@sema-agent/client-core 0.111.0 → 0.112.0

package/dist/localConfig/mcp/servers.js

@@ -0,0 +1,776 @@
+import { LOCAL_CONFIG_WRITE_INTENTS } from '../settingsWrite.js';
+import { projectMcpConfigs, mcpTransportVerdict } from '../../mcpWireCaps.js';
+import { readHostSettingsOnce, CC_MERGE_ORDER } from '../../hostSettingsSource.js';
+import { layerAdmissionWord } from '../../settingsLayerAdmission.js';
+import { msg, renderMessage } from '../../i18n/translate.js';
+export const MCP_SERVER_SCOPES = Object.freeze(['user', 'project', 'local']);
+export const MCP_SERVER_ROW_STATES = Object.freeze(['active', 'pending_approval', 'rejected', 'disabled', 'withheld', 'unusable']);
+export const MCP_SERVER_WITHHELD_CAUSES = Object.freeze(['narrowing_conflict', 'narrowing_invalid', 'layer_unreadable', 'policy_locked']);
+const isRecord = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+export function ownData(v, key) {
+    try {
+        if (typeof v !== 'object' || v === null)
+            return { ok: true, value: undefined };
+        const d = Object.getOwnPropertyDescriptor(v, key);
+        if (d === undefined)
+            return { ok: true, value: undefined };
+        return Object.hasOwn(d, 'value') ? { ok: true, value: d.value } : { ok: false };
+    }
+    catch {
+        return { ok: false };
+    }
+}
+const ownValue = (v, key) => {
+    const r = ownData(v, key);
+    return r.ok ? r.value : undefined;
+};
+export function stringListOf(v) {
+    try {
+        if (!Array.isArray(v) || v.length > 100_000)
+            return undefined;
+        const out = [];
+        for (let i = 0; i < v.length; i++) {
+            const r = ownData(v, String(i));
+            if (!r.ok || typeof r.value !== 'string')
+                return undefined;
+            out.push(r.value);
+        }
+        return out;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function nameListOf(holder, key) {
+    const r = ownData(holder, key);
+    if (!r.ok)
+        return { kind: 'bad' };
+    if (r.value === undefined)
+        return { kind: 'absent' };
+    const list = stringListOf(r.value);
+    return list === undefined ? { kind: 'bad' } : { kind: 'list', list: Object.freeze(list) };
+}
+const grantedNames = (r) => new Set(r.kind === 'list' ? r.list : []);
+function ownArrayLength(v) {
+    try {
+        if (!Array.isArray(v))
+            return undefined;
+        const d = Object.getOwnPropertyDescriptor(v, 'length');
+        return d !== undefined && typeof d.value === 'number' && Number.isSafeInteger(d.value) && d.value >= 0 && d.value <= 100_000 ? d.value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function pureJsonOf(v, depth, path) {
+    try {
+        if (v === null || typeof v === 'string' || typeof v === 'boolean')
+            return JSON.stringify(v);
+        if (typeof v === 'number')
+            return Number.isFinite(v) ? JSON.stringify(v) : undefined;
+        if (typeof v !== 'object' || depth > 32 || path.has(v))
+            return undefined;
+        const arr = Array.isArray(v);
+        const proto = Object.getPrototypeOf(v);
+        if (arr ? proto !== Array.prototype : proto !== Object.prototype && proto !== null)
+            return undefined;
+        path.add(v);
+        try {
+            const parts = [];
+            const keys = Reflect.ownKeys(v);
+            if (arr) {
+                const len = ownArrayLength(v);
+                if (len === undefined || keys.length !== len + 1)
+                    return undefined;
+                for (let i = 0; i < len; i++) {
+                    const d = Object.getOwnPropertyDescriptor(v, String(i));
+                    if (d === undefined || !Object.hasOwn(d, 'value'))
+                        return undefined;
+                    const s = pureJsonOf(d.value, depth + 1, path);
+                    if (s === undefined)
+                        return undefined;
+                    parts.push(s);
+                }
+                return `[${parts.join(',')}]`;
+            }
+            for (const k of keys) {
+                if (typeof k !== 'string')
+                    return undefined;
+                const d = Object.getOwnPropertyDescriptor(v, k);
+                if (d === undefined)
+                    continue;
+                if (!Object.hasOwn(d, 'value') || d.enumerable !== true)
+                    return undefined;
+                const s = pureJsonOf(d.value, depth + 1, path);
+                if (s === undefined)
