@intutic/sync-daemon 2.1.0 → 2.3.0

package/dist/harness/mcpAutoWrite.js

@@ -4,7 +4,10 @@
  *
  * Injects and proxy-wraps MCP server entries in:
  * - Claude Code:      ~/.claude.json (user-scope `mcpServers`, and the
- *                      local-scope `projects[<workspaceRoot>].mcpServers`)
+ *                      local-scope `projects[<workspaceRoot>].mcpServers`,
+ *                      where the approved servers of the project's
+ *                      `.mcp.json` also get wrapped shadows — the shared
+ *                      `.mcp.json` itself is only read)
  * - Claude Desktop:   ~/Library/Application Support/Claude/claude_desktop_config.json
  * - Cursor (global):  ~/Library/Application Support/Cursor/User/globalSettings.json
  * - Cursor (project): <workspaceRoot>/.cursor/mcp.json
@@ -17,13 +20,18 @@
  * - Grok Build:       ~/.grok/config.toml + <workspaceRoot>/.grok/config.toml
  *                      ([mcp_servers.*] tables)
  * - OpenCode:         ~/.config/opencode/opencode.json + <workspaceRoot>/opencode.json
- *                      (`mcp` block — TD-487; see `injectOpenCode`)
+ *                      (`mcp` block; see `injectOpenCode`)
+ * - Gemini CLI:       ~/.gemini/settings.json + <workspaceRoot>/.gemini/settings.json
+ *                      (`mcpServers`)
+ * - Antigravity:      ~/.gemini/config/mcp_config.json (`mcpServers`)
+ *                      (both under the `antigravity` harness; see `injectAntigravity`)
  *
- * That is 14 config paths across 11 `HarnessType` values (Cursor, Grok
+ * That is 17 config paths across 12 `HarnessType` values (Cursor, Grok
  * Build and OpenCode each own two paths — global/project for Cursor and
- * OpenCode, user/project for Grok Build). `discoverMcpServers` below reads
- * all fourteen read-only, for reporting; the injectors above are the only
- * thing that writes.
+ * OpenCode, user/project for Grok Build — and the `antigravity` harness
+ * three, for its two products). `discoverMcpServers` below reads all
+ * seventeen read-only, for reporting, plus Claude Code's project
+ * `.mcp.json`; the injectors above are the only thing that writes.
  *
  * # Grok Build's compat-path overlap — dedup, not a bug
  *
@@ -56,8 +64,9 @@
  * `command`-or-`url` shape every other JSON-map harness here uses — `wrapAllServers`
  * / `wrapWithProxy` branch on exactly that, so a `streamable_http` entry is
  * wrapped through the SAME remote-bridge path a `url`-keyed Claude Desktop/
- * Windsurf entry gets, without new code. See TD-362 for why this is recorded
- * as an assumption rather than a confirmation.
+ * Windsurf entry gets, without new code. This is recorded as an assumption
+ * rather than a confirmation because the `muse` binary could not be installed
+ * to check it (see museHooks.ts).
  *
  * Proxy-wrapping convention:
  *   Each existing stdio MCP server entry is rewritten so that the governance
@@ -65,25 +74,22 @@
  *   after `--`, tagged with `--server-name <name>` so the proxy can attribute
  *   traffic to the server it fronts. A `__intutic_wrapped: true` flag is added
  *   to prevent double-wrapping. Remote (HTTP/SSE, `url`-keyed) entries are now
- *   ALSO wrapped — TD-354's stdio→HTTP bridge phase closed the gap this
+ *   ALSO wrapped — the stdio→HTTP bridge phase closed the gap this
  *   comment used to describe as "left untouched": the entry is rewritten to
  *   spawn the SAME proxy binary in bridge mode (`--remote-url`/
  *   `--remote-transport`, headers riding in `INTUTIC_REMOTE_HEADERS` env, not
- *   argv — `ps` visibility). `__intutic_original` preserves the entry's
- *   pre-wrap `url`/`type`/`headers` so `classifyEntry` can report the TRUE
- *   transport of what got wrapped, and so a wrapped entry could be unwrapped
- *   later. See TECH_DEBT.md TD-354 for the historical decline this phase
- *   supersedes.
+ *   argv — `ps` visibility). `__intutic_original` keeps the whole pre-wrap
+ *   entry, stdio or remote, so `classifyEntry` can report the TRUE transport
+ *   of what got wrapped and `intutic disconnect` can put the entry back
+ *   exactly.
  *
- * Continuous invariant, not one-shot: `injectMcpServer` is called once from
- * `intutic connect` (tools/cli) AND once per sync-loop iteration
- * (services/sync-daemon/src/syncLoop.ts), so a server a user adds to a harness
+ * Continuous invariant, not one-shot: `intutic connect` (tools/cli) calls
+ * `injectMcpServer` on every sync cycle, so a server a user adds to a harness
  * config after their first `connect` still gets wrapped on the next sync
  * cycle rather than staying invisible to governance forever. Running this
  * every ~30s only works because `writeJsonFile` below is write-if-changed —
  * an already-wrapped, unchanged config produces zero bytes written.
  *
- * LLD #14 — mcpAutoWrite.ts
  * HLD §3.14 — GUI Harness Interception (MCP registration + Universal MCP Governance)
  *
  * @module
@@ -96,8 +102,12 @@ import { createRequire } from 'node:module';
 import { isDeepStrictEqual } from 'node:util';
 import { createLogger } from '@intutic/logger';
 import { readJsonObjectForMerge } from './jsonMergeTarget.js';
+import { projectServerApproval } from './claudeProjectApproval.js';
+import { keepOriginal } from '../disconnect/originals.js';
 import { parseDocument, isMap } from 'yaml';
+import { GEMINI_CLI_GATE_ID, sanitizeMcpEndpoint } from '@intutic/shared-types';
 import { parse as parseToml, stringify as stringifyToml } from 'smol-toml';
+import { antigravityGateIdentities } from './antigravityProducts.js';
 const log = createLogger('sync-mcp-autowrite');
 // ─── Proxy Binary Resolution ─────────────────────────────────────────────────
 /** Resolves packages relative to this module — i.e. from wherever the
@@ -139,13 +149,14 @@ export function resolveProxyBin(workspaceRoot) {
 // Shared by both the injectors (which write) and discoverMcpServers (which
 // only reads), so the two can never independently drift about where a
 // harness keeps its config.
