@pleri/olam-cli 0.1.48 → 0.1.50

package/dist/index.js

@@ -454,8 +454,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path43, errorMaps, issueData } = params;
-      const fullPath = [...path43, ...issueData.path || []];
+      const { data, path: path44, errorMaps, issueData } = params;
+      const fullPath = [...path44, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -763,11 +763,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path43, key) {
+      constructor(parent, value, path44, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path43;
+        this._path = path44;
         this._key = key;
       }
       get path() {
@@ -4248,7 +4248,7 @@ import YAML from "yaml";
 function bootstrapStepCmd(entry) {
   return typeof entry === "string" ? entry : entry.cmd;
 }
-function refineForbiddenKeys(value, path43, ctx, rejectSource) {
+function refineForbiddenKeys(value, path44, ctx, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
@@ -4256,12 +4256,12 @@ function refineForbiddenKeys(value, path43, ctx, rejectSource) {
     if (FORBIDDEN_KEYS.has(key)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...path43, key],
+        path: [...path44, key],
         message: `forbidden key "${key}" (prototype-pollution surface)`
       });
       continue;
     }
-    if (rejectSource && path43.length === 0 && key === "source") {
+    if (rejectSource && path44.length === 0 && key === "source") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: ["source"],
@@ -4269,21 +4269,21 @@ function refineForbiddenKeys(value, path43, ctx, rejectSource) {
       });
       continue;
     }
-    refineForbiddenKeys(value[key], [...path43, key], ctx, false);
+    refineForbiddenKeys(value[key], [...path44, key], ctx, false);
   }
 }
-function rejectForbiddenKeys(value, path43, rejectSource) {
+function rejectForbiddenKeys(value, path44, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
   for (const key of Object.keys(value)) {
     if (FORBIDDEN_KEYS.has(key)) {
-      throw new Error(`[manifest] ${path43}: forbidden key "${key}" (prototype-pollution surface)`);
+      throw new Error(`[manifest] ${path44}: forbidden key "${key}" (prototype-pollution surface)`);
     }
     if (rejectSource && key === "source") {
-      throw new Error(`[manifest] ${path43}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
+      throw new Error(`[manifest] ${path44}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
     }
-    rejectForbiddenKeys(value[key], `${path43}.${key}`, false);
+    rejectForbiddenKeys(value[key], `${path44}.${key}`, false);
   }
 }
 function unknownTopLevelKeys(parsed) {
@@ -5224,8 +5224,8 @@ var init_client = __esm({
           throw new Error(`failed to report rate-limit for ${accountId} (HTTP ${res.status})`);
         }
       }
-      async request(method, path43, body, attempt = 0) {
-        const url = `${this.baseUrl}${path43}`;
+      async request(method, path44, body, attempt = 0) {
+        const url = `${this.baseUrl}${path44}`;
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), this.timeoutMs);
         const headers = {};
@@ -5243,7 +5243,7 @@ var init_client = __esm({
         } catch (err) {
           if (attempt < RETRY_COUNT && isTransient(err)) {
             await sleep(RETRY_BACKOFF_MS * (attempt + 1));
-            return this.request(method, path43, body, attempt + 1);
+            return this.request(method, path44, body, attempt + 1);
           }
           throw err;
         } finally {
@@ -6722,8 +6722,8 @@ var init_provider3 = __esm({
       // -----------------------------------------------------------------------
       // Internal fetch helper
       // -----------------------------------------------------------------------
-      async request(path43, method, body) {
-        const url = `${this.config.workerUrl}${path43}`;
+      async request(path44, method, body) {
+        const url = `${this.config.workerUrl}${path44}`;
         const bearer = await this.config.mintToken();
         const headers = {
           Authorization: `Bearer ${bearer}`
