@switchboard-mcp/core 0.1.1 → 0.1.3

package/dist/import/import-plan.js

@@ -1,11 +1,14 @@
 import { constants, readdirSync, readFileSync, statSync } from "node:fs";
 import { copyFile, mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+import { planAuthorityStatus } from "../authority/authority-status.js";
 import { deepMerge, loadSwitchboardConfig } from "../config/load-config.js";
 import { resolveRepoConfigPaths } from "../config/paths.js";
 import { resolveProjectClientConfigPath } from "../install/client-config.js";
 import { normalizeNamespace } from "../namespaces/namespaces.js";
+import { planRecommendedNextAction } from "../next-actions/next-actions.js";
 import { switchboardConfigSchema } from "../schemas/config.js";
 export const importPlanSchemaVersion = "switchboard.import-plan.v1";
 const providerEnvPrefixes = {
@@ -18,7 +21,11 @@ const providerEnvPrefixes = {
 export async function createSwitchboardImportPlan(options = {}) {
     const cwd = resolve(options.cwd ?? process.cwd());
     const repoName = basename(cwd);
-    const loaded = loadSwitchboardConfig({ cwd });
+    const loaded = loadSwitchboardConfig({
+        cwd,
+        ...(options.env ? { env: options.env } : {}),
+        ...(options.homeDir ? { homeDir: options.homeDir } : {})
+    });
     const profileNames = new Set(Object.keys(loaded.config.profiles));
     const switchboardProfiles = Object.entries(loaded.config.profiles).map(([name, profile]) => ({
         name,
@@ -28,6 +35,23 @@ export async function createSwitchboardImportPlan(options = {}) {
     const clients = detectClientConfigs(cwd, repoName);
     const envFiles = detectEnvFiles(cwd);
     const detectedServers = clients.flatMap((client) => client.servers.filter((server) => server.name !== "switchboard"));
+    const acceptedDirect = collectAcceptedDirectRiskIds({
+        configured: loaded.config.acceptedRisks.directMcp.map((risk) => risk.id),
+        requested: options.acceptDirect ?? []
+    });
+    const bypassFindings = buildBypassFindings({
+        cwd,
+        ...(options.homeDir ? { homeDir: options.homeDir } : {}),
+        clients,
+        switchboardProfiles,
+        acceptedDirect
+    });
+    const riskFindings = buildRiskFindings({
+        envFiles,
+        clients,
+        bypassFindings
+    });
+    const cleanupPlan = buildClientCleanupPlan(clients, acceptedDirect);
     const createProfileActions = uniqueServersByProfile(detectedServers)
         .filter((server) => !profileNames.has(server.suggestedProfileName))
         .map((server) => createProfileAction(server));
@@ -75,18 +99,42 @@ export async function createSwitchboardImportPlan(options = {}) {
         ...installActions,
         ...reviewActions
     ];
-    const warnings = buildWarnings({ clients, envFiles, detectedServers });
+    const warnings = buildWarnings({
+        clients,
+        envFiles,
+        detectedServers,
+        riskFindings,
+        bypassFindings
+    });
     const safetyNotes = [
         "Dry run only: this command does not write .switchboard.yaml or client config.",
         "Secret values are never read from env files or client config; only env variable names are reported.",
         "Imported MCP servers should be treated as setup candidates until doctor and preset checks pass.",
-        "Run client install separately so existing Codex/Claude config remains backup-protected and reversible."
+        "Run client install separately so existing Codex/Claude config remains backup-protected and reversible.",
+        "Cleanup backups are exact rollback copies of original client config and may contain any raw values that were already there."
