@kwonye/mcpx 0.1.93 → 0.1.95

package/dist/cli.js

@@ -1,6 +1,5 @@
 #!/usr/bin/env node
 import {
-  APP_VERSION,
   STATUS_CLIENTS,
   applyAuthReference,
   buildStatusReport,
@@ -14,6 +13,8 @@ import {
   listAuthBindings,
   mapRegistryToSpec,
   maybePrefixBearer,
+  mutateActiveConfig,
+  mutateConfig,
   performRollback,
   performUpdate,
   probeHttpAuthRequirement,
@@ -30,25 +31,28 @@ import {
   startDaemon,
   stopDaemon,
   toSecretRef
-} from "./cli-m2645syd.js";
+} from "./cli-28fsxhe3.js";
 import {
+  APP_VERSION,
   deleteSkill,
   getAdapters,
   getGatewayUrl,
   getSkill,
   listSkills,
   loadManagedIndex,
+  persistSyncState,
   saveSkill,
   syncAllClients
-} from "./cli-kwyp9ywh.js";
+} from "./cli-wxw1t3rr.js";
 import {
+  ConfigLoadError,
   loadConfig,
   loadMergedConfig,
   loadProjectConfig,
   resolveActiveConfig,
   saveConfig,
   saveProjectConfig
-} from "./cli-np0wwh6m.js";
+} from "./cli-v27bt25d.js";
 import {
   SecretsManager,
   addServer,
@@ -58,7 +62,7 @@ import {
   removeServer,
   rotateGatewayToken,
   setServerEnabled
-} from "./cli-8vxva0cb.js";
+} from "./cli-tk8bggg5.js";
 import {
   getConfigPath,
   getManagedIndexPath,
@@ -729,6 +733,203 @@ function parseQwenArgs(argv) {
   }
 }
 
+// src/compat/openclaw.ts
+function parseOpenClawArgs(args) {
+  if (args.length === 0) {
+    return { error: "Usage: mcpx openclaw mcp add <name> --url <url> | --command <cmd>" };
+  }
+  let name;
+  let url;
+  let command;
+  let transport;
+  const headers = [];
+  const envVars = [];
+  const commandArgs = [];
+  let cwd;
+  let hasAuthOAuth = false;
+  let hasInclude = false;
+  let hasExclude = false;
+  let hasTimeout = false;
+  let hasConnectTimeout = false;
+  for (let i = 0;i < args.length; i++) {
+    const arg = args[i];
+    if (!name && !arg.startsWith("--")) {
+      name = arg;
+      continue;
+    }
+    if (arg === "--url") {
+      url = args[++i];
+    } else if (arg === "--command") {
+      command = args[++i];
+    } else if (arg === "--transport") {
+      transport = args[++i];
+    } else if (arg === "--header") {
+      const val = args[++i];
+      if (val && !val.startsWith("--")) {
+        headers.push(val);
+      }
+    } else if (arg === "--arg") {
+      const val = args[++i];
+      if (val && !val.startsWith("--")) {
+        commandArgs.push(val);
+      }
+    } else if (arg === "--env") {
+      const val = args[++i];
+      if (val && !val.startsWith("--")) {
+        envVars.push(val);
+      }
+    } else if (arg === "--cwd") {
+      cwd = args[++i];
+    } else if (arg === "--auth") {
+      const val = args[++i];
+      if (val === "oauth") {
+        hasAuthOAuth = true;
+      }
+    } else if (arg.startsWith("--include")) {
+      hasInclude = true;
+    } else if (arg.startsWith("--exclude")) {
+      hasExclude = true;
+    } else if (arg === "--timeout") {
+      hasTimeout = true;
+      i++;
+    } else if (arg === "--connect-timeout") {
+      hasConnectTimeout = true;
+      i++;
+    }
+  }
+  if (!name) {
+    return { error: "Server name is required." };
+  }
+  if (hasAuthOAuth) {
+    return { error: "--auth oauth is not supported. Use `mcpx auth` to configure auth after adding the server." };
+  }
+  if (hasInclude || hasExclude) {
+    return { error: "--include/--exclude are not supported. Use `mcpx add` directly for advanced configuration." };
+  }
+  if (url && command) {
+    return { error: "Cannot combine --url and --command. Specify one transport mode." };
+  }
+  if (hasTimeout) {