@@ -7983,8 +7983,8 @@ import { execFileSync as execFileSync3 } from "node:child_process";
 import * as fs13 from "node:fs";
 import * as os9 from "node:os";
 import * as path14 from "node:path";
-function expandHome(p, homedir21) {
-  return p.replace(/^~(?=$|\/|\\)/, homedir21());
+function expandHome(p, homedir22) {
+  return p.replace(/^~(?=$|\/|\\)/, homedir22());
 }
 function sanitizeRepoFilename(name) {
   const sanitized = name.replace(/[^A-Za-z0-9._-]/g, "_");
@@ -8007,7 +8007,7 @@ ${stderr}`;
 }
 function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync3(cmd, args, opts));
-  const homedir21 = deps.homedir ?? (() => os9.homedir());
+  const homedir22 = deps.homedir ?? (() => os9.homedir());
   const baselineDir = path14.join(workspacePath, ".olam", "baseline");
   try {
     fs13.mkdirSync(baselineDir, { recursive: true });
@@ -8023,7 +8023,7 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
       continue;
     const filename = `${sanitizeRepoFilename(repo.name)}.diff`;
     const outPath = path14.join(baselineDir, filename);
-    const repoPath = expandHome(repo.path, homedir21);
+    const repoPath = expandHome(repo.path, homedir22);
     if (!fs13.existsSync(repoPath)) {
       writeBaselineFile(outPath, `# repo: ${repo.name}
 # (skipped: path ${repoPath} does not exist)
@@ -11938,6 +11938,7 @@ __export(host_cp_exports, {
   callHostCpProxy: () => callHostCpProxy,
   callHostCpRegistry: () => callHostCpRegistry,
   captureGhToken: () => captureGhToken,
+  findComposeFile: () => findComposeFile,
   findHostCpContainer: () => findHostCpContainer,
   gatherProbeFailureDiagnostics: () => gatherProbeFailureDiagnostics,
   openHostCpUrl: () => openUrl,
@@ -12419,10 +12420,10 @@ async function readHostCpToken2() {
   if (!fs19.existsSync(tp)) return null;
   return fs19.readFileSync(tp, "utf-8").trim();
 }
-async function callHostCpProxy(method, worldId, path43, body) {
+async function callHostCpProxy(method, worldId, path44, body) {
   const token = await readHostCpToken2();
   if (!token) return { ok: false, status: 0, error: "no token (host CP not started)" };
-  const url = `http://127.0.0.1:${HOST_CP_PORT}/api/world/${encodeURIComponent(worldId)}${path43}`;
+  const url = `http://127.0.0.1:${HOST_CP_PORT}/api/world/${encodeURIComponent(worldId)}${path44}`;
   try {
     const headers = {
       Authorization: `Bearer ${token}`
@@ -12930,8 +12931,8 @@ var init_machine_schema = __esm({
 
 // src/index.ts
 import { Command } from "commander";
-import * as fs38 from "node:fs";
-import * as path42 from "node:path";
+import * as fs39 from "node:fs";
+import * as path43 from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // src/commands/init.ts
@@ -13308,9 +13309,9 @@ var UnknownArchetypeError = class extends Error {
 };
 var ArchetypeCycleError = class extends Error {
   path;
-  constructor(path43) {
-    super(`Archetype inheritance cycle detected: ${path43.join(" \u2192 ")} \u2192 ${path43[0] ?? "?"}`);
-    this.path = path43;
+  constructor(path44) {
+    super(`Archetype inheritance cycle detected: ${path44.join(" \u2192 ")} \u2192 ${path44[0] ?? "?"}`);
+    this.path = path44;
     this.name = "ArchetypeCycleError";
   }
 };
@@ -14082,8 +14083,8 @@ function runStep(label, cmd, args, opts = {}) {
 }
 async function confirm(message) {
   if (!process.stdin.isTTY) return true;
-  const { createInterface: createInterface2 } = await import("node:readline");
-  const rl = createInterface2({ input: process.stdin, output: process.stdout });
+  const { createInterface: createInterface4 } = await import("node:readline");
+  const rl = createInterface4({ input: process.stdin, output: process.stdout });
   return new Promise((resolve8) => {
     rl.question(`${message} [y/N] `, (answer) => {
       rl.close();
@@ -14653,9 +14654,9 @@ function formatFreshnessWarning(result, image = DEFAULT_DEVBOX_IMAGE) {
     "These source files have changed since the image was built; the",
     "changes will NOT take effect in fresh worlds until you rebuild:"
   ];
-  for (const { path: path43, mtimeMs } of result.newerSources) {
+  for (const { path: path44, mtimeMs } of result.newerSources) {
