@kb-labs/mcp-app 2.96.0 → 2.98.0

package/dist/bin.cjs

@@ -62,11 +62,20 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   if (typeof require !== "undefined") return require.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __commonJS = (cb, mod) => function __require3() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -17375,11 +17384,14 @@ var require_data = __commonJS({
   }
 });
 
-// ../../../node_modules/.pnpm/fast-uri@3.1.0/node_modules/fast-uri/lib/utils.js
+// ../../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/utils.js
 var require_utils = __commonJS({
-  "../../../node_modules/.pnpm/fast-uri@3.1.0/node_modules/fast-uri/lib/utils.js"(exports$1, module) {
+  "../../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/utils.js"(exports$1, module) {
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
+    var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
+    var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
+    var isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);
     function stringArrayToHexStripped(input) {
       let acc = "";
       let code = 0;
@@ -17572,27 +17584,77 @@ var require_utils = __commonJS({
       }
       return output.join("");
     }
-    function normalizeComponentEncoding(component, esc2) {
-      const func = esc2 !== true ? escape : unescape;
-      if (component.scheme !== void 0) {
-        component.scheme = func(component.scheme);
-      }
-      if (component.userinfo !== void 0) {
-        component.userinfo = func(component.userinfo);
-      }
-      if (component.host !== void 0) {
-        component.host = func(component.host);
+    var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
+    var HOST_DELIM_RE = /[@/?#:]/g;
+    var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
+    function reescapeHostDelimiters(host, isIP) {
+      const re = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
+      re.lastIndex = 0;
+      return host.replace(re, (ch) => HOST_DELIMS[ch]);
+    }
+    function normalizePercentEncoding(input, decodeUnreserved = false) {
+      if (input.indexOf("%") === -1) {
+        return input;
       }
-      if (component.path !== void 0) {
-        component.path = func(component.path);
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        if (input[i] === "%" && i + 2 < input.length) {
+          const hex3 = input.slice(i + 1, i + 3);
+          if (isHexPair(hex3)) {
+            const normalizedHex = hex3.toUpperCase();
+            const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+            if (decodeUnreserved && isUnreserved(decoded)) {
+              output += decoded;
+            } else {
+              output += "%" + normalizedHex;
+            }
+            i += 2;
+            continue;
+          }
+        }
+        output += input[i];
       }
-      if (component.query !== void 0) {
-        component.query = func(component.query);
+      return output;
+    }
+    function normalizePathEncoding(input) {
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        if (input[i] === "%" && i + 2 < input.length) {
+          const hex3 = input.slice(i + 1, i + 3);
+          if (isHexPair(hex3)) {
+            const normalizedHex = hex3.toUpperCase();
+            const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+            if (decoded !== "." && isUnreserved(decoded)) {
+              output += decoded;
+            } else {
+              output += "%" + normalizedHex;
+            }
+            i += 2;
+            continue;
+          }
+        }
+        if (isPathCharacter(input[i])) {
+          output += input[i];
+        } else {
+          output += escape(input[i]);
+        }
       }
-      if (component.fragment !== void 0) {
-        component.fragment = func(component.fragment);
+      return output;
+    }
+    function escapePreservingEscapes(input) {
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        if (input[i] === "%" && i + 2 < input.length) {
+          const hex3 = input.slice(i + 1, i + 3);
+          if (isHexPair(hex3)) {
+            output += "%" + hex3.toUpperCase();
