@mcpcloud/cli 0.3.0 → 0.4.0

package/dist/index.js

@@ -4151,9 +4151,83 @@ async function confirmUnset(bindingName, serverId) {
   return ch === "y";
 }
 
+// src/commands/servers-export.ts
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, isAbsolute, join as join4, resolve as resolve2 } from "node:path";
+function formatBytes(bytes) {
+  if (bytes < 1024)
+    return `${bytes} B`;
+  if (bytes < 1024 * 1024)
+    return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+function assertSafeRelativePath(path) {
+  if (isAbsolute(path) || path.split(/[\\/]/).includes("..")) {
+    throw new Error(`Refusing to write unsafe bundle path: ${path}`);
+  }
+}
+async function downloadTar(downloadPath) {
+  requireApiKey();
+  const url = new URL(downloadPath, getBaseUrl());
+  const res = await fetch(url.toString(), {
+    headers: { Authorization: `Bearer ${getApiKey()}` }
+  });
+  if (!res.ok) {
+    throw new Error(`Bundle download failed (${res.status}).`);
+  }
+  return new Uint8Array(await res.arrayBuffer());
+}
+function registerServerExportCommands(servers) {
+  servers.command("export <serverId>").description("Export a self-host bundle (Dockerfile + node entry + config) for a server").option("--org <organizationId>", "Organization ID").requiredOption("--project <projectId>", "Project ID").option("--output <dir>", "Write the bundle files to a directory (default: ./<slug>)").option("--tar [file]", "Download the bundle as a single .tar instead").addHelpText("after", [
+    "",
+    "Examples:",
+    "  # Write the bundle into a directory and run it:",
+    "  $ mcp servers export srv_123 --project prj_123 --output ./my-server",
+    "  $ cd ./my-server && docker compose up --build",
+    "",
+    "  # Download a single .tar:",
+    "  $ mcp servers export srv_123 --project prj_123 --tar my-server.tar"
+  ].join(`
+`)).action(runAction(async (serverId, opts) => {
+    const organizationId = await resolveOrgId(opts.org);
+    const result = await api.post("/api/v1/server/self-host-export", { organizationId, projectId: opts.project, serverId });
+    const summary = {
+      artifactId: result.artifactId,
+      downloadPath: result.downloadPath,
+      fileCount: result.fileCount,
+      byteSize: result.byteSize,
+      server: result.server
+    };
+    if (opts.tar !== undefined) {
+      const tarPath = resolve2(typeof opts.tar === "string" ? opts.tar : `${result.server.slug}.tar`);
+      writeFileSync2(tarPath, await downloadTar(result.downloadPath));
+      if (isJsonMode()) {
+        printJson({ ...summary, output: tarPath });
+        return;
+      }
+      printSuccess(`Downloaded self-host bundle (${result.fileCount} files, ${formatBytes(result.byteSize)}) to ${tarPath}.`);
+      printKeyValue({ Unpack: `tar xf ${tarPath} && docker compose up --build` });
+      return;
+    }
+    const dir = resolve2(opts.output ?? `./${result.server.slug}`);
+    for (const file of result.files) {
+      assertSafeRelativePath(file.path);
+      const full = join4(dir, file.path);
+      mkdirSync3(dirname2(full), { recursive: true });
+      writeFileSync2(full, file.content);
+    }
+    if (isJsonMode()) {
+      printJson({ ...summary, output: dir });
+      return;
+    }
+    printSuccess(`Exported ${result.fileCount} files (${formatBytes(result.byteSize)}) to ${dir}.`);
+    printKeyValue({ "Run it": `cd ${dir} && docker compose up --build` });
+  }));
+}
+
 // src/commands/servers-lifecycle.ts
 import { existsSync as existsSync5 } from "node:fs";
-import { isAbsolute, resolve as resolve2 } from "node:path";
+import { isAbsolute as isAbsolute2, resolve as resolve3 } from "node:path";
 
 // src/lib/dev/spec-watcher.ts
 import { createHash as createHash2 } from "node:crypto";
@@ -4162,7 +4236,7 @@ import {
   readFileSync as readFileSync4,
   watch as fsWatch
 } from "node:fs";
-import { dirname as dirname2 } from "node:path";
+import { dirname as dirname3 } from "node:path";
 async function regenerateDevBundle(args) {
   try {
     const response = await api.post("/api/v1/server/dev-bundle", {
@@ -4221,7 +4295,7 @@ function watchSpecFile(options) {
   let lastHash = null;
   let pendingTimer = null;
   let closed = false;
-  const dir = dirname2(options.specPath);
+  const dir = dirname3(options.specPath);
   const baseName = options.specPath.slice(dir.length + 1);
   const fire = () => {
     if (closed)
@@ -4398,7 +4472,7 @@ function registerServerLifecycleCommands(servers) {
   ].join(`
 `)).action(runAction(async (serverId, opts) => {
     const cwd = process.cwd();
-    const specPath = isAbsolute(opts.spec) ? opts.spec : resolve2(cwd, opts.spec);
+    const specPath = isAbsolute2(opts.spec) ? opts.spec : resolve3(cwd, opts.spec);
     if (!existsSync5(specPath)) {
       throw new Error(`Spec file not found: ${specPath}`);
     }
@@ -4904,6 +4978,7 @@ function registerServerTestCommands(servers) {
 function registerServerCommands(program2) {
   const servers = program2.command("servers").description("Manage MCP servers");
   registerServerEnvCommands(servers);
+  registerServerExportCommands(servers);
   registerServerLifecycleCommands(servers);
   registerServerMutationCommands(servers);
   registerServerTestCommands(servers);
@@ -5093,31 +5168,35 @@ import { relative } from "node:path";
 // src/lib/dev/handlers-sync.ts
 import {
   existsSync as existsSync8,
-  mkdirSync as mkdirSync5,
+  mkdirSync as mkdirSync6,
   readFileSync as readFileSync7,
   statSync,
-  writeFileSync as writeFileSync4
+  writeFileSync as writeFileSync5
 } from "node:fs";
 import { createHash as createHash3 } from "node:crypto";
-import { dirname as dirname3, join as join6 } from "node:path";
+import { dirname as dirname4, join as join7 } from "node:path";
 
 // src/lib/dev/state.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join4, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join5, resolve as resolve4 } from "node:path";
 function devRoot(cwd) {
-  return join4(cwd, ".mcpcloud");
+  return join5(cwd, ".mcpcloud");
 }
 function stateFile(cwd) {
-  return join4(devRoot(cwd), "state.json");
+  return join5(devRoot(cwd), "state.json");
 }
 function serverDir(cwd) {
-  return join4(devRoot(cwd), "server");
+  return join5(devRoot(cwd), "server");
+}
+function gitCloneDir(cwd, owner, name) {
+  const safe = `${owner}__${name}`.replace(/[^a-zA-Z0-9._-]/g, "-");
+  return join5(devRoot(cwd), "git", safe);
 }
 function envFile(cwd) {
-  return join4(devRoot(cwd), "env.json");
+  return join5(devRoot(cwd), "env.json");
 }
 function backupsDir(cwd) {
-  return join4(devRoot(cwd), "agent-backups");
+  return join5(devRoot(cwd), "agent-backups");
 }
 function readState(cwd) {
   const path = stateFile(cwd);
@@ -5138,20 +5217,21 @@ function readState(cwd) {
 }
 function writeState(cwd, state) {
   if (!existsSync6(devRoot(cwd))) {
-    mkdirSync3(devRoot(cwd), { recursive: true });
+    mkdirSync4(devRoot(cwd), { recursive: true });
   }
-  writeFileSync2(stateFile(cwd), JSON.stringify(state, null, 2), "utf-8");
+  writeFileSync3(stateFile(cwd), JSON.stringify(state, null, 2), "utf-8");
 }
 function ensureGitignore(cwd) {
-  const ignoreFile = join4(devRoot(cwd), ".gitignore");
+  const ignoreFile = join5(devRoot(cwd), ".gitignore");
   if (existsSync6(ignoreFile))
     return;
   if (!existsSync6(devRoot(cwd))) {
-    mkdirSync3(devRoot(cwd), { recursive: true });
+    mkdirSync4(devRoot(cwd), { recursive: true });
   }
-  writeFileSync2(ignoreFile, [
+  writeFileSync3(ignoreFile, [
     "# generated by `mcp dev`",
     "server/",
+    "git/",
     "env.json",
     "agent-backups/",
     "inspector/",
@@ -5163,13 +5243,13 @@ function ensureGitignore(cwd) {
 // src/lib/dev/tools-sync.ts
 import {
   existsSync as existsSync7,
-  mkdirSync as mkdirSync4,
+  mkdirSync as mkdirSync5,
   readFileSync as readFileSync6,
   readdirSync,
   rmSync,
-  writeFileSync as writeFileSync3
+  writeFileSync as writeFileSync4
 } from "node:fs";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 var TOOLS_DIR_NAME = "tools";
 var RISK_CLASSES = [
   "read",
@@ -5178,10 +5258,10 @@ var RISK_CLASSES = [
   "external_effect"
 ];
 function toolsDir(devRootDir) {
-  return join5(devRootDir, TOOLS_DIR_NAME);
+  return join6(devRootDir, TOOLS_DIR_NAME);
 }
 function serverToolsDir(devRootDir, serverId) {
-  return join5(toolsDir(devRootDir), serverId);
+  return join6(toolsDir(devRootDir), serverId);
 }
 function escapeFrontmatterScalar(raw) {
   if (raw === "")
@@ -5371,7 +5451,7 @@ function arraysEqual(a, b) {
 }
 var STATE_FILE = ".tools-state.json";
 function toolsStateFile(devRootDir, serverId) {
-  return join5(serverToolsDir(devRootDir, serverId), STATE_FILE);
+  return join6(serverToolsDir(devRootDir, serverId), STATE_FILE);
 }
 function readToolsState(devRootDir, serverId) {
   const file = toolsStateFile(devRootDir, serverId);
@@ -5393,8 +5473,8 @@ function readToolsState(devRootDir, serverId) {
 function writeToolsState(devRootDir, state) {
   const dir = serverToolsDir(devRootDir, state.serverId);
   if (!existsSync7(dir))
-    mkdirSync4(dir, { recursive: true });
-  writeFileSync3(toolsStateFile(devRootDir, state.serverId), JSON.stringify(state, null, 2), "utf-8");
+    mkdirSync5(dir, { recursive: true });
+  writeFileSync4(toolsStateFile(devRootDir, state.serverId), JSON.stringify(state, null, 2), "utf-8");
 }
 function hashLocalView(view) {
   return JSON.stringify({
@@ -5407,13 +5487,13 @@ function hashLocalView(view) {
 function materializeTools(args) {
   const dir = serverToolsDir(args.devRootDir, args.serverId);
   if (!existsSync7(dir))
-    mkdirSync4(dir, { recursive: true });
+    mkdirSync5(dir, { recursive: true });
   const kept = new Set;
   let filesWritten = 0;
   for (const tool of args.tools) {
     const filename = `${tool.name}.md`;
     kept.add(filename);
-    writeFileSync3(join5(dir, filename), renderToolMarkdown(tool), "utf-8");
+    writeFileSync4(join6(dir, filename), renderToolMarkdown(tool), "utf-8");
     filesWritten += 1;
   }
   let filesRemoved = 0;
@@ -5425,7 +5505,7 @@ function materializeTools(args) {
     if (kept.has(entry))
       continue;
     try {
-      rmSync(join5(dir, entry), { force: true });
+      rmSync(join6(dir, entry), { force: true });
       filesRemoved += 1;
     } catch {}
   }
@@ -5451,7 +5531,7 @@ function materializeTools(args) {
   return { filesWritten, filesRemoved };
 }
 function readLocalTool(devRootDir, serverId, toolName) {
-  const filePath = join5(serverToolsDir(devRootDir, serverId), `${toolName}.md`);
+  const filePath = join6(serverToolsDir(devRootDir, serverId), `${toolName}.md`);
   if (!existsSync7(filePath))
     return null;
   const state = readToolsState(devRootDir, serverId);
@@ -5488,7 +5568,7 @@ async function pushLocalToolEdit(args) {
     };
   }
   if (!local) {
-    const filePath = join5(serverToolsDir(args.devRootDir, args.serverId), `${args.toolName}.md`);
+    const filePath = join6(serverToolsDir(args.devRootDir, args.serverId), `${args.toolName}.md`);
     if (!existsSync7(filePath))
       return { kind: "missing-file" };
     return { kind: "unknown-tool" };
@@ -5572,7 +5652,7 @@ function toKebabSlug(value) {
   return value.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/[^a-zA-Z0-9]+/g, "-").replace(/^-+|-+$/g, "").toLowerCase() || "generated-mcp-server";
 }
 function serverBundleHandlersDir(devRootDir) {
-  return join6(devRootDir, "server", "src", "tools");
+  return join7(devRootDir, "server", "src", "tools");
 }
 function handlerSlugFromWatcherPath(rel) {
   if (!rel)
@@ -5601,7 +5681,7 @@ function hashSource(source) {
 }
 var lastPushedHash = new Map;
 async function pushLocalHandlerEdit(args) {
-  const filePath = join6(serverBundleHandlersDir(args.devRootDir), `${args.slug}.ts`);
+  const filePath = join7(serverBundleHandlersDir(args.devRootDir), `${args.slug}.ts`);
   if (!existsSync8(filePath)) {
     return { kind: "missing-file" };
   }
@@ -5753,9 +5833,9 @@ async function resetCloudHandler(args) {
   }
 }
 function writeLocalHandlerFromCloud(args) {
-  const filePath = join6(serverBundleHandlersDir(args.devRootDir), `${args.slug}.ts`);
-  mkdirSync5(dirname3(filePath), { recursive: true });
-  writeFileSync4(filePath, args.content, "utf-8");
+  const filePath = join7(serverBundleHandlersDir(args.devRootDir), `${args.slug}.ts`);
+  mkdirSync6(dirname4(filePath), { recursive: true });
+  writeFileSync5(filePath, args.content, "utf-8");
   lastPushedHash.set(filePath, hashSource(args.content));
   return filePath;
 }
@@ -5764,7 +5844,7 @@ function handlerSlugFromToolName(toolName) {
 }
 var RECENT_EDIT_WINDOW_MS = 5 * 60 * 1000;
 function inspectLocalHandler(args) {
-  const filePath = join6(serverBundleHandlersDir(args.devRootDir), `${args.slug}.ts`);
+  const filePath = join7(serverBundleHandlersDir(args.devRootDir), `${args.slug}.ts`);
   if (!existsSync8(filePath))
     return { kind: "no-local-file" };
   const cached2 = lastPushedHash.get(filePath);
@@ -6066,13 +6146,13 @@ function renderBool(value) {
 
