@synapsor/runner 1.6.4 → 1.6.5

package/dist/runner.mjs

@@ -22743,7 +22743,7 @@ var require_svgPath = __commonJS({
       ["Z", 0],
       ["z", 0]
     ]);
-    var parse = function(path30) {
+    var parse2 = function(path30) {
       var cmd;
       var ret = [];
       var args = [];
@@ -23065,7 +23065,7 @@ var require_svgPath = __commonJS({
       return result;
     };
     exports.svgPathToOperators = function(path30) {
-      return apply2(parse(path30));
+      return apply2(parse2(path30));
     };
   }
 });
@@ -50839,15 +50839,16 @@ import path16 from "node:path";
 init_src();
 init_src2();
 
-// apps/runner/src/cursor-project.ts
+// apps/runner/src/managed-mcp-project.ts
 import crypto7 from "node:crypto";
 import fs3 from "node:fs/promises";
 import path3 from "node:path";
+import { applyEdits, modify, parse, printParseErrorCode } from "jsonc-parser";
 
 // apps/runner/package.json
 var package_default = {
   name: "@synapsor/runner",
-  version: "1.6.4",
+  version: "1.6.5",
   description: "Open-source MCP runtime for governed Postgres/MySQL access with reviewed capabilities, proposals, guarded writes, receipts, and replay.",
   license: "Apache-2.0",
   type: "module",
@@ -50949,6 +50950,7 @@ var package_default = {
     "@modelcontextprotocol/sdk": "1.29.0",
     "@synapsor/spec": "workspace:^1.7.0",
     jose: "6.2.3",
+    "jsonc-parser": "3.3.1",
     mysql2: "^3.11.0",
     "pdf-lib": "1.17.1",
     pg: "^8.13.0",
@@ -50976,61 +50978,102 @@ var package_default = {
   }
 };
 
-// apps/runner/src/cursor-project.ts
-var markerVersion = "synapsor.cursor-project.v1";
+// apps/runner/src/managed-mcp-project.ts
 var serverName = "synapsor";
-async function previewCursorProjectInstall(input = {}) {
-  const paths = await resolveInstallPaths(input);
-  const existing = await readOptionalJson(paths.destination);
-  const marker = await readMarker(paths.marker);
-  const entry = cursorEntry(paths.configArgument, paths.storeArgument, input.packageSpec, input.authoring === true);
-  assertSecretFree(entry);
-  if (existing?.mcpServers !== void 0 && !isRecord7(existing.mcpServers)) {
-    throw new Error(`${displayPath(paths.projectRoot, paths.destination)} must contain an object at mcpServers.`);
-  }
-  const existingServers = isRecord7(existing?.mcpServers) ? existing.mcpServers : {};
+var managedClients = {
+  cursor: {
+    client: "cursor",
+    displayName: "Cursor",
+    destination: ".cursor/mcp.json",
+    marker: ".synapsor/cursor-project.json",
+    markerVersion: "synapsor.cursor-project.v1",
+    serversKey: "mcpServers",
+    reloadInstruction: "Restart or reload Cursor"
+  },
+  "claude-code": {
+    client: "claude-code",
+    displayName: "Claude Code",
+    destination: ".mcp.json",
+    marker: ".synapsor/claude-code-project.json",
+    markerVersion: "synapsor.claude-code-project.v1",
+    serversKey: "mcpServers",
+    reloadInstruction: "Restart Claude Code or begin a new project session, then approve the project MCP server when Claude Code prompts"
+  },
+  vscode: {
+    client: "vscode",
+    displayName: "VS Code",
+    destination: ".vscode/mcp.json",
+    marker: ".synapsor/vscode-project.json",
+    markerVersion: "synapsor.vscode-project.v1",
+    serversKey: "servers",
+    reloadInstruction: "Reload the VS Code window and start the Synapsor MCP server"
+  }
+};
+function parseManagedMcpProjectClient(value) {
+  if (value === "cursor") return "cursor";
+  if (value === "claude-code" || value === "claude") return "claude-code";
+  if (value === "vscode" || value === "vs-code") return "vscode";
+  throw new Error("managed MCP project client must be cursor, claude-code, or vscode");
+}
+function managedMcpProjectDefinition(client) {
+  return managedClients[client];
+}
+async function previewManagedMcpProjectInstall(input) {
+  const definition = managedClients[input.client];
+  const paths = await resolveInstallPaths(input, definition);
+  const existing = await readOptionalJsonDocument(paths.destination);
+  const marker = await readMarker(paths.marker, definition);
+  const entry = managedEntry(paths.configArgument, paths.storeArgument, input.packageSpec, input.authoring === true);
+  assertSecretFree(entry, definition);
+  const existingServersValue = existing?.value[definition.serversKey];
+  if (existingServersValue !== void 0 && !isRecord7(existingServersValue)) {
+    throw new Error(`${displayPath(paths.projectRoot, paths.destination)} must contain an object at ${definition.serversKey}.`);
+  }
+  const existingServers = isRecord7(existingServersValue) ? existingServersValue : {};
   const existingEntry = isRecord7(existingServers[serverName]) ? existingServers[serverName] : void 0;
   if (marker && !existingEntry) {
-    throw new Error(`Runner ownership marker exists, but the Cursor ${serverName} MCP entry is missing. Review the files manually.`);
+    throw new Error(`Runner ownership marker exists, but the ${definition.displayName} ${serverName} MCP entry is missing. Review the files manually.`);
   }
   if (existingEntry && !marker) {
     if (!deepEqual(existingEntry, entry)) {
-      throw new Error(`Cursor project already has an unowned ${serverName} MCP entry at ${displayPath(paths.projectRoot, paths.destination)}. Rename it or remove it explicitly before installing.`);
+      throw new Error(`${definition.displayName} project already has an unowned ${serverName} MCP entry at ${displayPath(paths.projectRoot, paths.destination)}. Rename it or remove it explicitly before installing.`);
     }
-    throw new Error(`Cursor project has a matching but unowned ${serverName} MCP entry. Remove it explicitly or restore ${displayPath(paths.projectRoot, paths.marker)} before Runner manages it.`);
+    throw new Error(`${definition.displayName} project has a matching but unowned ${serverName} MCP entry. Remove it explicitly or restore ${displayPath(paths.projectRoot, paths.marker)} before Runner manages it.`);
   }
   if (existingEntry && marker && digest3(existingEntry) !== marker.entry_digest) {
-    throw new Error(`Cursor ${serverName} MCP entry changed after Runner installed it. Refusing to overwrite user edits; review ${displayPath(paths.projectRoot, paths.destination)}.`);
+    throw new Error(`${definition.displayName} ${serverName} MCP entry changed after Runner installed it. Refusing to overwrite user edits; review ${displayPath(paths.projectRoot, paths.destination)}.`);
   }
   const merged = {
-    ...existing ?? {},
-    mcpServers: { ...existingServers, [serverName]: entry }
+    ...existing?.value ?? {},
+    [definition.serversKey]: { ...existingServers, [serverName]: entry }
   };
   const unchanged = Boolean(existingEntry && marker && deepEqual(existingEntry, entry));
   return {
     state: unchanged ? "installed" : existingEntry ? "installed" : "not_installed",
     paths,
     entry,
-    message: unchanged ? "Cursor project MCP entry already matches the reviewed Runner wiring." : "Cursor project MCP entry is ready to install.",
+    message: unchanged ? `${definition.displayName} project MCP entry already matches the reviewed Runner wiring.` : `${definition.displayName} project MCP entry is ready to install.`,
     action: unchanged ? "unchanged" : existingEntry ? "update" : "install",
-    merged
+    merged,
+    updatedDocument: setManagedEntry(existing?.text, definition, entry)
   };
 }
-async function installCursorProject(input = {}) {
-  const preview = await previewCursorProjectInstall(input);
+async function installManagedMcpProject(input) {
+  const definition = managedClients[input.client];
+  const preview = await previewManagedMcpProjectInstall(input);
   if (preview.action === "unchanged") return preview;
   const hadDestination = await pathExists(preview.paths.destination);
   const backup = hadDestination ? await backupFile(preview.paths.destination, input.now) : void 0;
   const marker = {
-    schema_version: markerVersion,
+    schema_version: definition.markerVersion,
     server_name: serverName,
-    destination: ".cursor/mcp.json",
+    destination: definition.destination,
     entry_digest: digest3(preview.entry),
     config_path: preview.paths.configArgument,