+            i += 2;
+            continue;
+          }
+        }
+        output += escape(input[i]);
       }
-      return component;
+      return output;
     }
     function recomposeAuthority(component) {
       const uriTokens = [];
@@ -17607,7 +17669,7 @@ var require_utils = __commonJS({
           if (ipV6res.isIPV6 === true) {
             host = `[${ipV6res.escapedHost}]`;
           } else {
-            host = component.host;
+            host = reescapeHostDelimiters(host, false);
           }
         }
         uriTokens.push(host);
@@ -17621,7 +17683,10 @@ var require_utils = __commonJS({
     module.exports = {
       nonSimpleDomain,
       recomposeAuthority,
-      normalizeComponentEncoding,
+      reescapeHostDelimiters,
+      normalizePercentEncoding,
+      normalizePathEncoding,
+      escapePreservingEscapes,
       removeDotSegments,
       isIPv4,
       isUUID,
@@ -17631,9 +17696,9 @@ var require_utils = __commonJS({
   }
 });
 
-// ../../../node_modules/.pnpm/fast-uri@3.1.0/node_modules/fast-uri/lib/schemes.js
+// ../../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/schemes.js
 var require_schemes = __commonJS({
-  "../../../node_modules/.pnpm/fast-uri@3.1.0/node_modules/fast-uri/lib/schemes.js"(exports$1, module) {
+  "../../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/schemes.js"(exports$1, module) {
     var { isUUID } = require_utils();
     var URN_REG = /([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-.:;=@]|%[\da-f]{2})+)/iu;
     var supportedSchemeNames = (
@@ -17840,15 +17905,15 @@ var require_schemes = __commonJS({
   }
 });
 
-// ../../../node_modules/.pnpm/fast-uri@3.1.0/node_modules/fast-uri/index.js
+// ../../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS({
-  "../../../node_modules/.pnpm/fast-uri@3.1.0/node_modules/fast-uri/index.js"(exports$1, module) {
-    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizeComponentEncoding, isIPv4, nonSimpleDomain } = require_utils();
+  "../../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/index.js"(exports$1, module) {
+    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
     function normalize4(uri, options) {
       if (typeof uri === "string") {
         uri = /** @type {T} */
-        serialize2(parse5(uri, options), options);
+        normalizeString(uri, options);
       } else if (typeof uri === "object") {
         uri = /** @type {T} */
         parse5(serialize2(uri, options), options);
@@ -17915,19 +17980,9 @@ var require_fast_uri = __commonJS({
       return target;
     }
     function equal(uriA, uriB, options) {
-      if (typeof uriA === "string") {
-        uriA = unescape(uriA);
-        uriA = serialize2(normalizeComponentEncoding(parse5(uriA, options), true), { ...options, skipEscape: true });
-      } else if (typeof uriA === "object") {
-        uriA = serialize2(normalizeComponentEncoding(uriA, true), { ...options, skipEscape: true });
-      }
-      if (typeof uriB === "string") {
-        uriB = unescape(uriB);
-        uriB = serialize2(normalizeComponentEncoding(parse5(uriB, options), true), { ...options, skipEscape: true });
-      } else if (typeof uriB === "object") {
-        uriB = serialize2(normalizeComponentEncoding(uriB, true), { ...options, skipEscape: true });
-      }
-      return uriA.toLowerCase() === uriB.toLowerCase();
+      const normalizedA = normalizeComparableURI(uriA, options);
+      const normalizedB = normalizeComparableURI(uriB, options);
+      return normalizedA !== void 0 && normalizedB !== void 0 && normalizedA.toLowerCase() === normalizedB.toLowerCase();
     }
     function serialize2(cmpts, opts) {
       const component = {
@@ -17952,12 +18007,12 @@ var require_fast_uri = __commonJS({
       if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options);
       if (component.path !== void 0) {
         if (!options.skipEscape) {
-          component.path = escape(component.path);
+          component.path = escapePreservingEscapes(component.path);
           if (component.scheme !== void 0) {
             component.path = component.path.split("%3A").join(":");
           }