+                    return undefined;
+                parts.push(`${JSON.stringify(k)}:${s}`);
+            }
+            return `{${parts.join(',')}}`;
+        }
+        finally {
+            path.delete(v);
+        }
+    }
+    catch {
+        return undefined;
+    }
+}
+function envSignatureOf(entry) {
+    const r = ownData(entry, 'env');
+    if (!r.ok)
+        return undefined;
+    return r.value === undefined ? 'null' : pureJsonOf(r.value, 0, new Set());
+}
+function ownKeysOf(v) {
+    try {
+        return Object.keys(v);
+    }
+    catch {
+        return undefined;
+    }
+}
+export function subTableOf(doc, path) {
+    let box = doc;
+    for (const seg of path) {
+        if (!isRecord(box))
+            return { kind: 'bad' };
+        const r = ownData(box, seg);
+        if (!r.ok)
+            return { kind: 'bad' };
+        if (r.value === undefined)
+            return { kind: 'absent' };
+        box = r.value;
+    }
+    return isRecord(box) ? { kind: 'table', table: box } : { kind: 'bad' };
+}
+export function documentOf(r) {
+    if (r === undefined)
+        return undefined;
+    if (r.status === 'loaded')
+        return r.doc;
+    return r.status === 'absent' ? {} : undefined;
+}
+export const localScopePath = (projectKey) => Object.freeze(['projects', projectKey, 'mcpServers']);
+export const USER_SCOPE_PATH = Object.freeze(['mcpServers']);
+export const PROJECT_FILE_PATH = Object.freeze(['mcpServers']);
+function splitPath(p, sep) {
+    if (sep === '/') {
+        if (!p.startsWith('/'))
+            return undefined;
+        return { root: '/', parts: p.split('/').filter((s) => s !== '') };
+    }
+    const m = /^([A-Za-z]:)\\/.exec(p);
+    if (m === null)
+        return undefined;
+    return { root: `${m[1]}\\`, parts: p.slice(m[0].length).split('\\').filter((s) => s !== '') };
+}
+const joinPath = (root, parts, sep) => root + parts.join(sep);
+export function mcpProjectChainOf(startDir, sep, fence) {
+    try {
+        if (typeof startDir !== 'string' || (sep !== '/' && sep !== '\\'))
+            return Object.freeze([]);
+        const s = splitPath(startDir, sep);
+        if (s === undefined || s.parts.length === 0)
+            return Object.freeze([]);
+        let floor = 1;
+        if (fence !== undefined) {
+            if (typeof fence !== 'string')
+                return Object.freeze([]);
+            const f = splitPath(fence, sep);
+            if (f === undefined || f.root !== s.root || f.parts.length > s.parts.length || f.parts.some((x, i) => s.parts[i] !== x))
+                return Object.freeze([]);
+            floor = Math.max(1, f.parts.length);
+        }
+        const out = [];
+        for (let n = floor; n <= s.parts.length; n++)
+            out.push(joinPath(s.root, s.parts.slice(0, n), sep));
+        return Object.freeze(out);
+    }
+    catch {
+        return Object.freeze([]);
+    }
+}
+export function mcpPathWithinFence(physicalPath, fence, sep) {
+    try {
+        if (typeof physicalPath !== 'string' || typeof fence !== 'string')
+            return false;
+        const p = splitPath(physicalPath, sep);
+        const f = splitPath(fence, sep);
+        if (p === undefined || f === undefined || p.root !== f.root || f.parts.length > p.parts.length)
+            return false;
+        return f.parts.every((x, i) => p.parts[i] === x);
+    }
+    catch {
+        return false;
+    }
+}
+const REMOTE_SINK_WITHHELD_NAMES = new Set([
+    'AWS_ACCESS_KEY_ID',
+    'AWS_SECRET_ACCESS_KEY',
+    'AWS_SESSION_TOKEN',
+    'AZURE_CLIENT_SECRET',
+    'GOOGLE_APPLICATION_CREDENTIALS',
+    'GITHUB_TOKEN',
+    'GH_TOKEN',
+    'GITLAB_TOKEN',
+    'NPM_TOKEN',
+    'NODE_AUTH_TOKEN',
+    'PYPI_TOKEN',
+    'ANTHROPIC_API_KEY',
+    'OPENAI_API_KEY',
+]);
+const VAR_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}/g;
+export function expandMcpServerEntry(entry, env, target) {
+    const missing = [];
+    const withheld = [];
+    try {
+        if (!isRecord(entry))
+            return Object.freeze({ entry, missing: Object.freeze([]), withheld: Object.freeze([]) });
+        const values = env !== undefined && isRecord(env) ? ownValue(env, 'values') : undefined;
+        const secrets = new Set(stringListOf(env !== undefined && isRecord(env) ? ownValue(env, 'hostSecretNames') : undefined) ?? []);
+        const x = (s) => s.replace(VAR_RE, (whole, name, def) => {
+            if (secrets.has(name) || (target === 'remote' && REMOTE_SINK_WITHHELD_NAMES.has(name))) {
