@intutic/sync-daemon 2.0.0 → 2.2.0

package/dist/harness/mcpAutoWrite.js

@@ -3,7 +3,11 @@
  * MCP servers with the @intutic/mcp-governance-proxy.
  *
  * Injects and proxy-wraps MCP server entries in:
- * - Claude Code:      ~/.claude/mcp.json
+ * - Claude Code:      ~/.claude.json (user-scope `mcpServers`, and the
+ *                      local-scope `projects[<workspaceRoot>].mcpServers`,
+ *                      where the approved servers of the project's
+ *                      `.mcp.json` also get wrapped shadows — the shared
+ *                      `.mcp.json` itself is only read)
  * - Claude Desktop:   ~/Library/Application Support/Claude/claude_desktop_config.json
  * - Cursor (global):  ~/Library/Application Support/Cursor/User/globalSettings.json
  * - Cursor (project): <workspaceRoot>/.cursor/mcp.json
@@ -15,11 +19,14 @@
  * - Muse Code:        ~/.config/muse/settings.json (`mcp_servers` section)
  * - Grok Build:       ~/.grok/config.toml + <workspaceRoot>/.grok/config.toml
  *                      ([mcp_servers.*] tables)
+ * - OpenCode:         ~/.config/opencode/opencode.json + <workspaceRoot>/opencode.json
+ *                      (`mcp` block — TD-487; see `injectOpenCode`)
  *
- * That is 12 config paths across 10 `HarnessType` values (Cursor and Grok
- * Build each own two paths — global/project for Cursor, user/project for
- * Grok Build). `discoverMcpServers` below reads all twelve read-only, for
- * reporting; the injectors above are the only thing that writes.
+ * That is 14 config paths across 11 `HarnessType` values (Cursor, Grok
+ * Build and OpenCode each own two paths — global/project for Cursor and
+ * OpenCode, user/project for Grok Build). `discoverMcpServers` below reads
+ * all fourteen read-only, for reporting, plus Claude Code's project
+ * `.mcp.json`; the injectors above are the only thing that writes.
  *
  * # Grok Build's compat-path overlap — dedup, not a bug
  *
@@ -65,15 +72,13 @@
  *   comment used to describe as "left untouched": the entry is rewritten to
  *   spawn the SAME proxy binary in bridge mode (`--remote-url`/
  *   `--remote-transport`, headers riding in `INTUTIC_REMOTE_HEADERS` env, not
- *   argv — `ps` visibility). `__intutic_original` preserves the entry's
- *   pre-wrap `url`/`type`/`headers` so `classifyEntry` can report the TRUE
- *   transport of what got wrapped, and so a wrapped entry could be unwrapped
- *   later. See TECH_DEBT.md TD-354 for the historical decline this phase
- *   supersedes.
- *
- * Continuous invariant, not one-shot: `injectMcpServer` is called once from
- * `intutic connect` (tools/cli) AND once per sync-loop iteration
- * (services/sync-daemon/src/syncLoop.ts), so a server a user adds to a harness
+ *   argv — `ps` visibility). `__intutic_original` keeps the whole pre-wrap
+ *   entry, stdio or remote, so `classifyEntry` can report the TRUE transport
+ *   of what got wrapped and `intutic disconnect` can put the entry back
+ *   exactly.
+ *
+ * Continuous invariant, not one-shot: `intutic connect` (tools/cli) calls
+ * `injectMcpServer` on every sync cycle, so a server a user adds to a harness
  * config after their first `connect` still gets wrapped on the next sync
  * cycle rather than staying invisible to governance forever. Running this
  * every ~30s only works because `writeJsonFile` below is write-if-changed —
@@ -88,41 +93,63 @@ import * as node_fs from 'node:fs/promises';
 import * as node_path from 'node:path';
 import * as node_os from 'node:os';
 import { existsSync } from 'node:fs';
+import { createRequire } from 'node:module';
 import { isDeepStrictEqual } from 'node:util';
 import { createLogger } from '@intutic/logger';
+import { readJsonObjectForMerge } from './jsonMergeTarget.js';
+import { projectServerApproval } from './claudeProjectApproval.js';
+import { keepOriginal } from '../disconnect/originals.js';
 import { parseDocument, isMap } from 'yaml';
 import { parse as parseToml, stringify as stringifyToml } from 'smol-toml';
 const log = createLogger('sync-mcp-autowrite');
 // ─── Proxy Binary Resolution ─────────────────────────────────────────────────
+/** Resolves packages relative to this module — i.e. from wherever the
+ *  daemon itself is installed, not from the user's project. */
+const requireFromDaemon = createRequire(import.meta.url);
 /**
- * Resolve the path to the @intutic/mcp-governance-proxy binary.
+ * Resolve the path to the @intutic/mcp-governance-proxy entry point.
  *
  * Resolution order:
- * 1. `<workspaceRoot>/node_modules/@intutic/mcp-governance-proxy/dist/index.js`
- *    — created by pnpm after `pnpm install` (post-install production path)
- * 2. `<workspaceRoot>/packages/mcp-proxy/dist/index.js`
- *    — direct monorepo source path (dev without pnpm install, or if symlink is missing)
+ * 1. The copy installed next to this daemon — a dependency of
+ *    `@intutic/sync-daemon`, so a global `npm install -g @intutic/cli` has it
+ *    in the CLI's own node_modules. This is the normal case: the user's
+ *    project has no reason to depend on the proxy.
+ * 2. `<workspaceRoot>/node_modules/@intutic/mcp-governance-proxy/dist/index.js`
+ *    and `<workspaceRoot>/packages/mcp-proxy/dist/index.js` — for a run from
+ *    a bundled binary, whose bundled modules are not on disk for `node` to
+ *    load (their paths start with `/snapshot/`), and for a source checkout
+ *    that has not built the proxy yet.