     store_path: preview.paths.storeArgument,
     installed_at: input.now ?? (/* @__PURE__ */ new Date()).toISOString()
   };
-  await writeJsonAtomic(preview.paths.destination, preview.merged);
+  await writeTextAtomic(preview.paths.destination, preview.updatedDocument);
   try {
     await writeJsonAtomic(preview.paths.marker, marker);
   } catch (error) {
@@ -51040,49 +51083,76 @@ async function installCursorProject(input = {}) {
   }
   return { ...preview, state: "installed", ...backup ? { backup } : {} };
 }
-async function uninstallCursorProject(input = {}) {
-  const base = await resolveBasePaths(input.projectRoot);
-  const existing = await readOptionalJson(base.destination);
-  const marker = await readMarker(base.marker);
-  const paths = marker ? await pathsFromMarker(base, marker) : defaultPaths(base);
+async function uninstallManagedMcpProject(input) {
+  const definition = managedClients[input.client];
+  const base = await resolveBasePaths(input.projectRoot, definition);
+  const existing = await readOptionalJsonDocument(base.destination);
+  const marker = await readMarker(base.marker, definition);
+  const paths = marker ? await pathsFromMarker(base, marker, definition) : defaultPaths(base);
   if (!existing && !marker) return { changed: false, paths };
-  if (!marker) throw new Error(`Refusing to uninstall an unowned Cursor ${serverName} entry without ${displayPath(paths.projectRoot, paths.marker)}.`);
-  if (existing?.mcpServers !== void 0 && !isRecord7(existing.mcpServers)) {
-    throw new Error(`${displayPath(paths.projectRoot, paths.destination)} must contain an object at mcpServers.`);
+  if (!marker) {
+    throw new Error(`Refusing to uninstall an unowned ${definition.displayName} ${serverName} entry without ${displayPath(paths.projectRoot, paths.marker)}.`);
+  }
+  const serversValue = existing?.value[definition.serversKey];
+  if (serversValue !== void 0 && !isRecord7(serversValue)) {
+    throw new Error(`${displayPath(paths.projectRoot, paths.destination)} must contain an object at ${definition.serversKey}.`);
   }
-  const servers = isRecord7(existing?.mcpServers) ? existing.mcpServers : {};
+  const servers = isRecord7(serversValue) ? serversValue : {};
   const entry = isRecord7(servers[serverName]) ? servers[serverName] : void 0;
-  if (!entry) throw new Error(`Runner ownership marker exists, but Cursor ${serverName} entry is missing. Review the files manually.`);
+  if (!entry) {
+    throw new Error(`Runner ownership marker exists, but ${definition.displayName} ${serverName} entry is missing. Review the files manually.`);
+  }
   if (digest3(entry) !== marker.entry_digest) {
-    throw new Error(`Cursor ${serverName} entry changed after installation. Refusing to remove user edits.`);
+    throw new Error(`${definition.displayName} ${serverName} entry changed after installation. Refusing to remove user edits.`);
   }
-  const remainingServers = { ...servers };
-  delete remainingServers[serverName];
-  const updated = { ...existing, mcpServers: remainingServers };
   const backup = await backupFile(paths.destination, input.now);
-  await writeJsonAtomic(paths.destination, updated);
+  const updatedDocument = removeManagedEntry(existing?.text ?? "{}\n", definition);
+  await writeTextAtomic(paths.destination, updatedDocument);
   await fs3.rm(paths.marker, { force: true });
   return { changed: true, paths, backup };
 }
-async function cursorProjectStatus(projectRoot = process.cwd()) {
-  const base = await resolveBasePaths(projectRoot);
-  const existing = await readOptionalJson(base.destination);
-  const marker = await readMarker(base.marker);
-  const paths = marker ? await pathsFromMarker(base, marker) : defaultPaths(base);
-  if (existing?.mcpServers !== void 0 && !isRecord7(existing.mcpServers)) {
-    return { state: "tampered", paths, message: "Cursor mcpServers is not a JSON object." };
-  }
-  const servers = isRecord7(existing?.mcpServers) ? existing.mcpServers : {};
+async function managedMcpProjectStatus(client, projectRoot = process.cwd()) {
+  const definition = managedClients[client];
+  const base = await resolveBasePaths(projectRoot, definition);
+  const existing = await readOptionalJsonDocument(base.destination);
+  const marker = await readMarker(base.marker, definition);
+  const paths = marker ? await pathsFromMarker(base, marker, definition) : defaultPaths(base);
+  const serversValue = existing?.value[definition.serversKey];
+  if (serversValue !== void 0 && !isRecord7(serversValue)) {
+    return { state: "tampered", paths, message: `${definition.displayName} ${definition.serversKey} is not a JSON object.` };
+  }
+  const servers = isRecord7(serversValue) ? serversValue : {};
   const entry = isRecord7(servers[serverName]) ? servers[serverName] : void 0;
-  if (!entry && !marker) return { state: "not_installed", paths, message: "No Runner-owned Cursor project entry is installed." };
-  if (!entry || !marker) return { state: "unowned", paths, ...entry ? { entry } : {}, message: "Cursor entry and Runner ownership marker do not agree." };
-  if (digest3(entry) !== marker.entry_digest) return { state: "tampered", paths, entry, message: "Cursor entry changed after Runner installation." };
-  return { state: "installed", paths, entry, message: "Runner-owned Cursor project entry is intact." };
-}
-async function resolveInstallPaths(input) {
-  const base = await resolveBasePaths(input.projectRoot);
-  const config = resolveContained(base.projectRoot, input.configPath ?? "./synapsor.runner.json", "Runner config");
-  const store = resolveContained(base.projectRoot, input.storePath ?? "./.synapsor/local.db", "Runner store");
+  if (!entry && !marker) {
+    return { state: "not_installed", paths, message: `No Runner-owned ${definition.displayName} project entry is installed.` };
+  }
+  if (!entry || !marker) {
+    return {
+      state: "unowned",
+      paths,
+      ...entry ? { entry } : {},
+      message: `${definition.displayName} entry and Runner ownership marker do not agree.`
+    };
+  }
+  if (digest3(entry) !== marker.entry_digest) {
+    return {
+      state: "tampered",
+      paths,
+      entry,
+      message: `${definition.displayName} entry changed after Runner installation.`
+    };
+  }
+  return {
+    state: "installed",
+    paths,
+    entry,
+    message: `Runner-owned ${definition.displayName} project entry is intact.`
+  };
+}
+async function resolveInstallPaths(input, definition) {
+  const base = await resolveBasePaths(input.projectRoot, definition);
+  const config = resolveContained(base.projectRoot, input.configPath ?? "./synapsor.runner.json", "Runner config", definition);
+  const store = resolveContained(base.projectRoot, input.storePath ?? "./.synapsor/local.db", "Runner store", definition);
   await rejectSymlinkChain(base.projectRoot, config, "Runner config");
   await rejectSymlinkChain(base.projectRoot, store, "Runner store");
   if (!input.authoring) await requireRegularFile(config, "Runner config");
@@ -51092,14 +51162,14 @@ async function resolveInstallPaths(input) {
     storeArgument: projectArgument(base.projectRoot, store)
   };
 }
-async function resolveBasePaths(projectRootInput) {
+async function resolveBasePaths(projectRootInput, definition) {
   const projectRoot = path3.resolve(projectRootInput ?? process.cwd());
-  await requireRealDirectory(projectRoot, "Cursor project root");
-  const destination = path3.join(projectRoot, ".cursor/mcp.json");
-  const marker = path3.join(projectRoot, ".synapsor/cursor-project.json");
-  await rejectSymlinkChain(projectRoot, destination, "Cursor project config");
-  await rejectSymlinkChain(projectRoot, marker, "Cursor ownership marker");
-  return { projectRoot, destination, marker };
+  await requireRealDirectory(projectRoot, `${definition.displayName} project root`);
+  const destination = path3.join(projectRoot, definition.destination);
+  const marker = path3.join(projectRoot, definition.marker);
+  await rejectSymlinkChain(projectRoot, destination, `${definition.displayName} project config`);
+  await rejectSymlinkChain(projectRoot, marker, `${definition.displayName} ownership marker`);
+  return { client: definition.client, projectRoot, destination, marker };