     const when = new Date(mtimeMs).toISOString();
-    lines.push(`  \u2022 ${path43}  (modified ${when})`);
+    lines.push(`  \u2022 ${path44}  (modified ${when})`);
   }
   lines.push("");
   lines.push("Rebuild with:");
@@ -14814,15 +14815,15 @@ init_host_cp();
 var HOST_CP_URL = "http://127.0.0.1:19000";
 async function readHostCpTokenForCreate() {
   try {
-    const { default: fs39 } = await import("node:fs");
-    const { default: os23 } = await import("node:os");
-    const { default: path43 } = await import("node:path");
-    const tp = path43.join(
-      process.env.OLAM_HOME ?? path43.join(os23.homedir(), ".olam"),
+    const { default: fs40 } = await import("node:fs");
+    const { default: os24 } = await import("node:os");
+    const { default: path44 } = await import("node:path");
+    const tp = path44.join(
+      process.env.OLAM_HOME ?? path44.join(os24.homedir(), ".olam"),
       "host-cp.token"
     );
-    if (!fs39.existsSync(tp)) return null;
-    return fs39.readFileSync(tp, "utf-8").trim();
+    if (!fs40.existsSync(tp)) return null;
+    return fs40.readFileSync(tp, "utf-8").trim();
   } catch {
     return null;
   }
@@ -15184,12 +15185,12 @@ function defaultNameFromPrompt(prompt) {
 }
 async function readHostCpToken3() {
   try {
-    const { default: fs39 } = await import("node:fs");
-    const { default: os23 } = await import("node:os");
-    const { default: path43 } = await import("node:path");
-    const tp = path43.join(os23.homedir(), ".olam", "host-cp.token");
-    if (!fs39.existsSync(tp)) return null;
-    const raw = fs39.readFileSync(tp, "utf-8").trim();
+    const { default: fs40 } = await import("node:fs");
+    const { default: os24 } = await import("node:os");
+    const { default: path44 } = await import("node:path");
+    const tp = path44.join(os24.homedir(), ".olam", "host-cp.token");
+    if (!fs40.existsSync(tp)) return null;
+    const raw = fs40.readFileSync(tp, "utf-8").trim();
     return raw.length > 0 ? raw : null;
   } catch {
     return null;
@@ -18780,8 +18781,8 @@ function performRollbackSwap(plan) {
 }
 async function confirm2(message) {
   if (!process.stdin.isTTY) return true;
-  const { createInterface: createInterface2 } = await import("node:readline");
-  const rl = createInterface2({ input: process.stdin, output: process.stdout });
+  const { createInterface: createInterface4 } = await import("node:readline");
+  const rl = createInterface4({ input: process.stdin, output: process.stdout });
   return new Promise((resolve8) => {
     rl.question(`${message} [y/N] `, (answer) => {
       rl.close();
@@ -18982,7 +18983,7 @@ async function runUpgradePullByDigest(deps = {}) {
     }
   }
   tagSpinner.succeed("Re-tagged 3 images to canonical refs");
-  const composeFile = deps.composeFile ?? path31.join(process.cwd(), "packages/host-cp/compose.yaml");
+  const composeFile = deps.composeFile ?? findComposeFile();
   const authSecret = deps.authSecret ?? readAuthSecret2();
   const composeRunner = deps.runComposeImpl ?? runCompose;
   const composeSpinner = ora7("docker compose recreate host-cp").start();
@@ -19182,8 +19183,7 @@ manually inspect images with \`docker images olam-*:olam-rollback\`.`
       return;
     }
     printInfo("Rollback", swapResult.summary);
-    const cwd = process.cwd();
-    const composeFile = path31.join(cwd, "packages/host-cp/compose.yaml");
+    const composeFile = findComposeFile();
     const authSecret = readAuthSecret2();
     process.stdout.write(`  ${pc16.dim("docker compose recreate host-cp".padEnd(34))}`);
     const composeStart = Date.now();
@@ -19457,7 +19457,7 @@ Recovery options:
     return;
   }
   printInfo("Swap", swapResult.summary);
-  const composeFile = path31.join(cwd, "packages/host-cp/compose.yaml");
+  const composeFile = findComposeFile();
   process.stdout.write(`  ${pc16.dim("docker compose recreate".padEnd(34))}`);
   const composeStart = Date.now();
   const composeResult = runCompose(
@@ -21137,19 +21137,563 @@ function registerWorldUpgrade(program2) {
   });
 }
 
-// src/pleri-config.ts
+// src/commands/mcp/login.ts