-/** Claude Code keeps user- and local-scope MCP servers in `~/.claude.json`
- *  (project-scope servers live in the repo's `.mcp.json`, which is shared
- *  with the team and is not rewritten here). */
+/** Claude Code keeps user- and local-scope MCP servers in `~/.claude.json`.
+ *  Project-scope servers live in the repo's `.mcp.json`, which is shared with
+ *  the team and never rewritten here; they are governed through local-scope
+ *  shadows instead (see {@link shadowProjectServers}). */
 function claudeCodeConfigPath() {
     return node_path.join(node_os.homedir(), '.claude.json');
 }
-function claudeDesktopConfigPath() {
+export function claudeDesktopConfigPath() {
     const home = node_os.homedir();
     if (process.platform === 'darwin') {
         return node_path.join(home, 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json');
@@ -155,7 +166,7 @@ function claudeDesktopConfigPath() {
     }
     return node_path.join(home, '.config', 'Claude', 'claude_desktop_config.json');
 }
-function cursorGlobalConfigPath() {
+export function cursorGlobalConfigPath() {
     const home = node_os.homedir();
     if (process.platform === 'darwin') {
         return node_path.join(home, 'Library', 'Application Support', 'Cursor', 'User', 'globalSettings.json');
@@ -171,22 +182,22 @@ function cursorProjectConfigPath(workspaceRoot) {
 function clineConfigPath(workspaceRoot) {
     return node_path.join(workspaceRoot, '.cline', 'mcp.json');
 }
-function windsurfConfigPath() {
+export function windsurfConfigPath() {
     return node_path.join(node_os.homedir(), '.codeium', 'windsurf', 'mcp_config.json');
 }
-function continueConfigPath() {
+export function continueConfigPath() {
     return node_path.join(node_os.homedir(), '.continue', 'config.json');
 }
-function gooseConfigPath() {
+export function gooseConfigPath() {
     return node_path.join(node_os.homedir(), '.config', 'goose', 'config.yaml');
 }
 function openHandsConfigPath(workspaceRoot) {
     return node_path.join(workspaceRoot, '.openhands', 'mcp.json');
 }
-function museConfigPath() {
+export function museConfigPath() {
     return node_path.join(node_os.homedir(), '.config', 'muse', 'settings.json');
 }
-function grokUserConfigPath() {
+export function grokUserConfigPath() {
     return node_path.join(node_os.homedir(), '.grok', 'config.toml');
 }
 function grokProjectConfigPath(workspaceRoot) {
@@ -195,13 +206,24 @@ function grokProjectConfigPath(workspaceRoot) {
 /** OpenCode's global config: `$XDG_CONFIG_HOME/opencode/opencode.json`, which
  *  is `~/.config/opencode/opencode.json` unless XDG_CONFIG_HOME is set (OpenCode
  *  resolves it through xdg-basedir). Only the `.json` spelling — see `injectOpenCode`. */
-function openCodeGlobalConfigPath() {
+export function openCodeGlobalConfigPath() {
     const base = process.env['XDG_CONFIG_HOME'] || node_path.join(node_os.homedir(), '.config');
     return node_path.join(base, 'opencode', 'opencode.json');
 }
 function openCodeProjectConfigPath(workspaceRoot) {
     return node_path.join(workspaceRoot, 'opencode.json');
 }
+/** Gemini CLI's user settings, which also hold its `BeforeTool` gate (antigravityHooks.ts). */
+export function geminiSettingsPath() {
+    return node_path.join(node_os.homedir(), '.gemini', 'settings.json');
+}
+function geminiProjectSettingsPath(workspaceRoot) {
+    return node_path.join(workspaceRoot, '.gemini', 'settings.json');
+}
+/** Google Antigravity's global MCP servers, next to its `hooks.json` (antigravityCliHooks.ts). */
+export function antigravityMcpConfigPath() {
+    return node_path.join(node_os.homedir(), '.gemini', 'config', 'mcp_config.json');
+}
 // ─── Proxy Wrapping ───────────────────────────────────────────────────────────
 /**
  * Wrap a single MCP server entry with the governance proxy.
@@ -213,7 +235,7 @@ function openCodeProjectConfigPath(workspaceRoot) {
  * Two wrap conventions, chosen by the entry's pre-wrap shape:
  *   - stdio (`command`/`args`): the proxy binary becomes the command, the
  *     original command is passed after `--`, tagged `--server-name`.
- *   - remote (`url`, HTTP/SSE — TD-354, now superseded): the proxy binary is
+ *   - remote (`url`, HTTP/SSE): the proxy binary is
  *     invoked in bridge mode (`--remote-url`/`--remote-transport` instead of
  *     `--`), also tagged `--server-name`. Any `headers` on the original entry
  *     ride into the wrapped entry's env as `INTUTIC_REMOTE_HEADERS` (a JSON
@@ -227,6 +249,7 @@ function wrapWithProxy(entry, workspaceId, workspaceRoot, serverName) {
     if (entry.__intutic_wrapped)
         return entry;
     const proxyBin = resolveProxyBin(workspaceRoot);
+    const original = structuredClone(entry);
     if (typeof entry.command === 'string') {
         const originalArgs = entry.args ?? [];
         return {
@@ -244,16 +267,12 @@ function wrapWithProxy(entry, workspaceId, workspaceRoot, serverName) {
                 INTUTIC_WORKSPACE_ID: workspaceId,
             },
             __intutic_wrapped: true,
+            __intutic_original: original,
         };
     }
     if (typeof entry.url === 'string') {
         const remoteTransport = entry.type?.toLowerCase() === 'sse' ? 'sse' : 'http';
         const hasHeaders = entry.headers !== undefined && Object.keys(entry.headers).length > 0;
-        const original = { url: entry.url };
-        if (entry.type !== undefined)
-            original.type = entry.type;
-        if (entry.headers !== undefined)
-            original.headers = entry.headers;
         const env = {
             ...(entry.env ?? {}),
             INTUTIC_WORKSPACE_ID: workspaceId,
@@ -339,8 +358,8 @@ async function readJsonForWrite(filePath) {
 /**
  * Write JSON to disk, but only if the content actually changed.
