@intutic/sync-daemon 2.1.0 → 2.2.0

package/dist/harness/mcpAutoWrite.js

@@ -4,7 +4,10 @@
  *
  * Injects and proxy-wraps MCP server entries in:
  * - Claude Code:      ~/.claude.json (user-scope `mcpServers`, and the
- *                      local-scope `projects[<workspaceRoot>].mcpServers`)
+ *                      local-scope `projects[<workspaceRoot>].mcpServers`,
+ *                      where the approved servers of the project's
+ *                      `.mcp.json` also get wrapped shadows — the shared
+ *                      `.mcp.json` itself is only read)
  * - Claude Desktop:   ~/Library/Application Support/Claude/claude_desktop_config.json
  * - Cursor (global):  ~/Library/Application Support/Cursor/User/globalSettings.json
  * - Cursor (project): <workspaceRoot>/.cursor/mcp.json
@@ -22,8 +25,8 @@
  * That is 14 config paths across 11 `HarnessType` values (Cursor, Grok
  * Build and OpenCode each own two paths — global/project for Cursor and
  * OpenCode, user/project for Grok Build). `discoverMcpServers` below reads
- * all fourteen read-only, for reporting; the injectors above are the only
- * thing that writes.
+ * all fourteen read-only, for reporting, plus Claude Code's project
+ * `.mcp.json`; the injectors above are the only thing that writes.
  *
  * # Grok Build's compat-path overlap — dedup, not a bug
  *
@@ -69,15 +72,13 @@
  *   comment used to describe as "left untouched": the entry is rewritten to
  *   spawn the SAME proxy binary in bridge mode (`--remote-url`/
  *   `--remote-transport`, headers riding in `INTUTIC_REMOTE_HEADERS` env, not
- *   argv — `ps` visibility). `__intutic_original` preserves the entry's
- *   pre-wrap `url`/`type`/`headers` so `classifyEntry` can report the TRUE
- *   transport of what got wrapped, and so a wrapped entry could be unwrapped
- *   later. See TECH_DEBT.md TD-354 for the historical decline this phase
- *   supersedes.
+ *   argv — `ps` visibility). `__intutic_original` keeps the whole pre-wrap
+ *   entry, stdio or remote, so `classifyEntry` can report the TRUE transport
+ *   of what got wrapped and `intutic disconnect` can put the entry back
+ *   exactly.
  *
- * Continuous invariant, not one-shot: `injectMcpServer` is called once from
- * `intutic connect` (tools/cli) AND once per sync-loop iteration
- * (services/sync-daemon/src/syncLoop.ts), so a server a user adds to a harness
+ * Continuous invariant, not one-shot: `intutic connect` (tools/cli) calls
+ * `injectMcpServer` on every sync cycle, so a server a user adds to a harness
  * config after their first `connect` still gets wrapped on the next sync
  * cycle rather than staying invisible to governance forever. Running this
  * every ~30s only works because `writeJsonFile` below is write-if-changed —
@@ -96,6 +97,8 @@ import { createRequire } from 'node:module';
 import { isDeepStrictEqual } from 'node:util';
 import { createLogger } from '@intutic/logger';
 import { readJsonObjectForMerge } from './jsonMergeTarget.js';
+import { projectServerApproval } from './claudeProjectApproval.js';
+import { keepOriginal } from '../disconnect/originals.js';
 import { parseDocument, isMap } from 'yaml';
 import { parse as parseToml, stringify as stringifyToml } from 'smol-toml';
 const log = createLogger('sync-mcp-autowrite');
@@ -139,13 +142,14 @@ export function resolveProxyBin(workspaceRoot) {
 // Shared by both the injectors (which write) and discoverMcpServers (which
 // only reads), so the two can never independently drift about where a
 // harness keeps its config.
-/** Claude Code keeps user- and local-scope MCP servers in `~/.claude.json`
- *  (project-scope servers live in the repo's `.mcp.json`, which is shared
- *  with the team and is not rewritten here). */
+/** Claude Code keeps user- and local-scope MCP servers in `~/.claude.json`.
