@kwonye/mcpx 0.1.93 → 0.1.95

package/dist/{cli-kwyp9ywh.js → cli-wxw1t3rr.js}

@@ -1,9 +1,6 @@
-import {
-  saveConfig
-} from "./cli-np0wwh6m.js";
 import {
   ensureGatewayToken
-} from "./cli-8vxva0cb.js";
+} from "./cli-tk8bggg5.js";
 import {
   ensureDir,
   getManagedIndexPath,
@@ -71,14 +68,15 @@ function loadOwnership(targetDir) {
   try {
     return JSON.parse(fs2.readFileSync(manifestPath, "utf8"));
   } catch {
+    console.error(`[mcpx] Warning: corrupt plugin ownership manifest at ${manifestPath}, resetting`);
     return { version: 1, plugins: {} };
   }
 }
 function saveOwnership(targetDir, manifest) {
+  ensureDir(targetDir);
   fs2.writeFileSync(path2.join(targetDir, OWNERSHIP_MANIFEST), JSON.stringify(manifest, null, 2));
 }
 function recordOwned(targetDir, pluginId, paths) {
-  ensureDir(targetDir);
   const manifest = loadOwnership(targetDir);
   manifest.plugins[pluginId] = {
     pluginId,
@@ -114,16 +112,49 @@ function pruneAllPluginProjections(targetDir) {
     prunePluginProjections(targetDir, pluginId);
   }
 }
+function pruneUnlistedPlugins(targetDir, keepPluginIds) {
+  const manifest = loadOwnership(targetDir);
+  const keep = new Set(keepPluginIds);
+  for (const [pluginId] of Object.entries(manifest.plugins)) {
+    if (!keep.has(pluginId)) {
+      prunePluginProjections(targetDir, pluginId);
+    }
+  }
+}
 function nsName(pluginName, id) {
   return `${pluginName}__${id}`;
 }
+function assertWithinBase(base, target) {
+  const resolvedBase = path2.resolve(base);
+  const resolvedTarget = path2.resolve(target);
+  if (resolvedTarget !== resolvedBase && !resolvedTarget.startsWith(resolvedBase + path2.sep)) {
+    throw new Error(`Refusing to write outside projection base: ${target} (base: ${base})`);
+  }
+}
+function isComponentApproved(plugin, component) {
+  const approval = plugin.approvals?.[component];
+  if (approval === false)
+    return false;
+  if (approval === true)
+    return true;
+  if (component === "hooks")
+    return false;
+  if (component === "mcpServers")
+    return plugin.components.mcpServers;
+  return plugin.components[component] ?? false;
+}
 function syncClaude(plugins) {
   const targetBase = path2.join(homeDir(), ".claude", "skills");
   const projectedDirs = [];
   const unsupported = [];
+  const skippedUnapproved = [];
   for (const plugin of plugins) {
     if (!plugin.enabled)
       continue;
+    if (!isComponentApproved(plugin, "skills")) {
+      skippedUnapproved.push(`${plugin.pluginName}:skills`);
+      continue;
+    }
     const targetDir = path2.join(targetBase, plugin.pluginName);
     ensureDir(targetDir);
     const mcpJsonSrc = path2.join(plugin.pluginRoot, ".mcp.json");
@@ -155,25 +186,34 @@ function syncCodex(plugins) {
   const targetBase = path2.join(homeDir(), ".codex", "skills");
   const projectedDirs = [];
   const unsupported = ["hooks", "agents"];
+  const errors = [];
   for (const plugin of plugins) {
-    if (!plugin.enabled || !plugin.components.skills)
+    if (!plugin.enabled)
       continue;
-    ensureDir(targetBase);
-    const owned = [];
-    for (const skill of plugin.skills) {
-      const targetDir = path2.join(targetBase, nsName(plugin.pluginName, skill.id));
-      ensureDir(targetDir);
-      copyFileOrDir(skill.path, path2.join(targetDir, "SKILL.md"));
-      owned.push(nsName(plugin.pluginName, skill.id));
-      projectedDirs.push(targetDir);
+    if (plugin.components.skills && isComponentApproved(plugin, "skills")) {
+      ensureDir(targetBase);
+      const owned = [];
+      for (const skill of plugin.skills) {
+        try {
+          const targetDir = path2.join(targetBase, nsName(plugin.pluginName, skill.id));
+          assertWithinBase(targetBase, targetDir);
+          ensureDir(targetDir);
+          copyFileOrDir(skill.path, path2.join(targetDir, "SKILL.md"));
+          owned.push(nsName(plugin.pluginName, skill.id));
+          projectedDirs.push(targetDir);
+        } catch (error) {
+          errors.push(`${plugin.pluginName}/${skill.id}: ${error.message}`);
+        }
+      }
+      recordOwned(targetBase, plugin.pluginId, owned);
     }
-    recordOwned(targetBase, plugin.pluginId, owned);
   }
   return {
     clientId: "codex",
     status: "SYNCED",
     projectedDirs,
-    unsupported
+    unsupported,
+    ...errors.length > 0 ? { error: errors.join("; ") } : {}
   };
 }
 function syncCursor(plugins) {
@@ -181,28 +221,39 @@ function syncCursor(plugins) {
   const commandsBase = path2.join(homeDir(), ".cursor", "commands");
   const projectedDirs = [];
   const unsupported = ["hooks", "agents"];
-  const ownedSkills = [];
-  const ownedCommands = [];
+  const errors = [];
   for (const plugin of plugins) {
     if (!plugin.enabled)
       continue;
-    if (plugin.components.skills) {
+    const ownedSkills = [];
+    const ownedCommands = [];
+    if (plugin.components.skills && isComponentApproved(plugin, "skills")) {
       ensureDir(skillsBase);
       for (const skill of plugin.skills) {
-        const targetDir = path2.join(skillsBase, nsName(plugin.pluginName, skill.id));
-        ensureDir(targetDir);
-        copyFileOrDir(skill.path, path2.join(targetDir, "SKILL.md"));
-        ownedSkills.push(nsName(plugin.pluginName, skill.id));
-        projectedDirs.push(targetDir);
+        try {
+          const targetDir = path2.join(skillsBase, nsName(plugin.pluginName, skill.id));
+          assertWithinBase(skillsBase, targetDir);
+          ensureDir(targetDir);
+          copyFileOrDir(skill.path, path2.join(targetDir, "SKILL.md"));
+          ownedSkills.push(nsName(plugin.pluginName, skill.id));
+          projectedDirs.push(targetDir);
+        } catch (error) {
+          errors.push(`${plugin.pluginName}/${skill.id}: ${error.message}`);
+        }
       }
     }
-    if (plugin.components.commands) {
+    if (plugin.components.commands && isComponentApproved(plugin, "commands")) {
       ensureDir(commandsBase);
       for (const cmd of plugin.commands) {
-        const targetPath = path2.join(commandsBase, `${nsName(plugin.pluginName, cmd.id)}.md`);
-        copyFileOrDir(cmd.path, targetPath);
-        ownedCommands.push(`${nsName(plugin.pluginName, cmd.id)}.md`);
-        projectedDirs.push(targetPath);
+        try {
+          const targetPath = path2.join(commandsBase, `${nsName(plugin.pluginName, cmd.id)}.md`);
+          assertWithinBase(commandsBase, targetPath);
+          copyFileOrDir(cmd.path, targetPath);
+          ownedCommands.push(`${nsName(plugin.pluginName, cmd.id)}.md`);
+          projectedDirs.push(targetPath);
+        } catch (error) {
+          errors.push(`${plugin.pluginName}/${cmd.id}: ${error.message}`);
+        }
       }
     }
     if (ownedSkills.length > 0)
@@ -214,151 +265,281 @@ function syncCursor(plugins) {
     clientId: "cursor",
     status: "SYNCED",
     projectedDirs,
-    unsupported
+    unsupported,
+    ...errors.length > 0 ? { error: errors.join("; ") } : {}
   };
 }
 function syncVsCode(plugins) {
   const skillsBase = path2.join(homeDir(), ".copilot", "skills");
   const projectedDirs = [];
   const unsupported = ["hooks", "agents"];
+  const errors = [];
   for (const plugin of plugins) {
-    if (!plugin.enabled || !plugin.components.skills)
+    if (!plugin.enabled)
       continue;
-    ensureDir(skillsBase);
-    const owned = [];
-    for (const skill of plugin.skills) {
-      const targetDir = path2.join(skillsBase, nsName(plugin.pluginName, skill.id));
-      ensureDir(targetDir);
-      copyFileOrDir(skill.path, path2.join(targetDir, "SKILL.md"));
-      owned.push(nsName(plugin.pluginName, skill.id));
-      projectedDirs.push(targetDir);
+    if (plugin.components.skills && isComponentApproved(plugin, "skills")) {
+      ensureDir(skillsBase);
+      const owned = [];
+      for (const skill of plugin.skills) {
+        try {
+          const targetDir = path2.join(skillsBase, nsName(plugin.pluginName, skill.id));
+          assertWithinBase(skillsBase, targetDir);
+          ensureDir(targetDir);
+          copyFileOrDir(skill.path, path2.join(targetDir, "SKILL.md"));
+          owned.push(nsName(plugin.pluginName, skill.id));
+          projectedDirs.push(targetDir);
+        } catch (error) {
+          errors.push(`${plugin.pluginName}/${skill.id}: ${error.message}`);
+        }
+      }
+      recordOwned(skillsBase, plugin.pluginId, owned);
     }
-    recordOwned(skillsBase, plugin.pluginId, owned);
   }
   return {
     clientId: "vscode",
     status: "SYNCED",
     projectedDirs,
-    unsupported
+    unsupported,
+    ...errors.length > 0 ? { error: errors.join("; ") } : {}
   };
 }
-function syncKiro(plugins) {
