@kuznai/inception-engine 0.8.0 → 0.9.0

package/README.md

@@ -2,7 +2,7 @@
 
 Plant skills directly into the minds of your installed AI coding agents — Claude Code, Codex, Gemini CLI, Antigravity, OpenCode, and GitHub Copilot. One command. They'll think they thought of it themselves.
 
-Today, inception-engine deploys skills, single files, and JSON config patches to AI coding agents. MCP configuration and agent rules remain unimplemented at the manifest level.
+Today, inception-engine deploys skills, single files, JSON config patches, MCP server registrations, and agent instruction files to AI coding agents.
 
 ## Quick Start
 
@@ -38,13 +38,13 @@ Managed skills overwrite their previous version. If a target exists but was not
 
 ### Feature Support
 
-| Feature | Status |
-|---|---|
-| Skills (SKILL.md) | Supported via manifest and CLI |
-| File write | Supported via manifest and CLI |
-| Config patch (JSON merge) | Supported via manifest and CLI |
-| MCP Servers | Accepted in manifest for forward compatibility, not implemented |
-| Agent Rules | Accepted in manifest for forward compatibility, not implemented |
+| Feature | Deploy | Revert |
+|---|---|---|
+| Skills (SKILL.md) | All agents via manifest and CLI | All agents |
+| File write | All agents via manifest and CLI | All agents |
+| Config patch (JSON merge) | All agents via manifest and CLI | All agents |
+| MCP Servers | claude-code, gemini-cli; stub warning for other agents | claude-code, gemini-cli |
+| Agent Rules | claude-code, codex, gemini-cli, opencode; stub warning for other agents | claude-code, codex, gemini-cli, opencode |
 
 ## Manifest Format
 
@@ -75,8 +75,20 @@ Create an `inception.json` file at the root of your skills directory:
       "agents": ["claude-code"]
     }
   ],
-  "mcpServers": [],
-  "agentRules": []
+  "mcpServers": [
+    {
+      "name": "my-server",
+      "agents": ["claude-code", "gemini-cli"],
+      "config": { "command": "npx", "args": ["-y", "my-mcp-server"] }
+    }
+  ],
+  "agentRules": [
+    {
+      "name": "my-rules",
+      "path": "rules/CLAUDE.md",
+      "agents": ["claude-code"]
+    }
+  ]
 }
 ```
 
@@ -102,7 +114,21 @@ Each **config** entry applies a [JSON merge patch (RFC 7386)](https://datatracke
 
 The engine records an undo-patch for each config-patch deployment so that `revert` can restore the original values.
 
-`mcpServers` and `agentRules` are currently parsed for forward compatibility, but the deployment engine ignores them today.
+Each **mcpServer** entry registers an MCP server into the agent's config file by applying a JSON merge patch under the `mcpServers` key:
+
+- **name** - Unique identifier (same format as skill names); used as the server's key in the config
+- **agents** - Array of agent IDs to register this server with
+- **config** - Raw server descriptor object (e.g. `{ "command": "...", "args": [...] }` for stdio transport). The exact shape is passed through verbatim; agent adapters handle agent-specific requirements.
+
+MCP server registration is currently supported for `claude-code` (`~/.claude.json`) and `gemini-cli` (`~/.gemini/settings.json`). Other agents emit a warning and are skipped. Revert removes the registered server entry from the config file.
+
+Each **agentRules** entry deploys a Markdown instruction file to the agent's global rules location:
+
+- **name** - Unique identifier (same format as skill names)
+- **path** - Relative path to the source Markdown file within the repo
+- **agents** - Array of agent IDs to deploy this file to
+
+Agent rules deployment is currently supported for `claude-code` (`~/.claude/CLAUDE.md`), `codex` (`~/.codex/AGENTS.md`), `gemini-cli` (`~/.gemini/GEMINI.md`), and `opencode` (`~/.config/opencode/AGENTS.md`). Other agents emit a warning and are skipped. Revert removes the deployed rules file.
 
 ## Creating Skills
 
@@ -119,7 +145,7 @@ description: What this skill does and when to use it
 Instructions for the AI agent...
 ```
 
-The `name` and `description` fields in the frontmatter are required by most agents. The description determines when the agent activates the skill.
+The `name` and `description` fields in the frontmatter are used by most agents. The description determines when the agent activates the skill. inception-engine does not currently validate the frontmatter — missing or malformed fields may cause the skill to be ignored or misbehave at the agent level.
 