  *
- * Using synchronous existsSync is intentional — this runs at daemon init time
- * (not in a hot path), and avoids async complexity in callers.
+ * Synchronous on purpose — this runs while building config entries, not in a
+ * hot path.
  */
-function resolveProxyBin(workspaceRoot) {
+export function resolveProxyBin(workspaceRoot) {
+    try {
+        const installed = requireFromDaemon.resolve('@intutic/mcp-governance-proxy');
+        if (!installed.startsWith('/snapshot/') && existsSync(installed))
+            return installed;
+    }
+    catch {
+        // Not installed alongside the daemon — fall through to the workspace.
+    }
     const nmPath = node_path.join(workspaceRoot, 'node_modules', '@intutic', 'mcp-governance-proxy', 'dist', 'index.js');
     if (existsSync(nmPath))
         return nmPath;
-    // Fallback: direct monorepo package path for dev environments
-    const pkgPath = node_path.join(workspaceRoot, 'packages', 'mcp-proxy', 'dist', 'index.js');
-    return pkgPath;
+    return node_path.join(workspaceRoot, 'packages', 'mcp-proxy', 'dist', 'index.js');
 }
 // ─── Config Path Resolution ───────────────────────────────────────────────────
 //
 // Shared by both the injectors (which write) and discoverMcpServers (which
 // only reads), so the two can never independently drift about where a
 // harness keeps its config.
+/** Claude Code keeps user- and local-scope MCP servers in `~/.claude.json`.
+ *  Project-scope servers live in the repo's `.mcp.json`, which is shared with
+ *  the team and never rewritten here; they are governed through local-scope
+ *  shadows instead (see {@link shadowProjectServers}). */
 function claudeCodeConfigPath() {
-    return node_path.join(node_os.homedir(), '.claude', 'mcp.json');
+    return node_path.join(node_os.homedir(), '.claude.json');
 }
-function claudeDesktopConfigPath() {
+export function claudeDesktopConfigPath() {
     const home = node_os.homedir();
     if (process.platform === 'darwin') {
         return node_path.join(home, 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json');
@@ -132,7 +159,7 @@ function claudeDesktopConfigPath() {
     }
     return node_path.join(home, '.config', 'Claude', 'claude_desktop_config.json');
 }
-function cursorGlobalConfigPath() {
+export function cursorGlobalConfigPath() {
     const home = node_os.homedir();
     if (process.platform === 'darwin') {
         return node_path.join(home, 'Library', 'Application Support', 'Cursor', 'User', 'globalSettings.json');
@@ -148,27 +175,37 @@ function cursorProjectConfigPath(workspaceRoot) {
 function clineConfigPath(workspaceRoot) {
     return node_path.join(workspaceRoot, '.cline', 'mcp.json');
 }
-function windsurfConfigPath() {
+export function windsurfConfigPath() {
     return node_path.join(node_os.homedir(), '.codeium', 'windsurf', 'mcp_config.json');
 }
-function continueConfigPath() {
+export function continueConfigPath() {
     return node_path.join(node_os.homedir(), '.continue', 'config.json');
 }
-function gooseConfigPath() {
+export function gooseConfigPath() {
     return node_path.join(node_os.homedir(), '.config', 'goose', 'config.yaml');
 }
 function openHandsConfigPath(workspaceRoot) {
     return node_path.join(workspaceRoot, '.openhands', 'mcp.json');
 }
-function museConfigPath() {
+export function museConfigPath() {
     return node_path.join(node_os.homedir(), '.config', 'muse', 'settings.json');
 }
-function grokUserConfigPath() {
+export function grokUserConfigPath() {
     return node_path.join(node_os.homedir(), '.grok', 'config.toml');
 }
 function grokProjectConfigPath(workspaceRoot) {
     return node_path.join(workspaceRoot, '.grok', 'config.toml');
 }
+/** OpenCode's global config: `$XDG_CONFIG_HOME/opencode/opencode.json`, which
+ *  is `~/.config/opencode/opencode.json` unless XDG_CONFIG_HOME is set (OpenCode
+ *  resolves it through xdg-basedir). Only the `.json` spelling — see `injectOpenCode`. */
+export function openCodeGlobalConfigPath() {
+    const base = process.env['XDG_CONFIG_HOME'] || node_path.join(node_os.homedir(), '.config');
+    return node_path.join(base, 'opencode', 'opencode.json');
+}
+function openCodeProjectConfigPath(workspaceRoot) {
+    return node_path.join(workspaceRoot, 'opencode.json');
+}
 // ─── Proxy Wrapping ───────────────────────────────────────────────────────────
 /**
  * Wrap a single MCP server entry with the governance proxy.
@@ -194,6 +231,7 @@ function wrapWithProxy(entry, workspaceId, workspaceRoot, serverName) {
     if (entry.__intutic_wrapped)
         return entry;
     const proxyBin = resolveProxyBin(workspaceRoot);
+    const original = structuredClone(entry);
     if (typeof entry.command === 'string') {
         const originalArgs = entry.args ?? [];
         return {
@@ -211,16 +249,12 @@ function wrapWithProxy(entry, workspaceId, workspaceRoot, serverName) {
                 INTUTIC_WORKSPACE_ID: workspaceId,
             },
             __intutic_wrapped: true,
+            __intutic_original: original,
         };
     }
     if (typeof entry.url === 'string') {
         const remoteTransport = entry.type?.toLowerCase() === 'sse' ? 'sse' : 'http';
         const hasHeaders = entry.headers !== undefined && Object.keys(entry.headers).length > 0;
-        const original = { url: entry.url };
-        if (entry.type !== undefined)
-            original.type = entry.type;
-        if (entry.headers !== undefined)
-            original.headers = entry.headers;
         const env = {
             ...(entry.env ?? {}),
             INTUTIC_WORKSPACE_ID: workspaceId,
@@ -291,11 +325,23 @@ async function readJsonFile(filePath, fallback) {
         return fallback;
     }
 }
+/**
+ * Read a harness config this module is about to write back. A missing file is
+ * an empty object; a file that is present but not a plain JSON object throws,
+ * so the caller's error handling skips the write instead of replacing the
+ * user's file with only the MCP entries (see jsonMergeTarget.ts).
