@memnexus-ai/cli 1.7.222 → 1.7.224

package/dist/lib/renderable-retrieval.js

@@ -0,0 +1,364 @@
+"use strict";
+/**
+ * Renderable retrieval results — retrieval health that cannot be dropped.
+ *
+ * WHY THIS MODULE EXISTS
+ *
+ * A transient retrieval failure that produces a confident-looking empty (or
+ * short) answer is worse than a sustained outage. An outage is obvious and the
+ * caller retries. A quiet partial failure is not: the agent reads "no results",
+ * records "no prior art found" as a fact, and moves on. Nobody re-runs the
+ * query, so the wrong conclusion outlives the failure that caused it.
+ *
+ * The CLI already had a degraded-retrieval warning. It had never fired once:
+ * it read `meta.degraded`, while the digest wire carries `metadata.degraded`
+ * (GH #5124). Its test constructed the fictional shape the buggy code expected,
+ * so the suite stayed green over a feature that had never worked. The root
+ * cause was not one typo — it was that every render path took the raw response
+ * as `any` and each one was free to forget the health check.
+ *
+ * THE DESIGN
+ *
+ * Health is carried structurally, not by convention:
+ *
+ *  - `RenderableSearchResult`, `RenderableDigestResult` and
+ *    `RenderableContextBriefing` have PRIVATE constructors. The
+ *    `from*Response` factories are the only way to build one.
+ *  - Those factories are the ONE place the wire-field mapping lives —
+ *    `meta.degraded` (search, build-context) vs `metadata.degraded` (digest),
+ *    the naming inconsistency that caused #5124.
+ *  - Every renderable exposes `health: DegradationState`, where `degraded` is a
+ *    required boolean and `failures` is always an array (empty when healthy).
+ *    There is no `undefined` to forget to check.
+ *  - Raw wire types are NOT exported from this module. A render path cannot
+ *    take the raw response instead, and a new output format cannot be written
+ *    without accepting a value that carries health.
+ *
+ * OUTPUT CONVENTIONS
+ *
+ *  - The warning line goes to STDERR in every format. stderr is the one channel
+ *    that survives `| jq`, `--id-only` piping and `--format json`, where stdout
+ *    must stay machine-parseable.
+ *  - Object-shaped JSON/YAML payloads additionally carry a `health` object on
+ *    stdout, and only when degraded — matching the server convention that a
+ *    healthy response gains no new fields (search.schema.ts).
+ *
+ * This module deliberately has no imports: colouring is the caller's job, and a
+ * dependency-free module keeps the type-level enforcement test cheap to run.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RenderableContextBriefing = exports.RenderableDigestResult = exports.RenderableSearchResult = exports.DEGRADED_HEADLINE_SUFFIX = exports.DEGRADED_MARKER = void 0;
+exports.degradationWarningLine = degradationWarningLine;
+exports.degradationSummaryLine = degradationSummaryLine;
+exports.degradationHeadlineSuffix = degradationHeadlineSuffix;
+/** Shared marker text. Every surface uses this string so it is greppable. */
+exports.DEGRADED_MARKER = '⚠ Degraded retrieval';
+/** Suffix appended to a command's headline when the response is degraded. */
+exports.DEGRADED_HEADLINE_SUFFIX = ' — INCOMPLETE (degraded retrieval)';
+const HEALTHY = Object.freeze({
+    degraded: false,
+    failures: Object.freeze([]),
+});
+/**
+ * Branch names are server-supplied and land on stderr, which agents read.
+ * Constrain them to an identifier shape and cap the count rather than echoing
+ * arbitrary text: an unbounded string here is an injection channel into agent
+ * context (and can carry ANSI escapes from a hostile apiUrl).
+ */
+const BRANCH_NAME_PATTERN = /^[A-Za-z0-9_-]{1,32}$/;
+const MAX_BRANCH_NAMES = 8;
+function toStatus(raw) {
+    return raw === 'timeout' || raw === 'error' ? raw : 'unknown';
+}
+/**
+ * Read a wire `branchFailures` array. Accepts both shapes the API emits today:
+ * plain strings, and `{ name, status }` objects (search adds `reason`, digest
+ * adds `error`; neither is rendered).
+ */
+function readBranchFailures(raw) {
+    if (!Array.isArray(raw))
+        return HEALTHY.failures;
+    const out = [];
+    for (const entry of raw) {
+        const name = typeof entry === 'string' ? entry : (entry?.name ?? entry?.branch);
+        if (typeof name !== 'string' || !BRANCH_NAME_PATTERN.test(name))
+            continue;
+        out.push({ name, status: toStatus(entry?.status) });
+        if (out.length >= MAX_BRANCH_NAMES)
+            break;
+    }
+    return Object.freeze(out);
+}
+/**
+ * Map a container that carries the PR-3 partial-failure contract
+ * (`degraded` + `branchFailures`) into a DegradationState.
+ *
+ * This is the single place that reads those field names. Callers pass
+ * `body.meta` (search, build-context) or `body.metadata` (digest) — the
+ * difference the #5124 bug lived in.
+ */
+function readDegradation(container) {
+    const c = container;
+    if (!c || typeof c !== 'object' || c.degraded !== true)
+        return HEALTHY;
+    return Object.freeze({ degraded: true, failures: readBranchFailures(c.branchFailures) });
+}
+/**
+ * build-context reports failure per SECTION rather than per search branch
+ * (`meta.timedOutSections` / `meta.failedSections`, memories.routes.ts). Map
+ * both lists onto the same BranchFailure vocabulary so one marker renderer
+ * serves every surface.
+ */
+function readSectionDegradation(container) {
+    const c = container;
+    if (!c || typeof c !== 'object' || c.degraded !== true)
+        return HEALTHY;
+    const failures = [];
+    const collect = (raw, status) => {
+        if (!Array.isArray(raw))
+            return;
+        for (const name of raw) {
+            if (typeof name !== 'string' || !BRANCH_NAME_PATTERN.test(name))
+                continue;
+            if (failures.length >= MAX_BRANCH_NAMES)
+                return;
+            failures.push({ name, status });
+        }
+    };
+    collect(c.timedOutSections, 'timeout');
+    collect(c.failedSections, 'error');
+    return Object.freeze({ degraded: true, failures: Object.freeze(failures) });
+}
+/** Serialisable form of health, embedded in object-shaped JSON/YAML payloads. */
+function healthPayload(health) {
+    return {
+        degraded: health.degraded,
+        failures: health.failures.map((f) => ({ name: f.name, status: f.status })),
+    };
+}
+/**
+ * Replace a wire container's raw `branchFailures` with the sanitised set.
+ *
+ * Sanitising only the `health` fold is not enough: `--format json` and
+ * `--format yaml` also emit the response body, so the ORIGINAL server-supplied
+ * `meta.branchFailures` / `metadata.branchFailures` would still reach stdout
+ * unfiltered — the same injection channel the identifier-shape filter exists to
+ * close, on the one format agents parse rather than read. JSON.stringify and
+ * js-yaml both escape C0 control bytes (checked: js-yaml v4 renders ESC as
+ * `\e` inside a double-quoted scalar, so no raw escape sequence reaches a
+ * terminal), but neither touches plain-text instructions, and plain text is
+ * what an agent acts on.
+ *
+ * Replacement rather than deletion: the failed branch names survive, in their
+ * filtered form. The digest shape's free-text `error` message does not — it is
+ * unbounded server-authored prose on a channel an agent parses, and the
+ * closed-vocabulary `status` already says how the branch failed.
+ */
+function withSanitizedFailures(container, health) {
+    const c = container;
+    if (!c || typeof c !== 'object')
+        return c;
+    if (!('branchFailures' in c))
+        return c;
+    return { ...c, branchFailures: healthPayload(health).failures };
+}
+/**
+ * build-context reports failures as two lists of section names rather than a
+ * `branchFailures` array, so it needs the same treatment in its own shape.