     ];
+    const cleanupPlanned = cleanupPlan.some((item) => item.status === "planned");
     const nextActions = [
-        "switchboard import --dry-run",
+        ...(cleanupPlanned ? ["switchboard import --write --cleanup-client"] : []),
         ...secretCommands.map((command) => renderCommand(command)),
-        ...installClients.map((command) => renderCommand(command))
+        ...installClients.map((command) => renderCommand(command)),
+        ...(cleanupPlanned ? [] : ["switchboard import --dry-run"])
     ];
+    const recommendedNextAction = planRecommendedNextAction(importNextActionCandidates({
+        secretCommands,
+        cleanupPlan,
+        installClients,
+        preferCleanup: cleanupPlanned
+    }));
+    const authorityStatus = planAuthorityStatus({
+        diagnostics: loaded.diagnostics,
+        invalidClientConfigs: clients.some((client) => client.status === "invalid"),
+        bypassFindings,
+        riskFindings,
+        switchboardConfigured: switchboardProfiles.length > 0,
+        switchboardInstalled: clients.some((client) => client.servers.some((server) => server.routesThroughSwitchboard)),
+        recommendedNextAction
+    });
     return {
         ok: true,
         schemaVersion: importPlanSchemaVersion,
@@ -97,18 +145,66 @@ export async function createSwitchboardImportPlan(options = {}) {
             switchboardProfiles,
             envFiles
         },
+        riskFindings,
+        bypassFindings,
+        authorityStatus,
+        cleanupPlan,
         actions,
         commands: {
             dryRun: { command: "switchboard", args: ["import", "--dry-run"] },
             writePreview: { command: "switchboard", args: ["import", "--write"] },
+            cleanupClient: {
+                command: "switchboard",
+                args: ["import", "--write", "--cleanup-client"]
+            },
             installClients,
             secretCommands
         },
         warnings,
         safetyNotes,
+        recommendedNextAction,
         nextActions: [...new Set(nextActions)]
     };
 }
+function importNextActionCandidates(options) {
+    const candidates = [];
+    if (options.preferCleanup &&
+        options.cleanupPlan.some((item) => item.status === "planned")) {
+        candidates.push({
+            kind: "bypass-cleanup",
+            command: "switchboard import --write --cleanup-client",
+            reason: "Remove direct MCP bypass routes from active client config with backups."
+        });
+    }
+    for (const command of options.secretCommands) {
+        candidates.push({
+            kind: "missing-secret",
+            command: renderCommand(command),
+            reason: "Store the token behind a local secretRef before routing agents."
+        });
+    }
+    if (!options.preferCleanup &&
+        options.cleanupPlan.some((item) => item.status === "planned")) {
+        candidates.push({
+            kind: "bypass-cleanup",
+            command: "switchboard import --write --cleanup-client",
+            reason: "Remove direct MCP bypass routes from active client config with backups."
+        });
+    }
+    for (const command of options.installClients) {
+        candidates.push({
+            kind: "client-install",
+            command: renderCommand(command),
+            reason: "Route this project client through Switchboard MCP."
+        });
+    }
+    candidates.push({
+        kind: "info",
+        command: "switchboard import --dry-run",
+        reason: "Review the import plan without writing files."