 ## CLI Reference
 
@@ -201,7 +227,7 @@ inception-engine maintains a centralized deployment registry at `~/.inception-en
 
 - **Strong binding**: Each registry entry binds a specific target path to its skill, agent, and action kind, with action-specific provenance fields (`source` and `method` for skill-dir and file-write; `patch` and `undoPatch` for config-patch). A target is only considered managed if all relevant fields match — a stray entry or a different deployment cannot satisfy the check.
 
-- **Atomic redeploy**: When overwriting an existing managed target, the engine renames the old target to a backup, creates the new deployment, and only removes the backup on success. If the new deployment fails, the backup is restored.
+- **Atomic redeploy**: When overwriting an existing managed `skill-dir` target, the engine renames the old target to a backup, creates the new deployment, and only removes the backup on success. If the new deployment fails, the backup is restored. `file-write` and `config-patch` deployments write directly to the target without this backup/rollback model.
 
 - **Cross-platform**: The registry uses the same resolved home directory as the rest of the tool, including sudo scenarios on POSIX and elevated PowerShell on Windows.
 

package/dist/config/agents.js

@@ -15,6 +15,16 @@ export const AGENT_REGISTRY = [
             skills: "documented",
             detectPaths: "documented",
             detectBinary: "documented",
+            mcpConfig: "documented",
+            agentRules: "documented",
+        },
+        mcpConfigPath: {
+            posix: ["{home}", ".claude.json"],
+            windows: ["{home}", ".claude.json"],
+        },
+        agentRulesPath: {
+            posix: ["{home}", ".claude", "CLAUDE.md"],
+            windows: ["{home}", ".claude", "CLAUDE.md"],
         },
     },
     {
@@ -33,6 +43,12 @@ export const AGENT_REGISTRY = [
             skills: "documented",
             detectPaths: "documented",
             detectBinary: "documented",
+            agentRules: "documented",
+        },
+        // mcpConfigPath omitted: Codex uses TOML config, not JSON — not supported by config-patch
+        agentRulesPath: {
+            posix: ["{home}", ".codex", "AGENTS.md"],
+            windows: ["{home}", ".codex", "AGENTS.md"],
         },
     },
     {
@@ -51,6 +67,16 @@ export const AGENT_REGISTRY = [
             skills: "documented",
             detectPaths: "documented",
             detectBinary: "documented",
+            mcpConfig: "documented",
+            agentRules: "documented",
+        },
+        mcpConfigPath: {
+            posix: ["{home}", ".gemini", "settings.json"],
+            windows: ["{home}", ".gemini", "settings.json"],
+        },
+        agentRulesPath: {
+            posix: ["{home}", ".gemini", "GEMINI.md"],
+            windows: ["{home}", ".gemini", "GEMINI.md"],
         },
     },
     {
@@ -70,6 +96,7 @@ export const AGENT_REGISTRY = [
             detectPaths: "implementation-only",
             detectBinary: "provisional",
         },
+        // mcpConfigPath and agentRulesPath omitted: paths not documented strongly enough for this release
     },
     {
         id: "opencode",
@@ -87,6 +114,12 @@ export const AGENT_REGISTRY = [
             skills: "documented",
             detectPaths: "documented",
             detectBinary: "documented",
+            agentRules: "documented",
+        },
+        // mcpConfigPath omitted: OpenCode uses opencode.json (TOML-adjacent format), not plain JSON
+        agentRulesPath: {
+            posix: ["{xdg_config}", "opencode", "AGENTS.md"],
+            windows: ["{appdata}", "opencode", "AGENTS.md"],
         },
     },
     {
@@ -106,6 +139,7 @@ export const AGENT_REGISTRY = [
             detectPaths: "documented",
             detectBinary: "documented",
         },
+        // mcpConfigPath and agentRulesPath omitted: rules live in repo, not home dir; MCP config unclear
         policyNote: "Organization policies may override locally deployed skills. Verify with your GitHub org admin if deployed skills are not active.",
     },
 ];