+ */
+function withSanitizedSections(container, health) {
+    const c = container;
+    if (!c || typeof c !== 'object')
+        return c;
+    const names = (status) => health.failures.filter((f) => f.status === status).map((f) => f.name);
+    return {
+        ...c,
+        ...('timedOutSections' in c ? { timedOutSections: names('timeout') } : {}),
+        ...('failedSections' in c ? { failedSections: names('error') } : {}),
+    };
+}
+/**
+ * The stderr warning line for a response, or null when the response is healthy.
+ * Plain text — the caller applies colour.
+ */
+function degradationWarningLine(health) {
+    if (!health.degraded)
+        return null;
+    const names = health.failures.map((f) => f.name);
+    const detail = names.length
+        ? `failed branches: ${names.join(', ')}`
+        : 'one or more retrieval branches failed';
+    return (`${exports.DEGRADED_MARKER} — ${detail}. These results are incomplete; re-run before ` +
+        'treating them as a full answer.');
+}
+/**
+ * A one-line marker for human stdout renderers (table footer, timeline header,
+ * grouped header). Null when healthy.
+ */
+function degradationSummaryLine(health) {
+    if (!health.degraded)
+        return null;
+    const names = health.failures.map((f) => f.name);
+    const detail = names.length ? ` (${names.join(', ')})` : '';
+    return `${exports.DEGRADED_MARKER}${detail} — results below are INCOMPLETE.`;
+}
+/** Headline suffix for spinners; empty string when healthy. */
+function degradationHeadlineSuffix(health) {
+    return health.degraded ? exports.DEGRADED_HEADLINE_SUFFIX : '';
+}
+function normaliseResults(raw) {
+    if (!Array.isArray(raw))
+        return Object.freeze([]);
+    return Object.freeze(raw.map((r) => r && r.memory ? r : { memory: r, score: r?.score, matchedVia: r?.matchedVia }));
+}
+/**
+ * A search response that has been through the health mapping.
+ *
+ * Construction is via `fromApiResponse` / `fromListResponse` only — the private
+ * constructor is what makes the health check impossible to bypass.
+ */
+class RenderableSearchResult {
+    results;
+    total;
+    searchMethod;
+    temporalMetadata;
+    health;
+    body;
+    constructor(
+    /** Normalised `{ memory, score, matchedVia }` hits. */
+    results, 
+    /** `meta.total` when the server sent one, else the result count. */
+    total, 
+    /** `meta.searchMethod`, when present. */
+    searchMethod, 
+    /** `meta.temporalMetadata`, when present. */
+    temporalMetadata, 
+    /** Retrieval health. Always populated. */
+    health, body) {
+        this.results = results;
+        this.total = total;
+        this.searchMethod = searchMethod;
+        this.temporalMetadata = temporalMetadata;
+        this.health = health;
+        this.body = body;
+    }
+    /**
+     * Map a `/api/memories/search` body. Health lives at `meta.degraded` +
+     * `meta.branchFailures` (search.schema.ts SearchMeta).
+     *
+     * Callers validate the body is usable first (a 2xx without a `data` array is
+     * an unusable response, not an empty result set — see
+     * `unusableResponseError` in the search command). This factory is tolerant so
+     * that mapping never throws inside a render path.
+     */
+    static fromApiResponse(body) {
+        const b = (body ?? {});
+        const results = normaliseResults(b.data);
+        const meta = b.meta;
+        return new RenderableSearchResult(results, typeof meta?.total === 'number' ? meta.total : results.length, typeof meta?.searchMethod === 'string' ? meta.searchMethod : undefined, meta?.temporalMetadata, readDegradation(meta), b);
+    }
+    /**
+     * Map a `/api/memories` list body (recap's no-query path). The list endpoint
+     * runs no search branches and carries no health signal, so the result is
+     * healthy by construction — recorded here rather than left implicit.
+     */
+    static fromListResponse(body) {
+        const b = (body ?? {});
+        const results = Object.freeze((Array.isArray(b.data) ? b.data : []).map((m) => ({ memory: m })));
+        return new RenderableSearchResult(results, results.length, undefined, undefined, HEALTHY, b);
+    }
+    /**
+     * The JSON/YAML payload: the response body with results normalised, plus a
+     * `health` object when — and only when — the response is degraded.
+     */
+    toSerializable() {
+        // The `meta` overwrite keeps its original key position (object spread
+        // overwrites in place) while swapping the raw branchFailures for the
+        // filtered set.
+        return {
+            ...this.body,
+            ...(this.body.meta !== undefined
+                ? { meta: withSanitizedFailures(this.body.meta, this.health) }
+                : {}),
+            data: this.results,
+            ...(this.health.degraded ? { health: healthPayload(this.health) } : {}),
+        };
+    }
+}
+exports.RenderableSearchResult = RenderableSearchResult;
+/**
+ * A digest / status-report response that has been through the health mapping.
+ *
+ * The digest wire puts health on `metadata`, not `meta` — the single-character
+ * difference that made the CLI's degraded warning dead code (#5124). That
+ * mapping is written once, here.
+ */
+class RenderableDigestResult {
+    digest;
+    metadata;
+    sources;
+    keyFacts;
+    entities;
+    effectiveStateBreakdown;
+    health;
+    body;
+    constructor(digest, 
+    /** DigestMetadata as sent; also carries the relevance-fallback caveats. */
+    metadata, sources, keyFacts, entities, effectiveStateBreakdown, health, body) {
+        this.digest = digest;
+        this.metadata = metadata;
+        this.sources = sources;
+        this.keyFacts = keyFacts;
+        this.entities = entities;
+        this.effectiveStateBreakdown = effectiveStateBreakdown;
+        this.health = health;
+        this.body = body;
+    }
+    /** Map a `/api/memories/digest` body. Callers validate `data.metadata` first. */
+    static fromApiResponse(body) {
+        const b = (body ?? {});
+        const metadata = (b.metadata ?? {});
+        return new RenderableDigestResult(typeof b.digest === 'string' ? b.digest : '', metadata, Array.isArray(b.sources) ? b.sources : [], Array.isArray(b.keyFacts) ? b.keyFacts : undefined, Array.isArray(b.entities) ? b.entities : undefined, b.effectiveStateBreakdown, readDegradation(metadata), b);
+    }
+    toSerializable() {
+        return {
+            ...this.body,
+            ...(this.body.metadata !== undefined
+                ? { metadata: withSanitizedFailures(this.body.metadata, this.health) }
+                : {}),
+            ...(this.health.degraded ? { health: healthPayload(this.health) } : {}),
+        };
+    }
+}
+exports.RenderableDigestResult = RenderableDigestResult;
+/**
+ * A build-context briefing that has been through the health mapping.
+ *
+ * The API already sends `meta.degraded` here (with `timedOutSections` /
+ * `failedSections`); the CLI dropped it silently before this type existed.
+ */
+class RenderableContextBriefing {
+    data;
+    health;
+    constructor(
+    /** The briefing body: activeWork, relevantFacts, gotchas, … */
+    data, health) {
+        this.data = data;
+        this.health = health;
+    }
+    static fromApiResponse(body) {
+        const b = (body ?? {});
+        return new RenderableContextBriefing(b, readSectionDegradation(b.meta));
+    }
+    toSerializable() {
+        return {
+            ...this.data,
+            ...(this.data.meta !== undefined
+                ? { meta: withSanitizedSections(this.data.meta, this.health) }
+                : {}),
+            ...(this.health.degraded ? { health: healthPayload(this.health) } : {}),
+        };
+    }
+}
+exports.RenderableContextBriefing = RenderableContextBriefing;
+//# sourceMappingURL=renderable-retrieval.js.map