+                if (!withheld.includes(name))
+                    withheld.push(name);
+                return def ?? '';
+            }
+            const v = isRecord(values) ? ownValue(values, name) : undefined;
+            if (typeof v === 'string')
+                return v;
+            if (def !== undefined)
+                return def;
+            if (!missing.includes(name))
+                missing.push(name);
+            return whole;
+        });
+        const out = {};
+        const keys = ownKeysOf(entry) ?? [];
+        for (const k of keys) {
+            const r = ownData(entry, k);
+            if (!r.ok) {
+                const d = Object.getOwnPropertyDescriptor(entry, k);
+                if (d !== undefined)
+                    Object.defineProperty(out, k, d);
+                continue;
+            }
+            let v = r.value;
+            if ((k === 'command' || k === 'url') && typeof v === 'string')
+                v = x(v);
+            else if (k === 'args') {
+                const list = stringListOf(v);
+                if (list !== undefined)
+                    v = list.map(x);
+            }
+            else if ((k === 'env' || k === 'headers') && isRecord(v)) {
+                const src = v;
+                const map = {};
+                let ok = true;
+                for (const mk of ownKeysOf(src) ?? []) {
+                    const mr = ownData(src, mk);
+                    if (!mr.ok) {
+                        ok = false;
+                        break;
+                    }
+                    Object.defineProperty(map, mk, { value: typeof mr.value === 'string' ? x(mr.value) : mr.value, writable: true, enumerable: true, configurable: true });
+                }
+                if (ok)
+                    v = map;
+            }
+            Object.defineProperty(out, k, { value: v, writable: true, enumerable: true, configurable: true });
+        }
+        return Object.freeze({ entry: out, missing: Object.freeze([...missing]), withheld: Object.freeze([...withheld]) });
+    }
+    catch {
+        return Object.freeze({ entry, missing: Object.freeze([...missing]), withheld: Object.freeze([...withheld]) });
+    }
+}
+export function expansionTargetOf(entry) {
+    const t = ownValue(entry, 'type');
+    if (typeof t === 'string')
+        return t === 'stdio' ? 'plain' : 'remote';
+    return typeof ownValue(entry, 'url') === 'string' && ownValue(entry, 'command') === undefined ? 'remote' : 'plain';
+}
+const NAME_REASONS = Object.freeze({ name_blank: true, name_edge_whitespace: true, name_collides_after_trim: true, name_too_long: true, name_reserved: true });
+export function judgeTable(table, env, opts) {
+    try {
+        if (!isRecord(table))
+            return undefined;
+        const names = ownKeysOf(table);
+        if (names === undefined)
+            return undefined;
+        const forJudge = {};
+        const pre = [];
+        for (const name of names) {
+            const r = ownData(table, name);
+            const raw = r.ok ? r.value : undefined;
+            const reserved = opts.reserved.has(name);
+            const envSig = opts.signature === true && r.ok ? envSignatureOf(raw) : undefined;
+            const readable = r.ok && (opts.signature !== true || envSig !== undefined);
+            const exp = readable && !reserved ? (opts.expand ? expandMcpServerEntry(raw, env, expansionTargetOf(raw)) : { entry: raw, missing: [], withheld: [] }) : undefined;
+            pre.push({ name, raw, readable, exp, reserved, envSig });
+            if (!reserved && readable)
+                Object.defineProperty(forJudge, name, { value: exp?.entry, writable: true, enumerable: true, configurable: true });
+            else if (!reserved)
+                Object.defineProperty(forJudge, name, {
+                    get() {
+                        throw new Error('entry unreadable');
+                    },
+                    enumerable: true,
+                    configurable: true,
+                });
+        }
+        const projected = projectMcpConfigs(forJudge, opts.lang === undefined ? undefined : { lang: opts.lang });
+        const out = [];
+        for (const p of pre) {
+            if (p.reserved) {
+                out.push({ name: p.name, raw: p.raw, spec: undefined, problems: Object.freeze([{ reason: 'name_reserved', notice: renderMessage(msg('config.mcpServers.problem.nameReserved'), opts.lang) }]), missing: [], withheld: [], vote: { kind: 'none' }, reserved: true, ...(p.envSig === undefined ? {} : { envSig: p.envSig }) });