-  const skillsBase = path2.join(homeDir(), ".kiro", "skills");
+function syncQwen(plugins) {
+  const targetBase = path2.join(homeDir(), ".qwen", "skills");
   const projectedDirs = [];
   const unsupported = ["hooks", "agents", "commands"];
+  const errors = [];
   for (const plugin of plugins) {
-    if (!plugin.enabled || !plugin.components.skills)
+    if (!plugin.enabled)
       continue;
-    ensureDir(skillsBase);
-    const owned = [];
-    for (const skill of plugin.skills) {
-      const targetPath = path2.join(skillsBase, `${nsName(plugin.pluginName, skill.id)}.md`);
-      copyFileOrDir(skill.path, targetPath);
-      owned.push(`${nsName(plugin.pluginName, skill.id)}.md`);
-      projectedDirs.push(targetPath);
+    if (plugin.components.skills && isComponentApproved(plugin, "skills")) {
+      ensureDir(targetBase);
+      const owned = [];
+      for (const skill of plugin.skills) {
+        try {
+          const targetDir = path2.join(targetBase, nsName(plugin.pluginName, skill.id));
+          assertWithinBase(targetBase, targetDir);
+          ensureDir(targetDir);
+          copyFileOrDir(skill.path, path2.join(targetDir, "SKILL.md"));
+          owned.push(nsName(plugin.pluginName, skill.id));
+          projectedDirs.push(targetDir);
+        } catch (error) {
+          errors.push(`${plugin.pluginName}/${skill.id}: ${error.message}`);
+        }
+      }
+      recordOwned(targetBase, plugin.pluginId, owned);
     }
-    recordOwned(skillsBase, plugin.pluginId, owned);
   }
   return {
-    clientId: "kiro",
+    clientId: "qwen",
     status: "SYNCED",
     projectedDirs,
-    unsupported
+    unsupported,
+    ...errors.length > 0 ? { error: errors.join("; ") } : {}
   };
 }
-function syncQwen(plugins) {
-  const skillsBase = path2.join(homeDir(), ".qwen", "skills");
-  const commandsBase = path2.join(homeDir(), ".qwen", "commands");
+function syncCline(plugins) {
+  const targetBase = path2.join(homeDir(), ".config", "cline", "skills");
   const projectedDirs = [];
-  const unsupported = ["hooks", "agents"];
-  const ownedSkills = [];
-  const ownedCommands = [];
+  const unsupported = ["hooks", "agents", "commands"];
+  const errors = [];
   for (const plugin of plugins) {
     if (!plugin.enabled)
       continue;
-    if (plugin.components.skills) {
-      ensureDir(skillsBase);
+    if (plugin.components.skills && isComponentApproved(plugin, "skills")) {
+      ensureDir(targetBase);
+      const owned = [];
       for (const skill of plugin.skills) {
-        const targetPath = path2.join(skillsBase, `${nsName(plugin.pluginName, skill.id)}.md`);
-        copyFileOrDir(skill.path, targetPath);
-        ownedSkills.push(`${nsName(plugin.pluginName, skill.id)}.md`);
-        projectedDirs.push(targetPath);
+        try {
+          const targetDir = path2.join(targetBase, nsName(plugin.pluginName, skill.id));
+          assertWithinBase(targetBase, targetDir);
+          ensureDir(targetDir);
+          copyFileOrDir(skill.path, path2.join(targetDir, "SKILL.md"));
+          owned.push(nsName(plugin.pluginName, skill.id));
+          projectedDirs.push(targetDir);
+        } catch (error) {
+          errors.push(`${plugin.pluginName}/${skill.id}: ${error.message}`);
+        }
       }
+      recordOwned(targetBase, plugin.pluginId, owned);
     }
-    if (plugin.components.commands) {
-      ensureDir(commandsBase);
-      for (const cmd of plugin.commands) {
-        const targetPath = path2.join(commandsBase, `${nsName(plugin.pluginName, cmd.id)}.md`);
-        copyFileOrDir(cmd.path, targetPath);
-        ownedCommands.push(`${nsName(plugin.pluginName, cmd.id)}.md`);
-        projectedDirs.push(targetPath);
+  }
+  return {
+    clientId: "cline",
+    status: "SYNCED",
+    projectedDirs,
+    unsupported,
+    ...errors.length > 0 ? { error: errors.join("; ") } : {}
+  };
+}
+function syncKiro(plugins) {
+  const targetBase = path2.join(homeDir(), ".kiro", "skills");
+  const projectedDirs = [];
+  const unsupported = ["hooks", "agents", "commands"];
+  const errors = [];
+  for (const plugin of plugins) {
+    if (!plugin.enabled)
+      continue;
+    if (plugin.components.skills && isComponentApproved(plugin, "skills")) {
+      ensureDir(targetBase);
+      const owned = [];
+      for (const skill of plugin.skills) {
+        try {
+          const targetDir = path2.join(targetBase, nsName(plugin.pluginName, skill.id));
+          assertWithinBase(targetBase, targetDir);
+          ensureDir(targetDir);
+          copyFileOrDir(skill.path, path2.join(targetDir, "SKILL.md"));
+          owned.push(nsName(plugin.pluginName, skill.id));
+          projectedDirs.push(targetDir);
+        } catch (error) {
+          errors.push(`${plugin.pluginName}/${skill.id}: ${error.message}`);
+        }
       }
+      recordOwned(targetBase, plugin.pluginId, owned);
     }
-    if (ownedSkills.length > 0)
-      recordOwned(skillsBase, plugin.pluginId, ownedSkills);
-    if (ownedCommands.length > 0)
-      recordOwned(commandsBase, plugin.pluginId, ownedCommands);
   }
   return {
-    clientId: "qwen",
+    clientId: "kiro",
     status: "SYNCED",
     projectedDirs,
+    unsupported,
+    ...errors.length > 0 ? { error: errors.join("; ") } : {}
+  };
+}
+function syncOpenCode(plugins) {
+  const unsupported = ["skills", "hooks", "agents", "commands"];
+  return {
+    clientId: "opencode",
+    status: plugins.length > 0 ? "SYNCED" : "SKIPPED",
+    projectedDirs: [],
     unsupported
   };
 }
-var CLIENT_SYNCERS = {
-  claude: syncClaude,
-  "claude-desktop": syncClaudeDesktop,
-  codex: syncCodex,
-  cursor: syncCursor,
-  vscode: syncVsCode,
-  kiro: syncKiro,
-  qwen: syncQwen
-};
 function syncPluginsToClient(clientId, plugins) {
-  const syncer = CLIENT_SYNCERS[clientId];
-  if (!syncer) {
-    return {
-      clientId,
-      status: "SKIPPED",
-      projectedDirs: [],
-      unsupported: ["mcpServers", "skills", "hooks", "agents", "commands"],
-      error: `No plugin sync implementation for ${clientId}`
-    };
+  const syncMap = {
+    claude: syncClaude,
+    "claude-desktop": syncClaudeDesktop,
+    codex: syncCodex,
+    cursor: syncCursor,
+    vscode: syncVsCode,
+    qwen: syncQwen,
+    cline: syncCline,
+    kiro: syncKiro,
+    opencode: syncOpenCode
+  };
+  const syncFn = syncMap[clientId];
+  if (!syncFn) {
+    return { clientId, status: "SKIPPED", projectedDirs: [], unsupported: [] };
+  }
+  const targetBaseMap = {
+    claude: path2.join(homeDir(), ".claude", "skills"),
+    "claude-desktop": "",
+    codex: path2.join(homeDir(), ".codex", "skills"),
+    cursor: path2.join(homeDir(), ".cursor"),
+    vscode: path2.join(homeDir(), ".copilot", "skills"),
+    qwen: path2.join(homeDir(), ".qwen", "skills"),
+    cline: path2.join(homeDir(), ".config", "cline", "skills"),
+    kiro: path2.join(homeDir(), ".kiro", "skills"),
+    opencode: ""
+  };
+  const target = targetBaseMap[clientId];
+  if (target) {
+    const enabledIds = plugins.filter((p) => p.enabled).map((p) => p.pluginId);
+    pruneUnlistedPlugins(target, enabledIds);
   }
-  return syncer(plugins);
+  return syncFn(plugins);
 }
-function copyPluginDir(src, dest, exclude = []) {
+function copyPluginDir(src, dest, exclude = [], errors) {
+  const excludeSet = new Set(exclude);
   ensureDir(dest);
   const entries = fs2.readdirSync(src, { withFileTypes: true });
   for (const entry of entries) {
-    if (exclude.includes(entry.name))
-      continue;
-    if (entry.name.startsWith(".") && entry.name !== ".claude-plugin")
+    if (excludeSet.has(entry.name))
       continue;
     const srcPath = path2.join(src, entry.name);
     const destPath = path2.join(dest, entry.name);
     if (entry.isDirectory()) {
-      copyPluginDir(srcPath, destPath, exclude);
-    } else {
-      fs2.mkdirSync(path2.dirname(destPath), { recursive: true });
-      fs2.copyFileSync(srcPath, destPath);
+      copyPluginDir(srcPath, destPath, exclude, errors);
+    } else if (entry.isFile()) {
+      try {
+        fs2.copyFileSync(srcPath, destPath);
+      } catch (e) {
+        errors?.push(`Failed to copy ${srcPath}: ${e.message}`);
+      }
     }
   }
 }
-function copyFileOrDir(src, dest) {
-  ensureDir(path2.dirname(dest));
-  if (fs2.statSync(src).isDirectory()) {
-    copyPluginDir(src, dest);
-  } else {
-    fs2.copyFileSync(src, dest);
+function copyFileOrDir(src, dest, errors) {
+  try {
+    ensureDir(path2.dirname(dest));
+    if (fs2.statSync(src).isDirectory()) {
+      copyPluginDir(src, dest, [], errors);
+    } else {
+      fs2.copyFileSync(src, dest);
+    }
+  } catch (e) {
+    errors?.push(`Failed to copy ${src} -> ${dest}: ${e.message}`);
   }
 }
 