 }
 function defaultPaths(base) {
   return {
@@ -51108,9 +51178,9 @@ function defaultPaths(base) {
     storeArgument: "./.synapsor/local.db"
   };
 }
-async function pathsFromMarker(base, marker) {
-  const config = resolveContained(base.projectRoot, marker.config_path, "Recorded Runner config");
-  const store = resolveContained(base.projectRoot, marker.store_path, "Recorded Runner store");
+async function pathsFromMarker(base, marker, definition) {
+  const config = resolveContained(base.projectRoot, marker.config_path, "Recorded Runner config", definition);
+  const store = resolveContained(base.projectRoot, marker.store_path, "Recorded Runner store", definition);
   await rejectSymlinkChain(base.projectRoot, config, "Recorded Runner config");
   await rejectSymlinkChain(base.projectRoot, store, "Recorded Runner store");
   return {
@@ -51119,10 +51189,10 @@ async function pathsFromMarker(base, marker) {
     storeArgument: projectArgument(base.projectRoot, store)
   };
 }
-function cursorEntry(configPath, storePath, packageSpec, authoring) {
+function managedEntry(configPath, storePath, packageSpec, authoring) {
   const resolvedPackage = packageSpec ?? `@synapsor/runner@${package_default.version}`;
   if (!resolvedPackage.trim() || resolvedPackage.length > 2048 || /[\u0000-\u001f\u007f]/.test(resolvedPackage)) {
-    throw new Error("Cursor Runner package spec must be a non-empty package reference without control characters");
+    throw new Error("Runner package spec must be a non-empty package reference without control characters");
   }
   return {
     type: "stdio",
@@ -51130,11 +51200,24 @@ function cursorEntry(configPath, storePath, packageSpec, authoring) {
     args: authoring ? ["-y", resolvedPackage, "mcp", "serve", "--authoring", "--project-root", "."] : ["-y", resolvedPackage, "mcp", "serve", "--config", configPath, "--store", storePath]
   };
 }
-function resolveContained(root, value, label) {
+function setManagedEntry(existingText, definition, entry) {
+  const source = existingText ?? "{}\n";
+  const edits = modify(source, [definition.serversKey, serverName], entry, {
+    formattingOptions: { insertSpaces: true, tabSize: 2, eol: "\n" }
+  });
+  return finalNewline(applyEdits(source, edits));
+}
+function removeManagedEntry(existingText, definition) {
+  const edits = modify(existingText, [definition.serversKey, serverName], void 0, {
+    formattingOptions: { insertSpaces: true, tabSize: 2, eol: "\n" }
+  });
+  return finalNewline(applyEdits(existingText, edits));
+}
+function resolveContained(root, value, label, definition) {
   const resolved = path3.resolve(root, value);
   const relative2 = path3.relative(root, resolved);
   if (relative2 === "" || !relative2.startsWith("..") && !path3.isAbsolute(relative2)) return resolved;
-  throw new Error(`${label} must stay inside the project for project-scoped Cursor installation: ${value}`);
+  throw new Error(`${label} must stay inside the project for project-scoped ${definition.displayName} installation: ${value}`);
 }
 function projectArgument(root, value) {
   const relative2 = path3.relative(root, value).split(path3.sep).join("/");
@@ -51162,26 +51245,33 @@ async function rejectSymlinkChain(root, value, label) {
     }
   }
 }
-async function readOptionalJson(value) {
+async function readOptionalJsonDocument(value) {
   try {
-    const parsed = JSON.parse(await fs3.readFile(value, "utf8"));
+    const text = await fs3.readFile(value, "utf8");
+    const errors = [];
+    const parsed = parse(text, errors, { allowTrailingComma: true, disallowComments: false });
+    if (errors.length > 0) {
+      const first = errors[0];
+      throw new Error(`${value} contains invalid JSON/JSONC at offset ${first.offset}: ${printParseErrorCode(first.error)}`);
+    }
     if (!isRecord7(parsed)) throw new Error(`${value} must contain a JSON object`);
-    return parsed;
+    return { value: parsed, text };
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw error;
   }
 }
-async function readMarker(value) {
-  const parsed = await readOptionalJson(value);
+async function readMarker(value, definition) {
+  const document2 = await readOptionalJsonDocument(value);
+  const parsed = document2?.value;
   if (!parsed) return void 0;
-  if (parsed.schema_version !== markerVersion || parsed.server_name !== serverName || parsed.destination !== ".cursor/mcp.json" || typeof parsed.entry_digest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(parsed.entry_digest) || typeof parsed.config_path !== "string" || typeof parsed.store_path !== "string" || typeof parsed.installed_at !== "string") {
-    throw new Error(`Invalid Cursor ownership marker: ${value}`);
+  if (parsed.schema_version !== definition.markerVersion || parsed.server_name !== serverName || parsed.destination !== definition.destination || typeof parsed.entry_digest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(parsed.entry_digest) || typeof parsed.config_path !== "string" || typeof parsed.store_path !== "string" || typeof parsed.installed_at !== "string") {
+    throw new Error(`Invalid ${definition.displayName} ownership marker: ${value}`);
   }
   return {
-    schema_version: markerVersion,
+    schema_version: definition.markerVersion,
     server_name: serverName,
-    destination: ".cursor/mcp.json",
+    destination: definition.destination,
     entry_digest: parsed.entry_digest,
     config_path: parsed.config_path,
     store_path: parsed.store_path,
@@ -51189,11 +51279,14 @@ async function readMarker(value) {
   };
 }
 async function writeJsonAtomic(destination, value) {
+  await writeTextAtomic(destination, `${JSON.stringify(value, null, 2)}
+`);
+}
+async function writeTextAtomic(destination, value) {
   await fs3.mkdir(path3.dirname(destination), { recursive: true });
   const temporary = `${destination}.tmp-${process.pid}-${crypto7.randomBytes(6).toString("hex")}`;
   try {
-    await fs3.writeFile(temporary, `${JSON.stringify(value, null, 2)}
-`, { encoding: "utf8", mode: 384 });
+    await fs3.writeFile(temporary, value, { encoding: "utf8", mode: 384 });
     await fs3.rename(temporary, destination);
   } finally {
     await fs3.rm(temporary, { force: true });
@@ -51218,10 +51311,10 @@ function stableJson(value) {
 function deepEqual(left, right) {
   return stableJson(left) === stableJson(right);
 }
-function assertSecretFree(value) {
+function assertSecretFree(value, definition) {
   const text = JSON.stringify(value);
   if (/postgres(?:ql)?:\/\/|mysql:\/\/|password|bearer\s+[a-z0-9._~+/=-]+|syn_wbr_|api[_-]?key/i.test(text)) {
-    throw new Error("Cursor MCP configuration must contain command paths only, never credentials or database URLs");
+    throw new Error(`${definition.displayName} MCP configuration must contain command paths only, never credentials or database URLs`);
   }
 }
 function displayPath(root, value) {
@@ -51236,10 +51329,19 @@ async function pathExists(value) {
     throw error;
   }
 }
+function finalNewline(value) {
+  return value.endsWith("\n") ? value : `${value}
+`;
+}
 function isRecord7(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 
+// apps/runner/src/cursor-project.ts
+function cursorProjectStatus(projectRoot = process.cwd()) {
+  return managedMcpProjectStatus("cursor", projectRoot);
+}
+
 // apps/runner/src/workbench-syntax.ts
 var synapsorDslKeywordValues = [
   "ABSOLUTE",
@@ -53296,12 +53398,12 @@ function renderBoundaryWorkbench(csrfToken) {
       }
     }
 
-	    function renderClientConfigs(){
-	      const command="npx -y @synapsor/runner mcp serve --authoring --project-root .";
-	      const config={mcpServers:{synapsor_authoring:{command:"npx",args:["-y","@synapsor/runner","mcp","serve","--authoring","--project-root","."]}}};
-	      const codex='[mcp_servers.synapsor_authoring]\\ncommand = "npx"\\nargs = '+JSON.stringify(config.mcpServers.synapsor_authoring.args);