+    });
+    return candidates;
+}
 export async function writeSwitchboardImportPlan(options = {}) {
     const plan = await createSwitchboardImportPlan(options);
     const cwd = plan.repo.cwd;
@@ -116,34 +212,57 @@ export async function writeSwitchboardImportPlan(options = {}) {
     const importableServers = uniqueServersByProfile(plan.detected.clients.flatMap((client) => client.servers.filter((server) => !server.routesThroughSwitchboard &&
         server.command !== null &&
         !plan.detected.switchboardProfiles.some((profile) => profile.name === server.suggestedProfileName))));
+    const acceptedDirectRisks = plan.bypassFindings.filter((finding) => finding.status === "accepted" &&
+        (options.acceptDirect ?? []).includes(finding.id));
     if (importableServers.length === 0) {
+        const acceptedRiskWrite = acceptedDirectRisks.length > 0
+            ? await writeAcceptedDirectRisks(targetPath, acceptedDirectRisks, options.now)
+            : { backupPath: null, nextContent: null };
+        const clientCleanup = options.cleanupClient
+            ? await writeClientCleanupPlan(plan, options.now)
+            : [];
+        const refreshedPlan = await createSwitchboardImportPlan({
+            cwd,
+            ...(options.env ? { env: options.env } : {}),
+            ...(options.homeDir ? { homeDir: options.homeDir } : {})
+        });
         return {
             ok: true,
             schemaVersion: importPlanSchemaVersion,
-            action: "noop",
+            action: acceptedRiskWrite.nextContent ? "updated" : "noop",
             targetPath,
-            backupPath: null,
-            plan,
+            backupPath: acceptedRiskWrite.backupPath,
+            plan: refreshedPlan,
             createdProfiles: [],
-            nextContent: null
+            clientCleanup,
+            nextContent: acceptedRiskWrite.nextContent
         };
     }
     assertNoNamespaceCollisions(plan, importableServers);
     const existing = await readOptionalTextFileAsync(targetPath);
-    const nextContent = renderMergedImportConfig(existing, importableServers);
+    const nextContent = renderMergedImportConfig(existing, importableServers, acceptedDirectRisks);
     await mkdir(dirname(targetPath), { recursive: true });
     const backupPath = existing
         ? await backupExistingFile(targetPath, options.now)
         : null;
     await writeFile(targetPath, nextContent, "utf8");
+    const clientCleanup = options.cleanupClient
+        ? await writeClientCleanupPlan(plan, options.now)
+        : [];
+    const refreshedPlan = await createSwitchboardImportPlan({
+        cwd,
+        ...(options.env ? { env: options.env } : {}),
+        ...(options.homeDir ? { homeDir: options.homeDir } : {})
+    });
     return {
         ok: true,
         schemaVersion: importPlanSchemaVersion,
         action: existing ? "updated" : "created",
         targetPath,
         backupPath,
-        plan,
+        plan: refreshedPlan,
         createdProfiles: importableServers.map((server) => server.suggestedProfileName),
+        clientCleanup,
         nextContent
     };
 }
@@ -166,12 +285,14 @@ function assertNoNamespaceCollisions(plan, servers) {
         planned.set(namespace, server.suggestedProfileName);
     }
 }
-function renderMergedImportConfig(existingContent, servers) {
-    const rendered = renderImportConfig(servers);
+function renderMergedImportConfig(existingContent, servers, acceptedRisks = []) {
+    const existing = existingContent?.trim()
+        ? parseConfigYaml(existingContent, ".switchboard.yaml")
+        : {};
+    const rendered = renderImportConfig(servers, mergeAcceptedDirectRisks(existing, acceptedRisks));
     if (!existingContent?.trim()) {
         return `${stringifyYaml(rendered, { lineWidth: 0 })}`;
     }
-    const existing = parseConfigYaml(existingContent, ".switchboard.yaml");
     const merged = deepMerge(existing, rendered);
     const parsed = switchboardConfigSchema.safeParse(merged);
     if (!parsed.success) {
@@ -181,7 +302,44 @@ function renderMergedImportConfig(existingContent, servers) {
         lineWidth: 0
     })}`;
 }
-function renderImportConfig(servers) {
+function mergeAcceptedDirectRisks(existing, acceptedRisks) {
+    const byId = new Map();
+    const existingRisks = isRecord(existing.acceptedRisks)
+        ? existing.acceptedRisks
+        : {};
+    const directMcp = Array.isArray(existingRisks.directMcp)
+        ? existingRisks.directMcp
+        : [];
+    for (const risk of directMcp) {
+        if (isRecord(risk) &&
+            typeof risk.id === "string" &&
+            (risk.client === "codex" || risk.client === "claude") &&
+            typeof risk.serverName === "string") {
+            byId.set(risk.id, {
+                id: risk.id,
+                status: "accepted",
+                severity: "medium",
+                client: risk.client,
+                targetPath: "",
+                serverName: risk.serverName,
+                provider: "unknown",
+                command: null,
+                args: [],
+                envKeys: [],
+                suggestedProfileName: "",
+                riskTags: ["direct-mcp-server"],
+                reasons: [],
+                nextActions: [],
+                acceptedRiskGuidance: "This direct route is marked as accepted risk; it remains visible and prevents controlled authority status."
