@hasna/instructions 0.3.0

package/dist/mcp/index.js

@@ -0,0 +1,2591 @@
+#!/usr/bin/env bun
+// @bun
+var __defProp = Object.defineProperty;
+var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = import.meta.require;
+
+// src/db/database.ts
+var exports_database = {};
+__export(exports_database, {
+  uuid: () => uuid,
+  slugify: () => slugify,
+  resetDatabase: () => resetDatabase,
+  now: () => now,
+  getDatabase: () => getDatabase
+});
+import { Database } from "bun:sqlite";
+import { cpSync, existsSync, mkdirSync, statSync } from "fs";
+import { join } from "path";
+import { randomUUID } from "crypto";
+function getDbPath() {
+  if (process.env["HASNA_CONFIGS_DB_PATH"]) {
+    return process.env["HASNA_CONFIGS_DB_PATH"];
+  }
+  if (process.env["CONFIGS_DB_PATH"]) {
+    return process.env["CONFIGS_DB_PATH"];
+  }
+  migrateDotfile();
+  const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
+  const dir = join(home, ".hasna", "configs");
+  mkdirSync(dir, { recursive: true });
+  return join(dir, "configs.db");
+}
+function uuid() {
+  return randomUUID();
+}
+function now() {
+  return new Date().toISOString();
+}
+function slugify(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+}
+function getDatabase(path) {
+  if (_db)
+    return _db;
+  const dbPath = path || getDbPath();
+  const db = new Database(dbPath);
+  db.run("PRAGMA journal_mode = WAL");
+  db.run("PRAGMA foreign_keys = ON");
+  applyMigrations(db);
+  ensureFeedbackTable(db);
+  _db = db;
+  return db;
+}
+function resetDatabase() {
+  if (_db) {
+    try {
+      _db.close();
+    } catch {}
+  }
+  _db = null;
+}
+function applyMigrations(db) {
+  let currentVersion = 0;
+  try {
+    const row = db.query("SELECT version FROM schema_version ORDER BY version DESC LIMIT 1").get();
+    currentVersion = row?.version ?? 0;
+  } catch {
+    currentVersion = 0;
+  }
+  for (let i = currentVersion;i < MIGRATIONS.length; i++) {
+    db.exec(MIGRATIONS[i]);
+    db.run(`INSERT OR REPLACE INTO schema_version (version) VALUES (${i + 1})`);
+  }
+}
+function ensureFeedbackTable(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS feedback (
+      id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(16)))),
+      message TEXT NOT NULL,
+      email TEXT,
+      category TEXT DEFAULT 'general',
+      version TEXT,
+      machine_id TEXT,
+      created_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )
+  `);
+}
+function migrateDotfile() {
+  const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
+  const oldDirs = [join(home, ".open-configs"), join(home, ".configs")];
+  const newDir = join(home, ".hasna", "configs");
+  if (existsSync(newDir))
+    return;
+  for (const oldDir of oldDirs) {
+    if (!existsSync(oldDir))
+      continue;
+    try {
+      if (!statSync(oldDir).isDirectory())
+        continue;
+      mkdirSync(join(home, ".hasna"), { recursive: true });
+      cpSync(oldDir, newDir, { recursive: true, force: false });
+      return;
+    } catch {}
+  }
+}
+var MIGRATIONS, _db = null;
+var init_database = __esm(() => {
+  MIGRATIONS = [
+    `
+  CREATE TABLE IF NOT EXISTS configs (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL,
+    slug TEXT NOT NULL UNIQUE,
+    kind TEXT NOT NULL DEFAULT 'file',
+    category TEXT NOT NULL,
+    agent TEXT NOT NULL DEFAULT 'global',
+    target_path TEXT,
+    format TEXT NOT NULL DEFAULT 'text',
+    content TEXT NOT NULL DEFAULT '',
+    description TEXT,
+    tags TEXT NOT NULL DEFAULT '[]',
+    is_template INTEGER NOT NULL DEFAULT 0,
+    version INTEGER NOT NULL DEFAULT 1,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    synced_at TEXT
+  );
+
+  CREATE TABLE IF NOT EXISTS config_snapshots (
+    id TEXT PRIMARY KEY,
+    config_id TEXT NOT NULL REFERENCES configs(id) ON DELETE CASCADE,
+    content TEXT NOT NULL,
+    version INTEGER NOT NULL,
+    created_at TEXT NOT NULL
+  );
+
+  CREATE TABLE IF NOT EXISTS profiles (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL,
+    slug TEXT NOT NULL UNIQUE,
+    description TEXT,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+  );
+
+  CREATE TABLE IF NOT EXISTS profile_configs (
+    profile_id TEXT NOT NULL REFERENCES profiles(id) ON DELETE CASCADE,
+    config_id TEXT NOT NULL REFERENCES configs(id) ON DELETE CASCADE,
+    sort_order INTEGER NOT NULL DEFAULT 0,
+    PRIMARY KEY (profile_id, config_id)
+  );
+
+  CREATE TABLE IF NOT EXISTS machines (
+    id TEXT PRIMARY KEY,
+    hostname TEXT NOT NULL UNIQUE,
+    os TEXT,
+    last_applied_at TEXT,
+    created_at TEXT NOT NULL
+  );
+
+  CREATE TABLE IF NOT EXISTS schema_version (
+    version INTEGER PRIMARY KEY
+  );
+
+  INSERT OR IGNORE INTO schema_version (version) VALUES (1);
+  `,
+    `
+  ALTER TABLE profiles ADD COLUMN selectors TEXT NOT NULL DEFAULT '{}';
+  ALTER TABLE profiles ADD COLUMN variables TEXT NOT NULL DEFAULT '{}';
+  ALTER TABLE machines ADD COLUMN arch TEXT;
+  `,
+    `
+  ALTER TABLE configs ADD COLUMN outputs TEXT NOT NULL DEFAULT '[]';
+  `
+  ];
+});
+
+// src/types/index.ts
+var ConfigNotFoundError, ProfileNotFoundError, ConfigApplyError, TemplateRenderError;
+var init_types = __esm(() => {
+  ConfigNotFoundError = class ConfigNotFoundError extends Error {
+    constructor(id) {
+      super(`Config not found: ${id}`);
+      this.name = "ConfigNotFoundError";
+    }
+  };
+  ProfileNotFoundError = class ProfileNotFoundError extends Error {
+    constructor(id) {
+      super(`Profile not found: ${id}`);
+      this.name = "ProfileNotFoundError";
+    }
+  };
+  ConfigApplyError = class ConfigApplyError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "ConfigApplyError";
+    }
+  };
+  TemplateRenderError = class TemplateRenderError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "TemplateRenderError";
+    }
+  };
+});
+
+// src/db/configs.ts
+var exports_configs = {};
+__export(exports_configs, {
+  updateConfig: () => updateConfig,
+  listConfigs: () => listConfigs,
+  getConfigStats: () => getConfigStats,
+  getConfigById: () => getConfigById,
+  getConfig: () => getConfig,
+  deleteConfig: () => deleteConfig,
+  createConfig: () => createConfig
+});
+function rowToConfig(row) {
+  let outputs = [];
+  try {
+    const parsed = JSON.parse(row.outputs || "[]");
+    outputs = Array.isArray(parsed) ? parsed : [];
+  } catch {
+    outputs = [];
+  }
+  return {
+    ...row,
+    tags: JSON.parse(row.tags || "[]"),
+    outputs,
+    is_template: !!row.is_template,
+    kind: row.kind,
+    category: row.category,
+    agent: row.agent,
+    format: row.format
+  };
+}
+function uniqueSlug(name, db, excludeId) {
+  const base = slugify(name);
+  let slug = base;
+  let i = 1;
+  while (true) {
+    const existing = db.query("SELECT id FROM configs WHERE slug = ?").get(slug);
+    if (!existing || existing.id === excludeId)
+      return slug;
+    slug = `${base}-${i++}`;
+  }
+}
+function createConfig(input, db) {
+  const d = db || getDatabase();
+  const id = uuid();
+  const ts = now();
+  const slug = uniqueSlug(input.name, d);
+  const tags = JSON.stringify(input.tags || []);
+  const outputs = JSON.stringify(input.outputs || []);
+  d.run(`INSERT INTO configs (id, name, slug, kind, category, agent, target_path, outputs, format, content, description, tags, is_template, version, created_at, updated_at, synced_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?, NULL)`, [
+    id,
+    input.name,
+    slug,
+    input.kind ?? "file",
+    input.category,
+    input.agent ?? "global",
+    input.target_path ?? null,
+    outputs,
+    input.format ?? "text",
+    input.content,
+    input.description ?? null,
+    tags,
+    input.is_template ? 1 : 0,
+    ts,
+    ts
+  ]);
+  return getConfig(id, d);
+}
+function getConfig(idOrSlug, db) {
+  const d = db || getDatabase();
+  const row = d.query("SELECT * FROM configs WHERE id = ? OR slug = ?").get(idOrSlug, idOrSlug);
+  if (!row)
+    throw new ConfigNotFoundError(idOrSlug);
+  return rowToConfig(row);
+}
+function getConfigById(id, db) {
+  const d = db || getDatabase();
+  const row = d.query("SELECT * FROM configs WHERE id = ?").get(id);
+  if (!row)
+    throw new ConfigNotFoundError(id);
+  return rowToConfig(row);
+}
+function listConfigs(filter, db) {
+  const d = db || getDatabase();
+  const conditions = [];
+  const params = [];
+  if (filter?.category) {
+    conditions.push("category = ?");
+    params.push(filter.category);
+  }
+  if (filter?.agent) {
+    conditions.push("agent = ?");
+    params.push(filter.agent);
+  }
+  if (filter?.kind) {
+    conditions.push("kind = ?");
+    params.push(filter.kind);
+  }
+  if (filter?.is_template !== undefined) {
+    conditions.push("is_template = ?");
+    params.push(filter.is_template ? 1 : 0);
+  }
+  if (filter?.search) {
+    conditions.push("(name LIKE ? OR description LIKE ? OR content LIKE ?)");
+    const q = `%${filter.search}%`;
+    params.push(q, q, q);
+  }
+  if (filter?.tags && filter.tags.length > 0) {
+    const tagConditions = filter.tags.map(() => "tags LIKE ?").join(" OR ");
+    conditions.push(`(${tagConditions})`);
+    for (const tag of filter.tags)
+      params.push(`%"${tag}"%`);
+  }
+  const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+  const rows = d.query(`SELECT * FROM configs ${where} ORDER BY category, name`).all(...params);
+  return rows.map(rowToConfig);
+}
+function updateConfig(idOrSlug, input, db) {
+  const d = db || getDatabase();
+  const existing = getConfig(idOrSlug, d);
+  const ts = now();
+  const updates = ["updated_at = ?", "version = version + 1"];
+  const params = [ts];
+  if (input.name !== undefined) {
+    updates.push("name = ?", "slug = ?");
+    params.push(input.name, uniqueSlug(input.name, d, existing.id));
+  }
+  if (input.kind !== undefined) {
+    updates.push("kind = ?");
+    params.push(input.kind);
+  }
+  if (input.category !== undefined) {
+    updates.push("category = ?");
+    params.push(input.category);
+  }
+  if (input.agent !== undefined) {
+    updates.push("agent = ?");
+    params.push(input.agent);
+  }
+  if (input.target_path !== undefined) {
+    updates.push("target_path = ?");
+    params.push(input.target_path);
+  }
+  if (input.outputs !== undefined) {
+    updates.push("outputs = ?");
+    params.push(JSON.stringify(input.outputs));
+  }
+  if (input.format !== undefined) {
+    updates.push("format = ?");
+    params.push(input.format);
+  }
+  if (input.content !== undefined) {
+    updates.push("content = ?");
+    params.push(input.content);
+  }
+  if (input.description !== undefined) {
+    updates.push("description = ?");
+    params.push(input.description);
+  }
+  if (input.tags !== undefined) {
+    updates.push("tags = ?");
+    params.push(JSON.stringify(input.tags));
+  }
+  if (input.is_template !== undefined) {
+    updates.push("is_template = ?");
+    params.push(input.is_template ? 1 : 0);
+  }
+  if (input.synced_at !== undefined) {
+    updates.push("synced_at = ?");
+    params.push(input.synced_at);
+  }
+  params.push(existing.id);
+  d.run(`UPDATE configs SET ${updates.join(", ")} WHERE id = ?`, params);
+  return getConfigById(existing.id, d);
+}
+function deleteConfig(idOrSlug, db) {
+  const d = db || getDatabase();
+  const existing = getConfig(idOrSlug, d);
+  d.run("DELETE FROM configs WHERE id = ?", [existing.id]);
+}
+function getConfigStats(db) {
+  const d = db || getDatabase();
+  const rows = d.query("SELECT category, COUNT(*) as count FROM configs GROUP BY category").all();
+  const stats = { total: 0 };
+  for (const row of rows) {
+    stats[row.category] = row.count;
+    stats["total"] = (stats["total"] || 0) + row.count;
+  }
+  return stats;
+}
+var init_configs = __esm(() => {
+  init_types();
+  init_database();
+});
+
+// src/db/snapshots.ts
+function createSnapshot(configId, content, version, db) {
+  const d = db || getDatabase();
+  const id = uuid();
+  const ts = now();
+  d.run("INSERT INTO config_snapshots (id, config_id, content, version, created_at) VALUES (?, ?, ?, ?, ?)", [id, configId, content, version, ts]);
+  return { id, config_id: configId, content, version, created_at: ts };
+}
+function listSnapshots(configId, db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM config_snapshots WHERE config_id = ? ORDER BY version DESC").all(configId);
+}
+function getSnapshotByVersion(configId, version, db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM config_snapshots WHERE config_id = ? AND version = ?").get(configId, version);
+}
+var init_snapshots = __esm(() => {
+  init_database();
+});
+
+// src/lib/template.ts
+var exports_template = {};
+__export(exports_template, {
+  renderTemplate: () => renderTemplate,
+  parseTemplateVars: () => parseTemplateVars,
+  isTemplate: () => isTemplate,