         } else {
-          component.path = unescape(component.path);
+          component.path = normalizePercentEncoding(component.path);
         }
       }
       if (options.reference !== "suffix" && component.scheme) {
@@ -17992,7 +18047,16 @@ var require_fast_uri = __commonJS({
       return uriTokens.join("");
     }
     var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
-    function parse5(uri, opts) {
+    function getParseError(parsed, matches) {
+      if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") {
+        return 'URI path must start with "/" when authority is present.';
+      }
+      if (typeof parsed.port === "number" && (parsed.port < 0 || parsed.port > 65535)) {
+        return "URI port is malformed.";
+      }
+      return void 0;
+    }
+    function parseWithStatus(uri, opts) {
       const options = Object.assign({}, opts);
       const parsed = {
         scheme: void 0,
@@ -18003,6 +18067,7 @@ var require_fast_uri = __commonJS({
         query: void 0,
         fragment: void 0
       };
+      let malformedAuthorityOrPort = false;
       let isIP = false;
       if (options.reference === "suffix") {
         if (options.scheme) {
@@ -18023,6 +18088,11 @@ var require_fast_uri = __commonJS({
         if (isNaN(parsed.port)) {
           parsed.port = matches[5];
         }
+        const parseError = getParseError(parsed, matches);
+        if (parseError !== void 0) {
+          parsed.error = parsed.error || parseError;
+          malformedAuthorityOrPort = true;
+        }
         if (parsed.host) {
           const ipv4result = isIPv4(parsed.host);
           if (ipv4result === false) {
@@ -18061,14 +18131,18 @@ var require_fast_uri = __commonJS({
               parsed.scheme = unescape(parsed.scheme);
             }
             if (parsed.host !== void 0) {
-              parsed.host = unescape(parsed.host);
+              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP);
             }
           }
           if (parsed.path) {
-            parsed.path = escape(unescape(parsed.path));
+            parsed.path = normalizePathEncoding(parsed.path);
           }
           if (parsed.fragment) {
-            parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
+            try {
+              parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
+            } catch {
+              parsed.error = parsed.error || "URI malformed";
+            }
           }
         }
         if (schemeHandler && schemeHandler.parse) {
@@ -18077,7 +18151,29 @@ var require_fast_uri = __commonJS({
       } else {
         parsed.error = parsed.error || "URI can not be parsed.";
       }
-      return parsed;
+      return { parsed, malformedAuthorityOrPort };
+    }
+    function parse5(uri, opts) {
+      return parseWithStatus(uri, opts).parsed;
+    }
+    function normalizeString(uri, opts) {
+      return normalizeStringWithStatus(uri, opts).normalized;
+    }
+    function normalizeStringWithStatus(uri, opts) {
+      const { parsed, malformedAuthorityOrPort } = parseWithStatus(uri, opts);
+      return {
+        normalized: malformedAuthorityOrPort ? uri : serialize2(parsed, opts),
+        malformedAuthorityOrPort
+      };
+    }
+    function normalizeComparableURI(uri, opts) {
+      if (typeof uri === "string") {
+        const { normalized, malformedAuthorityOrPort } = normalizeStringWithStatus(uri, opts);
+        return malformedAuthorityOrPort ? void 0 : normalized;
+      }
+      if (typeof uri === "object") {
+        return serialize2(uri, opts);
+      }
     }
     var fastUri = {
       SCHEMES,
@@ -79431,9 +79527,9 @@ var require_bcryptjs = __commonJS({
   }
 });
 
-// ../../../node_modules/.pnpm/@hono+node-server@1.19.13_hono@4.12.14/node_modules/@hono/node-server/dist/index.js
+// ../../../node_modules/.pnpm/@hono+node-server@1.19.13_hono@4.12.25/node_modules/@hono/node-server/dist/index.js
 var require_dist7 = __commonJS({
-  "../../../node_modules/.pnpm/@hono+node-server@1.19.13_hono@4.12.14/node_modules/@hono/node-server/dist/index.js"(exports$1, module) {