+    return { error: "--timeout is not supported. Configure timeouts in the server config after adding." };
+  }
+  if (hasConnectTimeout) {
+    return { error: "--connect-timeout is not supported. Configure timeouts in the server config after adding." };
+  }
+  if (url) {
+    const spec = {
+      transport: "http",
+      url
+    };
+    if (headers.length > 0) {
+      const headerObj = {};
+      for (const h of headers) {
+        const colonIndex = h.indexOf(":");
+        if (colonIndex > 0) {
+          const key = h.slice(0, colonIndex).trim();
+          const value = h.slice(colonIndex + 1).trim();
+          headerObj[key] = value;
+        }
+      }
+      spec.headers = headerObj;
+    }
+    return { name, spec };
+  }
+  if (command) {
+    const spec = {
+      transport: "stdio",
+      command
+    };
+    if (commandArgs.length > 0) {
+      spec.args = commandArgs;
+    }
+    if (envVars.length > 0) {
+      const envObj = {};
+      for (const e of envVars) {
+        const eqIndex = e.indexOf("=");
+        if (eqIndex > 0) {
+          envObj[e.slice(0, eqIndex)] = e.slice(eqIndex + 1);
+        }
+      }
+      spec.env = envObj;
+    }
+    if (cwd) {
+      spec.cwd = cwd;
+    }
+    return { name, spec };
+  }
+  return { error: "Server name is required." };
+}
+
+// src/compat/hermes.ts
+function parseHermesArgs(args) {
+  if (args.length === 0) {
+    return { error: "Usage: mcpx hermes mcp add <name> --url <url> | --command <cmd>" };
+  }
+  let name;
+  let url;
+  let command;
+  const envVars = [];
+  const commandArgs = [];
+  let hasAuth = false;
+  let hasPreset = false;
+  for (let i = 0;i < args.length; i++) {
+    const arg = args[i];
+    if (!name && !arg.startsWith("--")) {
+      name = arg;
+      continue;
+    }
+    if (arg === "--url") {
+      url = args[++i];
+    } else if (arg === "--command") {
+      command = args[++i];
+    } else if (arg === "--args") {
+      while (i + 1 < args.length && !args[i + 1].startsWith("--")) {
+        commandArgs.push(args[++i]);
+      }
+    } else if (arg === "--env") {
+      const val = args[++i];
+      if (val && !val.startsWith("--")) {
+        envVars.push(val);
+      }
+    } else if (arg === "--auth") {
+      hasAuth = true;
+    } else if (arg === "--preset") {
+      hasPreset = true;
+      i++;
+    }
+  }
+  if (!name) {
+    return { error: "Server name is required." };
+  }
+  if (hasAuth) {
+    return { error: "--auth is not supported. Use `mcpx auth` to configure auth after adding the server." };
+  }
+  if (hasPreset) {
+    return { error: "--preset is not supported. Use `mcpx add` directly for advanced configuration." };
+  }
+  if (url) {
+    return { name, spec: { transport: "http", url } };
+  }
+  if (command) {
+    const spec = { transport: "stdio", command };
+    if (commandArgs.length > 0) {
+      spec.args = commandArgs;
+    }
+    if (envVars.length > 0) {
+      const envObj = {};
+      for (const e of envVars) {
+        const eqIndex = e.indexOf("=");
+        if (eqIndex > 0) {
+          envObj[e.slice(0, eqIndex)] = e.slice(eqIndex + 1);
+        }
+      }
+      spec.env = envObj;
+    }
+    return { name, spec };
+  }
+  return { error: "Server name is required." };
+}
+
 // src/compat/unsupported.ts
 var UNSUPPORTED_CLIENTS = {
   "cursor-agent": "Cursor MCP management uses a different interface. Use `mcpx add <name> <url|command>` directly to add MCP servers to mcpx.",
@@ -825,11 +1026,68 @@ function parseCompatibilityArgs(argv) {
       normalizedArgs: result.normalizedArgs
