@lannguyensi/harness 0.41.0 → 0.42.0

package/dist/io/claude-mcp.js

@@ -0,0 +1,544 @@
+// All interaction with Claude Code's user-scope MCP registration lives here.
+// harness never writes `~/.claude.json` (or `$CLAUDE_CONFIG_DIR/.claude.json`)
+// itself — mutations go exclusively through the `claude mcp` CLI, which is
+// the only thing Claude Code actually reads at runtime for user-scope
+// servers (unlike the `mcpServers` block in `~/.claude/settings.json`,
+// which Claude Code does not consume — see
+// .ai/runs/2026-07-18-init-mcp-wiring-claude-code/01-plan.md).
+//
+// Three layers, task T-001 scope only (no init/doctor wiring — that's
+// T-002/T-003):
+//   1. A thin, injectable-exec wrapper around `claude mcp get/add-json/
+//      remove/list`, ENOENT-tolerant and timeout-bounded, that turns raw
+//      exit codes/stderr into structured result objects (never throws for
+//      "CLI missing" or "timed out" — those are just another outcome).
+//   2. `ensureMcpServers`: reconciles a desired per-server state against
+//      the live registry (add/replace-on-drift/no-op), and — opt-in via
+//      `opts.gc` (task 363a6de0, MCP-removal GC) — also `claude mcp
+//      remove`s any caller-designated "owned" name that's registered but
+//      no longer in `desired` (a manifest entry the operator removed or
+//      disabled). Ownership is entirely the caller's call: this module
+//      never guesses which names harness owns, so a foreign/manually
+//      registered server is never touched, no matter how it drifts from
+//      `desired`. The ONLY read of the registry file this module performs
+//      serves both the drift comparison and the GC candidate scan, and it
+//      reads strictly the top-level `mcpServers` key — never
+//      `projects.<path>.mcpServers` (that's project-local Claude Code
+//      state; `uninstall`'s `probeProjectLocalClaudeJson` already surfaces
+//      it separately, read-only). All writes still go through the CLI
+//      wrapper above.
+//   3. `stripOwnedMcpServers`: a pure function that removes owned names
+//      from a parsed settings.json object (the dead `mcpServers` block
+//      the old write path left behind). No file I/O — callers own reading
+//      and writing the file.
+//
+// Verified CLI contract (empirical probe, 2026-07-18, disposable
+// CLAUDE_CONFIG_DIR):
+//   `claude mcp add-json --scope user <name> <json>`
+//     new name    → exit 0, stdout "Added stdio MCP server <name> to user config"
+//     name exists → exit 1, stderr "MCP server <name> already exists in user config" (no overwrite, no prompt)
+//     malformed   → exit 1, stderr "Invalid configuration"
+//   `claude mcp remove --scope user <name>`
+//     present → exit 0
+//     absent  → exit 1, stderr 'No MCP server named "<name>" in user scope'
+//   `claude mcp get <name>`
+//     present → exit 0; absent → exit 1
+//   `claude mcp list`
+//     exit 0 even with dead servers. Line format:
+//     `<name>: <command> <args> - <marker> <statusText>` with marker one
+//     of "✔ Connected" | "✘ Failed to connect" | "! Needs authentication".
+//   Respects CLAUDE_CONFIG_DIR: the user-scope registry then lives at
+//   $CLAUDE_CONFIG_DIR/.claude.json instead of ~/.claude.json.
+import { spawn } from "node:child_process";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { assertNoRealSpawnInTests } from "../runtime/hermetic-spawn-guard.js";
+export const DEFAULT_TIMEOUT_MS = 30_000;
+/**
+ * Hermetic guard (task 54739002 primitive, applied here per task
+ * 0d80e969): asserts BEFORE touching `child_process` that we are not
+ * running under vitest without a test having injected `opts.exec`. This
+ * is the ONLY spawn point behind every `claude mcp <verb>` call in this
+ * module (add-json/remove/get/list all default to `opts.exec ??
+ * realClaudeMcpExec`). An accidental real spawn here talks to the
+ * OPERATOR'S REAL Claude Code user-scope MCP registry (`~/.claude.json`
+ * or `$CLAUDE_CONFIG_DIR/.claude.json`) — `list`/`get` only read it, but
+ * `add-json`/`remove` actually mutate it. See
+ * src/runtime/hermetic-spawn-guard.ts for why and the env signal used.