  *
- * `injectMcpServer` now runs every sync-loop iteration (~every 30s, see
- * syncLoop.ts) instead of only once at `connect` time — re-running the same
+ * `injectMcpServer` runs every sync cycle (~every 30s, from `intutic
+ * connect`) instead of only once at startup — re-running the same
  * wrap against an already-wrapped, unchanged config must not touch the file,
  * or every cycle would churn the file's mtime and fire a spurious inotify /
  * FSEvents event for every harness config on every developer machine.
@@ -349,8 +368,12 @@ async function readJsonForWrite(filePath) {
  * serialized string — a naive string compare would report a false "changed"
  * on nothing more than JSON.stringify key-ordering differences between two
  * semantically identical objects.
+ *
+ * With `workspaceRoot`, the file's original is kept for `intutic disconnect`
+ * before the first write. `~/.claude.json` goes without: it is Claude Code's
+ * live state, never restored whole.
  */
-async function writeJsonFile(filePath, data) {
+async function writeJsonFile(filePath, data, workspaceRoot) {
     let existing;
     let hasExisting;
     try {
@@ -363,6 +386,8 @@ async function writeJsonFile(filePath, data) {
     if (hasExisting && isDeepStrictEqual(existing, data)) {
         return;
     }
+    if (workspaceRoot !== undefined)
+        await keepOriginal(filePath, workspaceRoot);
     await node_fs.mkdir(node_path.dirname(filePath), { recursive: true });
     await node_fs.writeFile(filePath, JSON.stringify(data, null, 2) + '\n', 'utf-8');
 }
@@ -378,14 +403,97 @@ async function injectClaudeCode(workspaceId, workspaceRoot) {
     const current = await readJsonForWrite(configPath);
     // User scope: available in every project.
     current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
-    // Local scope: servers added with `claude mcp add` in this project.
+    // Local scope: servers added with `claude mcp add` in this project, then
+    // the shadows that govern its approved `.mcp.json` servers. A project Claude
+    // Code has never opened has no entry, and nothing approved to shadow.
     const project = current.projects?.[workspaceRoot];
-    if (project?.mcpServers && Object.keys(project.mcpServers).length > 0) {
-        project.mcpServers = wrapAllServers(project.mcpServers, workspaceId, workspaceRoot);
+    if (project) {
+        const local = wrapAllServers(project.mcpServers ?? {}, workspaceId, workspaceRoot);
+        const withShadows = shadowProjectServers(local, await readProjectScopeServers(workspaceRoot), await projectServerApproval(workspaceRoot, current), workspaceId, workspaceRoot);
+        if (project.mcpServers !== undefined || Object.keys(withShadows).length > 0)
+            project.mcpServers = withShadows;
     }
     await writeJsonFile(configPath, current);
     log.info({ action: 'claude_code_mcp_injected' }, 'Claude Code ~/.claude.json MCP servers updated');
 }
+/** Where Claude Code keeps a project's shared, committed servers. */
+function claudeCodeProjectMcpPath(workspaceRoot) {
+    return node_path.join(workspaceRoot, '.mcp.json');
+}
+/** The project's `.mcp.json` servers; empty when the file is missing or not a JSON object. */
+async function readProjectScopeServers(workspaceRoot) {
+    const parsed = await readJsonFile(claudeCodeProjectMcpPath(workspaceRoot), {});
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+        return {};
+    const servers = parsed.mcpServers;
+    return servers !== null && typeof servers === 'object' && !Array.isArray(servers) ? servers : {};
+}
+/**
+ * Why an approved project server cannot get a governed local-scope copy, or
+ * null when it can. Exported for discovery's reporting through
+ * {@link discoverMcpServers}.
+ *
+ * Expansion itself is not a reason: Claude Code expands `${VAR}` the same way
+ * at local scope as in `.mcp.json`, in `command`, `args`, `env`, `url` and
+ * `headers` (verified with Claude Code 2.1.233 — see the MCP governance
+ * guide), so a copy keeps references verbatim and writes no resolved value.
+ * A remote server is the exception. Its copy is a stdio entry that hands the
+ * url to the proxy as an argument and the headers through the environment,
+ * where Claude Code expands every variable; in a remote server's own `url`
+ * and `headers` it reads credential variables (its own API keys, cloud and
+ * proxy credentials) as empty, by a list it does not publish in full. A copy
+ * could therefore send a credential the original never would.
+ */
+function shadowBlocker(entry) {
+    if (entry === null || typeof entry !== 'object')
+        return 'an entry the proxy cannot front';
+    if (entry.__intutic_wrapped)
+        return 'the entry in .mcp.json is already wrapped';
+    if (typeof entry.command === 'string')
+        return null;
+    if (typeof entry.url === 'string') {
+        const refs = [entry.url, ...Object.values(entry.headers ?? {})].some((v) => typeof v === 'string' && v.includes('${'));
+        return refs
+            ? 'its url or headers reference environment variables, which Claude Code expands with a credential filter a wrapped copy cannot keep'
+            : null;
+    }
+    return 'an entry the proxy cannot front';
+}
+/**
+ * Governs a project's `.mcp.json` servers without touching the file.
+ *
+ * `.mcp.json` is committed and shared with the team: wrapping it in place
+ * would write this machine's proxy path and workspace id into everyone's
+ * checkout. Claude Code gives a local-scope server precedence over a
+ * project-scope one of the same name, so each approved project server gets a
+ * wrapped copy at local scope, in this project's `~/.claude.json` entry,
+ * marked `__intutic_shadow_of: 'project'`. The rules:
+ *
+ * - A server the user added at local scope keeps its name; it is wrapped by
+ *   the local-scope pass already and never replaced by a shadow.
+ * - A shadow follows its source: rewritten when the project entry changes,
+ *   removed when the project entry, or its approval, goes away. Deleting the
+ *   marked entries returns the project to exactly what `.mcp.json` says.
+ * - An entry whose shape the proxy cannot wrap is left to Claude Code as is.
