@mcpcloud/cli 0.3.0 → 0.4.0-next-20260611161108

package/dist/index.js

@@ -5113,6 +5113,10 @@ function stateFile(cwd) {
 function serverDir(cwd) {
   return join4(devRoot(cwd), "server");
 }
+function gitCloneDir(cwd, owner, name) {
+  const safe = `${owner}__${name}`.replace(/[^a-zA-Z0-9._-]/g, "-");
+  return join4(devRoot(cwd), "git", safe);
+}
 function envFile(cwd) {
   return join4(devRoot(cwd), "env.json");
 }
@@ -5152,6 +5156,7 @@ function ensureGitignore(cwd) {
   writeFileSync2(ignoreFile, [
     "# generated by `mcp dev`",
     "server/",
+    "git/",
     "env.json",
     "agent-backups/",
     "inspector/",
@@ -8097,7 +8102,7 @@ function registerConfigCommands(program2) {
 }
 
 // src/commands/dev.ts
-import { existsSync as existsSync31 } from "node:fs";
+import { existsSync as existsSync32 } from "node:fs";
 import { isAbsolute as isAbsolute2, relative as relative7, resolve as resolve6 } from "node:path";
 
 // src/lib/mcp-invoke.ts
@@ -9556,6 +9561,24 @@ var Q = class extends m {
     }
   }
 };
+
+class X extends m {
+  get cursor() {
+    return this.value ? 0 : 1;
+  }
+  get _value() {
+    return this.cursor === 0;
+  }
+  constructor(t) {
+    super(t, false), this.value = !!t.initialValue, this.on("userInput", () => {
+      this.value = this._value;
+    }), this.on("confirm", (s) => {
+      this.output.write(import_sisteransi.cursor.move(0, -1)), this.value = s, this.state = "submit", this.close();
+    }), this.on("cursor", () => {
+      this.value = !this.value;
+    });
+  }
+}
 var Z = { Y: { type: "year", len: 4 }, M: { type: "month", len: 2 }, D: { type: "day", len: 2 } };
 function P(r) {
   return [...r].map((t) => Z[t]);
@@ -9992,6 +10015,33 @@ var F2 = ({ cursor: t, options: i, style: s, output: r = process.stdout, maxItem
       S2.push(G2);
   return h2 && S2.push(l), S2;
 };
+var ue = (t) => {
+  const i = t.active ?? "Yes", s = t.inactive ?? "No";
+  return new X({ active: i, inactive: s, signal: t.signal, input: t.input, output: t.output, initialValue: t.initialValue ?? true, render() {
+    const r = t.withGuide ?? h.withGuide, u = `${P2(this.state)}  `, n = r ? `${e("gray", $2)}  ` : "", a = W(t.output, t.message, n, u), c2 = `${r ? `${e("gray", $2)}
+` : ""}${a}
+`, o = this.value ? i : s;
+    switch (this.state) {
+      case "submit": {
+        const l = r ? `${e("gray", $2)}  ` : "";
+        return `${c2}${l}${e("dim", o)}`;
+      }
+      case "cancel": {
+        const l = r ? `${e("gray", $2)}  ` : "";
+        return `${c2}${l}${e(["strikethrough", "dim"], o)}${r ? `
+${e("gray", $2)}` : ""}`;
+      }
+      default: {
+        const l = r ? `${e("cyan", $2)}  ` : "", d = r ? e("cyan", x2) : "";
+        return `${c2}${l}${this.value ? `${e("green", z2)} ${i}` : `${e("dim", U2)} ${e("dim", i)}`}${t.vertical ? r ? `
+${e("cyan", $2)}  ` : `
+` : ` ${e("dim", "/")} `}${this.value ? `${e("dim", U2)} ${e("dim", s)}` : `${e("green", z2)} ${s}`}
+${d}
+`;
+      }
+    }
+  } }).prompt();
+};
 var me = (t = "", i) => {
   const s = i?.output ?? process.stdout, r = i?.withGuide ?? h.withGuide ? `${e("gray", x2)}  ` : "";
   s.write(`${r}${e("red", t)}
@@ -10092,6 +10142,18 @@ async function resolveDevTarget(deps) {
     }
   };
 }
+async function promptResumeOrSwitch(args) {
+  const label = args.serverName ? `${args.serverName} ${c.dim(`(${args.serverId})`)}` : args.serverId;
+  const resume = await ue({
+    message: `Resume ${label}?`,
+    active: "Resume",
+    inactive: "Pick a different server",
+    initialValue: true
+  });
+  if (q(resume))
+    return "cancel";
+  return resume ? "resume" : "switch";
+}
 function canRunInteractive() {
   if (isCiMode())
     return false;
@@ -10177,6 +10239,20 @@ async function resolveServerProject(args) {
     version: data.server.version
   };
 }
+async function resolveServerGitLink(args) {
+  const data = await api.get("/api/v1/server/git-link", {
+    organizationId: args.organizationId,
+    serverId: args.serverId
+  });
+  return data.gitLink ?? null;
+}
+async function resolveServerGitPullStatus(args) {
+  const data = await api.get("/api/v1/server/git-sync-status", {
+    organizationId: args.organizationId,
+    serverId: args.serverId
+  });
+  return data.pull ?? null;
+}
 async function fetchBundle(args) {
   requireApiKey();
   const url = new URL("/api/v1/artifacts/download", getBaseUrl());
@@ -10274,6 +10350,49 @@ function pruneStaleFiles(rootDir, currentDir, kept) {
   return removed;
 }
 
+// src/lib/dev/git-pull-poll.ts
+var DEFAULT_INTERVAL_MS2 = 6000;
+function reducePollState(baseline, status) {
+  if (!status)
+    return { baseline, nudge: false };
+  const sha = status.lastPulledGitSha;
+  if (baseline === undefined)
+    return { baseline: sha, nudge: false };
+  if (sha && sha !== baseline)
+    return { baseline: sha, nudge: true };
+  return { baseline, nudge: false };
+}
+function startGitPullPoll(args) {
+  const intervalMs = args.intervalMs ?? DEFAULT_INTERVAL_MS2;
+  let baseline;
+  let stopped = false;
+  let timer = null;
+  const tick = async () => {
+    if (stopped)
+      return;
+    try {
+      const status = await args.fetchStatus();
+      const next = reducePollState(baseline, status);
+      baseline = next.baseline;
+      if (next.nudge && status)
+        args.onChange(status);
+    } catch (err) {
+      args.onError?.(err);
+    } finally {
+      if (!stopped)
+        timer = setTimeout(() => void tick(), intervalMs);
+    }
+  };
+  tick();
+  return {
+    close() {
+      stopped = true;
+      if (timer)
+        clearTimeout(timer);
+    }
+  };
+}
+
 // src/lib/dev/editor.ts
 import { spawn as spawn4 } from "node:child_process";
 import { existsSync as existsSync17, statSync as statSync4 } from "node:fs";
@@ -10972,16 +11091,126 @@ async function installDependencies(options) {
 }
 