+init_output();
+
+// src/commands/mcp/client.ts
+var BASE_URL = process.env["OLAM_MCP_AUTH_SERVICE_URL"] ?? "http://127.0.0.1:9998";
+var SECRET = process.env["OLAM_MCP_AUTH_SECRET"] ?? "";
+function authHeaders() {
+  return SECRET ? { "X-Olam-Mcp-Secret": SECRET } : {};
+}
+async function apiFetch(path44, init = {}) {
+  const res = await fetch(`${BASE_URL}${path44}`, {
+    ...init,
+    headers: {
+      "Content-Type": "application/json",
+      ...authHeaders(),
+      ...init.headers
+    }
+  });
+  if (!res.ok) {
+    let msg = `HTTP ${res.status}`;
+    try {
+      const body = await res.json();
+      if (body.error) msg = body.error;
+    } catch {
+    }
+    return { ok: false, error: msg };
+  }
+  return res.json();
+}
+function getMcpAuthClient() {
+  return {
+    async status() {
+      const res = await apiFetch("/credentials/status");
+      return res;
+    },
+    async getCredential(service) {
+      return apiFetch(`/credentials/${encodeURIComponent(service)}`);
+    },
+    async staticAdd({ service, token, label, envName }) {
+      return apiFetch("/credentials/static/add", {
+        method: "POST",
+        body: JSON.stringify({ service, token, label, envName })
+      });
+    },
+    async oauthStart({ service, label }) {
+      return apiFetch("/credentials/oauth/start", {
+        method: "POST",
+        body: JSON.stringify({ service, label })
+      });
+    },
+    async oauthComplete({ state, accessToken, refreshToken }) {
+      return apiFetch("/credentials/oauth/complete", {
+        method: "POST",
+        body: JSON.stringify({ state, accessToken, refreshToken })
+      });
+    },
+    async remove(id) {
+      return apiFetch(`/credentials/${encodeURIComponent(id)}`, {
+        method: "DELETE"
+      });
+    }
+  };
+}
+
+// src/commands/mcp/login.ts
+import { spawn as spawn4 } from "node:child_process";
+function openBrowser2(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  try {
+    const child = spawn4(cmd, [url], { detached: true, stdio: "ignore" });
+    child.unref();
+  } catch {
+  }
+}
+function registerMcpLogin(cmd) {
+  cmd.command("login <service>").description("Start OAuth login flow for an MCP service (linear, slack)").option("--label <label>", "Label for this credential").action(async (service, opts) => {
+    const client = getMcpAuthClient();
+    const result = await client.oauthStart({ service, label: opts.label });
+    if (!result.ok && result.error) {
+      printError(result.error);
+      process.exitCode = 1;
+      return;
+    }
+    if (result.loginUrl) {
+      printInfo("Login URL", result.loginUrl);
+      openBrowser2(result.loginUrl);
+      printInfo("State", result.state ?? "");
+      printSuccess(`OAuth flow started for ${service}. Complete in your browser, then run:`);
+      console.log(`  olam mcp complete ${service} --state ${result.state ?? "<state>"} --token <access_token>`);
+    }
+  });
+}
+
+// src/commands/mcp/add.ts
+init_output();
+import * as readline2 from "node:readline";
+async function readTokenSilent(prompt) {
+  return new Promise((resolve8, reject) => {
+    const rl = readline2.createInterface({
+      input: process.stdin,
+      output: process.stdout,
+      terminal: true
+    });
+    process.stdout.write(prompt);
+    if (process.stdin.isTTY) {
+      process.stdin.setRawMode(true);
+    }
+    let token = "";
+    process.stdin.on("data", function onData(chunk) {
+      const char = chunk.toString("utf8");
+      if (char === "\r" || char === "\n") {
+        if (process.stdin.isTTY) process.stdin.setRawMode(false);
+        process.stdin.removeListener("data", onData);
+        process.stdout.write("\n");
+        rl.close();
+        resolve8(token);
+      } else if (char === "") {
+        if (process.stdin.isTTY) process.stdin.setRawMode(false);
+        process.stdin.removeListener("data", onData);
+        rl.close();
+        reject(new Error("Cancelled"));
+      } else if (char === "\x7F") {
+        token = token.slice(0, -1);
+      } else {
+        token += char;
+      }
+    });
+  });
+}
+function registerMcpAdd(cmd) {