+  extractTemplateVars: () => extractTemplateVars
+});
+function parseTemplateVars(content) {
+  const names = new Set;
+  let match;
+  VAR_PATTERN.lastIndex = 0;
+  while ((match = VAR_PATTERN.exec(content)) !== null) {
+    names.add(match[1]);
+  }
+  return Array.from(names);
+}
+function extractTemplateVars(content) {
+  const vars = new Map;
+  let match;
+  VAR_PATTERN.lastIndex = 0;
+  while ((match = VAR_PATTERN.exec(content)) !== null) {
+    const name = match[1];
+    const description = match[2] ?? null;
+    if (!vars.has(name)) {
+      vars.set(name, { name, description, required: true });
+    }
+  }
+  return Array.from(vars.values());
+}
+function renderTemplate(content, vars) {
+  const missing = [];
+  VAR_PATTERN.lastIndex = 0;
+  let match;
+  while ((match = VAR_PATTERN.exec(content)) !== null) {
+    const name = match[1];
+    if (!(name in vars))
+      missing.push(name);
+  }
+  if (missing.length > 0) {
+    throw new TemplateRenderError(`Missing required template variables: ${missing.join(", ")}`);
+  }
+  VAR_PATTERN.lastIndex = 0;
+  return content.replace(VAR_PATTERN, (_match, name) => vars[name] ?? "");
+}
+function isTemplate(content) {
+  VAR_PATTERN.lastIndex = 0;
+  return VAR_PATTERN.test(content);
+}
+var VAR_PATTERN;
+var init_template = __esm(() => {
+  init_types();
+  VAR_PATTERN = /\{\{([A-Z0-9_]+)(?::([^}]*))?\}\}/g;
+});
+
+// src/lib/machine.ts
+import { arch as currentArch, homedir, hostname as currentHostname, type as currentOsType } from "os";
+import { existsSync as existsSync2 } from "fs";
+import { join as join2 } from "path";
+function normalizeOsFamily(os) {
+  const value = (os ?? "").trim().toLowerCase();
+  if (value === "darwin" || value === "macos" || value === "mac" || value === "osx")
+    return "macos";
+  if (value === "linux")
+    return "linux";
+  if (value === "windows_nt" || value === "windows" || value === "win32")
+    return "windows";
+  return value || "unknown";
+}
+function detectMachineContext(overrides = {}) {
+  const homeDir = overrides.home_dir ?? process.env["CONFIGS_HOME"] ?? process.env["HOME"] ?? homedir();
+  const os = overrides.os ?? currentOsType();
+  const osFamily = normalizeOsFamily(os);
+  const bunBinDir = overrides.bun_bin_dir ?? join2(homeDir, ".bun", "bin");
+  const defaultBunPath = osFamily === "macos" && existsSync2(BREW_BUN_PATH) ? BREW_BUN_PATH : join2(bunBinDir, "bun");
+  return {
+    id: "current-machine",
+    hostname: overrides.hostname ?? currentHostname(),
+    os,
+    arch: overrides.arch ?? currentArch(),
+    last_applied_at: null,
+    created_at: "",
+    os_family: osFamily,
+    home_dir: homeDir,
+    workspace_root: overrides.workspace_root ?? join2(homeDir, osFamily === "macos" ? "Workspace" : "workspace"),
+    bun_bin_dir: bunBinDir,
+    bun_path: overrides.bun_path ?? defaultBunPath,
+    path_prefix: overrides.path_prefix ?? (osFamily === "macos" ? `${join2("/opt", "homebrew", "bin")}:${bunBinDir}` : bunBinDir)
+  };
+}
+function machineContextToVariables(machine) {
+  return {
+    HOSTNAME: machine.hostname,
+    OS: machine.os ?? "",
+    OS_FAMILY: machine.os_family,
+    ARCH: machine.arch ?? "",
+    HOME_DIR: machine.home_dir,
+    WORKSPACE_ROOT: machine.workspace_root,
+    BUN_BIN_DIR: machine.bun_bin_dir,
+    BUN_PATH: machine.bun_path,
+    PATH_PREFIX: machine.path_prefix
+  };
+}
+function resolveProfileVariables(profile, machine) {
+  const base = machineContextToVariables(machine);
+  const raw = profile?.variables ?? {};
+  const resolved = { ...base };
+  const pending = new Map(Object.entries(raw));
+  const maxPasses = Math.max(4, pending.size * 2);
+  for (let pass = 0;pass < maxPasses && pending.size > 0; pass++) {
+    let progress = false;
+    for (const [key, value] of [...pending.entries()]) {
+      try {
+        resolved[key] = isTemplate(value) ? renderTemplate(value, resolved) : value;
+        pending.delete(key);
+        progress = true;
+      } catch {}
+    }
+    if (!progress)
+      break;
+  }
+  for (const [key, value] of pending.entries()) {
+    resolved[key] = value;
+  }
+  return resolved;
+}
+function replaceKnownPath(content, actual, placeholder) {
+  if (!actual || actual === placeholder)
+    return content;
+  return content.split(actual).join(placeholder);
+}
+function templateizeMachineContent(content, machine) {
+  const vars = machineContextToVariables(machine);
+  let next = content;
+  const replacements = [
+    [vars["WORKSPACE_ROOT"], "{{WORKSPACE_ROOT}}"],
+    [vars["BUN_PATH"], "{{BUN_PATH}}"],
+    [vars["BUN_BIN_DIR"], "{{BUN_BIN_DIR}}"],
+    [vars["PATH_PREFIX"], "{{PATH_PREFIX}}"],
+    [vars["HOME_DIR"], "{{HOME_DIR}}"]
+  ];
+  for (const [actual, placeholder] of replacements) {
+    next = replaceKnownPath(next, actual, placeholder);
+  }
+  next = next.replace(/~\/workspace/g, "{{WORKSPACE_ROOT}}").replace(/~\/Workspace/g, "{{WORKSPACE_ROOT}}").replace(/\/opt\/homebrew\/bin\/bun/g, "{{BUN_PATH}}");
+  return { content: next, changed: next !== content };
+}
+function renderMachineAwareContent(content, variables) {
+  return isTemplate(content) ? renderTemplate(content, variables) : content;
+}
+var BREW_BUN_PATH = "/opt/homebrew/bin/bun";
+var init_machine = __esm(() => {
+  init_template();
+});
+
+// src/lib/transforms.ts
+import { basename, extname } from "path";
+function ensureTrailingNewline(content) {
+  return content.endsWith(`
+`) ? content : `${content}
+`;
+}
+function yamlQuote(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+function headingLevel(line) {
+  const m = line.match(/^(#{1,6})\s+/);
+  return m ? m[1].length : null;
+}
+function stripClaudeOnlySections(content) {
+  const withoutMarkedBlocks = content.replace(/<!--\s*claude-only:start\s*-->[\s\S]*?<!--\s*claude-only:end\s*-->/gi, "");
+  const lines = withoutMarkedBlocks.split(`
+`);
+  const kept = [];
+  let droppingUntilLevel = null;
+  for (const line of lines) {
+    const level = headingLevel(line);
+    if (level !== null && droppingUntilLevel !== null && level <= droppingUntilLevel) {
+      droppingUntilLevel = null;
+    }
+    if (droppingUntilLevel !== null)
+      continue;
+    if (/^#{1,6}\s+.*claude(?:\s+code)?[-\s]+only\b/i.test(line)) {
+      droppingUntilLevel = level ?? 1;
+      continue;
+    }
+    kept.push(line);
+  }
+  return kept.join(`
+`).replace(/\n{3,}/g, `
+
+`).trim();
+}
+function isClaudeRuleConfig(source, candidate) {
+  if (candidate.id === source.id)
+    return false;
+  if (candidate.agent !== "claude" || candidate.category !== "rules")
+    return false;
+  return !!candidate.target_path?.includes("/rules/");
+}
+function ruleLabel(config) {
+  const file = config.target_path ? basename(config.target_path) : config.name;
+  return file.replace(/\.(md|mdc|markdown)$/i, "");
+}
+function claudeRules(source, context) {
+  return (context.configs ?? []).filter((config) => isClaudeRuleConfig(source, config)).sort((a, b) => (a.target_path ?? a.name).localeCompare(b.target_path ?? b.name));
+}
+function flattenWithRules(source, context) {
+  const parts = [stripClaudeOnlySections(source.content)];
+  const rules = claudeRules(source, context).map((rule) => ({ rule, content: stripClaudeOnlySections(rule.content) })).filter(({ content }) => Boolean(content)).map(({ rule, content }) => `### ${ruleLabel(rule)}
+
+${content}`);
+  if (rules.length > 0) {
+    parts.push(`## Rules
+
+${rules.join(`
+
+`)}`);
+  }
+  return ensureTrailingNewline(parts.filter(Boolean).join(`
+
+`));
+}
+function buildCodexAgentsMd(source, context = {}) {
+  return flattenWithRules(source, context);
+}
+function buildOpenCodeAgentsMd(source, context = {}) {
+  return flattenWithRules(source, context);
+}
+function buildCursorMdc(source) {
+  const stem = source.target_path ? basename(source.target_path, extname(source.target_path)) : source.slug;
+  const description = source.name || stem;
+  return ensureTrailingNewline([
+    "---",
+    `description: ${yamlQuote(description)}`,
+    'globs: ["**/*"]',
+    "alwaysApply: true",
+    "---",
+    "",
+    stripClaudeOnlySections(source.content)
+  ].join(`
+`));
+}
+function transformSkillContent(content) {
+  return ensureTrailingNewline(content.split(`
+`).filter((line) => !/^\s*user_invocable\s*:/i.test(line)).join(`
+`).replace(/\bAgent tool\b/g, "delegate through the available MCP or agent orchestration tools").replace(/\bTodoWrite\b/g, "track tasks with the agent's native task mechanism").replace(/\bRead\/Edit\b/g, "read and edit files with the available filesystem tools").replace(/\bRead\b/g, "read files with the available filesystem tools").replace(/\bEdit\b/g, "edit files with the available filesystem tools").replace(/\bBash\b/g, "run shell commands with the available terminal tool").trim());
+}
+function applyTransform(source, output, context = {}) {
+  switch (output.transform) {
+    case "passthrough":
+    case "claude-passthrough":
+      return ensureTrailingNewline(source.content);
+    case "codex-flat":
+      return buildCodexAgentsMd(source, context);
+    case "opencode-flat":
+      return buildOpenCodeAgentsMd(source, context);
+    case "cursor-mdc":
+      return buildCursorMdc(source);
+    case "skill-neutral":
+      return transformSkillContent(source.content);
+  }
+}
+var init_transforms = () => {};
+
+// src/lib/apply.ts
+var exports_apply = {};
+__export(exports_apply, {
+  normalizeTargetPath: () => normalizeTargetPath,
+  getConfigHome: () => getConfigHome,
+  expandPath: () => expandPath,
+  applyConfigs: () => applyConfigs,
+  applyConfig: () => applyConfig
+});
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync, realpathSync, writeFileSync } from "fs";
+import { basename as basename2, dirname, resolve } from "path";
+import { homedir as homedir2 } from "os";
+function getConfigHome() {
+  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir2();
+}
+function expandPath(p) {
+  if (p.startsWith("~/")) {
+    return resolve(getConfigHome(), p.slice(2));
+  }
+  return resolve(p);
+}
+function normalizeTargetPath(p) {
+  const expanded = expandPath(p);
+  try {
+    return realpathSync(expanded);
+  } catch {
+    let current = expanded;
+    const missingSegments = [];
+    while (true) {
+      if (existsSync3(current)) {
+        try {
+          return resolve(realpathSync(current), ...missingSegments);
+        } catch {
+          return expanded;
+        }
+      }
+      const parent = dirname(current);
+      const name = basename2(current);
+      if (parent === current)
+        return expanded;
+      missingSegments.unshift(name);
+      current = parent;
+    }
+  }
+}
+async function writeConfigResult(config, targetPath, content, opts, meta = {}) {
+  const renderedTargetPath = opts.vars ? renderMachineAwareContent(targetPath, opts.vars) : targetPath;
+  const renderedContent = opts.vars ? renderMachineAwareContent(content, opts.vars) : content;
+  const path = expandPath(renderedTargetPath);
+  const previousContent = existsSync3(path) ? readFileSync(path, "utf-8") : null;
+  const changed = previousContent !== renderedContent;
+  if (!opts.dryRun) {
+    const dir = dirname(path);
+    if (!existsSync3(dir)) {
+      mkdirSync2(dir, { recursive: true });
+    }
+    if (previousContent !== null && changed) {
+      const db = opts.db || getDatabase();
+      createSnapshot(config.id, previousContent, config.version, db);
+    }
+    writeFileSync(path, renderedContent, "utf-8");
+  }
+  return {
+    config_id: config.id,
+    path,
+    previous_content: previousContent,
+    new_content: renderedContent,
+    dry_run: opts.dryRun ?? false,
+    changed,
+    ...meta
+  };
+}
+function isGeneratedOutputTarget(config, configs) {
+  if (!config.target_path)
+    return false;
+  const targetPath = normalizeTargetPath(config.target_path);
+  return configs.some((candidate) => candidate.id !== config.id && candidate.outputs.some((output) => normalizeTargetPath(output.target_path) === targetPath));
+}
+async function applyConfig(config, opts = {}) {
+  const selectedOutputs = opts.outputAgent ? config.outputs.filter((output) => output.agent === opts.outputAgent) : config.outputs;
+  const shouldApplyPrimary = !opts.outputAgent || config.agent === opts.outputAgent;
+  if (config.kind === "reference" || (!config.target_path || !shouldApplyPrimary) && selectedOutputs.length === 0) {
+    throw new ConfigApplyError(`Config "${config.name}" is a reference (kind=reference) and has no target_path \u2014 cannot apply to disk.`);
+  }
+  const db = opts.db || getDatabase();
+  const contextConfigs = selectedOutputs.length > 0 || config.target_path ? listConfigs(undefined, db) : [config];
+  if (isGeneratedOutputTarget(config, contextConfigs)) {