+// src/version.ts
+var APP_VERSION = "0.1.3";
+
 // src/adapters/claude.ts
+import fs4 from "node:fs";
+import path4 from "node:path";
+import { z } from "zod";
+
+// src/core/skill-projections.ts
 import fs3 from "node:fs";
 import path3 from "node:path";
-import { z } from "zod";
+var OWNERSHIP_MANIFEST2 = "mcpx-skills.json";
+function loadOwnership2(targetDir) {
+  const manifestPath = path3.join(targetDir, OWNERSHIP_MANIFEST2);
+  if (!fs3.existsSync(manifestPath)) {
+    return { version: 1, paths: [] };
+  }
+  try {
+    return JSON.parse(fs3.readFileSync(manifestPath, "utf8"));
+  } catch {
+    console.error(`[mcpx] Warning: corrupt ownership manifest at ${manifestPath}, resetting`);
+    return { version: 1, paths: [] };
+  }
+}
+function saveOwnership2(targetDir, manifest) {
+  ensureDir(targetDir);
+  fs3.writeFileSync(path3.join(targetDir, OWNERSHIP_MANIFEST2), JSON.stringify(manifest, null, 2));
+}
+function projectSkillsToDir(targetDir, skills, layout) {
+  const owned = loadOwnership2(targetDir);
+  const newPaths = new Set(skills.map((s) => layout === "dir" ? `${s.id}/SKILL.md` : `${s.id}.md`));
+  for (const ownedPath of owned.paths) {
+    if (!newPaths.has(ownedPath)) {
+      const fullPath = path3.join(targetDir, ownedPath);
+      try {
+        if (fs3.existsSync(fullPath)) {
+          fs3.rmSync(fullPath, { recursive: true, force: true });
+        }
+        if (layout === "dir") {
+          const dirPath = path3.join(targetDir, path3.dirname(ownedPath));
+          try {
+            const remaining = fs3.readdirSync(dirPath);
+            if (remaining.length === 0) {
+              fs3.rmSync(dirPath, { recursive: true, force: true });
+            }
+          } catch {}
+        }
+      } catch {
+        console.error(`[mcpx] Warning: could not remove stale skill projection: ${fullPath}`);
+      }
+    }
+  }
+  for (const skill of skills) {
+    const filePath = layout === "dir" ? path3.join(targetDir, skill.id, "SKILL.md") : path3.join(targetDir, `${skill.id}.md`);
+    ensureDir(path3.dirname(filePath));
+    fs3.writeFileSync(filePath, skill.content, "utf-8");
+  }
+  saveOwnership2(targetDir, { version: 1, paths: Array.from(newPaths) });
+}
 