 // src/commands/tools-edit.ts
 import { existsSync as existsSync11 } from "node:fs";
-import { join as join8, relative as relative2 } from "node:path";
+import { join as join9, relative as relative2 } from "node:path";
 
 // src/lib/editor-shell.ts
 import { spawn as spawn2 } from "node:child_process";
 import { existsSync as existsSync10, readFileSync as readFileSync9 } from "node:fs";
 import { platform as platform2 } from "node:os";
-import { delimiter, join as join7 } from "node:path";
+import { delimiter, join as join8 } from "node:path";
 var DEFAULT_FALLBACKS = ["vi"];
 function isExecutableFile(path) {
   try {
@@ -6093,7 +6173,7 @@ function findOnPath(command) {
     if (!dir)
       continue;
     for (const ext of exts) {
-      const candidate = join7(dir, command + ext);
+      const candidate = join8(dir, command + ext);
       if (isExecutableFile(candidate))
         return candidate;
     }
@@ -6114,10 +6194,10 @@ function resolveEditorCommand(args) {
   return { command: DEFAULT_FALLBACKS[0], source: "fallback" };
 }
 function defaultRun(cmd, args) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const child = spawn2(cmd, args, { stdio: "inherit" });
     child.on("error", (err) => reject(err));
-    child.on("exit", (code) => resolve4(code ?? 0));
+    child.on("exit", (code) => resolve5(code ?? 0));
   });
 }
 async function runEditor(args) {
@@ -6129,8 +6209,8 @@ async function runEditor(args) {
     };
   }
   const { command } = resolveEditorCommand({ command: args.command });
-  const resolve4 = args.resolveCommand ?? findOnPath;
-  const resolved = resolve4(command);
+  const resolve5 = args.resolveCommand ?? findOnPath;
+  const resolved = resolve5(command);
   if (!resolved) {
     return {
       ok: false,
@@ -6189,7 +6269,7 @@ async function runToolsEdit(args) {
   if (!ctx)
     return;
   const cwd = process.cwd();
-  const filePath = join8(serverToolsDir(devRoot(cwd), ctx.serverId), `${args.toolName}.md`);
+  const filePath = join9(serverToolsDir(devRoot(cwd), ctx.serverId), `${args.toolName}.md`);
   if (!existsSync11(filePath)) {
     printError(`Tool file not found: ${relative2(cwd, filePath)}`);
     printInfo(`  ${c.dim("Run")} ${c.bold(`mcp tools pull ${args.toolName}`)} ${c.dim("first to materialize it, or check the name is spelled correctly.")}`);
@@ -7531,13 +7611,13 @@ function registerSkillTestCommands(skills) {
 
 // src/commands/skills.ts
 async function runClaudeMcpAdd(connectionName, mcpUrl) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const child = spawn3("claude", ["mcp", "add", "--transport", "http", connectionName, mcpUrl], {
       stdio: "inherit",
       shell: false
     });
-    child.on("error", () => resolve4(127));
-    child.on("exit", (code) => resolve4(code ?? 1));
+    child.on("error", () => resolve5(127));
+    child.on("exit", (code) => resolve5(code ?? 1));
   });
 }
 function registerSkillCommands(program2) {
@@ -7854,9 +7934,9 @@ function registerApiKeyCommands(program2) {
 
 // src/commands/config.ts
 import { homedir as homedir2 } from "node:os";
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 function configFilePath() {
-  return join9(homedir2(), ".mcpcloud", "config.json");
+  return join10(homedir2(), ".mcpcloud", "config.json");
 }
 function previewKey2(key) {
   if (!key)
@@ -8097,12 +8177,12 @@ function registerConfigCommands(program2) {
 }
 
 // src/commands/dev.ts
-import { existsSync as existsSync31 } from "node:fs";
-import { isAbsolute as isAbsolute2, relative as relative7, resolve as resolve6 } from "node:path";
+import { existsSync as existsSync32 } from "node:fs";
+import { isAbsolute as isAbsolute3, relative as relative7, resolve as resolve7 } from "node:path";
 
 // src/lib/mcp-invoke.ts
 import { existsSync as existsSync12, readFileSync as readFileSync10 } from "node:fs";
-import { resolve as resolve4 } from "node:path";
+import { resolve as resolve5 } from "node:path";
 var DEFAULT_TIMEOUT_MS3 = 60000;
 var invokeRequestId = 1;
 async function invokeMcpTool(args) {
@@ -8239,7 +8319,7 @@ async function parseToolArguments(opts) {
     const reader = opts.readStdin ?? defaultStdinReader;
     source = await reader();
   } else if (raw.startsWith("@")) {
-    const filePath = resolve4(opts.cwd ?? process.cwd(), raw.slice(1));
+    const filePath = resolve5(opts.cwd ?? process.cwd(), raw.slice(1));
     if (!existsSync12(filePath)) {
       return { ok: false, reason: "file-not-found", path: filePath };
     }
@@ -8320,29 +8400,29 @@ function truncateJsonPreview(value) {
 // src/lib/dev/sessions.ts
 import {
   existsSync as existsSync13,
-  mkdirSync as mkdirSync6,
+  mkdirSync as mkdirSync7,
   readFileSync as readFileSync11,
   readdirSync as readdirSync2,
   unlinkSync,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync6
 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 var SESSIONS_DIR_NAME = "dev-sessions";
 function sessionsDir() {
-  return join10(homedir3(), ".mcpcloud", SESSIONS_DIR_NAME);
+  return join11(homedir3(), ".mcpcloud", SESSIONS_DIR_NAME);
 }
 function sessionFile(pid) {
-  return join10(sessionsDir(), `${pid}.json`);
+  return join11(sessionsDir(), `${pid}.json`);
 }
 function ensureDir() {
   const dir = sessionsDir();
   if (!existsSync13(dir))
-    mkdirSync6(dir, { recursive: true, mode: 448 });
+    mkdirSync7(dir, { recursive: true, mode: 448 });
 }
 function recordSession(record) {
   ensureDir();
-  writeFileSync5(sessionFile(record.pid), JSON.stringify(record, null, 2), {
+  writeFileSync6(sessionFile(record.pid), JSON.stringify(record, null, 2), {
     encoding: "utf-8",
     mode: 384
   });
@@ -8363,7 +8443,7 @@ function listSessions() {
   for (const entry of readdirSync2(dir)) {
     if (!entry.endsWith(".json"))
       continue;
-    const path = join10(dir, entry);
+    const path = join11(dir, entry);
     try {
       const parsed = JSON.parse(readFileSync11(path, "utf-8"));
       if (typeof parsed.pid !== "number") {
@@ -8558,27 +8638,27 @@ function invokeResultToJson(result) {
 import {
   appendFileSync as appendFileSync2,
   existsSync as existsSync14,
-  mkdirSync as mkdirSync7,
+  mkdirSync as mkdirSync8,
   readFileSync as readFileSync12,
   readdirSync as readdirSync3,
   renameSync,
   statSync as statSync2
 } from "node:fs";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 var INSPECTOR_DIRNAME = "inspector";
 var ACTIVE_FILE = "calls.ndjson";
 var ROTATED_PREFIX = "calls.";
 var ROTATED_SUFFIX = ".ndjson";
 var ROTATION_LIMIT_BYTES = 50 * 1024 * 1024;
 function inspectorDir(cwd) {
-  return join11(devRoot(cwd), INSPECTOR_DIRNAME);
+  return join12(devRoot(cwd), INSPECTOR_DIRNAME);
 }
 function ensureInspectorDir(dir) {
   if (!existsSync14(dir))
-    mkdirSync7(dir, { recursive: true });
+    mkdirSync8(dir, { recursive: true });
 }
 function activeFilePath(dir) {
-  return join11(dir, ACTIVE_FILE);
+  return join12(dir, ACTIVE_FILE);
 }
 function isRotatedName(name) {
   return name !== ACTIVE_FILE && name.startsWith(ROTATED_PREFIX) && name.endsWith(ROTATED_SUFFIX);
@@ -8588,7 +8668,7 @@ function listRotatedFiles(dir) {
     return [];
   const rotated = readdirSync3(dir).filter(isRotatedName);
   rotated.sort();
-  return rotated.map((n) => join11(dir, n));
+  return rotated.map((n) => join12(dir, n));
 }
 function parseLines(text) {
   if (!text)
@@ -8813,7 +8893,7 @@ import {
   closeSync,
   statSync as statSync3
 } from "node:fs";
-import { join as join12 } from "node:path";
+import { join as join13 } from "node:path";
 var DEFAULT_INTERVAL_MS = 250;
 var MAX_READ_CHUNK = 64 * 1024;
 function registerDevTailCommand(dev) {
@@ -8822,7 +8902,7 @@ function registerDevTailCommand(dev) {
 async function runDevTail(opts) {
   const cwd = process.cwd();
   const dir = inspectorDir(cwd);
-  const activePath = join12(dir, ACTIVE_FILE);
+  const activePath = join13(dir, ACTIVE_FILE);
   const intervalMs = parseInterval(opts.intervalMs);
   if (!existsSync15(dir)) {
     printInfo(`No inspector history yet at ${dir}. Run \`mcp dev\` to start capturing.`);
@@ -8930,7 +9010,7 @@ function emitLines(text, filter) {
   }
 }
 function sleep(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
+  return new Promise((resolve6) => setTimeout(resolve6, ms));
 }
 