+    throw new ConfigApplyError(`Config "${config.name}" targets a generated output path. Apply the canonical source config instead.`);
+  }
+  const outputResults = [];
+  for (const output of selectedOutputs) {
+    outputResults.push(await applyOutput(config, output, contextConfigs, opts));
+  }
+  let result;
+  if (config.target_path && shouldApplyPrimary) {
+    result = await writeConfigResult(config, config.target_path, config.content, opts);
+    result.outputs = outputResults;
+    result.changed = result.changed || outputResults.some((output) => output.changed);
+  } else {
+    result = {
+      ...outputResults[0],
+      outputs: outputResults.slice(1),
+      changed: outputResults.some((output) => output.changed)
+    };
+  }
+  if (!opts.dryRun) {
+    updateConfig(config.id, { synced_at: now() }, db);
+  }
+  return result;
+}
+async function applyOutput(config, output, contextConfigs, opts) {
+  const content = applyTransform(config, output, { configs: contextConfigs });
+  return writeConfigResult(config, output.target_path, content, opts, {
+    agent: output.agent,
+    transform: output.transform
+  });
+}
+async function applyConfigs(configs, opts = {}) {
+  const results = [];
+  for (const config of configs) {
+    if (config.kind === "reference")
+      continue;
+    results.push(await applyConfig(config, opts));
+  }
+  return results;
+}
+var init_apply = __esm(() => {
+  init_types();
+  init_database();
+  init_configs();
+  init_snapshots();
+  init_machine();
+  init_transforms();
+});
+
+// src/lib/redact.ts
+var exports_redact = {};
+__export(exports_redact, {
+  scanSecrets: () => scanSecrets,
+  redactContent: () => redactContent,
+  hasSecrets: () => hasSecrets
+});
+function redactShell(content) {
+  const redacted = [];
+  const lines = content.split(`
+`);
+  const out = [];
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i];
+    const m = line.match(/^(\s*(?:export\s+)?)([A-Z][A-Z0-9_]*)(\s*=\s*)(['"]?)(.+?)\4\s*$/);
+    if (m) {
+      const [, prefix, key, eq, quote, value] = m;
+      if (shouldRedactKeyValue(key, value)) {
+        const reason = reasonFor(key, value);
+        redacted.push({ varName: key, line: i + 1, reason });
+        out.push(`${prefix}${key}${eq}${quote}{{${key}}}${quote}`);
+        continue;
+      }
+    }
+    out.push(line);
+  }
+  return { content: out.join(`
+`), redacted, isTemplate: redacted.length > 0 };
+}
+function redactJson(content) {
+  const redacted = [];
+  const lines = content.split(`
+`);
+  const out = [];
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i];
+    const m = line.match(/^(\s*"([^"]+)"\s*:\s*)"([^"]+)"(,?)(\s*)$/);
+    if (m) {
+      const [, prefix, key, value, comma, trail] = m;
+      if (shouldRedactKeyValue(key, value)) {
+        const varName = key.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+        redacted.push({ varName, line: i + 1, reason: reasonFor(key, value) });
+        out.push(`${prefix}"{{${varName}}}"${comma}${trail}`);
+        continue;
+      }
+    }
+    let newLine = line;
+    for (const { re, reason } of VALUE_PATTERNS) {
+      newLine = newLine.replace(re, (match) => {
+        const varName = `REDACTED_${reason.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
+        redacted.push({ varName, line: i + 1, reason });
+        return `{{${varName}}}`;
+      });
+    }
+    out.push(newLine);
+  }
+  return { content: out.join(`
+`), redacted, isTemplate: redacted.length > 0 };
+}
+function redactToml(content) {
+  const redacted = [];
+  const lines = content.split(`
+`);
+  const out = [];
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i];
+    const m = line.match(/^(\s*)([a-zA-Z][a-zA-Z0-9_\-]*)(\s*=\s*)(['"]?)(.+?)\4\s*$/);
+    if (m) {
+      const [, indent, key, eq, quote, value] = m;
+      if (shouldRedactKeyValue(key, value)) {
+        const varName = key.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+        redacted.push({ varName, line: i + 1, reason: reasonFor(key, value) });
+        out.push(`${indent}${key}${eq}${quote}{{${varName}}}${quote}`);
+        continue;
+      }
+    }
+    out.push(line);
+  }
+  return { content: out.join(`
+`), redacted, isTemplate: redacted.length > 0 };
+}
+function redactIni(content) {
+  const redacted = [];
+  const lines = content.split(`
+`);
+  const out = [];
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i];
+    const authM = line.match(/^(\/\/[^:]+:_authToken=)(.+)$/);
+    if (authM && !authM[2].startsWith("{{")) {
+      redacted.push({ varName: "NPM_AUTH_TOKEN", line: i + 1, reason: "npm auth token" });
+      out.push(`${authM[1]}{{NPM_AUTH_TOKEN}}`);
+      continue;
+    }
+    const m = line.match(/^(\s*)([a-zA-Z][a-zA-Z0-9_\-]*)(\s*=\s*)(.+?)\s*$/);
+    if (m) {
+      const [, indent, key, eq, value] = m;
+      if (shouldRedactKeyValue(key, value)) {
+        const varName = key.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+        redacted.push({ varName, line: i + 1, reason: reasonFor(key, value) });
+        out.push(`${indent}${key}${eq}{{${varName}}}`);
+        continue;
+      }
+    }
+    out.push(line);
+  }
+  return { content: out.join(`
+`), redacted, isTemplate: redacted.length > 0 };
+}
+function redactGeneric(content) {
+  const redacted = [];
+  const lines = content.split(`
+`);
+  const out = [];
+  for (let i = 0;i < lines.length; i++) {
+    let line = lines[i];
+    for (const { re, reason } of VALUE_PATTERNS) {
+      line = line.replace(re, (match) => {
+        const varName = reason.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+        redacted.push({ varName, line: i + 1, reason });
+        return `{{${varName}}}`;
+      });
+    }
+    out.push(line);
+  }
+  return { content: out.join(`
+`), redacted, isTemplate: redacted.length > 0 };
+}
+function shouldRedactKeyValue(key, value) {
+  if (!value || value.startsWith("{{"))
+    return false;
+  if (value.length < MIN_SECRET_VALUE_LEN)
+    return false;
+  if (/^(true|false|yes|no|on|off|null|undefined|\d+)$/i.test(value))
+    return false;
+  if (SECRET_KEY_PATTERN.test(key))
+    return true;
+  for (const { re } of VALUE_PATTERNS) {
+    if (re.test(value))
+      return true;
+  }
+  return false;
+}
+function reasonFor(key, value) {
+  if (SECRET_KEY_PATTERN.test(key))
+    return `secret key name: ${key}`;
+  for (const { re, reason } of VALUE_PATTERNS) {
+    if (re.test(value))
+      return reason;
+  }
+  return "secret value pattern";
+}
+function redactContent(content, format) {
+  switch (format) {
+    case "shell":
+      return redactShell(content);
+    case "json":
+      return redactJson(content);
+    case "toml":
+      return redactToml(content);
+    case "ini":
+      return redactIni(content);
+    default:
+      return redactGeneric(content);
+  }
+}
+function scanSecrets(content, format) {
+  const r = redactContent(content, format);
+  return r.redacted;
+}
+function hasSecrets(content, format) {
+  return scanSecrets(content, format).length > 0;
+}
+var SECRET_KEY_PATTERN, VALUE_PATTERNS, MIN_SECRET_VALUE_LEN = 8;
+var init_redact = __esm(() => {
+  SECRET_KEY_PATTERN = /^(.*_?API_?KEY|.*_?TOKEN|.*_?SECRET|.*_?PASSWORD|.*_?PASSWD|.*_?CREDENTIAL|.*_?AUTH(?:_TOKEN|_KEY|ORIZATION)?|.*_?PRIVATE_?KEY|.*_?ACCESS_?KEY|.*_?CLIENT_?SECRET|.*_?SIGNING_?KEY|.*_?ENCRYPTION_?KEY|.*_AUTH_TOKEN)$/i;
+  VALUE_PATTERNS = [
+    { re: /npm_[A-Za-z0-9]{36,}/, reason: "npm token" },
+    { re: /gh[pousr]_[A-Za-z0-9_]{36,}/, reason: "GitHub token" },
+    { re: /sk-ant-[A-Za-z0-9\-_]{40,}/, reason: "Anthropic API key" },
+    { re: /sk-[A-Za-z0-9]{48,}/, reason: "OpenAI API key" },
+    { re: /xoxb-[0-9]+-[A-Za-z0-9\-]+/, reason: "Slack bot token" },
+    { re: /AIza[0-9A-Za-z\-_]{35}/, reason: "Google API key" },
+    { re: /ey[A-Za-z0-9_\-]{20,}\.[A-Za-z0-9_\-]{20,}\./, reason: "JWT token" },
+    { re: /AKIA[0-9A-Z]{16}/, reason: "AWS access key" }
+  ];
+});
+
+// src/lib/sync.ts
+var exports_sync = {};
+__export(exports_sync, {
+  syncToDisk: () => syncToDisk,
+  syncToDir: () => syncToDir,
+  syncProject: () => syncProject,
+  syncKnown: () => syncKnown,
+  syncFromDir: () => syncFromDir,
+  diffConfig: () => diffConfig,
+  detectFormat: () => detectFormat,
+  detectCategory: () => detectCategory,
+  detectAgent: () => detectAgent,
+  PROJECT_CONFIG_FILES: () => PROJECT_CONFIG_FILES,
+  KNOWN_CONFIGS: () => KNOWN_CONFIGS,
+  CLAUDE_PROMPT_OUTPUTS: () => CLAUDE_PROMPT_OUTPUTS
+});
+import { existsSync as existsSync4, readdirSync, readFileSync as readFileSync2 } from "fs";
+import { basename as basename3, extname as extname2, join as join3 } from "path";
+function claudeRuleOutputs(fileName) {
+  const stem = basename3(fileName, extname2(fileName));
+  return [
+    { agent: "cursor", target_path: `~/.cursor/rules/${stem}.mdc`, transform: "cursor-mdc" }
+  ];
+}
+function normalizeOutputs(outputs) {
+  return outputs ?? [];
+}
+function outputsEqual(a, b) {
+  return JSON.stringify(normalizeOutputs(a)) === JSON.stringify(normalizeOutputs(b));
+}
+function outputOwnerIdsByTarget(configs) {
+  const owners = new Map;
+  for (const config of configs) {
+    for (const output of config.outputs) {
+      const targetPath = normalizeTargetPath(output.target_path);
+      const existing = owners.get(targetPath) ?? new Set;
+      existing.add(config.id);
+      owners.set(targetPath, existing);
+    }
+  }
+  return owners;
+}
+function isGeneratedOutputTarget2(config, owners) {
+  if (!config.target_path)
+    return false;
+  const ownerIds = owners.get(normalizeTargetPath(config.target_path));
+  return !!ownerIds && !ownerIds.has(config.id);
+}
+function hasClaudePromptSource() {
+  return existsSync4(expandPath("~/.claude/CLAUDE.md"));
+}
+function hasClaudeRuleSourceForCursorTarget(targetPath) {
+  const absoluteTargetPath = expandPath(targetPath);
+  const absolutePrefix = expandPath("~/.cursor/rules");
+  if (!absoluteTargetPath.startsWith(`${absolutePrefix}/`) || !absoluteTargetPath.endsWith(".mdc"))
+    return false;
+  const stem = basename3(absoluteTargetPath, ".mdc");
+  return existsSync4(expandPath(`~/.claude/rules/${stem}.md`)) || existsSync4(expandPath(`~/.claude/rules/${stem}.mdc`));
+}
+function isKnownGeneratedTargetPath(targetPath) {
+  const normalizedTargetPath = normalizeTargetPath(targetPath);
+  const promptTargets = new Set(CLAUDE_PROMPT_OUTPUTS.map((output) => normalizeTargetPath(output.target_path)));
+  if (promptTargets.has(normalizedTargetPath))
+    return hasClaudePromptSource();
+  return hasClaudeRuleSourceForCursorTarget(targetPath);
+}
+async function syncProject(opts) {
+  const d = opts.db || getDatabase();
+  const absDir = expandPath(opts.projectDir);
+  const projectName = absDir.split("/").pop() || "project";
+  const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
+  const allConfigs = listConfigs(undefined, d);
+  const machine = detectMachineContext();
+  for (const pf of PROJECT_CONFIG_FILES) {
+    const abs = join3(absDir, pf.file);
+    if (!existsSync4(abs))
+      continue;
+    try {
+      const rawContent = readFileSync2(abs, "utf-8");
+      if (rawContent.length > 500000) {
+        result.skipped.push(pf.file);
+        continue;
+      }
+      const redacted = redactContent(rawContent, pf.format);
+      const machineAware = templateizeMachineContent(redacted.content, machine);
+      const content = machineAware.content;
+      const isTemplate2 = redacted.isTemplate || machineAware.changed;
+      const name = `${projectName}/${pf.file}`;
+      const targetPath = abs.startsWith(getConfigHome()) ? abs.replace(getConfigHome(), "~") : abs;
+      const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-");
+      const existing = allConfigs.find((c) => c.target_path === targetPath || c.slug === slug);
+      if (!existing) {
+        if (!opts.dryRun)
+          createConfig({ name, category: pf.category, agent: pf.agent, format: pf.format, content, target_path: targetPath, is_template: isTemplate2 }, d);
+        result.added++;
+      } else if (existing.content !== content) {
+        if (!opts.dryRun)
+          updateConfig(existing.id, { content, is_template: isTemplate2 }, d);
+        result.updated++;
+      } else {
+        result.unchanged++;
+      }
+    } catch {
+      result.skipped.push(pf.file);
+    }
+  }
+  const rulesDir = join3(absDir, ".claude", "rules");
+  if (existsSync4(rulesDir)) {
+    const mdFiles = readdirSync(rulesDir).filter((f) => f.endsWith(".md") || f.endsWith(".mdc"));
+    for (const f of mdFiles) {
+      const abs = join3(rulesDir, f);
+      const raw = readFileSync2(abs, "utf-8");
+      const redacted = redactContent(raw, "markdown");
+      const machineAware = templateizeMachineContent(redacted.content, machine);
+      const content = machineAware.content;