+            });
+        }
+    }
+    for (const risk of acceptedRisks) {
+        byId.set(risk.id, risk);
+    }
+    return [...byId.values()];
+}
+function renderImportConfig(servers, acceptedRisks = []) {
     const profiles = Object.fromEntries(servers.map((server) => [
         server.suggestedProfileName,
         {
@@ -198,18 +356,41 @@ function renderImportConfig(servers) {
             }
         }
     ]));
-    return {
+    const config = {
         version: 1,
         defaults: {},
         profiles,
-        workspaces: {
+        policies: {}
+    };
+    if (servers.length > 0) {
+        config.workspaces = {
             default: {
                 paths: ["."],
                 profiles: servers.map((server) => server.suggestedProfileName)
             }
-        },
-        policies: {}
-    };
+        };
+    }
+    if (acceptedRisks.length > 0) {
+        config.acceptedRisks = {
+            directMcp: acceptedRisks.map((risk) => ({
+                id: risk.id,
+                client: risk.client,
+                serverName: risk.serverName
+            }))
+        };
+    }
+    return config;
+}
+async function writeAcceptedDirectRisks(targetPath, acceptedRisks, now) {
+    const existing = await readOptionalTextFileAsync(targetPath);
+    const nextContent = renderMergedImportConfig(existing, [], acceptedRisks);
+    if (existing === nextContent) {
+        return { backupPath: null, nextContent: null };
+    }
+    await mkdir(dirname(targetPath), { recursive: true });
+    const backupPath = existing ? await backupExistingFile(targetPath, now) : null;
+    await writeFile(targetPath, nextContent, "utf8");
+    return { backupPath, nextContent };
 }
 function renderImportedEnv(server) {
     const env = Object.fromEntries(server.suggestedSecretRefs.map((secret) => [
@@ -425,8 +606,408 @@ function buildWarnings(options) {
     if (options.detectedServers.some((server) => server.envKeys.some((key) => isSecretLikeName(key)))) {
         warnings.push("Existing MCP configs reference secret-looking env names; store values behind Switchboard local token aliases before routing agents.");
     }
+    if (options.bypassFindings && options.bypassFindings.length > 0) {
+        warnings.push("Direct MCP servers bypass Switchboard authority; review bypass findings before giving agents this repo.");
+    }
+    const criticalOrHighRisks = options.riskFindings.filter((finding) => finding.severity === "critical" || finding.severity === "high");
+    if (criticalOrHighRisks.length > 0) {
+        warnings.push(`${criticalOrHighRisks.length} high-risk provider/environment hint(s) were detected; review risk findings before creating mandates.`);
+    }
     return [...new Set(warnings)];
 }
+export function buildRiskFindings(options) {
+    const findings = [];
+    const acceptedBypassIds = new Set(options.bypassFindings
+        .filter((finding) => finding.status === "accepted")
+        .map((finding) => finding.id));
+    for (const file of options.envFiles) {
+        for (const envKey of file.envKeys) {
+            const provider = providerFromEnvName(envKey);
+            if (looksProductionLikeEnvName(envKey)) {
+                findings.push({
+                    id: `env:${file.path}:${envKey}:prod`,
+                    kind: "prod_env_hint",
+                    severity: "high",
+                    provider,
+                    source: {
+                        kind: "env-file",
+                        path: file.path
+                    },
+                    evidence: [envKey],
+                    reason: "This env name looks production/live-scoped; agents should not receive it through a default non-prod mandate.",
+                    nextActions: [
+                        "Use a non-prod/test token alias for setup.",
+                        "Create an explicit production mandate only if this access is intentional."