+ */
+async function readJsonForWrite(filePath) {
+    const current = await readJsonObjectForMerge(filePath);
+    if (current === null)
+        throw new Error(`${filePath} is not a plain JSON object — left untouched`);
+    return current;
+}
 /**
  * Write JSON to disk, but only if the content actually changed.
  *
- * `injectMcpServer` now runs every sync-loop iteration (~every 30s, see
- * syncLoop.ts) instead of only once at `connect` time — re-running the same
+ * `injectMcpServer` runs every sync cycle (~every 30s, from `intutic
+ * connect`) instead of only once at startup — re-running the same
  * wrap against an already-wrapped, unchanged config must not touch the file,
  * or every cycle would churn the file's mtime and fire a spurious inotify /
  * FSEvents event for every harness config on every developer machine.
@@ -304,8 +350,12 @@ async function readJsonFile(filePath, fallback) {
  * serialized string — a naive string compare would report a false "changed"
  * on nothing more than JSON.stringify key-ordering differences between two
  * semantically identical objects.
+ *
+ * With `workspaceRoot`, the file's original is kept for `intutic disconnect`
+ * before the first write. `~/.claude.json` goes without: it is Claude Code's
+ * live state, never restored whole.
  */
-async function writeJsonFile(filePath, data) {
+async function writeJsonFile(filePath, data, workspaceRoot) {
     let existing;
     let hasExisting;
     try {
@@ -318,16 +368,113 @@ async function writeJsonFile(filePath, data) {
     if (hasExisting && isDeepStrictEqual(existing, data)) {
         return;
     }
+    if (workspaceRoot !== undefined)
+        await keepOriginal(filePath, workspaceRoot);
     await node_fs.mkdir(node_path.dirname(filePath), { recursive: true });
     await node_fs.writeFile(filePath, JSON.stringify(data, null, 2) + '\n', 'utf-8');
 }
-// ─── Target: Claude Code ─────────────────────────────────────────────────────
 async function injectClaudeCode(workspaceId, workspaceRoot) {
     const configPath = claudeCodeConfigPath();
-    const current = await readJsonFile(configPath, {});
+    // ~/.claude.json is Claude Code's own state file; it exists once Claude
+    // Code has run. Never created here, and merged key by key: everything but
+    // the two `mcpServers` maps below is Claude Code's.
+    if (!existsSync(configPath)) {
+        log.debug({ action: 'claude_code_skip' }, 'Claude Code not set up (no ~/.claude.json) — skipping');
+        return;
+    }
+    const current = await readJsonForWrite(configPath);
+    // User scope: available in every project.
     current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
+    // Local scope: servers added with `claude mcp add` in this project, then
+    // the shadows that govern its approved `.mcp.json` servers. A project Claude
+    // Code has never opened has no entry, and nothing approved to shadow.
+    const project = current.projects?.[workspaceRoot];
+    if (project) {
+        const local = wrapAllServers(project.mcpServers ?? {}, workspaceId, workspaceRoot);
+        const withShadows = shadowProjectServers(local, await readProjectScopeServers(workspaceRoot), await projectServerApproval(workspaceRoot, current), workspaceId, workspaceRoot);
+        if (project.mcpServers !== undefined || Object.keys(withShadows).length > 0)
+            project.mcpServers = withShadows;
+    }
     await writeJsonFile(configPath, current);
-    log.info({ action: 'claude_code_mcp_injected' }, 'Claude Code ~/.claude/mcp.json updated');
+    log.info({ action: 'claude_code_mcp_injected' }, 'Claude Code ~/.claude.json MCP servers updated');
+}
+/** Where Claude Code keeps a project's shared, committed servers. */
+function claudeCodeProjectMcpPath(workspaceRoot) {
+    return node_path.join(workspaceRoot, '.mcp.json');
+}
+/** The project's `.mcp.json` servers; empty when the file is missing or not a JSON object. */
+async function readProjectScopeServers(workspaceRoot) {
+    const parsed = await readJsonFile(claudeCodeProjectMcpPath(workspaceRoot), {});
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+        return {};
+    const servers = parsed.mcpServers;
+    return servers !== null && typeof servers === 'object' && !Array.isArray(servers) ? servers : {};
+}
+/**
+ * Why an approved project server cannot get a governed local-scope copy, or
+ * null when it can. Exported for discovery's reporting through
+ * {@link discoverMcpServers}.
+ *
+ * Expansion itself is not a reason: Claude Code expands `${VAR}` the same way
+ * at local scope as in `.mcp.json`, in `command`, `args`, `env`, `url` and
+ * `headers` (verified with Claude Code 2.1.233 — see the MCP governance
+ * guide), so a copy keeps references verbatim and writes no resolved value.
+ * A remote server is the exception. Its copy is a stdio entry that hands the
+ * url to the proxy as an argument and the headers through the environment,
+ * where Claude Code expands every variable; in a remote server's own `url`
+ * and `headers` it reads credential variables (its own API keys, cloud and
+ * proxy credentials) as empty, by a list it does not publish in full. A copy
+ * could therefore send a credential the original never would.