package/dist/lib/renderable-retrieval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"renderable-retrieval.js","sourceRoot":"","sources":["../../src/lib/renderable-retrieval.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;;;AA0KH,wDAUC;AAMD,wDAKC;AAGD,8DAEC;AAvKD,6EAA6E;AAChE,QAAA,eAAe,GAAG,sBAAsB,CAAC;AAEtD,6EAA6E;AAChE,QAAA,wBAAwB,GAAG,oCAAoC,CAAC;AAE7E,MAAM,OAAO,GAAqB,MAAM,CAAC,MAAM,CAAC;IAC9C,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAA6B;CACxD,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AACpD,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B,SAAS,QAAQ,CAAC,GAAY;IAC5B,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,GAAY;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;IACjD,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,MAAM,IAAI,GACR,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAa,EAAE,IAAI,IAAK,KAAa,EAAE,MAAM,CAAC,CAAC;QACvF,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1E,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAE,KAAa,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,GAAG,CAAC,MAAM,IAAI,gBAAgB;YAAE,MAAM;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,SAAkB;IACzC,MAAM,CAAC,GAAG,SAAgF,CAAC;IAC3F,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACvE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,SAAkB;IAChD,MAAM,CAAC,GAAG,SAGG,CAAC;IACd,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACvE,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,CAAC,GAAY,EAAE,MAA2B,EAAE,EAAE;QAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO;QAChC,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;YACvB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC1E,IAAI,QAAQ,CAAC,MAAM,IAAI,gBAAgB;gBAAE,OAAO;YAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC;IACF,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IACvC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa,CAAC,MAAwB;IAC7C,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,qBAAqB,CAC5B,SAAkB,EAClB,MAAwB;IAExB,MAAM,CAAC,GAAG,SAAoC,CAAC;IAC/C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACvC,OAAO,EAAE,GAAG,CAAC,EAAE,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAC5B,SAAkB,EAClB,MAAwB;IAExB,MAAM,CAAC,GAAG,SAAoC,CAAC;IAC/C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,MAA2B,EAAE,EAAE,CAC5C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxE,OAAO;QACL,GAAG,CAAC;QACJ,GAAG,CAAC,kBAAkB,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB,CAAC,MAAwB;IAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM;QACzB,CAAC,CAAC,oBAAoB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACxC,CAAC,CAAC,uCAAuC,CAAC;IAC5C,OAAO,CACL,GAAG,uBAAe,MAAM,MAAM,gDAAgD;QAC9E,iCAAiC,CAClC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB,CAAC,MAAwB;IAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,OAAO,GAAG,uBAAe,GAAG,MAAM,kCAAkC,CAAC;AACvE,CAAC;AAED,+DAA+D;AAC/D,SAAgB,yBAAyB,CAAC,MAAwB;IAChE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,gCAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAgC,CAAC;IACjF,OAAO,MAAM,CAAC,MAAM,CAClB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CACjB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,EAAE,CAC9E,CACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAa,sBAAsB;IAGtB;IAEA;IAEA;IAEA;IAEA;IACQ;IAXnB;IACE,uDAAuD;IAC9C,OAAoC;IAC7C,oEAAoE;IAC3D,KAAa;IACtB,yCAAyC;IAChC,YAAgC;IACzC,6CAA6C;IACpC,gBAAqB;IAC9B,0CAA0C;IACjC,MAAwB,EAChB,IAA6B;QATrC,YAAO,GAAP,OAAO,CAA6B;QAEpC,UAAK,GAAL,KAAK,CAAQ;QAEb,iBAAY,GAAZ,YAAY,CAAoB;QAEhC,qBAAgB,GAAhB,gBAAgB,CAAK;QAErB,WAAM,GAAN,MAAM,CAAkB;QAChB,SAAI,GAAJ,IAAI,CAAyB;IAC7C,CAAC;IAEJ;;;;;;;;OAQG;IACH,MAAM,CAAC,eAAe,CAAC,IAAa;QAClC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAwB,CAAC;QAC9C,MAAM,OAAO,GAAG,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAuC,CAAC;QACvD,OAAO,IAAI,sBAAsB,CAC/B,OAAO,EACP,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAC7D,OAAO,IAAI,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,EACtE,IAAI,EAAE,gBAAgB,EACtB,eAAe,CAAC,IAAI,CAAC,EACrB,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,gBAAgB,CAAC,IAAa;QACnC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAwB,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAC3B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CACxC,CAAC;QACjC,OAAO,IAAI,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC/F,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,sEAAsE;QACtE,qEAAqE;QACrE,gBAAgB;QAChB,OAAO;YACL,GAAG,IAAI,CAAC,IAAI;YACZ,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;gBAC9B,CAAC,CAAC,EAAE,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;gBAC9D,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,EAAE,IAAI,CAAC,OAAO;YAClB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;CACF;AApED,wDAoEC;AAED;;;;;;GAMG;AACH,MAAa,sBAAsB;IAEtB;IAEA;IACA;IACA;IACA;IACA;IACA;IACQ;IATnB,YACW,MAAc;IACvB,2EAA2E;IAClE,QAA6B,EAC7B,OAAc,EACd,QAA2B,EAC3B,QAA2B,EAC3B,uBAA4B,EAC5B,MAAwB,EAChB,IAA6B;QARrC,WAAM,GAAN,MAAM,CAAQ;QAEd,aAAQ,GAAR,QAAQ,CAAqB;QAC7B,YAAO,GAAP,OAAO,CAAO;QACd,aAAQ,GAAR,QAAQ,CAAmB;QAC3B,aAAQ,GAAR,QAAQ,CAAmB;QAC3B,4BAAuB,GAAvB,uBAAuB,CAAK;QAC5B,WAAM,GAAN,MAAM,CAAkB;QAChB,SAAI,GAAJ,IAAI,CAAyB;IAC7C,CAAC;IAEJ,iFAAiF;IACjF,MAAM,CAAC,eAAe,CAAC,IAAa;QAClC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAwB,CAAC;QAC9C,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAwB,CAAC;QAC3D,OAAO,IAAI,sBAAsB,CAC/B,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAC5C,QAAQ,EACR,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EACzC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAClD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAClD,CAAC,CAAC,uBAAuB,EACzB,eAAe,CAAC,QAAQ,CAAC,EACzB,CAAC,CACF,CAAC;IACJ,CAAC;IAED,cAAc;QACZ,OAAO;YACL,GAAG,IAAI,CAAC,IAAI;YACZ,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS;gBAClC,CAAC,CAAC,EAAE,QAAQ,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;gBACtE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;CACF;AAtCD,wDAsCC;AAED;;;;;GAKG;AACH,MAAa,yBAAyB;IAGzB;IACA;IAHX;IACE,+DAA+D;IACtD,IAAyB,EACzB,MAAwB;QADxB,SAAI,GAAJ,IAAI,CAAqB;QACzB,WAAM,GAAN,MAAM,CAAkB;IAChC,CAAC;IAEJ,MAAM,CAAC,eAAe,CAAC,IAAa;QAClC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAwB,CAAC;QAC9C,OAAO,IAAI,yBAAyB,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,cAAc;QACZ,OAAO;YACL,GAAG,IAAI,CAAC,IAAI;YACZ,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;gBAC9B,CAAC,CAAC,EAAE,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;gBAC9D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;CACF;AArBD,8DAqBC"}