+ *  Project-scope servers live in the repo's `.mcp.json`, which is shared with
+ *  the team and never rewritten here; they are governed through local-scope
+ *  shadows instead (see {@link shadowProjectServers}). */
 function claudeCodeConfigPath() {
     return node_path.join(node_os.homedir(), '.claude.json');
 }
-function claudeDesktopConfigPath() {
+export function claudeDesktopConfigPath() {
     const home = node_os.homedir();
     if (process.platform === 'darwin') {
         return node_path.join(home, 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json');
@@ -155,7 +159,7 @@ function claudeDesktopConfigPath() {
     }
     return node_path.join(home, '.config', 'Claude', 'claude_desktop_config.json');
 }
-function cursorGlobalConfigPath() {
+export function cursorGlobalConfigPath() {
     const home = node_os.homedir();
     if (process.platform === 'darwin') {
         return node_path.join(home, 'Library', 'Application Support', 'Cursor', 'User', 'globalSettings.json');
@@ -171,22 +175,22 @@ function cursorProjectConfigPath(workspaceRoot) {
 function clineConfigPath(workspaceRoot) {
     return node_path.join(workspaceRoot, '.cline', 'mcp.json');
 }
-function windsurfConfigPath() {
+export function windsurfConfigPath() {
     return node_path.join(node_os.homedir(), '.codeium', 'windsurf', 'mcp_config.json');
 }
-function continueConfigPath() {
+export function continueConfigPath() {
     return node_path.join(node_os.homedir(), '.continue', 'config.json');
 }
-function gooseConfigPath() {
+export function gooseConfigPath() {
     return node_path.join(node_os.homedir(), '.config', 'goose', 'config.yaml');
 }
 function openHandsConfigPath(workspaceRoot) {
     return node_path.join(workspaceRoot, '.openhands', 'mcp.json');
 }
-function museConfigPath() {
+export function museConfigPath() {
     return node_path.join(node_os.homedir(), '.config', 'muse', 'settings.json');
 }
-function grokUserConfigPath() {
+export function grokUserConfigPath() {
     return node_path.join(node_os.homedir(), '.grok', 'config.toml');
 }
 function grokProjectConfigPath(workspaceRoot) {
@@ -195,7 +199,7 @@ function grokProjectConfigPath(workspaceRoot) {
 /** OpenCode's global config: `$XDG_CONFIG_HOME/opencode/opencode.json`, which
  *  is `~/.config/opencode/opencode.json` unless XDG_CONFIG_HOME is set (OpenCode
  *  resolves it through xdg-basedir). Only the `.json` spelling — see `injectOpenCode`. */
-function openCodeGlobalConfigPath() {
+export function openCodeGlobalConfigPath() {
     const base = process.env['XDG_CONFIG_HOME'] || node_path.join(node_os.homedir(), '.config');
     return node_path.join(base, 'opencode', 'opencode.json');
 }
@@ -227,6 +231,7 @@ function wrapWithProxy(entry, workspaceId, workspaceRoot, serverName) {
     if (entry.__intutic_wrapped)
         return entry;
     const proxyBin = resolveProxyBin(workspaceRoot);
+    const original = structuredClone(entry);
     if (typeof entry.command === 'string') {
         const originalArgs = entry.args ?? [];
         return {
@@ -244,16 +249,12 @@ function wrapWithProxy(entry, workspaceId, workspaceRoot, serverName) {
                 INTUTIC_WORKSPACE_ID: workspaceId,
             },
             __intutic_wrapped: true,
+            __intutic_original: original,
         };
     }
     if (typeof entry.url === 'string') {
         const remoteTransport = entry.type?.toLowerCase() === 'sse' ? 'sse' : 'http';
         const hasHeaders = entry.headers !== undefined && Object.keys(entry.headers).length > 0;
-        const original = { url: entry.url };
-        if (entry.type !== undefined)
-            original.type = entry.type;
-        if (entry.headers !== undefined)
-            original.headers = entry.headers;
         const env = {
             ...(entry.env ?? {}),
             INTUTIC_WORKSPACE_ID: workspaceId,
@@ -339,8 +340,8 @@ async function readJsonForWrite(filePath) {
 /**
  * Write JSON to disk, but only if the content actually changed.
  *
- * `injectMcpServer` now runs every sync-loop iteration (~every 30s, see
- * syncLoop.ts) instead of only once at `connect` time — re-running the same
+ * `injectMcpServer` runs every sync cycle (~every 30s, from `intutic
+ * connect`) instead of only once at startup — re-running the same
  * wrap against an already-wrapped, unchanged config must not touch the file,
  * or every cycle would churn the file's mtime and fire a spurious inotify /
  * FSEvents event for every harness config on every developer machine.