+ *
+ * `realClaudeMcpExec` has no try/catch around this call, so the thrown
+ * `HermeticSpawnViolationError` propagates directly to whichever
+ * exported wrapper (addJsonMcpServer/removeMcpServer/getMcpServer/
+ * listMcpServers) called it, and from there to every one of THEIR
+ * callers (including `ensureMcpServers`). Local "no try/catch here" is
+ * not the actual guarantee, though: the OW guard
+ * (src/cli/init/interactive.ts) proved a local absence-of-catch
+ * argument isn't enough on its own — that violation had to survive a
+ * catch further up the call chain. The backstops verified for THIS
+ * module's call sites:
+ *   - init's wire-now path: `wireRuntime`'s own catch
+ *     (src/cli/init/interactive.ts, the "Failed to wire ..." handler)
+ *     re-throws a `HermeticSpawnViolationError` before its normal
+ *     degrade-to-warning-and-retry handling, and runInteractive's outer
+ *     catch (src/cli/init/interactive.ts, the top-level handler that
+ *     otherwise treats a caught error as either an `isAbortError`
+ *     Ctrl-C or a rethrow) re-throws it again past every remaining
+ *     intermediate handler.
+ *   - doctor's `buildClaudeMcpRegistration` (src/cli/doctor/claude-mcp.ts)
+ *     and `doctor()` (src/cli/doctor/index.ts) have no try/catch at all
+ *     around the `listMcpServers` call, so it propagates unmodified.
+ *   - uninstall's `removeRegisteredMcpServers` (src/cli/uninstall/
+ *     index.ts) and `uninstall()` likewise have no try/catch around the
+ *     `removeMcpServer` call.
+ */
+function realClaudeMcpExec(args, timeoutMs) {
+    // Every caller in this module passes >=2 elements (["mcp", <verb>, ...]),
+    // so the fallback below is unreached today — kept anyway so a future
+    // call site that passes fewer never degrades to a blank/truncated
+    // "claude " label in the guard's own error message.
+    const verb = args.slice(0, 2).join(" ") || "(no args)";
+    assertNoRealSpawnInTests(`claude ${verb}`, "Inject a fake `exec` (ClaudeMcpExec) via opts.exec instead of exercising the real spawn path.");
+    return new Promise((resolve) => {
+        let child;
+        try {
+            child = spawn("claude", args, { stdio: ["ignore", "pipe", "pipe"] });
+        }
+        catch (err) {
+            const e = err;
+            resolve({
+                code: 127,
+                stdout: "",
+                stderr: `spawn failed: ${e.message}`,
+                enoent: e.code === "ENOENT",
+                timedOut: false,
+            });
+            return;
+        }
+        let stdout = "";
+        let stderr = "";
+        let settled = false;
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            child.kill("SIGTERM");
+            resolve({ code: -1, stdout, stderr, enoent: false, timedOut: true });
+        }, timeoutMs);
+        child.stdout?.on("data", (c) => {
+            stdout += c.toString("utf8");
+        });
+        child.stderr?.on("data", (c) => {
+            stderr += c.toString("utf8");
+        });
+        child.on("error", (err) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            const e = err;
+            resolve({ code: 127, stdout, stderr, enoent: e.code === "ENOENT", timedOut: false });
+        });
+        child.on("exit", (code) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve({ code: code ?? 1, stdout, stderr, enoent: false, timedOut: false });
+        });
+    });
+}
+// Omit empty args/env so the JSON handed to `add-json` stays minimal
+// (mirrors buildMcpServers in generate-settings.ts).
+function compactSpec(spec) {
+    const out = { command: spec.command };
+    if (spec.args && spec.args.length > 0)
+        out.args = spec.args;
+    if (spec.env && Object.keys(spec.env).length > 0)
+        out.env = spec.env;
+    return out;
+}
+/**
+ * Wrap a value as a single POSIX shell single-quoted token, escaping any
+ * embedded single quote as `'\''`. Used to build the copy-pasteable
+ * `claude mcp add-json ... <json>` fallback commands harness prints when the
+ * CLI is missing or a server is unregistered, so the operator can paste them
+ * verbatim even when a value (e.g. a home path containing an apostrophe, as
+ * projected into grounding-mcp's EVIDENCE_LEDGER_DB) has a single quote.