package/dist/lib/setup/detector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"detector.d.ts","sourceRoot":"","sources":["../../../src/lib/setup/detector.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EAAmB,aAAa,EAAY,MAAM,YAAY,CAAC;AAG3E,wCAAwC;AACxC,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAS7C;AAuGD;;;GAGG;AACH,wBAAsB,YAAY,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAqDhF"}
+{"version":3,"file":"detector.d.ts","sourceRoot":"","sources":["../../../src/lib/setup/detector.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EAAmB,aAAa,EAAY,MAAM,YAAY,CAAC;AAG3E,wCAAwC;AACxC,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAS7C;AAuGD;;;GAGG;AACH,wBAAsB,YAAY,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAqEhF"}

package/dist/lib/setup/detector.js

@@ -129,27 +129,43 @@ async function detectAgents(projectDir) {
         if (!inProject && !inGlobal)
             continue;
         const detectedAt = inProject && inGlobal ? 'both' : inProject ? 'project' : 'global';
-        // Check existing config
+        // Check existing config — an agent counts as configured if EITHER scope holds
+        // the memnexus entry. The project check used to overwrite the global result
+        // outright, which reported "not configured" for a working global install as
+        // soon as the project had its own config file listing other servers (for
+        // Claude Code a project `.mcp.json` is additive, not a replacement). That
+        // false negative told the user to run `mx mcp install`, which would write
+        // into a repository they may have only cloned. Reachable from `mx mcp list`
+        // for the first time now that it passes a project dir (#4919).
         let existingConfigPath;
         let alreadyConfigured = false;
-        // Check global config first
         const globalPath = agent.mcp.globalConfigPath[platform];
-        if (globalPath) {
-            const resolved = resolvePath(globalPath);
-            const check = await checkExistingConfig(resolved, agent);
-            if (check.exists) {
-                existingConfigPath = resolved;
-                alreadyConfigured = check.hasMemnexus;
-            }
+        const globalResolved = globalPath ? resolvePath(globalPath) : undefined;
+        const globalCheck = globalResolved
+            ? await checkExistingConfig(globalResolved, agent)
+            : { exists: false, hasMemnexus: false };
+        const projectResolved = projectDir && agent.mcp.projectConfigPath
+            ? node_path_1.default.join(projectDir, agent.mcp.projectConfigPath)
+            : undefined;
+        const projectCheck = projectResolved
+            ? await checkExistingConfig(projectResolved, agent)
+            : { exists: false, hasMemnexus: false };
+        alreadyConfigured = globalCheck.hasMemnexus || projectCheck.hasMemnexus;
+        // Point at the file that actually holds the entry, preferring project when
+        // both do. Falling back to whichever config file merely exists keeps the
+        // previous behaviour for the not-configured case, where the path is a hint
+        // about where setup would write.
+        if (projectCheck.hasMemnexus) {
+            existingConfigPath = projectResolved;
         }
-        // Check project config if project dir provided
-        if (projectDir && agent.mcp.projectConfigPath) {
-            const projectPath = node_path_1.default.join(projectDir, agent.mcp.projectConfigPath);
-            const check = await checkExistingConfig(projectPath, agent);
-            if (check.exists) {
-                existingConfigPath = projectPath;
-                alreadyConfigured = check.hasMemnexus;
-            }
+        else if (globalCheck.hasMemnexus) {
+            existingConfigPath = globalResolved;
+        }
+        else if (projectCheck.exists) {
+            existingConfigPath = projectResolved;
+        }
+        else if (globalCheck.exists) {
+            existingConfigPath = globalResolved;
         }
         results.push({
             agent,