+ */
+function shadowBlocker(entry) {
+    if (entry === null || typeof entry !== 'object')
+        return 'an entry the proxy cannot front';
+    if (entry.__intutic_wrapped)
+        return 'the entry in .mcp.json is already wrapped';
+    if (typeof entry.command === 'string')
+        return null;
+    if (typeof entry.url === 'string') {
+        const refs = [entry.url, ...Object.values(entry.headers ?? {})].some((v) => typeof v === 'string' && v.includes('${'));
+        return refs
+            ? 'its url or headers reference environment variables, which Claude Code expands with a credential filter a wrapped copy cannot keep'
+            : null;
+    }
+    return 'an entry the proxy cannot front';
+}
+/**
+ * Governs a project's `.mcp.json` servers without touching the file.
+ *
+ * `.mcp.json` is committed and shared with the team: wrapping it in place
+ * would write this machine's proxy path and workspace id into everyone's
+ * checkout. Claude Code gives a local-scope server precedence over a
+ * project-scope one of the same name, so each approved project server gets a
+ * wrapped copy at local scope, in this project's `~/.claude.json` entry,
+ * marked `__intutic_shadow_of: 'project'`. The rules:
+ *
+ * - A server the user added at local scope keeps its name; it is wrapped by
+ *   the local-scope pass already and never replaced by a shadow.
+ * - A shadow follows its source: rewritten when the project entry changes,
+ *   removed when the project entry, or its approval, goes away. Deleting the
+ *   marked entries returns the project to exactly what `.mcp.json` says.
+ * - An entry whose shape the proxy cannot wrap is left to Claude Code as is.
+ * - Re-running on unchanged input produces the same map, so the
+ *   write-if-changed in `writeJsonFile` writes nothing.
+ */
+function shadowProjectServers(local, projectServers, approval, workspaceId, workspaceRoot) {
+    const result = {};
+    for (const [name, entry] of Object.entries(local)) {
+        if (entry.__intutic_shadow_of === 'project')
+            continue; // rebuilt below from the current source
+        result[name] = entry;
+    }
+    for (const [name, entry] of Object.entries(projectServers)) {
+        if (name === 'intutic' || name in result || !approval.approved(name))
+            continue;
+        if (shadowBlocker(entry) !== null)
+            continue;
+        result[name] = { ...wrapWithProxy(entry, workspaceId, workspaceRoot, name), __intutic_shadow_of: 'project' };
+    }
+    return result;
 }
 // ─── Target: Claude Desktop ───────────────────────────────────────────────────
 async function injectClaudeDesktop(workspaceId, workspaceRoot) {
@@ -340,9 +487,9 @@ async function injectClaudeDesktop(workspaceId, workspaceRoot) {
         log.debug({ action: 'claude_desktop_skip' }, 'Claude Desktop not installed — skipping');
         return;
     }
-    const current = await readJsonFile(configPath, {});
+    const current = await readJsonForWrite(configPath);
     current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
-    await writeJsonFile(configPath, current);
+    await writeJsonFile(configPath, current, workspaceRoot);
     log.info({ action: 'claude_desktop_mcp_injected' }, 'Claude Desktop config updated');
 }
 // ─── Target: Cursor (global + project) ───────────────────────────────────────
@@ -351,9 +498,9 @@ async function injectCursor(workspaceId, workspaceRoot) {
     const globalPath = cursorGlobalConfigPath();
     try {
         await node_fs.access(node_path.dirname(globalPath));
-        const current = await readJsonFile(globalPath, {});
+        const current = await readJsonForWrite(globalPath);
         current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
-        await writeJsonFile(globalPath, current);
+        await writeJsonFile(globalPath, current, workspaceRoot);
         log.info({ action: 'cursor_global_mcp_injected' }, 'Cursor globalSettings.json updated');
     }
     catch {
@@ -362,9 +509,9 @@ async function injectCursor(workspaceId, workspaceRoot) {
     // Project-level .cursor/mcp.json
     const projectPath = cursorProjectConfigPath(workspaceRoot);
     try {
-        const current = await readJsonFile(projectPath, {});
+        const current = await readJsonForWrite(projectPath);
         current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
-        await writeJsonFile(projectPath, current);
+        await writeJsonFile(projectPath, current, workspaceRoot);
         log.info({ action: 'cursor_project_mcp_injected' }, 'Cursor .cursor/mcp.json updated');
     }
     catch (err) {
@@ -375,9 +522,9 @@ async function injectCursor(workspaceId, workspaceRoot) {
 async function injectCline(workspaceId, workspaceRoot) {
     const configPath = clineConfigPath(workspaceRoot);
     try {
-        const current = await readJsonFile(configPath, {});
+        const current = await readJsonForWrite(configPath);
         current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
-        await writeJsonFile(configPath, current);
+        await writeJsonFile(configPath, current, workspaceRoot);
         log.info({ action: 'cline_mcp_injected' }, 'Cline .cline/mcp.json updated');
     }
     catch (err) {
@@ -389,9 +536,9 @@ async function injectWindsurf(workspaceId, workspaceRoot) {
     const configPath = windsurfConfigPath();
     try {
         await node_fs.access(node_path.dirname(configPath));
-        const current = await readJsonFile(configPath, {});
+        const current = await readJsonForWrite(configPath);
         current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
-        await writeJsonFile(configPath, current);
+        await writeJsonFile(configPath, current, workspaceRoot);
         log.info({ action: 'windsurf_mcp_injected' }, 'Windsurf mcp_config.json updated');
     }
     catch {
@@ -402,7 +549,7 @@ async function injectContinue(workspaceId, workspaceRoot) {
     const configPath = continueConfigPath();
     try {
         await node_fs.access(node_path.dirname(configPath));
-        const current = await readJsonFile(configPath, {});
+        const current = await readJsonForWrite(configPath);
         // Continue uses an array format for mcpServers
         if (!Array.isArray(current.mcpServers)) {
             current.mcpServers = [];
@@ -412,14 +559,16 @@ async function injectContinue(workspaceId, workspaceRoot) {
         // Wrap existing non-intutic servers — routed through the same
         // wrapWithProxy used by every other harness, so the stdio-only guard and
         // --server-name threading stay in one place instead of two.