+ * Harness never executes these strings itself.
+ */
+export function posixSingleQuote(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+export async function addJsonMcpServer(name, spec, opts = {}) {
+    const exec = opts.exec ?? realClaudeMcpExec;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const json = JSON.stringify(compactSpec(spec));
+    const r = await exec(["mcp", "add-json", "--scope", "user", name, json], timeoutMs);
+    if (r.timedOut) {
+        return { status: "timeout", message: `claude mcp add-json timed out after ${timeoutMs}ms`, code: r.code };
+    }
+    if (r.enoent) {
+        return { status: "cli-missing", message: "claude CLI not found on PATH", code: r.code };
+    }
+    if (r.code === 0) {
+        return { status: "added", message: r.stdout.trim(), code: r.code };
+    }
+    const stderr = r.stderr.trim();
+    if (/already exists/i.test(stderr)) {
+        return { status: "already-exists", message: stderr, code: r.code };
+    }
+    if (/invalid configuration/i.test(stderr)) {
+        return { status: "invalid-config", message: stderr, code: r.code };
+    }
+    return { status: "error", message: stderr || `claude mcp add-json exited ${r.code}`, code: r.code };
+}
+export async function removeMcpServer(name, opts = {}) {
+    const exec = opts.exec ?? realClaudeMcpExec;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const r = await exec(["mcp", "remove", "--scope", "user", name], timeoutMs);
+    if (r.timedOut) {
+        return { status: "timeout", message: `claude mcp remove timed out after ${timeoutMs}ms`, code: r.code };
+    }
+    if (r.enoent) {
+        return { status: "cli-missing", message: "claude CLI not found on PATH", code: r.code };
+    }
+    if (r.code === 0) {
+        return { status: "removed", message: r.stdout.trim(), code: r.code };
+    }
+    const stderr = r.stderr.trim();
+    if (/No MCP server named/i.test(stderr)) {
+        return { status: "not-found", message: stderr, code: r.code };
+    }
+    return { status: "error", message: stderr || `claude mcp remove exited ${r.code}`, code: r.code };
+}
+/**
+ * One `claude mcp remove --scope user <name>` line per name, sorted.
+ * Sibling of `manualAddJsonLines` in `cli/init/interactive.ts` — the
+ * copy-pasteable fallback GC (task 363a6de0) prints when it can't reach
+ * the `claude` CLI (or hits some other non-"removed"/"not-found" outcome)
+ * to deregister a stale, harness-owned server itself. Uses
+ * {@link posixSingleQuote} on the name for the same reason
+ * `manualAddJsonLines` quotes its JSON payload: a server name is an
+ * ordinary token today, but quoting it costs nothing and keeps the line
+ * safe to paste verbatim regardless. Harness never executes these strings
+ * itself.
+ */
+export function manualRemoveLines(names) {
+    return [...names].sort().map((name) => `claude mcp remove --scope user ${posixSingleQuote(name)}`);
+}
+export async function getMcpServer(name, opts = {}) {
+    const exec = opts.exec ?? realClaudeMcpExec;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const r = await exec(["mcp", "get", name], timeoutMs);
+    if (r.timedOut) {
+        return { status: "timeout", raw: "", code: r.code };
+    }
+    if (r.enoent) {
+        return { status: "cli-missing", raw: "", code: r.code };
+    }
+    if (r.code === 0) {
+        return { status: "found", raw: r.stdout, code: r.code };
+    }
+    // Per the verified contract `get` only ever exits 0 (found) or 1
+    // (absent); any other non-zero, non-enoent exit still reads as
+    // "not-found" rather than inventing an "error" bucket the contract
+    // never demonstrated.
+    return { status: "not-found", raw: r.stderr.trim(), code: r.code };
+}
+function markerToStatus(marker) {
+    switch (marker) {
+        case "✔":
+            return "connected";
+        case "✘":
+            return "failed";
+        case "!":
+            return "needs-authentication";
+        default:
+            return "unknown";
+    }
+}
+// `<name>: <command> <args...> - <marker> <statusText>`. Greedy `.+` for
+// the command segment finds the RIGHTMOST " - <marker> " separator,
+// which is what we want since the command/args portion (e.g. a URL like
+// `https://...`) may itself contain " - ". The name segment stops at the
+// first ": " (not just ":") so URLs like "https://..." — colon with no
+// following space — never get mistaken for the name/command boundary.