package/dist/lib/setup/detector.js.map

@@ -1 +1 @@
-{"version":3,"file":"detector.js","sourceRoot":"","sources":["../../../src/lib/setup/detector.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;AAWH,kCASC;AA2GD,oCAqDC;AAlLD,qCAAqC;AACrC,+CAA4C;AAC5C,2DAAkD;AAClD,0DAA6B;AAC7B,sDAAyB;AAEzB,+CAAgD;AAEhD,wCAAwC;AACxC,SAAgB,WAAW,CAAC,CAAS;IACnC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,mBAAI,CAAC,IAAI,CAAC,iBAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,mBAAI,CAAC,IAAI,CAAC,iBAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACrF,OAAO,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8CAA8C;AAC9C,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,iBAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAC1D,IAAA,iCAAY,EAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE;YACxB,KAAK,EAAE,QAAQ;YACf,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,UAAkB,EAClB,MAAyB;IAEzB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAE3C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;YAC9C,MAAM,QAAQ,GAAG,mBAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAC5C,IAAI,IAAA,oBAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;gBAC/B,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,MAAyB;IACnD,MAAM,QAAQ,GAAG,iBAAE,CAAC,QAAQ,EAAc,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,iBAAiB;QACjB,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YAC3C,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;gBAC9B,MAAM;YACR,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACvD,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;gBACxC,IAAI,IAAA,oBAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;oBACzB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,mBAAmB,CAChC,UAAkB,EAClB,KAAsB;IAEtB,IAAI,CAAC,IAAA,oBAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAC/C,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAA,mBAAQ,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAEpD,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YACtC,0DAA0D;YAC1D,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC;aACxD,CAAC;QACJ,CAAC;QAED,0CAA0C;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACnD,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,UAAU,IAAI,OAAO;SACnC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,YAAY,CAAC,UAAmB;IACpD,MAAM,MAAM,GAAG,IAAA,6BAAe,GAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,iBAAE,CAAC,QAAQ,EAAc,CAAC;IAE3C,MAAM,YAAY,GAAG,UAAU;QAC7B,CAAC,CAAC,mBAAmB,CAAC,UAAU,EAAE,MAAM,CAAC;QACzC,CAAC,CAAC,IAAI,GAAG,EAAqB,CAAC;IACjC,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAE/C,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAE3C,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ;YAAE,SAAS;QAEtC,MAAM,UAAU,GAAG,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QAErF,wBAAwB;QACxB,IAAI,kBAAsC,CAAC;QAC3C,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAE9B,4BAA4B;QAC5B,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;YACzC,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACzD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,kBAAkB,GAAG,QAAQ,CAAC;gBAC9B,iBAAiB,GAAG,KAAK,CAAC,WAAW,CAAC;YACxC,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,IAAI,UAAU,IAAI,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;YAC9C,MAAM,WAAW,GAAG,mBAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YACvE,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAC5D,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,kBAAkB,GAAG,WAAW,CAAC;gBACjC,iBAAiB,GAAG,KAAK,CAAC,WAAW,CAAC;YACxC,CAAC;QACH,CAAC;QAED,OAAO,CAAC,IAAI,CAAC;YACX,KAAK;YACL,UAAU;YACV,kBAAkB;YAClB,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"detector.js","sourceRoot":"","sources":["../../../src/lib/setup/detector.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;AAWH,kCASC;AA2GD,oCAqEC;AAlMD,qCAAqC;AACrC,+CAA4C;AAC5C,2DAAkD;AAClD,0DAA6B;AAC7B,sDAAyB;AAEzB,+CAAgD;AAEhD,wCAAwC;AACxC,SAAgB,WAAW,CAAC,CAAS;IACnC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,mBAAI,CAAC,IAAI,CAAC,iBAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,mBAAI,CAAC,IAAI,CAAC,iBAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACrF,OAAO,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8CAA8C;AAC9C,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,iBAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAC1D,IAAA,iCAAY,EAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE;YACxB,KAAK,EAAE,QAAQ;YACf,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,UAAkB,EAClB,MAAyB;IAEzB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAE3C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;YAC9C,MAAM,QAAQ,GAAG,mBAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAC5C,IAAI,IAAA,oBAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;gBAC/B,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,MAAyB;IACnD,MAAM,QAAQ,GAAG,iBAAE,CAAC,QAAQ,EAAc,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,iBAAiB;QACjB,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YAC3C,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;gBAC9B,MAAM;YACR,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACvD,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;gBACxC,IAAI,IAAA,oBAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;oBACzB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,mBAAmB,CAChC,UAAkB,EAClB,KAAsB;IAEtB,IAAI,CAAC,IAAA,oBAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAC/C,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAA,mBAAQ,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAEpD,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YACtC,0DAA0D;YAC1D,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC;aACxD,CAAC;QACJ,CAAC;QAED,0CAA0C;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACnD,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,UAAU,IAAI,OAAO;SACnC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,YAAY,CAAC,UAAmB;IACpD,MAAM,MAAM,GAAG,IAAA,6BAAe,GAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,iBAAE,CAAC,QAAQ,EAAc,CAAC;IAE3C,MAAM,YAAY,GAAG,UAAU;QAC7B,CAAC,CAAC,mBAAmB,CAAC,UAAU,EAAE,MAAM,CAAC;QACzC,CAAC,CAAC,IAAI,GAAG,EAAqB,CAAC;IACjC,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAE/C,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAE3C,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ;YAAE,SAAS;QAEtC,MAAM,UAAU,GAAG,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QAErF,8EAA8E;QAC9E,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,4EAA4E;QAC5E,+DAA+D;QAC/D,IAAI,kBAAsC,CAAC;QAC3C,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAE9B,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,MAAM,WAAW,GAAG,cAAc;YAChC,CAAC,CAAC,MAAM,mBAAmB,CAAC,cAAc,EAAE,KAAK,CAAC;YAClD,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAE1C,MAAM,eAAe,GACnB,UAAU,IAAI,KAAK,CAAC,GAAG,CAAC,iBAAiB;YACvC,CAAC,CAAC,mBAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC;YACpD,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,YAAY,GAAG,eAAe;YAClC,CAAC,CAAC,MAAM,mBAAmB,CAAC,eAAe,EAAE,KAAK,CAAC;YACnD,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAE1C,iBAAiB,GAAG,WAAW,CAAC,WAAW,IAAI,YAAY,CAAC,WAAW,CAAC;QAExE,2EAA2E;QAC3E,yEAAyE;QACzE,2EAA2E;QAC3E,iCAAiC;QACjC,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;YAC7B,kBAAkB,GAAG,eAAe,CAAC;QACvC,CAAC;aAAM,IAAI,WAAW,CAAC,WAAW,EAAE,CAAC;YACnC,kBAAkB,GAAG,cAAc,CAAC;QACtC,CAAC;aAAM,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;YAC/B,kBAAkB,GAAG,eAAe,CAAC;QACvC,CAAC;aAAM,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;YAC9B,kBAAkB,GAAG,cAAc,CAAC;QACtC,CAAC;QAED,OAAO,CAAC,IAAI,CAAC;YACX,KAAK;YACL,UAAU;YACV,kBAAkB;YAClB,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/lib/setup/index.d.ts