+  "../../../node_modules/.pnpm/@hono+node-server@1.19.13_hono@4.12.25/node_modules/@hono/node-server/dist/index.js"(exports$1, module) {
     var __create2 = Object.create;
     var __defProp6 = Object.defineProperty;
     var __getOwnPropDesc2 = Object.getOwnPropertyDescriptor;
@@ -84410,8 +84506,13 @@ async function resolveRoots(options = {}) {
 // ../../../core/runtime/dist/index.js
 var __defProp3 = Object.defineProperty;
 var __getOwnPropNames3 = Object.getOwnPropertyNames;
-var __esm3 = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames3(fn)[0]])(fn = 0)), res;
+var __esm3 = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames3(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __export3 = (target, all) => {
   for (var name in all)
@@ -89920,13 +90021,16 @@ async function loadPlatformConfig(options = {}) {
   const platformConfigPath = findConfigAtRoot(roots.platformRoot);
   let platformDefaults;
   let platformDefaultsSource;
+  let rawPlatformConfig;
   const samePath = !!platformConfigPath && !!projectConfigPath && path13__namespace.default.resolve(platformConfigPath) === path13__namespace.default.resolve(projectConfigPath);
   if (samePath && projectConfigData) {
     platformDefaults = projectConfigData.platformSection;
+    rawPlatformConfig = projectConfigData.rawConfig;
     projectPlatformConfig = void 0;
   } else if (platformConfigPath) {
-    const { platformSection } = await readConfigFile(platformConfigPath);
+    const { platformSection, rawConfig } = await readConfigFile(platformConfigPath);
     platformDefaults = platformSection;
+    rawPlatformConfig = rawConfig;
     platformDefaultsSource = platformConfigPath;
   }
   const mergeResult = mergeWithFieldPolicy(
@@ -89963,6 +90067,7 @@ async function loadPlatformConfig(options = {}) {
   return {
     platformConfig: effective,
     rawConfig: rawProjectConfig,
+    rawPlatformConfig,
     effectiveConfig,
     platformRoot: roots.platformRoot,
     projectRoot: roots.projectRoot,
@@ -105922,7 +106027,7 @@ var range = (a, b, str) => {
   return result;
 };
 
-// ../../../node_modules/.pnpm/brace-expansion@5.0.5/node_modules/brace-expansion/dist/esm/index.js
+// ../../../node_modules/.pnpm/brace-expansion@5.0.6/node_modules/brace-expansion/dist/esm/index.js
 var escSlash = "\0SLASH" + Math.random() + "\0";
 var escOpen = "\0OPEN" + Math.random() + "\0";
 var escClose = "\0CLOSE" + Math.random() + "\0";
@@ -106040,7 +106145,7 @@ function expand_(str, max, isTop) {
       }
       const pad = n.some(isPadded);
       N = [];
-      for (let i = x; test(i, y); i += incr) {
+      for (let i = x; test(i, y) && N.length < max; i += incr) {
         let c;
         if (isAlphaSequence) {
           c = String.fromCharCode(i);
@@ -112595,8 +112700,13 @@ var CredentialsManager = class {
 path13__namespace.join(os3__namespace.homedir(), ".kb", "agent.sock");
 var __defProp5 = Object.defineProperty;
 var __getOwnPropNames5 = Object.getOwnPropertyNames;
-var __esm5 = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames5(fn)[0]])(fn = 0)), res;
+var __esm5 = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames5(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __export5 = (target, all) => {
   for (var name in all)
@@ -116789,6 +116899,169 @@ defineSystemCommand({
     return { ok: true };
   }
 });
+var SENSITIVE_FIELD_PATTERN = /key|secret|token|password|jwt|credential/i;
+function isSensitiveField(dottedField) {
+  return dottedField.split(".").some((segment) => SENSITIVE_FIELD_PATTERN.test(segment));
+}
+var REDACTED = "***REDACTED***";
+function flatten(prefix, value, out) {
+  if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+    const entries = Object.entries(value);
+    if (entries.length === 0) {
+      out.push({ field: prefix, value: {} });
+      return;
+    }
+    for (const [key, nested] of entries) {
+      flatten(prefix ? `${prefix}.${key}` : key, nested, out);
+    }
+    return;
+  }
+  out.push({ field: prefix, value });
+}
+function redactLeaf(field, value) {
+  if (isSensitiveField(field)) {
+    return REDACTED;
+  }
+  return redactNested(field, value);
+}
+function redactNested(fieldPath, value) {