+      const isTemplate2 = redacted.isTemplate || machineAware.changed;
+      const name = `${projectName}/rules/${f}`;
+      const targetPath = abs.startsWith(getConfigHome()) ? abs.replace(getConfigHome(), "~") : abs;
+      const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-");
+      const existing = allConfigs.find((c) => c.target_path === targetPath || c.slug === slug);
+      if (!existing) {
+        if (!opts.dryRun)
+          createConfig({ name, category: "rules", agent: "claude", format: "markdown", content, target_path: targetPath, is_template: isTemplate2 }, d);
+        result.added++;
+      } else if (existing.content !== content) {
+        if (!opts.dryRun)
+          updateConfig(existing.id, { content, is_template: isTemplate2 }, d);
+        result.updated++;
+      } else {
+        result.unchanged++;
+      }
+    }
+  }
+  return result;
+}
+async function syncKnown(opts = {}) {
+  const d = opts.db || getDatabase();
+  const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
+  const home = getConfigHome();
+  const machine = detectMachineContext();
+  let targets = KNOWN_CONFIGS;
+  if (opts.agent)
+    targets = targets.filter((k) => k.agent === opts.agent);
+  if (opts.category)
+    targets = targets.filter((k) => k.category === opts.category);
+  const allConfigs = listConfigs(undefined, d);
+  const existingOutputOwners = outputOwnerIdsByTarget(allConfigs);
+  for (const known of targets) {
+    if (known.rulesDir) {
+      const absDir = expandPath(known.rulesDir);
+      if (!existsSync4(absDir)) {
+        result.skipped.push(known.rulesDir);
+        continue;
+      }
+      const extensions = known.rulesExtensions ?? [".md", ".mdc"];
+      const ruleFiles = readdirSync(absDir).filter((f) => extensions.some((ext) => f.endsWith(ext)));
+      for (const f of ruleFiles) {
+        const abs2 = join3(absDir, f);
+        const targetPath = abs2.replace(home, "~");
+        if (existingOutputOwners.has(normalizeTargetPath(targetPath)) || isKnownGeneratedTargetPath(targetPath)) {
+          result.skipped.push(`${targetPath} (generated output)`);
+          continue;
+        }
+        const raw = readFileSync2(abs2, "utf-8");
+        const redacted = redactContent(raw, "markdown");
+        const machineAware = templateizeMachineContent(redacted.content, machine);
+        const content = machineAware.content;
+        const isTemplate2 = redacted.isTemplate || machineAware.changed;
+        const name = `${known.name}-${f}`;
+        const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-");
+        const existing = allConfigs.find((c) => c.target_path === targetPath || c.slug === slug);
+        const outputs = known.agent === "claude" ? claudeRuleOutputs(f) : known.outputs;
+        if (!existing) {
+          if (!opts.dryRun)
+            createConfig({ name, category: known.category, agent: known.agent, format: "markdown", content, target_path: targetPath, is_template: isTemplate2, outputs }, d);
+          result.added++;
+        } else if (existing.content !== content) {
+          if (!opts.dryRun)
+            updateConfig(existing.id, { content, is_template: isTemplate2, outputs }, d);
+          result.updated++;
+        } else if (!outputsEqual(existing.outputs, outputs)) {
+          if (!opts.dryRun)
+            updateConfig(existing.id, { outputs }, d);
+          result.updated++;
+        } else {
+          result.unchanged++;
+        }
+      }
+      continue;
+    }
+    const abs = expandPath(known.path);
+    if (!existsSync4(abs)) {
+      result.skipped.push(known.path);
+      continue;
+    }
+    try {
+      const rawContent = readFileSync2(abs, "utf-8");
+      if (rawContent.length > 500000) {
+        result.skipped.push(known.path + " (too large)");
+        continue;
+      }
+      const fmt = known.format ?? detectFormat(abs);
+      const redacted = redactContent(rawContent, fmt);
+      const machineAware = templateizeMachineContent(redacted.content, machine);
+      const content = machineAware.content;
+      const isTemplate2 = redacted.isTemplate || machineAware.changed;
+      const targetPath = abs.replace(home, "~");
+      if (existingOutputOwners.has(normalizeTargetPath(targetPath)) || isKnownGeneratedTargetPath(targetPath)) {
+        result.skipped.push(`${targetPath} (generated output)`);
+        continue;
+      }
+      const existing = allConfigs.find((c) => c.target_path === targetPath || c.slug === known.name);
+      if (!existing) {
+        if (!opts.dryRun) {
+          createConfig({
+            name: known.name,
+            category: known.category,
+            agent: known.agent,
+            format: fmt,
+            content,
+            target_path: known.kind === "reference" ? null : targetPath,
+            kind: known.kind ?? "file",
+            description: known.description,
+            is_template: isTemplate2,
+            outputs: known.outputs
+          }, d);
+        }
+        result.added++;
+      } else if (existing.content !== content) {
+        if (!opts.dryRun)
+          updateConfig(existing.id, { content, is_template: isTemplate2, outputs: known.outputs }, d);
+        result.updated++;
+      } else if (!outputsEqual(existing.outputs, known.outputs)) {
+        if (!opts.dryRun)
+          updateConfig(existing.id, { outputs: known.outputs }, d);
+        result.updated++;
+      } else {
+        result.unchanged++;
+      }
+    } catch {
+      result.skipped.push(known.path);
+    }
+  }
+  return result;
+}
+async function syncToDisk(opts = {}) {
+  const d = opts.db || getDatabase();
+  const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
+  const allFileConfigs = listConfigs({ kind: "file", ...opts.category ? { category: opts.category } : {} }, d);
+  const outputOwners = outputOwnerIdsByTarget(allFileConfigs);
+  let configs = allFileConfigs.filter((config) => {
+    return !isGeneratedOutputTarget2(config, outputOwners);
+  }).filter((config) => {
+    if (!opts.agent)
+      return true;
+    return config.agent === opts.agent || config.outputs.some((output) => output.agent === opts.agent);
+  });
+  for (const config of configs) {
+    if (!config.target_path && config.outputs.length === 0)
+      continue;
+    try {
+      const r = await applyConfig(config, { dryRun: opts.dryRun, db: d, outputAgent: opts.agent });
+      r.changed ? result.updated++ : result.unchanged++;
+    } catch {
+      result.skipped.push(config.target_path ?? config.id);
+    }
+  }
+  return result;
+}
+function buildDiff(expectedContent, targetPath) {
+  const path = expandPath(targetPath);
+  if (!existsSync4(path))
+    return `(file not found on disk: ${path})`;
+  const diskContent = readFileSync2(path, "utf-8");
+  if (diskContent === expectedContent)
+    return "(no diff \u2014 identical)";
+  const stored = expectedContent.split(`
+`);
+  const disk = diskContent.split(`
+`);
+  const lines = [`--- stored (DB)`, `+++ disk (${path})`];
+  const maxLen = Math.max(stored.length, disk.length);
+  for (let i = 0;i < maxLen; i++) {
+    const s = stored[i];
+    const dk = disk[i];
+    if (s === dk) {
+      if (s !== undefined)
+        lines.push(` ${s}`);
+    } else {
+      if (s !== undefined)
+        lines.push(`-${s}`);
+      if (dk !== undefined)
+        lines.push(`+${dk}`);
+    }
+  }
+  return lines.join(`
+`);
+}
+function diffConfig(config, opts = {}) {
+  if (!config.target_path && config.outputs.length === 0)
+    return "(reference \u2014 no target path)";
+  const diffs = [];
+  const db = opts.db || getDatabase();
+  const contextConfigs = config.outputs.length > 0 || config.target_path ? listConfigs(undefined, db) : [config];
+  if (isGeneratedOutputTarget2(config, outputOwnerIdsByTarget(contextConfigs))) {
+    return "(generated output \u2014 managed by fan-out)";
+  }
+  if (config.target_path) {
+    const diff = buildDiff(config.content, config.target_path);
+    if (!diff.includes("no diff"))
+      diffs.push(diff);
+  }
+  if (config.outputs.length > 0) {
+    for (const output of config.outputs) {
+      const expected = applyTransform(config, output, { configs: contextConfigs });
+      const diff = buildDiff(expected, output.target_path);
+      if (!diff.includes("no diff"))
+        diffs.push(diff);
+    }
+  }
+  return diffs.length > 0 ? diffs.join(`
+
+`) : "(no diff \u2014 identical)";
+}
+function detectCategory(filePath) {
+  const p = filePath.toLowerCase().replace(getConfigHome(), "~");
+  if (p.includes("/.claude/rules/") || p.includes("/.cursor/rules/") || p.endsWith("claude.md") || p.endsWith("agents.md") || p.endsWith("codewith.md") || p.endsWith("gemini.md") || p.endsWith(".mdc"))
+    return "rules";
+  if (p.includes("/.claude/") || p.includes("/.codex/") || p.includes("/.gemini/") || p.includes("/.cursor/") || p.includes("/.config/opencode/") || p.includes("/.codewith/") || p.includes("/.config/aicopilot/"))
+    return "agent";
+  if (p.includes(".mcp.json") || p.includes("mcp"))
+    return "mcp";
+  if (p.includes(".zshrc") || p.includes(".zprofile") || p.includes(".bashrc") || p.includes(".bash_profile"))
+    return "shell";
+  if (p.includes(".gitconfig") || p.includes(".gitignore"))
+    return "git";
+  if (p.includes(".npmrc") || p.includes("tsconfig") || p.includes("bunfig"))
+    return "tools";
+  if (p.includes(".secrets"))
+    return "secrets_schema";
+  return "tools";
+}
+function detectAgent(filePath) {
+  const p = filePath.toLowerCase().replace(getConfigHome(), "~");
+  if (p.includes("/.claude/") || p.endsWith("claude.md"))
+    return "claude";
+  if (p.includes("/.config/opencode/"))
+    return "opencode";
+  if (p.includes("/.cursor/") || p.endsWith(".mdc"))
+    return "cursor";
+  if (p.includes("/.codewith/") || p.endsWith("codewith.md"))
+    return "codewith";
+  if (p.includes("/.config/aicopilot/"))
+    return "aicopilot";
+  if (p.includes("/.codex/") || p.endsWith("agents.md"))
+    return "codex";
+  if (p.includes("/.gemini/") || p.endsWith("gemini.md"))
+    return "gemini";
+  if (p.includes(".zshrc") || p.includes(".zprofile") || p.includes(".bashrc"))
+    return "zsh";
+  if (p.includes(".gitconfig") || p.includes(".gitignore"))
+    return "git";
+  if (p.includes(".npmrc"))
+    return "npm";
+  return "global";
+}
+function detectFormat(filePath) {
+  const ext = extname2(filePath).toLowerCase();
+  if (ext === ".json")
+    return "json";
+  if (ext === ".toml")
+    return "toml";
+  if (ext === ".yaml" || ext === ".yml")
+    return "yaml";
+  if (ext === ".md" || ext === ".mdc" || ext === ".markdown")
+    return "markdown";
+  if (ext === ".ini" || ext === ".cfg")
+    return "ini";
+  return "text";
+}
+var CLAUDE_PROMPT_OUTPUTS, KNOWN_CONFIGS, PROJECT_CONFIG_FILES;
+var init_sync = __esm(() => {
+  init_database();
+  init_configs();
+  init_apply();
+  init_redact();
+  init_machine();
+  init_transforms();
+  init_sync_dir();
+  CLAUDE_PROMPT_OUTPUTS = [
+    { agent: "codex", target_path: "~/.codex/AGENTS.md", transform: "codex-flat" },
+    { agent: "codewith", target_path: "~/.codewith/CODEWITH.md", transform: "codex-flat" },
+    { agent: "opencode", target_path: "~/.config/opencode/AGENTS.md", transform: "opencode-flat" },
+    { agent: "aicopilot", target_path: "~/.config/aicopilot/AGENTS.md", transform: "opencode-flat" },
+    { agent: "cursor", target_path: "~/.cursor/rules/claude.mdc", transform: "cursor-mdc" }
+  ];
+  KNOWN_CONFIGS = [
+    { path: "~/.claude/CLAUDE.md", name: "claude-claude-md", category: "rules", agent: "claude", format: "markdown", outputs: CLAUDE_PROMPT_OUTPUTS },
+    { path: "~/.claude/settings.json", name: "claude-settings", category: "agent", agent: "claude", format: "json" },
+    { path: "~/.claude/settings.local.json", name: "claude-settings-local", category: "agent", agent: "claude", format: "json" },
+    { path: "~/.claude/keybindings.json", name: "claude-keybindings", category: "agent", agent: "claude", format: "json", optional: true },
+    { path: "~/.claude/rules", name: "claude-rules", category: "rules", agent: "claude", rulesDir: "~/.claude/rules", rulesExtensions: [".md", ".mdc"] },
+    { path: "~/.codex/config.toml", name: "codex-config", category: "agent", agent: "codex", format: "toml" },
+    { path: "~/.codex/AGENTS.md", name: "codex-agents-md", category: "rules", agent: "codex", format: "markdown" },
+    { path: "~/.config/opencode/AGENTS.md", name: "opencode-agents-md", category: "rules", agent: "opencode", format: "markdown", optional: true },
+    { path: "~/.config/opencode/opencode.json", name: "opencode-config", category: "mcp", agent: "opencode", format: "json", optional: true, description: "OpenCode config (includes Skills MCP server entries)" },