package/dist/core/adapters/index.d.ts

@@ -0,0 +1,11 @@
+import type { McpServerEntry, AgentRuleEntry } from "../../schemas/manifest.ts";
+import type { AgentId, ConfigPatchDeployAction, FileWriteDeployAction, PlanWarning } from "../../types.ts";
+import { compileMcpServerReverts } from "./mcp.ts";
+import { compileAgentRuleReverts } from "./rules.ts";
+export { compileMcpServerReverts, compileAgentRuleReverts };
+export type AdapterAction = ConfigPatchDeployAction | FileWriteDeployAction;
+export interface AdapterResult {
+    actions: AdapterAction[];
+    warnings: PlanWarning[];
+}
+export declare function compileAdapterActions(mcpServers: McpServerEntry[], agentRules: AgentRuleEntry[], sourceDir: string, resolvedSourceDir: string, realRoot: string, detectedAgents: AgentId[], home: string): Promise<AdapterResult>;

package/dist/core/adapters/index.js

@@ -0,0 +1,18 @@
+import { compileMcpServerActions, compileMcpServerReverts } from "./mcp.js";
+import { compileAgentRuleActions, compileAgentRuleReverts } from "./rules.js";
+export { compileMcpServerReverts, compileAgentRuleReverts };
+export async function compileAdapterActions(mcpServers, agentRules, sourceDir, resolvedSourceDir, realRoot, detectedAgents, home) {
+    const actions = [];
+    const warnings = [];
+    for (const entry of mcpServers) {
+        const r = compileMcpServerActions(entry, detectedAgents, home);
+        actions.push(...r.actions);
+        warnings.push(...r.warnings);
+    }
+    for (const entry of agentRules) {
+        const r = await compileAgentRuleActions(entry, sourceDir, resolvedSourceDir, realRoot, detectedAgents, home);
+        actions.push(...r.actions);
+        warnings.push(...r.warnings);
+    }
+    return { actions, warnings };
+}

package/dist/core/adapters/mcp.d.ts

@@ -0,0 +1,8 @@
+import type { McpServerEntry } from "../../schemas/manifest.ts";
+import type { AgentId, ConfigPatchDeployAction, ConfigPatchRevertAction, PlanWarning } from "../../types.ts";
+export interface McpAdapterResult {
+    actions: ConfigPatchDeployAction[];
+    warnings: PlanWarning[];
+}
+export declare function compileMcpServerActions(entry: McpServerEntry, detectedAgents: AgentId[], home: string): McpAdapterResult;
+export declare function compileMcpServerReverts(entry: McpServerEntry, agentFilter: AgentId[] | null, home: string): ConfigPatchRevertAction[];