+  if (Array.isArray(value)) {
+    return value.map((item) => redactNested(fieldPath, item));
+  }
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [key, nested] of Object.entries(value)) {
+      const childPath = fieldPath ? `${fieldPath}.${key}` : key;
+      out[key] = isSensitiveField(childPath) ? REDACTED : redactNested(childPath, nested);
+    }
+    return out;
+  }
+  return value;
+}
+var PLATFORM_SCOPE_FIELDS = /* @__PURE__ */ new Set(["platform", "adapters", "adapterOptions", "core", "execution"]);
+function buildRows(result) {
+  const rows = [];
+  const fieldSources = result.sources.fields ?? {};
+  const defaultOtherSource = result.sameLocation ? "both" : "project";
+  const platformConfig = result.platformConfig;
+  for (const [topField, rawSource] of Object.entries(fieldSources)) {
+    const value = platformConfig[topField];
+    if (value === void 0) {
+      continue;
+    }
+    const source = result.sameLocation ? "both" : rawSource;
+    const leaves = [];
+    flatten(topField, value, leaves);
+    for (const leaf of leaves) {
+      rows.push({ source, field: leaf.field, value: redactLeaf(leaf.field, leaf.value) });
+    }
+  }
+  for (const ignoredField of result.sources.ignoredProjectFields ?? []) {
+    const value = platformConfig[ignoredField];
+    const leaves = [];
+    flatten(ignoredField, value, leaves);
+    for (const leaf of leaves) {
+      rows.push({ source: "ignored", field: leaf.field, value: redactLeaf(leaf.field, leaf.value) });
+    }
+  }
+  const rawPlatformConfig = result.rawPlatformConfig ?? {};
+  const effectiveConfig = result.effectiveConfig ?? {};
+  const otherTopFields = /* @__PURE__ */ new Set([...Object.keys(rawPlatformConfig), ...Object.keys(effectiveConfig)]);
+  for (const topField of otherTopFields) {
+    if (PLATFORM_SCOPE_FIELDS.has(topField)) {
+      continue;
+    }
+    const hasPlatform = rawPlatformConfig[topField] !== void 0;
+    const hasProject = effectiveConfig[topField] !== void 0;
+    let source;
+    let value;
+    if (result.sameLocation) {
+      source = "both";
+      value = hasProject ? effectiveConfig[topField] : rawPlatformConfig[topField];
+    } else if (hasPlatform && hasProject) {
+      source = "both";
+      value = effectiveConfig[topField];
+    } else if (hasProject) {
+      source = defaultOtherSource;
+      value = effectiveConfig[topField];
+    } else {
+      source = "platform";
+      value = rawPlatformConfig[topField];
+    }
+    const leaves = [];
+    flatten(topField, value, leaves);
+    for (const leaf of leaves) {
+      rows.push({ source, field: leaf.field, value: redactLeaf(leaf.field, leaf.value) });
+    }
+  }
+  rows.sort((a, b) => a.source === b.source ? a.field.localeCompare(b.field) : a.source.localeCompare(b.source));
+  return rows;
+}
+function formatValue(value) {
+  if (typeof value === "string") {
+    return value;
+  }
+  return JSON.stringify(value);
+}
+defineSystemCommand({
+  name: "show",
+  description: "Show the effective (merged) platform config with per-field provenance",
+  longDescription: "Resolves the fully-merged platform config (platform root + project overrides) and prints each field alongside where it came from: platform, project, both, or ignored (a project attempt to override a platform-only field). Sensitive values (keys, secrets, tokens, passwords, credentials) are always redacted.",
+  category: "config",
+  aliases: [],
+  examples: generateExamples("config show", "kb", [
+    { flags: {} },
+    { flags: { json: true } }
+  ]),
+  flags: {
+    json: { type: "boolean", description: "Output machine-readable JSON" }
+  },
+  async handler(ctx) {
+    const cwd = getContextCwd(ctx);
+    const result = await loadPlatformConfig({ startDir: cwd, loadEnvFile: false });
+    const rows = buildRows(result);
+    return {
+      ok: true,
+      status: "success",
+      rows,
+      sameLocation: result.sameLocation,
+      platformRoot: result.platformRoot,
+      projectRoot: result.projectRoot
+    };
+  },
+  formatter(result, ctx, flags) {
+    const rows = result.rows ?? [];
+    if (flags.json) {