     };
   }
+  if (argv[0] === "openclaw" && argv[1] === "mcp" && argv[2] === "add") {
+    const openclawArgs = argv.slice(3);
+    const result = parseOpenClawArgs(openclawArgs);
+    if ("error" in result) {
+      return {
+        client: "openclaw",
+        normalizedArgs: null,
+        error: result.error
+      };
+    }
+    return {
+      client: "openclaw",
+      normalizedArgs: ["--name", result.name, ...buildSpecArgs(result.spec)]
+    };
+  }
+  if (argv[0] === "hermes" && argv[1] === "mcp" && argv[2] === "add") {
+    const hermesArgs = argv.slice(3);
+    const result = parseHermesArgs(hermesArgs);
+    if ("error" in result) {
+      return {
+        client: "hermes",
+        normalizedArgs: null,
+        error: result.error
+      };
+    }
+    return {
+      client: "hermes",
+      normalizedArgs: ["--name", result.name, ...buildSpecArgs(result.spec)]
+    };
+  }
   return {
     client: null,
     normalizedArgs: null
   };
 }
+function buildSpecArgs(spec) {
+  const args = [];
+  if (spec.transport === "http") {
+    args.push(spec.url);
+    if (spec.headers) {
+      for (const [k, v] of Object.entries(spec.headers)) {
+        args.push("--header", `${k}=${v}`);
+      }
+    }
+  } else {
+    args.push("--command", spec.command);
+    if (Array.isArray(spec.args) && spec.args.length > 0) {
+      for (const a of spec.args) {
+        args.push("--arg", a);
+      }
+    }
+    if (spec.env) {
+      for (const [k, v] of Object.entries(spec.env)) {
+        args.push("--env", `${k}=${v}`);
+      }
+    }
+    if (spec.cwd) {
+      args.push("--cwd", spec.cwd);
+    }
+  }
+  return args;
+}
 
 // src/core/proxy.ts
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
@@ -1057,6 +1315,10 @@ function printSyncSummary(summary, asJson = false) {
     }
     process.stdout.write(`
 `);
+    if (result.driftedEntries && result.driftedEntries.length > 0) {
+      process.stdout.write(`  (note: ${result.driftedEntries.length} manually-edited entr${result.driftedEntries.length === 1 ? "y was" : "ies were"} reset to mcpx-managed values: ${result.driftedEntries.join(", ")})
+`);
+    }
   }
 }
 async function ensureDaemonIfEnabled(cliPath, secrets) {
@@ -1069,11 +1331,14 @@ async function ensureDaemonIfEnabled(cliPath, secrets) {
   }
   await startDaemon(config, cliPath, secrets);
 }
-async function autoSyncManagedEntries(config, cliPath) {
+async function autoSyncManagedEntries(cliPath) {
   const secrets = new SecretsManager;
   await ensureDaemonIfEnabled(cliPath, secrets);
-  const mergedConfig = loadMergedConfig();
-  const summary = syncAllClients(mergedConfig, secrets);
+  const config = loadMergedConfig();
+  const summary = syncAllClients(config, secrets);
+  await mutateConfig((freshConfig) => {
+    persistSyncState(summary, freshConfig);
+  });
   printSyncSummary(summary, false);
   ensureExitCodeForSyncFailures(summary.hasErrors);
 }
@@ -1567,6 +1832,8 @@ async function reconnectGatewayAndSync(cliPath) {
   process.stdout.write(`${restart.message} pid=${restart.pid} port=${restart.port}
 `);
   const summary = syncAllClients(config, secrets);
+  persistSyncState(summary, config);
+  saveConfig(config);
   printSyncSummary(summary, false);
 }
 async function setServerEnabledInteractively(rl, serverName, enabled, cliPath) {
@@ -1595,7 +1862,7 @@ async function setServerEnabledInteractively(rl, serverName, enabled, cliPath) {
 `);
             process.stdout.write(`Auto-syncing managed gateway entries across all supported clients...