+  cmd.command("add <service>").description("Add a static-key MCP credential (token input hidden from terminal)").option("--token <token>", "Token value (use stdin prompt if omitted)").option("--label <label>", "Human-friendly label").option("--env-name <envName>", "Environment variable name to inject into worlds").action(async (service, opts) => {
+    let token = opts.token;
+    if (!token) {
+      try {
+        token = await readTokenSilent(`Enter token for ${service} (hidden): `);
+      } catch (err) {
+        printError(err instanceof Error ? err.message : "Cancelled");
+        process.exitCode = 1;
+        return;
+      }
+    }
+    if (!token) {
+      printError("Token is required");
+      process.exitCode = 1;
+      return;
+    }
+    const client = getMcpAuthClient();
+    const result = await client.staticAdd({ service, token, label: opts.label, envName: opts.envName });
+    if (!result.ok) {
+      printError(result.error ?? "Failed to add credential");
+      process.exitCode = 1;
+      return;
+    }
+    printSuccess(`Added ${service} credential`);
+    if (opts.envName) {
+      printInfo("Env var", opts.envName);
+    }
+  });
+}
+
+// src/commands/mcp/list.ts
+init_output();
+import pc23 from "picocolors";
+function registerMcpList(cmd) {
+  cmd.command("list").description("List all registered MCP credentials").action(async () => {
+    const client = getMcpAuthClient();
+    let data;
+    try {
+      data = await client.status();
+    } catch (err) {
+      printError(`Could not reach mcp-auth service: ${err instanceof Error ? err.message : "unknown error"}`);
+      printError("Is mcp-auth running? (OLAM_MCP_AUTH_SERVICE_URL defaults to http://127.0.0.1:9998)");
+      process.exitCode = 1;
+      return;
+    }
+    const mcps = data.mcps ?? [];
+    if (mcps.length === 0) {
+      console.log(pc23.dim("No MCP credentials registered."));
+      console.log(pc23.dim("Add one with: olam mcp add <service>"));
+      return;
+    }
+    const [c0, c1, c2, c3] = [16, 20, 10, 24];
+    const header = [
+      "SERVICE".padEnd(c0),
+      "LABEL".padEnd(c1),
+      "TYPE".padEnd(c2),
+      "ENV VAR".padEnd(c3),
+      "STATUS"
+    ].join("  ");
+    console.log(pc23.dim(header));
+    console.log(pc23.dim("\u2500".repeat(header.length)));
+    for (const m of mcps) {
+      const status = !m.validated ? pc23.yellow("unvalidated") : m.expired ? pc23.red("expired") : pc23.green("active");
+      const row = [
+        pc23.cyan(m.service.padEnd(c0)),
+        m.label.padEnd(c1).slice(0, c1),
+        m.type.padEnd(c2),
+        (m.envName ?? "\u2014").padEnd(c3).slice(0, c3),
+        status
+      ].join("  ");
+      console.log(row);
+    }
+  });
+}
+
+// src/commands/mcp/remove.ts
+init_output();
+function registerMcpRemove(cmd) {
+  cmd.command("remove <service>").description("Remove an MCP credential by service ID").action(async (service) => {
+    const client = getMcpAuthClient();
+    const result = await client.remove(service);
+    if (!result.ok) {
+      printError(result.error ?? `No credential found for: ${service}`);
+      process.exitCode = 1;
+      return;
+    }
+    printSuccess(`Removed credential for ${service}`);
+  });
+}
+
+// src/commands/mcp/status.ts
+init_output();
+import pc24 from "picocolors";
+function formatExpiry(expiresAt) {
+  if (!expiresAt) return "\u2014";
+  const ms = expiresAt - Date.now();
+  if (ms <= 0) return pc24.red("expired");
+  const hours = ms / (1e3 * 60 * 60);
+  if (hours < 1) return pc24.yellow(`${Math.ceil(ms / 6e4)}m`);
+  return `${hours.toFixed(1)}h`;
+}
+function registerMcpStatus(cmd) {
+  cmd.command("status").description("Show status of all MCP credentials").action(async () => {
+    const client = getMcpAuthClient();
+    let data;
+    try {
+      data = await client.status();
+    } catch (err) {
+      printError(`Could not reach mcp-auth service: ${err instanceof Error ? err.message : "unknown error"}`);
+      process.exitCode = 1;
+      return;
+    }
+    const mcps = data.mcps ?? [];
+    printHeader(`MCP Credentials (${mcps.length})`);