+ * - Re-running on unchanged input produces the same map, so the
+ *   write-if-changed in `writeJsonFile` writes nothing.
+ */
+function shadowProjectServers(local, projectServers, approval, workspaceId, workspaceRoot) {
+    const result = {};
+    for (const [name, entry] of Object.entries(local)) {
+        if (entry.__intutic_shadow_of === 'project')
+            continue; // rebuilt below from the current source
+        result[name] = entry;
+    }
+    for (const [name, entry] of Object.entries(projectServers)) {
+        if (name === 'intutic' || name in result || !approval.approved(name))
+            continue;
+        if (shadowBlocker(entry) !== null)
+            continue;
+        result[name] = { ...wrapWithProxy(entry, workspaceId, workspaceRoot, name), __intutic_shadow_of: 'project' };
+    }
+    return result;
+}
 // ─── Target: Claude Desktop ───────────────────────────────────────────────────
 async function injectClaudeDesktop(workspaceId, workspaceRoot) {
     const configPath = claudeDesktopConfigPath();
@@ -399,7 +507,7 @@ async function injectClaudeDesktop(workspaceId, workspaceRoot) {
     }
     const current = await readJsonForWrite(configPath);
     current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
-    await writeJsonFile(configPath, current);
+    await writeJsonFile(configPath, current, workspaceRoot);
     log.info({ action: 'claude_desktop_mcp_injected' }, 'Claude Desktop config updated');
 }
 // ─── Target: Cursor (global + project) ───────────────────────────────────────
@@ -410,7 +518,7 @@ async function injectCursor(workspaceId, workspaceRoot) {
         await node_fs.access(node_path.dirname(globalPath));
         const current = await readJsonForWrite(globalPath);
         current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
-        await writeJsonFile(globalPath, current);
+        await writeJsonFile(globalPath, current, workspaceRoot);
         log.info({ action: 'cursor_global_mcp_injected' }, 'Cursor globalSettings.json updated');
     }
     catch {
@@ -421,7 +529,7 @@ async function injectCursor(workspaceId, workspaceRoot) {
     try {
         const current = await readJsonForWrite(projectPath);
         current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
-        await writeJsonFile(projectPath, current);
+        await writeJsonFile(projectPath, current, workspaceRoot);
         log.info({ action: 'cursor_project_mcp_injected' }, 'Cursor .cursor/mcp.json updated');
     }
     catch (err) {
@@ -434,7 +542,7 @@ async function injectCline(workspaceId, workspaceRoot) {
     try {
         const current = await readJsonForWrite(configPath);
         current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
-        await writeJsonFile(configPath, current);
+        await writeJsonFile(configPath, current, workspaceRoot);
         log.info({ action: 'cline_mcp_injected' }, 'Cline .cline/mcp.json updated');
     }
     catch (err) {
@@ -448,7 +556,7 @@ async function injectWindsurf(workspaceId, workspaceRoot) {
         await node_fs.access(node_path.dirname(configPath));
         const current = await readJsonForWrite(configPath);
         current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
-        await writeJsonFile(configPath, current);
+        await writeJsonFile(configPath, current, workspaceRoot);
         log.info({ action: 'windsurf_mcp_injected' }, 'Windsurf mcp_config.json updated');
     }
     catch {
@@ -469,14 +577,16 @@ async function injectContinue(workspaceId, workspaceRoot) {
         // Wrap existing non-intutic servers — routed through the same
         // wrapWithProxy used by every other harness, so the stdio-only guard and
         // --server-name threading stay in one place instead of two.
+        // The whole entry goes in, so the wrap's `__intutic_original` holds every
+        // key `intutic disconnect` has to put back.
         current.mcpServers = current.mcpServers.map((s) => {
-            const wrapped = wrapWithProxy({ command: s.command, args: s.args, env: s.env, url: s.url, type: s.type, __intutic_wrapped: s.__intutic_wrapped }, workspaceId, workspaceRoot, s.name);
-            return { name: s.name, ...wrapped };
+            const { name, ...entry } = s;
+            return { name, ...wrapWithProxy(entry, workspaceId, workspaceRoot, name) };
         });
         // Add Intutic MCP server
         const entry = buildIntuticMcpEntry(workspaceRoot);
         current.mcpServers.unshift({ name: 'intutic', ...entry });
-        await writeJsonFile(configPath, current);
+        await writeJsonFile(configPath, current, workspaceRoot);
         log.info({ action: 'continue_mcp_injected' }, 'Continue ~/.continue/config.json updated');
     }
     catch {
@@ -512,6 +622,7 @@ async function injectGooseAppendOnly(configPath, existingYaml, workspaceId, prox
         // (see writeJsonFile's doc comment for why: this runs every sync cycle now).
         return;
     }
+    await keepOriginal(configPath, node_os.homedir());
     await node_fs.mkdir(node_path.dirname(configPath), { recursive: true });
     await node_fs.writeFile(configPath, text, 'utf-8');
     log.info({ action: 'goose_mcp_injected', mode: 'append_only_fallback' }, 'Goose config.yaml updated (append-only fallback)');
@@ -603,6 +714,7 @@ async function injectGoose(workspaceId, workspaceRoot) {
         // (see writeJsonFile's doc comment for why: this runs every sync cycle now).
         return;
     }
+    await keepOriginal(configPath, workspaceRoot);
     await node_fs.mkdir(node_path.dirname(configPath), { recursive: true });
     await node_fs.writeFile(configPath, doc.toString(), 'utf-8');
     log.info({ action: 'goose_mcp_injected', mode: 'yaml' }, 'Goose config.yaml updated (structural YAML edit)');
@@ -613,7 +725,7 @@ async function injectOpenHands(workspaceId, workspaceRoot) {
     try {
         const current = await readJsonForWrite(configPath);
         current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
-        await writeJsonFile(configPath, current);
+        await writeJsonFile(configPath, current, workspaceRoot);
         log.info({ action: 'openhands_mcp_injected' }, 'OpenHands .openhands/mcp.json updated');
     }
     catch (err) {
@@ -644,7 +756,7 @@ async function injectMuse(workspaceId, workspaceRoot) {
     current.mcp_servers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcp_servers ?? {}) }, workspaceId, workspaceRoot);
     if (current.schema_version === undefined)
         current.schema_version = 1;
-    await writeJsonFile(configPath, current);
+    await writeJsonFile(configPath, current, workspaceRoot);
     log.info({ action: 'muse_mcp_injected' }, 'Muse Code ~/.config/muse/settings.json mcp_servers updated');
 }
 /**
@@ -657,7 +769,7 @@ async function injectMuse(workspaceId, workspaceRoot) {
  * honest limit `injectGooseAppendOnly`/`discoverGooseLineScanFallback`
  * document for their own fallback.