+        // The whole entry goes in, so the wrap's `__intutic_original` holds every
+        // key `intutic disconnect` has to put back.
         current.mcpServers = current.mcpServers.map((s) => {
-            const wrapped = wrapWithProxy({ command: s.command, args: s.args, env: s.env, url: s.url, type: s.type, __intutic_wrapped: s.__intutic_wrapped }, workspaceId, workspaceRoot, s.name);
-            return { name: s.name, ...wrapped };
+            const { name, ...entry } = s;
+            return { name, ...wrapWithProxy(entry, workspaceId, workspaceRoot, name) };
         });
         // Add Intutic MCP server
         const entry = buildIntuticMcpEntry(workspaceRoot);
         current.mcpServers.unshift({ name: 'intutic', ...entry });
-        await writeJsonFile(configPath, current);
+        await writeJsonFile(configPath, current, workspaceRoot);
         log.info({ action: 'continue_mcp_injected' }, 'Continue ~/.continue/config.json updated');
     }
     catch {
@@ -455,6 +604,7 @@ async function injectGooseAppendOnly(configPath, existingYaml, workspaceId, prox
         // (see writeJsonFile's doc comment for why: this runs every sync cycle now).
         return;
     }
+    await keepOriginal(configPath, node_os.homedir());
     await node_fs.mkdir(node_path.dirname(configPath), { recursive: true });
     await node_fs.writeFile(configPath, text, 'utf-8');
     log.info({ action: 'goose_mcp_injected', mode: 'append_only_fallback' }, 'Goose config.yaml updated (append-only fallback)');
@@ -471,7 +621,7 @@ async function injectGooseAppendOnly(configPath, existingYaml, workspaceId, prox
  * stdio entries wrapped with `--`, remote (`url`-keyed) entries wrapped with
  * `--remote-url`/`--remote-transport` — so a remote MCP server declared in
  * Goose's config gets the identical bridge coverage a remote entry in
- * `~/.claude/mcp.json` would get, not a second, divergent convention.
+ * `~/.claude.json` would get, not a second, divergent convention.
  *
  * Falls back to `injectGooseAppendOnly` (append-only text injection, the
  * pre-existing behaviour) when the file does not parse as YAML at all —
@@ -546,6 +696,7 @@ async function injectGoose(workspaceId, workspaceRoot) {
         // (see writeJsonFile's doc comment for why: this runs every sync cycle now).
         return;
     }
+    await keepOriginal(configPath, workspaceRoot);
     await node_fs.mkdir(node_path.dirname(configPath), { recursive: true });
     await node_fs.writeFile(configPath, doc.toString(), 'utf-8');
     log.info({ action: 'goose_mcp_injected', mode: 'yaml' }, 'Goose config.yaml updated (structural YAML edit)');
@@ -554,9 +705,9 @@ async function injectGoose(workspaceId, workspaceRoot) {
 async function injectOpenHands(workspaceId, workspaceRoot) {
     const configPath = openHandsConfigPath(workspaceRoot);
     try {
-        const current = await readJsonFile(configPath, {});
+        const current = await readJsonForWrite(configPath);
         current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
-        await writeJsonFile(configPath, current);
+        await writeJsonFile(configPath, current, workspaceRoot);
         log.info({ action: 'openhands_mcp_injected' }, 'OpenHands .openhands/mcp.json updated');
     }
     catch (err) {
@@ -583,11 +734,11 @@ async function injectMuse(workspaceId, workspaceRoot) {
         log.debug({ action: 'muse_skip' }, 'Muse Code not installed — skipping');
         return;
     }
-    const current = await readJsonFile(configPath, {});
+    const current = await readJsonForWrite(configPath);
     current.mcp_servers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcp_servers ?? {}) }, workspaceId, workspaceRoot);
     if (current.schema_version === undefined)
         current.schema_version = 1;
-    await writeJsonFile(configPath, current);
+    await writeJsonFile(configPath, current, workspaceRoot);
     log.info({ action: 'muse_mcp_injected' }, 'Muse Code ~/.config/muse/settings.json mcp_servers updated');
 }
 /**
@@ -600,7 +751,7 @@ async function injectMuse(workspaceId, workspaceRoot) {
  * honest limit `injectGooseAppendOnly`/`discoverGooseLineScanFallback`
  * document for their own fallback.
  */
-async function injectGrokConfigAppendOnly(configPath, existingToml, workspaceId, proxyBin) {
+async function injectGrokConfigAppendOnly(configPath, existingToml, workspaceId, proxyBin, workspaceRoot) {
     let text = existingToml;
     if (!text.includes('[mcp_servers.intutic]') && !text.includes('[mcp_servers."intutic"]')) {
         const block = [
@@ -612,6 +763,7 @@ async function injectGrokConfigAppendOnly(configPath, existingToml, workspaceId,
     }
     if (text === existingToml)
         return;
+    await keepOriginal(configPath, workspaceRoot);
     await node_fs.mkdir(node_path.dirname(configPath), { recursive: true });
     await node_fs.writeFile(configPath, text, 'utf-8');
     log.info({ action: 'grok_mcp_injected', mode: 'append_only_fallback' }, 'Grok config.toml updated (append-only fallback)');
@@ -622,7 +774,7 @@ async function injectGrokConfigAppendOnly(configPath, existingToml, workspaceId,
  * SAME `wrapWithProxy` convention every other harness uses (stdio entries
  * wrapped with `--`, remote/`url`-keyed entries wrapped with
  * `--remote-url`/`--remote-transport`) so a remote MCP server declared for
- * Grok Build gets identical bridge coverage to one in `~/.claude/mcp.json`,
+ * Grok Build gets identical bridge coverage to one in `~/.claude.json`,
  * not a second, divergent convention.