 // src/lib/dev/prepare.ts
-import { existsSync as existsSync24, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join19, relative as relative6 } from "node:path";
+import { existsSync as existsSync25, writeFileSync as writeFileSync10 } from "node:fs";
+import { join as join20, relative as relative6 } from "node:path";
+
+// src/lib/dev/git-clone.ts
+import { spawnSync } from "node:child_process";
+import {
+  existsSync as existsSync22,
+  mkdirSync as mkdirSync9,
+  readFileSync as readFileSync14,
+  writeFileSync as writeFileSync7
+} from "node:fs";
+import { dirname as dirname5, join as join17 } from "node:path";
+
+class GitNotAvailableError extends Error {
+  constructor() {
+    super("git is not installed or not on your PATH. Install Git to use Git-native dev mode.");
+    this.name = "GitNotAvailableError";
+  }
+}
+
+class GitCloneError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "GitCloneError";
+  }
+}
+var GIT_LOCAL_EXCLUDES = [
+  "_mcpsh_*",
+  "node_modules/",
+  "bun.lock"
+];
+var EXCLUDE_HEADER = "# added by `mcp dev` (Git-native mode)";
+function gitCloneArgs(httpsCloneUrl, branch, repoDir) {
+  return [
+    "clone",
+    "--branch",
+    branch,
+    "--single-branch",
+    httpsCloneUrl,
+    repoDir
+  ];
+}
+function gitFetchArgs(branch) {
+  return ["fetch", "--quiet", "origin", branch];
+}
+function mergeLocalExcludes(existing) {
+  const lines = existing.split(`
+`);
+  const present = new Set(lines.map((l) => l.trim()));
+  const missing = GIT_LOCAL_EXCLUDES.filter((pattern) => !present.has(pattern));
+  if (missing.length === 0)
+    return null;
+  const prefix = existing.length > 0 && !existing.endsWith(`
+`) ? `
+` : "";
+  const block = present.has(EXCLUDE_HEADER) ? missing.join(`
+`) : [EXCLUDE_HEADER, ...missing].join(`
+`);
+  return `${existing}${prefix}${block}
+`;
+}
+function runGit(args, cwd) {
+  const res = spawnSync("git", args, {
+    cwd,
+    encoding: "utf-8",
+    stdio: ["inherit", "pipe", "pipe"]
+  });
+  if (res.error && res.error.code === "ENOENT") {
+    throw new GitNotAvailableError;
+  }
+  return {
+    status: res.status ?? 1,
+    stdout: res.stdout ?? "",
+    stderr: res.stderr ?? ""
+  };
+}
+function isGitAvailable() {
+  try {
+    return runGit(["--version"]).status === 0;
+  } catch {
+    return false;
+  }
+}
+function applyLocalExcludes(repoDir) {
+  const excludePath = join17(repoDir, ".git", "info", "exclude");
+  const existing = existsSync22(excludePath) ? readFileSync14(excludePath, "utf-8") : "";
+  const next = mergeLocalExcludes(existing);
+  if (next === null)
+    return;
+  if (!existsSync22(dirname5(excludePath))) {
+    mkdirSync9(dirname5(excludePath), { recursive: true });
+  }
+  writeFileSync7(excludePath, next, "utf-8");
+}
+function ensureClone(opts) {
+  if (!isGitAvailable()) {
+    throw new GitNotAvailableError;
+  }
+  if (existsSync22(join17(opts.repoDir, ".git"))) {
+    opts.onStep?.("Refreshing existing clone (git fetch)…");
+    runGit(gitFetchArgs(opts.branch), opts.repoDir);
+    applyLocalExcludes(opts.repoDir);
+    return { cloned: false };
+  }
+  opts.onStep?.(`Cloning ${opts.httpsCloneUrl} (branch ${opts.branch})…`);
+  const res = runGit(gitCloneArgs(opts.httpsCloneUrl, opts.branch, opts.repoDir));
+  if (res.status !== 0) {
+    throw new GitCloneError(`git clone failed (exit ${res.status}). ${res.stderr.trim() || "Check that you have access to the repository with your local git credentials."}`);
+  }
+  applyLocalExcludes(opts.repoDir);
+  return { cloned: true };
+}
 
 // src/lib/dev/host-runtime.ts
-import { existsSync as existsSync23, mkdirSync as mkdirSync10, writeFileSync as writeFileSync8 } from "node:fs";
-import { dirname as dirname5, join as join18 } from "node:path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync11, writeFileSync as writeFileSync9 } from "node:fs";
+import { dirname as dirname6, join as join19 } from "node:path";
 
 // src/lib/dev/inspector-module.ts
-import { existsSync as existsSync22, mkdirSync as mkdirSync9, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join17 } from "node:path";
+import { existsSync as existsSync23, mkdirSync as mkdirSync10, writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join18 } from "node:path";
 
 // src/lib/dev/inspector-assets.ts
 var INSPECTOR_HTML = `<!doctype html>
@@ -11482,7 +11711,7 @@ function requireReact_production() {
   react_production.useTransition = function() {
     return ReactSharedInternals.H.useTransition();
   };
-  react_production.version = "19.2.6";
+  react_production.version = "19.2.7";
   return react_production;
 }
 var hasRequiredReact;
@@ -11909,7 +12138,7 @@ function requireReactDom_production() {
   reactDom_production.useFormStatus = function() {
     return ReactSharedInternals.H.useHostTransitionStatus();
   };
-  reactDom_production.version = "19.2.6";
+  reactDom_production.version = "19.2.7";
   return reactDom_production;
 }
 var hasRequiredReactDom;
@@ -23353,12 +23582,12 @@ function requireReactDomClient_production() {
     }
   };
   var isomorphicReactPackageVersion$jscomp$inline_1840 = React.version;
-  if ("19.2.6" !== isomorphicReactPackageVersion$jscomp$inline_1840)
+  if ("19.2.7" !== isomorphicReactPackageVersion$jscomp$inline_1840)
     throw Error(
       formatProdErrorMessage(
         527,
         isomorphicReactPackageVersion$jscomp$inline_1840,
-        "19.2.6"
+        "19.2.7"
       )
     );
   ReactDOMSharedInternals.findDOMNode = function(componentOrElement) {
@@ -23376,10 +23605,10 @@ function requireReactDomClient_production() {
   };
   var internals$jscomp$inline_2347 = {
     bundleType: 0,
-    version: "19.2.6",
+    version: "19.2.7",
     rendererPackageName: "react-dom",
     currentDispatcherRef: ReactSharedInternals,
-    reconcilerVersion: "19.2.6"
+    reconcilerVersion: "19.2.7"
   };
   if ("undefined" !== typeof __REACT_DEVTOOLS_GLOBAL_HOOK__) {
     var hook$jscomp$inline_2348 = __REACT_DEVTOOLS_GLOBAL_HOOK__;
@@ -23446,7 +23675,7 @@ function requireReactDomClient_production() {
     listenToAllSupportedEvents(container);
     return new ReactDOMHydrationRoot(initialChildren);
   };
-  reactDomClient_production.version = "19.2.6";
+  reactDomClient_production.version = "19.2.7";
   return reactDomClient_production;
 }
 var hasRequiredClient;
@@ -26116,10 +26345,10 @@ function buildInspectorModule() {
 `);
 }
 function writeInspectorModule(serverDir2) {
-  if (!existsSync22(serverDir2))
-    mkdirSync9(serverDir2, { recursive: true });
-  const target = join17(serverDir2, INSPECTOR_FILE_NAME);
-  writeFileSync7(target, buildInspectorModule(), "utf-8");
+  if (!existsSync23(serverDir2))
+    mkdirSync10(serverDir2, { recursive: true });
+  const target = join18(serverDir2, INSPECTOR_FILE_NAME);
+  writeFileSync8(target, buildInspectorModule(), "utf-8");
   return target;
 }
 