+                    ]
+                });
+            }
+            if (isSecretLikeName(envKey)) {
+                findings.push({
+                    id: `env:${file.path}:${envKey}:secret`,
+                    kind: "secret_env_hint",
+                    severity: "medium",
+                    provider,
+                    source: {
+                        kind: "env-file",
+                        path: file.path
+                    },
+                    evidence: [envKey],
+                    reason: "This env name looks secret-like; agents should receive it only through an intentional profile secretRef.",
+                    nextActions: [
+                        "Review whether this value belongs in an agent profile.",
+                        "Store agent-needed values with switchboard secrets set <ref> --value-stdin."
+                    ]
+                });
+            }
+            if (provider === "stripe" && looksStripeLiveOrAmbiguousKey(envKey)) {
+                findings.push({
+                    id: `env:${file.path}:${envKey}:stripe-live`,
+                    kind: "live_payment_key_hint",
+                    severity: looksProductionLikeEnvName(envKey) ? "critical" : "high",
+                    provider,
+                    source: {
+                        kind: "env-file",
+                        path: file.path
+                    },
+                    evidence: [envKey],
+                    reason: "This Stripe env name is live-looking or mode-ambiguous; stripe-test should use an explicit test-mode secretRef.",
+                    nextActions: [
+                        "switchboard setup stripe-test",
+                        "Store a test-mode Stripe key in the suggested local secretRef."
+                    ]
+                });
+            }
+            if (provider === "supabase" && /SERVICE[_-]?ROLE|ADMIN|ROOT/i.test(envKey)) {
+                findings.push({
+                    id: `env:${file.path}:${envKey}:database-write`,
+                    kind: "database_write_surface",
+                    severity: "critical",
+                    provider,
+                    source: {
+                        kind: "env-file",
+                        path: file.path
+                    },
+                    evidence: [envKey],
+                    reason: "This Supabase env name looks admin/write-capable; future database mandates should not mount it by default.",
+                    nextActions: [
+                        "Prefer anon/read-only/dev credentials for agent setup.",
+                        "Defer production database writes to an explicit approval-gated mandate."
+                    ]
+                });
+            }
+        }
+    }
+    for (const client of options.clients) {
+        for (const server of client.servers) {
+            if (server.routesThroughSwitchboard) {
+                continue;
+            }
+            if (acceptedBypassIds.has(`${client.client}:${server.name}`)) {
+                continue;
+            }
+            const adminEvidence = [
+                ...server.envKeys.filter((key) => /ADMIN|ROOT|SERVICE[_-]?ROLE/i.test(key)),
+                ...server.args.filter((arg) => /--tools=all|admin|service[_-]?role/i.test(arg))
+            ];
+            if (adminEvidence.length === 0) {
+                continue;
+            }
+            findings.push({
+                id: `client:${client.client}:${server.name}:provider-admin`,
+                kind: "provider_admin_surface",
+                severity: "high",
+                provider: server.provider,
+                source: {
+                    kind: "client-config",
+                    path: client.targetPath,
+                    detail: server.name
+                },
+                evidence: [...new Set(adminEvidence)],
+                reason: "This direct MCP server appears to expose broad provider/admin capability outside Switchboard policy.",
+                nextActions: [
+                    "switchboard import --dry-run",
+                    "switchboard import --write --cleanup-client"
+                ]
+            });
+        }
+    }
+    const providerRoutes = new Map();
+    for (const client of options.clients) {
+        for (const server of client.servers) {
+            if (server.routesThroughSwitchboard || server.provider === "unknown") {
+                continue;
+            }
+            const routes = providerRoutes.get(server.provider) ?? [];