-	      byId("client-configs").innerHTML='<p>All clients receive the same two local authoring tools and no approval or commit tool.</p><h3>Generic stdio MCP</h3><pre>'+esc(JSON.stringify(config,null,2))+'</pre><h3>Cursor project</h3><p>Save the same JSON as <code>.cursor/mcp.json</code>, or use the consent-gated installer.</p><pre>'+esc("synapsor-runner mcp install cursor --project --authoring --project-root . --yes")+'</pre><h3>Claude-compatible local MCP</h3><p>Use the same stdio server command in the client MCP configuration. No model API key is needed by Runner.</p><pre>'+esc(command)+'</pre><h3>Codex</h3><pre>'+esc(codex)+'</pre>';
-	    }
+		    function renderClientConfigs(){
+		      const command="npx -y @synapsor/runner mcp serve --authoring --project-root .";
+		      const config={mcpServers:{synapsor_authoring:{command:"npx",args:["-y","@synapsor/runner","mcp","serve","--authoring","--project-root","."]}}};
+		      const codex='[mcp_servers.synapsor_authoring]\\ncommand = "npx"\\nargs = '+JSON.stringify(config.mcpServers.synapsor_authoring.args);
+		      byId("client-configs").innerHTML='<p>Every path receives the same two local authoring tools and no approval or commit tool. Runner never puts database credentials in these files.</p><h3>Managed project installers</h3><p>Each command previews and owns only the <code>synapsor</code> entry, preserves other project settings, and creates a backup before editing an existing file.</p><pre>'+esc("synapsor-runner mcp install cursor --project --authoring --project-root . --yes\\nsynapsor-runner mcp install claude-code --project --authoring --project-root . --yes\\nsynapsor-runner mcp install vscode --project --authoring --project-root . --yes")+'</pre><h3>Generic stdio MCP</h3><pre>'+esc(JSON.stringify(config,null,2))+'</pre><h3>Direct server command</h3><p>Use this in another local MCP client. No model API key is needed by Runner.</p><pre>'+esc(command)+'</pre><h3>Codex</h3><pre>'+esc(codex)+'</pre>';
+		    }
 
     async function loadProtect(preferredRef=preferredProtectQueryRef){
       const status=byId("protect-message");
@@ -57485,7 +57587,7 @@ function protectedQueryTests(capability, plan, boundaryDigest) {
 async function writeDraftArtifacts(input) {
   await fs9.mkdir(input.outputRoot, { recursive: true, mode: 448 });
   const markerPath = path9.join(input.outputRoot, ".synapsor-protected-query.json");
-  const existing = await readOptionalJson2(markerPath);
+  const existing = await readOptionalJson(markerPath);
   if (existing && existing.schema_version !== PROTECTED_QUERY_VERSION) {
     throw new Error(`Refusing to overwrite unmanaged protected-query directory ${input.outputRoot}.`);
   }
@@ -57497,7 +57599,7 @@ async function writeDraftArtifacts(input) {
   await writeAtomic(markerPath, json3({ schema_version: PROTECTED_QUERY_VERSION, capability: input.draft.capability }), 384);
 }
 async function addProtectedContractToRuntimeConfig(input) {
-  const existing = await readOptionalJson2(input.configPath);
+  const existing = await readOptionalJson(input.configPath);
   const relativeContract = relativeConfigPath(path9.dirname(input.configPath), input.contractPath);
   const config = existing ?? {
     version: 1,
@@ -57710,7 +57812,7 @@ async function writeAtomic(filePath, content, mode) {
     throw error;
   }
 }
-async function readOptionalJson2(filePath) {
+async function readOptionalJson(filePath) {
   try {
     return JSON.parse(await fs9.readFile(filePath, "utf8"));
   } catch (error) {
@@ -58560,14 +58662,14 @@ async function guidedActionDraftDetails(projectRootInput, capabilityName2) {
 }
 async function guidedActionStatus(projectRootInput) {
   const projectRoot = path11.resolve(projectRootInput);
-  const index = await readOptionalJson3(path11.join(projectRoot, ".synapsor/guided-action-drafts.json"));
+  const index = await readOptionalJson2(path11.join(projectRoot, ".synapsor/guided-action-drafts.json"));
   const drafts = Array.isArray(index?.drafts) ? index.drafts.filter((item) => isRecord13(item) && item.schema_version === GUIDED_ACTION_VERSION && item.state === "disabled" && typeof item.capability === "string") : [];
   const activeRoot = path11.join(projectRoot, GUIDED_ACTION_ROOT, "active");
   const activations = [];
   try {
     for (const entry of await fs11.readdir(activeRoot, { withFileTypes: true })) {
       if (!entry.isFile() || !entry.name.endsWith(".active.json")) continue;
-      const parsed = await readOptionalJson3(path11.join(activeRoot, entry.name));
+      const parsed = await readOptionalJson2(path11.join(activeRoot, entry.name));
       if (parsed && parsed.schema_version === GUIDED_ACTION_VERSION && parsed.state === "active" && typeof parsed.capability === "string") {
         activations.push(parsed);
       }
@@ -58966,7 +59068,7 @@ function guidedActionReview(draft, action, resource) {
 }
 async function writeGuidedActionArtifacts(input) {
   const markerPath = path11.join(input.outputRoot, ".synapsor-guided-action.json");
-  const existing = await readOptionalJson3(markerPath);
+  const existing = await readOptionalJson2(markerPath);
   if (existing && (existing.schema_version !== GUIDED_ACTION_VERSION || existing.capability !== input.draft.capability)) {
     throw new Error(`GUIDED_ACTION_OUTPUT_UNMANAGED: refusing to overwrite ${input.outputRoot}.`);
   }
@@ -58981,7 +59083,7 @@ async function writeGuidedActionArtifacts(input) {
 }
 async function updateActionIndex(projectRoot, draft) {
   const indexPath = path11.join(projectRoot, ".synapsor/guided-action-drafts.json");
-  const existing = await readOptionalJson3(indexPath);
+  const existing = await readOptionalJson2(indexPath);
   if (existing && existing.schema_version !== "synapsor.guided-action-drafts.v1" && existing.schema_version !== GUIDED_ACTION_INDEX_VERSION) {
     throw new Error("GUIDED_ACTION_INDEX_UNMANAGED: refusing to replace an unknown action index.");
   }
@@ -59131,7 +59233,7 @@ function relativeConfigPath2(configDirectory, target2) {
   const relative2 = path11.relative(configDirectory, target2).replace(/\\/g, "/");
   return relative2 === "." || relative2.startsWith("./") || relative2.startsWith("../") ? relative2 : `./${relative2}`;
 }
-async function readOptionalJson3(filePath) {
+async function readOptionalJson2(filePath) {
   try {
     const parsed = JSON.parse(await fs11.readFile(filePath, "utf8"));
     if (!isRecord13(parsed)) throw new Error(`Expected a JSON object at ${filePath}.`);
@@ -60670,7 +60772,7 @@ async function activateSafeActionDraft(input) {
       activated_at: activatedAt
     });
   } catch (error) {
-    await writeTextAtomic(configPath, previousConfigText).catch(() => void 0);
+    await writeTextAtomic2(configPath, previousConfigText).catch(() => void 0);
     throw error;
   }
   return active;
@@ -61190,10 +61292,10 @@ async function writeDigestArtifact(filePath, content, immutable = false) {
   if (immutable) await fs15.chmod(filePath, 256).catch(() => void 0);
 }
 async function writeJsonAtomic2(filePath, value) {
-  await writeTextAtomic(filePath, `${JSON.stringify(value, null, 2)}
+  await writeTextAtomic2(filePath, `${JSON.stringify(value, null, 2)}
 `);
 }
-async function writeTextAtomic(filePath, value) {
+async function writeTextAtomic2(filePath, value) {
   await fs15.mkdir(path15.dirname(filePath), { recursive: true, mode: 448 });
   const temporary = path15.join(path15.dirname(filePath), `.${path15.basename(filePath)}.${process.pid}.${Math.random().toString(16).slice(2)}.tmp`);
   try {
@@ -61213,7 +61315,7 @@ async function writeNewText(filePath, value, force) {
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
-  await writeTextAtomic(filePath, value);
+  await writeTextAtomic2(filePath, value);
 }
 function relativeProjectPath3(projectRoot, filePath) {
   const relative2 = normalizePath(path15.relative(projectRoot, filePath));
@@ -62786,7 +62888,7 @@ function createScopedExploreMcpServer(runtime) {
     }).strict().optional()
   }).strict();
   const server = new McpServer2(
-    { name: "synapsor-runner-authoring", version: "1.6.4" },
+    { name: "synapsor-runner-authoring", version: package_default.version },
     { capabilities: { tools: {} } }
   );
   server.registerTool(SCOPED_EXPLORE_DESCRIBE_TOOL, {
@@ -63005,7 +63107,7 @@ async function connectAuthoringSurface(input) {
 async function connectSurface(kind, server, closeRuntime) {
   const client = new Client({
     name: `synapsor-workbench-ask-${kind}`,