+    { path: "~/.cursor/rules", name: "cursor-rules", category: "rules", agent: "cursor", rulesDir: "~/.cursor/rules", rulesExtensions: [".md", ".mdc"] },
+    { path: "~/.cursor/mcp.json", name: "cursor-mcp", category: "mcp", agent: "cursor", format: "json", optional: true, description: "Cursor MCP config (includes Skills MCP server entries)" },
+    { path: "~/.codewith/CODEWITH.md", name: "codewith-codewith-md", category: "rules", agent: "codewith", format: "markdown", optional: true },
+    { path: "~/.codewith/config.toml", name: "codewith-config", category: "mcp", agent: "codewith", format: "toml", optional: true, description: "codewith config (Codex fork, includes Skills MCP server entries)" },
+    { path: "~/.config/aicopilot/AGENTS.md", name: "aicopilot-agents-md", category: "rules", agent: "aicopilot", format: "markdown", optional: true },
+    { path: "~/.config/aicopilot/opencode.json", name: "aicopilot-config", category: "mcp", agent: "aicopilot", format: "json", optional: true, description: "AI Copilot config (OpenCode fork, includes Skills MCP server entries)" },
+    { path: "~/.gemini/settings.json", name: "gemini-settings", category: "agent", agent: "gemini", format: "json" },
+    { path: "~/.gemini/GEMINI.md", name: "gemini-gemini-md", category: "rules", agent: "gemini", format: "markdown", optional: true },
+    { path: "~/.claude.json", name: "claude-json", category: "mcp", agent: "claude", format: "json", description: "Claude Code global config (includes MCP server entries)" },
+    { path: "~/.zshrc", name: "zshrc", category: "shell", agent: "zsh" },
+    { path: "~/.zprofile", name: "zprofile", category: "shell", agent: "zsh", optional: true },
+    { path: "~/.bashrc", name: "bashrc", category: "shell", agent: "zsh", optional: true },
+    { path: "~/.bash_profile", name: "bash-profile", category: "shell", agent: "zsh", optional: true },
+    { path: "~/.gitconfig", name: "gitconfig", category: "git", agent: "git", format: "ini" },
+    { path: "~/.gitignore_global", name: "gitignore-global", category: "git", agent: "git", optional: true },
+    { path: "~/.npmrc", name: "npmrc", category: "tools", agent: "npm", format: "ini" },
+    { path: "~/.bunfig.toml", name: "bunfig", category: "tools", agent: "global", format: "toml", optional: true }
+  ];
+  PROJECT_CONFIG_FILES = [
+    { file: "CLAUDE.md", category: "rules", agent: "claude", format: "markdown" },
+    { file: ".claude/settings.json", category: "agent", agent: "claude", format: "json" },
+    { file: ".claude/settings.local.json", category: "agent", agent: "claude", format: "json" },
+    { file: ".mcp.json", category: "mcp", agent: "claude", format: "json" },
+    { file: "AGENTS.md", category: "rules", agent: "codex", format: "markdown" },
+    { file: ".codex/AGENTS.md", category: "rules", agent: "codex", format: "markdown" },
+    { file: "GEMINI.md", category: "rules", agent: "gemini", format: "markdown" },
+    { file: ".opencode/AGENTS.md", category: "rules", agent: "opencode", format: "markdown" },
+    { file: ".codewith/CODEWITH.md", category: "rules", agent: "codewith", format: "markdown" },
+    { file: ".cursor/mcp.json", category: "mcp", agent: "cursor", format: "json" }
+  ];
+});
+
+// src/lib/sync-dir.ts
+import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
+import { join as join4, relative } from "path";
+import { homedir as homedir3 } from "os";
+function shouldSkip(p) {
+  return SKIP.some((s) => p.includes(s));
+}
+async function syncFromDir(dir, opts = {}) {
+  const d = opts.db || getDatabase();
+  const absDir = expandPath(dir);
+  if (!existsSync5(absDir))
+    return { added: 0, updated: 0, unchanged: 0, skipped: [`Not found: ${absDir}`] };
+  const files = opts.recursive !== false ? walkDir(absDir) : readdirSync2(absDir).map((f) => join4(absDir, f)).filter((f) => statSync2(f).isFile());
+  const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
+  const home = homedir3();
+  const allConfigs = listConfigs(undefined, d);
+  for (const file of files) {
+    if (shouldSkip(file)) {
+      result.skipped.push(file);
+      continue;
+    }
+    try {
+      const content = readFileSync3(file, "utf-8");
+      if (content.length > 500000) {
+        result.skipped.push(file + " (too large)");
+        continue;
+      }
+      const targetPath = file.replace(home, "~");
+      const existing = allConfigs.find((c) => c.target_path === targetPath);
+      if (!existing) {
+        if (!opts.dryRun)
+          createConfig({ name: relative(absDir, file), category: detectCategory(file), agent: detectAgent(file), target_path: targetPath, format: detectFormat(file), content }, d);
+        result.added++;
+      } else if (existing.content !== content) {
+        if (!opts.dryRun)
+          updateConfig(existing.id, { content }, d);
+        result.updated++;
+      } else {
+        result.unchanged++;
+      }
+    } catch {
+      result.skipped.push(file);
+    }
+  }
+  return result;
+}
+async function syncToDir(dir, opts = {}) {
+  const d = opts.db || getDatabase();
+  const home = homedir3();
+  const absDir = expandPath(dir);
+  const normalized = dir.startsWith("~/") ? dir : absDir.replace(home, "~");
+  const configs = listConfigs(undefined, d).filter((c) => c.target_path && (c.target_path.startsWith(normalized) || c.target_path.startsWith(absDir)));
+  const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
+  for (const config of configs) {
+    if (config.kind === "reference")
+      continue;
+    try {
+      const r = await applyConfig(config, { dryRun: opts.dryRun, db: d });
+      r.changed ? result.updated++ : result.unchanged++;
+    } catch {
+      result.skipped.push(config.target_path || config.id);
+    }
+  }
+  return result;
+}
+function walkDir(dir, files = []) {
+  for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+    const full = join4(dir, entry.name);
+    if (shouldSkip(full))
+      continue;
+    if (entry.isDirectory())
+      walkDir(full, files);
+    else if (entry.isFile())
+      files.push(full);
+  }
+  return files;
+}
+var SKIP;
+var init_sync_dir = __esm(() => {
+  init_database();
+  init_configs();
+  init_apply();
+  init_sync();
+  SKIP = [".db", ".db-shm", ".db-wal", ".log", ".lock", ".DS_Store", "node_modules", ".git"];
+});
+
+// package.json
+var require_package = __commonJS((exports, module) => {
+  module.exports = {
+    name: "@hasna/instructions",
+    version: "0.3.0",
+    description: "AI coding agent instruction & configuration manager \u2014 store, version, apply, and share all your AI coding configs. CLI + MCP + HTTP API (instructions-serve) + generated SDK + Dashboard.",
+    type: "module",
+    main: "dist/index.js",
+    types: "dist/index.d.ts",
+    bin: {
+      instructions: "dist/cli/index.js",
+      "instructions-mcp": "dist/mcp/index.js",
+      "instructions-serve": "dist/server/index.js",
+      "configs-mcp": "dist/mcp/index.js"
+    },
+    exports: {
+      ".": {
+        types: "./dist/index.d.ts",
+        import: "./dist/index.js"
+      },
+      "./storage": {
+        types: "./dist/storage.d.ts",
+        import: "./dist/storage.js"
+      }
+    },
+    files: [
+      "dist",
+      "dashboard/dist",
+      "LICENSE",
+      "README.md"
+    ],
+    scripts: {
+      clean: "rm -rf dist",
+      build: "bun run clean && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external pg --external @modelcontextprotocol/sdk && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external pg --external @modelcontextprotocol/sdk && bun build src/server/index.ts --outdir dist/server --target bun --external pg && bun build src/index.ts src/storage.ts --outdir dist --target bun --external pg && tsc --emitDeclarationOnly --outDir dist",
+      "build:server": "bun run clean && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external pg --external @modelcontextprotocol/sdk && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external pg --external @modelcontextprotocol/sdk && bun build src/server/index.ts --outdir dist/server --target bun --external pg && bun build src/index.ts src/storage.ts --outdir dist --target bun --external pg",
+      "build:dashboard": "cd dashboard && bun run build",
+      migrate: "bun run src/server/index.ts migrate",
+      "generate:sdk": "bun run scripts/generate-sdk.ts",
+      "kit:check": "bunx @hasna/contracts vendor-kit --check",
+      typecheck: "tsc --noEmit",
+      test: "bun test",
+      "dev:cli": "bun run src/cli/index.tsx",
+      "dev:mcp": "bun run src/mcp/index.ts",
+      "dev:serve": "bun run src/server/index.ts",
+      seed: "bun run scripts/seed.ts",
+      prepublishOnly: "bun run build",
+      postinstall: "mkdir -p $HOME/.hasna/instructions $HOME/.hasna/instructions/backups 2>/dev/null || true"
+    },
+    keywords: [
+      "instructions",
+      "configs",
+      "dotfiles",
+      "agent-config",
+      "claude",
+      "codex",
+      "gemini",
+      "mcp",
+      "ai",
+      "coding-agent",
+      "cli",
+      "dashboard"
+    ],
+    publishConfig: {
+      registry: "https://registry.npmjs.org",
+      access: "public"
+    },
+    repository: {
+      type: "git",
+      url: "git+https://github.com/hasna/instructions.git"
+    },
+    homepage: "https://github.com/hasna/instructions",
+    bugs: {
+      url: "https://github.com/hasna/instructions/issues"
+    },
+    engines: {
+      bun: ">=1.0.0"
+    },
+    author: "Andrei Hasna <andrei@hasna.com>",
+    license: "Apache-2.0",
+    dependencies: {
+      "@hasna/contracts": "^0.4.1",
+      "@hasna/events": "^0.1.6",
+      "@modelcontextprotocol/sdk": "^1.12.1",
+      chalk: "^5.4.1",
+      commander: "^13.1.0",
+      hono: "^4.7.4",
+      ink: "^5.2.0",
+      pg: "^8.13.3",
+      react: "^18.3.1",
+      zod: "^3.24.2"
+    },
+    devDependencies: {
+      "@types/bun": "^1.2.4",
+      "@types/pg": "^8.11.11",
+      "@types/react": "^18.3.18",
+      typescript: "^5.7.3"
+    }
+  };
+});
+
+// src/mcp/index.ts
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+// src/mcp/server.ts
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+
+// src/db/storage-sync.ts
+init_database();
+
+// src/db/pg-migrations.ts
+var PG_MIGRATIONS = [
+  `CREATE TABLE IF NOT EXISTS configs (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL,
+    slug TEXT NOT NULL UNIQUE,
+    kind TEXT NOT NULL DEFAULT 'file',
+    category TEXT NOT NULL,
+    agent TEXT NOT NULL DEFAULT 'global',
+    target_path TEXT,
+    outputs TEXT NOT NULL DEFAULT '[]',
+    format TEXT NOT NULL DEFAULT 'text',
+    content TEXT NOT NULL DEFAULT '',
+    description TEXT,
+    tags TEXT NOT NULL DEFAULT '[]',
+    is_template BOOLEAN NOT NULL DEFAULT FALSE,
+    version INTEGER NOT NULL DEFAULT 1,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    synced_at TEXT
+  )`,
+  `CREATE TABLE IF NOT EXISTS config_snapshots (
+    id TEXT PRIMARY KEY,
+    config_id TEXT NOT NULL REFERENCES configs(id) ON DELETE CASCADE,
+    content TEXT NOT NULL,
+    version INTEGER NOT NULL,
+    created_at TEXT NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS profiles (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL,
+    slug TEXT NOT NULL UNIQUE,
+    description TEXT,
+    selectors TEXT NOT NULL DEFAULT '{}',
+    variables TEXT NOT NULL DEFAULT '{}',
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS profile_configs (
+    profile_id TEXT NOT NULL REFERENCES profiles(id) ON DELETE CASCADE,
+    config_id TEXT NOT NULL REFERENCES configs(id) ON DELETE CASCADE,
+    sort_order INTEGER NOT NULL DEFAULT 0,
+    PRIMARY KEY (profile_id, config_id)
+  )`,
+  `CREATE TABLE IF NOT EXISTS machines (
+    id TEXT PRIMARY KEY,
+    hostname TEXT NOT NULL UNIQUE,
+    os TEXT,
+    arch TEXT,
+    last_applied_at TEXT,
+    created_at TEXT NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS feedback (
+    id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+    message TEXT NOT NULL,
+    email TEXT,
+    category TEXT DEFAULT 'general',
+    version TEXT,
+    machine_id TEXT,
+    created_at TEXT NOT NULL DEFAULT NOW()::text
+  )`,
+  `ALTER TABLE configs ADD COLUMN IF NOT EXISTS outputs TEXT NOT NULL DEFAULT '[]'`
+];
+
+// src/db/remote-storage.ts
+import pg from "pg";
+var DISABLED_SSL_MODE = "disable";
+function translatePlaceholders(sql) {
+  let index = 0;
+  return sql.replace(/\?/g, () => `$${++index}`);
+}
+function normalizeParams(params) {
+  const flat = params.length === 1 && Array.isArray(params[0]) ? params[0] : params;
+  return flat.map((value) => value === undefined ? null : value);
+}
+function normalizeHost(hostname) {
+  const stripped = hostname.replace(/^\[/, "").replace(/\]$/, "");
+  try {
+    return decodeURIComponent(stripped).toLowerCase();
+  } catch {