+            routes.push({ client: client.client, server: server.name });
+            providerRoutes.set(server.provider, routes);
+        }
+    }
+    for (const [provider, routes] of providerRoutes) {
+        if (routes.length < 2) {
+            continue;
+        }
+        findings.push({
+            id: `client:${provider}:duplicate-direct-route`,
+            kind: "duplicate_provider_route",
+            severity: "medium",
+            provider: provider,
+            source: {
+                kind: "client-config",
+                path: routes.map((route) => `${route.client}:${route.server}`).join(", ")
+            },
+            evidence: routes.map((route) => `${route.client}:${route.server}`),
+            reason: "Multiple direct MCP routes expose the same provider outside one repo-scoped Switchboard authority path.",
+            nextActions: [
+                "switchboard import --dry-run",
+                "switchboard import --write --cleanup-client"
+            ]
+        });
+    }
+    return dedupeRiskFindings(findings);
+}
+function dedupeRiskFindings(findings) {
+    const seen = new Set();
+    return findings.filter((finding) => {
+        if (seen.has(finding.id)) {
+            return false;
+        }
+        seen.add(finding.id);
+        return true;
+    });
+}
+export function buildBypassFindings(options) {
+    const hasSwitchboardClientRoute = options.clients.some((client) => client.servers.some((server) => server.routesThroughSwitchboard));
+    const home = options.homeDir ?? homedir();
+    return options.clients.flatMap((client) => client.servers
+        .filter((server) => !server.routesThroughSwitchboard)
+        .map((server) => {
+        const riskTags = ["direct-mcp-server"];
+        const reasons = [
+            `${client.client} server "${server.name}" can give agents tools without Switchboard mandate policy, leases, approvals, or audit.`
+        ];
+        if (hasSwitchboardClientRoute) {
+            riskTags.push("switchboard-coexists");
+            reasons.push("This direct MCP route coexists with a Switchboard client route, so agents can bypass the intended control plane.");
+        }
+        if (providerOverlapsSwitchboard(server, options.switchboardProfiles)) {
+            riskTags.push("provider-overlap");
+            reasons.push(`This server appears to overlap a configured Switchboard ${server.provider} profile.`);
+        }
+        if (server.envKeys.some((key) => isSecretLikeName(key))) {
+            riskTags.push("secret-env-name");
+            reasons.push("The server references secret-looking env names; Switchboard should keep values behind local secretRefs.");
+        }
+        if (server.args.some((arg) => arg.includes("[redacted]"))) {
+            riskTags.push("token-like-arg");
+            reasons.push("The server command args include token-like material; values were redacted from output.");
+        }
+        if (looksLikeBroadFilesystemMount(server, options.cwd, home)) {
+            riskTags.push("broad-filesystem-mount");
+            reasons.push("The server appears to mount a broad filesystem path such as /, $HOME, or the repo parent.");
+        }
+        const severity = riskTags.includes("broad-filesystem-mount")
+            ? "critical"
+            : riskTags.some((tag) => ["provider-overlap", "secret-env-name", "token-like-arg"].includes(tag))
+                ? "high"
+                : "medium";
+        const id = `${client.client}:${server.name}`;
+        const accepted = options.acceptedDirect?.has(id) ?? false;
+        return {
+            id,
+            status: accepted ? "accepted" : "unaccepted",
+            severity,
+            client: client.client,
+            targetPath: client.targetPath,
+            serverName: server.name,
+            provider: server.provider,
+            command: server.command,
+            args: server.args,
+            envKeys: server.envKeys,
+            suggestedProfileName: server.suggestedProfileName,
+            riskTags: [...new Set(riskTags)],
+            reasons,
+            nextActions: [
+                "switchboard import --dry-run",
+                server.suggestedSecretRefs.length > 0
+                    ? `switchboard secrets set ${server.suggestedSecretRefs[0]?.ref ?? "<ref>"} --value-stdin`
+                    : `switchboard import --write`
+            ],
+            acceptedRiskGuidance: accepted
+                ? "This direct route is marked as accepted risk; it remains visible and prevents controlled authority status."