@@ -349,8 +350,12 @@ async function readJsonForWrite(filePath) {
  * serialized string — a naive string compare would report a false "changed"
  * on nothing more than JSON.stringify key-ordering differences between two
  * semantically identical objects.
+ *
+ * With `workspaceRoot`, the file's original is kept for `intutic disconnect`
+ * before the first write. `~/.claude.json` goes without: it is Claude Code's
+ * live state, never restored whole.
  */
-async function writeJsonFile(filePath, data) {
+async function writeJsonFile(filePath, data, workspaceRoot) {
     let existing;
     let hasExisting;
     try {
@@ -363,6 +368,8 @@ async function writeJsonFile(filePath, data) {
     if (hasExisting && isDeepStrictEqual(existing, data)) {
         return;
     }
+    if (workspaceRoot !== undefined)
+        await keepOriginal(filePath, workspaceRoot);
     await node_fs.mkdir(node_path.dirname(filePath), { recursive: true });
     await node_fs.writeFile(filePath, JSON.stringify(data, null, 2) + '\n', 'utf-8');
 }
@@ -378,14 +385,97 @@ async function injectClaudeCode(workspaceId, workspaceRoot) {
     const current = await readJsonForWrite(configPath);
     // User scope: available in every project.
     current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
-    // Local scope: servers added with `claude mcp add` in this project.
+    // Local scope: servers added with `claude mcp add` in this project, then
+    // the shadows that govern its approved `.mcp.json` servers. A project Claude
+    // Code has never opened has no entry, and nothing approved to shadow.
     const project = current.projects?.[workspaceRoot];
-    if (project?.mcpServers && Object.keys(project.mcpServers).length > 0) {
-        project.mcpServers = wrapAllServers(project.mcpServers, workspaceId, workspaceRoot);
+    if (project) {
+        const local = wrapAllServers(project.mcpServers ?? {}, workspaceId, workspaceRoot);
+        const withShadows = shadowProjectServers(local, await readProjectScopeServers(workspaceRoot), await projectServerApproval(workspaceRoot, current), workspaceId, workspaceRoot);
+        if (project.mcpServers !== undefined || Object.keys(withShadows).length > 0)
+            project.mcpServers = withShadows;
     }
     await writeJsonFile(configPath, current);
     log.info({ action: 'claude_code_mcp_injected' }, 'Claude Code ~/.claude.json MCP servers updated');
 }
+/** Where Claude Code keeps a project's shared, committed servers. */
+function claudeCodeProjectMcpPath(workspaceRoot) {
+    return node_path.join(workspaceRoot, '.mcp.json');
+}
+/** The project's `.mcp.json` servers; empty when the file is missing or not a JSON object. */
+async function readProjectScopeServers(workspaceRoot) {
+    const parsed = await readJsonFile(claudeCodeProjectMcpPath(workspaceRoot), {});
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+        return {};
+    const servers = parsed.mcpServers;
+    return servers !== null && typeof servers === 'object' && !Array.isArray(servers) ? servers : {};
+}
+/**
+ * Why an approved project server cannot get a governed local-scope copy, or
+ * null when it can. Exported for discovery's reporting through
+ * {@link discoverMcpServers}.
+ *
+ * Expansion itself is not a reason: Claude Code expands `${VAR}` the same way
+ * at local scope as in `.mcp.json`, in `command`, `args`, `env`, `url` and
+ * `headers` (verified with Claude Code 2.1.233 — see the MCP governance
+ * guide), so a copy keeps references verbatim and writes no resolved value.
+ * A remote server is the exception. Its copy is a stdio entry that hands the
+ * url to the proxy as an argument and the headers through the environment,
+ * where Claude Code expands every variable; in a remote server's own `url`
+ * and `headers` it reads credential variables (its own API keys, cloud and
+ * proxy credentials) as empty, by a list it does not publish in full. A copy
+ * could therefore send a credential the original never would.