@@ -26298,11 +26527,11 @@ function buildHostScript(options) {
 `);
 }
 function writeHostScript(serverDir2, options) {
-  if (!existsSync23(serverDir2))
-    mkdirSync10(serverDir2, { recursive: true });
-  const target = join18(serverDir2, HOST_FILE_NAME);
-  mkdirSync10(dirname5(target), { recursive: true });
-  writeFileSync8(target, buildHostScript(options), "utf-8");
+  if (!existsSync24(serverDir2))
+    mkdirSync11(serverDir2, { recursive: true });
+  const target = join19(serverDir2, HOST_FILE_NAME);
+  mkdirSync11(dirname6(target), { recursive: true });
+  writeFileSync9(target, buildHostScript(options), "utf-8");
   if (options.inspector) {
     writeInspectorModule(serverDir2);
   }
@@ -26314,12 +26543,50 @@ var ENTRY_CANDIDATES = ["src/worker.ts", "src/server.ts", "src/index.ts"];
 async function prepareDev(opts) {
   const cwd = opts.cwd;
   ensureGitignore(cwd);
-  const dest = serverDir(cwd);
+  let dest = serverDir(cwd);
   const env = envFile(cwd);
   const backups = backupsDir(cwd);
   const cached2 = readState(cwd);
   let projectId = cached2?.projectId;
-  if (!opts.offline) {
+  let serverName = cached2?.serverName;
+  let gitNative = false;
+  let repoDir;
+  const gitLink = opts.offline ? null : await resolveServerGitLink({
+    serverId: opts.serverId,
+    organizationId: opts.organizationId
+  }).catch(() => null);
+  if (gitLink) {
+    gitNative = true;
+    projectId = projectId ?? gitLink.projectId;
+    serverName = `${gitLink.owner}/${gitLink.name}`;
+    repoDir = gitCloneDir(cwd, gitLink.owner, gitLink.name);
+    dest = gitLink.pathPrefix ? join20(repoDir, gitLink.pathPrefix) : repoDir;
+    printStep(`Git-linked server — cloning ${gitLink.owner}/${gitLink.name}@${gitLink.branch}…`);
+    try {
+      const result = ensureClone({
+        repoDir,
+        httpsCloneUrl: gitLink.httpsCloneUrl,
+        branch: gitLink.branch,
+        onStep: (m2) => printStep(m2)
+      });
+      printSuccess(result.cloned ? `Cloned to ${relative6(cwd, repoDir)}` : `Using existing clone at ${relative6(cwd, repoDir)}`);
+    } catch (err) {
+      if (err instanceof GitNotAvailableError) {
+        printError(err.message);
+      } else if (err instanceof GitCloneError) {
+        printError(err.message);
+      } else {
+        printError(`Git clone failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
+      process.exit(1);
+    }
+    if (!existsSync25(env)) {
+      writeFileSync10(env, `{}
+`, "utf-8");
+      printInfo(`  → seeded ${relative6(cwd, env)} (empty; fill secrets here)`);
+    }
+    printInfo(`  ${"Open the clone in your editor; commit + push to sync (config under mcpcloud/ is read-only)."}`);
+  } else if (!opts.offline) {
     if (!projectId) {
       printStep(`Looking up server ${opts.serverId}…`);
       const lookup = await resolveServerProject({
@@ -26327,6 +26594,7 @@ async function prepareDev(opts) {
         organizationId: opts.organizationId
       });
       projectId = lookup.projectId;
+      serverName = lookup.serverName;
       printInfo(`  → ${lookup.serverName} (project ${projectId})`);
     }
     printStep("Fetching bundle…");
@@ -26337,8 +26605,8 @@ async function prepareDev(opts) {
     });
     const result = materializeBundle(dest, bundle, { prune: true });
     printInfo(`  → wrote ${result.filesWritten} files (pruned ${result.filesRemoved})`);
-    if (!existsSync24(env)) {
-      writeFileSync9(env, `{}
+    if (!existsSync25(env)) {
+      writeFileSync10(env, `{}
 `, "utf-8");
       printInfo(`  → seeded ${relative6(cwd, env)} (empty; fill secrets here)`);
     }
@@ -26355,7 +26623,7 @@ async function prepareDev(opts) {
     });
     printInfo(`  → wrote ${toolsResult.filesWritten} editable tool file${toolsResult.filesWritten === 1 ? "" : "s"}${toolsResult.filesRemoved > 0 ? ` (pruned ${toolsResult.filesRemoved})` : ""}`);
   } else {
-    if (!existsSync24(dest)) {
+    if (!existsSync25(dest)) {
       printError("No cached bundle found. Run once without --offline first.");
       process.exit(1);
     }
@@ -26364,7 +26632,7 @@ async function prepareDev(opts) {
       process.exit(1);
     }
   }
-  const entryRel = ENTRY_CANDIDATES.find((c2) => existsSync24(join19(dest, c2)));
+  const entryRel = ENTRY_CANDIDATES.find((c2) => existsSync25(join20(dest, c2)));
   if (!entryRel) {
     printError("Could not locate an entry file (expected src/worker.ts).");
     process.exit(1);
@@ -26385,7 +26653,8 @@ async function prepareDev(opts) {
     bundleVersion: 0,
     lastSyncedAt: Date.now(),
     transports: opts.transports,
-    port: opts.port
+    port: opts.port,
+    ...serverName !== undefined ? { serverName } : {}
   };
   writeState(cwd, state);
   const storePath = inspectorDir(cwd);
@@ -26403,7 +26672,9 @@ async function prepareDev(opts) {
     destDir: dest,
     envPath: env,
     backupsPath: backups,
-    state
+    state,
+    gitNative,
+    ...repoDir !== undefined ? { repoDir } : {}
   };
 }
 
@@ -26519,73 +26790,73 @@ function createBurstGuard() {
 }
 
 // src/lib/dev/agent-connectors/claude-code.ts
-import { existsSync as existsSync26, unlinkSync as unlinkSync2, writeFileSync as writeFileSync11 } from "node:fs";
+import { existsSync as existsSync27, unlinkSync as unlinkSync2, writeFileSync as writeFileSync12 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { join as join21 } from "node:path";
+import { join as join22 } from "node:path";
 
 // src/lib/dev/agent-connectors/json-config-utils.ts
-import { existsSync as existsSync25, mkdirSync as mkdirSync11, readFileSync as readFileSync14, writeFileSync as writeFileSync10 } from "node:fs";
-import { dirname as dirname6, join as join20, basename } from "node:path";
+import { existsSync as existsSync26, mkdirSync as mkdirSync12, readFileSync as readFileSync15, writeFileSync as writeFileSync11 } from "node:fs";
+import { dirname as dirname7, join as join21, basename } from "node:path";
 function readJsonFile(path) {
-  if (!existsSync25(path))
+  if (!existsSync26(path))
     return { ok: true, value: {} };
   try {
-    const raw = readFileSync14(path, "utf-8");
+    const raw = readFileSync15(path, "utf-8");
     if (!raw.trim())
       return { ok: true, value: {} };
     return { ok: true, value: JSON.parse(raw) };
   } catch {
     try {
-      return { ok: false, raw: readFileSync14(path, "utf-8") };
+      return { ok: false, raw: readFileSync15(path, "utf-8") };
     } catch {
       return { ok: false };
     }
   }
 }
 function atomicWriteJson(path, value) {
-  mkdirSync11(dirname6(path), { recursive: true });
+  mkdirSync12(dirname7(path), { recursive: true });
   const tmp = `${path}.mcpsh-${process.pid}-${Date.now()}.tmp`;
-  writeFileSync10(tmp, JSON.stringify(value, null, 2) + `
+  writeFileSync11(tmp, JSON.stringify(value, null, 2) + `
 `, "utf-8");
   const { renameSync: renameSync2 } = __require("node:fs");
   renameSync2(tmp, path);
 }
 function backupConfig(args) {
-  if (!existsSync25(args.configPath)) {
+  if (!existsSync26(args.configPath)) {
     return { backupPath: null, existed: false };
   }
-  mkdirSync11(args.backupsDir, { recursive: true });
+  mkdirSync12(args.backupsDir, { recursive: true });
   const filename = `${args.agentId}__${basename(args.configPath)}.bak`;
-  const backupPath = join20(args.backupsDir, filename);
-  if (!existsSync25(backupPath)) {
-    const raw = readFileSync14(args.configPath, "utf-8");
-    writeFileSync10(backupPath, raw, "utf-8");
+  const backupPath = join21(args.backupsDir, filename);
+  if (!existsSync26(backupPath)) {
+    const raw = readFileSync15(args.configPath, "utf-8");
+    writeFileSync11(backupPath, raw, "utf-8");
   }
   return { backupPath, existed: true };
 }
 function restoreFromBackup(args) {
   const filename = `${args.agentId}__${basename(args.configPath)}.bak`;
-  const backupPath = join20(args.backupsDir, filename);
-  if (!existsSync25(backupPath)) {
+  const backupPath = join21(args.backupsDir, filename);
+  if (!existsSync26(backupPath)) {
     return { restored: false };
   }
-  const raw = readFileSync14(backupPath, "utf-8");
-  mkdirSync11(dirname6(args.configPath), { recursive: true });
-  writeFileSync10(args.configPath, raw, "utf-8");
+  const raw = readFileSync15(backupPath, "utf-8");
+  mkdirSync12(dirname7(args.configPath), { recursive: true });
+  writeFileSync11(args.configPath, raw, "utf-8");
   return { restored: true };
 }
 