 `);
-            await autoSyncManagedEntries(loadMergedConfig(), cliPath);
+            await autoSyncManagedEntries(cliPath);
             return true;
           }
         }
@@ -1609,7 +1876,7 @@ async function setServerEnabledInteractively(rl, serverName, enabled, cliPath) {
 `);
   process.stdout.write(`Auto-syncing managed gateway entries across all supported clients...
 `);
-  await autoSyncManagedEntries(loadMergedConfig(), cliPath);
+  await autoSyncManagedEntries(cliPath);
   return true;
 }
 function buildServerActionTitle(server) {
@@ -1731,25 +1998,23 @@ async function runInteractiveStatusMenu(cliPath) {
 }
 function registerEnabledCommand(parent, enabled, cliPath) {
   parent.command(enabled ? "enable <name>" : "disable <name>").option("-g, --global", "Force target the global configuration").option("-l, --local", "Force target (or initialize) a local `.mcpx.json` configuration").description(`${enabled ? "Enable" : "Disable"} an upstream MCP server`).action(async (name, options) => {
-    const context = resolveActiveConfig({ global: options.global, local: options.local });
-    setServerEnabled(context.config, name, enabled);
-    context.save();
-    if (context.type === "project" && context.projectPath) {
-      const globalConfig = loadConfig();
-      registerProject(globalConfig, context.projectPath);
-      saveConfig(globalConfig);
+    const { type, projectPath } = await mutateActiveConfig({ global: options.global, local: options.local }, (config) => {
+      setServerEnabled(config, name, enabled);
+    });
+    if (type === "project" && projectPath) {
+      await mutateConfig((globalConfig) => {
+        registerProject(globalConfig, projectPath, globalConfig.projects?.[path.resolve(projectPath)]?.name);
+      });
     }
-    process.stdout.write(`${enabled ? "Enabled" : "Disabled"} server: ${name} (${context.type} config)
+    process.stdout.write(`${enabled ? "Enabled" : "Disabled"} server: ${name} (${type} config)
 `);
     process.stdout.write(`Auto-syncing managed gateway entries across all supported clients...
 `);
-    const mergedConfig = loadMergedConfig();
-    await autoSyncManagedEntries(mergedConfig, cliPath);
+    await autoSyncManagedEntries(cliPath);
   });
 }
 function registerAddCommand(parent, cliPath) {
   parent.command("add [values...]").allowUnknownOption(true).option("--transport <transport>", "MCP transport (auto|http|stdio)", "auto").option("--header <header>", "Header entry in KEY=VALUE form", (value, previous = []) => [...previous, value], []).option("--env <env>", "Env entry in KEY=VALUE form for stdio upstreams", (value, previous = []) => [...previous, value], []).option("--cwd <cwd>", "Working directory for stdio upstream").option("--force", "Overwrite existing server with same name").option("-g, --global", "Force saving to global configuration").option("-l, --local", "Force saving to local project configuration").description("Add an upstream MCP server").action(async (values, options) => {
-    const context = resolveActiveConfig({ global: options.global, local: options.local });
     const safeValues = values ?? [];
     const secrets = new SecretsManager;
     if (safeValues.length === 1 && safeValues[0]?.includes("/")) {
@@ -1804,46 +2069,46 @@ Value: ` : `${input.name} (${input.kind}): `;
           spec.env = Object.keys(env).length > 0 ? env : undefined;
         }
       }
-      if (context.type === "project") {
-        const globalConfig = loadConfig();
-        registerProject(globalConfig, context.projectPath);