+                continue;
+            }
+            const spec = projected.specs.find((s) => s.name === p.name);
+            const drops = projected.dropped.filter((d) => d.name === p.name);
+            const problems = drops.map((d) => Object.freeze({ reason: d.reason, ...(d.path === undefined ? {} : { path: d.path }), notice: d.notice }));
+            if (spec === undefined && problems.length === 0) {
+                const tv = isRecord(p.exp?.entry) ? mcpTransportVerdict(p.exp?.entry) : undefined;
+                problems.push(Object.freeze({ reason: 'transport_invalid', path: tv !== undefined && tv.kind === 'bad' ? tv.key : 'transport.kind', notice: tv !== undefined && tv.kind === 'bad' ? tv.detail : 'transport not supported' }));
+            }
+            const nameBad = drops.some((d) => Object.hasOwn(NAME_REASONS, d.reason));
+            const notObject = !p.readable || !isRecord(p.raw);
+            let vote;
+            if (nameBad || notObject)
+                vote = { kind: 'none' };
+            else {
+                const a = ownData(p.raw, 'allowTools');
+                const transportBad = spec === undefined && problems.some((x) => x.reason === 'transport_invalid' || x.reason === 'identity_headers_both_set');
+                if (!a.ok)
+                    vote = { kind: 'bad' };
+                else if (a.value === undefined)
+                    vote = { kind: 'absent' };
+                else if (transportBad)
+                    vote = { kind: 'bad' };
+                else {
+                    const list = stringListOf(a.value);
+                    vote = list === undefined ? { kind: 'bad' } : { kind: 'list', list: Object.freeze(list) };
+                }
+            }
+            out.push({ name: p.name, raw: p.raw, spec, problems: Object.freeze(problems), missing: p.exp?.missing ?? [], withheld: p.exp?.withheld ?? [], vote, reserved: false, ...(p.envSig === undefined ? {} : { envSig: p.envSig }) });
+        }
+        return Object.freeze(out);
+    }
+    catch {
+        return undefined;
+    }
+}
+const LOOSEN_LAYERS = CC_MERGE_ORDER;
+function approvalCategoryOf() {
+    const row = LOCAL_CONFIG_WRITE_INTENTS.find((r) => r.intent === 'mcpJsonEnabled');
+    return row === undefined ? '' : row.admitVia;
+}
+function approvalFactsOf(read, facts, purpose) {
+    const session = grantedNames(nameListOf(facts, 'sessionApproved'));
+    if (read === undefined)
+        return { rejected: new Set(), rejectedUnreadable: false, approvedBySettings: () => false, session, mayApprove: session.size > 0, autoBy: undefined, withheld: Object.freeze([]) };
+    const rejected = new Set();
+    let rejectedUnreadable = false;
+    const admitted = [];
+    const withheld = [];
+    for (const layer of LOOSEN_LAYERS) {
+        const snap = read.layers[layer];
+        if (!snap.enabled || snap.doc === null)
+            continue;
+        const rej = nameListOf(snap.doc, 'disabledMcpjsonServers');
+        if (rej.kind === 'bad')
+            rejectedUnreadable = true;
+        else if (rej.kind === 'list')
+            for (const n of rej.list)
+                rejected.add(n);
+        let word;
+        try {
+            word = layerAdmissionWord(layer, read.trust, approvalCategoryOf());
+        }
+        catch {
+            word = 'unknown';
+        }
+        if (word === 'admitted')
+            admitted.push(layer);
+        else if (word === 'trust_withheld' && (layer === 'projectSettings' || layer === 'localSettings')) {
+            const all = ownValue(snap.doc, 'enableAllProjectMcpServers') === true;
+            const en = nameListOf(snap.doc, 'enabledMcpjsonServers');
+            const named = en.kind === 'bad' || (en.kind === 'list' && en.list.length > 0);
+            if (all || named)
+                withheld.push({ layer, cause: 'trust_withheld' });
+        }
+    }
+    const lists = admitted.map((l) => grantedNames(nameListOf(read.layers[l].doc, 'enabledMcpjsonServers')));
+    const union = new Set(lists.flatMap((s) => [...s]));
+    let approvedBySettings;
+    let mayApprove;
+    if (read.trust === 'accepted') {
+        let all;
+        for (const l of admitted) {
+            const v = ownValue(read.layers[l].doc, 'enableAllProjectMcpServers');
+            if (typeof v === 'boolean')
+                all = v;