 // src/lib/dev/agent-connectors/claude-code.ts
 function configPath() {
-  return join21(homedir4(), ".claude.json");
+  return join22(homedir4(), ".claude.json");
 }
 function legacyConfigPath() {
-  return join21(homedir4(), ".claude", "mcp.json");
+  return join22(homedir4(), ".claude", "mcp.json");
 }
 function resolveConfigPath() {
-  if (existsSync26(configPath()))
+  if (existsSync27(configPath()))
     return configPath();
-  if (existsSync26(legacyConfigPath()))
+  if (existsSync27(legacyConfigPath()))
     return legacyConfigPath();
   return configPath();
 }
@@ -26595,8 +26866,8 @@ var claudeCodeConnector = {
   hotkey: "c",
   describeLocation: () => resolveConfigPath(),
   async detect() {
-    const claudeDir = join21(homedir4(), ".claude");
-    if (existsSync26(configPath()) || existsSync26(legacyConfigPath()) || existsSync26(claudeDir)) {
+    const claudeDir = join22(homedir4(), ".claude");
+    if (existsSync27(configPath()) || existsSync27(legacyConfigPath()) || existsSync27(claudeDir)) {
       return { installed: true, note: "Found Claude Code config" };
     }
     return { installed: false };
@@ -26634,7 +26905,7 @@ var claudeCodeConnector = {
       backupsDir: args.backupsDir,
       agentId: this.id
     });
-    if (!restored.restored && existsSync26(path)) {
+    if (!restored.restored && existsSync27(path)) {
       const after = readJsonFile(path);
       if (after.ok && after.value && typeof after.value === "object") {
         const root = after.value;
@@ -26644,7 +26915,7 @@ var claudeCodeConnector = {
           try {
             unlinkSync2(path);
           } catch {
-            writeFileSync11(path, `{}
+            writeFileSync12(path, `{}
 `, "utf-8");
           }
         }
@@ -26656,16 +26927,16 @@ var claudeCodeConnector = {
 
 // src/lib/dev/agent-connectors/codex.ts
 import {
-  existsSync as existsSync27,
-  mkdirSync as mkdirSync12,
-  readFileSync as readFileSync15,
+  existsSync as existsSync28,
+  mkdirSync as mkdirSync13,
+  readFileSync as readFileSync16,
   unlinkSync as unlinkSync3,
-  writeFileSync as writeFileSync12
+  writeFileSync as writeFileSync13
 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname7, join as join22 } from "node:path";
+import { dirname as dirname8, join as join23 } from "node:path";
 function configPath2() {
-  return join22(homedir5(), ".codex", "config.toml");
+  return join23(homedir5(), ".codex", "config.toml");
 }
 var SECTION_PREFIX = "mcp_servers.";
 function buildSection(name, url) {
@@ -26703,7 +26974,7 @@ var codexConnector = {
   hotkey: "x",
   describeLocation: () => configPath2(),
   async detect() {
-    if (existsSync27(join22(homedir5(), ".codex")) || existsSync27(configPath2())) {
+    if (existsSync28(join23(homedir5(), ".codex")) || existsSync28(configPath2())) {
       return { installed: true, note: "Found ~/.codex/" };
     }
     return { installed: false };
@@ -26716,8 +26987,8 @@ var codexConnector = {
       agentId: this.id
     });
     let existing = "";
-    if (existsSync27(path)) {
-      existing = readFileSync15(path, "utf-8");
+    if (existsSync28(path)) {
+      existing = readFileSync16(path, "utf-8");
     }
     const conflict = findSectionRange(existing, args.name) !== null;
     let next = existing;
@@ -26732,18 +27003,18 @@ var codexConnector = {
       next += `
 `;
     next += buildSection(args.name, args.url);
-    mkdirSync12(dirname7(path), { recursive: true });
-    writeFileSync12(path, next, "utf-8");
+    mkdirSync13(dirname8(path), { recursive: true });
+    writeFileSync13(path, next, "utf-8");
     return { added: !conflict, conflict };
   },
   async remove(args) {
     const path = configPath2();
-    if (existsSync27(path)) {
-      const existing = readFileSync15(path, "utf-8");
+    if (existsSync28(path)) {
+      const existing = readFileSync16(path, "utf-8");
       const range = findSectionRange(existing, args.name);
       if (range) {
         const next = existing.slice(0, range.start) + existing.slice(range.end);
-        writeFileSync12(path, next, "utf-8");
+        writeFileSync13(path, next, "utf-8");
       }
     }
     const restored = restoreFromBackup({
@@ -26751,8 +27022,8 @@ var codexConnector = {
       backupsDir: args.backupsDir,
       agentId: this.id
     });
-    if (!restored.restored && existsSync27(path)) {
-      const after = readFileSync15(path, "utf-8");
+    if (!restored.restored && existsSync28(path)) {
+      const after = readFileSync16(path, "utf-8");
       if (!after.trim()) {
         try {
           unlinkSync3(path);
@@ -26764,11 +27035,11 @@ var codexConnector = {
 };
 
 // src/lib/dev/agent-connectors/continue.ts
-import { existsSync as existsSync28, unlinkSync as unlinkSync4, writeFileSync as writeFileSync13 } from "node:fs";
+import { existsSync as existsSync29, unlinkSync as unlinkSync4, writeFileSync as writeFileSync14 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 function configPath3() {
-  return join23(homedir6(), ".continue", "config.json");
+  return join24(homedir6(), ".continue", "config.json");
 }
 function isContinueServerEntry(value) {
   return Boolean(value && typeof value === "object" && typeof value.name === "string");
@@ -26779,8 +27050,8 @@ var continueConnector = {
   hotkey: "n",
   describeLocation: () => configPath3(),
   async detect() {
-    const dir = join23(homedir6(), ".continue");
-    if (existsSync28(dir) || existsSync28(configPath3())) {
+    const dir = join24(homedir6(), ".continue");
+    if (existsSync29(dir) || existsSync29(configPath3())) {
       return { installed: true, note: "Found ~/.continue/" };
     }
     return { installed: false };
@@ -26818,7 +27089,7 @@ var continueConnector = {
       backupsDir: args.backupsDir,
       agentId: this.id
     });
-    if (!restored.restored && existsSync28(path)) {
+    if (!restored.restored && existsSync29(path)) {
       const after = readJsonFile(path);
       if (after.ok && after.value && typeof after.value === "object") {
         const root = after.value;
@@ -26828,7 +27099,7 @@ var continueConnector = {
           try {
             unlinkSync4(path);
           } catch {
-            writeFileSync13(path, `{}
+            writeFileSync14(path, `{}
 `, "utf-8");
           }
         }
@@ -26839,11 +27110,11 @@ var continueConnector = {
 };
 