 // src/adapters/utils/index.ts
 function getManagedEntryNames(managedIndex, clientId) {
@@ -381,15 +562,35 @@ function pruneStaleManagedEntries(managedIndex, clientId, servers, keepEntryName
     }
   }
 }
-function ensureManagedEntryWritable(managedIndex, clientId, entryName, existingValue) {
+function ensureManagedEntryWritable(managedIndex, clientId, entryName, existingValue, expectedEntry) {
   if (existingValue === undefined || existingValue === null) {
     return null;
   }
   if (isManagedEntry(managedIndex, clientId, entryName)) {
     return null;
   }
+  if (expectedEntry && isManagedGatewayProjection(entryName) && matchesExpectedShape(existingValue, expectedEntry)) {
+    if (!managedIndex.managed[clientId]) {
+      managedIndex.managed[clientId] = { configPath: "", entries: {} };
+    }
+    managedIndex.managed[clientId].entries[entryName] = {
+      fingerprint: sha256(JSON.stringify(existingValue)),
+      lastSyncedAt: new Date().toISOString()
+    };
+    return null;
+  }
   return `Cannot sync managed entry "${entryName}" because an unmanaged entry already exists.`;
 }
+function matchesExpectedShape(value, expected) {
+  if (!value || typeof value !== "object")
+    return false;
+  const v = value;
+  if (expected.url && v.url !== expected.url)
+    return false;
+  if (expected.command && v.command !== expected.command)
+    return false;
+  return true;
+}
 function setManagedEntries(managedIndex, clientId, configPath, entries) {
   if (!managedIndex.managed[clientId]) {
     managedIndex.managed[clientId] = {
@@ -475,25 +676,36 @@ function removeSourceEntries(entries, names) {
     delete entries[name];
   }
 }
-function syncDisabledMcpServersArray(raw, managedNames, managedEntries) {
-  const existingDisabled = (raw.disabledMcpServers ?? []).filter((name) => !managedNames.includes(name));
-  const disabledManaged = managedEntries.filter((entry) => !entry.enabled).map((entry) => entry.name);
-  raw.disabledMcpServers = [...existingDisabled, ...disabledManaged];
+function purgeManagedFromDisabledArray(raw, managedNames) {
+  const existingDisabled = raw.disabledMcpServers ?? [];
+  raw.disabledMcpServers = existingDisabled.filter((name) => !managedNames.includes(name));
+  if (Array.isArray(raw.disabledMcpServers) && raw.disabledMcpServers.length === 0) {
+    delete raw.disabledMcpServers;
+  }
 }
-function syncMcpExcludedArray(raw, managedNames, managedEntries) {
+function purgeManagedFromExcludedArray(raw, managedNames) {
   const mcp = raw.mcp ?? {};
-  const existingExcluded = (mcp.excluded ?? []).filter((name) => !managedNames.includes(name));
-  const disabledManaged = managedEntries.filter((entry) => !entry.enabled).map((entry) => entry.name);
-  mcp.excluded = [...existingExcluded, ...disabledManaged];
-  raw.mcp = mcp;
+  const existingExcluded = mcp.excluded ?? [];
+  mcp.excluded = existingExcluded.filter((name) => !managedNames.includes(name));
+  if (Array.isArray(mcp.excluded) && mcp.excluded.length === 0) {
+    delete mcp.excluded;
+  }
+  raw.mcp = Object.keys(mcp).length > 0 ? mcp : undefined;
+}
+function detectManagedEntryDrift(managedIndex, clientId, entryName, existingValue) {
+  const recorded = managedIndex.managed[clientId]?.entries?.[entryName];
+  if (!recorded || existingValue === undefined)
+    return false;
+  const liveFingerprint = sha256(JSON.stringify(existingValue));
+  return liveFingerprint !== recorded.fingerprint;
 }
 
 // src/adapters/claude.ts
 function normalizeProjectKey(p) {
   try {
-    return fs3.realpathSync(path3.resolve(p));
+    return fs4.realpathSync(path4.resolve(p));
   } catch {
-    return path3.resolve(p);
+    return path4.resolve(p);
   }
 }
 function syncProjectDisabledArray(project, managedNames, disabledForThisProject) {
@@ -520,7 +732,7 @@ var claudeEntrySchema = z.object({
 class ClaudeAdapter {
   id = "claude";
   detectConfigPath() {
-    return path3.join(homeDir(), ".claude.json");
+    return path4.join(homeDir(), ".claude.json");
   }
   supportsHttp() {
     return true;
@@ -528,6 +740,9 @@ class ClaudeAdapter {
   syncPlugins(plugins) {
     return syncPluginsToClient(this.id, plugins);
   }
+  syncSkills(skills) {
+    projectSkillsToDir(path4.join(homeDir(), ".claude", "skills"), skills, "dir");
+  }
   scanForImports(_config, managedIndex) {
     const configPath = this.detectConfigPath();
     const result = emptyImportScan(this.id, configPath ?? undefined);
@@ -608,6 +823,7 @@ class ClaudeAdapter {
       const enabledManagedNames = enabledEntries.map((entry) => entry.name);
       const topLevelServers = raw.mcpServers ?? {};
       removeSourceEntries(topLevelServers, options.sourceEntriesToRemove);
+      const driftedNames = enabledManagedNames.filter((name) => detectManagedEntryDrift(options.managedIndex, this.id, name, topLevelServers[name]));
       for (const name of enabledManagedNames) {
         const topLevelConflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, topLevelServers[name]);
         if (topLevelConflict) {
@@ -619,7 +835,7 @@ class ClaudeAdapter {
         topLevelServers[name] = entry;
       }
       raw.mcpServers = topLevelServers;
-      syncDisabledMcpServersArray(raw, managedNames, options.managedEntries);
+      purgeManagedFromDisabledArray(raw, managedNames);
       const scopeByNormalizedPath = new Map;
       for (const scope of options.projectScopes ?? []) {
         scopeByNormalizedPath.set(normalizeProjectKey(scope.path), scope.disabledServerNames);
@@ -643,7 +859,7 @@ class ClaudeAdapter {
       raw.projects = projects;
       writeJsonAtomic(configPath, raw);
       setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(Object.entries(serverEntries).map(([name, entry]) => [name, JSON.stringify(entry)])));
-      return okResult(this.id, configPath);
+      return { ...okResult(this.id, configPath), driftedEntries: driftedNames.length > 0 ? driftedNames : undefined };
     } catch (error) {
       return errorResult(this.id, configPath, error.message);
     }
@@ -652,7 +868,7 @@ class ClaudeAdapter {
 