  *
  * Unlike `injectGoose`'s `Document#setIn` (which preserves comments/
@@ -654,7 +806,7 @@ async function injectGrokConfig(configPath, workspaceId, workspaceRoot) {
     }
     catch (err) {
         log.warn({ action: 'grok_toml_unparseable', path: configPath, err: err.message }, 'Grok config.toml did not parse as TOML — falling back to append-only text injection');
-        await injectGrokConfigAppendOnly(configPath, existingToml, workspaceId, proxyBin);
+        await injectGrokConfigAppendOnly(configPath, existingToml, workspaceId, proxyBin, workspaceRoot);
         return;
     }
     const servers = doc.mcp_servers && typeof doc.mcp_servers === 'object' ? doc.mcp_servers : {};
@@ -679,6 +831,7 @@ async function injectGrokConfig(configPath, workspaceId, workspaceRoot) {
         return;
     }
     doc.mcp_servers = servers;
+    await keepOriginal(configPath, workspaceRoot);
     await node_fs.mkdir(node_path.dirname(configPath), { recursive: true });
     const tmp = configPath + '.intutic-tmp';
     await node_fs.writeFile(tmp, stringifyToml(doc), 'utf-8');
@@ -689,6 +842,129 @@ async function injectGrok(workspaceId, workspaceRoot) {
     await injectGrokConfig(grokProjectConfigPath(workspaceRoot), workspaceId, workspaceRoot);
     await injectGrokConfig(grokUserConfigPath(), workspaceId, workspaceRoot);
 }
+/** The proxy binary path `resolveProxyBin` returns, in either of its two forms. */
+export const PROXY_BIN_PATTERN = /(?:^|[\\/])(?:@intutic[\\/]mcp-governance-proxy|packages[\\/]mcp-proxy)[\\/]dist[\\/]index\.js$/;
+/**
+ * Whether an OpenCode entry is already fronted by the governance proxy, read
+ * from the command SHAPE — `["node", <proxy bin>, "--workspace-id", …]` —
+ * because an OpenCode entry cannot carry the `__intutic_wrapped` marker every
+ * other harness uses: OpenCode's config schema has no such key, and a key the
+ * schema does not declare is at best dropped and at worst refused.
+ */
+function isOpenCodeWrapped(entry) {
+    const c = entry.command;
+    return (Array.isArray(c) &&
+        c[0] === 'node' &&
+        typeof c[1] === 'string' &&
+        PROXY_BIN_PATTERN.test(c[1]) &&
+        c.includes('--workspace-id'));
+}
+/**
+ * Wrap one OpenCode server. Translates the entry into the `command`/`args`/
+ * `env` (or `url`/`headers`) shape `wrapWithProxy` takes, so the proxy argv —
+ * `--workspace-id`, `--server-name`, then `--` and the real command, or
+ * `--remote-url`/`--remote-transport` for a remote server — is built in one
+ * place for every harness, then translates the result back into a `local`
+ * entry. Keys OpenCode defines for a local server (`cwd`, `enabled`,
+ * `timeout`, and anything unrecognised) are carried over unchanged.
+ *
+ * Left alone: an already-wrapped entry, an entry of neither type, a local
+ * entry with no command, and a remote entry with an `oauth` object. The
+ * proxy's remote bridge forwards static headers only, so wrapping a server
+ * that relies on OpenCode's own OAuth flow would silently stop it from
+ * authenticating; it stays ungoverned by the MCP proxy instead (the plugin
+ * gate still sees its calls).
+ */
+function wrapOpenCodeEntry(entry, workspaceId, workspaceRoot, serverName) {
+    if (isOpenCodeWrapped(entry))
+        return entry;
+    const { type, command, environment, url, headers, oauth, ...rest } = entry;
+    let wrapped;
+    if (type === 'local' && Array.isArray(command) && command.length > 0 && command.every((a) => typeof a === 'string')) {
+        const [cmd, ...args] = command;
+        wrapped = wrapWithProxy({ command: cmd, args, env: environment }, workspaceId, workspaceRoot, serverName);
+    }
+    else if (type === 'remote' && typeof url === 'string' && (oauth === undefined || oauth === false)) {
+        // OpenCode tries streamable HTTP first, then SSE; the bridge's `http` is
+        // the streamable transport. `type` is OpenCode's discriminator, not a
+        // transport hint, so it is not passed through.
+        wrapped = wrapWithProxy({ url, headers }, workspaceId, workspaceRoot, serverName);
+    }
+    else {
+        return entry;
+    }
+    // `rest` holds keys valid on a local entry (cwd/enabled/timeout/…); a
+    // remote entry's url/headers/oauth are now carried by the argv and env.
+    return {
+        type: 'local',
+        command: [wrapped.command, ...(wrapped.args ?? [])],
+        environment: wrapped.env,
+        ...rest,
+    };
+}
+/**
+ * Merge the governance proxy into ONE OpenCode config file's `mcp` block.