package/dist/core/adapters/mcp.js

@@ -0,0 +1,51 @@
+import path from "node:path";
+import { AGENT_REGISTRY_BY_ID } from "../../config/agents.js";
+import { getPlatformKey, resolvePlaceholders } from "../resolve.js";
+export function compileMcpServerActions(entry, detectedAgents, home) {
+    const actions = [];
+    const warnings = [];
+    const platform = getPlatformKey();
+    for (const agentId of entry.agents) {
+        if (!detectedAgents.includes(agentId))
+            continue;
+        const agent = AGENT_REGISTRY_BY_ID[agentId];
+        if (!agent?.mcpConfigPath) {
+            warnings.push({
+                kind: "confidence",
+                message: `mcpServers: agent "${agentId}" does not have a documented MCP config path — skipping "${entry.name}"`,
+            });
+            continue;
+        }
+        const target = resolvePlaceholders(agent.mcpConfigPath[platform], "", home);
+        // Ensure no stray empty segments collapse the path unexpectedly
+        const resolvedTarget = path.resolve(target);
+        actions.push({
+            kind: "config-patch",
+            skill: entry.name,
+            agent: agentId,
+            target: resolvedTarget,
+            patch: { mcpServers: { [entry.name]: entry.config } },
+            confidence: agent.provenance.mcpConfig ?? "provisional",
+        });
+    }
+    return { actions, warnings };
+}
+export function compileMcpServerReverts(entry, agentFilter, home) {
+    const actions = [];
+    const platform = getPlatformKey();
+    for (const agentId of entry.agents) {
+        if (agentFilter && !agentFilter.includes(agentId))
+            continue;
+        const agent = AGENT_REGISTRY_BY_ID[agentId];
+        if (!agent?.mcpConfigPath)
+            continue;
+        const target = path.resolve(resolvePlaceholders(agent.mcpConfigPath[platform], "", home));
+        actions.push({
+            kind: "config-patch",
+            skill: entry.name,
+            agent: agentId,
+            target,
+        });
+    }
+    return actions;
+}

package/dist/core/adapters/rules.d.ts

@@ -0,0 +1,8 @@
+import type { AgentRuleEntry } from "../../schemas/manifest.ts";
+import type { AgentId, FileWriteDeployAction, FileWriteRevertAction, PlanWarning } from "../../types.ts";
+export interface RulesAdapterResult {
+    actions: FileWriteDeployAction[];
+    warnings: PlanWarning[];
+}
+export declare function compileAgentRuleActions(entry: AgentRuleEntry, sourceDir: string, resolvedSourceDir: string, realRoot: string, detectedAgents: AgentId[], home: string): Promise<RulesAdapterResult>;
+export declare function compileAgentRuleReverts(entry: AgentRuleEntry, agentFilter: AgentId[] | null, home: string): FileWriteRevertAction[];

package/dist/core/adapters/rules.js

@@ -0,0 +1,54 @@
+import path from "node:path";
+import { AGENT_REGISTRY_BY_ID } from "../../config/agents.js";
+import { getPlatformKey, resolvePlaceholders } from "../resolve.js";
+import { validateSourceFile, validateSourcePath } from "../validation.js";
+export async function compileAgentRuleActions(entry, sourceDir, resolvedSourceDir, realRoot, detectedAgents, home) {
+    const actions = [];
+    const warnings = [];
+    const platform = getPlatformKey();
+    // Validate the source file once (before iterating agents) since it is shared.
+    const source = path.resolve(sourceDir, entry.path);
+    await validateSourcePath(source, entry.path, resolvedSourceDir, realRoot);
+    await validateSourceFile(source, entry.path);
+    for (const agentId of entry.agents) {
+        if (!detectedAgents.includes(agentId))
+            continue;
+        const agent = AGENT_REGISTRY_BY_ID[agentId];
+        if (!agent?.agentRulesPath) {
+            warnings.push({
+                kind: "confidence",
+                message: `agentRules: agent "${agentId}" does not have a documented rules file path — skipping "${entry.name}"`,
+            });
+            continue;
+        }
+        const target = resolvePlaceholders(agent.agentRulesPath[platform], "", home);
+        actions.push({
+            kind: "file-write",
+            skill: entry.name,
+            agent: agentId,
+            source,
+            target,
+            confidence: agent.provenance.agentRules ?? "provisional",
+        });
+    }
+    return { actions, warnings };
+}
+export function compileAgentRuleReverts(entry, agentFilter, home) {
+    const actions = [];
+    const platform = getPlatformKey();
+    for (const agentId of entry.agents) {
+        if (agentFilter && !agentFilter.includes(agentId))
+            continue;
+        const agent = AGENT_REGISTRY_BY_ID[agentId];
+        if (!agent?.agentRulesPath)
+            continue;
+        const target = resolvePlaceholders(agent.agentRulesPath[platform], "", home);
+        actions.push({
+            kind: "file-write",
+            skill: entry.name,
+            agent: agentId,
+            target,
+        });
+    }
+    return actions;
+}