 // src/adapters/claude-desktop.ts
 import { execFileSync } from "node:child_process";
-import path4 from "node:path";
+import path5 from "node:path";
 import { z as z2 } from "zod";
 var stringMapSchema2 = z2.record(z2.string(), z2.string());
 var claudeDesktopEntrySchema = z2.object({
@@ -672,19 +888,19 @@ function buildProxyEntry(entry) {
     if (mcpxPath)
       return { command: mcpxPath, args: ["proxy", upstreamName] };
   } catch {}
-  return { command: "npx", args: ["-y", "@kwonye/mcpx@latest", "proxy", upstreamName] };
+  return { command: "npx", args: ["-y", `@kwonye/mcpx@${APP_VERSION}`, "proxy", upstreamName] };
 }
 
 class ClaudeDesktopAdapter {
   id = "claude-desktop";
   detectConfigPath() {
     if (process.platform === "linux") {
-      return path4.join(homeDir(), ".config", "Claude", "claude_desktop_config.json");
+      return path5.join(homeDir(), ".config", "Claude", "claude_desktop_config.json");
     }
     if (process.platform === "win32") {
-      return path4.join(process.env.APPDATA ?? "", "Claude", "claude_desktop_config.json");
+      return path5.join(process.env.APPDATA ?? "", "Claude", "claude_desktop_config.json");
     }
-    return path4.join(homeDir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
+    return path5.join(homeDir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
   }
   supportsHttp() {
     return true;
@@ -761,6 +977,7 @@ class ClaudeDesktopAdapter {
       const enabledManagedNames = enabledEntries.map((entry) => entry.name);
       const topLevelServers = raw.mcpServers ?? {};
       removeSourceEntries(topLevelServers, options.sourceEntriesToRemove);
+      const driftedNames = enabledManagedNames.filter((name) => detectManagedEntryDrift(options.managedIndex, this.id, name, topLevelServers[name]));
       for (const name of enabledManagedNames) {
         const topLevelConflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, topLevelServers[name]);
         if (topLevelConflict) {
@@ -777,7 +994,7 @@ class ClaudeDesktopAdapter {
         const { command, args } = buildProxyEntry(entry);
         return [entry.name, JSON.stringify({ command, args })];
       })));
-      return okResult(this.id, configPath);
+      return { ...okResult(this.id, configPath), driftedEntries: driftedNames.length > 0 ? driftedNames : undefined };
     } catch (error) {
       return errorResult(this.id, configPath, error.message);
     }
@@ -785,8 +1002,8 @@ class ClaudeDesktopAdapter {
 }
 
 // src/adapters/codex.ts
-import path5 from "node:path";
-import fs4 from "node:fs";
+import path6 from "node:path";
+import fs5 from "node:fs";
 import { parse, stringify } from "@iarna/toml";
 import { z as z3 } from "zod";
 var stringMapSchema3 = z3.preprocess((value) => {
@@ -809,7 +1026,7 @@ var codexEntrySchema = z3.object({
 class CodexAdapter {
   id = "codex";
   detectConfigPath() {
-    return path5.join(homeDir(), ".codex", "config.toml");
+    return path6.join(homeDir(), ".codex", "config.toml");
   }
   supportsHttp() {
     return true;
@@ -817,13 +1034,16 @@ class CodexAdapter {
   syncPlugins(plugins) {
     return syncPluginsToClient(this.id, plugins);
   }
+  syncSkills(skills) {
+    projectSkillsToDir(path6.join(homeDir(), ".codex", "skills"), skills, "dir");
+  }
   scanForImports(_config, managedIndex) {
     const configPath = this.detectConfigPath();
     const result = emptyImportScan(this.id, configPath ?? undefined);
-    if (!configPath || !fs4.existsSync(configPath)) {
+    if (!configPath || !fs5.existsSync(configPath)) {
       return result;
     }
-    const existing = fs4.readFileSync(configPath, "utf8");
+    const existing = fs5.readFileSync(configPath, "utf8");
     const doc = existing.trim().length > 0 ? parse(existing) : {};
     const mcpServers = doc.mcp_servers ?? {};
     for (const [name, rawEntry] of Object.entries(mcpServers)) {
@@ -878,33 +1098,35 @@ class CodexAdapter {
       return errorResult(this.id, undefined, "Unable to resolve Codex config.toml path.");
     }
     try {
-      const existing = fs4.existsSync(configPath) ? fs4.readFileSync(configPath, "utf8") : "";
+      const existing = fs5.existsSync(configPath) ? fs5.readFileSync(configPath, "utf8") : "";
       const doc = existing.trim().length > 0 ? parse(existing) : {};
       const mcpServers = doc.mcp_servers ?? {};
       removeSourceEntries(mcpServers, options.sourceEntriesToRemove);
       const managedNames = options.managedEntries.map((entry) => entry.name);
-      const serverEntries = Object.fromEntries(options.managedEntries.map((entry) => [entry.name, {
-        enabled: entry.enabled,
+      const enabledEntries = options.managedEntries.filter((entry) => entry.enabled);
+      const enabledManagedNames = enabledEntries.map((entry) => entry.name);
+      const serverEntries = Object.fromEntries(enabledEntries.map((entry) => [entry.name, {
         url: entry.url,
         http_headers: entry.headers
       }]));
-      for (const name of managedNames) {
+      const driftedNames = enabledManagedNames.filter((name) => detectManagedEntryDrift(options.managedIndex, this.id, name, mcpServers[name]));
+      for (const name of enabledManagedNames) {
         const conflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, mcpServers[name]);
         if (conflict) {
           return errorResult(this.id, configPath, conflict);
         }
       }
-      pruneStaleManagedEntries(options.managedIndex, this.id, mcpServers, managedNames);
+      pruneStaleManagedEntries(options.managedIndex, this.id, mcpServers, enabledManagedNames);
       for (const [name, entry] of Object.entries(serverEntries)) {
         mcpServers[name] = entry;
       }
       doc.mcp_servers = mcpServers;
-      fs4.mkdirSync(path5.dirname(configPath), { recursive: true });
+      fs5.mkdirSync(path6.dirname(configPath), { recursive: true });
       const tmpPath = `${configPath}.tmp-${process.pid}-${Date.now()}`;
-      fs4.writeFileSync(tmpPath, stringify(doc), { mode: 384 });
-      fs4.renameSync(tmpPath, configPath);
+      fs5.writeFileSync(tmpPath, stringify(doc), { mode: 384 });
+      fs5.renameSync(tmpPath, configPath);
       setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(Object.entries(serverEntries).map(([name, entry]) => [name, JSON.stringify(entry)])));
-      return okResult(this.id, configPath);
+      return { ...okResult(this.id, configPath), driftedEntries: driftedNames.length > 0 ? driftedNames : undefined };
     } catch (error) {
       return errorResult(this.id, configPath, error.message);
     }
@@ -912,7 +1134,7 @@ class CodexAdapter {
 }
 
 // src/adapters/cursor.ts
-import path6 from "node:path";
+import path7 from "node:path";
 import { z as z4 } from "zod";
 var stringMapSchema4 = z4.record(z4.string(), z4.string());
 var cursorEntrySchema = z4.object({
@@ -929,7 +1151,7 @@ var cursorEntrySchema = z4.object({
 class CursorAdapter {
   id = "cursor";
   detectConfigPath() {
-    return path6.join(homeDir(), ".cursor", "mcp.json");
+    return path7.join(homeDir(), ".cursor", "mcp.json");
   }
   supportsHttp() {
     return true;
@@ -937,6 +1159,9 @@ class CursorAdapter {
   syncPlugins(plugins) {
     return syncPluginsToClient(this.id, plugins);
   }
+  syncSkills(skills) {
+    projectSkillsToDir(path7.join(homeDir(), ".cursor", "skills"), skills, "dir");
+  }
   scanForImports(_config, managedIndex) {
     const configPath = this.detectConfigPath();
     const result = emptyImportScan(this.id, configPath ?? undefined);
@@ -1011,6 +1236,7 @@ class CursorAdapter {
         headers: entry.headers
       }]));
       const enabledManagedNames = enabledEntries.map((entry) => entry.name);
+      const driftedNames = enabledManagedNames.filter((name) => detectManagedEntryDrift(options.managedIndex, this.id, name, servers[name]));
       for (const name of enabledManagedNames) {
         const conflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, servers[name]);
         if (conflict) {
@@ -1030,7 +1256,7 @@ class CursorAdapter {
         entry.name,
         JSON.stringify({ type: "http", url: entry.url, headers: entry.headers, enabled: entry.enabled })
       ])));
-      return okResult(this.id, configPath);
+      return { ...okResult(this.id, configPath), driftedEntries: driftedNames.length > 0 ? driftedNames : undefined };
     } catch (error) {
       return errorResult(this.id, configPath, error.message);
     }
@@ -1038,8 +1264,8 @@ class CursorAdapter {
 }
 
 // src/adapters/cline.ts
-import path7 from "node:path";
-import fs5 from "node:fs";
+import path8 from "node:path";
+import fs6 from "node:fs";
 import { z as z5 } from "zod";
 var HTTP_TRANSPORT_TYPES = new Set(["http", "sse", "streamableHttp"]);
 var stringMapSchema5 = z5.record(z5.string(), z5.string());
@@ -1057,22 +1283,22 @@ var clineEntrySchema = z5.object({
 function getCandidatePaths() {
   if (process.platform === "linux") {
     return [
-      path7.join(homeDir(), ".config", "Code", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
-      path7.join(homeDir(), ".config", "Cursor", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
-      path7.join(homeDir(), ".cline", "settings", "cline_mcp_settings.json")
+      path8.join(homeDir(), ".config", "Code", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
+      path8.join(homeDir(), ".config", "Cursor", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
+      path8.join(homeDir(), ".cline", "settings", "cline_mcp_settings.json")
     ];
   }
   if (process.platform === "win32") {
     return [
-      path7.join(process.env.APPDATA ?? "", "Code", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
-      path7.join(process.env.APPDATA ?? "", "Cursor", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
-      path7.join(homeDir(), ".cline", "settings", "cline_mcp_settings.json")
+      path8.join(process.env.APPDATA ?? "", "Code", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
+      path8.join(process.env.APPDATA ?? "", "Cursor", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
+      path8.join(homeDir(), ".cline", "settings", "cline_mcp_settings.json")
     ];
   }
   return [
-    path7.join(homeDir(), "Library", "Application Support", "Code", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
-    path7.join(homeDir(), "Library", "Application Support", "Cursor", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
-    path7.join(homeDir(), ".cline", "settings", "cline_mcp_settings.json")
+    path8.join(homeDir(), "Library", "Application Support", "Code", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
+    path8.join(homeDir(), "Library", "Application Support", "Cursor", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
+    path8.join(homeDir(), ".cline", "settings", "cline_mcp_settings.json")
   ];
 }
 