+const LIST_LINE_RE = /^(.+?): (.+) - (✔|✘|!) (.+)$/;
+/**
+ * Parse `claude mcp list` stdout. Lines that don't match the expected
+ * shape (blank lines, any future banner/preamble) are skipped rather
+ * than throwing — the exit code alone tells us the command succeeded.
+ *
+ * Caveat (same one `buildMcpServers` in generate-settings.ts documents
+ * for the inverse direction): splitting the command+args segment on
+ * whitespace mis-splits a command path with embedded spaces. Foreign
+ * entries whose "command" is a URL (e.g. `claude.ai Gmail: https://... -
+ * ! Needs authentication`) still parse correctly since URLs have no
+ * embedded whitespace.
+ */
+export function parseClaudeMcpListOutput(stdout) {
+    const entries = [];
+    for (const rawLine of stdout.split("\n")) {
+        const line = rawLine.trim();
+        if (line === "")
+            continue;
+        const m = LIST_LINE_RE.exec(line);
+        if (!m)
+            continue;
+        const name = (m[1] ?? "").trim();
+        const commandLine = (m[2] ?? "").trim();
+        const marker = m[3] ?? "";
+        const statusText = (m[4] ?? "").trim();
+        const tokens = commandLine.split(/\s+/).filter((t) => t.length > 0);
+        entries.push({
+            name,
+            command: tokens[0] ?? "",
+            args: tokens.slice(1),
+            status: markerToStatus(marker),
+            statusText,
+        });
+    }
+    return entries;
+}
+export async function listMcpServers(opts = {}) {
+    const exec = opts.exec ?? realClaudeMcpExec;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const r = await exec(["mcp", "list"], timeoutMs);
+    if (r.timedOut) {
+        return { status: "timeout", servers: [], message: `claude mcp list timed out after ${timeoutMs}ms` };
+    }
+    if (r.enoent) {
+        return { status: "cli-missing", servers: [], message: "claude CLI not found on PATH" };
+    }
+    if (r.code !== 0) {
+        return { status: "error", servers: [], message: r.stderr.trim() || `claude mcp list exited ${r.code}` };
+    }
+    return { status: "ok", servers: parseClaudeMcpListOutput(r.stdout) };
+}
+// ---------------------------------------------------------------------
+// Layer 2: ensure routine (desired-state reconciliation + opt-in GC)
+// ---------------------------------------------------------------------
+function isRecord(x) {
+    return typeof x === "object" && x !== null && !Array.isArray(x);
+}
+/**
+ * Resolve the path to the user-scope registry file the `claude` CLI
+ * itself reads/writes — the same precedence the CLI applies: an explicit
+ * `CLAUDE_CONFIG_DIR` wins (`$CLAUDE_CONFIG_DIR/.claude.json`); otherwise
+ * it's `~/.claude.json`, derived here as `path.join(path.dirname(homeDir),
+ * ".claude.json")` to match the existing resolution in
+ * `src/cli/uninstall/index.ts` (`probeProjectLocalClaudeJson`).
+ */
+export function resolveClaudeUserRegistryPath(opts = {}) {
+    const env = opts.env ?? process.env;
+    const configDir = env["CLAUDE_CONFIG_DIR"];
+    if (typeof configDir === "string" && configDir.length > 0) {
+        return path.join(configDir, ".claude.json");
+    }
+    const homeDir = opts.homeDir ?? path.join(os.homedir(), ".claude");
+    return path.join(path.dirname(homeDir), ".claude.json");
+}
+/**
+ * Read strictly the top-level `mcpServers` key of the registry file. Never
+ * reads/interprets `projects.<path>.mcpServers` — that's project-local
+ * Claude Code state, out of scope here (see `probeProjectLocalClaudeJson`
+ * in uninstall for the existing, separate, read-only handling of it).
+ *
+ * Exported (task 83d8d03a) as the single allowed primitive for reading the
+ * effective Claude Code user-scope MCP registration from outside this
+ * module — `adopt` (MCP-drift comparison) and `detect` (team/full
+ * recognition) both call this directly instead of duplicating a registry
+ * reader or spawning `claude mcp list`. Read-only; never writes.