+    return stripped.toLowerCase();
+  }
+}
+function isLocalPostgresHost(hostname) {
+  const host = normalizeHost(hostname);
+  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "" || host.startsWith("/");
+}
+function effectivePgHost(url) {
+  const hosts = url.searchParams.getAll("host");
+  const finalHost = hosts.length > 0 ? hosts[hosts.length - 1] : null;
+  return finalHost?.trim() ? finalHost : url.hostname;
+}
+function buildPgPoolConfig(connectionString) {
+  let url;
+  try {
+    url = new URL(connectionString);
+  } catch {
+    throw new Error("Invalid PostgreSQL connection string");
+  }
+  const sslMode = url.searchParams.get("sslmode")?.trim().toLowerCase();
+  const sslValue = url.searchParams.get("ssl")?.trim().toLowerCase();
+  const isLocal = isLocalPostgresHost(effectivePgHost(url));
+  const hasDisabledSsl = sslMode === DISABLED_SSL_MODE || sslValue === "false";
+  if (!isLocal && hasDisabledSsl) {
+    throw new Error("Refusing remote PostgreSQL connection with TLS disabled");
+  }
+  const shouldUseSsl = !isLocal || sslMode === "require" || sslMode === "verify-ca" || sslMode === "verify-full" || sslValue === "true";
+  url.searchParams.delete("sslmode");
+  url.searchParams.delete("ssl");
+  return {
+    connectionString: url.toString(),
+    ssl: shouldUseSsl ? { rejectUnauthorized: true } : undefined
+  };
+}
+
+class PgAdapterAsync {
+  pool;
+  constructor(connectionString) {
+    this.pool = new pg.Pool(buildPgPoolConfig(connectionString));
+  }
+  async run(sql, ...params) {
+    const result = await this.pool.query(translatePlaceholders(sql), normalizeParams(params));
+    return { changes: result.rowCount ?? 0 };
+  }
+  async all(sql, ...params) {
+    const result = await this.pool.query(translatePlaceholders(sql), normalizeParams(params));
+    return result.rows;
+  }
+  async close() {
+    await this.pool.end();
+  }
+}
+
+// src/db/storage-sync.ts
+var STORAGE_TABLES = ["configs", "config_snapshots", "profiles", "profile_configs", "machines", "feedback"];
+var PRIMARY_KEYS = {
+  configs: ["id"],
+  config_snapshots: ["id"],
+  profiles: ["id"],
+  profile_configs: ["profile_id", "config_id"],
+  machines: ["id"],
+  feedback: ["id"]
+};
+var CONFIGS_STORAGE_ENV = "HASNA_CONFIGS_DATABASE_URL";
+var CONFIGS_STORAGE_FALLBACK_ENV = "CONFIGS_DATABASE_URL";
+var CONFIGS_STORAGE_MODE_ENV = "HASNA_CONFIGS_STORAGE_MODE";
+var CONFIGS_STORAGE_MODE_FALLBACK_ENV = "CONFIGS_STORAGE_MODE";
+var STORAGE_DATABASE_ENV = [CONFIGS_STORAGE_ENV, CONFIGS_STORAGE_FALLBACK_ENV];
+var STORAGE_MODE_ENV = [CONFIGS_STORAGE_MODE_ENV, CONFIGS_STORAGE_MODE_FALLBACK_ENV];
+function firstEnv(names) {
+  for (const name of names) {
+    const value = process.env[name];
+    if (value)
+      return value;
+  }
+  return null;
+}
+function normalizeStorageMode(value) {
+  const normalized = value?.trim().toLowerCase();
+  if (normalized === "local" || normalized === "hybrid" || normalized === "remote")
+    return normalized;
+  return;
+}
+function getStorageDatabaseUrl() {
+  return firstEnv(STORAGE_DATABASE_ENV);
+}
+function getStorageMode() {
+  const mode = normalizeStorageMode(firstEnv(STORAGE_MODE_ENV));
+  if (mode)
+    return mode;
+  return getStorageDatabaseUrl() ? "hybrid" : "local";
+}
+async function getStoragePg() {
+  const url = getStorageDatabaseUrl();
+  if (!url)
+    throw new Error("Missing HASNA_CONFIGS_DATABASE_URL or CONFIGS_DATABASE_URL");
+  return new PgAdapterAsync(url);
+}
+async function runStorageMigrations(remote) {
+  await remote.run("CREATE EXTENSION IF NOT EXISTS pgcrypto");
+  for (const sql of PG_MIGRATIONS)
+    await remote.run(sql);
+}
+async function storagePush(options) {
+  const remote = await getStoragePg();
+  const db = getDatabase();
+  try {
+    await runStorageMigrations(remote);
+    const results = [];
+    for (const table of resolveTables(options?.tables))
+      results.push(await pushTable(db, remote, table));
+    recordSyncMeta(db, "push", results);
+    return results;
+  } finally {
+    await remote.close();
+  }
+}
+async function storagePull(options) {
+  const remote = await getStoragePg();
+  const db = getDatabase();
+  try {
+    await runStorageMigrations(remote);
+    const results = [];
+    for (const table of resolveTables(options?.tables))
+      results.push(await pullTable(remote, db, table));
+    recordSyncMeta(db, "pull", results);
+    return results;
+  } finally {
+    await remote.close();
+  }
+}
+async function storageSync(options) {
+  const pull = await storagePull(options);
+  const push = await storagePush(options);
+  return { pull, push };
+}
+function getStorageSyncMetaAll() {
+  const db = getDatabase();
+  ensureSyncMetaTable(db);
+  return db.query("SELECT table_name, last_synced_at, direction FROM _configs_sync_meta ORDER BY table_name, direction").all();
+}
+function getStorageStatus() {
+  return {
+    configured: Boolean(getStorageDatabaseUrl()),
+    mode: getStorageMode(),
+    env: STORAGE_DATABASE_ENV,
+    service: "configs",
+    tables: STORAGE_TABLES,
+    sync: getStorageSyncMetaAll()
+  };
+}
+function resolveTables(tables) {
+  if (!tables || tables.length === 0)
+    return [...STORAGE_TABLES];
+  const allowed = new Set(STORAGE_TABLES);
+  const requested = tables.map((table) => table.trim()).filter(Boolean);
+  const invalid = requested.filter((table) => !allowed.has(table));
+  if (invalid.length > 0)
+    throw new Error(`Unknown configs sync table(s): ${invalid.join(", ")}`);
+  return requested;
+}
+async function pushTable(db, remote, table) {
+  const result = { table, rowsRead: 0, rowsWritten: 0, errors: [] };
+  try {
+    const rows = db.query(`SELECT * FROM ${quoteIdent(table)}`).all();
+    result.rowsRead = rows.length;
+    if (rows.length === 0)
+      return result;
+    const columns = await filterRemoteColumns(remote, table, Object.keys(rows[0]));
+    result.rowsWritten = await upsertPg(remote, table, columns, rows);
+  } catch (error) {
+    result.errors.push(error instanceof Error ? error.message : String(error));
+  }
+  return result;
+}
+async function pullTable(remote, db, table) {
+  const result = { table, rowsRead: 0, rowsWritten: 0, errors: [] };
+  try {
+    const rows = await remote.all(`SELECT * FROM ${quoteIdent(table)}`);
+    result.rowsRead = rows.length;
+    if (rows.length === 0)
+      return result;
+    const columns = filterLocalColumns(db, table, Object.keys(rows[0]));
+    result.rowsWritten = upsertSqlite(db, table, columns, rows);
+  } catch (error) {
+    result.errors.push(error instanceof Error ? error.message : String(error));
+  }
+  return result;
+}
+async function filterRemoteColumns(remote, table, columns) {
+  const rows = await remote.all("SELECT column_name FROM information_schema.columns WHERE table_schema = 'public' AND table_name = ?", table);
+  if (rows.length === 0)
+    return columns;
+  const allowed = new Set(rows.map((row) => row.column_name));
+  return columns.filter((column) => allowed.has(column));
+}
+function filterLocalColumns(db, table, columns) {
+  const rows = db.query(`PRAGMA table_info(${quoteIdent(table)})`).all();
+  const allowed = new Set(rows.map((row) => row.name));
+  return columns.filter((column) => allowed.has(column));
+}
+async function upsertPg(remote, table, columns, rows) {
+  if (columns.length === 0)
+    return 0;
+  const primaryKeys = PRIMARY_KEYS[table];
+  const columnList = columns.map(quoteIdent).join(", ");
+  const placeholders = columns.map(() => "?").join(", ");
+  const keyList = primaryKeys.map(quoteIdent).join(", ");
+  const updateColumns = columns.filter((column) => !primaryKeys.includes(column));
+  const fallbackKey = primaryKeys[0];
+  const setClause = updateColumns.length > 0 ? updateColumns.map((column) => `${quoteIdent(column)} = EXCLUDED.${quoteIdent(column)}`).join(", ") : `${quoteIdent(fallbackKey)} = EXCLUDED.${quoteIdent(fallbackKey)}`;
+  for (const row of rows) {
+    await remote.run(`INSERT INTO ${quoteIdent(table)} (${columnList}) VALUES (${placeholders}) ON CONFLICT (${keyList}) DO UPDATE SET ${setClause}`, ...columns.map((column) => row[column] ?? null));
+  }
+  return rows.length;
+}
+function upsertSqlite(db, table, columns, rows) {
+  if (columns.length === 0)
+    return 0;
+  const primaryKeys = PRIMARY_KEYS[table];
+  const columnList = columns.map(quoteIdent).join(", ");
+  const placeholders = columns.map(() => "?").join(", ");
+  const keyList = primaryKeys.map(quoteIdent).join(", ");
+  const updateColumns = columns.filter((column) => !primaryKeys.includes(column));
+  const fallbackKey = primaryKeys[0];
+  const setClause = updateColumns.length > 0 ? updateColumns.map((column) => `${quoteIdent(column)} = excluded.${quoteIdent(column)}`).join(", ") : `${quoteIdent(fallbackKey)} = excluded.${quoteIdent(fallbackKey)}`;
+  const statement = db.prepare(`INSERT INTO ${quoteIdent(table)} (${columnList}) VALUES (${placeholders}) ON CONFLICT (${keyList}) DO UPDATE SET ${setClause}`);
+  db.transaction((batch) => {
+    for (const row of batch)
+      statement.run(...columns.map((column) => coerceForSqlite(row[column])));
+  })(rows);
+  return rows.length;
+}
+function recordSyncMeta(db, direction, results) {
+  ensureSyncMetaTable(db);
+  const now2 = new Date().toISOString();
+  const statement = db.prepare("INSERT INTO _configs_sync_meta (table_name, last_synced_at, direction) VALUES (?, ?, ?) ON CONFLICT(table_name, direction) DO UPDATE SET last_synced_at = excluded.last_synced_at");
+  for (const result of results) {
+    if (result.errors.length > 0)
+      continue;
+    statement.run(result.table, now2, direction);
+  }
+}
+function ensureSyncMetaTable(db) {
+  db.exec("CREATE TABLE IF NOT EXISTS _configs_sync_meta (table_name TEXT NOT NULL, last_synced_at TEXT, direction TEXT NOT NULL CHECK(direction IN ('push', 'pull')), PRIMARY KEY (table_name, direction))");
+}
+function quoteIdent(identifier) {
+  return `"${identifier.replace(/"/g, '""')}"`;
+}
+function coerceForSqlite(value) {
+  if (value === undefined || value === null)
+    return null;
+  if (typeof value === "string" || typeof value === "number" || typeof value === "bigint" || typeof value === "boolean")
+    return value;
+  if (value instanceof Date)
+    return value.toISOString();
+  if (Buffer.isBuffer(value) || value instanceof Uint8Array)
+    return value;
+  if (typeof value === "object")
+    return JSON.stringify(value);
+  return String(value);
+}
+
+// src/mcp/server.ts
+init_configs();
+init_apply();
+init_sync_dir();
+
+// src/db/profiles.ts
+init_types();
+init_database();
+init_configs();
+init_machine();
+function rowToProfile(row) {
+  return {
+    ...row,
+    selectors: JSON.parse(row.selectors || "{}"),
+    variables: JSON.parse(row.variables || "{}")
+  };
+}
+function getProfile(idOrSlug, db) {
+  const d = db || getDatabase();
+  const row = d.query("SELECT * FROM profiles WHERE id = ? OR slug = ?").get(idOrSlug, idOrSlug);
+  if (!row)
+    throw new ProfileNotFoundError(idOrSlug);
+  return rowToProfile(row);
+}
+function listProfiles(db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM profiles ORDER BY name").all().map(rowToProfile);
+}
+function getProfileConfigs(profileIdOrSlug, db) {
+  const d = db || getDatabase();
+  const profile = getProfile(profileIdOrSlug, d);
+  const rows = d.query("SELECT config_id FROM profile_configs WHERE profile_id = ? ORDER BY sort_order").all(profile.id);
+  if (rows.length === 0)
+    return [];
+  const ids = rows.map((r) => r.config_id);
+  return listConfigs(undefined, d).filter((c) => ids.includes(c.id));
+}
+function profileHasSelectors(profile) {
+  const selectors = profile.selectors ?? {};
+  return (selectors.os?.length ?? 0) > 0 || (selectors.arch?.length ?? 0) > 0 || (selectors.hostnames?.length ?? 0) > 0;
+}
+function profileMatchesMachine(profile, machine) {
+  const selectors = profile.selectors ?? {};
+  const osMatches = !selectors.os?.length || selectors.os.some((candidate) => {
+    const value = candidate.trim().toLowerCase();
+    return value === machine.os_family || value === (machine.os ?? "").trim().toLowerCase() || normalizeOsFamily(candidate) === machine.os_family;
+  });
+  const archMatches = !selectors.arch?.length || selectors.arch.some((candidate) => candidate.trim().toLowerCase() === (machine.arch ?? "").trim().toLowerCase());
+  const hostnameMatches = !selectors.hostnames?.length || selectors.hostnames.some((candidate) => candidate.trim().toLowerCase() === machine.hostname.trim().toLowerCase());
+  return osMatches && archMatches && hostnameMatches;
+}
+function resolveProfileForMachine(machine = detectMachineContext(), db) {
+  const profiles = listProfiles(db).filter(profileHasSelectors);
+  const matches = profiles.filter((profile) => profileMatchesMachine(profile, machine)).map((profile) => {