@@ -1081,7 +1307,7 @@ class ClineAdapter {
   detectConfigPath() {
     const candidates = getCandidatePaths();
     for (const candidate of candidates) {
-      if (fs5.existsSync(candidate)) {
+      if (fs6.existsSync(candidate)) {
         return candidate;
       }
     }
@@ -1090,10 +1316,16 @@ class ClineAdapter {
   supportsHttp() {
     return true;
   }
+  syncPlugins(plugins) {
+    return syncPluginsToClient(this.id, plugins);
+  }
+  syncSkills(skills) {
+    projectSkillsToDir(path8.join(homeDir(), ".config", "cline", "skills"), skills, "dir");
+  }
   scanForImports(_config, managedIndex) {
     const configPath = this.detectConfigPath();
     const result = emptyImportScan(this.id, configPath ?? undefined);
-    if (!configPath || !fs5.existsSync(configPath)) {
+    if (!configPath || !fs6.existsSync(configPath)) {
       return result;
     }
     const raw = readJsonFile(configPath, {});
@@ -1152,7 +1384,7 @@ class ClineAdapter {
     if (!configPath) {
       return errorResult(this.id, undefined, "Unable to resolve Cline MCP config path.");
     }
-    if (!fs5.existsSync(configPath)) {
+    if (!fs6.existsSync(configPath)) {
       return okResult(this.id, configPath, "Cline config not found; skipping sync.");
     }
     try {
@@ -1162,19 +1394,21 @@ class ClineAdapter {
       };
       removeSourceEntries(servers, options.sourceEntriesToRemove);
       const managedNames = options.managedEntries.map((entry) => entry.name);
-      const serverEntries = Object.fromEntries(options.managedEntries.map((entry) => [entry.name, {
+      const enabledEntries = options.managedEntries.filter((entry) => entry.enabled);
+      const enabledManagedNames = enabledEntries.map((entry) => entry.name);
+      const serverEntries = Object.fromEntries(enabledEntries.map((entry) => [entry.name, {
         type: "streamableHttp",
         url: entry.url,
-        headers: entry.headers,
-        disabled: !entry.enabled
+        headers: entry.headers
       }]));
-      for (const name of managedNames) {
+      const driftedNames = enabledManagedNames.filter((name) => detectManagedEntryDrift(options.managedIndex, this.id, name, servers[name]));
+      for (const name of enabledManagedNames) {
         const conflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, servers[name]);
         if (conflict) {
           return errorResult(this.id, configPath, conflict);
         }
       }
-      pruneStaleManagedEntries(options.managedIndex, this.id, servers, managedNames);
+      pruneStaleManagedEntries(options.managedIndex, this.id, servers, enabledManagedNames);
       for (const [name, entry] of Object.entries(serverEntries)) {
         servers[name] = entry;
       }
@@ -1184,7 +1418,7 @@ class ClineAdapter {
       };
       writeJsonAtomic(configPath, next);
       setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(Object.entries(serverEntries).map(([name, entry]) => [name, JSON.stringify(entry)])));
-      return okResult(this.id, configPath);
+      return { ...okResult(this.id, configPath), driftedEntries: driftedNames.length > 0 ? driftedNames : undefined };
     } catch (error) {
       return errorResult(this.id, configPath, error.message);
     }
@@ -1192,8 +1426,7 @@ class ClineAdapter {
 }
 
 // src/adapters/kiro.ts
-import fs6 from "node:fs";
-import path8 from "node:path";
+import path9 from "node:path";
 import { z as z6 } from "zod";
 var stringMapSchema6 = z6.record(z6.string(), z6.string());
 var kiroEntrySchema = z6.object({
@@ -1210,7 +1443,7 @@ var kiroEntrySchema = z6.object({
 class KiroAdapter {
   id = "kiro";
   detectConfigPath() {
-    return path8.join(homeDir(), ".kiro", "settings", "mcp.json");
+    return path9.join(homeDir(), ".kiro", "settings", "mcp.json");
   }
   supportsHttp() {
     return true;
@@ -1286,18 +1519,20 @@ class KiroAdapter {
       };
       removeSourceEntries(servers, options.sourceEntriesToRemove);
       const managedNames = options.managedEntries.map((entry) => entry.name);
-      const serverEntries = Object.fromEntries(options.managedEntries.map((entry) => [entry.name, {
+      const enabledEntries = options.managedEntries.filter((entry) => entry.enabled);
+      const enabledManagedNames = enabledEntries.map((entry) => entry.name);
+      const serverEntries = Object.fromEntries(enabledEntries.map((entry) => [entry.name, {
         url: entry.url,
-        headers: entry.headers,
-        disabled: !entry.enabled
+        headers: entry.headers
       }]));
-      for (const name of managedNames) {
+      const driftedNames = enabledManagedNames.filter((name) => detectManagedEntryDrift(options.managedIndex, this.id, name, servers[name]));
+      for (const name of enabledManagedNames) {
         const conflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, servers[name]);
         if (conflict) {
           return errorResult(this.id, configPath, conflict);
         }
       }
-      pruneStaleManagedEntries(options.managedIndex, this.id, servers, managedNames);
+      pruneStaleManagedEntries(options.managedIndex, this.id, servers, enabledManagedNames);
       for (const [name, entry] of Object.entries(serverEntries)) {
         servers[name] = entry;
       }
@@ -1307,35 +1542,18 @@ class KiroAdapter {
       };
       writeJsonAtomic(configPath, next);
       setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(Object.entries(serverEntries).map(([name, entry]) => [name, JSON.stringify(entry)])));
-      return okResult(this.id, configPath);
+      return { ...okResult(this.id, configPath), driftedEntries: driftedNames.length > 0 ? driftedNames : undefined };
     } catch (error) {
       return errorResult(this.id, configPath, error.message);
     }
   }
   syncSkills(skills) {
-    const skillsDir = path8.join(homeDir(), ".kiro", "skills");
-    if (!fs6.existsSync(skillsDir)) {
-      fs6.mkdirSync(skillsDir, { recursive: true });
-    }
-    const existingFiles = fs6.readdirSync(skillsDir);
-    const managedIds = new Set(skills.map((s) => s.id));
-    for (const file of existingFiles) {
-      if (file.endsWith(".md")) {
-        const id = path8.basename(file, ".md");
-        if (!managedIds.has(id)) {
-          fs6.unlinkSync(path8.join(skillsDir, file));
-        }
-      }
-    }
-    for (const skill of skills) {
-      const targetPath = path8.join(skillsDir, `${skill.id}.md`);
-      fs6.writeFileSync(targetPath, skill.content, "utf-8");
-    }
+    projectSkillsToDir(path9.join(homeDir(), ".kiro", "skills"), skills, "flat");
   }
 }
 
 // src/adapters/opencode.ts
-import path9 from "node:path";
+import path10 from "node:path";
 import { z as z7 } from "zod";
 var stringMapSchema7 = z7.record(z7.string(), z7.string());
 var openCodeEntrySchema = z7.object({
@@ -1353,11 +1571,14 @@ var openCodeEntrySchema = z7.object({
 class OpenCodeAdapter {
   id = "opencode";
   detectConfigPath() {
-    return path9.join(homeDir(), ".config", "opencode", "opencode.json");
+    return path10.join(homeDir(), ".config", "opencode", "opencode.json");
   }
   supportsHttp() {
     return true;
   }
+  syncPlugins(plugins) {
+    return syncPluginsToClient(this.id, plugins);
+  }
   scanForImports(_config, managedIndex) {
     const configPath = this.detectConfigPath();
     const result = emptyImportScan(this.id, configPath ?? undefined);
@@ -1431,19 +1652,21 @@ class OpenCodeAdapter {
       };
       removeSourceEntries(mcp, options.sourceEntriesToRemove);
       const managedNames = options.managedEntries.map((entry) => entry.name);
-      const serverEntries = Object.fromEntries(options.managedEntries.map((entry) => [entry.name, {
+      const enabledEntries = options.managedEntries.filter((entry) => entry.enabled);
+      const enabledManagedNames = enabledEntries.map((entry) => entry.name);
+      const serverEntries = Object.fromEntries(enabledEntries.map((entry) => [entry.name, {
         type: "remote",
         url: entry.url,
-        headers: entry.headers,
-        enabled: entry.enabled
+        headers: entry.headers
       }]));
-      for (const name of managedNames) {
+      const driftedNames = enabledManagedNames.filter((name) => detectManagedEntryDrift(options.managedIndex, this.id, name, mcp[name]));
+      for (const name of enabledManagedNames) {
         const conflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, mcp[name]);
         if (conflict) {
           return errorResult(this.id, configPath, conflict);
         }
       }
-      pruneStaleManagedEntries(options.managedIndex, this.id, mcp, managedNames);
+      pruneStaleManagedEntries(options.managedIndex, this.id, mcp, enabledManagedNames);
       for (const [name, entry] of Object.entries(serverEntries)) {
         mcp[name] = entry;
       }
@@ -1453,7 +1676,7 @@ class OpenCodeAdapter {
       };
       writeJsonAtomic(configPath, next);
       setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(Object.entries(serverEntries).map(([name, entry]) => [name, JSON.stringify(entry)])));
-      return okResult(this.id, configPath);
+      return { ...okResult(this.id, configPath), driftedEntries: driftedNames.length > 0 ? driftedNames : undefined };
     } catch (error) {
       return errorResult(this.id, configPath, error.message);
     }
@@ -1461,7 +1684,7 @@ class OpenCodeAdapter {
 }
 