-        saveConfig(globalConfig);
-      }
-      addServer(context.config, shortName, spec, options.force ?? false);
       await maybeAutoConfigureAuthForAddedServer(shortName, spec, secrets);
-      context.save();
-      process.stdout.write(`Added server: ${shortName} (${spec.transport}) from registry "${registryName}"${context.type === "project" ? ` (project: ${context.projectPath})` : ""}
+      const { type, projectPath } = await mutateActiveConfig({ global: options.global, local: options.local }, (config) => {
+        addServer(config, shortName, spec, options.force ?? false);
+      });
+      if (type === "project" && projectPath) {
+        await mutateConfig((globalConfig) => {
+          registerProject(globalConfig, projectPath, globalConfig.projects?.[path.resolve(projectPath)]?.name);
+        });
+      }
+      process.stdout.write(`Added server: ${shortName} (${spec.transport}) from registry "${registryName}"${type === "project" ? ` (project: ${projectPath})` : ""}
 `);
     } else {
       const parsed = parseAddServerSpec(safeValues, options);
-      if (context.type === "project") {
-        const globalConfig = loadConfig();
-        registerProject(globalConfig, context.projectPath);
-        saveConfig(globalConfig);
-      }
-      addServer(context.config, parsed.name, parsed.spec, options.force ?? false);
       await maybeAutoConfigureAuthForAddedServer(parsed.name, parsed.spec, secrets);
-      context.save();
-      process.stdout.write(`Added server: ${parsed.name} (${parsed.spec.transport})${context.type === "project" ? ` (project: ${context.projectPath})` : ""}
+      const { type, projectPath } = await mutateActiveConfig({ global: options.global, local: options.local }, (config) => {
+        addServer(config, parsed.name, parsed.spec, options.force ?? false);
+      });
+      if (type === "project" && projectPath) {
+        await mutateConfig((globalConfig) => {
+          registerProject(globalConfig, projectPath, globalConfig.projects?.[path.resolve(projectPath)]?.name);
+        });
+      }
+      process.stdout.write(`Added server: ${parsed.name} (${parsed.spec.transport})${type === "project" ? ` (project: ${projectPath})` : ""}
 `);
     }
     process.stdout.write(`Auto-syncing managed gateway entries across all supported clients...
 `);
-    const mergedConfig = loadMergedConfig();
-    await autoSyncManagedEntries(mergedConfig, cliPath);
+    await autoSyncManagedEntries(cliPath);
   });
 }
 function registerRemoveCommand(parent, cliPath) {
   parent.command("remove <name>").option("--force", "Do not error if server does not exist").option("-g, --global", "Force target global configuration").option("-l, --local", "Force target local project configuration").description("Remove an upstream MCP server").action(async (name, options) => {
-    const context = resolveActiveConfig({ global: options.global, local: options.local });
-    removeServer(context.config, name, options.force ?? false);
-    context.save();
-    process.stdout.write(`Removed server: ${name} ${context.type === "project" ? `from project: ${context.projectPath}` : "globally"}
+    const { type, projectPath } = await mutateActiveConfig({ global: options.global, local: options.local }, (config) => {
+      removeServer(config, name, options.force ?? false);
+    });
+    process.stdout.write(`Removed server: ${name} ${type === "project" ? `from project: ${projectPath}` : "globally"}
 `);
     process.stdout.write(`Auto-syncing managed gateway entries across all supported clients...