 // ../../node_modules/.bun/@clack+core@1.3.1/node_modules/@clack/core/dist/index.mjs
@@ -9556,6 +9636,24 @@ var Q = class extends m {
     }
   }
 };
+
+class X extends m {
+  get cursor() {
+    return this.value ? 0 : 1;
+  }
+  get _value() {
+    return this.cursor === 0;
+  }
+  constructor(t) {
+    super(t, false), this.value = !!t.initialValue, this.on("userInput", () => {
+      this.value = this._value;
+    }), this.on("confirm", (s) => {
+      this.output.write(import_sisteransi.cursor.move(0, -1)), this.value = s, this.state = "submit", this.close();
+    }), this.on("cursor", () => {
+      this.value = !this.value;
+    });
+  }
+}
 var Z = { Y: { type: "year", len: 4 }, M: { type: "month", len: 2 }, D: { type: "day", len: 2 } };
 function P(r) {
   return [...r].map((t) => Z[t]);
@@ -9992,6 +10090,33 @@ var F2 = ({ cursor: t, options: i, style: s, output: r = process.stdout, maxItem
       S2.push(G2);
   return h2 && S2.push(l), S2;
 };
+var ue = (t) => {
+  const i = t.active ?? "Yes", s = t.inactive ?? "No";
+  return new X({ active: i, inactive: s, signal: t.signal, input: t.input, output: t.output, initialValue: t.initialValue ?? true, render() {
+    const r = t.withGuide ?? h.withGuide, u = `${P2(this.state)}  `, n = r ? `${e("gray", $2)}  ` : "", a = W(t.output, t.message, n, u), c2 = `${r ? `${e("gray", $2)}
+` : ""}${a}
+`, o = this.value ? i : s;
+    switch (this.state) {
+      case "submit": {
+        const l = r ? `${e("gray", $2)}  ` : "";
+        return `${c2}${l}${e("dim", o)}`;
+      }
+      case "cancel": {
+        const l = r ? `${e("gray", $2)}  ` : "";
+        return `${c2}${l}${e(["strikethrough", "dim"], o)}${r ? `
+${e("gray", $2)}` : ""}`;
+      }
+      default: {
+        const l = r ? `${e("cyan", $2)}  ` : "", d = r ? e("cyan", x2) : "";
+        return `${c2}${l}${this.value ? `${e("green", z2)} ${i}` : `${e("dim", U2)} ${e("dim", i)}`}${t.vertical ? r ? `
+${e("cyan", $2)}  ` : `
+` : ` ${e("dim", "/")} `}${this.value ? `${e("dim", U2)} ${e("dim", s)}` : `${e("green", z2)} ${s}`}
+${d}
+`;
+      }
+    }
+  } }).prompt();
+};
 var me = (t = "", i) => {
   const s = i?.output ?? process.stdout, r = i?.withGuide ?? h.withGuide ? `${e("gray", x2)}  ` : "";
   s.write(`${r}${e("red", t)}
@@ -10092,6 +10217,18 @@ async function resolveDevTarget(deps) {
     }
   };
 }
+async function promptResumeOrSwitch(args) {
+  const label = args.serverName ? `${args.serverName} ${c.dim(`(${args.serverId})`)}` : args.serverId;
+  const resume = await ue({
+    message: `Resume ${label}?`,
+    active: "Resume",
+    inactive: "Pick a different server",
+    initialValue: true
+  });
+  if (q(resume))
+    return "cancel";
+  return resume ? "resume" : "switch";
+}
 function canRunInteractive() {
   if (isCiMode())
     return false;
@@ -10160,12 +10297,12 @@ async function runInteractiveBootstrap() {
 // src/lib/dev/bundle-sync.ts
 import {
   existsSync as existsSync16,
-  mkdirSync as mkdirSync8,
+  mkdirSync as mkdirSync9,
   readFileSync as readFileSync13,
   rmSync as rmSync2,
-  writeFileSync as writeFileSync6
+  writeFileSync as writeFileSync7
 } from "node:fs";
-import { dirname as dirname4, join as join13 } from "node:path";
+import { dirname as dirname5, join as join14 } from "node:path";
 async function resolveServerProject(args) {
   const data = await api.get("/api/v1/server", {
     organizationId: args.organizationId,
@@ -10177,6 +10314,20 @@ async function resolveServerProject(args) {
     version: data.server.version
   };
 }
+async function resolveServerGitLink(args) {
+  const data = await api.get("/api/v1/server/git-link", {
+    organizationId: args.organizationId,
+    serverId: args.serverId
+  });
+  return data.gitLink ?? null;
+}
+async function resolveServerGitPullStatus(args) {
+  const data = await api.get("/api/v1/server/git-sync-status", {
+    organizationId: args.organizationId,
+    serverId: args.serverId
+  });
+  return data.pull ?? null;
+}
 async function fetchBundle(args) {
   requireApiKey();
   const url = new URL("/api/v1/artifacts/download", getBaseUrl());
@@ -10208,7 +10359,7 @@ async function fetchBundle(args) {
 }
 function materializeBundle(destDir, bundle, options = {}) {
   if (!existsSync16(destDir)) {
-    mkdirSync8(destDir, { recursive: true });
+    mkdirSync9(destDir, { recursive: true });
   }
   const preserve = options.preservePaths;
   const kept = new Set;
@@ -10223,9 +10374,9 @@ function materializeBundle(destDir, bundle, options = {}) {
       preservedCount += 1;
       continue;
     }
-    const target = join13(destDir, safePath);
-    mkdirSync8(dirname4(target), { recursive: true });
-    writeFileSync6(target, file.content, "utf-8");
+    const target = join14(destDir, safePath);
+    mkdirSync9(dirname5(target), { recursive: true });
+    writeFileSync7(target, file.content, "utf-8");
     writtenCount += 1;
   }
   let removed = 0;
@@ -10253,7 +10404,7 @@ function pruneStaleFiles(rootDir, currentDir, kept) {
   const { relative: relative6 } = __require("node:path");
   let removed = 0;
   for (const entry of readdirSync4(currentDir)) {
-    const abs = join13(currentDir, entry);
+    const abs = join14(currentDir, entry);
     const stat = statSync4(abs);
     if (stat.isDirectory()) {
       removed += pruneStaleFiles(rootDir, abs, kept);
@@ -10274,10 +10425,53 @@ function pruneStaleFiles(rootDir, currentDir, kept) {
   return removed;
 }
 
+// src/lib/dev/git-pull-poll.ts
+var DEFAULT_INTERVAL_MS2 = 6000;
+function reducePollState(baseline, status) {
+  if (!status)
+    return { baseline, nudge: false };
+  const sha = status.lastPulledGitSha;
+  if (baseline === undefined)
+    return { baseline: sha, nudge: false };
+  if (sha && sha !== baseline)
+    return { baseline: sha, nudge: true };
+  return { baseline, nudge: false };
+}
+function startGitPullPoll(args) {
+  const intervalMs = args.intervalMs ?? DEFAULT_INTERVAL_MS2;
+  let baseline;
+  let stopped = false;
+  let timer = null;
+  const tick = async () => {
+    if (stopped)
+      return;
+    try {
+      const status = await args.fetchStatus();
+      const next = reducePollState(baseline, status);
+      baseline = next.baseline;
+      if (next.nudge && status)
+        args.onChange(status);
+    } catch (err) {
+      args.onError?.(err);
+    } finally {
+      if (!stopped)
+        timer = setTimeout(() => void tick(), intervalMs);
+    }
+  };
+  tick();
+  return {
+    close() {
+      stopped = true;
+      if (timer)
+        clearTimeout(timer);
+    }
+  };
+}
+
 // src/lib/dev/editor.ts
 import { spawn as spawn4 } from "node:child_process";
 import { existsSync as existsSync17, statSync as statSync4 } from "node:fs";
-import { delimiter as delimiter2, join as join14 } from "node:path";
+import { delimiter as delimiter2, join as join15 } from "node:path";
 import { platform as platform3 } from "node:os";
 var TARGET_LABEL = {
   tools: "tool metadata",
@@ -10313,7 +10507,7 @@ function findOnPath2(command) {
     if (!dir)
       continue;
     for (const ext of exts) {
-      const candidate = join14(dir, command + ext);
+      const candidate = join15(dir, command + ext);
       if (existsSync17(candidate) && isExecutable(candidate))
         return candidate;
     }
@@ -10595,7 +10789,7 @@ function parseOpenChoice(raw) {
 
 // src/lib/dev/file-watcher.ts
 import { existsSync as existsSync18, statSync as statSync5, watch as fsWatch2 } from "node:fs";
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 var DEFAULT_IGNORE = ["node_modules", ".git", "_mcpsh_host.mjs"];
 function watchDir(options) {
   if (!existsSync18(options.rootDir)) {
@@ -10634,7 +10828,7 @@ function watchDir(options) {
       for (const entry of readdirSync4(options.rootDir)) {
         if (ignore.has(entry))
           continue;
-        const sub = join15(options.rootDir, entry);
+        const sub = join16(options.rootDir, entry);
         try {
           const stat = statSync5(sub);
           if (!stat.isDirectory())
@@ -10901,7 +11095,7 @@ async function handleOne2(args) {
 // src/lib/dev/local-runtime.ts
 import { spawn as spawn5 } from "node:child_process";
 import { existsSync as existsSync21 } from "node:fs";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 function detectRuntime(preferred = "auto") {
   if (preferred === "bun" || preferred === "node")
     return preferred;
@@ -10938,50 +11132,160 @@ function startRuntime(options) {
       if (child.exitCode !== null)
         return;
       child.kill("SIGTERM");
-      await new Promise((resolve5) => {
+      await new Promise((resolve6) => {
         const timer = setTimeout(() => {
           if (child.exitCode === null)
             child.kill("SIGKILL");
-          resolve5();
+          resolve6();
         }, 3000);
         child.once("exit", () => {
           clearTimeout(timer);
-          resolve5();
+          resolve6();
         });
       });
     }
   };
 }
 async function installDependencies(options) {
-  const pkgPath = join16(options.serverDir, "package.json");
+  const pkgPath = join17(options.serverDir, "package.json");
   if (!existsSync21(pkgPath))
     return { ran: false, exitCode: null };
-  const nodeModules = join16(options.serverDir, "node_modules");
+  const nodeModules = join17(options.serverDir, "node_modules");
   if (options.skipIfPresent !== false && existsSync21(nodeModules)) {
     return { ran: false, exitCode: 0 };
   }
   options.onStep?.("Installing dependencies (bun install)…");
-  return await new Promise((resolve5) => {
+  return await new Promise((resolve6) => {
     const child = spawn5("bun", ["install", "--silent"], {
       cwd: options.serverDir,
       stdio: "inherit"
     });
-    child.on("error", () => resolve5({ ran: true, exitCode: 127 }));
-    child.on("exit", (code) => resolve5({ ran: true, exitCode: code }));
+    child.on("error", () => resolve6({ ran: true, exitCode: 127 }));
+    child.on("exit", (code) => resolve6({ ran: true, exitCode: code }));
   });
 }
 