+        }
+        approvedBySettings = (name) => all === true || union.has(name);
+        mayApprove = all === true || union.size > 0;
+    }
+    else {
+        const anyAll = admitted.some((l) => ownValue(read.layers[l].doc, 'enableAllProjectMcpServers') === true);
+        approvedBySettings = (name) => anyAll || union.has(name);
+        mayApprove = anyAll || union.size > 0;
+    }
+    let autoBy;
+    if (purpose === 'load' && read.layers.projectSettings.enabled) {
+        const skip = ['policySettings', 'userSettings'].some((l) => read.layers[l].doc !== null && ownValue(read.layers[l].doc, 'skipDangerousModePermissionPrompt') === true);
+        if (ownValue(facts, 'permissionMode') === 'bypass' && skip)
+            autoBy = 'bypass';
+        else if (ownValue(facts, 'nonInteractive') === true)
+            autoBy = 'non_interactive';
+    }
+    return { rejected, rejectedUnreadable, approvedBySettings, session, mayApprove: mayApprove || session.size > 0 || autoBy !== undefined, autoBy, withheld: Object.freeze(withheld) };
+}
+function approvalOf(a, name) {
+    if (a.rejected.has(name))
+        return { state: 'rejected' };
+    if (a.approvedBySettings(name))
+        return { state: 'approved', by: 'settings' };
+    if (a.session.has(name))
+        return { state: 'approved', by: 'session' };
+    if (a.autoBy !== undefined)
+        return { state: 'approved', by: a.autoBy };
+    return { state: 'pending' };
+}
+export function fileReadingOf(holder, key, missing) {
+    const slot = ownData(holder, key);
+    if (!slot.ok)
+        return { status: 'unreadable', cause: 'io' };
+    const r = slot.value;
+    if (r === undefined)
+        return missing === 'absent' ? { status: 'absent' } : { status: 'unreadable', cause: 'io' };
+    if (!isRecord(r))
+        return { status: 'unreadable', cause: 'io' };
+    const status = ownData(r, 'status');
+    if (!status.ok)
+        return { status: 'unreadable', cause: 'io' };
+    if (status.value === 'absent')
+        return { status: 'absent' };
+    if (status.value === 'outside_fence')
+        return { status: 'outside_fence' };
+    if (status.value !== 'loaded')
+        return { status: 'unreadable', cause: 'io' };
+    const doc = ownData(r, 'doc');
+    const revision = ownData(r, 'revision');
+    if (!doc.ok || !isRecord(doc.value) || !revision.ok || typeof revision.value !== 'string' || revision.value === '')
+        return { status: 'unreadable', cause: 'io' };
+    const loaded = { status: 'loaded', doc: doc.value, revision: revision.value };
+    return Object.freeze(loaded);
+}
+const revisionOf = (r) => (r.status === 'loaded' ? r.revision : null);
+const sourceTableOf = (r, path) => (r.status === 'outside_fence' ? { kind: 'absent' } : subTableOf(documentOf(r), path));
+function signatureOf(entry) {
+    const url = ownValue(entry, 'url');
+    if (typeof url === 'string')
+        return `u:${url}`;
+    const cmd = ownValue(entry, 'command');
+    if (typeof cmd !== 'string')
+        return undefined;
+    return `c:${JSON.stringify([cmd, stringListOf(ownValue(entry, 'args')) ?? []])}`;
+}
+export function mergeMcpServers(input, purpose) {
+    const lang = input.lang;
+    const facts = isRecord(input.facts) ? input.facts : {};
+    const files = isRecord(input.files) ? input.files : {};
+    const supplementary = isRecord(input.supplementarySources) ? input.supplementarySources : {};
+    let read;
+    if (input.settings !== 'none') {
+        try {
+            read = readHostSettingsOnce(input.settings, 'mcpServersReport');
+        }
+        catch {
+            read = undefined;
+        }
+    }
+    const env = ownValue(facts, 'env');
+    const reserved = new Set(stringListOf(ownValue(facts, 'reservedNames')) ?? []);
+    const none = new Set();
+    const approvals = approvalFactsOf(read, facts, purpose);
+    const unreadable = new Set();
+    const g = fileReadingOf(files, 'global', 'absent');
+    const ent = fileReadingOf(files, 'enterprise', 'absent');
+    const projectKeyRaw = ownValue(files, 'projectKey');
+    const projectKey = typeof projectKeyRaw === 'string' && projectKeyRaw !== '' ? projectKeyRaw : undefined;
+    const chain = [];
+    const chainSlot = ownData(files, 'projectChain');
+    if (!chainSlot.ok)
+        chain.push({ status: 'unreadable', cause: 'io' });
+    else if (chainSlot.value !== undefined) {
+        const len = ownArrayLength(chainSlot.value);
+        if (len === undefined)