 `);
-    const mergedConfig = loadMergedConfig();
-    await autoSyncManagedEntries(mergedConfig, cliPath);
+    await autoSyncManagedEntries(cliPath);
   });
 }
 function registerListCommand(parent) {
@@ -1914,12 +2179,14 @@ function registerListCommand(parent) {
   });
 }
 function registerSyncCommand(program, cliPath) {
-  program.command("sync [clients...]").option("--client <id>", "Limit sync to specific client(s), comma-separated or repeated", (value, prev = []) => [...prev, value], []).option("--json", "Output JSON").description("Sync gateway configuration to supported clients (e.g. `mcpx sync claude`)").action(async (clients, options) => {
-    const config = loadMergedConfig();
+  program.command("sync [clients...]").option("--client <id>", "Limit sync to specific client(s), comma-separated or repeated", (value, prev = []) => [...prev, value], []).option("--import", "Also scan clients for unmanaged servers and adopt them into the mcpx catalog", false).option("--json", "Output JSON").description("Sync gateway configuration to supported clients (e.g. `mcpx sync claude`)").action(async (clients, options) => {
+    const config = loadConfig();
     const targetClients = parseClientList([...clients ?? [], ...options.client ?? []]);
     const secrets = new SecretsManager;
     await ensureDaemonIfEnabled(cliPath, secrets);
-    const summary = syncAllClients(config, secrets, targetClients);
+    const summary = syncAllClients(config, secrets, { targetClients, importScan: options.import ?? false });
+    persistSyncState(summary, config);
+    saveConfig(config);
     printSyncSummary(summary, options.json ?? false);
     ensureExitCodeForSyncFailures(summary.hasErrors);
   });
@@ -2309,11 +2576,11 @@ function registerProjectCommands(program, cliPath) {
       name: projectName,
       servers: {}
     };
-    const { saveProjectConfig: saveProjectConfig2 } = await import("./config-2s5nsm2g.js");
+    const { saveProjectConfig: saveProjectConfig2 } = await import("./config-5p08cb0c.js");
     saveProjectConfig2(localConfig, targetPath);
     process.stdout.write(`Initialized project configuration at: ${targetPath}
 `);
-    const { registerProject: registerProject2 } = await import("./registry-mztfy0cz.js");
+    const { registerProject: registerProject2 } = await import("./registry-n12thgf2.js");
     const globalConfig = loadConfig();
     registerProject2(globalConfig, process.cwd(), projectName);
     saveConfig(globalConfig);
@@ -2344,21 +2611,20 @@ function registerProjectCommands(program, cliPath) {
       process.exit(1);
     }
     const entry = globalConfig.projects[resolvedPath];
-    const { unregisterProject: unregisterProject2 } = await import("./registry-mztfy0cz.js");
+    const { unregisterProject: unregisterProject2 } = await import("./registry-n12thgf2.js");
     unregisterProject2(globalConfig, resolvedPath);
     saveConfig(globalConfig);
     process.stdout.write(`Unregistered project "${entry.name}" (${resolvedPath}) from the global configuration.
 `);
     process.stdout.write(`Auto-syncing managed gateway entries across all supported clients...
 `);
-    const mergedConfig = loadMergedConfig();
-    await autoSyncManagedEntries(mergedConfig, cliPath);
+    await autoSyncManagedEntries(cliPath);
   });
 }
 function registerPluginCommands(program, _cliPath) {
   const plugin = program.command("plugin").description("Manage plugins");
   plugin.command("inspect <source>").description("Inspect plugin manifest and components").action(async (source) => {
-    const { inspectPlugin } = await import("./plugin-manager-1sc4b6am.js");
+    const { inspectPlugin } = await import("./plugin-manager-m8ar2271.js");
     try {
       const info = await inspectPlugin(source);
       process.stdout.write(JSON.stringify(info, null, 2) + `
@@ -2370,7 +2636,7 @@ function registerPluginCommands(program, _cliPath) {
     }
   });
   plugin.command("install <source>").option("--name <name>", "Plugin name").option("--no-enable", "Don't enable plugin after install").description("Install plugin").action(async (source, options) => {