+                : `If this direct route is intentional, rerun with --accept-direct ${id} to preserve it as accepted risk.`
+        };
+    }));
+}
+function collectAcceptedDirectRiskIds(options) {
+    return new Set([...options.configured, ...options.requested]
+        .map((value) => value.trim())
+        .filter((value) => /^[a-z]+:[^:\s]+$/.test(value)));
+}
+function providerOverlapsSwitchboard(server, profiles) {
+    if (server.provider === "unknown") {
+        return false;
+    }
+    return profiles.some((profile) => {
+        const provider = profile.provider?.toLowerCase();
+        return (provider === server.provider ||
+            profile.name.toLowerCase().includes(server.provider) ||
+            (profile.namespace?.toLowerCase().includes(server.provider) ?? false));
+    });
+}
+function looksLikeBroadFilesystemMount(server, cwd, homeDir) {
+    const joined = [server.name, server.command ?? "", ...server.args].join(" ");
+    if (!/filesystem|file-system|fs|desktop-commander/i.test(joined)) {
+        return false;
+    }
+    const repoParent = dirname(resolve(cwd));
+    return server.args.some((arg) => {
+        const normalized = arg.replace(/^['"]|['"]$/g, "");
+        return (normalized === "/" ||
+            normalized === homeDir ||
+            normalized === "$HOME" ||
+            normalized === "~" ||
+            normalized === repoParent);
+    });
+}
+function buildClientCleanupPlan(clients, acceptedDirect) {
+    return clients.map((client) => {
+        const affectedServerNames = client.servers
+            .filter((server) => !server.routesThroughSwitchboard &&
+            !acceptedDirect.has(`${client.client}:${server.name}`))
+            .map((server) => server.name);
+        const acceptedServerNames = client.servers
+            .filter((server) => !server.routesThroughSwitchboard &&
+            acceptedDirect.has(`${client.client}:${server.name}`))
+            .map((server) => server.name);
+        const acceptedRiskGuidance = acceptedServerNames.length > 0
+            ? `Accepted direct route(s) preserved: ${acceptedServerNames.join(", ")}. They remain visible and keep authority status at partial-control.`
+            : affectedServerNames.length > 0
+                ? `If any direct route is intentional, rerun with --accept-direct <client:server> to preserve it as accepted risk.`
+                : "No direct MCP routes need accepted-risk handling.";
+        if (client.status === "missing") {
+            return {
+                client: client.client,
+                targetPath: client.targetPath,
+                status: "missing",
+                affectedServerNames: [],
+                rollbackCommand: null,
+                acceptedRiskGuidance
+            };
+        }
+        if (client.status === "invalid") {
+            return {
+                client: client.client,
+                targetPath: client.targetPath,
+                status: "invalid",
+                affectedServerNames: [],
+                rollbackCommand: null,
+                acceptedRiskGuidance
+            };
+        }
+        return {
+            client: client.client,
+            targetPath: client.targetPath,
+            status: affectedServerNames.length > 0 ? "planned" : "noop",
+            affectedServerNames,
+            rollbackCommand: affectedServerNames.length > 0
+                ? `cp <backupPath> ${shellQuotePath(client.targetPath)}`
+                : null,
+            acceptedRiskGuidance
+        };
+    });
+}
+async function writeClientCleanupPlan(plan, now) {
+    const results = [];
+    for (const item of plan.cleanupPlan) {
+        if (item.status !== "planned") {
+            results.push({
+                client: item.client,
+                targetPath: item.targetPath,
+                status: item.status,
+                backupPath: null,