+ */
+function shadowBlocker(entry) {
+    if (entry === null || typeof entry !== 'object')
+        return 'an entry the proxy cannot front';
+    if (entry.__intutic_wrapped)
+        return 'the entry in .mcp.json is already wrapped';
+    if (typeof entry.command === 'string')
+        return null;
+    if (typeof entry.url === 'string') {
+        const refs = [entry.url, ...Object.values(entry.headers ?? {})].some((v) => typeof v === 'string' && v.includes('${'));
+        return refs
+            ? 'its url or headers reference environment variables, which Claude Code expands with a credential filter a wrapped copy cannot keep'
+            : null;
+    }
+    return 'an entry the proxy cannot front';
+}
+/**
+ * Governs a project's `.mcp.json` servers without touching the file.
+ *
+ * `.mcp.json` is committed and shared with the team: wrapping it in place
+ * would write this machine's proxy path and workspace id into everyone's
+ * checkout. Claude Code gives a local-scope server precedence over a
+ * project-scope one of the same name, so each approved project server gets a
+ * wrapped copy at local scope, in this project's `~/.claude.json` entry,
+ * marked `__intutic_shadow_of: 'project'`. The rules:
+ *
+ * - A server the user added at local scope keeps its name; it is wrapped by
+ *   the local-scope pass already and never replaced by a shadow.
+ * - A shadow follows its source: rewritten when the project entry changes,
+ *   removed when the project entry, or its approval, goes away. Deleting the
+ *   marked entries returns the project to exactly what `.mcp.json` says.
+ * - An entry whose shape the proxy cannot wrap is left to Claude Code as is.
+ * - Re-running on unchanged input produces the same map, so the
+ *   write-if-changed in `writeJsonFile` writes nothing.
+ */
+function shadowProjectServers(local, projectServers, approval, workspaceId, workspaceRoot) {
+    const result = {};
+    for (const [name, entry] of Object.entries(local)) {
+        if (entry.__intutic_shadow_of === 'project')
+            continue; // rebuilt below from the current source
+        result[name] = entry;
+    }
+    for (const [name, entry] of Object.entries(projectServers)) {
+        if (name === 'intutic' || name in result || !approval.approved(name))
+            continue;
+        if (shadowBlocker(entry) !== null)
+            continue;
+        result[name] = { ...wrapWithProxy(entry, workspaceId, workspaceRoot, name), __intutic_shadow_of: 'project' };
+    }
+    return result;
+}
 // ─── Target: Claude Desktop ───────────────────────────────────────────────────
 async function injectClaudeDesktop(workspaceId, workspaceRoot) {
     const configPath = claudeDesktopConfigPath();
@@ -399,7 +489,7 @@ async function injectClaudeDesktop(workspaceId, workspaceRoot) {
     }
     const current = await readJsonForWrite(configPath);
     current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
-    await writeJsonFile(configPath, current);
+    await writeJsonFile(configPath, current, workspaceRoot);
     log.info({ action: 'claude_desktop_mcp_injected' }, 'Claude Desktop config updated');
 }
 // ─── Target: Cursor (global + project) ───────────────────────────────────────
@@ -410,7 +500,7 @@ async function injectCursor(workspaceId, workspaceRoot) {
         await node_fs.access(node_path.dirname(globalPath));
         const current = await readJsonForWrite(globalPath);
         current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
-        await writeJsonFile(globalPath, current);
+        await writeJsonFile(globalPath, current, workspaceRoot);
         log.info({ action: 'cursor_global_mcp_injected' }, 'Cursor globalSettings.json updated');
     }
     catch {
@@ -421,7 +511,7 @@ async function injectCursor(workspaceId, workspaceRoot) {
     try {
         const current = await readJsonForWrite(projectPath);
         current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
-        await writeJsonFile(projectPath, current);
+        await writeJsonFile(projectPath, current, workspaceRoot);
         log.info({ action: 'cursor_project_mcp_injected' }, 'Cursor .cursor/mcp.json updated');
     }
     catch (err) {
@@ -434,7 +524,7 @@ async function injectCline(workspaceId, workspaceRoot) {
     try {
         const current = await readJsonForWrite(configPath);
         current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
-        await writeJsonFile(configPath, current);
+        await writeJsonFile(configPath, current, workspaceRoot);
         log.info({ action: 'cline_mcp_injected' }, 'Cline .cline/mcp.json updated');
     }
     catch (err) {
@@ -448,7 +538,7 @@ async function injectWindsurf(workspaceId, workspaceRoot) {
         await node_fs.access(node_path.dirname(configPath));
         const current = await readJsonForWrite(configPath);
         current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
-        await writeJsonFile(configPath, current);
+        await writeJsonFile(configPath, current, workspaceRoot);
         log.info({ action: 'windsurf_mcp_injected' }, 'Windsurf mcp_config.json updated');
     }
     catch {
@@ -469,14 +559,16 @@ async function injectContinue(workspaceId, workspaceRoot) {
         // Wrap existing non-intutic servers — routed through the same
         // wrapWithProxy used by every other harness, so the stdio-only guard and
         // --server-name threading stay in one place instead of two.