 // src/lib/dev/agent-connectors/cursor.ts
-import { existsSync as existsSync29, unlinkSync as unlinkSync5, writeFileSync as writeFileSync14 } from "node:fs";
+import { existsSync as existsSync30, unlinkSync as unlinkSync5, writeFileSync as writeFileSync15 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 function globalConfigPath() {
-  return join24(homedir7(), ".cursor", "mcp.json");
+  return join25(homedir7(), ".cursor", "mcp.json");
 }
 var cursorConnector = {
   id: "cursor",
@@ -26851,9 +27122,9 @@ var cursorConnector = {
   hotkey: "u",
   describeLocation: () => globalConfigPath(),
   async detect() {
-    const cursorDir = join24(homedir7(), ".cursor");
-    const macAppSupport = join24(homedir7(), "Library", "Application Support", "Cursor");
-    if (existsSync29(cursorDir) || existsSync29(macAppSupport)) {
+    const cursorDir = join25(homedir7(), ".cursor");
+    const macAppSupport = join25(homedir7(), "Library", "Application Support", "Cursor");
+    if (existsSync30(cursorDir) || existsSync30(macAppSupport)) {
       return { installed: true, note: "Found Cursor config dir" };
     }
     return { installed: false };
@@ -26891,7 +27162,7 @@ var cursorConnector = {
       backupsDir: args.backupsDir,
       agentId: this.id
     });
-    if (!restored.restored && existsSync29(path)) {
+    if (!restored.restored && existsSync30(path)) {
       const after = readJsonFile(path);
       if (after.ok && after.value && typeof after.value === "object") {
         const root = after.value;
@@ -26901,7 +27172,7 @@ var cursorConnector = {
           try {
             unlinkSync5(path);
           } catch {
-            writeFileSync14(path, `{}
+            writeFileSync15(path, `{}
 `, "utf-8");
           }
         }
@@ -26912,30 +27183,30 @@ var cursorConnector = {
 };
 