 // src/lib/dev/prepare.ts
-import { existsSync as existsSync24, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join19, relative as relative6 } from "node:path";
+import { existsSync as existsSync25, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join21, relative as relative6 } from "node:path";
+
+// src/lib/dev/git-clone.ts
+import { spawnSync } from "node:child_process";
+import {
+  existsSync as existsSync22,
+  mkdirSync as mkdirSync10,
+  readFileSync as readFileSync14,
+  writeFileSync as writeFileSync8
+} from "node:fs";
+import { dirname as dirname6, join as join18 } from "node:path";
+
+class GitNotAvailableError extends Error {
+  constructor() {
+    super("git is not installed or not on your PATH. Install Git to use Git-native dev mode.");
+    this.name = "GitNotAvailableError";
+  }
+}
+
+class GitCloneError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "GitCloneError";
+  }
+}
+var GIT_LOCAL_EXCLUDES = [
+  "_mcpsh_*",
+  "node_modules/",
+  "bun.lock"
+];
+var EXCLUDE_HEADER = "# added by `mcp dev` (Git-native mode)";
+function gitCloneArgs(httpsCloneUrl, branch, repoDir) {
+  return [
+    "clone",
+    "--branch",
+    branch,
+    "--single-branch",
+    httpsCloneUrl,
+    repoDir
+  ];
+}
+function gitFetchArgs(branch) {
+  return ["fetch", "--quiet", "origin", branch];
+}
+function mergeLocalExcludes(existing) {
+  const lines = existing.split(`
+`);
+  const present = new Set(lines.map((l) => l.trim()));
+  const missing = GIT_LOCAL_EXCLUDES.filter((pattern) => !present.has(pattern));
+  if (missing.length === 0)
+    return null;
+  const prefix = existing.length > 0 && !existing.endsWith(`
+`) ? `
+` : "";
+  const block = present.has(EXCLUDE_HEADER) ? missing.join(`
+`) : [EXCLUDE_HEADER, ...missing].join(`
+`);
+  return `${existing}${prefix}${block}
+`;
+}
+function runGit(args, cwd) {
+  const res = spawnSync("git", args, {
+    cwd,
+    encoding: "utf-8",
+    stdio: ["inherit", "pipe", "pipe"]
+  });
+  if (res.error && res.error.code === "ENOENT") {
+    throw new GitNotAvailableError;
+  }
+  return {
+    status: res.status ?? 1,
+    stdout: res.stdout ?? "",
+    stderr: res.stderr ?? ""
+  };
+}
+function isGitAvailable() {
+  try {
+    return runGit(["--version"]).status === 0;
+  } catch {
+    return false;
+  }
+}
+function applyLocalExcludes(repoDir) {
+  const excludePath = join18(repoDir, ".git", "info", "exclude");
+  const existing = existsSync22(excludePath) ? readFileSync14(excludePath, "utf-8") : "";
+  const next = mergeLocalExcludes(existing);
+  if (next === null)
+    return;
+  if (!existsSync22(dirname6(excludePath))) {
+    mkdirSync10(dirname6(excludePath), { recursive: true });
+  }
+  writeFileSync8(excludePath, next, "utf-8");
+}
+function ensureClone(opts) {
+  if (!isGitAvailable()) {
+    throw new GitNotAvailableError;
+  }
+  if (existsSync22(join18(opts.repoDir, ".git"))) {
+    opts.onStep?.("Refreshing existing clone (git fetch)…");
+    runGit(gitFetchArgs(opts.branch), opts.repoDir);
+    applyLocalExcludes(opts.repoDir);
+    return { cloned: false };
+  }
+  opts.onStep?.(`Cloning ${opts.httpsCloneUrl} (branch ${opts.branch})…`);
+  const res = runGit(gitCloneArgs(opts.httpsCloneUrl, opts.branch, opts.repoDir));
+  if (res.status !== 0) {
+    throw new GitCloneError(`git clone failed (exit ${res.status}). ${res.stderr.trim() || "Check that you have access to the repository with your local git credentials."}`);
+  }
+  applyLocalExcludes(opts.repoDir);
+  return { cloned: true };
+}
 
 // src/lib/dev/host-runtime.ts
-import { existsSync as existsSync23, mkdirSync as mkdirSync10, writeFileSync as writeFileSync8 } from "node:fs";
-import { dirname as dirname5, join as join18 } from "node:path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync12, writeFileSync as writeFileSync10 } from "node:fs";
+import { dirname as dirname7, join as join20 } from "node:path";
 
 // src/lib/dev/inspector-module.ts
-import { existsSync as existsSync22, mkdirSync as mkdirSync9, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join17 } from "node:path";
+import { existsSync as existsSync23, mkdirSync as mkdirSync11, writeFileSync as writeFileSync9 } from "node:fs";
+import { join as join19 } from "node:path";
 
 // src/lib/dev/inspector-assets.ts
 var INSPECTOR_HTML = `<!doctype html>
@@ -11482,7 +11786,7 @@ function requireReact_production() {
   react_production.useTransition = function() {
     return ReactSharedInternals.H.useTransition();
   };
-  react_production.version = "19.2.6";
+  react_production.version = "19.2.7";
   return react_production;
 }
 var hasRequiredReact;
@@ -11909,7 +12213,7 @@ function requireReactDom_production() {
   reactDom_production.useFormStatus = function() {
     return ReactSharedInternals.H.useHostTransitionStatus();
   };
-  reactDom_production.version = "19.2.6";
+  reactDom_production.version = "19.2.7";
   return reactDom_production;
 }
 var hasRequiredReactDom;
@@ -23353,12 +23657,12 @@ function requireReactDomClient_production() {
     }
   };
   var isomorphicReactPackageVersion$jscomp$inline_1840 = React.version;
-  if ("19.2.6" !== isomorphicReactPackageVersion$jscomp$inline_1840)
+  if ("19.2.7" !== isomorphicReactPackageVersion$jscomp$inline_1840)
     throw Error(
       formatProdErrorMessage(
         527,
         isomorphicReactPackageVersion$jscomp$inline_1840,
-        "19.2.6"
+        "19.2.7"
       )
     );
   ReactDOMSharedInternals.findDOMNode = function(componentOrElement) {
@@ -23376,10 +23680,10 @@ function requireReactDomClient_production() {
   };
   var internals$jscomp$inline_2347 = {
     bundleType: 0,
-    version: "19.2.6",
+    version: "19.2.7",
     rendererPackageName: "react-dom",
     currentDispatcherRef: ReactSharedInternals,
-    reconcilerVersion: "19.2.6"
+    reconcilerVersion: "19.2.7"
   };
   if ("undefined" !== typeof __REACT_DEVTOOLS_GLOBAL_HOOK__) {
     var hook$jscomp$inline_2348 = __REACT_DEVTOOLS_GLOBAL_HOOK__;
@@ -23446,7 +23750,7 @@ function requireReactDomClient_production() {
     listenToAllSupportedEvents(container);
     return new ReactDOMHydrationRoot(initialChildren);
   };
-  reactDomClient_production.version = "19.2.6";
+  reactDomClient_production.version = "19.2.7";
   return reactDomClient_production;
 }
 var hasRequiredClient;
@@ -26116,10 +26420,10 @@ function buildInspectorModule() {
 `);
 }
 function writeInspectorModule(serverDir2) {
-  if (!existsSync22(serverDir2))
-    mkdirSync9(serverDir2, { recursive: true });
-  const target = join17(serverDir2, INSPECTOR_FILE_NAME);
-  writeFileSync7(target, buildInspectorModule(), "utf-8");
+  if (!existsSync23(serverDir2))
+    mkdirSync11(serverDir2, { recursive: true });
+  const target = join19(serverDir2, INSPECTOR_FILE_NAME);
+  writeFileSync9(target, buildInspectorModule(), "utf-8");
   return target;
 }
 
@@ -26298,11 +26602,11 @@ function buildHostScript(options) {
 `);
 }
 function writeHostScript(serverDir2, options) {
-  if (!existsSync23(serverDir2))
-    mkdirSync10(serverDir2, { recursive: true });
-  const target = join18(serverDir2, HOST_FILE_NAME);
-  mkdirSync10(dirname5(target), { recursive: true });
-  writeFileSync8(target, buildHostScript(options), "utf-8");
+  if (!existsSync24(serverDir2))
+    mkdirSync12(serverDir2, { recursive: true });
+  const target = join20(serverDir2, HOST_FILE_NAME);
+  mkdirSync12(dirname7(target), { recursive: true });
+  writeFileSync10(target, buildHostScript(options), "utf-8");
   if (options.inspector) {
     writeInspectorModule(serverDir2);
   }
@@ -26314,12 +26618,50 @@ var ENTRY_CANDIDATES = ["src/worker.ts", "src/server.ts", "src/index.ts"];
 async function prepareDev(opts) {
   const cwd = opts.cwd;
   ensureGitignore(cwd);
-  const dest = serverDir(cwd);
+  let dest = serverDir(cwd);
   const env = envFile(cwd);
   const backups = backupsDir(cwd);
   const cached2 = readState(cwd);
   let projectId = cached2?.projectId;
-  if (!opts.offline) {
+  let serverName = cached2?.serverName;
+  let gitNative = false;
+  let repoDir;
+  const gitLink = opts.offline ? null : await resolveServerGitLink({
+    serverId: opts.serverId,
+    organizationId: opts.organizationId
+  }).catch(() => null);
+  if (gitLink) {
+    gitNative = true;
+    projectId = projectId ?? gitLink.projectId;
+    serverName = `${gitLink.owner}/${gitLink.name}`;
+    repoDir = gitCloneDir(cwd, gitLink.owner, gitLink.name);
+    dest = gitLink.pathPrefix ? join21(repoDir, gitLink.pathPrefix) : repoDir;
+    printStep(`Git-linked server — cloning ${gitLink.owner}/${gitLink.name}@${gitLink.branch}…`);
+    try {
+      const result = ensureClone({
+        repoDir,
+        httpsCloneUrl: gitLink.httpsCloneUrl,
+        branch: gitLink.branch,
+        onStep: (m2) => printStep(m2)
+      });
+      printSuccess(result.cloned ? `Cloned to ${relative6(cwd, repoDir)}` : `Using existing clone at ${relative6(cwd, repoDir)}`);
+    } catch (err) {
+      if (err instanceof GitNotAvailableError) {
+        printError(err.message);
+      } else if (err instanceof GitCloneError) {
+        printError(err.message);
+      } else {
+        printError(`Git clone failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
+      process.exit(1);
+    }
+    if (!existsSync25(env)) {
+      writeFileSync11(env, `{}
+`, "utf-8");
+      printInfo(`  → seeded ${relative6(cwd, env)} (empty; fill secrets here)`);
+    }
+    printInfo(`  ${"Open the clone in your editor; commit + push to sync (config under mcpcloud/ is read-only)."}`);
+  } else if (!opts.offline) {
     if (!projectId) {
       printStep(`Looking up server ${opts.serverId}…`);
       const lookup = await resolveServerProject({
@@ -26327,6 +26669,7 @@ async function prepareDev(opts) {
         organizationId: opts.organizationId
       });
       projectId = lookup.projectId;
+      serverName = lookup.serverName;
       printInfo(`  → ${lookup.serverName} (project ${projectId})`);
     }
     printStep("Fetching bundle…");
@@ -26337,8 +26680,8 @@ async function prepareDev(opts) {
     });
     const result = materializeBundle(dest, bundle, { prune: true });
     printInfo(`  → wrote ${result.filesWritten} files (pruned ${result.filesRemoved})`);
-    if (!existsSync24(env)) {
-      writeFileSync9(env, `{}
+    if (!existsSync25(env)) {
+      writeFileSync11(env, `{}
 `, "utf-8");
       printInfo(`  → seeded ${relative6(cwd, env)} (empty; fill secrets here)`);
     }
@@ -26355,7 +26698,7 @@ async function prepareDev(opts) {
     });
     printInfo(`  → wrote ${toolsResult.filesWritten} editable tool file${toolsResult.filesWritten === 1 ? "" : "s"}${toolsResult.filesRemoved > 0 ? ` (pruned ${toolsResult.filesRemoved})` : ""}`);
   } else {
-    if (!existsSync24(dest)) {
+    if (!existsSync25(dest)) {
       printError("No cached bundle found. Run once without --offline first.");
       process.exit(1);
     }
@@ -26364,7 +26707,7 @@ async function prepareDev(opts) {
       process.exit(1);
     }
   }
-  const entryRel = ENTRY_CANDIDATES.find((c2) => existsSync24(join19(dest, c2)));
+  const entryRel = ENTRY_CANDIDATES.find((c2) => existsSync25(join21(dest, c2)));
   if (!entryRel) {
     printError("Could not locate an entry file (expected src/worker.ts).");
     process.exit(1);
@@ -26385,7 +26728,8 @@ async function prepareDev(opts) {
     bundleVersion: 0,
     lastSyncedAt: Date.now(),
     transports: opts.transports,
-    port: opts.port
+    port: opts.port,
+    ...serverName !== undefined ? { serverName } : {}
   };
   writeState(cwd, state);
   const storePath = inspectorDir(cwd);
@@ -26403,7 +26747,9 @@ async function prepareDev(opts) {
     destDir: dest,
     envPath: env,
     backupsPath: backups,
-    state
+    state,
+    gitNative,
+    ...repoDir !== undefined ? { repoDir } : {}
   };
 }
 