+    if (mcps.length === 0) {
+      console.log(pc24.dim("No credentials registered."));
+      return;
+    }
+    for (const m of mcps) {
+      const stateColor = !m.validated ? pc24.yellow : m.expired ? pc24.red : pc24.green;
+      const stateLabel = !m.validated ? "unvalidated" : m.expired ? "expired" : "active";
+      console.log(`
+  ${pc24.cyan(m.service)} ${stateColor(`[${stateLabel}]`)}`);
+      console.log(`    label:      ${m.label}`);
+      console.log(`    type:       ${m.type}`);
+      if (m.envName) console.log(`    env var:    ${m.envName}`);
+      if (m.importedFrom) console.log(`    imported:   ${m.importedFrom}`);
+      if (m.type === "oauth") console.log(`    expires in: ${formatExpiry(m.expiresAt)}`);
+      if (m.lastUsed) console.log(`    last used:  ${new Date(m.lastUsed).toLocaleString()}`);
+    }
+    console.log("");
+  });
+}
+
+// src/commands/mcp/import.ts
+init_output();
+import * as readline3 from "node:readline";
+import pc25 from "picocolors";
+
+// src/commands/mcp/import-discovery.ts
 import * as fs37 from "node:fs";
+import * as os23 from "node:os";
 import * as path41 from "node:path";
+function readJsonFile(filePath) {
+  try {
+    const raw = fs37.readFileSync(filePath, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function extractMcpServers(obj, source, sourceLabel) {
+  if (!obj || typeof obj !== "object" || Array.isArray(obj)) return [];
+  const record = obj;
+  const mcpServers = record["mcpServers"] ?? record["mcps"];
+  if (!mcpServers || typeof mcpServers !== "object" || Array.isArray(mcpServers)) return [];
+  const result = [];
+  for (const [name, entry] of Object.entries(mcpServers)) {
+    if (!entry || typeof entry !== "object") continue;
+    const command = entry.command;
+    if (!command || typeof command !== "string") continue;
+    result.push({
+      name,
+      command,
+      args: Array.isArray(entry.args) ? entry.args : [],
+      env: entry.env && typeof entry.env === "object" ? entry.env : void 0,
+      source,
+      sourceLabel
+    });
+  }
+  return result;
+}
+function getClaudeDesktopPath() {
+  if (process.platform === "darwin") {
+    return path41.join(os23.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
+  }
+  if (process.platform === "win32") {
+    const appData = process.env["APPDATA"] ?? path41.join(os23.homedir(), "AppData", "Roaming");
+    return path41.join(appData, "Claude", "claude_desktop_config.json");
+  }
+  return path41.join(os23.homedir(), ".config", "Claude", "claude_desktop_config.json");
+}
+function getOlamRepoPaths() {
+  const configPaths = [
+    path41.join(os23.homedir(), ".olam", "config.yaml"),
+    path41.join(process.cwd(), ".olam", "config.yaml")
+  ];
+  const paths = [];
+  for (const configPath of configPaths) {
+    if (!fs37.existsSync(configPath)) continue;
+    try {
+      const raw = fs37.readFileSync(configPath, "utf-8");
+      const repoMatches = [...raw.matchAll(/path:\s*["']?([^\s"'\n]+)/g)];
+      for (const m of repoMatches) {
+        if (m[1]) paths.push(m[1]);
+      }
+    } catch {
+    }
+  }
+  return paths;
+}
+async function discoverMcpSources(repoPaths) {
+  const start = performance.now();
+  const allEntries = [];
+  const sources = [];
+  const sourceDefs = [
+    {
+      path: path41.join(os23.homedir(), ".claude.json"),
+      label: "Claude Code (~/.claude.json)"
+    },
+    {
+      path: getClaudeDesktopPath(),
+      label: "Claude Desktop"
+    },
+    {
+      path: path41.join(os23.homedir(), ".cursor", "mcp.json"),
+      label: "Cursor (~/.cursor/mcp.json)"
+    },
+    {
+      path: path41.join(os23.homedir(), ".codeium", "windsurf", "mcp_config.json"),
+      label: "Windsurf (~/.codeium/windsurf/mcp_config.json)"
+    }
+  ];
+  const resolvedRepoPaths = repoPaths ?? getOlamRepoPaths();
+  for (const repoPath of resolvedRepoPaths) {
+    sourceDefs.push({
+      path: path41.join(repoPath, ".mcp.json"),
+      label: `.mcp.json (${path41.basename(repoPath)})`
+    });
+  }
+  const reads = await Promise.all(
+    sourceDefs.map(async ({ path: filePath, label }) => ({
+      filePath,