 // src/lib/dev/agent-connectors/vscode-copilot.ts
-import { existsSync as existsSync30, unlinkSync as unlinkSync6, writeFileSync as writeFileSync15 } from "node:fs";
+import { existsSync as existsSync31, unlinkSync as unlinkSync6, writeFileSync as writeFileSync16 } from "node:fs";
 import { homedir as homedir8, platform as platform4 } from "node:os";
-import { join as join25, resolve as resolve5 } from "node:path";
+import { join as join26, resolve as resolve5 } from "node:path";
 function userLevelConfigPath() {
   const home = homedir8();
   const p2 = platform4();
   if (p2 === "darwin")
-    return join25(home, "Library", "Application Support", "Code", "User", "mcp.json");
+    return join26(home, "Library", "Application Support", "Code", "User", "mcp.json");
   if (p2 === "win32") {
-    const appData = process.env["APPDATA"] ?? join25(home, "AppData", "Roaming");
-    return join25(appData, "Code", "User", "mcp.json");
+    const appData = process.env["APPDATA"] ?? join26(home, "AppData", "Roaming");
+    return join26(appData, "Code", "User", "mcp.json");
   }
-  const xdg = process.env["XDG_CONFIG_HOME"] ?? join25(home, ".config");
-  return join25(xdg, "Code", "User", "mcp.json");
+  const xdg = process.env["XDG_CONFIG_HOME"] ?? join26(home, ".config");
+  return join26(xdg, "Code", "User", "mcp.json");
 }
 function isHomeDir(cwd) {
   return resolve5(cwd) === resolve5(homedir8());
 }
 function hasWorkspaceVscode(cwd) {
-  return existsSync30(join25(cwd, ".vscode"));
+  return existsSync31(join26(cwd, ".vscode"));
 }
 function configPath4(cwd) {
   if (!isHomeDir(cwd) && hasWorkspaceVscode(cwd)) {
-    return join25(cwd, ".vscode", "mcp.json");
+    return join26(cwd, ".vscode", "mcp.json");
   }
   return userLevelConfigPath();
 }
@@ -26949,7 +27220,7 @@ var vscodeCopilotConnector = {
     if (!isHomeDir(here) && hasWorkspaceVscode(here)) {
       return { installed: true, note: "Found .vscode/ in current dir" };
     }
-    if (existsSync30(userLevelConfigPath().replace(/mcp\.json$/, ""))) {
+    if (existsSync31(userLevelConfigPath().replace(/mcp\.json$/, ""))) {
       return { installed: true, note: "Found VS Code user profile" };
     }
     return { installed: false };
@@ -26987,7 +27258,7 @@ var vscodeCopilotConnector = {
       backupsDir: args.backupsDir,
       agentId: this.id
     });
-    if (!restored.restored && existsSync30(path)) {
+    if (!restored.restored && existsSync31(path)) {
       const after = readJsonFile(path);
       if (after.ok && after.value && typeof after.value === "object") {
         const root = after.value;
@@ -26997,7 +27268,7 @@ var vscodeCopilotConnector = {
           try {
             unlinkSync6(path);
           } catch {
-            writeFileSync15(path, `{}
+            writeFileSync16(path, `{}
 `, "utf-8");
           }
         }
@@ -27149,6 +27420,16 @@ function buildConnectionName(serverId) {
 }
 function registerDevCommand(program2) {
   const dev = program2.command("dev").description("Run a deployed MCP server locally with hot reload + agent auto-wire").option("--server <serverId>", "Server ID (default: from .mcpcloud/state.json)").option("--org <organizationId>", "Organization ID (overrides default)").option("--port <number>", "Local port (default 8787)").option("--transport <list>", "Comma-separated: http,sse,stdio (default http,sse)").option("--stdio", "Shorthand for --transport stdio").option("--offline", "Use cached bundle, skip Convex sync").option("--no-watch", "Disable file watcher").option("--no-connect", "Disable agent auto-wire prompts").option("--auto-connect <agent>", "Auto-wire the named agent (claude-code, cursor, codex, vscode-copilot, continue)").option("--no-inspector", "Disable the inspector UI (default: enabled at /__inspect)").option("--spec <path>", "Watch this OpenAPI spec file and regenerate the bundle on change").option("--no-auto-regen", "Show spec drift but do not auto-apply (manual file edit still works)").option("--regen-grace <seconds>", "Grace period before auto-applying spec changes (default 5)").option("--enrich-on-change", "Preserve per-tool enrichment when the spec changes").option("--open <choice>", "Open an editor on startup: yes | always | no | never | ask").option("--open-target <choice>", "What to open: tools (.mcpcloud/tools/<server>/) | bundle (read-only .mcpcloud/server/) | all (both). When omitted on first run, mcp dev prompts.").option("--editor <command>", "Editor binary for this invocation (e.g. cursor, code, windsurf). Overrides saved editorCommand and the multi-editor picker.").option("--verbose", "Verbose logs").action(runAction(runDev));
+  dev.addHelpText("after", `
+Git-native mode (automatic):
+  If the chosen server is linked to a GitHub repo, mcp dev clones it under
+  .mcpcloud/git/ and runs against the working copy — no flag needed. Edit in
+  your own editor, then commit + push: the webhook reconciles src/** back into
+  MCPCloud. The CLI's tool/handler PATCH watchers are off in this mode (native
+  git is the version control). Config under mcpcloud/ is a read-only mirror —
+  change it in the dashboard. Deploy when ready with \`mcp deploy\` or the UI.
+  An unlinked server uses the default flow (download bundle, edit via dashboard).
+`);
   dev.command("list").description("List running mcp dev sessions on this machine").action(runAction(runDevList));
   dev.command("kill <pid>").description('Stop a running mcp dev session by PID (or "all" to stop every session)').action(runAction(runDevKill));
   dev.command("init").description("Interactively pick an organization + server and write .mcpcloud/state.json (forces the picker even if state already exists)").action(runAction(runDevInit));
@@ -27178,7 +27459,8 @@ async function runDevInit() {
     bundleVersion: 0,
     lastSyncedAt: 0,
     transports: ["http", "sse"],
-    port: 8787
+    port: 8787,
+    serverName: result.target.serverName
   });
   printSuccess(`Saved .mcpcloud/state.json — run ${c.bold("mcp dev")} to start.`);
 }
@@ -27234,6 +27516,21 @@ async function runDev(opts) {
   const cached2 = readState(cwd);
   let serverId = opts.server ?? cached2?.serverId;
   let organizationId = opts.org ?? cached2?.organizationId ?? undefined;
+  if (!opts.server && cached2?.serverId && canRunInteractive()) {
+    const choice = await promptResumeOrSwitch({
+      serverId: cached2.serverId,
+      ...cached2.serverName !== undefined ? { serverName: cached2.serverName } : {}
+    });
+    if (choice === "cancel")
+      process.exit(1);
+    if (choice === "switch") {
+      const result = await runInteractiveBootstrap();
+      if (result.kind !== "resolved")
+        process.exit(1);
+      serverId = result.target.serverId;
+      organizationId = result.target.organizationId;
+    }
+  }
   if (!serverId) {
     if (!canRunInteractive()) {
       printError("No server selected. Pass --server <serverId>, run `mcp dev init` to pick one interactively, or run from a directory with .mcpcloud/state.json.");
@@ -27274,7 +27571,7 @@ async function runDev(opts) {
   let specPath = null;
   if (opts.spec) {
     const resolved = resolveSpecPath(cwd, opts.spec);
-    if (!existsSync31(resolved)) {
+    if (!existsSync32(resolved)) {
       printError(`Spec file not found: ${resolved}`);
       process.exit(1);
     }
@@ -27303,7 +27600,8 @@ async function runDev(opts) {
     enrichOnChange,
     openChoice,
     openTargetOverride,
-    editorOverride
+    editorOverride,
+    gitNative: prepared.gitNative
   });
 }
 async function emitStaleHandlerOverrideWarning(args) {
@@ -27338,6 +27636,21 @@ async function runWithRuntime(args) {
     }
   });
   runtime = launch();
+  let fullShutdownReady = false;
+  const killRuntimeNow = () => {
+    try {
+      runtime?.child.kill("SIGKILL");
+    } catch {}
+  };
+  process.once("exit", killRuntimeNow);
+  const earlySignal = (signal) => {
+    if (fullShutdownReady)
+      return;
+    killRuntimeNow();
+    process.exit(signal === "SIGINT" ? 130 : 143);
+  };
+  process.on("SIGINT", () => earlySignal("SIGINT"));
+  process.on("SIGTERM", () => earlySignal("SIGTERM"));
   const baseUrl = `http://127.0.0.1:${args.port}`;
   const mcpUrl = `${baseUrl}/mcp`;
   const connectionName = buildConnectionName(args.serverId);
@@ -27354,7 +27667,14 @@ async function runWithRuntime(args) {
     });
     wired.push(...selected);
   }
-  if (args.transports[0] !== "stdio") {
+  if (args.transports[0] !== "stdio" && args.gitNative) {
+    await maybeOpenEditor({
+      dir: args.prepared.repoDir ?? args.prepared.destDir,
+      target: "bundle",
+      override: args.openChoice,
+      editorOverride: args.editorOverride
+    });
+  } else if (args.transports[0] !== "stdio") {
     const savedTarget = readConfig().editorOpenTarget;
     let target = resolveOpenTarget({
       override: args.openTargetOverride,
@@ -27405,11 +27725,16 @@ async function runWithRuntime(args) {
   const watcher = args.watch ? watchDir({
     rootDir: args.prepared.destDir,
     debounceMs: 250,
-    ignore: ["node_modules", "_mcpsh_host.mjs", ".git"],
+    ignore: [
+      "node_modules",
+      "_mcpsh_host.mjs",
+      "_mcpsh_inspector.mjs",
+      ".git"
+    ],
     onChange: async (path) => {
       if (shuttingDown)
         return;
-      if (shouldWarnAboutBundleEdit({
+      if (!args.gitNative && shouldWarnAboutBundleEdit({
         changedPath: path,
         alreadyWarned: bundleEditWarned,
         suppressed: suppressBundleWarn,
@@ -27427,14 +27752,14 @@ async function runWithRuntime(args) {
       runtime = launch();
     }
   }) : null;
-  const toolsWatcher = args.watch ? startToolsWatcher({
+  const toolsWatcher = args.watch && !args.gitNative ? startToolsWatcher({
     cwd: args.cwd,
     serverId: args.serverId,
     organizationId: args.organizationId,
     projectId: args.prepared.state.projectId,
     devBaseUrl: args.inspector ? baseUrl : undefined
   }) : null;
-  const handlersWatcher = args.watch ? startHandlersWatcher({
+  const handlersWatcher = args.watch && !args.gitNative ? startHandlersWatcher({
     cwd: args.cwd,
     serverId: args.serverId,
     organizationId: args.organizationId,
@@ -27443,7 +27768,7 @@ async function runWithRuntime(args) {
   let specWatcher = null;
   let pendingApply = null;
   let regenInFlight = false;
-  if (args.specPath) {
+  if (args.specPath && !args.gitNative) {
     const initial = readSpecFile(args.specPath);
     let lastAppliedHash = initial.hash;
     specWatcher = watchSpecFile({
@@ -27524,20 +27849,60 @@ async function runWithRuntime(args) {
     printInfo(`  ${c.dim("Inspector:   ")} ${c.cyan(`${baseUrl}/__inspect`)}`);
   }
   printInfo(`  ${c.dim(`Edit files in ${relative7(args.cwd, args.prepared.destDir)}/ to hot-reload.`)}`);
+  if (args.gitNative && args.prepared.repoDir) {
+    printInfo(`  ${c.dim(`Git-native: edit + commit + push in ${relative7(args.cwd, args.prepared.repoDir)}/ — the webhook reconciles src/**.`)}`);
+    printInfo(`  ${c.dim("Config under mcpcloud/ is read-only; change it in the dashboard. Deploy when ready (mcp deploy).")}`);
+  }
   if (toolsWatcher) {
     printInfo(`  ${c.dim(`Edit tool metadata in .mcpcloud/tools/${args.serverId}/ (changes push to cloud on save).`)}`);
   }
   if (handlersWatcher) {
     printInfo(`  ${c.dim(`Edit tool handlers in .mcpcloud/server/src/tools/<slug>.ts (changes push to cloud on save).`)}`);
   }
-  if (args.specPath) {
+  if (specWatcher) {
     printInfo(`  ${c.dim(`Spec watch:    ${relative7(args.cwd, args.specPath)}`)}`);
   }
-  await emitStaleHandlerOverrideWarning({
-    organizationId: args.organizationId,
-    projectId: args.prepared.state.projectId,
-    serverId: args.serverId
-  });
+  const gitPullPoller = args.gitNative ? startGitPullPoll({
+    fetchStatus: () => resolveServerGitPullStatus({
+      serverId: args.serverId,
+      organizationId: args.organizationId
+    }),
+    onChange: (status) => {
+      if (shuttingDown)
+        return;
+      const sha = status.lastPulledGitSha ? status.lastPulledGitSha.slice(0, 7) : "HEAD";
+      if (status.rejectedFileCount > 0) {
+        printWarn(`Push ${sha}: MCPCloud rejected ${status.rejectedFileCount} file${status.rejectedFileCount === 1 ? "" : "s"} (unsafe handler code).`);
+        if (status.error)
+          printInfo(`  ${c.dim(status.error)}`);
+        printInfo(`  ${c.dim("Fix the flagged file(s) and push again.")}`);
+        return;
+      }
+      if (status.status === "error") {
+        printWarn(`Push ${sha}: MCPCloud could not reconcile — ${status.error ?? "unknown error"}.`);
+        return;
+      }
+      if (status.status !== "pulled") {
+        printInfo(`Push ${sha}: ${status.hadConfigDrift ? "touched the read-only mcpcloud/ config — ignored." : "touched only generated files outside src/** — nothing synced."}`);
+        printInfo(`  ${c.dim("Only src/ round-trips; edit there to sync. README / mcpcloud/ are generated.")}`);
+        return;
+      }
+      const parts = [`${status.pulledFileCount} updated`];
+      if (status.deletedFileCount > 0) {
+        parts.push(`${status.deletedFileCount} deleted`);
+      }
+      printSuccess(`Push ${sha} reconciled (${parts.join(", ")}) — changes ready for deployment.`);
+      printInfo(`  ${c.dim("Deploy with")} ${c.bold("mcp deploy")} ${c.dim("or the dashboard — no preview needed, this session is your local server.")}`);
+    },
+    onError: () => {}
+  }) : null;
+  if (!args.gitNative) {
+    await emitStaleHandlerOverrideWarning({
+      organizationId: args.organizationId,
+      projectId: args.prepared.state.projectId,
+      serverId: args.serverId
+    });
+  }
   printInfo(`  ${c.dim("Ctrl+C to stop.")}`);
   if (isJsonMode()) {
     printJson({
@@ -27576,6 +27941,9 @@ async function runWithRuntime(args) {
     try {
       specWatcher?.close();
     } catch {}
+    try {
+      gitPullPoller?.close();
+    } catch {}
     if (pendingApply) {
       clearTimeout(pendingApply);
       pendingApply = null;
@@ -27595,6 +27963,7 @@ async function runWithRuntime(args) {
     printSuccess("Bye.");
     process.exit(0);
   };
+  fullShutdownReady = true;
   process.on("SIGINT", () => void shutdown("SIGINT"));
   process.on("SIGTERM", () => void shutdown("SIGTERM"));
   shortcuts = startShortcuts({
@@ -28018,13 +28387,13 @@ async function confirmRollback(deploymentId) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync33, statSync as statSync6, readFileSync as readFileSync17 } from "node:fs";
+import { existsSync as existsSync34, statSync as statSync6, readFileSync as readFileSync18 } from "node:fs";
 import { homedir as homedir9, platform as platform6 } from "node:os";
-import { join as join27, delimiter as delimiter3 } from "node:path";
+import { join as join28, delimiter as delimiter3 } from "node:path";
 