@@ -26519,73 +26865,73 @@ function createBurstGuard() {
 }
 
 // src/lib/dev/agent-connectors/claude-code.ts
-import { existsSync as existsSync26, unlinkSync as unlinkSync2, writeFileSync as writeFileSync11 } from "node:fs";
+import { existsSync as existsSync27, unlinkSync as unlinkSync2, writeFileSync as writeFileSync13 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { join as join21 } from "node:path";
+import { join as join23 } from "node:path";
 
 // src/lib/dev/agent-connectors/json-config-utils.ts
-import { existsSync as existsSync25, mkdirSync as mkdirSync11, readFileSync as readFileSync14, writeFileSync as writeFileSync10 } from "node:fs";
-import { dirname as dirname6, join as join20, basename } from "node:path";
+import { existsSync as existsSync26, mkdirSync as mkdirSync13, readFileSync as readFileSync15, writeFileSync as writeFileSync12 } from "node:fs";
+import { dirname as dirname8, join as join22, basename } from "node:path";
 function readJsonFile(path) {
-  if (!existsSync25(path))
+  if (!existsSync26(path))
     return { ok: true, value: {} };
   try {
-    const raw = readFileSync14(path, "utf-8");
+    const raw = readFileSync15(path, "utf-8");
     if (!raw.trim())
       return { ok: true, value: {} };
     return { ok: true, value: JSON.parse(raw) };
   } catch {
     try {
-      return { ok: false, raw: readFileSync14(path, "utf-8") };
+      return { ok: false, raw: readFileSync15(path, "utf-8") };
     } catch {
       return { ok: false };
     }
   }
 }
 function atomicWriteJson(path, value) {
-  mkdirSync11(dirname6(path), { recursive: true });
+  mkdirSync13(dirname8(path), { recursive: true });
   const tmp = `${path}.mcpsh-${process.pid}-${Date.now()}.tmp`;
-  writeFileSync10(tmp, JSON.stringify(value, null, 2) + `
+  writeFileSync12(tmp, JSON.stringify(value, null, 2) + `
 `, "utf-8");
   const { renameSync: renameSync2 } = __require("node:fs");
   renameSync2(tmp, path);
 }
 function backupConfig(args) {
-  if (!existsSync25(args.configPath)) {
+  if (!existsSync26(args.configPath)) {
     return { backupPath: null, existed: false };
   }
-  mkdirSync11(args.backupsDir, { recursive: true });
+  mkdirSync13(args.backupsDir, { recursive: true });
   const filename = `${args.agentId}__${basename(args.configPath)}.bak`;
-  const backupPath = join20(args.backupsDir, filename);
-  if (!existsSync25(backupPath)) {
-    const raw = readFileSync14(args.configPath, "utf-8");
-    writeFileSync10(backupPath, raw, "utf-8");
+  const backupPath = join22(args.backupsDir, filename);
+  if (!existsSync26(backupPath)) {
+    const raw = readFileSync15(args.configPath, "utf-8");
+    writeFileSync12(backupPath, raw, "utf-8");
   }
   return { backupPath, existed: true };
 }
 function restoreFromBackup(args) {
   const filename = `${args.agentId}__${basename(args.configPath)}.bak`;
-  const backupPath = join20(args.backupsDir, filename);
-  if (!existsSync25(backupPath)) {
+  const backupPath = join22(args.backupsDir, filename);
+  if (!existsSync26(backupPath)) {
     return { restored: false };
   }
-  const raw = readFileSync14(backupPath, "utf-8");
-  mkdirSync11(dirname6(args.configPath), { recursive: true });
-  writeFileSync10(args.configPath, raw, "utf-8");
+  const raw = readFileSync15(backupPath, "utf-8");
+  mkdirSync13(dirname8(args.configPath), { recursive: true });
+  writeFileSync12(args.configPath, raw, "utf-8");
   return { restored: true };
 }
 
 // src/lib/dev/agent-connectors/claude-code.ts
 function configPath() {
-  return join21(homedir4(), ".claude.json");
+  return join23(homedir4(), ".claude.json");
 }
 function legacyConfigPath() {
-  return join21(homedir4(), ".claude", "mcp.json");
+  return join23(homedir4(), ".claude", "mcp.json");
 }
 function resolveConfigPath() {
-  if (existsSync26(configPath()))
+  if (existsSync27(configPath()))
     return configPath();
-  if (existsSync26(legacyConfigPath()))
+  if (existsSync27(legacyConfigPath()))
     return legacyConfigPath();
   return configPath();
 }
@@ -26595,8 +26941,8 @@ var claudeCodeConnector = {
   hotkey: "c",
   describeLocation: () => resolveConfigPath(),
   async detect() {
-    const claudeDir = join21(homedir4(), ".claude");
-    if (existsSync26(configPath()) || existsSync26(legacyConfigPath()) || existsSync26(claudeDir)) {
+    const claudeDir = join23(homedir4(), ".claude");
+    if (existsSync27(configPath()) || existsSync27(legacyConfigPath()) || existsSync27(claudeDir)) {
       return { installed: true, note: "Found Claude Code config" };
     }
     return { installed: false };
@@ -26634,7 +26980,7 @@ var claudeCodeConnector = {
       backupsDir: args.backupsDir,
       agentId: this.id
     });
-    if (!restored.restored && existsSync26(path)) {
+    if (!restored.restored && existsSync27(path)) {
       const after = readJsonFile(path);
       if (after.ok && after.value && typeof after.value === "object") {
         const root = after.value;
@@ -26644,7 +26990,7 @@ var claudeCodeConnector = {
           try {
             unlinkSync2(path);
           } catch {
-            writeFileSync11(path, `{}
+            writeFileSync13(path, `{}
 `, "utf-8");
           }
         }
@@ -26656,16 +27002,16 @@ var claudeCodeConnector = {
 
 // src/lib/dev/agent-connectors/codex.ts
 import {
-  existsSync as existsSync27,
-  mkdirSync as mkdirSync12,
-  readFileSync as readFileSync15,
+  existsSync as existsSync28,
+  mkdirSync as mkdirSync14,
+  readFileSync as readFileSync16,
   unlinkSync as unlinkSync3,
-  writeFileSync as writeFileSync12
+  writeFileSync as writeFileSync14
 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname7, join as join22 } from "node:path";
+import { dirname as dirname9, join as join24 } from "node:path";
 function configPath2() {
-  return join22(homedir5(), ".codex", "config.toml");
+  return join24(homedir5(), ".codex", "config.toml");
 }
 var SECTION_PREFIX = "mcp_servers.";
 function buildSection(name, url) {
@@ -26703,7 +27049,7 @@ var codexConnector = {
   hotkey: "x",
   describeLocation: () => configPath2(),
   async detect() {
-    if (existsSync27(join22(homedir5(), ".codex")) || existsSync27(configPath2())) {
+    if (existsSync28(join24(homedir5(), ".codex")) || existsSync28(configPath2())) {
       return { installed: true, note: "Found ~/.codex/" };
     }
     return { installed: false };
@@ -26716,8 +27062,8 @@ var codexConnector = {
       agentId: this.id
     });
     let existing = "";
-    if (existsSync27(path)) {
-      existing = readFileSync15(path, "utf-8");
+    if (existsSync28(path)) {
+      existing = readFileSync16(path, "utf-8");
     }
     const conflict = findSectionRange(existing, args.name) !== null;
     let next = existing;
@@ -26732,18 +27078,18 @@ var codexConnector = {
       next += `
 `;
     next += buildSection(args.name, args.url);
-    mkdirSync12(dirname7(path), { recursive: true });
-    writeFileSync12(path, next, "utf-8");
+    mkdirSync14(dirname9(path), { recursive: true });
+    writeFileSync14(path, next, "utf-8");
     return { added: !conflict, conflict };
   },
   async remove(args) {
     const path = configPath2();
-    if (existsSync27(path)) {
-      const existing = readFileSync15(path, "utf-8");
+    if (existsSync28(path)) {
+      const existing = readFileSync16(path, "utf-8");
       const range = findSectionRange(existing, args.name);
       if (range) {
         const next = existing.slice(0, range.start) + existing.slice(range.end);
-        writeFileSync12(path, next, "utf-8");
+        writeFileSync14(path, next, "utf-8");
       }
     }
     const restored = restoreFromBackup({
@@ -26751,8 +27097,8 @@ var codexConnector = {
       backupsDir: args.backupsDir,
       agentId: this.id
     });
-    if (!restored.restored && existsSync27(path)) {
-      const after = readFileSync15(path, "utf-8");
+    if (!restored.restored && existsSync28(path)) {
+      const after = readFileSync16(path, "utf-8");
       if (!after.trim()) {
         try {
           unlinkSync3(path);
@@ -26764,11 +27110,11 @@ var codexConnector = {
 };
 
 // src/lib/dev/agent-connectors/continue.ts
-import { existsSync as existsSync28, unlinkSync as unlinkSync4, writeFileSync as writeFileSync13 } from "node:fs";
+import { existsSync as existsSync29, unlinkSync as unlinkSync4, writeFileSync as writeFileSync15 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join23 } from "node:path";
+import { join as join25 } from "node:path";
 function configPath3() {
-  return join23(homedir6(), ".continue", "config.json");
+  return join25(homedir6(), ".continue", "config.json");
 }
 function isContinueServerEntry(value) {
   return Boolean(value && typeof value === "object" && typeof value.name === "string");
@@ -26779,8 +27125,8 @@ var continueConnector = {
   hotkey: "n",
   describeLocation: () => configPath3(),
   async detect() {
-    const dir = join23(homedir6(), ".continue");
-    if (existsSync28(dir) || existsSync28(configPath3())) {
+    const dir = join25(homedir6(), ".continue");
+    if (existsSync29(dir) || existsSync29(configPath3())) {
       return { installed: true, note: "Found ~/.continue/" };
     }
     return { installed: false };
@@ -26818,7 +27164,7 @@ var continueConnector = {
       backupsDir: args.backupsDir,
       agentId: this.id
     });
-    if (!restored.restored && existsSync28(path)) {
+    if (!restored.restored && existsSync29(path)) {
       const after = readJsonFile(path);
       if (after.ok && after.value && typeof after.value === "object") {
         const root = after.value;
@@ -26828,7 +27174,7 @@ var continueConnector = {
           try {
             unlinkSync4(path);
           } catch {
-            writeFileSync13(path, `{}
+            writeFileSync15(path, `{}
 `, "utf-8");
           }
         }
@@ -26839,11 +27185,11 @@ var continueConnector = {
 };
 