-    version: "1.6.4"
+    version: package_default.version
   });
   const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
   try {
@@ -63229,7 +63331,7 @@ async function handleRequest(input) {
     const candidate = progress?.candidate ?? recommendedWorkbenchCandidate(draft);
     const reviewDecisions = boundaryReviewDecisions(candidate);
     const confirmedDecisions = progress?.confirmed_decisions ?? [];
-    const active = await readOptionalJson4(path16.join(projectRoot, ".synapsor/exploration-boundary.active.json"));
+    const active = await readOptionalJson3(path16.join(projectRoot, ".synapsor/exploration-boundary.active.json"));
     const instantCandidate = instantWorkbenchCandidate(draft);
     sendJson(response, 200, {
       ok: true,
@@ -63444,7 +63546,7 @@ async function handleRequest(input) {
       path16.join(boundaryRoot, "exploration-boundary.draft.json"),
       "utf8"
     ));
-    const active = await readOptionalJson4(
+    const active = await readOptionalJson3(
       path16.join(projectRoot, ".synapsor/exploration-boundary.active.json")
     );
     if (!active || active.activation.digest !== expectedActiveDigest) {
@@ -63549,7 +63651,7 @@ async function handleRequest(input) {
     );
     const previousProgress = await readBoundaryReviewProgress(projectRoot, previousDraft);
     const previousActive = activeBoundaryEventMetadata(
-      await readOptionalJson4(path16.join(projectRoot, ".synapsor/exploration-boundary.active.json"))
+      await readOptionalJson3(path16.join(projectRoot, ".synapsor/exploration-boundary.active.json"))
     );
     const overrides = applyManagedBoundaryReviewDecision(
       await loadAutoBoundaryReviewOverrides(projectRoot),
@@ -63706,7 +63808,7 @@ async function handleRequest(input) {
       throw new Error("Schema or review inputs changed after preview; preview the rescan again.");
     }
     const previousActive = activeBoundaryEventMetadata(
-      await readOptionalJson4(path16.join(projectRoot, ".synapsor/exploration-boundary.active.json"))
+      await readOptionalJson3(path16.join(projectRoot, ".synapsor/exploration-boundary.active.json"))
     );
     const previousDraft = JSON.parse(
       await fs16.readFile(path16.join(boundaryRoot, "exploration-boundary.draft.json"), "utf8")
@@ -63802,7 +63904,7 @@ async function handleRequest(input) {
       throw new Error("Start over requires the exact confirmation START OVER REVIEW.");
     }
     const previousActive = activeBoundaryEventMetadata(
-      await readOptionalJson4(path16.join(projectRoot, ".synapsor/exploration-boundary.active.json"))
+      await readOptionalJson3(path16.join(projectRoot, ".synapsor/exploration-boundary.active.json"))
     );
     const prepared = await prepareAutoBoundaryRescan({
       projectRoot,
@@ -64030,7 +64132,7 @@ async function handleRequest(input) {
       throw new Error("Protected-capability activation requires capability_name, expected_digest, confirmation, and actor.");
     }
     const previousExploreAuthority = activeBoundaryEventMetadata(
-      await readOptionalJson4(path16.join(projectRoot, ".synapsor/exploration-boundary.active.json"))
+      await readOptionalJson3(path16.join(projectRoot, ".synapsor/exploration-boundary.active.json"))
     );
     const active = await activateProtectedQuery({
       projectRoot,
@@ -64096,7 +64198,7 @@ async function handleRequest(input) {
       return;
     }
     const previousActive = activeBoundaryEventMetadata(
-      await readOptionalJson4(path16.join(projectRoot, ".synapsor/exploration-boundary.active.json"))
+      await readOptionalJson3(path16.join(projectRoot, ".synapsor/exploration-boundary.active.json"))
     );
     const disabled = await disableScopedExplore(projectRoot);
     if (disabled.disabled && previousActive) {
@@ -66564,13 +66666,13 @@ function workbenchReceiptRecord(record) {
 }
 async function resolveWorkbenchDeploymentProfile(projectRoot, configured) {
   if (configured) return configured;
-  const active = await readOptionalJson4(path16.join(projectRoot, ".synapsor/exploration-boundary.active.json"));
-  const draft = await readOptionalJson4(path16.join(projectRoot, "synapsor/generated/exploration-boundary.draft.json"));
+  const active = await readOptionalJson3(path16.join(projectRoot, ".synapsor/exploration-boundary.active.json"));
+  const draft = await readOptionalJson3(path16.join(projectRoot, "synapsor/generated/exploration-boundary.draft.json"));
   const profile = isRecord18(active) ? active.deployment_profile : isRecord18(draft) ? draft.deployment_profile : void 0;
   return profile === "development" || profile === "staging" || profile === "production" ? profile : "unknown";
 }
 async function workbenchOperatorPosture(configPath) {
-  const rawConfig = await readOptionalJson4(path16.resolve(configPath));
+  const rawConfig = await readOptionalJson3(path16.resolve(configPath));
   const operator = isRecord18(rawConfig) ? asRecord4(rawConfig.operator_identity) : {};
   const provider = operator.provider === "signed_key" || operator.provider === "jwt_oidc" ? operator.provider : "dev_env";
   const applyRoles = Array.isArray(operator.apply_roles) ? operator.apply_roles.filter((role) => typeof role === "string") : [];
@@ -66622,7 +66724,7 @@ async function readJsonBody(request) {
   if (!isRecord18(parsed)) throw new Error("request body must be a JSON object");
   return parsed;
 }
-async function readOptionalJson4(filePath) {
+async function readOptionalJson3(filePath) {
   try {
     return JSON.parse(await fs16.readFile(filePath, "utf8"));
   } catch (error) {
@@ -66687,7 +66789,7 @@ function instantActivationActor() {
 }
 async function readBoundaryReviewProgress(projectRoot, draft) {
   const filePath = path16.join(projectRoot, ".synapsor/boundary-review-progress.json");
-  const raw = await readOptionalJson4(filePath);
+  const raw = await readOptionalJson3(filePath);
   if (raw === null) return void 0;
   if (!isRecord18(raw) || raw.schema_version !== BOUNDARY_REVIEW_PROGRESS_VERSION && raw.schema_version !== LEGACY_BOUNDARY_REVIEW_PROGRESS_VERSION || !isRecord18(raw.candidate) || !Array.isArray(raw.confirmed_decisions) || raw.confirmed_decisions.some((decision) => typeof decision !== "string") || typeof raw.updated_at !== "string") {
     throw new Error("Saved boundary-review progress is invalid; use explicit Rescan or Start over rather than trusting it.");
@@ -67025,11 +67127,11 @@ function askWorkbenchAccessFailure(profile, host) {
   return void 0;
 }
 async function workbenchAskAuthority(input) {
-  const active = await readOptionalJson4(path16.join(input.projectRoot, ".synapsor/exploration-boundary.active.json"));
+  const active = await readOptionalJson3(path16.join(input.projectRoot, ".synapsor/exploration-boundary.active.json"));
   const activation2 = isRecord18(active) ? asRecord4(active.activation) : {};
   const activeBoundaryDigest = typeof activation2.digest === "string" && /^sha256:[a-f0-9]{64}$/.test(activation2.digest) ? activation2.digest : void 0;
   const toolSurfaceDigest = askToolSurfaceDigest(input.tools);
-  const runtimeConfig = await readOptionalJson4(input.configPath);
+  const runtimeConfig = await readOptionalJson3(input.configPath);
   if (!isRecord18(runtimeConfig)) {
     throw new AskError("ASK_RUNTIME_CONFIG_UNAVAILABLE", "Ask could not bind consent to the active Runner configuration.", 409);
   }
@@ -75156,7 +75258,7 @@ async function writeGeneratedOnboardingFiles(output, generated, selection, force
   process2.stdout.write(`created onboarding manifest ${displayPath2(manifestPath)}
 `);
   if (options.printNext !== false) {
-    process2.stdout.write(`Next: set the referenced environment variables, run \`${cliCommandName()} config validate --config ${configArgument}\`, then add the reviewed tools to Cursor with \`${cliCommandName()} mcp install cursor --project --config ${configArgument}\`.
+    process2.stdout.write(`Next: set the referenced environment variables, run \`${cliCommandName()} config validate --config ${configArgument}\`, then add the reviewed tools to a project client with \`${cliCommandName()} mcp install <cursor|claude-code|vscode> --project --config ${configArgument}\`.