+ */
+export function readTopLevelMcpServers(registryPath) {
+    let raw;
+    try {
+        raw = fs.readFileSync(registryPath, "utf8");
+    }
+    catch (err) {
+        const e = err;
+        if (e.code === "ENOENT")
+            return { servers: {}, error: null };
+        return { servers: {}, error: `cannot read ${registryPath}: ${e.message}` };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        return { servers: {}, error: `${registryPath} is not valid JSON: ${err.message}` };
+    }
+    if (!isRecord(parsed)) {
+        return { servers: {}, error: `${registryPath} is not a JSON object` };
+    }
+    const mcp = parsed["mcpServers"];
+    if (mcp === undefined)
+        return { servers: {}, error: null };
+    if (!isRecord(mcp)) {
+        return { servers: {}, error: `${registryPath} \`mcpServers\` is not a JSON object` };
+    }
+    return { servers: mcp, error: null };
+}
+// Equality tolerates a missing `args` on either side as `[]` and a
+// missing `env` on either side as `{}` (constraint: "args-Default []
+// tolerieren"; env gets the same treatment for consistency).
+function specsEqual(existing, desired) {
+    if (!isRecord(existing))
+        return false;
+    if (existing["command"] !== desired.command)
+        return false;
+    const existingArgs = Array.isArray(existing["args"]) ? existing["args"] : [];
+    const desiredArgs = desired.args ?? [];
+    if (existingArgs.length !== desiredArgs.length)
+        return false;
+    for (let i = 0; i < existingArgs.length; i++) {
+        if (existingArgs[i] !== desiredArgs[i])
+            return false;
+    }
+    const existingEnv = isRecord(existing["env"]) ? existing["env"] : {};
+    const desiredEnv = desired.env ?? {};
+    const existingEnvKeys = Object.keys(existingEnv).sort();
+    const desiredEnvKeys = Object.keys(desiredEnv).sort();
+    if (existingEnvKeys.length !== desiredEnvKeys.length)
+        return false;
+    for (let i = 0; i < existingEnvKeys.length; i++) {
+        const k = existingEnvKeys[i];
+        if (k !== desiredEnvKeys[i])
+            return false;
+        if (existingEnv[k] !== desiredEnv[k])
+            return false;
+    }
+    return true;
+}
+/**
+ * Reconcile `desired` against the live user-scope registry:
+ *   - name absent from the registry           → `add-json`
+ *   - name present, spec identical             → no-op, NO exec call at all
+ *   - name present, spec differs (drift)        → `remove` then `add-json`
+ * The registry is only ever read (for the comparison); every write goes
+ * through the CLI wrapper. If the registry file can't be read safely
+ * (malformed JSON, `mcpServers` not an object, non-ENOENT read error),
+ * every desired server is reported `skipped` with a reason instead of
+ * guessing — a missing file (ENOENT, i.e. no registry yet) is NOT an
+ * error and is treated as an empty registry.
+ *
+ * `opts.gc` (task 363a6de0) opts into a second pass over the SAME
+ * registry snapshot: every name in `opts.gc.ownedNames` that is currently
+ * registered but absent from `desired` gets `claude mcp remove`d — this is
+ * how a manifest edit that deletes or disables a `tools.mcp[]` entry
+ * propagates into a deregistration on the next ensure run. A name that's
+ * owned but ALSO still in `desired` (e.g. an operator hand-registered a
+ * drifted copy of a still-active entry) is never a GC candidate — the
+ * `desired` membership check excludes it before ownership is even
+ * considered, so it's protected automatically, not via special-cased
+ * content comparison. Without `opts.gc`, behavior is exactly the pre-GC
+ * contract: every registry entry outside `desired` is left alone. If the
+ * registry couldn't be read safely, GC is skipped too, mirroring the main
+ * loop (`gc.registryReadError` set, `gc.results` empty) — same "never
+ * guess" rule.