+      ctx.ui?.json?.({
+        sameLocation: result.sameLocation,
+        platformRoot: result.platformRoot,
+        projectRoot: result.projectRoot,
+        fields: rows
+      });
+      return;
+    }
+    if (rows.length === 0) {
+      ctx.ui.success("Effective Config", {
+        sections: [{ header: "Config", items: ["No config fields resolved."] }]
+      });
+      return;
+    }
+    const fieldWidth = Math.max(...rows.map((r) => r.field.length), "FIELD".length);
+    const sourceWidth = Math.max(...rows.map((r) => r.source.length), "SOURCE".length);
+    const lines = [
+      `${"SOURCE".padEnd(sourceWidth)}  ${"FIELD".padEnd(fieldWidth)}  VALUE`,
+      ...rows.map(
+        (r) => `${r.source.padEnd(sourceWidth)}  ${r.field.padEnd(fieldWidth)}  ${formatValue(r.value)}`
+      )
+    ];
+    if (result.sameLocation) {
+      lines.push("", "(sameLocation: platform and project resolve to the same file \u2014 merge is a no-op)");
+    }
+    ctx.ui.success("Effective Config", {
+      sections: [{ header: "Config", items: lines }]
+    });
+  }
+});
 path13__namespace.default.join(os3__namespace.default.homedir(), ".config", "kb", "completion.zsh");
 platform.logger.child({ module: "cli:shutdown" });
 function flagToProperty(flag) {
@@ -116864,6 +117137,24 @@ function toCommandManifest(decl, entry) {
     pkgRoot: entry.pluginRoot
   };
 }
+function buildTool(entry, decl) {
+  if (typeof decl.path !== "string" || decl.path.trim().length === 0) {
+    throw new Error(
+      `command "${decl.id ?? "(unknown)"}" in plugin "${entry.pluginId}" has no "path" field \u2014 skipping`
+    );
+  }
+  return {
+    name: toolName(entry.pluginId, decl.path),
+    description: decl.describe,
+    inputSchema: generateCommandSchema(toCommandManifest(decl, entry)),
+    pluginId: entry.pluginId,
+    pluginRoot: entry.pluginRoot,
+    handlerPath: decl.handler,
+    version: entry.manifest.version ?? "0.0.0",
+    operationType: decl.operationType,
+    permissions: getHandlerPermissions(entry.manifest, "cli", decl.path)
+  };
+}
 function filterTools(snapshot, permits) {
   const tools = [];
   for (const entry of snapshot.manifests) {
@@ -116871,21 +117162,31 @@ function filterTools(snapshot, permits) {
       if (!permits(decl.operationType, entry.pluginId)) {
         continue;
       }
-      tools.push({
-        name: toolName(entry.pluginId, decl.path),
-        description: decl.describe,
-        inputSchema: generateCommandSchema(toCommandManifest(decl, entry)),
-        pluginId: entry.pluginId,
-        pluginRoot: entry.pluginRoot,
-        handlerPath: decl.handler,
-        version: entry.manifest.version ?? "0.0.0",
-        operationType: decl.operationType,
-        permissions: getHandlerPermissions(entry.manifest, "cli", decl.path)
-      });
+      try {
+        tools.push(buildTool(entry, decl));
+      } catch {
+      }
     }
   }
   return tools;
 }
+function validateManifests2(snapshot) {
+  const diagnostics = [];
+  for (const entry of snapshot.manifests) {
+    for (const decl of entry.manifest.cli?.commands ?? []) {
+      try {
+        buildTool(entry, decl);
+      } catch (error2) {
+        diagnostics.push({
+          pluginId: entry.pluginId,
+          commandId: decl.id ?? decl.path ?? "(unknown)",
+          error: error2 instanceof Error ? error2.message : String(error2)
+        });
+      }
+    }
+  }
+  return diagnostics;
+}
 init_dist();
 function resolveHandlerPath(pluginRoot, handler) {
   const relative2 = handler.split("#")[0] ?? handler;
@@ -117014,6 +117315,14 @@ var McpObservabilityCollector = class {
   requestsTotal = 0;
   errorsTotal = 0;
   ops = new OperationMetricsTracker();
+  manifestDiagnostics = [];
+  /** Record the manifest diagnostics found by validateManifests() at startup. */
+  setManifestDiagnostics(diagnostics) {
+    this.manifestDiagnostics = diagnostics;
+  }
+  getManifestDiagnostics() {
+    return this.manifestDiagnostics;
+  }
   /**
    * Register Fastify hooks that track HTTP-level request counts and duration.
    * Must be called before routes are registered so the hooks apply to all routes.