 // src/lib/version-check.ts
-import { existsSync as existsSync32, mkdirSync as mkdirSync13, readFileSync as readFileSync16, writeFileSync as writeFileSync16 } from "node:fs";
-import { join as join26 } from "node:path";
+import { existsSync as existsSync33, mkdirSync as mkdirSync14, readFileSync as readFileSync17, writeFileSync as writeFileSync17 } from "node:fs";
+import { join as join27 } from "node:path";
 var CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 var FETCH_TIMEOUT_MS2 = 2000;
 var REGISTRY_URL = "https://registry.npmjs.org/@mcpcloud/cli/latest";
@@ -28032,13 +28401,13 @@ function cacheDir() {
   return configDir();
 }
 function cacheFile() {
-  return join26(cacheDir(), "version-check.json");
+  return join27(cacheDir(), "version-check.json");
 }
 function readCache() {
-  if (!existsSync32(cacheFile()))
+  if (!existsSync33(cacheFile()))
     return null;
   try {
-    const raw = JSON.parse(readFileSync16(cacheFile(), "utf-8"));
+    const raw = JSON.parse(readFileSync17(cacheFile(), "utf-8"));
     if (typeof raw.latest !== "string" || typeof raw.fetchedAt !== "number")
       return null;
     return { latest: raw.latest, fetchedAt: raw.fetchedAt };
@@ -28048,9 +28417,9 @@ function readCache() {
 }
 function writeCache(entry) {
   try {
-    if (!existsSync32(cacheDir()))
-      mkdirSync13(cacheDir(), { recursive: true, mode: 448 });
-    writeFileSync16(cacheFile(), JSON.stringify(entry, null, 2), { mode: 384 });
+    if (!existsSync33(cacheDir()))
+      mkdirSync14(cacheDir(), { recursive: true, mode: 448 });
+    writeFileSync17(cacheFile(), JSON.stringify(entry, null, 2), { mode: 384 });
   } catch {}
 }
 function compareVersions(a, b) {
@@ -28161,8 +28530,8 @@ function checkNode() {
 }
 function checkConfigFile() {
   const t0 = Date.now();
-  const path = join27(homedir9(), ".mcpcloud", "config.json");
-  if (!existsSync33(path)) {
+  const path = join28(homedir9(), ".mcpcloud", "config.json");
+  if (!existsSync34(path)) {
     return {
       name: "Config file",
       status: "warn",
@@ -28184,7 +28553,7 @@ function checkConfigFile() {
     } catch {}
   }
   try {
-    JSON.parse(readFileSync17(path, "utf-8"));
+    JSON.parse(readFileSync18(path, "utf-8"));
   } catch (err) {
     return {
       name: "Config file",
@@ -28319,8 +28688,8 @@ function checkClaudeCli() {
   for (const dir of PATH.split(delimiter3)) {
     if (!dir)
       continue;
-    const candidate = join27(dir, exe);
-    if (existsSync33(candidate)) {
+    const candidate = join28(dir, exe);
+    if (existsSync34(candidate)) {
       return {
         name: "claude CLI",
         status: "pass",
@@ -29261,38 +29630,38 @@ function registerOAuthCommands(program2) {
 // src/lib/plugins.ts
 import { spawn as spawn7 } from "node:child_process";
 import {
-  existsSync as existsSync34,
-  mkdirSync as mkdirSync14,
+  existsSync as existsSync35,
+  mkdirSync as mkdirSync15,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync18,
+  readFileSync as readFileSync19,
   rmSync as rmSync3,
   statSync as statSync7
 } from "node:fs";
-import { join as join28 } from "node:path";
+import { join as join29 } from "node:path";
 import { pathToFileURL } from "node:url";
 function pluginsDir() {
-  return join28(configDir(), "plugins");
+  return join29(configDir(), "plugins");
 }
 function ensureDir2() {
   const dir = pluginsDir();
-  if (!existsSync34(dir))
-    mkdirSync14(dir, { recursive: true, mode: 448 });
+  if (!existsSync35(dir))
+    mkdirSync15(dir, { recursive: true, mode: 448 });
 }
 function readManifestFromPackageDir(packageDir) {
-  const pkgPath = join28(packageDir, "package.json");
-  if (!existsSync34(pkgPath))
+  const pkgPath = join29(packageDir, "package.json");
+  if (!existsSync35(pkgPath))
     return null;
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync18(pkgPath, "utf-8"));
+    pkg = JSON.parse(readFileSync19(pkgPath, "utf-8"));
   } catch {
     return null;
   }
   if (!pkg.name)
     return null;
   const relEntry = pkg.mcpsh?.register ?? pkg.main ?? "index.js";
-  const entry = join28(packageDir, relEntry);
-  if (!existsSync34(entry))
+  const entry = join29(packageDir, relEntry);
+  if (!existsSync35(entry))
     return null;
   return {
     name: pkg.name,
@@ -29303,11 +29672,11 @@ function readManifestFromPackageDir(packageDir) {
 }
 function listInstalledPlugins() {
   const dir = pluginsDir();
-  if (!existsSync34(dir))
+  if (!existsSync35(dir))
     return [];
   const out = [];
   for (const entry of readdirSync4(dir)) {
-    const full = join28(dir, entry);
+    const full = join29(dir, entry);
     let s;
     try {
       s = statSync7(full);
@@ -29318,7 +29687,7 @@ function listInstalledPlugins() {
       continue;
     if (entry.startsWith("@")) {
       for (const child of readdirSync4(full)) {
-        const m2 = readManifestFromPackageDir(join28(full, child));
+        const m2 = readManifestFromPackageDir(join29(full, child));
         if (m2)
           out.push(m2);
       }
@@ -29351,26 +29720,43 @@ async function loadPlugins(program2) {
     }
   }
 }
-function runShell(command, cwd) {
+var PACKAGE_SPEC_PATTERN = /^(@[a-z0-9~-][\w.~-]*\/)?[a-z0-9~-][\w.~-]*(@[-\w.^~><=*+|]+)?$/i;
+function runNpm(args, cwd) {
   return new Promise((resolve7) => {
-    const child = spawn7(command, { shell: true, cwd, stdio: "inherit" });
+    const isWindows = process.platform === "win32";
+    const child = spawn7(isWindows ? "npm.cmd" : "npm", args, {
+      shell: isWindows,
+      cwd,
+      stdio: "inherit"
+    });
     child.on("close", (code) => resolve7(code ?? 1));
     child.on("error", () => resolve7(1));
   });
 }
 async function installPlugin(packageSpec) {
+  if (!PACKAGE_SPEC_PATTERN.test(packageSpec)) {
+    throw new Error(`"${packageSpec}" is not a plain name@version npm package spec. URL, git, and path specs are not supported for plugins.`);
+  }
   ensureDir2();
   const dir = pluginsDir();
-  const code = await runShell(`npm install --prefix "${dir}" --no-save --silent ${JSON.stringify(packageSpec)}`, dir);
+  const code = await runNpm([
+    "install",
+    "--prefix",
+    dir,
+    "--no-save",
+    "--silent",
+    "--ignore-scripts",
+    packageSpec
+  ], dir);
   if (code !== 0) {
     throw new Error(`npm install ${packageSpec} exited with code ${code}.`);
   }
-  const nm = join28(dir, "node_modules");
-  if (!existsSync34(nm)) {
+  const nm = join29(dir, "node_modules");
+  if (!existsSync35(nm)) {
     throw new Error(`npm install ran but produced no node_modules under ${dir}.`);
   }
   const baseName = packageSpec.replace(/@[^@/]+$/, "");
-  const candidatePath = baseName.startsWith("@") ? join28(nm, baseName.split("/")[0], baseName.split("/")[1] ?? "") : join28(nm, baseName);
+  const candidatePath = baseName.startsWith("@") ? join29(nm, baseName.split("/")[0], baseName.split("/")[1] ?? "") : join29(nm, baseName);
   const manifest = readManifestFromPackageDir(candidatePath);
   if (!manifest) {
     throw new Error(`Installed but could not read plugin manifest at ${candidatePath}.`);
@@ -29378,26 +29764,26 @@ async function installPlugin(packageSpec) {
   return { name: manifest.name, entry: manifest.entry };
 }
 function removePlugin(name) {
-  const nm = join28(pluginsDir(), "node_modules");
-  if (!existsSync34(nm))
+  const nm = join29(pluginsDir(), "node_modules");
+  if (!existsSync35(nm))
     return false;
-  const target = name.startsWith("@") ? join28(nm, name.split("/")[0], name.split("/")[1] ?? "") : join28(nm, name);
-  if (!existsSync34(target))
+  const target = name.startsWith("@") ? join29(nm, name.split("/")[0], name.split("/")[1] ?? "") : join29(nm, name);
+  if (!existsSync35(target))
     return false;
   rmSync3(target, { recursive: true, force: true });
   return true;
 }
 function listInstalledPluginsCombined() {
   const direct = listInstalledPlugins();
-  const nm = join28(pluginsDir(), "node_modules");
-  if (!existsSync34(nm))
+  const nm = join29(pluginsDir(), "node_modules");
+  if (!existsSync35(nm))
     return direct;
   const seen = new Set(direct.map((p2) => p2.name));
   const out = [...direct];
   for (const entry of readdirSync4(nm)) {
     if (entry === ".bin" || entry === ".package-lock.json")
       continue;
-    const full = join28(nm, entry);
+    const full = join29(nm, entry);
     let s;
     try {
       s = statSync7(full);
@@ -29408,7 +29794,7 @@ function listInstalledPluginsCombined() {
       continue;
     if (entry.startsWith("@")) {
       for (const child of readdirSync4(full)) {
-        const m2 = readManifestFromPackageDir(join28(full, child));
+        const m2 = readManifestFromPackageDir(join29(full, child));
         if (m2 && !seen.has(m2.name)) {
           seen.add(m2.name);
           out.push(m2);
@@ -30994,12 +31380,12 @@ function displayValueFor(field, value) {
 