 `);
   }
   return artifacts;
@@ -77756,7 +77858,7 @@ async function localDoctor(args) {
     level: forbiddenTools.length === 0 ? "pass" : "fail",
     message: forbiddenTools.length === 0 ? "MCP tool catalog is semantic-only." : `Forbidden model-facing tools: ${forbiddenTools.join(", ")}`
   });
-  checks.push(...await cursorProjectDoctorChecks(configPath, tools2, args));
+  checks.push(...await managedMcpProjectDoctorChecks(configPath, tools2, args));
   const report = {
     ok: checks.every((check) => check.level !== "fail"),
     mode: String(parsed.mode),
@@ -77781,78 +77883,100 @@ async function localDoctor(args) {
   }
   return report.ok ? 0 : 1;
 }
-async function cursorProjectDoctorChecks(configPath, expectedTools, args) {
+async function managedMcpProjectDoctorChecks(configPath, expectedTools, args) {
   const projectRoot = path29.resolve(optionalArg(args, "--project-root") ?? path29.dirname(path29.resolve(configPath)));
-  try {
-    const status = await cursorProjectStatus(projectRoot);
-    if (status.state === "not_installed") {
-      return [{
-        name: "cursor-project:installation",
-        ok: true,
-        level: "warn",
-        message: `No Runner-owned project Cursor entry is installed. Preview it with ${cliCommandName()} mcp install cursor --project --project-root ${projectRoot} --dry-run.`
-      }];
-    }
-    if (status.state !== "installed") {
-      return [{
-        name: "cursor-project:installation",
-        ok: false,
-        level: "fail",
-        message: status.message
-      }];
-    }
-    const authoring = isCursorAuthoringEntry(status.entry);
-    const authoringTools = ["app.describe_data", "app.explore_data"];
-    const reviewedTools = authoring ? authoringTools : expectedTools;
-    const recordedConfig = path29.resolve(projectRoot, status.paths.configArgument);
-    const configMatches = recordedConfig === path29.resolve(configPath);
-    const checks = [{
-      name: "cursor-project:installation",
-      ok: authoring || configMatches,
-      level: authoring || configMatches ? "pass" : "fail",
-      message: authoring ? "Runner owns an intact local authoring Cursor entry; it does not depend on a production Runner config." : configMatches ? `Runner owns an intact project Cursor entry for ${status.paths.configArgument}.` : `Cursor entry points to ${status.paths.configArgument}, but doctor inspected ${path29.resolve(configPath)}.`
-    }, {
-      name: "cursor-project:model-tools",
-      ok: reviewedTools.length > 0,
-      level: reviewedTools.length > 0 ? "pass" : "fail",
-      message: authoring ? `Authoring tools: ${authoringTools.join(", ")}. Scoped Explore remains local development/staging only; activation, approval, apply, revert, credentials, and trusted identity remain outside MCP.` : `Reviewed model-facing tools: ${expectedTools.join(", ") || "none"}. Approval, apply, revert, policy, credentials, and trusted identity remain outside MCP.`
+  const clients = ["cursor", "claude-code", "vscode"];
+  const requestedLaunch = args.includes("--check-cursor") ? "cursor" : optionalArg(args, "--check-mcp-client");
+  const launchClient = requestedLaunch === void 0 ? void 0 : parseManagedMcpProjectClient(requestedLaunch);
+  const statuses = await Promise.all(clients.map(async (client) => ({
+    client,
+    definition: managedMcpProjectDefinition(client),
+    status: await managedMcpProjectStatus(client, projectRoot)
+  })));
+  const relevant = statuses.filter(({ status, client }) => status.state !== "not_installed" || client === launchClient);
+  if (relevant.length === 0) {
+    return [{
+      name: "mcp-project:installation",
+      ok: true,
+      level: "warn",
+      message: `No Runner-owned project MCP entry is installed. Preview one with ${cliCommandName()} mcp install <cursor|claude-code|vscode> --project --project-root ${projectRoot} --dry-run.`
     }];
-    if (!args.includes("--check-cursor")) {
+  }
+  const checks = [];
+  for (const { client, definition, status } of relevant) {
+    const prefix = `${client}-project`;
+    try {
+      if (status.state === "not_installed") {
+        checks.push({
+          name: `${prefix}:installation`,
+          ok: false,
+          level: "fail",
+          message: `No Runner-owned ${definition.displayName} project entry is installed, so the requested launch check cannot run.`
+        });
+        continue;
+      }
+      if (status.state !== "installed") {
+        checks.push({
+          name: `${prefix}:installation`,
+          ok: false,
+          level: "fail",
+          message: status.message
+        });
+        continue;
+      }
+      const authoring = isManagedAuthoringEntry(status.entry);
+      const authoringTools = ["app.describe_data", "app.explore_data"];
+      const reviewedTools = authoring ? authoringTools : expectedTools;
+      const recordedConfig = path29.resolve(projectRoot, status.paths.configArgument);
+      const configMatches = recordedConfig === path29.resolve(configPath);
       checks.push({
-        name: "cursor-project:launch",
-        ok: true,
-        level: "warn",
-        message: `Cursor command was not launched. Rerun with --check-cursor to perform a real stdio initialize + tools/list handshake.`
+        name: `${prefix}:installation`,
+        ok: authoring || configMatches,
+        level: authoring || configMatches ? "pass" : "fail",
+        message: authoring ? `Runner owns an intact local authoring ${definition.displayName} entry; it does not depend on a production Runner config.` : configMatches ? `Runner owns an intact ${definition.displayName} project entry for ${status.paths.configArgument}.` : `${definition.displayName} entry points to ${status.paths.configArgument}, but doctor inspected ${path29.resolve(configPath)}.`
+      }, {
+        name: `${prefix}:model-tools`,
+        ok: reviewedTools.length > 0,
+        level: reviewedTools.length > 0 ? "pass" : "fail",
+        message: authoring ? `Authoring tools: ${authoringTools.join(", ")}. Scoped Explore remains local development/staging only; activation, approval, apply, revert, credentials, and trusted identity remain outside MCP.` : `Reviewed model-facing tools: ${expectedTools.join(", ") || "none"}. Approval, apply, revert, policy, credentials, and trusted identity remain outside MCP.`
       });
-      return checks;
-    }
-    const entry = status.entry;
-    const command = typeof entry?.command === "string" ? entry.command : "";
-    const commandArgs = Array.isArray(entry?.args) && entry.args.every((value) => typeof value === "string") ? entry.args : [];
-    if (!command) {
-      checks.push({ name: "cursor-project:launch", ok: false, level: "fail", message: "Cursor Synapsor entry has no valid command." });
-      return checks;
-    }
-    const timeoutMs = Number(optionalArg(args, "--timeout-ms") ?? "10000");
-    if (!Number.isInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 12e4) throw new Error("--timeout-ms must be an integer from 100 to 120000");
-    const response = await fetchStdioMcpToolsCommand(command, commandArgs, timeoutMs, projectRoot);
-    const liveTools = mcpAuditToolNames(response);
-    const matches = stableStringArray(liveTools).join("\n") === stableStringArray(reviewedTools).join("\n");
-    checks.push({
-      name: "cursor-project:launch",
-      ok: matches,
-      level: matches ? "pass" : "fail",
-      message: matches ? `Configured Cursor command started and exposed exactly ${liveTools.length} reviewed tool(s).` : `Configured command exposed ${liveTools.join(", ") || "no tools"}; expected ${reviewedTools.join(", ") || "no tools"}.`
-    });
-    return checks;
-  } catch (error) {
-    return [{
-      name: "cursor-project:installation",
-      ok: false,
-      level: "fail",
-      message: `Cursor project verification failed: ${safeErrorMessage(error)}`
-    }];
+      if (launchClient !== client) {
+        checks.push({
+          name: `${prefix}:launch`,
+          ok: true,
+          level: "warn",
+          message: `${definition.displayName} command was not launched. Rerun with --check-mcp-client ${client} to perform a real stdio initialize + tools/list handshake.`
+        });
+        continue;
+      }
+      const entry = status.entry;
+      const command = typeof entry?.command === "string" ? entry.command : "";
+      const commandArgs = Array.isArray(entry?.args) && entry.args.every((value) => typeof value === "string") ? entry.args : [];
+      if (!command) {
+        checks.push({ name: `${prefix}:launch`, ok: false, level: "fail", message: `${definition.displayName} Synapsor entry has no valid command.` });
+        continue;
+      }
+      const timeoutMs = Number(optionalArg(args, "--timeout-ms") ?? "10000");
+      if (!Number.isInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 12e4) throw new Error("--timeout-ms must be an integer from 100 to 120000");
+      const response = await fetchStdioMcpToolsCommand(command, commandArgs, timeoutMs, projectRoot);
+      const liveTools = mcpAuditToolNames(response);
+      const matches = stableStringArray(liveTools).join("\n") === stableStringArray(reviewedTools).join("\n");
+      checks.push({
+        name: `${prefix}:launch`,
+        ok: matches,
+        level: matches ? "pass" : "fail",
+        message: matches ? `Configured ${definition.displayName} command started and exposed exactly ${liveTools.length} reviewed tool(s).` : `Configured command exposed ${liveTools.join(", ") || "no tools"}; expected ${reviewedTools.join(", ") || "no tools"}.`
+      });
+    } catch (error) {
+      checks.push({
+        name: `${prefix}:installation`,
+        ok: false,
+        level: "fail",
+        message: `${definition.displayName} project verification failed: ${safeErrorMessage(error)}`
+      });
+    }
   }
+  return checks;
 }
 async function httpSecurityDoctorChecks(config, args) {
   const requestedTransport = optionalArg(args, "--transport") ?? "stdio";
@@ -81851,11 +81975,12 @@ async function mcp(args) {
   return 2;
 }
 async function mcpProjectInstall(args) {
-  const [client, ...rest] = args;
-  if (client !== "cursor") throw new Error("mcp install currently supports cursor only");
-  assertKnownOptions(rest, /* @__PURE__ */ new Set(["--project", "--project-root", "--config", "--store", "--authoring", "--dry-run", "--yes", "--json"]), "mcp install cursor");
+  const [clientValue, ...rest] = args;
+  const client = parseManagedMcpProjectClient(clientValue);
+  const definition = managedMcpProjectDefinition(client);
+  assertKnownOptions(rest, /* @__PURE__ */ new Set(["--project", "--project-root", "--config", "--store", "--authoring", "--dry-run", "--yes", "--json"]), `mcp install ${client}`);
   if (!rest.includes("--project")) {
-    throw new Error("mcp install cursor requires --project so Runner changes only the current project's .cursor/mcp.json");
+    throw new Error(`mcp install ${client} requires --project so Runner changes only the current project's ${definition.destination}`);
   }
   const projectRoot = path29.resolve(optionalArg(rest, "--project-root") ?? process2.cwd());
   const authoring = rest.includes("--authoring");
@@ -81870,42 +81995,44 @@ async function mcpProjectInstall(args) {
     await readRuntimeConfig(absoluteConfig);
     const boundary = await inspectMcpToolBoundary(["--config", absoluteConfig, "--store", ":memory:"]);
     if (!boundary.ok) {
-      throw new Error(`Cursor install refused because the reviewed model-facing boundary failed: ${boundary.checks.filter((check) => !check.ok).map((check) => check.name).join(", ")}`);
+      throw new Error(`${definition.displayName} install refused because the reviewed model-facing boundary failed: ${boundary.checks.filter((check) => !check.ok).map((check) => check.name).join(", ")}`);
     }
     toolNames = boundary.names;
   }
-  const preview = await previewCursorProjectInstall({ projectRoot, configPath, storePath, authoring });
-  const report = cursorProjectLifecycleReport(preview, toolNames, authoring);
+  const preview = await previewManagedMcpProjectInstall({ client, projectRoot, configPath, storePath, authoring });
+  const report = managedMcpProjectLifecycleReport(client, preview, toolNames, authoring);
   const json7 = rest.includes("--json");
   if (rest.includes("--dry-run") || preview.action === "unchanged") {
     if (json7) process2.stdout.write(`${JSON.stringify(report, null, 2)}
 `);
-    else process2.stdout.write(formatCursorProjectPreview(report));
+    else process2.stdout.write(formatManagedMcpProjectPreview(report));
     return 0;
   }
-  if (!json7) process2.stdout.write(formatCursorProjectPreview(report));
+  if (!json7) process2.stdout.write(formatManagedMcpProjectPreview(report));
   await confirmDangerousAction(rest, `Install the reviewed Synapsor MCP entry in ${path29.relative(projectRoot, preview.paths.destination)}?`);
-  const installed = await installCursorProject({ projectRoot, configPath, storePath, authoring });
+  const installed = await installManagedMcpProject({ client, projectRoot, configPath, storePath, authoring });
   if (json7) {
     process2.stdout.write(`${JSON.stringify({ ...report, action: installed.action, installed: true, backup: installed.backup ?? null }, null, 2)}
 `);
   } else {
-    process2.stdout.write(`Cursor project MCP entry installed at ${path29.relative(projectRoot, installed.paths.destination)}.