+        // The whole entry goes in, so the wrap's `__intutic_original` holds every
+        // key `intutic disconnect` has to put back.
         current.mcpServers = current.mcpServers.map((s) => {
-            const wrapped = wrapWithProxy({ command: s.command, args: s.args, env: s.env, url: s.url, type: s.type, __intutic_wrapped: s.__intutic_wrapped }, workspaceId, workspaceRoot, s.name);
-            return { name: s.name, ...wrapped };
+            const { name, ...entry } = s;
+            return { name, ...wrapWithProxy(entry, workspaceId, workspaceRoot, name) };
         });
         // Add Intutic MCP server
         const entry = buildIntuticMcpEntry(workspaceRoot);
         current.mcpServers.unshift({ name: 'intutic', ...entry });
-        await writeJsonFile(configPath, current);
+        await writeJsonFile(configPath, current, workspaceRoot);
         log.info({ action: 'continue_mcp_injected' }, 'Continue ~/.continue/config.json updated');
     }
     catch {
@@ -512,6 +604,7 @@ async function injectGooseAppendOnly(configPath, existingYaml, workspaceId, prox
         // (see writeJsonFile's doc comment for why: this runs every sync cycle now).
         return;
     }
+    await keepOriginal(configPath, node_os.homedir());
     await node_fs.mkdir(node_path.dirname(configPath), { recursive: true });
     await node_fs.writeFile(configPath, text, 'utf-8');
     log.info({ action: 'goose_mcp_injected', mode: 'append_only_fallback' }, 'Goose config.yaml updated (append-only fallback)');
@@ -603,6 +696,7 @@ async function injectGoose(workspaceId, workspaceRoot) {
         // (see writeJsonFile's doc comment for why: this runs every sync cycle now).
         return;
     }
+    await keepOriginal(configPath, workspaceRoot);
     await node_fs.mkdir(node_path.dirname(configPath), { recursive: true });
     await node_fs.writeFile(configPath, doc.toString(), 'utf-8');
     log.info({ action: 'goose_mcp_injected', mode: 'yaml' }, 'Goose config.yaml updated (structural YAML edit)');
@@ -613,7 +707,7 @@ async function injectOpenHands(workspaceId, workspaceRoot) {
     try {
         const current = await readJsonForWrite(configPath);
         current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
-        await writeJsonFile(configPath, current);
+        await writeJsonFile(configPath, current, workspaceRoot);
         log.info({ action: 'openhands_mcp_injected' }, 'OpenHands .openhands/mcp.json updated');
     }
     catch (err) {
@@ -644,7 +738,7 @@ async function injectMuse(workspaceId, workspaceRoot) {
     current.mcp_servers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcp_servers ?? {}) }, workspaceId, workspaceRoot);
     if (current.schema_version === undefined)
         current.schema_version = 1;
-    await writeJsonFile(configPath, current);
+    await writeJsonFile(configPath, current, workspaceRoot);
     log.info({ action: 'muse_mcp_injected' }, 'Muse Code ~/.config/muse/settings.json mcp_servers updated');
 }
 /**
@@ -657,7 +751,7 @@ async function injectMuse(workspaceId, workspaceRoot) {
  * honest limit `injectGooseAppendOnly`/`discoverGooseLineScanFallback`
  * document for their own fallback.