package/dist/core/deploy.js

@@ -5,7 +5,9 @@ import { AGENT_REGISTRY_BY_ID } from "../config/agents.js";
 import { UserError } from "../errors.js";
 import { logger } from "../logger.js";
 import { lookupDeployment, registerDeployment, verifyDeployment, } from "./ownership.js";
+import { compileAdapterActions } from "./adapters/index.js";
 import { getDeployMethod, resolveAgentSkillPath } from "./resolve.js";
+import { sourceAccessError, validateSourceFile, validateSourcePath, } from "./validation.js";
 function isPlainObject(v) {
     return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -35,7 +37,13 @@ async function readJsonConfig(filePath) {
 function computeUndoPatch(original, patch) {
     const undoPatch = {};
     for (const key of Object.keys(patch)) {
-        undoPatch[key] = key in original ? original[key] : null;
+        const patchVal = patch[key];
+        if (isPlainObject(patchVal) && isPlainObject(original[key])) {
+            undoPatch[key] = computeUndoPatch(original[key], patchVal);
+        }
+        else {
+            undoPatch[key] = key in original ? original[key] : null;
+        }
     }
     return undoPatch;
 }
@@ -45,21 +53,15 @@ function applyMergePatch(original, patch) {
         if (value === null) {
             delete patched[key];
         }
+        else if (isPlainObject(value) && isPlainObject(patched[key])) {
+            patched[key] = applyMergePatch(patched[key], value);
+        }
         else {
             patched[key] = value;
         }
     }
     return patched;
 }
-function sourceAccessError(err, sourcePath) {
-    const code = err.code;
-    if (code === "ENOENT")
-        return `Source not found: ${sourcePath}`;
-    if (code === "EACCES" || code === "EPERM")
-        return `Permission denied accessing source: ${sourcePath}`;
-    const detail = err instanceof Error ? err.message : String(err);
-    return `Failed to access source ${sourcePath}: ${detail}`;
-}
 function resolveTargetTemplate(template, home) {
     const appdata = process.env.APPDATA ?? path.join(home, "AppData", "Roaming");
     const xdgRaw = process.env.XDG_CONFIG_HOME;
@@ -69,18 +71,6 @@ function resolveTargetTemplate(template, home) {
         .replace("{appdata}", appdata)
         .replace("{xdg_config}", xdgConfig);
 }
-async function validateSourceFile(sourcePath, manifestPath) {
-    let stat;
-    try {
-        stat = await lstat(sourcePath);
-    }
-    catch (err) {
-        throw new UserError("DEPLOY_FAILED", sourceAccessError(err, manifestPath));
-    }
-    if (!stat.isFile()) {
-        throw new UserError("DEPLOY_FAILED", `Source is not a file: ${manifestPath}`);
-    }
-}
 function detectCollisions(actions) {
     const seen = new Map();
     const warnings = [];
@@ -194,9 +184,12 @@ export async function planDeploy(manifest, sourceDir, detectedAgents, home) {
         ...(await planFileWriteActions(manifest, sourceDir, resolvedSourceDir, realRoot, detectedAgents, home)),
         ...planConfigPatchActions(manifest, detectedAgents, home),
     ];
+    const adapterResult = await compileAdapterActions(manifest.mcpServers, manifest.agentRules, sourceDir, resolvedSourceDir, realRoot, detectedAgents, home);
+    actions.push(...adapterResult.actions);
     const warnings = [
         ...detectAmbiguities(detectedAgents),
         ...detectCollisions(actions),
+        ...adapterResult.warnings,
     ];
     return { actions, warnings };
 }
@@ -386,23 +379,6 @@ async function deployConfigPatch(action, dryRun, verbose, home, planned) {
         return { error: msg };
     }
 }
-async function validateSourcePath(source, skillPath, resolvedSourceDir, realRoot) {
-    if (!source.startsWith(resolvedSourceDir + path.sep)) {
-        throw new UserError("DEPLOY_FAILED", `Skill path "${skillPath}" resolves outside the repository root: ${source}`);
-    }
-    try {
-        const realSource = await realpath(source);
-        if (realSource !== realRoot &&
-            !realSource.startsWith(realRoot + path.sep)) {
-            throw new UserError("DEPLOY_FAILED", `Skill path "${skillPath}" resolves outside the repository root via symlink: ${source} -> ${realSource}`);
-        }
-    }
-    catch (err) {
-        if (err instanceof UserError)
-            throw err;
-        // Source doesn't exist yet — will be caught during execute
-    }
-}
 async function validateSkillContract(source, skillPath) {
     let stat;
     try {