@@ -1,6 +1,6 @@
 export { detectAgents, resolvePath } from './detector.js';
 export { writeAgentConfig, removeAgentConfig, resolveConfigPath } from './config-writer.js';
-export { verifyAgent, verifyAll } from './verifier.js';
+export { verifyAgent, verifyAll, displayPath } from './verifier.js';
 export { writeSteeringFile, removeSteeringSection, getSteeringVersion, resolveSteeringPath, } from './rules-writer.js';
 export { composeRules, parseSteeringVersion } from './rules-templates.js';
 export { getAgent, getAgentIds, getSortedAgents, AGENTS } from './registry.js';

package/dist/lib/setup/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/setup/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EACL,cAAc,EACd,eAAe,EACf,UAAU,EACV,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC9D,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,mBAAmB,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/setup/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EACL,cAAc,EACd,eAAe,EACf,UAAU,EACV,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC9D,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,mBAAmB,YAAY,CAAC"}

package/dist/lib/setup/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.removeHooks = exports.installHooks = exports.parseSkillVersion = exports.SKILLS = exports.resolveSkillPath = exports.resolveSkillsDir = exports.listSkills = exports.removeAllSkills = exports.writeAllSkills = exports.AGENTS = exports.getSortedAgents = exports.getAgentIds = exports.getAgent = exports.parseSteeringVersion = exports.composeRules = exports.resolveSteeringPath = exports.getSteeringVersion = exports.removeSteeringSection = exports.writeSteeringFile = exports.verifyAll = exports.verifyAgent = exports.resolveConfigPath = exports.removeAgentConfig = exports.writeAgentConfig = exports.resolvePath = exports.detectAgents = void 0;
+exports.removeHooks = exports.installHooks = exports.parseSkillVersion = exports.SKILLS = exports.resolveSkillPath = exports.resolveSkillsDir = exports.listSkills = exports.removeAllSkills = exports.writeAllSkills = exports.AGENTS = exports.getSortedAgents = exports.getAgentIds = exports.getAgent = exports.parseSteeringVersion = exports.composeRules = exports.resolveSteeringPath = exports.getSteeringVersion = exports.removeSteeringSection = exports.writeSteeringFile = exports.displayPath = exports.verifyAll = exports.verifyAgent = exports.resolveConfigPath = exports.removeAgentConfig = exports.writeAgentConfig = exports.resolvePath = exports.detectAgents = void 0;
 var detector_js_1 = require("./detector.js");
 Object.defineProperty(exports, "detectAgents", { enumerable: true, get: function () { return detector_js_1.detectAgents; } });
 Object.defineProperty(exports, "resolvePath", { enumerable: true, get: function () { return detector_js_1.resolvePath; } });
@@ -11,6 +11,7 @@ Object.defineProperty(exports, "resolveConfigPath", { enumerable: true, get: fun
 var verifier_js_1 = require("./verifier.js");
 Object.defineProperty(exports, "verifyAgent", { enumerable: true, get: function () { return verifier_js_1.verifyAgent; } });
 Object.defineProperty(exports, "verifyAll", { enumerable: true, get: function () { return verifier_js_1.verifyAll; } });
+Object.defineProperty(exports, "displayPath", { enumerable: true, get: function () { return verifier_js_1.displayPath; } });
 var rules_writer_js_1 = require("./rules-writer.js");
 Object.defineProperty(exports, "writeSteeringFile", { enumerable: true, get: function () { return rules_writer_js_1.writeSteeringFile; } });
 Object.defineProperty(exports, "removeSteeringSection", { enumerable: true, get: function () { return rules_writer_js_1.removeSteeringSection; } });