  */
-async function injectGrokConfigAppendOnly(configPath, existingToml, workspaceId, proxyBin) {
+async function injectGrokConfigAppendOnly(configPath, existingToml, workspaceId, proxyBin, workspaceRoot) {
     let text = existingToml;
     if (!text.includes('[mcp_servers.intutic]') && !text.includes('[mcp_servers."intutic"]')) {
         const block = [
@@ -669,6 +763,7 @@ async function injectGrokConfigAppendOnly(configPath, existingToml, workspaceId,
     }
     if (text === existingToml)
         return;
+    await keepOriginal(configPath, workspaceRoot);
     await node_fs.mkdir(node_path.dirname(configPath), { recursive: true });
     await node_fs.writeFile(configPath, text, 'utf-8');
     log.info({ action: 'grok_mcp_injected', mode: 'append_only_fallback' }, 'Grok config.toml updated (append-only fallback)');
@@ -711,7 +806,7 @@ async function injectGrokConfig(configPath, workspaceId, workspaceRoot) {
     }
     catch (err) {
         log.warn({ action: 'grok_toml_unparseable', path: configPath, err: err.message }, 'Grok config.toml did not parse as TOML — falling back to append-only text injection');
-        await injectGrokConfigAppendOnly(configPath, existingToml, workspaceId, proxyBin);
+        await injectGrokConfigAppendOnly(configPath, existingToml, workspaceId, proxyBin, workspaceRoot);
         return;
     }
     const servers = doc.mcp_servers && typeof doc.mcp_servers === 'object' ? doc.mcp_servers : {};
@@ -736,6 +831,7 @@ async function injectGrokConfig(configPath, workspaceId, workspaceRoot) {
         return;
     }
     doc.mcp_servers = servers;
+    await keepOriginal(configPath, workspaceRoot);
     await node_fs.mkdir(node_path.dirname(configPath), { recursive: true });
     const tmp = configPath + '.intutic-tmp';
     await node_fs.writeFile(tmp, stringifyToml(doc), 'utf-8');
@@ -747,7 +843,7 @@ async function injectGrok(workspaceId, workspaceRoot) {
     await injectGrokConfig(grokUserConfigPath(), workspaceId, workspaceRoot);
 }
 /** The proxy binary path `resolveProxyBin` returns, in either of its two forms. */
-const PROXY_BIN_PATTERN = /(?:^|[\\/])(?:@intutic[\\/]mcp-governance-proxy|packages[\\/]mcp-proxy)[\\/]dist[\\/]index\.js$/;
+export const PROXY_BIN_PATTERN = /(?:^|[\\/])(?:@intutic[\\/]mcp-governance-proxy|packages[\\/]mcp-proxy)[\\/]dist[\\/]index\.js$/;
 /**
  * Whether an OpenCode entry is already fronted by the governance proxy, read
  * from the command SHAPE — `["node", <proxy bin>, "--workspace-id", …]` —
@@ -858,6 +954,8 @@ async function injectOpenCodeConfig(configPath, workspaceId, workspaceRoot) {
         return;
     config['mcp'] = next;
     const indent = raw.match(/^([ \t]+)\S/m)?.[1] ?? 2;
+    // OpenCode entries cannot carry a marker, so disconnect needs the file as it was.
+    await keepOriginal(configPath, workspaceRoot);
     const tmp = configPath + '.intutic-tmp';
     await node_fs.writeFile(tmp, JSON.stringify(config, null, indent) + '\n', 'utf-8');
     await node_fs.rename(tmp, configPath);
@@ -910,15 +1008,31 @@ async function discoverJsonObjectHarness(harness, filePath) {
     }
     return out;
 }
-/** Claude Code's `~/.claude.json`: the user-scope `mcpServers` map plus this
- *  project's local-scope one under `projects[<workspaceRoot>]`. */
+/** Claude Code's servers as Claude Code resolves them: user scope
+ *  (`~/.claude.json`), project scope (the repo's `.mcp.json`) and local scope
+ *  (this project's entry in `~/.claude.json`), each narrower scope winning a
+ *  name — so a project server governed by a local-scope shadow reports as
+ *  wrapped. */
 async function discoverClaudeCode(workspaceRoot) {
     const filePath = claudeCodeConfigPath();
-    if (!existsSync(filePath))
-        return [];
-    const current = await readJsonFile(filePath, {});
-    const servers = { ...(current.projects?.[workspaceRoot]?.mcpServers ?? {}), ...(current.mcpServers ?? {}) };
-    return Object.entries(servers).map(([name, entry]) => ({ server: name, harness: 'claude-code', ...classifyEntry(entry) }));
+    const current = existsSync(filePath) ? await readJsonFile(filePath, {}) : {};
+    const projectServers = await readProjectScopeServers(workspaceRoot);
+    const local = current.projects?.[workspaceRoot]?.mcpServers ?? {};
+    const servers = { ...(current.mcpServers ?? {}), ...projectServers, ...local };
+    const approval = Object.keys(projectServers).length > 0 ? await projectServerApproval(workspaceRoot, current) : null;
+    return Object.entries(servers).map(([name, entry]) => {
+        const found = { server: name, harness: 'claude-code', ...classifyEntry(entry) };
+        // A project server Claude Code will start, with no copy of ours in front of it.