 // src/lib/tui/state-store.ts
 import {
-  existsSync as existsSync35,
-  mkdirSync as mkdirSync15,
-  readFileSync as readFileSync19,
-  writeFileSync as writeFileSync17
+  existsSync as existsSync36,
+  mkdirSync as mkdirSync16,
+  readFileSync as readFileSync20,
+  writeFileSync as writeFileSync18
 } from "node:fs";
-import { join as join29 } from "node:path";
+import { join as join30 } from "node:path";
 var ALL_TABS = [
   "servers",
   "projects",
@@ -31009,7 +31395,7 @@ var ALL_TABS = [
   "devSessions"
 ];
 function tuiStateFile() {
-  return join29(configDir(), "tui-state.json");
+  return join30(configDir(), "tui-state.json");
 }
 function isTab(v2) {
   return typeof v2 === "string" && ALL_TABS.includes(v2);
@@ -31074,11 +31460,11 @@ function sanitizeTuiState(input) {
 }
 function readTuiState() {
   const path = tuiStateFile();
-  if (!existsSync35(path))
+  if (!existsSync36(path))
     return {};
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync19(path, "utf-8"));
+    parsed = JSON.parse(readFileSync20(path, "utf-8"));
   } catch {
     return {};
   }
@@ -31086,10 +31472,10 @@ function readTuiState() {
 }
 function writeTuiState(state) {
   try {
-    if (!existsSync35(configDir())) {
-      mkdirSync15(configDir(), { recursive: true, mode: 448 });
+    if (!existsSync36(configDir())) {
+      mkdirSync16(configDir(), { recursive: true, mode: 448 });
     }
-    writeFileSync17(tuiStateFile(), JSON.stringify(state, null, 2), {
+    writeFileSync18(tuiStateFile(), JSON.stringify(state, null, 2), {
       encoding: "utf-8",
       mode: 384
     });
@@ -33713,7 +34099,7 @@ function registerUiCommand(program2) {
 
 // src/commands/update.ts
 import { spawn as spawn9 } from "node:child_process";
-import { dirname as dirname8 } from "node:path";
+import { dirname as dirname9 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function detectInstallContext() {
   const override = process.env["MCPSH_PACKAGE_MANAGER"]?.trim().toLowerCase();
@@ -33726,7 +34112,7 @@ function detectInstallContext() {
   }
   const here = (() => {
     try {
-      return dirname8(fileURLToPath2(import.meta.url));
+      return dirname9(fileURLToPath2(import.meta.url));
     } catch {
       return process.argv[1] ?? "";
     }
@@ -33773,7 +34159,7 @@ function buildCommand(manager) {
       return "npm install -g @mcpcloud/cli@latest";
   }
 }
-function runShell2(command) {
+function runShell(command) {
   return new Promise((resolve7) => {
     const child = spawn9(command, { shell: true, stdio: "inherit" });
     child.on("close", (code) => resolve7(code ?? 1));
@@ -33821,7 +34207,7 @@ function registerUpdateCommand(program2) {
     const ctx = detectInstallContext();
     printStep(`Running: ${c.cyan(ctx.command)}`);
     printInfo(c.dim(`  (${ctx.rationale}; override with MCPSH_PACKAGE_MANAGER)`));
-    const code = await runShell2(ctx.command);
+    const code = await runShell(ctx.command);
     if (code !== 0) {
       if (isJsonMode())
         printJson({