package/dist/core/resolve.d.ts

@@ -9,3 +9,4 @@ export declare function resolveAgentSkillPathFor(agent: AgentConfig, skillName:
 export declare function resolveAgentDetectPathFor(agent: AgentConfig, home: string, platform: "posix" | "windows"): string;
 export declare function resolveAgentSkillPath(agent: AgentConfig, skillName: string, home: string): string;
 export declare function resolveAgentDetectPath(agent: AgentConfig, home: string): string;
+export declare function resolvePlaceholders(segments: string[], skillName: string, home: string): string;

package/dist/core/resolve.js

@@ -96,7 +96,7 @@ export function resolveAgentSkillPath(agent, skillName, home) {
 export function resolveAgentDetectPath(agent, home) {
     return resolveAgentDetectPathFor(agent, home, getPlatformKey());
 }
-function resolvePlaceholders(segments, skillName, home) {
+export function resolvePlaceholders(segments, skillName, home) {
     const appdata = process.env.APPDATA ?? path.join(home, "AppData", "Roaming");
     const xdgRaw = process.env.XDG_CONFIG_HOME;
     const xdgConfig = xdgRaw && path.isAbsolute(xdgRaw) ? xdgRaw : path.join(home, ".config");

package/dist/core/revert.js

@@ -2,6 +2,7 @@ import { lstat, readFile, rm, unlink, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { AGENT_REGISTRY_BY_ID } from "../config/agents.js";
 import { logger } from "../logger.js";
+import { compileMcpServerReverts, compileAgentRuleReverts, } from "./adapters/index.js";
 import { lookupDeployment, unregisterDeployment } from "./ownership.js";
 import { resolveAgentSkillPath } from "./resolve.js";
 function resolveTargetTemplate(template, home) {
@@ -75,6 +76,8 @@ export function planRevert(manifest, detectedAgents, home) {
         ...buildSkillDirReverts(manifest, home, detectedAgents),
         ...buildFileWriteReverts(manifest, home, detectedAgents),
         ...buildConfigPatchReverts(manifest, home, detectedAgents),
+        ...(manifest.mcpServers ?? []).flatMap((e) => compileMcpServerReverts(e, detectedAgents, home)),
+        ...(manifest.agentRules ?? []).flatMap((e) => compileAgentRuleReverts(e, detectedAgents, home)),
     ];
 }
 export function planRevertAll(manifest, home) {
@@ -82,6 +85,8 @@ export function planRevertAll(manifest, home) {
         ...buildSkillDirReverts(manifest, home, null),
         ...buildFileWriteReverts(manifest, home, null),
         ...buildConfigPatchReverts(manifest, home, null),
+        ...(manifest.mcpServers ?? []).flatMap((e) => compileMcpServerReverts(e, null, home)),
+        ...(manifest.agentRules ?? []).flatMap((e) => compileAgentRuleReverts(e, null, home)),
     ];
 }
 function recordOutcome(result, action, counts, failed) {
@@ -109,12 +114,18 @@ async function readJsonConfig(filePath) {
     }
     return parsed;
 }
+function isPlainObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
 function applyUndoPatch(current, undoPatch) {
     const restored = { ...current };
     for (const [key, originalValue] of Object.entries(undoPatch)) {
         if (originalValue === null) {
             delete restored[key];
         }
+        else if (isPlainObject(originalValue) && isPlainObject(restored[key])) {
+            restored[key] = applyUndoPatch(restored[key], originalValue);
+        }
         else {
             restored[key] = originalValue;
         }