@@ -117104,6 +117413,11 @@ var McpObservabilityCollector = class {
           id: "execution",
           status: "ok",
           message: `mode=${executionMode}`
+        },
+        {
+          id: "manifests",
+          status: this.manifestDiagnostics.length === 0 ? "ok" : "warn",
+          message: this.manifestDiagnostics.length === 0 ? "all commands loaded cleanly" : `${this.manifestDiagnostics.length} command(s) skipped \u2014 see /observability/diagnostics`
         }
       ],
       topOperations: this.ops.getTopOperations(5)
@@ -117133,6 +117447,17 @@ var McpObservabilityCollector = class {
 };
 
 // src/server.ts
+var DIAGNOSTICS_TOOL = {
+  name: "kb-labs__mcp_diagnostics",
+  description: "List plugin commands that failed to load as MCP tools (malformed manifests), with the reason for each.",
+  inputSchema: { type: "object", properties: {} }
+};
+function renderManifestDiagnostics(diagnostics) {
+  if (diagnostics.length === 0) {
+    return "All plugin commands loaded cleanly \u2014 no manifest issues.";
+  }
+  return diagnostics.map((d) => `[${d.pluginId}] ${d.commandId}: ${d.error}`).join("\n");
+}
 var McpDaemonServer = class {
   opts;
   resolvePlatform;
@@ -117157,6 +117482,15 @@ var McpDaemonServer = class {
       platformRoot: this.opts.platformRoot,
       cache: this.opts.cache
     });
+    const manifestDiagnostics = validateManifests2(this.registry.snapshot());
+    this.collector.setManifestDiagnostics(manifestDiagnostics);
+    for (const diag2 of manifestDiagnostics) {
+      this.opts.logger.warn("MCP tool skipped \u2014 invalid manifest command", {
+        pluginId: diag2.pluginId,
+        commandId: diag2.commandId,
+        error: diag2.error
+      });
+    }
     const execMode = process.env.KB_MCP_EXECUTION_MODE ?? "subprocess";
     const observabilityAdapter = {
       register: (server) => this.collector.register(server),
@@ -117181,6 +117515,9 @@ var McpDaemonServer = class {
   }
   async registerMcpRoutes(server) {
     const { cache, logger: logger2, jwtConfig } = this.opts;
+    server.get("/observability/diagnostics", async () => ({
+      diagnostics: this.collector.getManifestDiagnostics()
+    }));
     server.all("/api/v1/mcp", async (request, reply) => {
       reply.header("Access-Control-Allow-Origin", "*").header("Access-Control-Allow-Methods", "GET, POST, OPTIONS").header("Access-Control-Allow-Headers", "Authorization, Content-Type, Mcp-Session-Id");
       if (request.method === "OPTIONS") {
@@ -117207,15 +117544,24 @@ var McpDaemonServer = class {
         { capabilities: { tools: {} } }
       );
       mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
-        tools: visibleTools.map((t) => ({
-          name: t.name,
-          description: t.description,
-          inputSchema: t.inputSchema
-        }))
+        tools: [
+          ...visibleTools.map((t) => ({
+            name: t.name,
+            description: t.description,
+            inputSchema: t.inputSchema
+          })),
+          // Authenticated callers only — mirrors the visibility gate above.
+          ...permits ? [DIAGNOSTICS_TOOL] : []
+        ]
       }));
-      mcp.setRequestHandler(
-        CallToolRequestSchema,
-        async ({ params }) => executeToolCall({
+      mcp.setRequestHandler(CallToolRequestSchema, async ({ params }) => {
+        if (params.name === DIAGNOSTICS_TOOL.name) {
+          if (!permits) {
+            return { content: [{ type: "text", text: `Not authorized: ${params.name}` }], isError: true };
+          }
+          return { content: [{ type: "text", text: renderManifestDiagnostics(this.collector.getManifestDiagnostics()) }], isError: false };
+        }
+        return executeToolCall({
           name: params.name,
           args: params.arguments ?? {},
           visibleTools,
@@ -117224,8 +117570,8 @@ var McpDaemonServer = class {
           resolvePlatform: this.resolvePlatform,
           analytics: this.opts.platform.analytics,
           collector: this.collector
-        })
-      );
+        });
+      });
       const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: void 0 });
       try {
         await mcp.connect(transport);