+ */
+export async function ensureMcpServers(opts) {
+    const registryPath = opts.registryPath ?? resolveClaudeUserRegistryPath({ homeDir: opts.homeDir, env: opts.env });
+    const { servers: existing, error: readError } = readTopLevelMcpServers(registryPath);
+    const callOpts = { exec: opts.exec, timeoutMs: opts.timeoutMs };
+    const results = [];
+    for (const name of Object.keys(opts.desired).sort()) {
+        const spec = opts.desired[name];
+        if (readError !== null) {
+            results.push({ name, action: "skipped", reason: readError });
+            continue;
+        }
+        const current = existing[name];
+        if (current === undefined) {
+            const add = await addJsonMcpServer(name, spec, callOpts);
+            results.push({ name, action: "add", add });
+            continue;
+        }
+        if (specsEqual(current, spec)) {
+            results.push({ name, action: "noop" });
+            continue;
+        }
+        const remove = await removeMcpServer(name, callOpts);
+        if (remove.status !== "removed" && remove.status !== "not-found") {
+            // remove failed for a reason unrelated to "already gone" (cli-missing,
+            // timeout, or a genuine error) — a follow-up add-json would just fail
+            // the same way (or worse, collide), so stop here and report it.
+            results.push({ name, action: "replace", remove });
+            continue;
+        }
+        const add = await addJsonMcpServer(name, spec, callOpts);
+        results.push({ name, action: "replace", remove, add });
+    }
+    let gc;
+    if (opts.gc) {
+        if (readError !== null) {
+            gc = { results: [], registryReadError: readError };
+        }
+        else {
+            const desiredNames = new Set(Object.keys(opts.desired));
+            const owned = new Set(opts.gc.ownedNames);
+            // Owned ∧ registered ∧ NOT desired (D-103/D-107 — this module is
+            // agnostic to how the caller built `ownedNames`). `desired`
+            // membership is checked first, so a still-active manifest entry is
+            // protected regardless of whether its registered content has
+            // drifted.
+            const candidates = Object.keys(existing)
+                .filter((name) => owned.has(name) && !desiredNames.has(name))
+                .sort();
+            const gcResults = [];
+            for (const name of candidates) {
+                const remove = await removeMcpServer(name, callOpts);
+                if (remove.status === "removed" || remove.status === "not-found") {
+                    gcResults.push({ name, action: "removed", remove });
+                }
+                else {
+                    gcResults.push({ name, action: "skipped", remove, reason: remove.message });
+                }
+            }
+            gc = { results: gcResults };
+        }
+    }
+    return { registryPath, results, ...(gc !== undefined ? { gc } : {}) };
+}
+/**
+ * Remove exactly the given owned names from `settings.mcpServers`,
+ * preserve every foreign entry, drop the `mcpServers` key entirely when
+ * it becomes empty, and leave every other top-level key byte-identical
+ * (same values, same insertion order). Pure — no file I/O; callers own
+ * reading/writing settings.json.
+ */
+export function stripOwnedMcpServers(settings, ownedNames) {
+    const mcpServers = settings["mcpServers"];
+    if (!isRecord(mcpServers)) {
+        // Absent or malformed `mcpServers`: nothing this function owns to
+        // strip. Returning the same reference keeps the "byte-identical"
+        // guarantee trivially true.
+        return { settings, removedNames: [] };
+    }
+    const owned = new Set(ownedNames);
+    const kept = {};
+    const removed = [];
+    for (const [name, value] of Object.entries(mcpServers)) {
+        if (owned.has(name)) {
+            removed.push(name);
+        }
+        else {
+            kept[name] = value;
+        }
+    }
+    if (removed.length === 0) {
+        return { settings, removedNames: [] };
+    }
+    // Spread preserves existing key order; reassigning `mcpServers` in
+    // place keeps its original position instead of moving it to the end.