+    process2.stdout.write(`${definition.displayName} project MCP entry installed at ${path29.relative(projectRoot, installed.paths.destination)}.
 `);
     if (installed.backup) process2.stdout.write(`Backup: ${installed.backup}
 `);
-    process2.stdout.write("Restart or reload Cursor, then run `synapsor-runner mcp status cursor --project` to verify the reviewed tool boundary.\n");
+    process2.stdout.write(`${definition.reloadInstruction}, then run \`synapsor-runner mcp status ${client} --project\` to verify the reviewed tool boundary.
+`);
   }
   return 0;
 }
 async function mcpProjectStatus(args) {
-  const [client, ...rest] = args;
-  if (client !== "cursor") throw new Error("mcp status currently supports cursor only");
-  assertKnownOptions(rest, /* @__PURE__ */ new Set(["--project", "--project-root", "--json", "--check-launch", "--timeout-ms"]), "mcp status cursor");
-  if (!rest.includes("--project")) throw new Error("mcp status cursor requires --project");
+  const [clientValue, ...rest] = args;
+  const client = parseManagedMcpProjectClient(clientValue);
+  const definition = managedMcpProjectDefinition(client);
+  assertKnownOptions(rest, /* @__PURE__ */ new Set(["--project", "--project-root", "--json", "--check-launch", "--timeout-ms"]), `mcp status ${client}`);
+  if (!rest.includes("--project")) throw new Error(`mcp status ${client} requires --project`);
   const projectRoot = path29.resolve(optionalArg(rest, "--project-root") ?? process2.cwd());
-  const status = await cursorProjectStatus(projectRoot);
-  const authoring = status.state === "installed" && isCursorAuthoringEntry(status.entry);
+  const status = await managedMcpProjectStatus(client, projectRoot);
+  const authoring = status.state === "installed" && isManagedAuthoringEntry(status.entry);
   let tools2 = [];
   let launch = {
     checked: false,
@@ -81929,7 +82056,7 @@ async function mcpProjectStatus(args) {
       const entry = status.entry;
       const command = typeof entry?.command === "string" ? entry.command : "";
       const commandArgs = Array.isArray(entry?.args) && entry.args.every((value) => typeof value === "string") ? entry.args : [];
-      if (!command) throw new Error("Cursor Synapsor entry does not contain a valid command");
+      if (!command) throw new Error(`${definition.displayName} Synapsor entry does not contain a valid command`);
       const timeoutMs = Number(optionalArg(rest, "--timeout-ms") ?? "10000");
       if (!Number.isInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 12e4) throw new Error("--timeout-ms must be an integer from 100 to 120000");
       const response = await fetchStdioMcpToolsCommand(command, commandArgs, timeoutMs, projectRoot);
@@ -81938,12 +82065,14 @@ async function mcpProjectStatus(args) {
       launch = {
         checked: true,
         ok: matches,
-        message: matches ? `Cursor command started and exposed exactly ${liveNames.length} reviewed tool(s).` : `Started command exposed ${liveNames.join(", ") || "no tools"}; expected ${tools2.join(", ") || "no tools"}.`
+        message: matches ? `${definition.displayName} command started and exposed exactly ${liveNames.length} reviewed tool(s).` : `Started command exposed ${liveNames.join(", ") || "no tools"}; expected ${tools2.join(", ") || "no tools"}.`
       };
     }
   }
   const report = {
     ok: status.state === "installed" && launch.ok,
+    client,
+    client_name: definition.displayName,
     state: status.state,
     mode: authoring ? "authoring" : "runtime",
     message: status.message,
@@ -81956,18 +82085,21 @@ async function mcpProjectStatus(args) {
   };
   if (rest.includes("--json")) process2.stdout.write(`${JSON.stringify(report, null, 2)}
 `);
-  else process2.stdout.write(formatCursorProjectStatus(report));
+  else process2.stdout.write(formatManagedMcpProjectStatus(report));
   return report.ok ? 0 : 1;
 }
 async function mcpProjectUninstall(args) {
-  const [client, ...rest] = args;
-  if (client !== "cursor") throw new Error("mcp uninstall currently supports cursor only");
-  assertKnownOptions(rest, /* @__PURE__ */ new Set(["--project", "--project-root", "--dry-run", "--yes", "--json"]), "mcp uninstall cursor");
-  if (!rest.includes("--project")) throw new Error("mcp uninstall cursor requires --project");
+  const [clientValue, ...rest] = args;
+  const client = parseManagedMcpProjectClient(clientValue);
+  const definition = managedMcpProjectDefinition(client);
+  assertKnownOptions(rest, /* @__PURE__ */ new Set(["--project", "--project-root", "--dry-run", "--yes", "--json"]), `mcp uninstall ${client}`);
+  if (!rest.includes("--project")) throw new Error(`mcp uninstall ${client} requires --project`);
   const projectRoot = path29.resolve(optionalArg(rest, "--project-root") ?? process2.cwd());
-  const status = await cursorProjectStatus(projectRoot);
+  const status = await managedMcpProjectStatus(client, projectRoot);
   const preview = {
     ok: status.state === "installed" || status.state === "not_installed",
+    client,
+    client_name: definition.displayName,
     state: status.state,
     changed: status.state === "installed",
     destination: path29.relative(projectRoot, status.paths.destination),
@@ -81986,45 +82118,50 @@ ${preview.changed ? `Will remove only the Runner-owned Synapsor entry from ${pre
   if (!json7) process2.stdout.write(`${preview.message}
 Will remove only the Runner-owned Synapsor entry from ${preview.destination}.