+            chain.push({ status: 'unreadable', cause: 'io' });
+        else
+            for (let i = 0; i < len; i++)
+                chain.push(fileReadingOf(chainSlot.value, String(i), 'unreadable'));
+    }
+    const policyDoc = read !== undefined ? read.layers.policySettings.doc : null;
+    const pluginOnlyRaw = policyDoc === null ? undefined : ownValue(policyDoc, 'strictPluginOnlyCustomization');
+    const pluginOnly = pluginOnlyRaw === true || (stringListOf(pluginOnlyRaw) ?? []).includes('mcp');
+    const enterpriseBranch = ent.status === 'loaded' || ent.status === 'unreadable';
+    const strict = ownValue(supplementary, 'strictDynamicOnly') === true;
+    const locked = enterpriseBranch ? 'enterprise_config' : pluginOnly ? 'plugin_only' : undefined;
+    const managedState = read?.managed;
+    const managedWithhold = managedState === 'in-effect-pieces' || managedState === 'remote-unknown' || managedState === 'unreadable-covered' || managedState === 'unreadable-uncovered';
+    const projectEligible = !pluginOnly && approvals.mayApprove;
+    const sources = [];
+    const lockedOut = [];
+    const push = (s, out = sources) => {
+        out.push(s);
+    };
+    const judged = (t, opts) => t.kind === 'absent' ? 'absent' : t.kind === 'bad' ? 'unreadable' : (judgeTable(t.table, env, opts) ?? 'unreadable');
+    const slot = (key) => {
+        const r = ownData(supplementary, key);
+        if (!r.ok)
+            return 'unreadable';
+        return r.value === undefined ? undefined : isRecord(r.value) ? r.value : 'unreadable';
+    };
+    const agentSlot = (() => {
+        const r = ownData(supplementary, 'agent');
+        if (!r.ok)
+            return 'unreadable';
+        const v = r.value;
+        if (v === undefined)
+            return undefined;
+        if (!isRecord(v))
+            return 'unreadable';
+        const servers = ownValue(v, 'servers');
+        return isRecord(servers) ? { fromFlagSettings: ownValue(v, 'fromFlagSettings') === true, servers } : 'unreadable';
+    })();
+    const addExtra = (scope, table, useReserved) => {
+        if (table === undefined)
+            return;
+        const entries = table === 'unreadable' ? 'unreadable' : judged({ kind: 'table', table }, { expand: true, reserved: useReserved ? reserved : none, lang, ...(scope === 'plugin' ? { signature: true } : {}) });
+        if (entries === 'unreadable')
+            unreadable.add('supplementary');
+        else if (entries !== 'absent')
+            push({ scope, file: 'supplementary', revision: null, entries, project: false, writable: false });
+    };
+    const addManaged = () => {
+        const entries = judged(policyDoc === null ? { kind: 'absent' } : subTableOf(policyDoc, ['managedMcpServers']), { expand: false, reserved: none, lang });
+        if (entries === 'unreadable')
+            unreadable.add('managed');
+        else if (entries !== 'absent')
+            push({ scope: 'managed', file: 'managed', revision: null, entries, project: false, writable: false });
+    };
+    if (managedWithhold)
+        unreadable.add('managed');
+    if (enterpriseBranch) {
+        addManaged();
+        const entries = judged(sourceTableOf(ent, PROJECT_FILE_PATH), { expand: true, reserved, lang });
+        if (entries === 'unreadable')
+            unreadable.add('enterprise');
+        else if (entries !== 'absent')
+            push({ scope: 'enterprise', file: 'enterprise', revision: revisionOf(ent), entries, project: false, writable: false });
+    }
+    else if (strict) {
+        if (agentSlot !== undefined && agentSlot !== 'unreadable' && agentSlot.fromFlagSettings)
+            addExtra('agent', agentSlot.servers, false);
+        else if (agentSlot === 'unreadable')
+            unreadable.add('supplementary');
+        addExtra('dynamic', slot('dynamic'), false);
+    }
+    else {
+        addExtra('claudeai', slot('claudeai'), true);
+        addExtra('plugin', slot('plugin'), true);
+        const fileSink = pluginOnly ? lockedOut : sources;
+        const userEntries = judged(sourceTableOf(g, USER_SCOPE_PATH), { expand: true, reserved, lang });
+        if (userEntries === 'unreadable') {
+            if (!pluginOnly)
+                unreadable.add('global');
+        }
+        else if (userEntries !== 'absent')
+            push({ scope: 'user', file: 'global', revision: revisionOf(g), entries: userEntries, project: false, writable: !pluginOnly }, fileSink);
+        for (let ci = 0; ci < chain.length; ci++) {