 // src/lib/dev/agent-connectors/cursor.ts
-import { existsSync as existsSync29, unlinkSync as unlinkSync5, writeFileSync as writeFileSync14 } from "node:fs";
+import { existsSync as existsSync30, unlinkSync as unlinkSync5, writeFileSync as writeFileSync16 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join24 } from "node:path";
+import { join as join26 } from "node:path";
 function globalConfigPath() {
-  return join24(homedir7(), ".cursor", "mcp.json");
+  return join26(homedir7(), ".cursor", "mcp.json");
 }
 var cursorConnector = {
   id: "cursor",
@@ -26851,9 +27197,9 @@ var cursorConnector = {
   hotkey: "u",
   describeLocation: () => globalConfigPath(),
   async detect() {
-    const cursorDir = join24(homedir7(), ".cursor");
-    const macAppSupport = join24(homedir7(), "Library", "Application Support", "Cursor");
-    if (existsSync29(cursorDir) || existsSync29(macAppSupport)) {
+    const cursorDir = join26(homedir7(), ".cursor");
+    const macAppSupport = join26(homedir7(), "Library", "Application Support", "Cursor");
+    if (existsSync30(cursorDir) || existsSync30(macAppSupport)) {
       return { installed: true, note: "Found Cursor config dir" };
     }
     return { installed: false };
@@ -26891,7 +27237,7 @@ var cursorConnector = {
       backupsDir: args.backupsDir,
       agentId: this.id
     });
-    if (!restored.restored && existsSync29(path)) {
+    if (!restored.restored && existsSync30(path)) {
       const after = readJsonFile(path);
       if (after.ok && after.value && typeof after.value === "object") {
         const root = after.value;
@@ -26901,7 +27247,7 @@ var cursorConnector = {
           try {
             unlinkSync5(path);
           } catch {
-            writeFileSync14(path, `{}
+            writeFileSync16(path, `{}
 `, "utf-8");
           }
         }
@@ -26912,30 +27258,30 @@ var cursorConnector = {
 };
 
 // src/lib/dev/agent-connectors/vscode-copilot.ts
-import { existsSync as existsSync30, unlinkSync as unlinkSync6, writeFileSync as writeFileSync15 } from "node:fs";
+import { existsSync as existsSync31, unlinkSync as unlinkSync6, writeFileSync as writeFileSync17 } from "node:fs";
 import { homedir as homedir8, platform as platform4 } from "node:os";
-import { join as join25, resolve as resolve5 } from "node:path";
+import { join as join27, resolve as resolve6 } from "node:path";
 function userLevelConfigPath() {
   const home = homedir8();
   const p2 = platform4();
   if (p2 === "darwin")
-    return join25(home, "Library", "Application Support", "Code", "User", "mcp.json");
+    return join27(home, "Library", "Application Support", "Code", "User", "mcp.json");
   if (p2 === "win32") {
-    const appData = process.env["APPDATA"] ?? join25(home, "AppData", "Roaming");
-    return join25(appData, "Code", "User", "mcp.json");
+    const appData = process.env["APPDATA"] ?? join27(home, "AppData", "Roaming");
+    return join27(appData, "Code", "User", "mcp.json");
   }
-  const xdg = process.env["XDG_CONFIG_HOME"] ?? join25(home, ".config");
-  return join25(xdg, "Code", "User", "mcp.json");
+  const xdg = process.env["XDG_CONFIG_HOME"] ?? join27(home, ".config");
+  return join27(xdg, "Code", "User", "mcp.json");
 }
 function isHomeDir(cwd) {
-  return resolve5(cwd) === resolve5(homedir8());
+  return resolve6(cwd) === resolve6(homedir8());
 }
 function hasWorkspaceVscode(cwd) {
-  return existsSync30(join25(cwd, ".vscode"));
+  return existsSync31(join27(cwd, ".vscode"));
 }
 function configPath4(cwd) {
   if (!isHomeDir(cwd) && hasWorkspaceVscode(cwd)) {
-    return join25(cwd, ".vscode", "mcp.json");
+    return join27(cwd, ".vscode", "mcp.json");
   }
   return userLevelConfigPath();
 }
@@ -26949,7 +27295,7 @@ var vscodeCopilotConnector = {
     if (!isHomeDir(here) && hasWorkspaceVscode(here)) {
       return { installed: true, note: "Found .vscode/ in current dir" };
     }
-    if (existsSync30(userLevelConfigPath().replace(/mcp\.json$/, ""))) {
+    if (existsSync31(userLevelConfigPath().replace(/mcp\.json$/, ""))) {
       return { installed: true, note: "Found VS Code user profile" };
     }
     return { installed: false };
@@ -26987,7 +27333,7 @@ var vscodeCopilotConnector = {
       backupsDir: args.backupsDir,
       agentId: this.id
     });
-    if (!restored.restored && existsSync30(path)) {
+    if (!restored.restored && existsSync31(path)) {
       const after = readJsonFile(path);
       if (after.ok && after.value && typeof after.value === "object") {
         const root = after.value;
@@ -26997,7 +27343,7 @@ var vscodeCopilotConnector = {
           try {
             unlinkSync6(path);
           } catch {
-            writeFileSync15(path, `{}
+            writeFileSync17(path, `{}
 `, "utf-8");
           }
         }
@@ -27141,7 +27487,7 @@ function parseGraceMs(value, fallbackMs) {
   return Math.round(n * 1000);
 }
 function resolveSpecPath(cwd, raw) {
-  return isAbsolute2(raw) ? raw : resolve6(cwd, raw);
+  return isAbsolute3(raw) ? raw : resolve7(cwd, raw);
 }
 function buildConnectionName(serverId) {
   const slug = serverId.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 24) || "mcp-server";
@@ -27149,6 +27495,16 @@ function buildConnectionName(serverId) {
 }
 function registerDevCommand(program2) {
   const dev = program2.command("dev").description("Run a deployed MCP server locally with hot reload + agent auto-wire").option("--server <serverId>", "Server ID (default: from .mcpcloud/state.json)").option("--org <organizationId>", "Organization ID (overrides default)").option("--port <number>", "Local port (default 8787)").option("--transport <list>", "Comma-separated: http,sse,stdio (default http,sse)").option("--stdio", "Shorthand for --transport stdio").option("--offline", "Use cached bundle, skip Convex sync").option("--no-watch", "Disable file watcher").option("--no-connect", "Disable agent auto-wire prompts").option("--auto-connect <agent>", "Auto-wire the named agent (claude-code, cursor, codex, vscode-copilot, continue)").option("--no-inspector", "Disable the inspector UI (default: enabled at /__inspect)").option("--spec <path>", "Watch this OpenAPI spec file and regenerate the bundle on change").option("--no-auto-regen", "Show spec drift but do not auto-apply (manual file edit still works)").option("--regen-grace <seconds>", "Grace period before auto-applying spec changes (default 5)").option("--enrich-on-change", "Preserve per-tool enrichment when the spec changes").option("--open <choice>", "Open an editor on startup: yes | always | no | never | ask").option("--open-target <choice>", "What to open: tools (.mcpcloud/tools/<server>/) | bundle (read-only .mcpcloud/server/) | all (both). When omitted on first run, mcp dev prompts.").option("--editor <command>", "Editor binary for this invocation (e.g. cursor, code, windsurf). Overrides saved editorCommand and the multi-editor picker.").option("--verbose", "Verbose logs").action(runAction(runDev));
+  dev.addHelpText("after", `
+Git-native mode (automatic):
+  If the chosen server is linked to a GitHub repo, mcp dev clones it under
+  .mcpcloud/git/ and runs against the working copy — no flag needed. Edit in
+  your own editor, then commit + push: the webhook reconciles src/** back into
+  MCPCloud. The CLI's tool/handler PATCH watchers are off in this mode (native
+  git is the version control). Config under mcpcloud/ is a read-only mirror —
+  change it in the dashboard. Deploy when ready with \`mcp deploy\` or the UI.
+  An unlinked server uses the default flow (download bundle, edit via dashboard).
+`);
   dev.command("list").description("List running mcp dev sessions on this machine").action(runAction(runDevList));
   dev.command("kill <pid>").description('Stop a running mcp dev session by PID (or "all" to stop every session)').action(runAction(runDevKill));
   dev.command("init").description("Interactively pick an organization + server and write .mcpcloud/state.json (forces the picker even if state already exists)").action(runAction(runDevInit));
@@ -27178,7 +27534,8 @@ async function runDevInit() {
     bundleVersion: 0,
     lastSyncedAt: 0,
     transports: ["http", "sse"],
-    port: 8787
+    port: 8787,
+    serverName: result.target.serverName
   });
   printSuccess(`Saved .mcpcloud/state.json — run ${c.bold("mcp dev")} to start.`);
 }
@@ -27234,6 +27591,21 @@ async function runDev(opts) {
   const cached2 = readState(cwd);
   let serverId = opts.server ?? cached2?.serverId;
   let organizationId = opts.org ?? cached2?.organizationId ?? undefined;
+  if (!opts.server && cached2?.serverId && canRunInteractive()) {
+    const choice = await promptResumeOrSwitch({
+      serverId: cached2.serverId,
+      ...cached2.serverName !== undefined ? { serverName: cached2.serverName } : {}
+    });
+    if (choice === "cancel")
+      process.exit(1);
+    if (choice === "switch") {
+      const result = await runInteractiveBootstrap();
+      if (result.kind !== "resolved")
+        process.exit(1);
+      serverId = result.target.serverId;
+      organizationId = result.target.organizationId;
+    }
+  }
   if (!serverId) {
     if (!canRunInteractive()) {
       printError("No server selected. Pass --server <serverId>, run `mcp dev init` to pick one interactively, or run from a directory with .mcpcloud/state.json.");
@@ -27274,7 +27646,7 @@ async function runDev(opts) {
   let specPath = null;
   if (opts.spec) {
     const resolved = resolveSpecPath(cwd, opts.spec);
-    if (!existsSync31(resolved)) {
+    if (!existsSync32(resolved)) {
       printError(`Spec file not found: ${resolved}`);
       process.exit(1);
     }
@@ -27303,7 +27675,8 @@ async function runDev(opts) {
     enrichOnChange,
     openChoice,
     openTargetOverride,
-    editorOverride
+    editorOverride,
+    gitNative: prepared.gitNative
   });
 }
 async function emitStaleHandlerOverrideWarning(args) {
@@ -27338,6 +27711,21 @@ async function runWithRuntime(args) {
     }
   });
   runtime = launch();
+  let fullShutdownReady = false;
+  const killRuntimeNow = () => {
+    try {
+      runtime?.child.kill("SIGKILL");
+    } catch {}
+  };
+  process.once("exit", killRuntimeNow);
+  const earlySignal = (signal) => {
+    if (fullShutdownReady)
+      return;
+    killRuntimeNow();
+    process.exit(signal === "SIGINT" ? 130 : 143);
+  };
+  process.on("SIGINT", () => earlySignal("SIGINT"));
+  process.on("SIGTERM", () => earlySignal("SIGTERM"));
   const baseUrl = `http://127.0.0.1:${args.port}`;
   const mcpUrl = `${baseUrl}/mcp`;
   const connectionName = buildConnectionName(args.serverId);
@@ -27354,7 +27742,14 @@ async function runWithRuntime(args) {
     });
     wired.push(...selected);
   }
-  if (args.transports[0] !== "stdio") {
+  if (args.transports[0] !== "stdio" && args.gitNative) {
+    await maybeOpenEditor({
+      dir: args.prepared.repoDir ?? args.prepared.destDir,
+      target: "bundle",
+      override: args.openChoice,
+      editorOverride: args.editorOverride
+    });
+  } else if (args.transports[0] !== "stdio") {
     const savedTarget = readConfig().editorOpenTarget;
     let target = resolveOpenTarget({
       override: args.openTargetOverride,
@@ -27405,11 +27800,16 @@ async function runWithRuntime(args) {
   const watcher = args.watch ? watchDir({
     rootDir: args.prepared.destDir,
     debounceMs: 250,
-    ignore: ["node_modules", "_mcpsh_host.mjs", ".git"],
+    ignore: [
+      "node_modules",
+      "_mcpsh_host.mjs",
+      "_mcpsh_inspector.mjs",
+      ".git"
+    ],
     onChange: async (path) => {
       if (shuttingDown)
         return;
-      if (shouldWarnAboutBundleEdit({
+      if (!args.gitNative && shouldWarnAboutBundleEdit({
         changedPath: path,
         alreadyWarned: bundleEditWarned,
         suppressed: suppressBundleWarn,
@@ -27427,14 +27827,14 @@ async function runWithRuntime(args) {
       runtime = launch();
     }
   }) : null;
-  const toolsWatcher = args.watch ? startToolsWatcher({
+  const toolsWatcher = args.watch && !args.gitNative ? startToolsWatcher({
     cwd: args.cwd,
     serverId: args.serverId,
     organizationId: args.organizationId,
     projectId: args.prepared.state.projectId,
     devBaseUrl: args.inspector ? baseUrl : undefined
   }) : null;
-  const handlersWatcher = args.watch ? startHandlersWatcher({
+  const handlersWatcher = args.watch && !args.gitNative ? startHandlersWatcher({
     cwd: args.cwd,
     serverId: args.serverId,
     organizationId: args.organizationId,
@@ -27443,7 +27843,7 @@ async function runWithRuntime(args) {
   let specWatcher = null;
   let pendingApply = null;
   let regenInFlight = false;
-  if (args.specPath) {
+  if (args.specPath && !args.gitNative) {
     const initial = readSpecFile(args.specPath);
     let lastAppliedHash = initial.hash;
     specWatcher = watchSpecFile({
@@ -27524,20 +27924,60 @@ async function runWithRuntime(args) {
     printInfo(`  ${c.dim("Inspector:   ")} ${c.cyan(`${baseUrl}/__inspect`)}`);
   }
   printInfo(`  ${c.dim(`Edit files in ${relative7(args.cwd, args.prepared.destDir)}/ to hot-reload.`)}`);
+  if (args.gitNative && args.prepared.repoDir) {
+    printInfo(`  ${c.dim(`Git-native: edit + commit + push in ${relative7(args.cwd, args.prepared.repoDir)}/ — the webhook reconciles src/**.`)}`);
+    printInfo(`  ${c.dim("Config under mcpcloud/ is read-only; change it in the dashboard. Deploy when ready (mcp deploy).")}`);
+  }
   if (toolsWatcher) {
     printInfo(`  ${c.dim(`Edit tool metadata in .mcpcloud/tools/${args.serverId}/ (changes push to cloud on save).`)}`);
   }
   if (handlersWatcher) {
     printInfo(`  ${c.dim(`Edit tool handlers in .mcpcloud/server/src/tools/<slug>.ts (changes push to cloud on save).`)}`);
   }
-  if (args.specPath) {
+  if (specWatcher) {
     printInfo(`  ${c.dim(`Spec watch:    ${relative7(args.cwd, args.specPath)}`)}`);
   }
-  await emitStaleHandlerOverrideWarning({
-    organizationId: args.organizationId,
-    projectId: args.prepared.state.projectId,
-    serverId: args.serverId
-  });
+  const gitPullPoller = args.gitNative ? startGitPullPoll({
+    fetchStatus: () => resolveServerGitPullStatus({
+      serverId: args.serverId,
+      organizationId: args.organizationId
+    }),
+    onChange: (status) => {
+      if (shuttingDown)
+        return;
+      const sha = status.lastPulledGitSha ? status.lastPulledGitSha.slice(0, 7) : "HEAD";
+      if (status.rejectedFileCount > 0) {
+        printWarn(`Push ${sha}: MCPCloud rejected ${status.rejectedFileCount} file${status.rejectedFileCount === 1 ? "" : "s"} (unsafe handler code).`);
+        if (status.error)
+          printInfo(`  ${c.dim(status.error)}`);
+        printInfo(`  ${c.dim("Fix the flagged file(s) and push again.")}`);
+        return;
+      }
+      if (status.status === "error") {
+        printWarn(`Push ${sha}: MCPCloud could not reconcile — ${status.error ?? "unknown error"}.`);
+        return;
+      }
+      if (status.status !== "pulled") {
+        printInfo(`Push ${sha}: ${status.hadConfigDrift ? "touched the read-only mcpcloud/ config — ignored." : "touched only generated files outside src/** — nothing synced."}`);
+        printInfo(`  ${c.dim("Only src/ round-trips; edit there to sync. README / mcpcloud/ are generated.")}`);
+        return;
+      }
+      const parts = [`${status.pulledFileCount} updated`];
+      if (status.deletedFileCount > 0) {
+        parts.push(`${status.deletedFileCount} deleted`);
+      }
+      printSuccess(`Push ${sha} reconciled (${parts.join(", ")}) — changes ready for deployment.`);
+      printInfo(`  ${c.dim("Deploy with")} ${c.bold("mcp deploy")} ${c.dim("or the dashboard — no preview needed, this session is your local server.")}`);
+    },
+    onError: () => {}
+  }) : null;
+  if (!args.gitNative) {
+    await emitStaleHandlerOverrideWarning({
+      organizationId: args.organizationId,
+      projectId: args.prepared.state.projectId,
+      serverId: args.serverId
+    });
+  }
   printInfo(`  ${c.dim("Ctrl+C to stop.")}`);
   if (isJsonMode()) {
     printJson({
@@ -27576,6 +28016,9 @@ async function runWithRuntime(args) {
     try {
       specWatcher?.close();
     } catch {}
+    try {
+      gitPullPoller?.close();
+    } catch {}
     if (pendingApply) {
       clearTimeout(pendingApply);
       pendingApply = null;
@@ -27595,6 +28038,7 @@ async function runWithRuntime(args) {
     printSuccess("Bye.");
     process.exit(0);
   };
+  fullShutdownReady = true;
   process.on("SIGINT", () => void shutdown("SIGINT"));
   process.on("SIGTERM", () => void shutdown("SIGTERM"));
   shortcuts = startShortcuts({
@@ -28018,13 +28462,13 @@ async function confirmRollback(deploymentId) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync33, statSync as statSync6, readFileSync as readFileSync17 } from "node:fs";
+import { existsSync as existsSync34, statSync as statSync6, readFileSync as readFileSync18 } from "node:fs";
 import { homedir as homedir9, platform as platform6 } from "node:os";
-import { join as join27, delimiter as delimiter3 } from "node:path";
+import { join as join29, delimiter as delimiter3 } from "node:path";
 