  */
-async function injectGrokConfigAppendOnly(configPath, existingToml, workspaceId, proxyBin) {
+async function injectGrokConfigAppendOnly(configPath, existingToml, workspaceId, proxyBin, workspaceRoot) {
     let text = existingToml;
     if (!text.includes('[mcp_servers.intutic]') && !text.includes('[mcp_servers."intutic"]')) {
         const block = [
@@ -669,6 +781,7 @@ async function injectGrokConfigAppendOnly(configPath, existingToml, workspaceId,
     }
     if (text === existingToml)
         return;
+    await keepOriginal(configPath, workspaceRoot);
     await node_fs.mkdir(node_path.dirname(configPath), { recursive: true });
     await node_fs.writeFile(configPath, text, 'utf-8');
     log.info({ action: 'grok_mcp_injected', mode: 'append_only_fallback' }, 'Grok config.toml updated (append-only fallback)');
@@ -711,7 +824,7 @@ async function injectGrokConfig(configPath, workspaceId, workspaceRoot) {
     }
     catch (err) {
         log.warn({ action: 'grok_toml_unparseable', path: configPath, err: err.message }, 'Grok config.toml did not parse as TOML — falling back to append-only text injection');
-        await injectGrokConfigAppendOnly(configPath, existingToml, workspaceId, proxyBin);
+        await injectGrokConfigAppendOnly(configPath, existingToml, workspaceId, proxyBin, workspaceRoot);
         return;
     }
     const servers = doc.mcp_servers && typeof doc.mcp_servers === 'object' ? doc.mcp_servers : {};
@@ -736,6 +849,7 @@ async function injectGrokConfig(configPath, workspaceId, workspaceRoot) {
         return;
     }
     doc.mcp_servers = servers;
+    await keepOriginal(configPath, workspaceRoot);
     await node_fs.mkdir(node_path.dirname(configPath), { recursive: true });
     const tmp = configPath + '.intutic-tmp';
     await node_fs.writeFile(tmp, stringifyToml(doc), 'utf-8');
@@ -747,7 +861,7 @@ async function injectGrok(workspaceId, workspaceRoot) {
     await injectGrokConfig(grokUserConfigPath(), workspaceId, workspaceRoot);
 }
 /** The proxy binary path `resolveProxyBin` returns, in either of its two forms. */
-const PROXY_BIN_PATTERN = /(?:^|[\\/])(?:@intutic[\\/]mcp-governance-proxy|packages[\\/]mcp-proxy)[\\/]dist[\\/]index\.js$/;
+export const PROXY_BIN_PATTERN = /(?:^|[\\/])(?:@intutic[\\/]mcp-governance-proxy|packages[\\/]mcp-proxy)[\\/]dist[\\/]index\.js$/;
 /**
  * Whether an OpenCode entry is already fronted by the governance proxy, read
  * from the command SHAPE — `["node", <proxy bin>, "--workspace-id", …]` —
@@ -858,6 +972,8 @@ async function injectOpenCodeConfig(configPath, workspaceId, workspaceRoot) {
         return;
     config['mcp'] = next;
     const indent = raw.match(/^([ \t]+)\S/m)?.[1] ?? 2;
+    // OpenCode entries cannot carry a marker, so disconnect needs the file as it was.
+    await keepOriginal(configPath, workspaceRoot);
     const tmp = configPath + '.intutic-tmp';
     await node_fs.writeFile(tmp, JSON.stringify(config, null, indent) + '\n', 'utf-8');
     await node_fs.rename(tmp, configPath);
@@ -867,7 +983,143 @@ async function injectOpenCode(workspaceId, workspaceRoot) {
     await injectOpenCodeConfig(openCodeProjectConfigPath(workspaceRoot), workspaceId, workspaceRoot);
     await injectOpenCodeConfig(openCodeGlobalConfigPath(), workspaceId, workspaceRoot);
 }
-// ─── Discovery (read-only — writes nothing) ───────────────────────────────────
+// ─── Target: Gemini CLI and Google Antigravity ──────────────────────────────
+/**
+ * Whether an entry is already fronted by the governance proxy, read from its
+ * argv (`node <proxy bin> --workspace-id …`). Gemini CLI and Antigravity
+ * entries carry no `__intutic_wrapped` marker: Gemini CLI's settings schema
+ * declares `mcpServers` entries with `additionalProperties: false` and warns
+ * about any other key on every start, and Antigravity documents a fixed set
+ * of keys too. So, as for OpenCode, the shape is the marker, and `intutic
+ * disconnect` rebuilds the original from the argv or the kept file.
+ */
+function isProxyFronted(entry) {
+    const args = entry.args;
+    return (entry.command === 'node' &&
+        Array.isArray(args) &&
+        typeof args[0] === 'string' &&
+        PROXY_BIN_PATTERN.test(args[0]) &&
+        args.includes('--workspace-id'));
+}
+/**
+ * Gemini CLI: `url`, with `type` `sse` or `http` (with no `type`, Gemini CLI
+ * tries streamable HTTP first, which is what the bridge speaks), or
+ * `httpUrl` for streamable HTTP. A server Gemini CLI authenticates itself
+ * (`oauth`, or a Google credential provider in `authProviderType`) stays as
+ * it is: the bridge forwards static headers only, so behind it the server
+ * would stop authenticating. A websocket server (`tcp`) has no bridge.