-    const { installPlugin } = await import("./plugin-manager-1sc4b6am.js");
+    const { installPlugin } = await import("./plugin-manager-m8ar2271.js");
     try {
       const p = await installPlugin(source, {
         name: options.name,
@@ -2385,7 +2651,7 @@ function registerPluginCommands(program, _cliPath) {
     }
   });
   plugin.command("approve <name> <component>").description("Approve a plugin component (hooks, mcpServers)").action(async (name, component) => {
-    const { approvePluginComponent } = await import("./plugin-manager-1sc4b6am.js");
+    const { approvePluginComponent } = await import("./plugin-manager-m8ar2271.js");
     try {
       await approvePluginComponent(name, component);
       process.stdout.write(`Approved ${component} for plugin ${name}
@@ -2397,7 +2663,7 @@ function registerPluginCommands(program, _cliPath) {
     }
   });
   plugin.command("prepare <name>").description("Install plugin dependencies").action(async (name) => {
-    const { preparePlugin } = await import("./plugin-manager-1sc4b6am.js");
+    const { preparePlugin } = await import("./plugin-manager-m8ar2271.js");
     try {
       await preparePlugin(name);
       process.stdout.write(`Plugin ${name} prepared
@@ -2409,7 +2675,7 @@ function registerPluginCommands(program, _cliPath) {
     }
   });
   plugin.command("update <name>").description("Update plugin to latest version").action(async (name) => {
-    const { updatePlugin } = await import("./plugin-manager-1sc4b6am.js");
+    const { updatePlugin } = await import("./plugin-manager-m8ar2271.js");
     try {
       const p = await updatePlugin(name);
       process.stdout.write(`Plugin ${name} updated to ${p.version}
@@ -2421,7 +2687,7 @@ function registerPluginCommands(program, _cliPath) {
     }
   });
   plugin.command("uninstall <name>").option("--keep-data", "Keep plugin data after uninstall").description("Uninstall plugin").action(async (name, options) => {
-    const { uninstallPlugin } = await import("./plugin-manager-1sc4b6am.js");
+    const { uninstallPlugin } = await import("./plugin-manager-m8ar2271.js");
     try {
       await uninstallPlugin(name, options.keepData || false);
       process.stdout.write(`Plugin ${name} uninstalled
@@ -2432,24 +2698,40 @@ function registerPluginCommands(program, _cliPath) {
       process.exit(1);
     }
   });
-  plugin.command("enable <name>").description("Enable plugin").action(async (name) => {
-    const { enablePlugin } = await import("./plugin-manager-1sc4b6am.js");
+  plugin.command("enable <name>").option("--project <path>", "Scope this enable to a single registered project instead of globally").description("Enable plugin (globally, or for one project with --project)").action(async (name, options) => {
     try {
-      await enablePlugin(name);
-      process.stdout.write(`Plugin ${name} enabled
+      if (options.project) {
+        const { setPluginProjectOverride } = await import("./plugin-manager-m8ar2271.js");
+        const resolvedPath = path.resolve(options.project);
+        await setPluginProjectOverride(name, resolvedPath, { enabled: true });
+        process.stdout.write(`Plugin ${name} enabled for project: ${resolvedPath}
 `);
+      } else {
+        const { enablePlugin } = await import("./plugin-manager-m8ar2271.js");
+        await enablePlugin(name);
+        process.stdout.write(`Plugin ${name} enabled
+`);
+      }
     } catch (e) {
       process.stderr.write(`Error: ${e.message}
 `);
       process.exit(1);
     }
   });
-  plugin.command("disable <name>").description("Disable plugin").action(async (name) => {
-    const { disablePlugin } = await import("./plugin-manager-1sc4b6am.js");
+  plugin.command("disable <name>").option("--project <path>", "Scope this disable to a single registered project instead of globally").description("Disable plugin (globally, or for one project with --project)").action(async (name, options) => {
     try {