package/dist/core/validation.d.ts

@@ -0,0 +1,3 @@
+export declare function sourceAccessError(err: unknown, sourcePath: string): string;
+export declare function validateSourcePath(source: string, skillPath: string, resolvedSourceDir: string, realRoot: string): Promise<void>;
+export declare function validateSourceFile(sourcePath: string, manifestPath: string): Promise<void>;

package/dist/core/validation.js

@@ -0,0 +1,41 @@
+import { lstat, realpath } from "node:fs/promises";
+import path from "node:path";
+import { UserError } from "../errors.js";
+export function sourceAccessError(err, sourcePath) {
+    const code = err.code;
+    if (code === "ENOENT")
+        return `Source not found: ${sourcePath}`;
+    if (code === "EACCES" || code === "EPERM")
+        return `Permission denied accessing source: ${sourcePath}`;
+    const detail = err instanceof Error ? err.message : String(err);
+    return `Failed to access source ${sourcePath}: ${detail}`;
+}
+export async function validateSourcePath(source, skillPath, resolvedSourceDir, realRoot) {
+    if (!source.startsWith(resolvedSourceDir + path.sep)) {
+        throw new UserError("DEPLOY_FAILED", `Skill path "${skillPath}" resolves outside the repository root: ${source}`);
+    }
+    try {
+        const realSource = await realpath(source);
+        if (realSource !== realRoot &&
+            !realSource.startsWith(realRoot + path.sep)) {
+            throw new UserError("DEPLOY_FAILED", `Skill path "${skillPath}" resolves outside the repository root via symlink: ${source} -> ${realSource}`);
+        }
+    }
+    catch (err) {
+        if (err instanceof UserError)
+            throw err;
+        // Source doesn't exist yet — will be caught during execute
+    }
+}
+export async function validateSourceFile(sourcePath, manifestPath) {
+    let stat;
+    try {
+        stat = await lstat(sourcePath);
+    }
+    catch (err) {
+        throw new UserError("DEPLOY_FAILED", sourceAccessError(err, manifestPath));
+    }
+    if (!stat.isFile()) {
+        throw new UserError("DEPLOY_FAILED", `Source is not a file: ${manifestPath}`);
+    }
+}