+ */
+const GEMINI_FORMAT = {
+    harness: 'gemini-cli',
+    remote: (e) => typeof e.httpUrl === 'string'
+        ? { url: e.httpUrl, transport: 'http' }
+        : typeof e.url === 'string'
+            ? { url: e.url, transport: e.type === 'sse' ? 'sse' : 'http' }
+            : null,
+    blocker: (e) => typeof e.command === 'string'
+        ? null
+        : e.oauth !== undefined || e.authProviderType !== undefined
+            ? 'Gemini CLI authenticates this server itself (OAuth or a Google credential provider), which the proxy cannot do for it'
+            : typeof e.tcp === 'string'
+                ? 'a websocket (tcp) server, which the proxy cannot bridge'
+                : null,
+    remoteKeys: ['url', 'httpUrl', 'type', 'headers'],
+};
+/** Antigravity: a remote server is `serverUrl`, which Antigravity documents as SSE. */
+const ANTIGRAVITY_FORMAT = {
+    harness: 'antigravity',
+    remote: (e) => (typeof e.serverUrl === 'string' ? { url: e.serverUrl, transport: 'sse' } : null),
+    blocker: () => null,
+    remoteKeys: ['serverUrl', 'headers'],
+};
+function stringMap(v) {
+    if (!v || typeof v !== 'object' || Array.isArray(v))
+        return undefined;
+    const out = {};
+    for (const [k, x] of Object.entries(v))
+        if (typeof x === 'string')
+            out[k] = x;
+    return out;
+}
+/**
+ * Wrap one Gemini CLI or Antigravity server. The proxy argv is built by
+ * `wrapWithProxy`, like every harness's, and only its `command`/`args`/`env`
+ * are kept. The entry's other keys stay: Gemini CLI's `cwd` (where the real
+ * command runs), `timeout`, `trust`, `description`, `includeTools` and
+ * `excludeTools` mean the same in front of the proxy, which passes the
+ * server's tools through under their own names.
+ */
+function wrapUnmarkedEntry(entry, format, workspaceId, workspaceRoot, serverName) {
+    if (isProxyFronted(entry) || format.blocker(entry) !== null)
+        return entry;
+    const { command, args, env, ...rest } = entry;
+    let wrapped;
+    if (typeof command === 'string') {
+        const argv = Array.isArray(args) ? args.filter((a) => typeof a === 'string') : [];
+        wrapped = wrapWithProxy({ command, args: argv, env: stringMap(env) }, workspaceId, workspaceRoot, serverName);
+    }
+    else {
+        const remote = format.remote(entry);
+        if (remote === null)
+            return entry;
+        const headers = stringMap(entry.headers);
+        wrapped = wrapWithProxy({ url: remote.url, type: remote.transport, env: stringMap(env), ...(headers ? { headers } : {}) }, workspaceId, workspaceRoot, serverName);
+        for (const key of format.remoteKeys)
+            delete rest[key];
+    }
+    return { ...rest, command: wrapped.command, args: wrapped.args, env: wrapped.env };
+}
+/**
+ * Wrap the `mcpServers` map of one Gemini CLI or Antigravity file, with the
+ * `intutic` server added when `addIntutic`. A file that is missing is created
+ * only when `addIntutic` (the product's user-level file, on a machine that has
+ * the product); a project file is only ever edited.
+ */
+async function injectUnmarkedConfig(configPath, format, workspaceId, workspaceRoot, addIntutic) {
+    if (!addIntutic && !existsSync(configPath))
+        return;
+    const current = await readJsonForWrite(configPath);
+    const existing = current.mcpServers && typeof current.mcpServers === 'object' && !Array.isArray(current.mcpServers)
+        ? current.mcpServers
+        : {};
+    const servers = addIntutic ? { intutic: buildIntuticMcpEntry(workspaceRoot), ...existing } : existing;
+    if (Object.keys(servers).length === 0)
+        return;
+    const next = {};
+    for (const [name, entry] of Object.entries(servers)) {
+        next[name] =
+            name === 'intutic' || !entry || typeof entry !== 'object' || Array.isArray(entry)
+                ? entry
+                : wrapUnmarkedEntry(entry, format, workspaceId, workspaceRoot, name);
+    }
+    current.mcpServers = next;
+    await writeJsonFile(configPath, current, workspaceRoot);
+    log.info({ action: 'gemini_mcp_injected', harness: format.harness, path: configPath }, 'MCP servers wrapped');
+}
+/**
+ * The `antigravity` harness's two products, each where it is installed
+ * (`antigravityProducts.ts`): Gemini CLI's `mcpServers` in its user
+ * settings, and in the project's `.gemini/settings.json` when there is one
+ * (wrapped there, with no second `intutic` server); Antigravity's in
+ * `~/.gemini/config/mcp_config.json`. Servers an Antigravity plugin brings
+ * (`plugins/<name>/mcp_config.json`) belong to the plugin and are not
+ * rewritten.