+    const selectors = profile.selectors;
+    const score = (selectors.hostnames?.length ? 100 : 0) + (selectors.os?.length ? 10 : 0) + (selectors.arch?.length ? 10 : 0);
+    return { profile, score };
+  }).sort((a, b) => b.score - a.score || a.profile.name.localeCompare(b.profile.name));
+  return matches[0]?.profile ?? null;
+}
+
+// src/mcp/server.ts
+init_apply();
+init_snapshots();
+init_machine();
+
+// src/lib/compact-output.ts
+var DEFAULT_LIST_LIMIT = 20;
+var MAX_LIST_LIMIT = 100;
+function parseLimit(value, fallback = DEFAULT_LIST_LIMIT, max = MAX_LIST_LIMIT) {
+  const parsed = typeof value === "number" ? value : Number.parseInt(String(value ?? ""), 10);
+  if (!Number.isFinite(parsed) || parsed <= 0)
+    return fallback;
+  return Math.min(Math.floor(parsed), max);
+}
+function parseCursor(value) {
+  const parsed = typeof value === "number" ? value : Number.parseInt(String(value ?? ""), 10);
+  if (!Number.isFinite(parsed) || parsed < 0)
+    return 0;
+  return Math.floor(parsed);
+}
+function paginate(items, opts = {}) {
+  const limit = parseLimit(opts.limit, opts.defaultLimit ?? DEFAULT_LIST_LIMIT, opts.maxLimit ?? MAX_LIST_LIMIT);
+  const cursor = parseCursor(opts.cursor);
+  const pageItems = items.slice(cursor, cursor + limit);
+  const nextCursor = cursor + pageItems.length < items.length ? cursor + pageItems.length : null;
+  return {
+    items: pageItems,
+    total: items.length,
+    limit,
+    cursor,
+    next_cursor: nextCursor,
+    has_more: nextCursor !== null
+  };
+}
+function pagedPayload(items, opts = {}) {
+  return {
+    ...paginate(items, opts),
+    hint: opts.hint
+  };
+}
+function truncateText(value, max = 80) {
+  const text = (value ?? "").replace(/\s+/g, " ").trim();
+  if (text.length <= max)
+    return text;
+  if (max <= 3)
+    return text.slice(0, max);
+  return `${text.slice(0, max - 3)}...`;
+}
+function summarizeConfig(config, opts = {}) {
+  const summary = {
+    id: config.id,
+    slug: config.slug,
+    name: config.name,
+    category: config.category,
+    agent: config.agent,
+    kind: config.kind,
+    format: config.format,
+    target_path: config.target_path,
+    output_count: config.outputs.length,
+    version: config.version,
+    is_template: config.is_template
+  };
+  if (opts.verbose) {
+    summary.updated_at = config.updated_at;
+    summary.description = config.description;
+    summary.tags = config.tags;
+    summary.outputs = config.outputs;
+  }
+  return summary;
+}
+function summarizeProfile(profile, opts = {}) {
+  const selectorCount = (profile.selectors.os?.length ?? 0) + (profile.selectors.arch?.length ?? 0) + (profile.selectors.hostnames?.length ?? 0);
+  const summary = {
+    id: profile.id,
+    slug: profile.slug,
+    name: profile.name,
+    description: opts.verbose ? profile.description : truncateText(profile.description, 80),
+    selector_count: selectorCount,
+    variable_count: Object.keys(profile.variables).length
+  };
+  if (opts.verbose) {
+    summary.created_at = profile.created_at;
+    summary.updated_at = profile.updated_at;
+    summary.selectors = profile.selectors;
+    summary.variables = profile.variables;
+  }
+  return summary;
+}
+function summarizeApplyResult(result) {
+  return {
+    config_id: result.config_id,
+    path: result.path,
+    dry_run: result.dry_run,
+    changed: result.changed,
+    agent: result.agent,
+    transform: result.transform,
+    output_count: result.outputs?.length ?? 0,
+    outputs: result.outputs?.map(summarizeApplyResult)
+  };
+}
+
+// src/mcp/server.ts
+var TOOL_DOCS = {
+  list_configs: "List configs. Params: category?, agent?, kind?, search?, limit?, cursor?, verbose?. Defaults to a paged compact envelope without content; use get_config for full content.",
+  get_config: "Get a config by id or slug. Returns full config including content.",
+  create_config: "Create a new config. Required: name, content, category. Optional: agent, target_path, outputs, kind, format, tags, description, is_template.",
+  update_config: "Update a config by id or slug. Optional: content, name, tags, description, category, agent, target_path, outputs.",
+  apply_config: "Apply a config to its target_path on disk. Params: id_or_slug, dry_run?, verbose?. Defaults to a compact result without previous/new content.",
+  sync_directory: "Sync a directory with the DB. Params: dir, direction ('from_disk'|'to_disk'). Returns sync result.",
+  list_profiles: "List profiles. Params: limit?, cursor?, verbose?. Defaults to a paged compact envelope.",
+  apply_profile: "Apply all configs in a profile to disk. Params: id_or_slug? or auto=true, dry_run?, hostname?, os?, arch?, verbose?. Defaults to compact apply results without content.",
+  get_snapshot: "Get snapshot(s) for a config. Params: config_id_or_slug, version?. Returns latest snapshot or specific version.",
+  get_status: "Single-call orientation. Returns: total configs, counts by category, templates, DB path.",
+  render_template: "Render a template config with variable substitution. Params: id_or_slug, vars? (object of KEY:VALUE), use_env? (fill from env vars). Returns rendered content.",
+  scan_secrets: "Scan configs for unredacted secrets. Params: id_or_slug? (omit for all known), fix?, limit?, cursor?. Returns paged findings without secret values.",
+  sync_known: "Sync all known config files from disk into DB. Params: agent?, category?. Replaces sync_directory for standard use.",
+  sync_project: "Sync project-scoped configs (CLAUDE.md, .mcp.json, AGENTS.md, rules/*.md) from a project dir. Params: project_dir (default: cwd).",
+  search_tools: "Search tool descriptions. Params: query. Returns matching tool names and descriptions.",
+  describe_tools: "Get full descriptions for tools. Params: names? (array). Returns tool docs."
+};
+var PROFILES = {
+  minimal: ["get_status", "get_config", "sync_known"],
+  standard: ["list_configs", "get_config", "create_config", "update_config", "apply_config", "sync_known", "get_status", "render_template", "scan_secrets", "list_profiles", "apply_profile", "search_tools", "describe_tools"],
+  full: []
+};
+var activeProfile = process.env["CONFIGS_PROFILE"] || "full";
+var profileFilter = PROFILES[activeProfile];
+var ALL_LEAN_TOOLS = [
+  { name: "list_configs", inputSchema: { type: "object", properties: { category: { type: "string" }, agent: { type: "string" }, kind: { type: "string" }, search: { type: "string" }, limit: { type: "number" }, cursor: { type: "number" }, verbose: { type: "boolean" } } } },
+  { name: "get_config", inputSchema: { type: "object", properties: { id_or_slug: { type: "string" } }, required: ["id_or_slug"] } },
+  { name: "create_config", inputSchema: { type: "object", properties: { name: { type: "string" }, content: { type: "string" }, category: { type: "string" }, agent: { type: "string" }, target_path: { type: "string" }, outputs: { type: "array", items: { type: "object" } }, kind: { type: "string" }, format: { type: "string" }, tags: { type: "array", items: { type: "string" } }, description: { type: "string" }, is_template: { type: "boolean" } }, required: ["name", "content", "category"] } },
+  { name: "update_config", inputSchema: { type: "object", properties: { id_or_slug: { type: "string" }, content: { type: "string" }, name: { type: "string" }, tags: { type: "array", items: { type: "string" } }, description: { type: "string" }, category: { type: "string" }, agent: { type: "string" }, target_path: { type: "string" }, outputs: { type: "array", items: { type: "object" } } }, required: ["id_or_slug"] } },
+  { name: "delete_config", inputSchema: { type: "object", properties: { id_or_slug: { type: "string" } }, required: ["id_or_slug"] } },
+  { name: "apply_config", inputSchema: { type: "object", properties: { id_or_slug: { type: "string" }, dry_run: { type: "boolean" }, verbose: { type: "boolean" } }, required: ["id_or_slug"] } },
+  { name: "sync_directory", inputSchema: { type: "object", properties: { dir: { type: "string" }, direction: { type: "string" } }, required: ["dir"] } },
+  { name: "list_profiles", inputSchema: { type: "object", properties: { limit: { type: "number" }, cursor: { type: "number" }, verbose: { type: "boolean" } } } },
+  { name: "apply_profile", inputSchema: { type: "object", properties: { id_or_slug: { type: "string" }, auto: { type: "boolean" }, dry_run: { type: "boolean" }, hostname: { type: "string" }, os: { type: "string" }, arch: { type: "string" }, verbose: { type: "boolean" } } } },
+  { name: "get_snapshot", inputSchema: { type: "object", properties: { config_id_or_slug: { type: "string" }, version: { type: "number" } }, required: ["config_id_or_slug"] } },
+  { name: "get_status", inputSchema: { type: "object", properties: {} } },
+  { name: "sync_known", inputSchema: { type: "object", properties: { agent: { type: "string" }, category: { type: "string" } } } },
+  { name: "sync_project", inputSchema: { type: "object", properties: { project_dir: { type: "string" } } } },
+  { name: "render_template", inputSchema: { type: "object", properties: { id_or_slug: { type: "string" }, vars: { type: "object" }, use_env: { type: "boolean" } }, required: ["id_or_slug"] } },
+  { name: "scan_secrets", inputSchema: { type: "object", properties: { id_or_slug: { type: "string" }, fix: { type: "boolean" }, limit: { type: "number" }, cursor: { type: "number" } } } },
+  { name: "search_tools", inputSchema: { type: "object", properties: { query: { type: "string" } }, required: ["query"] } },
+  { name: "describe_tools", inputSchema: { type: "object", properties: { names: { type: "array", items: { type: "string" } } } } },
+  { name: "register_agent", description: "Register agent session.", inputSchema: { type: "object", properties: { name: { type: "string" }, session_id: { type: "string" } }, required: ["name"] } },
+  { name: "heartbeat", description: "Update last_seen_at.", inputSchema: { type: "object", properties: { agent_id: { type: "string" } }, required: ["agent_id"] } },
+  { name: "set_focus", description: "Set active project context.", inputSchema: { type: "object", properties: { agent_id: { type: "string" }, project_id: { type: "string" } }, required: ["agent_id"] } },
+  { name: "list_agents", description: "List all registered agents.", inputSchema: { type: "object", properties: {} } },
+  { name: "send_feedback", description: "Send feedback about this service", inputSchema: { type: "object", properties: { message: { type: "string" }, email: { type: "string" }, category: { type: "string", enum: ["bug", "feature", "general"] } }, required: ["message"] } },
+  { name: "storage_status", description: "Show storage sync configuration and local sync history.", inputSchema: { type: "object", properties: {} } },
+  { name: "storage_push", description: "Push local configs data to storage PostgreSQL.", inputSchema: { type: "object", properties: { tables: { type: "array", items: { type: "string" } } } } },
+  { name: "storage_pull", description: "Pull configs data from storage PostgreSQL to local SQLite.", inputSchema: { type: "object", properties: { tables: { type: "array", items: { type: "string" } } } } },
+  { name: "storage_sync", description: "Bidirectional configs sync: pull then push.", inputSchema: { type: "object", properties: { tables: { type: "array", items: { type: "string" } } } } }
+];
+function ok(data) {
+  return { content: [{ type: "text", text: JSON.stringify(data) }] };
+}
+function err(msg) {
+  return { content: [{ type: "text", text: JSON.stringify({ error: msg }) }], isError: true };
+}
+var _cfgAgents = new Map;
+function buildServer() {
+  const server = new Server({ name: "configs", version: require_package().version }, { capabilities: { tools: {} } });
+  const LEAN_TOOLS = profileFilter && profileFilter.length > 0 ? ALL_LEAN_TOOLS.filter((t) => profileFilter.includes(t.name)) : ALL_LEAN_TOOLS;
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: LEAN_TOOLS }));
+  server.setRequestHandler(CallToolRequestSchema, async (req) => {
+    const { name, arguments: args = {} } = req.params;
+    try {
+      switch (name) {
+        case "list_configs": {
+          const configs = listConfigs({
+            category: args["category"] || undefined,
+            agent: args["agent"] || undefined,
+            kind: args["kind"] || undefined,
+            search: args["search"] || undefined
+          });
+          const summaries = configs.map((c) => summarizeConfig(c, { verbose: Boolean(args["verbose"]) }));
+          return ok(pagedPayload(summaries, {
+            limit: args["limit"],
+            cursor: args["cursor"],
+            hint: "Use get_config with id_or_slug for full content, or list_configs verbose=true for tags/output targets."