package/dist/schemas/manifest.d.ts

@@ -50,10 +50,28 @@ export declare const ConfigEntrySchema: z.ZodObject<{
 }, z.core.$strip>;
 export declare const McpServerEntrySchema: z.ZodObject<{
     name: z.ZodString;
-}, z.core.$loose>;
+    agents: z.ZodPipe<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodEnum<{
+        "claude-code": "claude-code";
+        codex: "codex";
+        "gemini-cli": "gemini-cli";
+        antigravity: "antigravity";
+        opencode: "opencode";
+        "github-copilot": "github-copilot";
+    }>>>, z.ZodTransform<("claude-code" | "codex" | "gemini-cli" | "antigravity" | "opencode" | "github-copilot")[], ("claude-code" | "codex" | "gemini-cli" | "antigravity" | "opencode" | "github-copilot")[]>>;
+    config: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strip>;
 export declare const AgentRuleEntrySchema: z.ZodObject<{
     name: z.ZodString;
-}, z.core.$loose>;
+    agents: z.ZodPipe<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodEnum<{
+        "claude-code": "claude-code";
+        codex: "codex";
+        "gemini-cli": "gemini-cli";
+        antigravity: "antigravity";
+        opencode: "opencode";
+        "github-copilot": "github-copilot";
+    }>>>, z.ZodTransform<("claude-code" | "codex" | "gemini-cli" | "antigravity" | "opencode" | "github-copilot")[], ("claude-code" | "codex" | "gemini-cli" | "antigravity" | "opencode" | "github-copilot")[]>>;
+    path: z.ZodString;
+}, z.core.$strip>;
 export declare const ManifestSchema: z.ZodObject<{
     skills: z.ZodArray<z.ZodObject<{
         name: z.ZodString;
@@ -95,10 +113,28 @@ export declare const ManifestSchema: z.ZodObject<{
     }, z.core.$strip>>>;
     mcpServers: z.ZodDefault<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
-    }, z.core.$loose>>>;
+        agents: z.ZodPipe<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodEnum<{
+            "claude-code": "claude-code";
+            codex: "codex";
+            "gemini-cli": "gemini-cli";
+            antigravity: "antigravity";
+            opencode: "opencode";
+            "github-copilot": "github-copilot";
+        }>>>, z.ZodTransform<("claude-code" | "codex" | "gemini-cli" | "antigravity" | "opencode" | "github-copilot")[], ("claude-code" | "codex" | "gemini-cli" | "antigravity" | "opencode" | "github-copilot")[]>>;
+        config: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, z.core.$strip>>>;
     agentRules: z.ZodDefault<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
-    }, z.core.$loose>>>;
+        agents: z.ZodPipe<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodEnum<{
+            "claude-code": "claude-code";
+            codex: "codex";
+            "gemini-cli": "gemini-cli";
+            antigravity: "antigravity";
+            opencode: "opencode";
+            "github-copilot": "github-copilot";
+        }>>>, z.ZodTransform<("claude-code" | "codex" | "gemini-cli" | "antigravity" | "opencode" | "github-copilot")[], ("claude-code" | "codex" | "gemini-cli" | "antigravity" | "opencode" | "github-copilot")[]>>;
+        path: z.ZodString;
+    }, z.core.$strip>>>;
 }, z.core.$strip>;
 export type SkillEntry = z.infer<typeof SkillEntrySchema>;
 export type FileEntry = z.infer<typeof FileEntrySchema>;

package/dist/schemas/manifest.js

@@ -71,20 +71,19 @@ export const ConfigEntrySchema = z.object({
     patch: z.record(z.string(), z.unknown()),
     agents: agentsField,
 });
-export const McpServerEntrySchema = z
-    .object({
-    name: z
-        .string({ message: "mcpServers entry name must be a non-empty string" })
-        .min(1, { message: "mcpServers entry name must be a non-empty string" }),
-})
-    .passthrough();
-export const AgentRuleEntrySchema = z
-    .object({
-    name: z
-        .string({ message: "agentRules entry name must be a non-empty string" })
-        .min(1, { message: "agentRules entry name must be a non-empty string" }),
-})
-    .passthrough();
+export const McpServerEntrySchema = z.object({
+    name: nameField,
+    agents: agentsField,
+    // Raw server descriptor passed verbatim to each agent adapter.
+    // Adapters are responsible for validating the shape they need.
+    config: z.record(z.string(), z.unknown()),
+});
+export const AgentRuleEntrySchema = z.object({
+    name: nameField,
+    agents: agentsField,
+    // Relative path to the rules/instruction file within the source bundle.
+    path: sourcePathField,
+});
 export const ManifestSchema = z.object({
     skills: z.array(SkillEntrySchema).superRefine((skills, ctx) => {
         const seen = new Set();

package/dist/types.d.ts

@@ -9,6 +9,8 @@ export interface AgentProvenance {
     skills: Confidence;
     detectPaths: Confidence;
     detectBinary: Confidence;
+    mcpConfig?: Confidence;
+    agentRules?: Confidence;
 }
 export interface AgentConfig {
     id: AgentId;
@@ -17,6 +19,8 @@ export interface AgentConfig {
     detectPaths: AgentPaths;
     detectBinary: string | null;
     provenance: AgentProvenance;
+    mcpConfigPath?: AgentPaths;
+    agentRulesPath?: AgentPaths;
     policyNote?: string;
 }
 export interface PlanWarning {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kuznai/inception-engine",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Deploy AI agent skills from a git repo to user home directories",
   "license": "MIT",
   "author": "Damian Piątkowski",