+    const out = { ...settings };
+    if (Object.keys(kept).length === 0) {
+        delete out["mcpServers"];
+    }
+    else {
+        out["mcpServers"] = kept;
+    }
+    return { settings: out, removedNames: removed.sort() };
+}
+//# sourceMappingURL=claude-mcp.js.map

package/dist/io/claude-mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-mcp.js","sourceRoot":"","sources":["../../src/io/claude-mcp.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,+EAA+E;AAC/E,2EAA2E;AAC3E,sEAAsE;AACtE,uEAAuE;AACvE,2CAA2C;AAC3C,+DAA+D;AAC/D,EAAE;AACF,sEAAsE;AACtE,gBAAgB;AAChB,wEAAwE;AACxE,yEAAyE;AACzE,0EAA0E;AAC1E,uEAAuE;AACvE,yEAAyE;AACzE,wEAAwE;AACxE,oEAAoE;AACpE,yEAAyE;AACzE,wEAAwE;AACxE,uEAAuE;AACvE,qEAAqE;AACrE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,6DAA6D;AAC7D,sEAAsE;AACtE,2EAA2E;AAC3E,sEAAsE;AACtE,sBAAsB;AACtB,wEAAwE;AACxE,uEAAuE;AACvE,0EAA0E;AAC1E,6BAA6B;AAC7B,EAAE;AACF,iEAAiE;AACjE,sBAAsB;AACtB,qDAAqD;AACrD,kFAAkF;AAClF,+GAA+G;AAC/G,2DAA2D;AAC3D,4CAA4C;AAC5C,uBAAuB;AACvB,4EAA4E;AAC5E,4BAA4B;AAC5B,wCAAwC;AACxC,sBAAsB;AACtB,kDAAkD;AAClD,yEAAyE;AACzE,2EAA2E;AAC3E,sEAAsE;AACtE,+DAA+D;AAE/D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAE9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAoBzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,SAAS,iBAAiB,CAAC,IAAc,EAAE,SAAiB;IAC1D,0EAA0E;IAC1E,qEAAqE;IACrE,kEAAkE;IAClE,oDAAoD;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC;IACvD,wBAAwB,CACtB,UAAU,IAAI,EAAE,EAChB,+FAA+F,CAChG,CAAC;IACF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,GAA4B,CAAC;YACvC,OAAO,CAAC;gBACN,IAAI,EAAE,GAAG;gBACT,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,iBAAiB,CAAC,CAAC,OAAO,EAAE;gBACpC,MAAM,EAAE,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAC3B,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YACrC,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YACrC,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,GAA4B,CAAC;YACvC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACvF,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAgBD,qEAAqE;AACrE,qDAAqD;AACrD,SAAS,WAAW,CAAC,IAAyB;IAC5C,MAAM,GAAG,GAAwB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAC3D,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IAC5D,IAAI,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrE,OAAO,GAAG,CAAC;AACb,CAAC;AAgBD;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY,EACZ,IAAyB,EACzB,OAA6B,EAAE;IAE/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,iBAAiB,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;IACpF,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,uCAAuC,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5G,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,8BAA8B,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACtG,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,OAA6B,EAAE;IAE/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,iBAAiB,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5E,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,qCAAqC,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1G,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,4BAA4B,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACpG,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAwB;IACxD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kCAAkC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrG,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,OAA6B,EAAE;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,iBAAiB,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;IACtD,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IACD,iEAAiE;IACjE,+DAA+D;IAC/D,mEAAmE;IACnE,sBAAsB;IACtB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACrE,CAAC;AAYD,SAAS,cAAc,CAAC,MAAc;IACpC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG;YACN,OAAO,WAAW,CAAC;QACrB,KAAK,GAAG;YACN,OAAO,QAAQ,CAAC;QAClB,KAAK,GAAG;YACN,OAAO,sBAAsB,CAAC;QAChC;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,oEAAoE;AACpE,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,sEAAsE;AACtE,MAAM,YAAY,GAAG,8BAA8B,CAAC;AAEpD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC;YACX,IAAI;YACJ,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE;YACxB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACrB,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC;YAC9B,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA6B,EAAE;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,iBAAiB,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,mCAAmC,SAAS,IAAI,EAAE,CAAC;IACvG,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,0BAA0B,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC1G,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,wEAAwE;AACxE,qEAAqE;AACrE,wEAAwE;AAExE,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAmC,EAAE;IACjF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,SAAS,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC3C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACnE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,CAAC;AAC1D,CAAC;AAOD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CAAC,YAAoB;IACzD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAA4B,CAAC;QACvC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC7D,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,YAAY,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;IAC7E,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,uBAAwB,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