 // src/adapters/vscode.ts
-import path10 from "node:path";
+import path11 from "node:path";
 import { z as z8 } from "zod";
 var stringMapSchema8 = z8.record(z8.string(), z8.string());
 var vscodeEntrySchema = z8.object({
@@ -1479,12 +1702,12 @@ class VsCodeAdapter {
   id = "vscode";
   detectConfigPath() {
     if (process.platform === "linux") {
-      return path10.join(homeDir(), ".config", "Code", "User", "mcp.json");
+      return path11.join(homeDir(), ".config", "Code", "User", "mcp.json");
     }
     if (process.platform === "win32") {
-      return path10.join(process.env.APPDATA ?? "", "Code", "User", "mcp.json");
+      return path11.join(process.env.APPDATA ?? "", "Code", "User", "mcp.json");
     }
-    return path10.join(homeDir(), "Library", "Application Support", "Code", "User", "mcp.json");
+    return path11.join(homeDir(), "Library", "Application Support", "Code", "User", "mcp.json");
   }
   supportsHttp() {
     return true;
@@ -1492,6 +1715,9 @@ class VsCodeAdapter {
   syncPlugins(plugins) {
     return syncPluginsToClient(this.id, plugins);
   }
+  syncSkills(skills) {
+    projectSkillsToDir(path11.join(homeDir(), ".copilot", "skills"), skills, "dir");
+  }
   scanForImports(_config, managedIndex) {
     const configPath = this.detectConfigPath();
     const result = emptyImportScan(this.id, configPath ?? undefined);
@@ -1566,6 +1792,7 @@ class VsCodeAdapter {
         headers: entry.headers
       }]));
       const enabledManagedNames = enabledEntries.map((entry) => entry.name);
+      const driftedNames = enabledManagedNames.filter((name) => detectManagedEntryDrift(options.managedIndex, this.id, name, servers[name]));
       for (const name of enabledManagedNames) {
         const conflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, servers[name]);
         if (conflict) {
@@ -1581,11 +1808,11 @@ class VsCodeAdapter {
         servers
       };
       writeJsonAtomic(configPath, next);
-      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(options.managedEntries.map((entry) => [
+      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(enabledEntries.map((entry) => [
         entry.name,
-        JSON.stringify({ type: "http", url: entry.url, headers: entry.headers, enabled: entry.enabled })
+        JSON.stringify({ type: "http", url: entry.url, headers: entry.headers })
       ])));
-      return okResult(this.id, configPath);
+      return { ...okResult(this.id, configPath), driftedEntries: driftedNames.length > 0 ? driftedNames : undefined };
     } catch (error) {
       return errorResult(this.id, configPath, error.message);
     }
@@ -1593,8 +1820,7 @@ class VsCodeAdapter {
 }
 
 // src/adapters/qwen.ts
-import fs7 from "node:fs";
-import path11 from "node:path";
+import path12 from "node:path";
 import { z as z9 } from "zod";
 var stringMapSchema9 = z9.record(z9.string(), z9.string());
 var qwenEntrySchema = z9.object({
@@ -1611,7 +1837,7 @@ var qwenEntrySchema = z9.object({
 class QwenAdapter {
   id = "qwen";
   detectConfigPath() {
-    return path11.join(homeDir(), ".qwen", "settings.json");
+    return path12.join(homeDir(), ".qwen", "settings.json");
   }
   supportsHttp() {
     return true;
@@ -1697,52 +1923,317 @@ class QwenAdapter {
     try {
       const raw = readJsonFile(configPath, {});
       const managedNames = options.managedEntries.map((entry) => entry.name);
-      const serverEntries = Object.fromEntries(options.managedEntries.map((entry) => [entry.name, {
+      const enabledEntries = options.managedEntries.filter((entry) => entry.enabled);
+      const enabledManagedNames = enabledEntries.map((entry) => entry.name);
+      const serverEntries = Object.fromEntries(enabledEntries.map((entry) => [entry.name, {
         httpUrl: entry.url,
         headers: entry.headers
       }]));
       const topLevelServers = raw.mcpServers ?? {};
       removeSourceEntries(topLevelServers, options.sourceEntriesToRemove);
-      for (const name of managedNames) {
+      const driftedNames = enabledManagedNames.filter((name) => detectManagedEntryDrift(options.managedIndex, this.id, name, topLevelServers[name]));
+      for (const name of enabledManagedNames) {
         const topLevelConflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, topLevelServers[name]);
         if (topLevelConflict) {
           return errorResult(this.id, configPath, topLevelConflict);
         }
       }
-      pruneStaleManagedEntries(options.managedIndex, this.id, topLevelServers, managedNames);
+      pruneStaleManagedEntries(options.managedIndex, this.id, topLevelServers, enabledManagedNames);
       for (const [name, entry] of Object.entries(serverEntries)) {
         topLevelServers[name] = entry;
       }
       raw.mcpServers = topLevelServers;
-      syncMcpExcludedArray(raw, managedNames, options.managedEntries);
+      purgeManagedFromExcludedArray(raw, managedNames);
       writeJsonAtomic(configPath, raw);
       setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(options.managedEntries.map((entry) => [
         entry.name,
         JSON.stringify({ httpUrl: entry.url, headers: entry.headers, enabled: entry.enabled })
       ])));
-      return okResult(this.id, configPath);
+      return { ...okResult(this.id, configPath), driftedEntries: driftedNames.length > 0 ? driftedNames : undefined };
     } catch (error) {
       return errorResult(this.id, configPath, error.message);
     }
   }
   syncSkills(skills) {
-    const skillsDir = path11.join(homeDir(), ".qwen", "skills");
-    if (!fs7.existsSync(skillsDir)) {
-      fs7.mkdirSync(skillsDir, { recursive: true });
-    }
-    const existingFiles = fs7.readdirSync(skillsDir);
-    const managedIds = new Set(skills.map((s) => s.id));
-    for (const file of existingFiles) {
-      if (file.endsWith(".md")) {
-        const id = path11.basename(file, ".md");
-        if (!managedIds.has(id)) {
-          fs7.unlinkSync(path11.join(skillsDir, file));
+    projectSkillsToDir(path12.join(homeDir(), ".qwen", "skills"), skills, "flat");
+  }
+}
+
+// src/adapters/openclaw.ts
+import fs7 from "node:fs";
+import path13 from "node:path";
+import { z as z10 } from "zod";
+var stringMapSchema10 = z10.record(z10.string(), z10.string());
+var openclawEntrySchema = z10.object({
+  url: z10.string().min(1).optional(),
+  transport: z10.string().optional(),
+  headers: stringMapSchema10.optional(),
+  command: z10.string().min(1).optional(),
+  args: z10.array(z10.string()).optional(),
+  env: stringMapSchema10.optional(),
+  cwd: z10.string().min(1).optional(),
+  workingDirectory: z10.string().min(1).optional(),
+  auth: z10.unknown().optional()
+}).passthrough();
+
+class OpenClawAdapter {
+  id = "openclaw";
+  detectConfigPath() {
+    return process.env.OPENCLAW_CONFIG_PATH ?? path13.join(homeDir(), ".openclaw", "openclaw.json");
+  }
+  supportsHttp() {
+    return true;
+  }
+  syncPlugins(plugins) {
+    return syncPluginsToClient(this.id, plugins);
+  }
+  syncSkills(skills) {
+    projectSkillsToDir(path13.join(homeDir(), ".openclaw", "skills"), skills, "dir");
+  }
+  scanForImports(_config, managedIndex) {
+    const configPath = this.detectConfigPath();
+    const result = emptyImportScan(this.id, configPath ?? undefined);
+    if (!configPath) {
+      return result;
+    }
+    let raw;
+    try {
+      raw = JSON.parse(fs7.readFileSync(configPath, "utf8"));
+    } catch {
+      return result;
+    }
+    const mcpServers = {};
+    const rootMcp = raw.mcp;
+    if (rootMcp?.servers) {
+      Object.assign(mcpServers, rootMcp.servers);
+    }
+    if (raw.mcpServers) {
+      Object.assign(mcpServers, raw.mcpServers);
+    }
+    for (const [name, rawEntry] of Object.entries(mcpServers)) {
+      if (isManagedGatewayProjection(name) || managedIndex.managed[this.id]?.entries?.[name]) {
+        continue;
+      }
+      const parsed = openclawEntrySchema.safeParse(rawEntry);
+      if (!parsed.success) {
+        result.skipped.push(buildImportSkip(this.id, name, "Entry could not be mapped to an mcpx server.", configPath));
+        continue;
+      }
+      const entry = parsed.data;
+      if (entry.auth === "oauth") {
+        result.skipped.push(buildImportSkip(this.id, name, "OAuth-authenticated servers cannot be imported via mcpx.", configPath));
+        continue;
+      }
+      if (entry.url && !entry.command) {
+        result.candidates.push({
+          clientId: this.id,
+          configPath,
+          sourceEntryName: name,
+          serverName: name,
+          spec: {
+            transport: "http",
+            url: entry.url,
+            headers: entry.headers
+          }
+        });
+        continue;
+      }
+      if (entry.command && !entry.url) {
+        result.candidates.push({
+          clientId: this.id,
+          configPath,
+          sourceEntryName: name,
+          serverName: name,
+          spec: {
+            transport: "stdio",
+            command: entry.command,
+            args: entry.args,
+            env: entry.env,
+            cwd: entry.workingDirectory ?? entry.cwd
+          }
+        });
+        continue;
+      }
+      result.skipped.push(buildImportSkip(this.id, name, "Entry must define exactly one transport that mcpx supports.", configPath));
+    }
+    return result;
+  }
+  syncGateway(_config, options) {
+    const configPath = this.detectConfigPath();
+    if (!configPath) {
+      return errorResult(this.id, undefined, "Unable to resolve OpenClaw config path.");
+    }
+    try {
+      let raw;
+      if (fs7.existsSync(configPath)) {
+        try {
+          raw = JSON.parse(fs7.readFileSync(configPath, "utf8"));
+        } catch {
+          return errorResult(this.id, configPath, "OpenClaw config contains invalid JSON (possibly JSON5). Cannot safely write.");
         }
+      } else {
+        raw = {};
       }
+      const rootMcp = raw.mcp ?? {};
+      const servers = rootMcp.servers ?? {};
+      removeSourceEntries(servers, options.sourceEntriesToRemove);
+      const enabledEntries = options.managedEntries.filter((entry) => entry.enabled);
+      const serverEntries = Object.fromEntries(enabledEntries.map((entry) => [entry.name, {
+        url: entry.url,
+        transport: "streamable-http",
+        headers: entry.headers
+      }]));
+      const enabledManagedNames = enabledEntries.map((entry) => entry.name);
+      const driftedNames = enabledManagedNames.filter((name) => detectManagedEntryDrift(options.managedIndex, this.id, name, servers[name]));
+      for (const name of enabledManagedNames) {
+        const conflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, servers[name]);
+        if (conflict) {
+          return errorResult(this.id, configPath, conflict);
+        }
+      }
+      pruneStaleManagedEntries(options.managedIndex, this.id, servers, enabledManagedNames);
+      for (const [name, entry] of Object.entries(serverEntries)) {
+        servers[name] = entry;
+      }
+      rootMcp.servers = servers;
+      raw.mcp = rootMcp;
+      writeJsonAtomic(configPath, raw);
+      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(options.managedEntries.map((entry) => [
+        entry.name,
+        JSON.stringify({ url: entry.url, transport: "streamable-http", headers: entry.headers, enabled: entry.enabled })
+      ])));
+      return { ...okResult(this.id, configPath), driftedEntries: driftedNames.length > 0 ? driftedNames : undefined };
+    } catch (error) {
+      return errorResult(this.id, configPath, error.message);
     }
-    for (const skill of skills) {
-      const targetPath = path11.join(skillsDir, `${skill.id}.md`);
-      fs7.writeFileSync(targetPath, skill.content, "utf-8");
+  }
+}
+
+// src/adapters/hermes.ts
+import fs8 from "node:fs";
+import path14 from "node:path";
+import YAML from "yaml";
+import { z as z11 } from "zod";
+var stringMapSchema11 = z11.record(z11.string(), z11.string());
+var hermesEntrySchema = z11.object({
+  url: z11.string().min(1).optional(),
+  headers: stringMapSchema11.optional(),
+  command: z11.string().min(1).optional(),
+  args: z11.array(z11.string()).optional(),
+  env: stringMapSchema11.optional(),
+  auth: z11.unknown().optional(),
+  enabled: z11.boolean().optional(),
+  timeout: z11.number().optional(),
+  tools: z11.array(z11.string()).optional()
+}).passthrough();
+
+class HermesAdapter {
+  id = "hermes";
+  detectConfigPath() {
+    return path14.join(homeDir(), ".hermes", "config.yaml");
+  }
+  supportsHttp() {
+    return true;
+  }
+  syncPlugins(plugins) {
+    return syncPluginsToClient(this.id, plugins);
+  }
+  syncSkills(skills) {
+    projectSkillsToDir(path14.join(homeDir(), ".hermes", "skills"), skills, "dir");
+  }
+  scanForImports(_config, managedIndex) {
+    const configPath = this.detectConfigPath();
+    const result = emptyImportScan(this.id, configPath ?? undefined);
+    if (!configPath || !fs8.existsSync(configPath)) {
+      return result;
+    }
+    const existing = fs8.readFileSync(configPath, "utf8");
+    const doc = YAML.parse(existing) ?? {};
+    const mcpServers = doc.mcp_servers ?? {};
+    for (const [name, rawEntry] of Object.entries(mcpServers)) {
+      if (isManagedGatewayProjection(name) || managedIndex.managed[this.id]?.entries?.[name]) {
+        continue;
+      }
+      const parsed = hermesEntrySchema.safeParse(rawEntry);
+      if (!parsed.success) {
+        result.skipped.push(buildImportSkip(this.id, name, "Entry could not be mapped to an mcpx server.", configPath));
+        continue;
+      }
+      const entry = parsed.data;
+      if (entry.auth === "oauth") {
+        result.skipped.push(buildImportSkip(this.id, name, "OAuth-authenticated servers cannot be imported via mcpx.", configPath));
+        continue;
+      }
+      if (entry.url && !entry.command) {
+        result.candidates.push({
+          clientId: this.id,
+          configPath,
+          sourceEntryName: name,
+          serverName: name,
+          spec: {
+            transport: "http",
+            url: entry.url,
+            headers: entry.headers,
+            enabled: entry.enabled !== false
+          }
+        });
+        continue;
+      }
+      if (entry.command && !entry.url) {
+        result.candidates.push({
+          clientId: this.id,
+          configPath,
+          sourceEntryName: name,
+          serverName: name,
+          spec: {
+            transport: "stdio",
+            command: entry.command,
+            args: entry.args,
+            env: entry.env,
+            enabled: entry.enabled !== false
+          }
+        });
+        continue;
+      }
+      result.skipped.push(buildImportSkip(this.id, name, "Entry must define exactly one transport that mcpx supports.", configPath));
+    }
+    return result;
+  }
+  syncGateway(_config, options) {
+    const configPath = this.detectConfigPath();
+    if (!configPath) {
+      return errorResult(this.id, undefined, "Unable to resolve Hermes config.yaml path.");
+    }
+    try {
+      const existing = fs8.existsSync(configPath) ? fs8.readFileSync(configPath, "utf8") : "";
+      const doc = existing.trim().length > 0 ? YAML.parse(existing) ?? {} : {};
+      const mcpServers = doc.mcp_servers ?? {};
+      removeSourceEntries(mcpServers, options.sourceEntriesToRemove);
+      const managedNames = options.managedEntries.map((entry) => entry.name);
+      const serverEntries = Object.fromEntries(options.managedEntries.map((entry) => [entry.name, {
+        url: entry.url,
+        headers: entry.headers,
+        enabled: entry.enabled
+      }]));
+      for (const name of managedNames) {
+        const conflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, mcpServers[name]);
+        if (conflict) {
+          return errorResult(this.id, configPath, conflict);
+        }
+      }
+      pruneStaleManagedEntries(options.managedIndex, this.id, mcpServers, managedNames);
+      for (const [name, entry] of Object.entries(serverEntries)) {
+        mcpServers[name] = entry;
+      }
+      doc.mcp_servers = mcpServers;
+      fs8.mkdirSync(path14.dirname(configPath), { recursive: true });
+      const tmpPath = `${configPath}.tmp-${process.pid}-${Date.now()}`;
+      fs8.writeFileSync(tmpPath, YAML.stringify(doc), { mode: 384 });
+      fs8.renameSync(tmpPath, configPath);
+      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(Object.entries(serverEntries).map(([name, entry]) => [name, JSON.stringify(entry)])));
+      return okResult(this.id, configPath);
+    } catch (error) {
+      return errorResult(this.id, configPath, error.message);
     }
   }
 }
@@ -1758,7 +2249,9 @@ function getAdapters() {
     new OpenCodeAdapter,
     new KiroAdapter,
     new VsCodeAdapter,
-    new QwenAdapter
+    new QwenAdapter,
+    new OpenClawAdapter,
+    new HermesAdapter
   ];
 }
 