+ */
+async function injectAntigravity(workspaceId, workspaceRoot) {
+    const products = await antigravityGateIdentities(workspaceRoot);
+    if (products.includes(GEMINI_CLI_GATE_ID)) {
+        await injectUnmarkedConfig(geminiSettingsPath(), GEMINI_FORMAT, workspaceId, workspaceRoot, true);
+        await injectUnmarkedConfig(geminiProjectSettingsPath(workspaceRoot), GEMINI_FORMAT, workspaceId, workspaceRoot, false);
+    }
+    if (products.includes('antigravity')) {
+        await injectUnmarkedConfig(antigravityMcpConfigPath(), ANTIGRAVITY_FORMAT, workspaceId, workspaceRoot, true);
+    }
+}
+/** `endpoint` only when the URL survives sanitising, so the field is never present and empty. */
+function withEndpoint(found, url) {
+    const endpoint = sanitizeMcpEndpoint(url);
+    return endpoint ? { ...found, endpoint } : found;
+}
 /** Classify a raw server entry's transport + wrapped status, tolerant of any shape. */
 function classifyEntry(entry) {
     if (!entry || typeof entry !== 'object')
@@ -885,14 +1137,14 @@ function classifyEntry(entry) {
         const o = original;
         if (typeof o.url === 'string') {
             const type = typeof o.type === 'string' ? o.type.toLowerCase() : '';
-            return { transport: type === 'sse' ? 'sse' : 'http', wrapped: true };
+            return withEndpoint({ transport: type === 'sse' ? 'sse' : 'http', wrapped: true }, o.url);
         }
     }
     if (typeof e.command === 'string')
         return { transport: 'stdio', wrapped };
     if (typeof e.url === 'string') {
         const type = typeof e.type === 'string' ? e.type.toLowerCase() : '';
-        return { transport: type === 'sse' ? 'sse' : 'http', wrapped };
+        return withEndpoint({ transport: type === 'sse' ? 'sse' : 'http', wrapped }, e.url);
     }
     return { transport: 'unknown', wrapped };
 }
@@ -905,20 +1157,35 @@ async function discoverJsonObjectHarness(harness, filePath) {
     const current = await readJsonFile(filePath, {});
     const out = [];
     for (const [name, entry] of Object.entries(current.mcpServers ?? {})) {
-        const { transport, wrapped } = classifyEntry(entry);
-        out.push({ server: name, harness, transport, wrapped });
+        out.push({ server: name, harness, ...classifyEntry(entry) });
     }
     return out;
 }
-/** Claude Code's `~/.claude.json`: the user-scope `mcpServers` map plus this
- *  project's local-scope one under `projects[<workspaceRoot>]`. */
+/** Claude Code's servers as Claude Code resolves them: user scope
+ *  (`~/.claude.json`), project scope (the repo's `.mcp.json`) and local scope
+ *  (this project's entry in `~/.claude.json`), each narrower scope winning a
+ *  name — so a project server governed by a local-scope shadow reports as
+ *  wrapped. */
 async function discoverClaudeCode(workspaceRoot) {
     const filePath = claudeCodeConfigPath();
-    if (!existsSync(filePath))
-        return [];
-    const current = await readJsonFile(filePath, {});
-    const servers = { ...(current.projects?.[workspaceRoot]?.mcpServers ?? {}), ...(current.mcpServers ?? {}) };
-    return Object.entries(servers).map(([name, entry]) => ({ server: name, harness: 'claude-code', ...classifyEntry(entry) }));
+    const current = existsSync(filePath) ? await readJsonFile(filePath, {}) : {};
+    const projectServers = await readProjectScopeServers(workspaceRoot);
+    const local = current.projects?.[workspaceRoot]?.mcpServers ?? {};
+    const servers = { ...(current.mcpServers ?? {}), ...projectServers, ...local };
+    const approval = Object.keys(projectServers).length > 0 ? await projectServerApproval(workspaceRoot, current) : null;
+    return Object.entries(servers).map(([name, entry]) => {
+        const found = { server: name, harness: 'claude-code', ...classifyEntry(entry) };
+        // A project server Claude Code will start, with no copy of ours in front of it.
+        if (approval && name in projectServers && !(name in local) && approval.approved(name)) {
+            const reason = shadowBlocker(projectServers[name]);
+            if (reason)
+                found.ungovernedReason = `Claude Code project server not governed: ${reason}`;
+        }
+        if (approval?.blockedReason && name in projectServers && !(name in local)) {
+            found.ungovernedReason = `Claude Code project server not governed: ${approval.blockedReason}`;
+        }
+        return found;
+    });
 }
 /** Muse Code's `~/.config/muse/settings.json` keeps servers under `mcp_servers`,
  *  not `mcpServers` — otherwise the same JSON-map shape `discoverJsonObjectHarness`
@@ -930,8 +1197,7 @@ async function discoverMuse() {
     const current = await readJsonFile(filePath, {});
     const out = [];
     for (const [name, entry] of Object.entries(current.mcp_servers ?? {})) {
-        const { transport, wrapped } = classifyEntry(entry);
-        out.push({ server: name, harness: 'muse-code', transport, wrapped });
+        out.push({ server: name, harness: 'muse-code', ...classifyEntry(entry) });
     }
     return out;
 }
@@ -943,8 +1209,7 @@ async function discoverContinue() {
     const current = await readJsonFile(filePath, {});
     const out = [];
     for (const s of current.mcpServers ?? []) {
-        const { transport, wrapped } = classifyEntry(s);
-        out.push({ server: s.name, harness: 'continue', transport, wrapped });
+        out.push({ server: s.name, harness: 'continue', ...classifyEntry(s) });
     }
     return out;
 }
@@ -989,8 +1254,7 @@ async function discoverGoose() {
         const servers = doc.toJS().mcp ?? {};
         const out = [];
         for (const [name, entry] of Object.entries(servers)) {
-            const { transport, wrapped } = classifyEntry(entry);
-            out.push({ server: name, harness: 'goose', transport, wrapped });
+            out.push({ server: name, harness: 'goose', ...classifyEntry(entry) });
         }
         return out;
     }
@@ -1044,8 +1308,7 @@ async function discoverGrokConfig(configPath) {
         const servers = doc.mcp_servers && typeof doc.mcp_servers === 'object' ? doc.mcp_servers : {};
         const out = [];
         for (const [name, entry] of Object.entries(servers)) {
-            const { transport, wrapped } = classifyEntry(entry);
-            out.push({ server: name, harness: 'grok', transport, wrapped });
+            out.push({ server: name, harness: 'grok', ...classifyEntry(entry) });
         }
         return out;
     }
@@ -1087,12 +1350,14 @@ function classifyOpenCodeEntry(entry) {
         if (!argv.includes('--remote-url'))
             return { transport: 'stdio', wrapped };
         const t = argv[argv.indexOf('--remote-transport') + 1];
-        return { transport: t === 'sse' ? 'sse' : 'http', wrapped };
+        const url = argv[argv.indexOf('--remote-url') + 1];
+        const found = { transport: t === 'sse' ? 'sse' : 'http', wrapped };