+                affectedServerNames: item.affectedServerNames,
+                rollbackCommand: item.rollbackCommand,
+                acceptedRiskGuidance: item.acceptedRiskGuidance
+            });
+            continue;
+        }
+        const existing = await readOptionalTextFileAsync(item.targetPath);
+        if (existing === null) {
+            results.push({
+                client: item.client,
+                targetPath: item.targetPath,
+                status: "missing",
+                backupPath: null,
+                affectedServerNames: [],
+                rollbackCommand: null,
+                acceptedRiskGuidance: item.acceptedRiskGuidance
+            });
+            continue;
+        }
+        const nextContent = item.client === "claude"
+            ? removeClaudeMcpServers(existing, item.affectedServerNames)
+            : removeCodexMcpServers(existing, item.affectedServerNames);
+        if (nextContent === existing) {
+            results.push({
+                client: item.client,
+                targetPath: item.targetPath,
+                status: "noop",
+                backupPath: null,
+                affectedServerNames: [],
+                rollbackCommand: null,
+                acceptedRiskGuidance: item.acceptedRiskGuidance
+            });
+            continue;
+        }
+        const backupPath = await backupExistingFile(item.targetPath, now);
+        await writeFile(item.targetPath, nextContent, "utf8");
+        results.push({
+            client: item.client,
+            targetPath: item.targetPath,
+            status: "updated",
+            backupPath,
+            affectedServerNames: item.affectedServerNames,
+            rollbackCommand: `cp ${shellQuotePath(backupPath)} ${shellQuotePath(item.targetPath)}`,
+            acceptedRiskGuidance: item.acceptedRiskGuidance
+        });
+    }
+    return results;
+}
+function removeClaudeMcpServers(content, serverNames) {
+    const parsed = JSON.parse(content);
+    const mcpServers = isRecord(parsed.mcpServers) ? parsed.mcpServers : {};
+    for (const serverName of serverNames) {
+        delete mcpServers[serverName];
+    }
+    return `${JSON.stringify({
+        ...parsed,
+        mcpServers
+    }, null, 2)}\n`;
+}
+function removeCodexMcpServers(content, serverNames) {
+    const remove = new Set(serverNames);
+    const lines = content.split(/\r?\n/);
+    const kept = [];
+    let removing = false;
+    for (const line of lines) {
+        const serverHeader = line.match(/^\s*\[mcp_servers\.([^\].]+)\]\s*$/);
+        const envHeader = line.match(/^\s*\[mcp_servers\.([^\].]+)\.env\]\s*$/);
+        const headerName = serverHeader?.[1] ?? envHeader?.[1];
+        if (headerName) {
+            removing = remove.has(unquoteTomlKey(headerName));
+        }
+        else if (/^\s*\[/.test(line)) {
+            removing = false;
+        }
+        if (!removing) {
+            kept.push(line);
+        }
+    }
+    return `${kept.join("\n").replace(/\n{3,}/g, "\n\n").replace(/\n*$/, "")}\n`;
+}
+function shellQuotePath(value) {
+    return `'${value.replaceAll("'", "'\\''")}'`;
+}
 function codexServerSections(content) {
     const sections = [];
     let current = null;
@@ -606,6 +1187,14 @@ function secretRefLeaf(envName) {
 function isSecretLikeName(name) {
     return /(SECRET|TOKEN|KEY|PASSWORD|PRIVATE)/i.test(name);
 }
+function looksProductionLikeEnvName(name) {
+    return /(^|[_\-.])(PROD|PRODUCTION|LIVE)([_\-.]|$)/i.test(name);
+}
+function looksStripeLiveOrAmbiguousKey(name) {
+    return (/(^|[_\-.])(LIVE|PROD|PRODUCTION)([_\-.]|$)/i.test(name) ||
+        /^STRIPE_(SECRET_)?KEY$/i.test(name) ||
+        /^STRIPE_SECRET_KEY$/i.test(name));
+}
 function redactSecretLikeArgs(args) {
     return args.map((arg) => arg
         .replace(/\b([A-Za-z_][A-Za-z0-9_]*(?:SECRET|TOKEN|KEY|PASSWORD|PRIVATE)[A-Za-z0-9_]*)=([^\s]+)/gi, "$1=[redacted]")