+ *
+ * Narrow by design, like Muse's `settings.json`: `opencode.json` is the
+ * user's file (providers, permissions, agents, themes), so only `mcp` is
+ * rewritten and every other key is written back as it was parsed, in its
+ * original order, with the file's own indentation. The file is never created
+ * — a missing `opencode.json` means this scope has no OpenCode config to
+ * govern. OpenCode reads `opencode.json` as JSONC; a file that carries
+ * comments or trailing commas does not parse as JSON and is skipped
+ * (`opencode_config_unparseable`), never rewritten, since a rewrite would
+ * strip the comments. `opencode.jsonc` is not touched for the same reason.
+ * Write-if-changed and atomic, like every target here.
+ */
+async function injectOpenCodeConfig(configPath, workspaceId, workspaceRoot) {
+    let raw;
+    try {
+        raw = await node_fs.readFile(configPath, 'utf-8');
+    }
+    catch {
+        return;
+    }
+    let doc;
+    try {
+        doc = JSON.parse(raw);
+    }
+    catch (err) {
+        log.warn({ action: 'opencode_config_unparseable', path: configPath, err: err.message }, 'opencode.json is not plain JSON (comments?) — MCP servers in it are not proxy-wrapped');
+        return;
+    }
+    if (!doc || typeof doc !== 'object' || Array.isArray(doc))
+        return;
+    const config = doc;
+    const existing = config['mcp'] && typeof config['mcp'] === 'object' && !Array.isArray(config['mcp'])
+        ? config['mcp']
+        : {};
+    const intutic = buildIntuticMcpEntry(workspaceRoot);
+    const servers = {
+        intutic: { type: 'local', command: [intutic.command, ...(intutic.args ?? [])], environment: intutic.env },
+        ...existing,
+    };
+    const next = {};
+    for (const [name, entry] of Object.entries(servers)) {
+        next[name] =
+            name === 'intutic' || !entry || typeof entry !== 'object'
+                ? entry
+                : wrapOpenCodeEntry(entry, workspaceId, workspaceRoot, name);
+    }
+    if (isDeepStrictEqual(next, config['mcp']))
+        return;
+    config['mcp'] = next;
+    const indent = raw.match(/^([ \t]+)\S/m)?.[1] ?? 2;
+    // OpenCode entries cannot carry a marker, so disconnect needs the file as it was.
+    await keepOriginal(configPath, workspaceRoot);
+    const tmp = configPath + '.intutic-tmp';
+    await node_fs.writeFile(tmp, JSON.stringify(config, null, indent) + '\n', 'utf-8');
+    await node_fs.rename(tmp, configPath);
+    log.info({ action: 'opencode_mcp_injected', path: configPath }, 'OpenCode opencode.json mcp block updated');
+}
+async function injectOpenCode(workspaceId, workspaceRoot) {
+    await injectOpenCodeConfig(openCodeProjectConfigPath(workspaceRoot), workspaceId, workspaceRoot);
+    await injectOpenCodeConfig(openCodeGlobalConfigPath(), workspaceId, workspaceRoot);
+}
 // ─── Discovery (read-only — writes nothing) ───────────────────────────────────
 /** Classify a raw server entry's transport + wrapped status, tolerant of any shape. */
 function classifyEntry(entry) {
@@ -732,6 +1008,32 @@ async function discoverJsonObjectHarness(harness, filePath) {
     }
     return out;
 }
+/** Claude Code's servers as Claude Code resolves them: user scope
+ *  (`~/.claude.json`), project scope (the repo's `.mcp.json`) and local scope
+ *  (this project's entry in `~/.claude.json`), each narrower scope winning a
+ *  name — so a project server governed by a local-scope shadow reports as
+ *  wrapped. */
+async function discoverClaudeCode(workspaceRoot) {
+    const filePath = claudeCodeConfigPath();
+    const current = existsSync(filePath) ? await readJsonFile(filePath, {}) : {};
+    const projectServers = await readProjectScopeServers(workspaceRoot);
+    const local = current.projects?.[workspaceRoot]?.mcpServers ?? {};
+    const servers = { ...(current.mcpServers ?? {}), ...projectServers, ...local };
+    const approval = Object.keys(projectServers).length > 0 ? await projectServerApproval(workspaceRoot, current) : null;
+    return Object.entries(servers).map(([name, entry]) => {
+        const found = { server: name, harness: 'claude-code', ...classifyEntry(entry) };
+        // A project server Claude Code will start, with no copy of ours in front of it.