+        if (approval && name in projectServers && !(name in local) && approval.approved(name)) {
+            const reason = shadowBlocker(projectServers[name]);
+            if (reason)
+                found.ungovernedReason = `Claude Code project server not governed: ${reason}`;
+        }
+        if (approval?.blockedReason && name in projectServers && !(name in local)) {
+            found.ungovernedReason = `Claude Code project server not governed: ${approval.blockedReason}`;
+        }
+        return found;
+    });
 }
 /** Muse Code's `~/.config/muse/settings.json` keeps servers under `mcp_servers`,
  *  not `mcpServers` — otherwise the same JSON-map shape `discoverJsonObjectHarness`
@@ -1151,32 +1265,36 @@ export async function discoverMcpServers(workspaceRoot) {
  *
  * Non-fatal: a failure in one harness does not prevent other harnesses from being updated.
  *
- * Called from two places by design: once from `intutic connect` (tools/cli)
- * for immediate effect, and once per sync-loop iteration
- * (services/sync-daemon/src/syncLoop.ts) so it is a continuous invariant
- * rather than a one-shot — a server a user adds after their first `connect`
+ * Called by `intutic connect` (tools/cli) on every sync cycle, so it is a
+ * continuous invariant rather than a one-shot — a server a user adds after their first `connect`
  * still gets wrapped on the next cycle. Safe to call every cycle because
  * `writeJsonFile` is write-if-changed: an already-wrapped, unchanged config
  * writes zero bytes.
  *
  * @param workspaceId - The workspace ID for policy lookups and event attribution.
  * @param workspaceRoot - Absolute path to the project workspace root.
+ * @param options.skip - Harness ids to leave alone: the ones `intutic
+ *   disconnect --harness` took out.
  */
-export async function injectMcpServer(workspaceRoot, workspaceId = 'unknown') {
+export async function injectMcpServer(workspaceRoot, workspaceId = 'unknown', options = {}) {
     log.info({ action: 'mcp_inject_start', workspaceRoot, workspaceId }, 'Starting MCP server injection');
-    await Promise.allSettled([
-        injectClaudeCode(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'claude-code' }, 'MCP injection failed')),
-        injectClaudeDesktop(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'claude-desktop' }, 'MCP injection failed')),
-        injectCursor(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'cursor' }, 'MCP injection failed')),
-        injectCline(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'cline' }, 'MCP injection failed')),
-        injectWindsurf(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'windsurf' }, 'MCP injection failed')),
-        injectContinue(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'continue' }, 'MCP injection failed')),
-        injectGoose(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'goose' }, 'MCP injection failed')),
-        injectOpenHands(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'openhands' }, 'MCP injection failed')),
-        injectMuse(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'muse-code' }, 'MCP injection failed')),
-        injectGrok(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'grok' }, 'MCP injection failed')),
-        injectOpenCode(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'opencode' }, 'MCP injection failed')),
-    ]);
+    const targets = [
+        ['claude-code', injectClaudeCode],
+        ['claude-desktop', injectClaudeDesktop],
+        ['cursor', injectCursor],
+        ['cline', injectCline],
+        ['windsurf', injectWindsurf],
+        ['continue', injectContinue],
+        ['goose', injectGoose],
+        ['openhands', injectOpenHands],
+        ['muse-code', injectMuse],
+        ['grok', injectGrok],
+        ['opencode', injectOpenCode],
+    ];
+    const skip = new Set(options.skip ?? []);
+    await Promise.allSettled(targets
+        .filter(([target]) => !skip.has(target))
+        .map(([target, inject]) => inject(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target }, 'MCP injection failed'))));
     log.info({ action: 'mcp_inject_complete', workspaceRoot }, 'MCP server injection complete');
 }
 //# sourceMappingURL=mcpAutoWrite.js.map