 `);
-  if (!preview.ok) throw new Error("Cursor project entry is unowned or changed; refusing to remove it automatically");
+  if (!preview.ok) throw new Error(`${definition.displayName} project entry is unowned or changed; refusing to remove it automatically`);
   await confirmDangerousAction(rest, `Remove only the Runner-owned Synapsor MCP entry from ${preview.destination}?`);
-  const removed = await uninstallCursorProject({ projectRoot });
+  const removed = await uninstallManagedMcpProject({ client, projectRoot });
   if (json7) process2.stdout.write(`${JSON.stringify({ ...preview, changed: removed.changed, backup: removed.backup ?? null }, null, 2)}
 `);
-  else process2.stdout.write(`Removed Runner-owned Cursor project MCP entry. Backup: ${removed.backup}
+  else process2.stdout.write(`Removed Runner-owned ${definition.displayName} project MCP entry. Backup: ${removed.backup}
 `);
   return 0;
 }
-function cursorProjectLifecycleReport(preview, tools2, authoring = false) {
+function managedMcpProjectLifecycleReport(client, preview, tools2, authoring = false) {
+  const definition = managedMcpProjectDefinition(client);
   return {
     ok: true,
+    client,
+    client_name: definition.displayName,
     action: preview.action,
     mode: authoring ? "authoring" : "runtime",
     destination: path29.relative(preview.paths.projectRoot, preview.paths.destination),
     config: authoring ? null : preview.paths.configArgument,
     store: authoring ? null : preview.paths.storeArgument,
     preserves_other_servers: true,
-    credentials_in_cursor_config: false,
+    credentials_in_client_config: false,
+    ...client === "cursor" ? { credentials_in_cursor_config: false } : {},
     tools: tools2,
     not_exposed_to_mcp: defaultBlockedToolSurface()
   };
 }
-function formatCursorProjectPreview(report) {
+function formatManagedMcpProjectPreview(report) {
   const tools2 = Array.isArray(report.tools) ? report.tools.join(", ") : "";
+  const clientName = String(report.client_name);
   return [
-    `Cursor project MCP ${String(report.action)} preview`,
+    `${clientName} project MCP ${String(report.action)} preview`,
     `Mode: ${String(report.mode)}`,
     `Destination: ${String(report.destination)}`,
     ...report.mode === "authoring" ? ["Project root: .", "Transport: local stdio only"] : [`Runner config: ${String(report.config)}`, `Runner store: ${String(report.store)}`],
     `Model-facing tools: ${tools2 || "none"}`,
     "Approval, apply, revert, policy, credentials, and trusted identity stay outside MCP.",
-    "Other Cursor MCP servers and project settings are preserved.",
+    `Other ${clientName} MCP servers and project settings are preserved.`,
     ""
   ].join("\n");
 }
-function formatCursorProjectStatus(report) {
+function formatManagedMcpProjectStatus(report) {
   return [
-    `Cursor project MCP: ${report.state}`,
+    `${report.client_name} project MCP: ${report.state}`,
     report.message,
     `Mode: ${report.mode}`,
     `Destination: ${report.destination}`,
@@ -82035,7 +82172,7 @@ function formatCursorProjectStatus(report) {
     ""
   ].join("\n");
 }
-function isCursorAuthoringEntry(entry) {
+function isManagedAuthoringEntry(entry) {
   return Array.isArray(entry?.args) && entry.args.every((value) => typeof value === "string") && entry.args.includes("--authoring");
 }
 function stableStringArray(values) {
@@ -91605,7 +91742,7 @@ the local reviewed contract and proposal before writeback.
   ${cmd} boundary activate --headless --review-bundle boundary-review.json --config ./synapsor/synapsor.runner.json --confirm "ACTIVATE sha256:..." --identity reviewer --identity-key ./reviewer.pem --required-role boundary_reviewer --reason "Reviewed staging authority"
   ${cmd} boundary status [--project-root .] [--json]
   ${cmd} boundary diff [--project-root .] [--json]
-  ${cmd} mcp install cursor --project --authoring --project-root . --yes
+  ${cmd} mcp install <cursor|claude-code|vscode> --project --authoring --project-root . --yes
 
 Draft the whole deterministic application boundary without opening a browser,
 inspect/export its disabled review state, and compare the generation lock with
@@ -91618,7 +91755,8 @@ exact digest confirmation, a short-lived nonce-bound decision, and a configured
 signed_key or jwt_oidc operator identity carrying the required role. --yes and
 an actor string are never sufficient. Workbench and CLI converge on the same
 activation checks. After activation, --authoring installs exactly
-app.describe_data and app.explore_data in the current Cursor project. Scoped
+app.describe_data and app.explore_data in the selected Cursor, Claude Code, or
+VS Code project. Scoped
 Explore remains local stdio only and is absent from production and remote HTTP.
 `,
     action: `Usage:
@@ -91681,10 +91819,10 @@ Drizzle input is parsed as a bounded TypeScript AST and is never imported or run
   ${cmd} mcp serve-http --config ./synapsor.runner.json --store ./.synapsor/local.db --auth-token-env SYNAPSOR_RUNNER_HTTP_TOKEN
   ${cmd} mcp config --absolute-paths --config ./synapsor.runner.json --store ./.synapsor/local.db
   ${cmd} mcp client-config --client openai-agents --config ./synapsor.runner.json --store ./.synapsor/local.db
-  ${cmd} mcp install cursor --project --authoring [--project-root .] [--dry-run]
-  ${cmd} mcp install cursor --project [--dry-run] [--config ./synapsor.runner.json] [--store ./.synapsor/local.db]
-  ${cmd} mcp status cursor --project [--check-launch]
-  ${cmd} mcp uninstall cursor --project [--dry-run]
+  ${cmd} mcp install <cursor|claude-code|vscode> --project --authoring [--project-root .] [--dry-run]
+  ${cmd} mcp install <cursor|claude-code|vscode> --project [--dry-run] [--config ./synapsor.runner.json] [--store ./.synapsor/local.db]
+  ${cmd} mcp status <cursor|claude-code|vscode> --project [--check-launch]
+  ${cmd} mcp uninstall <cursor|claude-code|vscode> --project [--dry-run]
   ${cmd} mcp audit --example dangerous-db-mcp
   ${cmd} mcp audit ./tools-list.json
   ${cmd} mcp audit generate ./tools-list.json --output ./synapsor-audit-candidates
@@ -91694,10 +91832,11 @@ Stdio opens no network socket and needs no HTTP credential. Networked MCP is aut
 MCP clients see semantic tools. They do not receive raw SQL, write credentials, approval tools, or commit tools.
 `,
     "mcp install": `Usage:
-  ${cmd} mcp install cursor --project --authoring [--project-root .] [--dry-run] [--yes]
-  ${cmd} mcp install cursor --project [--project-root .] [--config ./synapsor.runner.json] [--store ./.synapsor/local.db] [--dry-run] [--yes]
+  ${cmd} mcp install <cursor|claude-code|vscode> --project --authoring [--project-root .] [--dry-run] [--yes]
+  ${cmd} mcp install <cursor|claude-code|vscode> --project [--project-root .] [--config ./synapsor.runner.json] [--store ./.synapsor/local.db] [--dry-run] [--yes]
 
-Preview, confirm, and merge a project-scoped Synapsor entry into .cursor/mcp.json.
+Preview, confirm, and merge a project-scoped Synapsor entry into
+.cursor/mcp.json, .mcp.json, or .vscode/mcp.json.
 Runner preserves other servers/settings, creates a backup before changing an
 existing file, records explicit ownership, and never writes database URLs,
 credentials, trusted identity, approval, apply, revert, or policy authority.
@@ -91708,16 +91847,16 @@ runtime config. Re-run without --authoring after Protect activates a production
 named capability.
 `,
     "mcp status": `Usage:
-  ${cmd} mcp status cursor --project [--project-root .] [--check-launch] [--timeout-ms 10000] [--json]
+  ${cmd} mcp status <cursor|claude-code|vscode> --project [--project-root .] [--check-launch] [--timeout-ms 10000] [--json]
 
-Verify Runner's project-scoped Cursor ownership marker and print the exact
+Verify Runner's project-scoped client ownership marker and print the exact
 reviewed model-facing tools. --check-launch performs a real stdio initialize +
 tools/list handshake with the configured command.
 `,
     "mcp uninstall": `Usage:
-  ${cmd} mcp uninstall cursor --project [--project-root .] [--dry-run] [--yes] [--json]
+  ${cmd} mcp uninstall <cursor|claude-code|vscode> --project [--project-root .] [--dry-run] [--yes] [--json]
 
-Remove only the Runner-owned Synapsor entry. Other Cursor MCP servers and
+Remove only the Runner-owned Synapsor entry. Other client MCP servers and
 project settings are preserved, and edited/unowned entries fail closed.
 `,
     tools: `Usage:
@@ -91922,6 +92061,7 @@ security guarantee.
   ${cmd} doctor --config synapsor.runner.json --check-handlers
   ${cmd} doctor --config synapsor.runner.json --check-writeback
   ${cmd} doctor --config synapsor.runner.json --check-rls
+  ${cmd} doctor --config synapsor.runner.json --check-mcp-client <cursor|claude-code|vscode>
   ${cmd} doctor --config synapsor.runner.json --transport streamable-http --host 127.0.0.1 --auth-token-env SYNAPSOR_RUNNER_HTTP_TOKEN
   ${cmd} doctor --config synapsor.runner.json --transport streamable-http --host 0.0.0.0 --trusted-tls-proxy
   ${cmd} doctor --config synapsor.runner.json --transport streamable-http --host 0.0.0.0 --tls-cert-env SYNAPSOR_TLS_CERT_PEM --tls-key-env SYNAPSOR_TLS_KEY_PEM