@@ -1783,45 +2276,105 @@ function saveManagedIndex(index, filePath = getManagedIndexPath()) {
   writeJsonAtomic(filePath, index);
 }
 
+// src/core/managed-index-lock.ts
+import fs9 from "node:fs";
+import path15 from "node:path";
+function isStale(lockPath, maxAgeMs = 5000) {
+  try {
+    const stat = fs9.statSync(lockPath);
+    return Date.now() - stat.mtimeMs > maxAgeMs;
+  } catch {
+    return true;
+  }
+}
+function withManagedIndexLock(lockPath, fn) {
+  fs9.mkdirSync(path15.dirname(lockPath), { recursive: true });
+  const deadline = Date.now() + 5000;
+  while (true) {
+    try {
+      fs9.writeFileSync(lockPath, `${process.pid}
+`, { flag: "wx" });
+      break;
+    } catch {
+      if (isStale(lockPath)) {
+        try {
+          fs9.unlinkSync(lockPath);
+        } catch {}
+        continue;
+      }
+      if (Date.now() > deadline) {
+        throw new Error(`Timed out waiting for managed-index lock: ${lockPath}`);
+      }
+    }
+  }
+  try {
+    return fn();
+  } finally {
+    try {
+      fs9.unlinkSync(lockPath);
+    } catch {}
+  }
+}
+
 // src/core/sync.ts
 function getGatewayUrl(config) {
   return `http://127.0.0.1:${config.gateway.port}/mcp`;
 }
 function buildProjectScopes(config) {
   const globallyEnabled = new Set(Object.entries(config.servers).filter(([, spec]) => isServerEnabled(spec)).map(([name]) => name));
+  const pluginDisabledByProject = new Map;
+  for (const [, plugin] of Object.entries(config.plugins ?? {})) {
+    if (!plugin.projectOverrides)
+      continue;
+    for (const [overridePath, override] of Object.entries(plugin.projectOverrides)) {
+      const disabled = override.enabled === false || override.components?.mcpServers === false;
+      if (!disabled)
+        continue;
+      if (!pluginDisabledByProject.has(overridePath)) {
+        pluginDisabledByProject.set(overridePath, new Set);
+      }
+      for (const serverName of plugin.serverNames) {
+        pluginDisabledByProject.get(overridePath).add(managedGatewayEntryName(serverName));
+      }
+    }
+  }
   return Object.values(config.projects ?? {}).map((project) => {
+    const projectPath = project.path;
     const disabledServerNames = (project.disabledServers ?? []).filter((name) => globallyEnabled.has(name)).map((name) => managedGatewayEntryName(name));
-    return { path: project.path, disabledServerNames };
+    const pluginDisabled = pluginDisabledByProject.get(projectPath);
+    if (pluginDisabled) {
+      for (const name of pluginDisabled) {
+        if (!disabledServerNames.includes(name)) {
+          disabledServerNames.push(name);
+        }
+      }
+    }
+    return { path: projectPath, disabledServerNames };
   });
 }
 function buildManagedEntries(config, gatewayUrl, localToken) {
-  const entries = Object.entries(config.servers);
-  return entries.map(([name, spec]) => ({
+  return Object.entries(config.servers).map(([name, spec]) => ({
     name: `${name} (mcpx)`,
     url: `${gatewayUrl}?upstream=${encodeURIComponent(name)}`,
-    headers: {
-      Authorization: `Bearer ${localToken}`
-    },
+    headers: { Authorization: `Bearer ${localToken}` },
     enabled: isServerEnabled(spec)
   }));
 }
 function isClientInternalServerCommand(candidate) {
   return candidate.spec.transport === "stdio" && /\.app\/Contents\//.test(candidate.spec.command ?? "");
 }
-function syncAllClients(config, secrets, targetClients) {
+function getFilteredAdapters(targetClients) {
   const adapters = getAdapters();
-  const managedIndexPath = getManagedIndexPath();
-  const managedIndex = loadManagedIndex(managedIndexPath);
-  const filteredAdapters = targetClients && targetClients.length > 0 ? adapters.filter((adapter) => targetClients.includes(adapter.id)) : adapters;
-  const imports = {
-    imported: [],
-    duplicates: [],
-    skipped: [],
-    conflicts: [],
-    errors: []
-  };
+  if (targetClients && targetClients.length > 0) {
+    return adapters.filter((a) => targetClients.includes(a.id));
+  }
+  return adapters;
+}
+function runImportPhase(adapters, config, managedIndex) {
+  const imports = { imported: [], duplicates: [], skipped: [], conflicts: [], errors: [] };
   const sourceEntriesToRemove = new Map;
-  for (const adapter of filteredAdapters) {
+  const phaseErrors = [];
+  for (const adapter of adapters) {
     try {
       const scan = adapter.scanForImports(config, managedIndex);
       imports.skipped.push(...scan.skipped);
@@ -1848,7 +2401,7 @@ function syncAllClients(config, secrets, targetClients) {
           if (!sourceEntriesToRemove.has(candidate.clientId)) {
             sourceEntriesToRemove.set(candidate.clientId, new Set);
           }
-          sourceEntriesToRemove.get(candidate.clientId)?.add(candidate.sourceEntryName);
+          sourceEntriesToRemove.get(candidate.clientId).add(candidate.sourceEntryName);
           continue;
         }
         if (serverSpecsEqual(existing, candidate.spec)) {
@@ -1861,7 +2414,7 @@ function syncAllClients(config, secrets, targetClients) {
           if (!sourceEntriesToRemove.has(candidate.clientId)) {
             sourceEntriesToRemove.set(candidate.clientId, new Set);
           }
-          sourceEntriesToRemove.get(candidate.clientId)?.add(candidate.sourceEntryName);
+          sourceEntriesToRemove.get(candidate.clientId).add(candidate.sourceEntryName);
           continue;
         }
         imports.conflicts.push({
@@ -1878,37 +2431,56 @@ function syncAllClients(config, secrets, targetClients) {
         configPath: adapter.detectConfigPath() ?? undefined,
         message: error instanceof Error ? error.message : String(error)
       });
+      phaseErrors.push({
+        clientId: adapter.id,
+        phase: "import",
+        message: error instanceof Error ? error.message : String(error)
+      });
     }
   }
-  const localToken = ensureGatewayToken(config, secrets);
-  const gatewayUrl = getGatewayUrl(config);
-  const managedEntries = buildManagedEntries(config, gatewayUrl, localToken);
-  const skills = listSkills();
-  const results = [];
-  const pluginInputs = Object.values(config.plugins ?? {}).map((p) => ({
-    pluginId: p.id,
-    pluginName: p.name,
-    pluginRoot: p.root,
-    components: p.components,
-    approvals: p.approvals ?? {},
-    enabled: p.enabled,
-    serverNames: p.serverNames,
-    skills: p.discovered.skills,
-    commands: p.discovered.commands,
-    agents: p.discovered.agents,
-    hooks: p.discovered.hooks
-  }));
-  for (const adapter of filteredAdapters) {
+  return { imports, sourceEntriesToRemove, phaseErrors };
+}
+function runSkillsPhase(adapters, skills) {
+  const phaseErrors = [];
+  for (const adapter of adapters) {
     if (adapter.syncSkills) {
       try {
         adapter.syncSkills(skills);
-      } catch (error) {}
+      } catch (error) {
+        phaseErrors.push({
+          clientId: adapter.id,
+          phase: "skills",
+          message: error instanceof Error ? error.message : String(error)
+        });
+      }
     }
-    if (adapter.syncPlugins && pluginInputs.length > 0) {
+  }
+  return phaseErrors;
+}
+function runPluginsPhase(adapters, pluginInputs) {
+  const pluginResults = [];
+  const phaseErrors = [];
+  for (const adapter of adapters) {
+    if (adapter.syncPlugins) {
       try {
-        adapter.syncPlugins(pluginInputs);
-      } catch (error) {}
+        const result = adapter.syncPlugins(pluginInputs);
+        if (result)
+          pluginResults.push(result);
+      } catch (error) {
+        phaseErrors.push({
+          clientId: adapter.id,
+          phase: "plugins",
+          message: error instanceof Error ? error.message : String(error)
+        });
+      }
     }
+  }
+  return { pluginResults, phaseErrors };
+}
+function runGatewayPhase(adapters, config, managedEntries, managedIndex, managedIndexPath, sourceEntriesToRemove, projectScopes) {
+  const results = [];
+  const phaseErrors = [];
+  for (const adapter of adapters) {
     if (!adapter.supportsHttp()) {
       results.push({
         clientId: adapter.id,
@@ -1917,32 +2489,98 @@ function syncAllClients(config, secrets, targetClients) {
       });
       continue;
     }
-    const result = adapter.syncGateway(config, {
-      managedEntries,
-      managedIndex,
-      managedIndexPath,
-      sourceEntriesToRemove: Array.from(sourceEntriesToRemove.get(adapter.id) ?? []),
-      projectScopes: buildProjectScopes(config)
-    });
-    results.push(result);
-  }
-  for (const result of results) {
-    config.clients[result.clientId] = {
-      status: result.status,
-      configPath: result.configPath,
-      message: result.message,
-      lastSyncAt: new Date().toISOString()
+    try {
+      const result = adapter.syncGateway(config, {
+        managedEntries,
+        managedIndex,
+        managedIndexPath,
+        sourceEntriesToRemove: Array.from(sourceEntriesToRemove.get(adapter.id) ?? []),
+        projectScopes
+      });
+      results.push(result);
+    } catch (error) {
+      results.push({
+        clientId: adapter.id,
+        status: "ERROR",
+        message: error instanceof Error ? error.message : String(error)
+      });
+      phaseErrors.push({
+        clientId: adapter.id,
+        phase: "gateway",
+        message: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  return { results, phaseErrors };
+}
+function syncAllClients(config, secrets, options) {
+  const opts = Array.isArray(options) ? { targetClients: options, importScan: false } : { importScan: false, ...options };
+  const managedIndexPath = getManagedIndexPath();
+  return withManagedIndexLock(`${managedIndexPath}.lock`, () => {
+    const managedIndex = loadManagedIndex(managedIndexPath);
+    const adapters = getFilteredAdapters(opts.targetClients);
+    const allPhaseErrors = [];
+    let imports = { imported: [], duplicates: [], skipped: [], conflicts: [], errors: [] };
+    let sourceEntriesToRemove = new Map;
+    if (opts.importScan) {
+      const importResult = runImportPhase(adapters, config, managedIndex);
+      imports = importResult.imports;
+      sourceEntriesToRemove = importResult.sourceEntriesToRemove;
+      allPhaseErrors.push(...importResult.phaseErrors ?? []);
+    }
+    const localToken = ensureGatewayToken(config, secrets);
+    const gatewayUrl = getGatewayUrl(config);
+    const managedEntries = buildManagedEntries(config, gatewayUrl, localToken);
+    const gatewayResult = runGatewayPhase(adapters, config, managedEntries, managedIndex, managedIndexPath, sourceEntriesToRemove, buildProjectScopes(config));
+    const results = gatewayResult.results;
+    allPhaseErrors.push(...gatewayResult.phaseErrors ?? []);
+    const skills = listSkills();
+    const skillsErrors = runSkillsPhase(adapters, skills);
+    allPhaseErrors.push(...skillsErrors ?? []);
+    const pluginInputs = Object.values(config.plugins ?? {}).map((p) => ({
+      pluginId: p.id,
+      pluginName: p.name,
+      pluginRoot: p.root,
+      components: p.components,
+      approvals: p.approvals ?? {},
+      enabled: p.enabled,
+      serverNames: p.serverNames,
+      skills: p.discovered.skills,
+      commands: p.discovered.commands,
+      agents: p.discovered.agents,
+      hooks: p.discovered.hooks
+    }));
+    const pluginResult = runPluginsPhase(adapters, pluginInputs);
+    const pluginResults = pluginResult.pluginResults;
+    allPhaseErrors.push(...pluginResult.phaseErrors ?? []);
+    saveManagedIndex(managedIndex, managedIndexPath);
+    const clientStates = {};
+    for (const result of results) {
+      clientStates[result.clientId] = {
+        status: result.status,
+        configPath: result.configPath,
+        message: result.message,
+        lastSyncAt: new Date().toISOString()
+      };
+    }
+    const hasErrors = results.some((r) => r.status === "ERROR") || imports.conflicts.length > 0 || imports.errors.length > 0;
+    return {
+      gatewayUrl,
+      imports,
+      results,
+      hasErrors,
+      clientStates,
+      phaseErrors: allPhaseErrors.length > 0 ? allPhaseErrors : undefined,
+      pluginResults: pluginResults.length > 0 ? pluginResults : undefined
     };
+  });
+}
+function persistSyncState(summary, config) {
+  if (!summary.clientStates)
+    return;
+  for (const [clientId, state] of Object.entries(summary.clientStates)) {
+    config.clients[clientId] = state;
   }
-  saveManagedIndex(managedIndex, managedIndexPath);
-  saveConfig(config);
-  const hasErrors = results.some((result) => result.status === "ERROR") || imports.conflicts.length > 0 || imports.errors.length > 0;
-  return {
-    gatewayUrl,
-    imports,
-    results,
-    hasErrors
-  };
 }
 
-export { listSkills, getSkill, saveSkill, deleteSkill, prunePluginProjections, pruneAllPluginProjections, syncPluginsToClient, getAdapters, loadManagedIndex, getGatewayUrl, syncAllClients };
+export { listSkills, getSkill, saveSkill, deleteSkill, prunePluginProjections, pruneAllPluginProjections, syncPluginsToClient, APP_VERSION, getAdapters, loadManagedIndex, getGatewayUrl, syncAllClients, persistSyncState };