-      await disablePlugin(name);
-      process.stdout.write(`Plugin ${name} disabled
+      if (options.project) {
+        const { setPluginProjectOverride } = await import("./plugin-manager-m8ar2271.js");
+        const resolvedPath = path.resolve(options.project);
+        await setPluginProjectOverride(name, resolvedPath, { enabled: false });
+        process.stdout.write(`Plugin ${name} disabled for project: ${resolvedPath}
 `);
+      } else {
+        const { disablePlugin } = await import("./plugin-manager-m8ar2271.js");
+        await disablePlugin(name);
+        process.stdout.write(`Plugin ${name} disabled
+`);
+      }
     } catch (e) {
       process.stderr.write(`Error: ${e.message}
 `);
@@ -2457,7 +2739,7 @@ function registerPluginCommands(program, _cliPath) {
     }
   });
   plugin.command("status [name]").description("Show plugin status").action(async (name) => {
-    const { getPluginStatus, listPlugins } = await import("./plugin-manager-1sc4b6am.js");
+    const { getPluginStatus, listPlugins } = await import("./plugin-manager-m8ar2271.js");
     try {
       if (name) {
         const p = await getPluginStatus(name);
@@ -2480,6 +2762,12 @@ function registerPluginCommands(program, _cliPath) {
     }
   });
 }
+function registerPluginHostCommand(program) {
+  program.command("plugin-host <plugin> <server>").description("Run a plugin MCP server under mcpx policy enforcement").action(async (plugin, server) => {
+    const { runPluginHost } = await import("./plugin-host-954a7tf7.js");
+    runPluginHost(plugin, server);
+  });
+}
 function registerProxyCommand(program) {
   program.command("proxy <name>").description("Run a stdio MCP proxy bridging to the local mcpx HTTP gateway for the given upstream server").action(async (name) => {
     await runStdioProxy(name);
@@ -2504,14 +2792,19 @@ async function runCli(argv = process.argv) {
     const stagedCliPath = getStagedCliPath();
     const stagedInfo = getStagedUpdate();
     if (stagedCliPath && stagedInfo && stagedCliPath !== argv[1] && shouldUseStagedCli(stagedInfo.version, APP_VERSION)) {
-      execFileSync(process.execPath, [stagedCliPath, ...rawArgs], {
-        stdio: "inherit",
-        env: {
-          ...process.env,
-          MCPX_USING_STAGED: "1"
-        }
-      });
-      return;
+      try {
+        execFileSync(process.execPath, [stagedCliPath, ...rawArgs], {
+          stdio: "inherit",
+          env: {
+            ...process.env,
+            MCPX_USING_STAGED: "1"
+          }
+        });
+        return;
+      } catch (error) {
+        process.stderr.write(`Warning: staged update v${stagedInfo.version} failed to run (${error.message}). ` + `Falling back to the currently installed version (v${APP_VERSION}). ` + `Run "mcpx update rollback" to clear the broken staged update.
+`);
+      }
     }
   }
   if (rawArgs.length > 0) {
@@ -2541,6 +2834,7 @@ async function runCli(argv = process.argv) {
   registerAuthCommands(program);
   registerClientsCommands(program);
   registerSkillsCommands(program);
+  registerPluginHostCommand(program);
   registerProxyCommand(program);
   registerMcpCompat(program, cliPath);
   registerUpdateCommand(program);
@@ -2550,8 +2844,25 @@ async function runCli(argv = process.argv) {
 }
 if (process.argv[1] && import.meta.url === pathToFileURL(fs.realpathSync(process.argv[1])).href) {
   runCli().catch((error) => {
-    process.stderr.write(`${error.message}
+    if (error instanceof ConfigLoadError) {
+      process.stderr.write(`Config error: ${error.message}
 `);
+      if (error.backupPath) {
+        process.stderr.write(`Backup saved to: ${error.backupPath}
+`);
+      }
+      if (error.issues && error.issues.length > 0) {
+        for (const issue of error.issues.slice(0, 5)) {
+          process.stderr.write(`  - ${issue}
+`);
+        }
+      }
+      process.stderr.write(`Fix the config file or restore from backup.
+`);
+    } else {
+      process.stderr.write(`${error.message}
+`);
+    }
     process.exit(1);
   });
 }