+      label,
+      data: await Promise.resolve(readJsonFile(filePath))
+    }))
+  );
+  const seen = /* @__PURE__ */ new Set();
+  for (const { filePath, label, data } of reads) {
+    if (!data) continue;
+    sources.push(label);
+    const entries = extractMcpServers(data, filePath, label);
+    for (const entry of entries) {
+      if (!seen.has(entry.name)) {
+        seen.add(entry.name);
+        allEntries.push(entry);
+      }
+    }
+  }
+  return {
+    entries: allEntries,
+    sources,
+    durationMs: performance.now() - start
+  };
+}
+
+// src/commands/mcp/import-validate.ts
+import { spawn as spawn5 } from "node:child_process";
+var VALIDATION_TIMEOUT_MS = 5e3;
+async function validateMcpEntry(entry) {
+  return new Promise((resolve8) => {
+    let stdout = "";
+    let timedOut = false;
+    let child;
+    try {
+      child = spawn5(entry.command, [...entry.args ?? []], {
+        stdio: ["ignore", "pipe", "ignore"],
+        env: { ...process.env, ...entry.env ?? {} }
+      });
+    } catch (err) {
+      resolve8({
+        name: entry.name,
+        validated: false,
+        reason: err instanceof Error ? err.message : "spawn failed"
+      });
+      return;
+    }
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGKILL");
+    }, VALIDATION_TIMEOUT_MS);
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      if (timedOut) {
+        resolve8({ name: entry.name, validated: false, reason: "timeout (5s)" });
+        return;
+      }
+      const validated = code === 0 && stdout.trim().length > 0;
+      resolve8({
+        name: entry.name,
+        validated,
+        reason: validated ? "ok" : `exit code ${code ?? "null"}`
+      });
+    });
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      resolve8({ name: entry.name, validated: false, reason: err.message });
+    });
+  });
+}
+
+// src/commands/mcp/import.ts
+async function multiSelectPicker(entries) {
+  if (entries.length === 0) return [];
+  console.log("\n" + pc25.bold("Discovered MCP servers:"));
+  entries.forEach((e, i) => {
+    console.log(
+      `  ${pc25.dim(`[${i + 1}]`)} ${pc25.cyan(e.name.padEnd(20))} ${pc25.dim(e.sourceLabel)}`
+    );
+  });
+  console.log("\n" + pc25.dim('Enter numbers to import (e.g. 1,2,3 or "all" or Enter to skip):'));
+  const answer = await new Promise((resolve8) => {
+    const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
+    rl.question("> ", (ans) => {
+      rl.close();
+      resolve8(ans.trim());
+    });
+  });
+  if (!answer || answer === "") return [];
+  if (answer.toLowerCase() === "all") return entries;
+  const indices = answer.split(/[\s,]+/).map((s) => parseInt(s, 10) - 1).filter((i) => !isNaN(i) && i >= 0 && i < entries.length);
+  const unique = [...new Set(indices)];
+  return unique.map((i) => entries[i]).filter((e) => e != null);
+}
+function registerMcpImport(cmd) {
+  cmd.command("import").description("Discover MCP servers from Claude Code, Desktop, Cursor, Windsurf, and .mcp.json").option("--reimport", "Re-import services that are already registered").option("--no-validate", "Skip validation probes").option("--repo-paths <paths>", "Comma-separated list of repo paths to scan for .mcp.json").action(async (opts) => {
+    const client = getMcpAuthClient();
+    let existingIds = /* @__PURE__ */ new Set();
+    try {
+      const data = await client.status();
+      existingIds = new Set((data.mcps ?? []).map((m) => m.id));
+    } catch {
+    }
+    printInfo("Scanning", "Claude Code, Claude Desktop, Cursor, Windsurf, .mcp.json\u2026");
+    const repoPaths = opts.repoPaths ? opts.repoPaths.split(",").map((s) => s.trim()) : void 0;
+    const { entries, sources, durationMs } = await discoverMcpSources(repoPaths);
+    if (entries.length === 0) {
+      console.log(pc25.dim("No MCP servers found in any source path."));
+      return;
+    }
+    printInfo("Sources", sources.length > 0 ? sources.join(", ") : "none");
+    printInfo("Found", `${entries.length} MCP server(s) in ${Math.round(durationMs)}ms`);
+    let candidates = entries;
+    let skippedCount = 0;
+    if (!opts.reimport) {