+            const f = chain[ci];
+            const entries = judged(sourceTableOf(f, PROJECT_FILE_PATH), { expand: true, reserved, lang });
+            if (entries === 'unreadable') {
+                if (projectEligible)
+                    unreadable.add('project');
+            }
+            else if (entries !== 'absent')
+                push({ scope: 'project', file: 'project', revision: revisionOf(f), entries, project: true, writable: !pluginOnly && ci === chain.length - 1 && ownValue(facts, 'projectConfigRootSet') !== true }, fileSink);
+        }
+        if (approvals.rejectedUnreadable && projectEligible && sources.some((s) => s.project && s.entries.length > 0))
+            unreadable.add('project');
+        if (projectKey !== undefined) {
+            const localEntries = judged(sourceTableOf(g, localScopePath(projectKey)), { expand: true, reserved, lang });
+            if (localEntries === 'unreadable') {
+                if (!pluginOnly)
+                    unreadable.add('global');
+            }
+            else if (localEntries !== 'absent')
+                push({ scope: 'local', file: 'global', revision: revisionOf(g), entries: localEntries, project: false, writable: !pluginOnly }, fileSink);
+        }
+        addManaged();
+        if (agentSlot === 'unreadable')
+            unreadable.add('supplementary');
+        else if (agentSlot !== undefined)
+            addExtra('agent', agentSlot.servers, false);
+        addExtra('dynamic', slot('dynamic'), false);
+    }
+    const approvalByName = new Map();
+    const participates = (s, e) => {
+        if (!s.project)
+            return true;
+        let v = approvalByName.get(e.name);
+        if (v === undefined) {
+            v = approvalOf(approvals, e.name);
+            approvalByName.set(e.name, v);
+        }
+        return v.state === 'approved';
+    };
+    const manualSigs = new Set();
+    for (const s of sources) {
+        if (s.scope === 'plugin' || s.scope === 'claudeai')
+            continue;
+        for (const e of s.entries)
+            if (e.spec !== undefined && participates(s, e)) {
+                const sig = signatureOf(e.raw);
+                if (sig !== undefined)
+                    manualSigs.add(sig);
+            }
+    }
+    const pluginSigs = new Set();
+    const suppressed = new Set();
+    for (const s of sources) {
+        if (s.scope !== 'plugin')
+            continue;
+        for (const e of s.entries) {
+            if (e.envSig === undefined)
+                continue;
+            const sig = signatureOf(e.raw);
+            if (sig === undefined)
+                continue;
+            const withEnv = `${sig}|${e.envSig}`;
+            if (manualSigs.has(sig) || pluginSigs.has(withEnv))
+                suppressed.add(e);
+            else
+                pluginSigs.add(withEnv);
+        }
+    }
+    const votes = new Map();
+    for (const s of sources)
+        for (const e of s.entries) {
+            if (e.vote.kind === 'none' || suppressed.has(e) || !participates(s, e))
+                continue;
+            const list = votes.get(e.name) ?? [];
+            list.push(e.vote);
+            votes.set(e.name, list);
+        }
+    const ledgerOf = (name) => {
+        const vs = votes.get(name) ?? [];
+        if (vs.some((v) => v.kind === 'bad'))
+            return { kind: 'withheld', by: 'narrowing_invalid' };
+        const lists = vs.filter((v) => v.kind === 'list');
+        if (lists.length === 0)
+            return { kind: 'ok' };
+        if (lists.length !== vs.length)
+            return { kind: 'withheld', by: 'narrowing_conflict' };
+        const first = JSON.stringify(lists[0].list);
+        return lists.every((l) => JSON.stringify(l.list) === first) ? { kind: 'ok' } : { kind: 'withheld', by: 'narrowing_conflict' };
+    };
+    let disabled = new Set();
+    if (projectKey !== undefined) {
+        const pt = sourceTableOf(g, ['projects', projectKey]);
+        const list = pt.kind === 'table' ? nameListOf(pt.table, 'disabledMcpServers') : pt.kind === 'absent' ? { kind: 'absent' } : { kind: 'bad' };
+        if (list.kind === 'bad')
+            unreadable.add('global');
+        else if (list.kind === 'list')
+            disabled = new Set(list.list);
+    }
+    const q2 = unreadable.size > 0;
+    const order = [];
+    const byName = new Map();
+    const slotOf = (name) => {
+        let x = byName.get(name);
+        if (x === undefined) {