 // src/lib/version-check.ts
-import { existsSync as existsSync32, mkdirSync as mkdirSync13, readFileSync as readFileSync16, writeFileSync as writeFileSync16 } from "node:fs";
-import { join as join26 } from "node:path";
+import { existsSync as existsSync33, mkdirSync as mkdirSync15, readFileSync as readFileSync17, writeFileSync as writeFileSync18 } from "node:fs";
+import { join as join28 } from "node:path";
 var CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 var FETCH_TIMEOUT_MS2 = 2000;
 var REGISTRY_URL = "https://registry.npmjs.org/@mcpcloud/cli/latest";
@@ -28032,13 +28476,13 @@ function cacheDir() {
   return configDir();
 }
 function cacheFile() {
-  return join26(cacheDir(), "version-check.json");
+  return join28(cacheDir(), "version-check.json");
 }
 function readCache() {
-  if (!existsSync32(cacheFile()))
+  if (!existsSync33(cacheFile()))
     return null;
   try {
-    const raw = JSON.parse(readFileSync16(cacheFile(), "utf-8"));
+    const raw = JSON.parse(readFileSync17(cacheFile(), "utf-8"));
     if (typeof raw.latest !== "string" || typeof raw.fetchedAt !== "number")
       return null;
     return { latest: raw.latest, fetchedAt: raw.fetchedAt };
@@ -28048,9 +28492,9 @@ function readCache() {
 }
 function writeCache(entry) {
   try {
-    if (!existsSync32(cacheDir()))
-      mkdirSync13(cacheDir(), { recursive: true, mode: 448 });
-    writeFileSync16(cacheFile(), JSON.stringify(entry, null, 2), { mode: 384 });
+    if (!existsSync33(cacheDir()))
+      mkdirSync15(cacheDir(), { recursive: true, mode: 448 });
+    writeFileSync18(cacheFile(), JSON.stringify(entry, null, 2), { mode: 384 });
   } catch {}
 }
 function compareVersions(a, b) {
@@ -28161,8 +28605,8 @@ function checkNode() {
 }
 function checkConfigFile() {
   const t0 = Date.now();
-  const path = join27(homedir9(), ".mcpcloud", "config.json");
-  if (!existsSync33(path)) {
+  const path = join29(homedir9(), ".mcpcloud", "config.json");
+  if (!existsSync34(path)) {
     return {
       name: "Config file",
       status: "warn",
@@ -28184,7 +28628,7 @@ function checkConfigFile() {
     } catch {}
   }
   try {
-    JSON.parse(readFileSync17(path, "utf-8"));
+    JSON.parse(readFileSync18(path, "utf-8"));
   } catch (err) {
     return {
       name: "Config file",
@@ -28319,8 +28763,8 @@ function checkClaudeCli() {
   for (const dir of PATH.split(delimiter3)) {
     if (!dir)
       continue;
-    const candidate = join27(dir, exe);
-    if (existsSync33(candidate)) {
+    const candidate = join29(dir, exe);
+    if (existsSync34(candidate)) {
       return {
         name: "claude CLI",
         status: "pass",
@@ -28659,10 +29103,10 @@ function prompt2(question) {
     throw new Error("Interactive prompts are disabled in CI mode. Pass --org / --project / --name explicitly or run `mcp init` outside CI.");
   }
   const rl = createInterface2({ input: process.stdin, output: process.stderr });
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     rl.question(question, (answer) => {
       rl.close();
-      resolve7(answer.trim());
+      resolve8(answer.trim());
     });
   });
 }
@@ -29261,38 +29705,38 @@ function registerOAuthCommands(program2) {
 // src/lib/plugins.ts
 import { spawn as spawn7 } from "node:child_process";
 import {
-  existsSync as existsSync34,
-  mkdirSync as mkdirSync14,
+  existsSync as existsSync35,
+  mkdirSync as mkdirSync16,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync18,
+  readFileSync as readFileSync19,
   rmSync as rmSync3,
   statSync as statSync7
 } from "node:fs";
-import { join as join28 } from "node:path";
+import { join as join30 } from "node:path";
 import { pathToFileURL } from "node:url";
 function pluginsDir() {
-  return join28(configDir(), "plugins");
+  return join30(configDir(), "plugins");
 }
 function ensureDir2() {
   const dir = pluginsDir();
-  if (!existsSync34(dir))
-    mkdirSync14(dir, { recursive: true, mode: 448 });
+  if (!existsSync35(dir))
+    mkdirSync16(dir, { recursive: true, mode: 448 });
 }
 function readManifestFromPackageDir(packageDir) {
-  const pkgPath = join28(packageDir, "package.json");
-  if (!existsSync34(pkgPath))
+  const pkgPath = join30(packageDir, "package.json");
+  if (!existsSync35(pkgPath))
     return null;
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync18(pkgPath, "utf-8"));
+    pkg = JSON.parse(readFileSync19(pkgPath, "utf-8"));
   } catch {
     return null;
   }
   if (!pkg.name)
     return null;
   const relEntry = pkg.mcpsh?.register ?? pkg.main ?? "index.js";
-  const entry = join28(packageDir, relEntry);
-  if (!existsSync34(entry))
+  const entry = join30(packageDir, relEntry);
+  if (!existsSync35(entry))
     return null;
   return {
     name: pkg.name,
@@ -29303,11 +29747,11 @@ function readManifestFromPackageDir(packageDir) {
 }
 function listInstalledPlugins() {
   const dir = pluginsDir();
-  if (!existsSync34(dir))
+  if (!existsSync35(dir))
     return [];
   const out = [];
   for (const entry of readdirSync4(dir)) {
-    const full = join28(dir, entry);
+    const full = join30(dir, entry);
     let s;
     try {
       s = statSync7(full);
@@ -29318,7 +29762,7 @@ function listInstalledPlugins() {
       continue;
     if (entry.startsWith("@")) {
       for (const child of readdirSync4(full)) {
-        const m2 = readManifestFromPackageDir(join28(full, child));
+        const m2 = readManifestFromPackageDir(join30(full, child));
         if (m2)
           out.push(m2);
       }
@@ -29351,26 +29795,43 @@ async function loadPlugins(program2) {
     }
   }
 }
-function runShell(command, cwd) {
-  return new Promise((resolve7) => {
-    const child = spawn7(command, { shell: true, cwd, stdio: "inherit" });
-    child.on("close", (code) => resolve7(code ?? 1));
-    child.on("error", () => resolve7(1));
+var PACKAGE_SPEC_PATTERN = /^(@[a-z0-9~-][\w.~-]*\/)?[a-z0-9~-][\w.~-]*(@[-\w.^~><=*+|]+)?$/i;
+function runNpm(args, cwd) {
+  return new Promise((resolve8) => {
+    const isWindows = process.platform === "win32";
+    const child = spawn7(isWindows ? "npm.cmd" : "npm", args, {
+      shell: isWindows,
+      cwd,
+      stdio: "inherit"
+    });
+    child.on("close", (code) => resolve8(code ?? 1));
+    child.on("error", () => resolve8(1));
   });
 }
 async function installPlugin(packageSpec) {
+  if (!PACKAGE_SPEC_PATTERN.test(packageSpec)) {
+    throw new Error(`"${packageSpec}" is not a plain name@version npm package spec. URL, git, and path specs are not supported for plugins.`);
+  }
   ensureDir2();
   const dir = pluginsDir();
-  const code = await runShell(`npm install --prefix "${dir}" --no-save --silent ${JSON.stringify(packageSpec)}`, dir);
+  const code = await runNpm([
+    "install",
+    "--prefix",
+    dir,
+    "--no-save",
+    "--silent",
+    "--ignore-scripts",
+    packageSpec
+  ], dir);
   if (code !== 0) {
     throw new Error(`npm install ${packageSpec} exited with code ${code}.`);
   }
-  const nm = join28(dir, "node_modules");
-  if (!existsSync34(nm)) {
+  const nm = join30(dir, "node_modules");
+  if (!existsSync35(nm)) {
     throw new Error(`npm install ran but produced no node_modules under ${dir}.`);
   }
   const baseName = packageSpec.replace(/@[^@/]+$/, "");
-  const candidatePath = baseName.startsWith("@") ? join28(nm, baseName.split("/")[0], baseName.split("/")[1] ?? "") : join28(nm, baseName);
+  const candidatePath = baseName.startsWith("@") ? join30(nm, baseName.split("/")[0], baseName.split("/")[1] ?? "") : join30(nm, baseName);
   const manifest = readManifestFromPackageDir(candidatePath);
   if (!manifest) {
     throw new Error(`Installed but could not read plugin manifest at ${candidatePath}.`);
@@ -29378,26 +29839,26 @@ async function installPlugin(packageSpec) {
   return { name: manifest.name, entry: manifest.entry };
 }
 function removePlugin(name) {
-  const nm = join28(pluginsDir(), "node_modules");
-  if (!existsSync34(nm))
+  const nm = join30(pluginsDir(), "node_modules");
+  if (!existsSync35(nm))
     return false;
-  const target = name.startsWith("@") ? join28(nm, name.split("/")[0], name.split("/")[1] ?? "") : join28(nm, name);
-  if (!existsSync34(target))
+  const target = name.startsWith("@") ? join30(nm, name.split("/")[0], name.split("/")[1] ?? "") : join30(nm, name);
+  if (!existsSync35(target))
     return false;
   rmSync3(target, { recursive: true, force: true });
   return true;
 }
 function listInstalledPluginsCombined() {
   const direct = listInstalledPlugins();
-  const nm = join28(pluginsDir(), "node_modules");
-  if (!existsSync34(nm))
+  const nm = join30(pluginsDir(), "node_modules");
+  if (!existsSync35(nm))
     return direct;
   const seen = new Set(direct.map((p2) => p2.name));
   const out = [...direct];
   for (const entry of readdirSync4(nm)) {
     if (entry === ".bin" || entry === ".package-lock.json")
       continue;
-    const full = join28(nm, entry);
+    const full = join30(nm, entry);
     let s;
     try {
       s = statSync7(full);
@@ -29408,7 +29869,7 @@ function listInstalledPluginsCombined() {
       continue;
     if (entry.startsWith("@")) {
       for (const child of readdirSync4(full)) {
-        const m2 = readManifestFromPackageDir(join28(full, child));
+        const m2 = readManifestFromPackageDir(join30(full, child));
         if (m2 && !seen.has(m2.name)) {
           seen.add(m2.name);
           out.push(m2);
@@ -29864,7 +30325,7 @@ function clipboardCandidatesFor(platform7, waylandDisplay) {
   return linux;
 }
 async function defaultIsExecutable(binary) {
-  return await new Promise((resolve7) => {
+  return await new Promise((resolve8) => {
     const isWin = process.platform === "win32";
     const cmd = isWin ? "where" : "command";
     const args = isWin ? [binary] : ["-v", binary];
@@ -29872,8 +30333,8 @@ async function defaultIsExecutable(binary) {
       shell: !isWin,
       stdio: "ignore"
     });
-    child.on("error", () => resolve7(false));
-    child.on("exit", (code) => resolve7(code === 0));
+    child.on("error", () => resolve8(false));
+    child.on("exit", (code) => resolve8(code === 0));
   });
 }
 async function detectClipboard(probe) {
@@ -29895,7 +30356,7 @@ async function copyToClipboard(text, probe) {
     };
   }
   const spawnImpl = probe?.spawnImpl ?? spawn8;
-  return await new Promise((resolve7) => {
+  return await new Promise((resolve8) => {
     const child = spawnImpl(candidate.binary, candidate.args, {
       stdio: ["pipe", "ignore", "pipe"]
     });
@@ -29904,7 +30365,7 @@ async function copyToClipboard(text, probe) {
       stderr += chunk.toString("utf-8");
     });
     child.on("error", (err) => {
-      resolve7({
+      resolve8({
         kind: "failed",
         binary: candidate.binary,
         message: err instanceof Error ? err.message : String(err)
@@ -29912,9 +30373,9 @@ async function copyToClipboard(text, probe) {
     });
     child.on("exit", (code) => {
       if (code === 0) {
-        resolve7({ kind: "ok", binary: candidate.binary });
+        resolve8({ kind: "ok", binary: candidate.binary });
       } else {
-        resolve7({
+        resolve8({
           kind: "failed",
           binary: candidate.binary,
           message: stderr.trim() || `${candidate.binary} exited with status ${code ?? "?"}`
@@ -29924,7 +30385,7 @@ async function copyToClipboard(text, probe) {
     try {
       child.stdin?.end(text);
     } catch (err) {
-      resolve7({
+      resolve8({
         kind: "failed",
         binary: candidate.binary,
         message: err instanceof Error ? err.message : String(err)
@@ -30994,12 +31455,12 @@ function displayValueFor(field, value) {
 