+        if (approval && name in projectServers && !(name in local) && approval.approved(name)) {
+            const reason = shadowBlocker(projectServers[name]);
+            if (reason)
+                found.ungovernedReason = `Claude Code project server not governed: ${reason}`;
+        }
+        if (approval?.blockedReason && name in projectServers && !(name in local)) {
+            found.ungovernedReason = `Claude Code project server not governed: ${approval.blockedReason}`;
+        }
+        return found;
+    });
+}
 /** Muse Code's `~/.config/muse/settings.json` keeps servers under `mcp_servers`,
  *  not `mcpServers` — otherwise the same JSON-map shape `discoverJsonObjectHarness`
  *  reads, so this is that function with one key renamed rather than a new format. */
@@ -885,9 +1187,45 @@ async function discoverGrok(workspaceRoot) {
     ]);
     return [...project, ...user];
 }
+/** Classify an OpenCode `mcp` entry. A wrapped entry is a `local` one whose
+ *  argv names the proxy; its true transport is read back from that argv
+ *  (`--remote-url` / `--remote-transport`), since OpenCode entries cannot
+ *  carry `__intutic_original`. */
+function classifyOpenCodeEntry(entry) {
+    if (!entry || typeof entry !== 'object')
+        return { transport: 'unknown', wrapped: false };
+    const e = entry;
+    const wrapped = isOpenCodeWrapped(e);
+    if (wrapped) {
+        const argv = e.command;
+        if (!argv.includes('--remote-url'))
+            return { transport: 'stdio', wrapped };
+        const t = argv[argv.indexOf('--remote-transport') + 1];
+        return { transport: t === 'sse' ? 'sse' : 'http', wrapped };
+    }
+    if (e.type === 'local' && Array.isArray(e.command))
+        return { transport: 'stdio', wrapped };
+    if (e.type === 'remote' && typeof e.url === 'string')
+        return { transport: 'http', wrapped };
+    return { transport: 'unknown', wrapped };
+}
+async function discoverOpenCodeConfig(configPath) {
+    if (!existsSync(configPath))
+        return [];
+    const current = await readJsonFile(configPath, {});
+    const mcp = current.mcp && typeof current.mcp === 'object' ? current.mcp : {};
+    return Object.entries(mcp).map(([name, entry]) => ({ server: name, harness: 'opencode', ...classifyOpenCodeEntry(entry) }));
+}
+async function discoverOpenCode(workspaceRoot) {
+    const [project, global] = await Promise.all([
+        discoverOpenCodeConfig(openCodeProjectConfigPath(workspaceRoot)),
+        discoverOpenCodeConfig(openCodeGlobalConfigPath()),
+    ]);
+    return [...project, ...global];
+}
 /**
  * Discover every MCP server declared in any harness config this daemon knows
- * how to parse — the same 12 config paths / 10 harnesses `injectMcpServer`
+ * how to parse — the same 14 config paths / 11 harnesses `injectMcpServer`
  * wraps — without writing anything. Used for reporting (agentReporter's
  * `mcp_tools` facet) so visibility does not silently lag behind whatever
  * `injectMcpServer` was last run against.
@@ -906,7 +1244,7 @@ async function discoverGrok(workspaceRoot) {
  */
 export async function discoverMcpServers(workspaceRoot) {
     const results = await Promise.all([
-        discoverJsonObjectHarness('claude-code', claudeCodeConfigPath()),
+        discoverClaudeCode(workspaceRoot),
         discoverJsonObjectHarness('claude-desktop', claudeDesktopConfigPath()),
         discoverJsonObjectHarness('cursor', cursorGlobalConfigPath()),
         discoverJsonObjectHarness('cursor', cursorProjectConfigPath(workspaceRoot)),
@@ -917,6 +1255,7 @@ export async function discoverMcpServers(workspaceRoot) {
         discoverGoose(),
         discoverMuse(),
         discoverGrok(workspaceRoot),
+        discoverOpenCode(workspaceRoot),
     ]);
     return results.flat().filter((s) => s.server !== 'intutic');
 }
@@ -926,31 +1265,36 @@ export async function discoverMcpServers(workspaceRoot) {
  *
  * Non-fatal: a failure in one harness does not prevent other harnesses from being updated.
  *
- * Called from two places by design: once from `intutic connect` (tools/cli)
- * for immediate effect, and once per sync-loop iteration
- * (services/sync-daemon/src/syncLoop.ts) so it is a continuous invariant
- * rather than a one-shot — a server a user adds after their first `connect`
+ * Called by `intutic connect` (tools/cli) on every sync cycle, so it is a
+ * continuous invariant rather than a one-shot — a server a user adds after their first `connect`
  * still gets wrapped on the next cycle. Safe to call every cycle because
  * `writeJsonFile` is write-if-changed: an already-wrapped, unchanged config
  * writes zero bytes.
  *
  * @param workspaceId - The workspace ID for policy lookups and event attribution.
  * @param workspaceRoot - Absolute path to the project workspace root.
+ * @param options.skip - Harness ids to leave alone: the ones `intutic
+ *   disconnect --harness` took out.
  */
-export async function injectMcpServer(workspaceRoot, workspaceId = 'unknown') {
+export async function injectMcpServer(workspaceRoot, workspaceId = 'unknown', options = {}) {
     log.info({ action: 'mcp_inject_start', workspaceRoot, workspaceId }, 'Starting MCP server injection');
-    await Promise.allSettled([
-        injectClaudeCode(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'claude-code' }, 'MCP injection failed')),
-        injectClaudeDesktop(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'claude-desktop' }, 'MCP injection failed')),
-        injectCursor(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'cursor' }, 'MCP injection failed')),
-        injectCline(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'cline' }, 'MCP injection failed')),
-        injectWindsurf(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'windsurf' }, 'MCP injection failed')),
-        injectContinue(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'continue' }, 'MCP injection failed')),
-        injectGoose(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'goose' }, 'MCP injection failed')),
-        injectOpenHands(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'openhands' }, 'MCP injection failed')),
-        injectMuse(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'muse-code' }, 'MCP injection failed')),
-        injectGrok(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'grok' }, 'MCP injection failed')),
-    ]);
+    const targets = [
+        ['claude-code', injectClaudeCode],
+        ['claude-desktop', injectClaudeDesktop],
+        ['cursor', injectCursor],
+        ['cline', injectCline],
+        ['windsurf', injectWindsurf],
+        ['continue', injectContinue],
+        ['goose', injectGoose],
+        ['openhands', injectOpenHands],
+        ['muse-code', injectMuse],
+        ['grok', injectGrok],
+        ['opencode', injectOpenCode],
+    ];
+    const skip = new Set(options.skip ?? []);
+    await Promise.allSettled(targets
+        .filter(([target]) => !skip.has(target))
+        .map(([target, inject]) => inject(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target }, 'MCP injection failed'))));
     log.info({ action: 'mcp_inject_complete', workspaceRoot }, 'MCP server injection complete');
 }
 //# sourceMappingURL=mcpAutoWrite.js.map