package/dist/lib/setup/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/setup/index.ts"],"names":[],"mappings":";;;AAAA,6CAA0D;AAAjD,2GAAA,YAAY,OAAA;AAAE,0GAAA,WAAW,OAAA;AAClC,uDAA4F;AAAnF,oHAAA,gBAAgB,OAAA;AAAE,qHAAA,iBAAiB,OAAA;AAAE,qHAAA,iBAAiB,OAAA;AAC/D,6CAAuD;AAA9C,0GAAA,WAAW,OAAA;AAAE,wGAAA,SAAS,OAAA;AAC/B,qDAK2B;AAJzB,oHAAA,iBAAiB,OAAA;AACjB,wHAAA,qBAAqB,OAAA;AACrB,qHAAA,kBAAkB,OAAA;AAClB,sHAAA,mBAAmB,OAAA;AAErB,2DAA0E;AAAjE,kHAAA,YAAY,OAAA;AAAE,0HAAA,oBAAoB,OAAA;AAC3C,6CAA+E;AAAtE,uGAAA,QAAQ,OAAA;AAAE,0GAAA,WAAW,OAAA;AAAE,8GAAA,eAAe,OAAA;AAAE,qGAAA,MAAM,OAAA;AACvD,uDAM4B;AAL1B,kHAAA,cAAc,OAAA;AACd,mHAAA,eAAe,OAAA;AACf,8GAAA,UAAU,OAAA;AACV,oHAAA,gBAAgB,OAAA;AAChB,oHAAA,gBAAgB,OAAA;AAElB,6DAAkE;AAAzD,6GAAA,MAAM,OAAA;AAAE,wHAAA,iBAAiB,OAAA;AAClC,qDAA8D;AAArD,+GAAA,YAAY,OAAA;AAAE,8GAAA,WAAW,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/setup/index.ts"],"names":[],"mappings":";;;AAAA,6CAA0D;AAAjD,2GAAA,YAAY,OAAA;AAAE,0GAAA,WAAW,OAAA;AAClC,uDAA4F;AAAnF,oHAAA,gBAAgB,OAAA;AAAE,qHAAA,iBAAiB,OAAA;AAAE,qHAAA,iBAAiB,OAAA;AAC/D,6CAAoE;AAA3D,0GAAA,WAAW,OAAA;AAAE,wGAAA,SAAS,OAAA;AAAE,0GAAA,WAAW,OAAA;AAC5C,qDAK2B;AAJzB,oHAAA,iBAAiB,OAAA;AACjB,wHAAA,qBAAqB,OAAA;AACrB,qHAAA,kBAAkB,OAAA;AAClB,sHAAA,mBAAmB,OAAA;AAErB,2DAA0E;AAAjE,kHAAA,YAAY,OAAA;AAAE,0HAAA,oBAAoB,OAAA;AAC3C,6CAA+E;AAAtE,uGAAA,QAAQ,OAAA;AAAE,0GAAA,WAAW,OAAA;AAAE,8GAAA,eAAe,OAAA;AAAE,qGAAA,MAAM,OAAA;AACvD,uDAM4B;AAL1B,kHAAA,cAAc,OAAA;AACd,mHAAA,eAAe,OAAA;AACf,8GAAA,UAAU,OAAA;AACV,oHAAA,gBAAgB,OAAA;AAChB,oHAAA,gBAAgB,OAAA;AAElB,6DAAkE;AAAzD,6GAAA,MAAM,OAAA;AAAE,wHAAA,iBAAiB,OAAA;AAClC,qDAA8D;AAArD,+GAAA,YAAY,OAAA;AAAE,8GAAA,WAAW,OAAA"}

package/dist/lib/setup/rules-templates.d.ts

@@ -21,6 +21,14 @@ export declare function composeRules(agentId: string, version: string, contentFo
 /**
  * Parse the version string from an existing steering file's markers.
  * Returns null if no markers found or version can't be parsed.
+ *
+ * The charset is version-shaped and length-bounded on purpose. The previous
+ * `[^\s|]+` excluded whitespace and `|` but admitted ESC, BEL and every other C0
+ * control byte, unbounded — and since verification now reads the PROJECT steering
+ * file, that content can come from a repository the user cloned but did not write.
+ * The captured string is rendered by `mx mcp doctor`, so it was a path from
+ * untrusted file content to terminal control sequences (KI-SEC-007 class).
+ * Bounding here is defence in depth; the render sites sanitize as well.
  */
 export declare function parseSteeringVersion(content: string): string | null;
 //# sourceMappingURL=rules-templates.d.ts.map

package/dist/lib/setup/rules-templates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules-templates.d.ts","sourceRoot":"","sources":["../../../src/lib/setup/rules-templates.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,QAAA,MAAM,YAAY,wFACgE,CAAC;AACnF,QAAA,MAAM,UAAU,gCAAgC,CAAC;AAEjD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AAoJpC;;;;;;GAMG;AACH,wBAAgB,oCAAoC,IAAI,MAAM,CA2C7D;AAID;;GAEG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,oBAAoB,GACjC,MAAM,CAkBR;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGnE"}
+{"version":3,"file":"rules-templates.d.ts","sourceRoot":"","sources":["../../../src/lib/setup/rules-templates.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,QAAA,MAAM,YAAY,wFACgE,CAAC;AACnF,QAAA,MAAM,UAAU,gCAAgC,CAAC;AAEjD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AAoJpC;;;;;;GAMG;AACH,wBAAgB,oCAAoC,IAAI,MAAM,CA2C7D;AAID;;GAEG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,oBAAoB,GACjC,MAAM,CAkBR;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGnE"}

package/dist/lib/setup/rules-templates.js

@@ -221,9 +221,17 @@ function composeRules(agentId, version, contentFocus) {
 /**
  * Parse the version string from an existing steering file's markers.
  * Returns null if no markers found or version can't be parsed.
+ *
+ * The charset is version-shaped and length-bounded on purpose. The previous
+ * `[^\s|]+` excluded whitespace and `|` but admitted ESC, BEL and every other C0
+ * control byte, unbounded — and since verification now reads the PROJECT steering
+ * file, that content can come from a repository the user cloned but did not write.
+ * The captured string is rendered by `mx mcp doctor`, so it was a path from
+ * untrusted file content to terminal control sequences (KI-SEC-007 class).
+ * Bounding here is defence in depth; the render sites sanitize as well.
  */
 function parseSteeringVersion(content) {
-    const match = content.match(/<!-- version: ([^\s|]+)/);
+    const match = content.match(/<!-- version: ([0-9A-Za-z.+-]{1,32})(?=[\s|])/);
     return match ? match[1] : null;
 }
 //# sourceMappingURL=rules-templates.js.map