,uBAAuB,EAAE,CAAC;IACxE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,sCAAsC,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,mEAAmE;AACnE,qEAAqE;AACrE,6DAA6D;AAC7D,SAAS,UAAU,CAAC,QAAiB,EAAE,OAA4B;IACjE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE1D,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAE,QAAQ,CAAC,MAAM,CAAe,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;IACvC,IAAI,YAAY,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC7D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACvD,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAE,QAAQ,CAAC,KAAK,CAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;IACrC,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,eAAe,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACnE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,CAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAkGD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAA6B;IAClE,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY,IAAI,6BAA6B,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/F,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAyB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IACtF,MAAM,OAAO,GAAyB,EAAE,CAAC;IAEzC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAE,CAAC;QAEjC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC7D,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3C,SAAS;QACX,CAAC;QAED,IAAI,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACvC,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACjE,uEAAuE;YACvE,sEAAsE;YACtE,gEAAgE;YAChE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,EAAwB,CAAC;IAC7B,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACxD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;YAC1C,iEAAiE;YACjE,4DAA4D;YAC5D,mEAAmE;YACnE,6DAA6D;YAC7D,WAAW;YACX,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;iBACrC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;iBAC5D,IAAI,EAAE,CAAC;YACV,MAAM,SAAS,GAAqB,EAAE,CAAC;YACvC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACrD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;oBACjE,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;gBACtD,CAAC;qBAAM,CAAC;oBACN,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC;YACD,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACxE,CAAC;AAYD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAiC,EACjC,UAA6B;IAE7B,MAAM,UAAU,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1B,kEAAkE;QAClE,iEAAiE;QACjE,4BAA4B;QAC5B,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAClC,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACrB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IACxC,CAAC;IAED,mEAAmE;IACnE,qEAAqE;IACrE,MAAM,GAAG,GAA4B,EAAE,GAAG,QAAQ,EAAE,CAAC;IACrD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;AACzD,CAAC"}

package/dist/policies/ledger-client.d.ts

@@ -42,6 +42,19 @@ export interface LedgerSessionQuery {
     sessionId: string;
     sinceIso?: string;
     contentPrefix?: string;
+    /**
+     * Optional per-call override of the session's `timeoutMs` (task
+     * 2026-07-18 subprocess-test-deflake, T-003). Applies only to this
+     * call's `ledger_summary` round-trip (the `tools/list` capability
+     * probe, only run when `sinceIso`/`contentPrefix` is set, still uses
+     * the session default). Omitted, behaviour is byte-for-byte identical
+     * to before this option existed: the session's own `timeoutMs` is
+     * used. A timeout on an overridden call still sets the session-wide
+     * latch exactly like a timeout on the session default would — see
+     * `LedgerSession.callTool`'s `options.timeoutMs` doc for the shared
+     * latch contract and the enforcement-path cost-bound caveat.
+     */
+    timeoutMs?: number;
 }
 /**
  * Result of a generic `LedgerSession.callTool` round-trip. Three-way so a
@@ -73,7 +86,27 @@ export type LedgerSessionCallResult = {
  */
 export interface LedgerSession {
     querySummary(query: LedgerSessionQuery): Promise<LedgerQueryResult>;
-    callTool(name: string, args: Record<string, unknown>): Promise<LedgerSessionCallResult>;
+    /**
+     * `options.timeoutMs` (task 2026-07-18 subprocess-test-deflake, T-003)
+     * is an optional per-call override of the session's `timeoutMs` for
+     * THIS call only; every other call on the session keeps using the
+     * session default. Omitted, behaviour is byte-for-byte identical to
+     * before this option existed. Fail-open/degrade semantics and the
+     * session-wide timeout latch are unchanged either way: a timeout on an
+     * overridden call latches the session exactly like a timeout on the
+     * session default does — every subsequent call (on this session, with
+     * or without its own override) short-circuits to `degraded` without a
+     * new round-trip.
+     *
+     * Cost-bound caveat (OKF gate-fail-posture-matrix): the latch's promise
+     * that a dead ledger costs a session at most ~1× its `timeoutMs` holds
+     * only while per-call overrides on the enforcement critical path stay
+     * ≤ the session default. The override exists for tests and non-critical
+     * callers; do not pass a LARGER override on the PreToolUse gate path.
+     */
+    callTool(name: string, args: Record<string, unknown>, options?: {
+        timeoutMs?: number;
+    }): Promise<LedgerSessionCallResult>;
     dispose(): void;
 }
 export declare function openLedgerSession(opts: LedgerClientOptions): LedgerSession;