+      const filtered = entries.filter((e) => !existingIds.has(e.name));
+      skippedCount = entries.length - filtered.length;
+      candidates = filtered;
+    }
+    if (skippedCount > 0) {
+      console.log(pc25.dim(`skipped: ${skippedCount} already registered`));
+    }
+    if (candidates.length === 0) {
+      console.log(pc25.dim("Nothing new to import. Use --reimport to force."));
+      return;
+    }
+    const selected = await multiSelectPicker(candidates);
+    if (selected.length === 0) {
+      console.log(pc25.dim("No servers selected."));
+      return;
+    }
+    console.log(`
+Importing ${selected.length} server(s)\u2026`);
+    let importedCount = 0;
+    let validatedCount = 0;
+    for (const entry of selected) {
+      let validated = false;
+      let validationReason = "skipped";
+      if (opts.validate !== false) {
+        process.stdout.write(`  ${pc25.dim("\u2192")} ${entry.name}  validating\u2026 `);
+        const vr = await validateMcpEntry(entry);
+        validated = vr.validated;
+        validationReason = vr.reason;
+        process.stdout.write(
+          validated ? pc25.green("ok\n") : pc25.yellow(`unvalidated (${vr.reason})
+`)
+        );
+      } else {
+        console.log(`  ${pc25.dim("\u2192")} ${entry.name}  ${pc25.dim("(validation skipped)")}`);
+      }
+      if (validated) validatedCount++;
+      const result = await client.staticAdd({
+        service: entry.name,
+        token: `mcp://${entry.command}`,
+        label: entry.name
+      });
+      if (result.ok) {
+        importedCount++;
+      } else {
+        printError(`Failed to register ${entry.name}: ${result.error ?? "unknown error"}`);
+      }
+    }
+    console.log("");
+    console.log(pc25.green(`\u2713 Imported ${importedCount}/${selected.length}`));
+    if (validatedCount > 0) {
+      console.log(pc25.dim(`  ${validatedCount} validated, ${importedCount - validatedCount} unvalidated`));
+    }
+  });
+}
+
+// src/commands/mcp/index.ts
+function registerMcp(program2) {
+  const mcp = program2.command("mcp").description("Manage MCP server credentials (login, add, list, remove, import)");
+  registerMcpLogin(mcp);
+  registerMcpAdd(mcp);
+  registerMcpList(mcp);
+  registerMcpRemove(mcp);
+  registerMcpStatus(mcp);
+  registerMcpImport(mcp);
+}
+
+// src/pleri-config.ts
+import * as fs38 from "node:fs";
+import * as path42 from "node:path";
 function isPleriConfigured(configDir = process.env.OLAM_CONFIG_DIR ?? ".olam") {
   if (process.env.PLERI_BASE_URL) {
     return true;
   }
-  const configPath = path41.join(configDir, "config.yaml");
-  if (!fs37.existsSync(configPath)) {
+  const configPath = path42.join(configDir, "config.yaml");
+  if (!fs38.existsSync(configPath)) {
     return false;
   }
   try {
-    const contents = fs37.readFileSync(configPath, "utf8");
+    const contents = fs38.readFileSync(configPath, "utf8");
     return /^[^#\n]*\bpleri:/m.test(contents);
   } catch {
     return false;
@@ -21160,14 +21704,14 @@ function isPleriConfigured(configDir = process.env.OLAM_CONFIG_DIR ?? ".olam") {
 var program = new Command();
 function readCliVersion() {
   try {
-    const here = path42.dirname(fileURLToPath4(import.meta.url));
+    const here = path43.dirname(fileURLToPath4(import.meta.url));
     for (const candidate of [
-      path42.join(here, "package.json"),
-      path42.join(here, "..", "package.json"),
-      path42.join(here, "..", "..", "package.json")
+      path43.join(here, "package.json"),
+      path43.join(here, "..", "package.json"),
+      path43.join(here, "..", "..", "package.json")
     ]) {
-      if (fs38.existsSync(candidate)) {
-        const pkg = JSON.parse(fs38.readFileSync(candidate, "utf-8"));
+      if (fs39.existsSync(candidate)) {
+        const pkg = JSON.parse(fs39.readFileSync(candidate, "utf-8"));
         if (typeof pkg.version === "string" && pkg.version.length > 0) return pkg.version;
       }
     }
@@ -21205,4 +21749,5 @@ registerUpdate(program);
 registerBegin(program);
 registerStop(program);
 registerWorldUpgrade(program);
+registerMcp(program);
 program.parse();