+            x = { shadows: [] };
+            byName.set(name, x);
+            order.push(name);
+        }
+        return x;
+    };
+    for (const s of sources)
+        for (const e of s.entries) {
+            if (suppressed.has(e))
+                continue;
+            const x = slotOf(e.name);
+            if (s.project && !participates(s, e)) {
+                x.pending = { s, e, v: approvalByName.get(e.name) ?? { state: 'pending' } };
+                continue;
+            }
+            if (e.spec === undefined) {
+                x.unusable = { s, e };
+                continue;
+            }
+            if (x.winner !== undefined && !x.shadows.includes(x.winner.s.scope))
+                x.shadows.push(x.winner.s.scope);
+            x.winner = { s, e };
+        }
+    for (const s of lockedOut)
+        for (const e of s.entries)
+            slotOf(e.name);
+    const rows = [];
+    for (const name of order) {
+        const x = byName.get(name);
+        if (x.winner !== undefined) {
+            const { s, e } = x.winner;
+            const ledger = ledgerOf(name);
+            const base = { name, scope: s.scope, entry: e.raw, shadows: Object.freeze([...x.shadows]), origin: Object.freeze({ file: s.file, revision: s.revision }), writable: s.writable, missing: e.missing, withheldVars: e.withheld };
+            const av = s.project ? approvalByName.get(name) : undefined;
+            const approvedBy = av !== undefined && av.state === 'approved' ? av.by : undefined;
+            const withApproval = approvedBy === undefined ? {} : { approvedBy };
+            if (q2)
+                rows.push(Object.freeze({ ...base, ...withApproval, state: 'withheld', withheldBy: 'layer_unreadable' }));
+            else if (ledger.kind === 'withheld')
+                rows.push(Object.freeze({ ...base, ...withApproval, state: 'withheld', withheldBy: ledger.by }));
+            else if (disabled.has(name))
+                rows.push(Object.freeze({ ...base, ...withApproval, state: 'disabled' }));
+            else
+                rows.push(Object.freeze({ ...base, ...withApproval, state: 'active', ...(e.spec === undefined ? {} : { spec: e.spec }) }));
+            continue;
+        }
+        if (x.pending !== undefined) {
+            const { s, e, v } = x.pending;
+            rows.push(Object.freeze({ name, scope: s.scope, entry: e.raw, shadows: Object.freeze([]), state: v.state === 'rejected' ? 'rejected' : 'pending_approval', origin: Object.freeze({ file: s.file, revision: s.revision }), writable: s.writable, missing: e.missing, withheldVars: e.withheld }));
+            continue;
+        }
+        if (x.unusable !== undefined) {
+            const { s, e } = x.unusable;
+            rows.push(Object.freeze({ name, scope: s.scope, entry: e.raw, shadows: Object.freeze([]), state: 'unusable', problems: e.problems, origin: Object.freeze({ file: s.file, revision: s.revision }), writable: s.writable, missing: e.missing, withheldVars: e.withheld }));
+            continue;
+        }
+        for (const s of lockedOut) {
+            const e = s.entries.filter((y) => y.name === name).pop();
+            if (e === undefined)
+                continue;
+            rows.push(Object.freeze({ name, scope: s.scope, entry: e.raw, shadows: Object.freeze([]), state: 'withheld', withheldBy: 'policy_locked', origin: Object.freeze({ file: s.file, revision: s.revision }), writable: false, missing: e.missing, withheldVars: e.withheld }));
+            break;
+        }
+    }
+    const dep = ownValue(facts, 'deploymentNames');
+    const depList = stringListOf(dep);
+    const deployment = depList !== undefined ? Object.freeze({ state: 'read', names: Object.freeze(depList) }) : Object.freeze({ state: 'unknown' });
+    return Object.freeze({
+        rows: Object.freeze(rows),
+        unreadable: Object.freeze(['global', 'project', 'enterprise', 'managed', 'supplementary'].filter((f) => unreadable.has(f))),
+        locked,
+        purpose,
+        approvalsWithheld: approvals.withheld,
+        deployment,
+        pluginRoster: slot('plugin') === undefined ? 'absent' : 'host_supplied',
+        promptsAndResources: 'not_yet',
+    });
+}
+export function mcpServersReport(files, facts, settings, supplementarySources, lang) {
+    return mergeMcpServers({ files, facts, settings, ...(supplementarySources === undefined ? {} : { supplementarySources }), ...(lang === undefined ? {} : { lang }) }, 'report');
+}