+          }));
+        }
+        case "get_config": {
+          const c = getConfig(args["id_or_slug"]);
+          return ok(c);
+        }
+        case "create_config": {
+          const c = createConfig({
+            name: args["name"],
+            content: args["content"],
+            category: args["category"],
+            agent: args["agent"] || undefined,
+            target_path: args["target_path"] || undefined,
+            outputs: args["outputs"],
+            kind: args["kind"] || undefined,
+            format: args["format"] || undefined,
+            tags: args["tags"] || undefined,
+            description: args["description"] || undefined,
+            is_template: args["is_template"] || undefined
+          });
+          return ok({ id: c.id, slug: c.slug, name: c.name });
+        }
+        case "update_config": {
+          const c = updateConfig(args["id_or_slug"], {
+            content: args["content"],
+            name: args["name"],
+            tags: args["tags"],
+            description: args["description"],
+            category: args["category"],
+            agent: args["agent"],
+            target_path: args["target_path"],
+            outputs: args["outputs"]
+          });
+          return ok({ id: c.id, slug: c.slug, version: c.version });
+        }
+        case "delete_config": {
+          const { deleteConfig: deleteConfig2 } = await Promise.resolve().then(() => (init_configs(), exports_configs));
+          deleteConfig2(args["id_or_slug"]);
+          return ok({ deleted: true });
+        }
+        case "apply_config": {
+          const config = getConfig(args["id_or_slug"]);
+          const result = await applyConfig(config, { dryRun: args["dry_run"] });
+          return ok(args["verbose"] ? result : summarizeApplyResult(result));
+        }
+        case "sync_directory": {
+          const dir = args["dir"];
+          const direction = args["direction"] || "from_disk";
+          const result = direction === "to_disk" ? await syncToDir(dir) : await syncFromDir(dir);
+          return ok(result);
+        }
+        case "list_profiles": {
+          const profiles = listProfiles().map((profile) => summarizeProfile(profile, { verbose: Boolean(args["verbose"]) }));
+          return ok(pagedPayload(profiles, {
+            limit: args["limit"],
+            cursor: args["cursor"],
+            hint: "Use apply_profile/get profile-specific commands for details; verbose=true includes selectors and variables."
+          }));
+        }
+        case "apply_profile": {
+          const machine = detectMachineContext({
+            hostname: args["hostname"],
+            os: args["os"],
+            arch: args["arch"]
+          });
+          if (!args["auto"] && !args["id_or_slug"])
+            return err("id_or_slug is required unless auto=true");
+          const profile = args["auto"] ? resolveProfileForMachine(machine) : getProfile(args["id_or_slug"]);
+          if (!profile)
+            return err("No matching machine-aware profile found");
+          const configs = getProfileConfigs(profile.id);
+          const vars = resolveProfileVariables(profile, machine);
+          const results = await applyConfigs(configs, { dryRun: args["dry_run"], vars });
+          return ok({
+            profile: summarizeProfile(profile, { verbose: Boolean(args["verbose"]) }),
+            machine: {
+              id: machine.id,
+              os_family: machine.os_family,
+              arch: machine.arch
+            },
+            results: args["verbose"] ? results : results.map(summarizeApplyResult),
+            total: results.length,
+            changed: results.filter((result) => result.changed).length,
+            hint: "Set verbose=true to include previous_content/new_content in apply results."
+          });
+        }
+        case "get_snapshot": {
+          const config = getConfig(args["config_id_or_slug"]);
+          if (args["version"]) {
+            const snap = getSnapshotByVersion(config.id, args["version"]);
+            return snap ? ok(snap) : err("Snapshot not found");
+          }
+          const snaps = listSnapshots(config.id);
+          return ok(snaps[0] ?? null);
+        }
+        case "get_status": {
+          const stats = getConfigStats();
+          const allConfigs = listConfigs({ kind: "file" });
+          const { existsSync: ex, readFileSync: rf } = await import("fs");
+          const { expandPath: expandPath2 } = await Promise.resolve().then(() => (init_apply(), exports_apply));
+          const { redactContent: redactContent2 } = await Promise.resolve().then(() => (init_redact(), exports_redact));
+          let drifted = 0, missing = 0, templates = 0;
+          const driftedSlugs = [];
+          for (const c of allConfigs) {
+            if (c.is_template)
+              templates++;
+            if (!c.target_path)
+              continue;
+            const abs = expandPath2(c.target_path);
+            if (!ex(abs)) {
+              missing++;
+              continue;
+            }
+            const disk = rf(abs, "utf-8");
+            const { content: redactedDisk } = redactContent2(disk, c.format);
+            if (redactedDisk !== c.content) {
+              drifted++;
+              driftedSlugs.push(c.slug);
+            }
+          }
+          return ok({
+            total: stats["total"] || 0,
+            by_category: Object.fromEntries(Object.entries(stats).filter(([k]) => k !== "total")),
+            templates,
+            drifted,
+            drifted_configs: driftedSlugs.slice(0, 5),
+            missing,
+            db_path: process.env["CONFIGS_DB_PATH"] || "~/.hasna/configs/configs.db"
+          });
+        }
+        case "sync_known": {
+          const { syncKnown: syncKnown2 } = await Promise.resolve().then(() => (init_sync(), exports_sync));
+          const result = await syncKnown2({
+            agent: args["agent"] || undefined,
+            category: args["category"] || undefined
+          });
+          return ok(result);
+        }
+        case "sync_project": {
+          const { syncProject: syncProject2 } = await Promise.resolve().then(() => (init_sync(), exports_sync));
+          const dir = args["project_dir"] || process.cwd();
+          const result = await syncProject2({ projectDir: dir });
+          return ok(result);
+        }
+        case "render_template": {
+          const { renderTemplate: renderTemplate2 } = await Promise.resolve().then(() => (init_template(), exports_template));
+          const config = getConfig(args["id_or_slug"]);
+          const vars = args["vars"] || {};
+          if (args["use_env"]) {
+            const { extractTemplateVars: extractTemplateVars2 } = await Promise.resolve().then(() => (init_template(), exports_template));
+            for (const v of extractTemplateVars2(config.content)) {
+              if (!(v.name in vars) && process.env[v.name]) {
+                vars[v.name] = process.env[v.name];
+              }
+            }
+          }
+          const rendered = renderTemplate2(config.content, vars);
+          return ok({ rendered, config_id: config.id, slug: config.slug });
+        }
+        case "scan_secrets": {
+          const { scanSecrets: scanSecrets2, redactContent: redactContent2 } = await Promise.resolve().then(() => (init_redact(), exports_redact));
+          const configs = args["id_or_slug"] ? [getConfig(args["id_or_slug"])] : listConfigs({ kind: "file" });
+          const findings = [];
+          for (const c of configs) {
+            const fmt = c.format;
+            const secrets = scanSecrets2(c.content, fmt);
+            if (secrets.length > 0) {
+              findings.push({ slug: c.slug, secrets: secrets.length, vars: secrets.map((s) => s.varName) });
+              if (args["fix"]) {
+                const { content, isTemplate: isTemplate2 } = redactContent2(c.content, fmt);
+                updateConfig(c.id, { content, is_template: isTemplate2 });
+              }
+            }
+          }
+          return ok({
+            clean: findings.length === 0,
+            fixed: !!args["fix"],
+            ...pagedPayload(findings, {
+              limit: args["limit"],
+              cursor: args["cursor"],
+              hint: "Secret values are never returned. Use id_or_slug to inspect one config, or increase limit/cursor for more findings."
+            })
+          });
+        }
+        case "search_tools": {
+          const query = (args["query"] || "").toLowerCase();
+          const matches = Object.entries(TOOL_DOCS).filter(([k, v]) => k.includes(query) || v.toLowerCase().includes(query)).map(([name2, description]) => ({ name: name2, description }));
+          return ok(matches);
+        }
+        case "describe_tools": {
+          const names = args["names"];
+          if (names) {
+            return ok(Object.fromEntries(names.map((n) => [n, TOOL_DOCS[n] ?? "Unknown tool"])));
+          }
+          return ok(TOOL_DOCS);
+        }
+        case "register_agent": {
+          const n = String(args["name"] ?? "");
+          const existing = [..._cfgAgents.values()].find((x) => x.name === n);
+          if (existing) {
+            existing.last_seen_at = new Date().toISOString();
+            return ok(existing);
+          }
+          const id = Math.random().toString(36).slice(2, 10);
+          const ag = { id, name: n, last_seen_at: new Date().toISOString() };
+          _cfgAgents.set(id, ag);
+          return ok(ag);
+        }
+        case "heartbeat": {
+          const ag = _cfgAgents.get(String(args["agent_id"] ?? ""));
+          if (!ag)
+            return err(`Agent not found: ${args["agent_id"]}`);
+          ag.last_seen_at = new Date().toISOString();
+          return ok({ agent_id: ag.id, name: ag.name, last_seen_at: ag.last_seen_at });
+        }
+        case "set_focus": {
+          const ag = _cfgAgents.get(String(args["agent_id"] ?? ""));
+          if (!ag)
+            return err(`Agent not found: ${args["agent_id"]}`);
+          ag["project_id"] = args["project_id"];
+          return ok({ agent_id: ag.id, project_id: args["project_id"] ?? null });
+        }
+        case "list_agents": {
+          return ok([..._cfgAgents.values()]);
+        }
+        case "send_feedback": {
+          const { getDatabase: getDatabase2 } = await Promise.resolve().then(() => (init_database(), exports_database));
+          const db = getDatabase2();
+          const pkg = require_package();
+          db.run("INSERT INTO feedback (message, email, category, version) VALUES (?, ?, ?, ?)", [args["message"], args["email"] || null, args["category"] || "general", pkg.version]);
+          return ok({ message: "Feedback saved. Thank you!" });
+        }
+        case "storage_status": {
+          return ok(getStorageStatus());
+        }
+        case "storage_push": {
+          const tables = Array.isArray(args["tables"]) ? args["tables"] : undefined;
+          return ok(await storagePush(tables ? { tables } : undefined));
+        }
+        case "storage_pull": {
+          const tables = Array.isArray(args["tables"]) ? args["tables"] : undefined;
+          return ok(await storagePull(tables ? { tables } : undefined));
+        }
+        case "storage_sync": {
+          const tables = Array.isArray(args["tables"]) ? args["tables"] : undefined;
+          return ok(await storageSync(tables ? { tables } : undefined));
+        }
+        default:
+          return err(`Unknown tool: ${name}`);
+      }
+    } catch (e) {
+      return err(e instanceof Error ? e.message : String(e));
+    }
+  });
+  return server;
+}
+
+// src/mcp/http.ts
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+var MCP_HTTP_PORT = 8853;
+var MCP_NAME = "configs";
+function isStdioMode(argv) {
+  return argv.includes("--stdio") || process.env.MCP_STDIO === "1";
+}
+function resolveHttpPort(argv) {
+  const eqArg = argv.find((a) => a.startsWith("--port="));
+  if (eqArg) {
+    const parsed = Number.parseInt(eqArg.slice("--port=".length), 10);
+    if (!Number.isNaN(parsed))
+      return parsed;
+  }
+  const idx = argv.indexOf("--port");
+  if (idx >= 0) {
+    const parsed = Number.parseInt(argv[idx + 1] ?? "", 10);
+    if (!Number.isNaN(parsed))
+      return parsed;
+  }
+  const envPort = process.env.MCP_HTTP_PORT;
+  if (envPort) {
+    const parsed = Number.parseInt(envPort, 10);
+    if (!Number.isNaN(parsed))
+      return parsed;
+  }
+  return MCP_HTTP_PORT;
+}
+function healthPayload() {
+  return { status: "ok", name: MCP_NAME };
+}
+async function handleMcpRequest(req) {
+  const server = buildServer();
+  const transport = new WebStandardStreamableHTTPServerTransport({
+    sessionIdGenerator: undefined,
+    enableJsonResponse: true
+  });
+  await server.connect(transport);
+  return transport.handleRequest(req);
+}
+async function handleMcpHttpRequest(req) {
+  const url = new URL(req.url);
+  if (url.pathname === "/health" && req.method === "GET") {
+    return Response.json(healthPayload());
+  }
+  if (url.pathname === "/mcp") {
+    return handleMcpRequest(req);
+  }
+  return null;
+}
+async function startMcpHttpServer(port) {
+  const httpServer = Bun.serve({
+    hostname: "127.0.0.1",
+    port,
+    async fetch(req) {
+      const handled = await handleMcpHttpRequest(req);
+      if (handled)
+        return handled;
+      return Response.json({ error: "Not found" }, { status: 404 });
+    }
+  });
+  return { port: httpServer.port, stop: () => httpServer.stop() };
+}
+
+// src/mcp/index.ts
+async function main() {
+  const argv = process.argv.slice(2);
+  if (argv.includes("--claude")) {
+    const proc = Bun.spawn(["claude", "mcp", "add", "--transport", "stdio", "--scope", "user", "configs", "--", "configs-mcp"], { stdout: "inherit", stderr: "inherit" });
+    await proc.exited;
+    process.exit(0);
+  }
+  if (isStdioMode(argv)) {
+    const server = buildServer();
+    const transport = new StdioServerTransport;
+    await server.connect(transport);
+    return;
+  }
+  const port = resolveHttpPort(argv);
+  const { port: boundPort } = await startMcpHttpServer(port);
+  console.error(`configs-mcp HTTP listening on http://127.0.0.1:${boundPort}/mcp`);
+}
+if (import.meta.main) {
+  main().catch((err2) => {
+    console.error("MCP server error:", err2);
+    process.exit(1);
+  });
+}
+export {
+  buildServer
+};