 // src/lib/tui/state-store.ts
 import {
-  existsSync as existsSync35,
-  mkdirSync as mkdirSync15,
-  readFileSync as readFileSync19,
-  writeFileSync as writeFileSync17
+  existsSync as existsSync36,
+  mkdirSync as mkdirSync17,
+  readFileSync as readFileSync20,
+  writeFileSync as writeFileSync19
 } from "node:fs";
-import { join as join29 } from "node:path";
+import { join as join31 } from "node:path";
 var ALL_TABS = [
   "servers",
   "projects",
@@ -31009,7 +31470,7 @@ var ALL_TABS = [
   "devSessions"
 ];
 function tuiStateFile() {
-  return join29(configDir(), "tui-state.json");
+  return join31(configDir(), "tui-state.json");
 }
 function isTab(v2) {
   return typeof v2 === "string" && ALL_TABS.includes(v2);
@@ -31074,11 +31535,11 @@ function sanitizeTuiState(input) {
 }
 function readTuiState() {
   const path = tuiStateFile();
-  if (!existsSync35(path))
+  if (!existsSync36(path))
     return {};
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync19(path, "utf-8"));
+    parsed = JSON.parse(readFileSync20(path, "utf-8"));
   } catch {
     return {};
   }
@@ -31086,10 +31547,10 @@ function readTuiState() {
 }
 function writeTuiState(state) {
   try {
-    if (!existsSync35(configDir())) {
-      mkdirSync15(configDir(), { recursive: true, mode: 448 });
+    if (!existsSync36(configDir())) {
+      mkdirSync17(configDir(), { recursive: true, mode: 448 });
     }
-    writeFileSync17(tuiStateFile(), JSON.stringify(state, null, 2), {
+    writeFileSync19(tuiStateFile(), JSON.stringify(state, null, 2), {
       encoding: "utf-8",
       mode: 384
     });
@@ -33094,7 +33555,7 @@ function registerUiCommand(program2) {
       }
       return false;
     };
-    await new Promise((resolve7) => {
+    await new Promise((resolve8) => {
       const flushAndExit = () => {
         try {
           if (persistTimer) {
@@ -33104,7 +33565,7 @@ function registerUiCommand(program2) {
           writeTuiState(snapshotForPersist());
         } catch {}
         shutdown(handles);
-        resolve7();
+        resolve8();
       };
       const executePaletteCommand = (id) => {
         if (id.startsWith("tab:")) {
@@ -33713,7 +34174,7 @@ function registerUiCommand(program2) {
 
 // src/commands/update.ts
 import { spawn as spawn9 } from "node:child_process";
-import { dirname as dirname8 } from "node:path";
+import { dirname as dirname10 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function detectInstallContext() {
   const override = process.env["MCPSH_PACKAGE_MANAGER"]?.trim().toLowerCase();
@@ -33726,7 +34187,7 @@ function detectInstallContext() {
   }
   const here = (() => {
     try {
-      return dirname8(fileURLToPath2(import.meta.url));
+      return dirname10(fileURLToPath2(import.meta.url));
     } catch {
       return process.argv[1] ?? "";
     }
@@ -33773,11 +34234,11 @@ function buildCommand(manager) {
       return "npm install -g @mcpcloud/cli@latest";
   }
 }
-function runShell2(command) {
-  return new Promise((resolve7) => {
+function runShell(command) {
+  return new Promise((resolve8) => {
     const child = spawn9(command, { shell: true, stdio: "inherit" });
-    child.on("close", (code) => resolve7(code ?? 1));
-    child.on("error", () => resolve7(1));
+    child.on("close", (code) => resolve8(code ?? 1));
+    child.on("error", () => resolve8(1));
   });
 }
 function registerUpdateCommand(program2) {
@@ -33821,7 +34282,7 @@ function registerUpdateCommand(program2) {
     const ctx = detectInstallContext();
     printStep(`Running: ${c.cyan(ctx.command)}`);
     printInfo(c.dim(`  (${ctx.rationale}; override with MCPSH_PACKAGE_MANAGER)`));
-    const code = await runShell2(ctx.command);
+    const code = await runShell(ctx.command);
     if (code !== 0) {
       if (isJsonMode())
         printJson({