package/dist/lib/setup/rules-templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules-templates.js","sourceRoot":"","sources":["../../../src/lib/setup/rules-templates.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAmKH,oFA2CC;AAOD,oCAsBC;AAMD,oDAGC;AAhPD,MAAM,YAAY,GAChB,gFAAgF,CAAC;AAG1E,oCAAY;AAFrB,MAAM,UAAU,GAAG,6BAA6B,CAAC;AAE1B,gCAAU;AAEjC,oEAAoE;AAEpE,SAAS,eAAe;IACtB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+EAuDsE,CAAC;AAChF,CAAC;AAED,oEAAoE;AAEpE,SAAS,aAAa;IACpB,OAAO;;;;;;;;;;;;;2CAakC,CAAC;AAC5C,CAAC;AAED,oEAAoE;AAEpE,MAAM,WAAW,GAA2B;IAC1C,aAAa,EAAE;;;;;;;;;;;;4FAY2E;IAE1F,MAAM,EAAE;;;;;;mEAMyD;IAEjE,OAAO,EAAE;;;;;;mEAMwD;IAEjE,KAAK,EAAE;;;;;;mDAM0C;IAEjD,QAAQ,EAAE;;;;;;mEAMuD;IAEjE,gBAAgB,EAAE;;;;;;;;kEAQ8C;CACjE,CAAC;AAEF,gEAAgE;AAChE,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,+EAA+E;AAE/E;;;;;;GAMG;AACH,SAAgB,oCAAoC;IAClD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yGAyCgG,CAAC;AAC1G,CAAC;AAED,oEAAoE;AAEpE;;GAEG;AACH,SAAgB,YAAY,CAC1B,OAAe,EACf,OAAe,EACf,YAAkC;IAElC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAEjD,MAAM,KAAK,GAAG;QACZ,YAAY;QACZ,iBAAiB,OAAO,aAAa,OAAO,MAAM;QAClD,EAAE;QACF,IAAI;QACJ,GAAG;QACH,aAAa;QACb,EAAE;QACF,UAAU;QACV,EAAE;KACH,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,OAAe;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACvD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC"}
+{"version":3,"file":"rules-templates.js","sourceRoot":"","sources":["../../../src/lib/setup/rules-templates.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAmKH,oFA2CC;AAOD,oCAsBC;AAcD,oDAGC;AAxPD,MAAM,YAAY,GAChB,gFAAgF,CAAC;AAG1E,oCAAY;AAFrB,MAAM,UAAU,GAAG,6BAA6B,CAAC;AAE1B,gCAAU;AAEjC,oEAAoE;AAEpE,SAAS,eAAe;IACtB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+EAuDsE,CAAC;AAChF,CAAC;AAED,oEAAoE;AAEpE,SAAS,aAAa;IACpB,OAAO;;;;;;;;;;;;;2CAakC,CAAC;AAC5C,CAAC;AAED,oEAAoE;AAEpE,MAAM,WAAW,GAA2B;IAC1C,aAAa,EAAE;;;;;;;;;;;;4FAY2E;IAE1F,MAAM,EAAE;;;;;;mEAMyD;IAEjE,OAAO,EAAE;;;;;;mEAMwD;IAEjE,KAAK,EAAE;;;;;;mDAM0C;IAEjD,QAAQ,EAAE;;;;;;mEAMuD;IAEjE,gBAAgB,EAAE;;;;;;;;kEAQ8C;CACjE,CAAC;AAEF,gEAAgE;AAChE,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,+EAA+E;AAE/E;;;;;;GAMG;AACH,SAAgB,oCAAoC;IAClD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yGAyCgG,CAAC;AAC1G,CAAC;AAED,oEAAoE;AAEpE;;GAEG;AACH,SAAgB,YAAY,CAC1B,OAAe,EACf,OAAe,EACf,YAAkC;IAElC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAEjD,MAAM,KAAK,GAAG;QACZ,YAAY;QACZ,iBAAiB,OAAO,aAAa,OAAO,MAAM;QAClD,EAAE;QACF,IAAI;QACJ,GAAG;QACH,aAAa;QACb,EAAE;QACF,UAAU;QACV,EAAE;KACH,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,oBAAoB,CAAC,OAAe;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC7E,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/lib/setup/verifier.d.ts

@@ -2,12 +2,29 @@
  * Setup verification — health checks for configured agents.
  */
 import type { AgentDefinition, VerifyResult } from './types.js';
+/**
+ * Render a path for display without leaking the user's home directory or
+ * username. `mx mcp doctor --json` gets pasted into issue reports and into agent
+ * context, and global paths are already shown `~`-relative, so an absolute
+ * project path would be the only place identifying the machine.
+ */
+export declare function displayPath(absolute: string, projectDir?: string): string;
 /**
  * Verify a single agent's setup.
+ *
+ * @param projectDir When set, project-scoped config and steering files are checked
+ *   IN ADDITION TO the global ones. `mx setup` defaults to project scope inside a
+ *   git project (setup.ts:203-207), so a global-only check reported working
+ *   project installs as broken (#4919). Either location passing is a pass.
  */
-export declare function verifyAgent(agent: AgentDefinition): Promise<VerifyResult>;
+export declare function verifyAgent(agent: AgentDefinition, projectDir?: string): Promise<VerifyResult>;
 /**
  * Verify all configured agents.
+ *
+ * @param projectDir When set (callers pass the detected git project root), agents
+ *   configured at project scope are verified too. Without it this only ever saw
+ *   global installs, so the onboarding flow's project-scoped install was reported
+ *   as missing (#4919).
  */
-export declare function verifyAll(): Promise<VerifyResult[]>;
+export declare function verifyAll(projectDir?: string): Promise<VerifyResult[]>;
 //# sourceMappingURL=verifier.d.ts.map

package/dist/lib/setup/verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../../src/lib/setup/verifier.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAyB,YAAY,EAAE,MAAM,YAAY,CAAC;AASvF;;GAEG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CA2I/E;AAED;;GAEG;AACH,wBAAsB,SAAS,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAoBzD"}
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../../src/lib/setup/verifier.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAyB,YAAY,EAAE,MAAM,YAAY,CAAC;AA8BvF;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAUzE;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,eAAe,EACtB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,YAAY,CAAC,CAwLvB;AAED;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAuB5E"}