+        return typeof url === 'string' ? withEndpoint(found, url) : found;
     }
     if (e.type === 'local' && Array.isArray(e.command))
         return { transport: 'stdio', wrapped };
     if (e.type === 'remote' && typeof e.url === 'string')
-        return { transport: 'http', wrapped };
+        return withEndpoint({ transport: 'http', wrapped }, e.url);
     return { transport: 'unknown', wrapped };
 }
 async function discoverOpenCodeConfig(configPath) {
@@ -1109,9 +1374,49 @@ async function discoverOpenCode(workspaceRoot) {
     ]);
     return [...project, ...global];
 }
+/** Classify a Gemini CLI or Antigravity entry. A wrapped one's true
+ *  transport is read back from its argv, since these entries carry no
+ *  `__intutic_original`. */
+function classifyUnmarkedEntry(entry, format) {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+        return { transport: 'unknown', wrapped: false };
+    const e = entry;
+    if (isProxyFronted(e)) {
+        const argv = e.args;
+        if (!argv.includes('--remote-url'))
+            return { transport: 'stdio', wrapped: true };
+        const t = argv[argv.indexOf('--remote-transport') + 1];
+        const url = argv[argv.indexOf('--remote-url') + 1];
+        const found = { transport: t === 'sse' ? 'sse' : 'http', wrapped: true };
+        return typeof url === 'string' ? withEndpoint(found, url) : found;
+    }
+    const blocker = format.blocker(e);
+    const remote = format.remote(e);
+    const found = typeof e.command === 'string'
+        ? { transport: 'stdio', wrapped: false }
+        : remote
+            ? withEndpoint({ transport: remote.transport, wrapped: false }, remote.url)
+            : { transport: 'unknown', wrapped: false };
+    return blocker ? { ...found, ungovernedReason: blocker } : found;
+}
+async function discoverUnmarkedConfig(configPath, format) {
+    if (!existsSync(configPath))
+        return [];
+    const current = await readJsonFile(configPath, {});
+    const servers = current.mcpServers && typeof current.mcpServers === 'object' ? current.mcpServers : {};
+    return Object.entries(servers).map(([name, entry]) => ({ server: name, harness: format.harness, ...classifyUnmarkedEntry(entry, format) }));
+}
+async function discoverAntigravity(workspaceRoot) {
+    const results = await Promise.all([
+        discoverUnmarkedConfig(geminiSettingsPath(), GEMINI_FORMAT),
+        discoverUnmarkedConfig(geminiProjectSettingsPath(workspaceRoot), GEMINI_FORMAT),
+        discoverUnmarkedConfig(antigravityMcpConfigPath(), ANTIGRAVITY_FORMAT),
+    ]);
+    return results.flat();
+}
 /**
  * Discover every MCP server declared in any harness config this daemon knows
- * how to parse — the same 14 config paths / 11 harnesses `injectMcpServer`
+ * how to parse — the same 17 config paths / 12 harnesses `injectMcpServer`
  * wraps — without writing anything. Used for reporting (agentReporter's
  * `mcp_tools` facet) so visibility does not silently lag behind whatever
  * `injectMcpServer` was last run against.
@@ -1142,6 +1447,7 @@ export async function discoverMcpServers(workspaceRoot) {
         discoverMuse(),
         discoverGrok(workspaceRoot),
         discoverOpenCode(workspaceRoot),
+        discoverAntigravity(workspaceRoot),
     ]);
     return results.flat().filter((s) => s.server !== 'intutic');
 }
@@ -1151,32 +1457,37 @@ export async function discoverMcpServers(workspaceRoot) {
  *
  * Non-fatal: a failure in one harness does not prevent other harnesses from being updated.
  *
- * Called from two places by design: once from `intutic connect` (tools/cli)
- * for immediate effect, and once per sync-loop iteration
- * (services/sync-daemon/src/syncLoop.ts) so it is a continuous invariant
- * rather than a one-shot — a server a user adds after their first `connect`
+ * Called by `intutic connect` (tools/cli) on every sync cycle, so it is a
+ * continuous invariant rather than a one-shot — a server a user adds after their first `connect`
  * still gets wrapped on the next cycle. Safe to call every cycle because
  * `writeJsonFile` is write-if-changed: an already-wrapped, unchanged config
  * writes zero bytes.
  *
  * @param workspaceId - The workspace ID for policy lookups and event attribution.
  * @param workspaceRoot - Absolute path to the project workspace root.
+ * @param options.skip - Harness ids to leave alone: the ones `intutic
+ *   disconnect --harness` took out.
  */
-export async function injectMcpServer(workspaceRoot, workspaceId = 'unknown') {
+export async function injectMcpServer(workspaceRoot, workspaceId = 'unknown', options = {}) {
     log.info({ action: 'mcp_inject_start', workspaceRoot, workspaceId }, 'Starting MCP server injection');
-    await Promise.allSettled([
-        injectClaudeCode(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'claude-code' }, 'MCP injection failed')),
-        injectClaudeDesktop(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'claude-desktop' }, 'MCP injection failed')),
-        injectCursor(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'cursor' }, 'MCP injection failed')),
-        injectCline(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'cline' }, 'MCP injection failed')),
-        injectWindsurf(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'windsurf' }, 'MCP injection failed')),
-        injectContinue(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'continue' }, 'MCP injection failed')),
-        injectGoose(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'goose' }, 'MCP injection failed')),
-        injectOpenHands(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'openhands' }, 'MCP injection failed')),
-        injectMuse(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'muse-code' }, 'MCP injection failed')),
-        injectGrok(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'grok' }, 'MCP injection failed')),
-        injectOpenCode(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'opencode' }, 'MCP injection failed')),
-    ]);
+    const targets = [
+        ['claude-code', injectClaudeCode],
+        ['claude-desktop', injectClaudeDesktop],
+        ['cursor', injectCursor],
+        ['cline', injectCline],
+        ['windsurf', injectWindsurf],
+        ['continue', injectContinue],
+        ['goose', injectGoose],
+        ['openhands', injectOpenHands],
+        ['muse-code', injectMuse],
+        ['grok', injectGrok],
+        ['opencode', injectOpenCode],
+        ['antigravity', injectAntigravity],
+    ];
+    const skip = new Set(options.skip ?? []);
+    await Promise.allSettled(targets
+        .filter(([target]) => !skip.has(target))
+        .map(([target, inject]) => inject(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target }, 'MCP injection failed'))));
     log.info({ action: 'mcp_inject_complete', workspaceRoot }, 'MCP server injection complete');
 }
 //# sourceMappingURL=mcpAutoWrite.js.map