@yagni-app/code 1.0.5 → 1.0.6

package/dist/mcpCommand.js

@@ -0,0 +1,755 @@
+/**
+ * `yagni mcp …` — configure MCP servers for YAGNI Code, mirroring Claude
+ * Code's CLI surface (add / add-json / remove / get / list /
+ * reset-project-choices / add-from-claude).
+ *
+ * The config module itself lives in pi-extension-yagni (`src/mcp/config.ts`)
+ * so the extension session and this CLI read and write the exact same files
+ * through the exact same code — loaded here by file path, the same pattern as
+ * the session-worktree and headless-go entries. `list` and `get` run real
+ * health-check connections (stdio servers are spawned), so they carry the
+ * same caution Claude Code prints: only run in directories you trust.
+ *
+ * Not implemented (deliberate deviations from Claude Code):
+ *   serve   — the YAGNI backend already exposes an MCP endpoint
+ *   login   — enterprise-IdP only in Claude Code; not applicable
+ */
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { DISTRIBUTION } from "./distribution.js";
+export function resolveMcpConfigPath() {
+    const bundled = fileURLToPath(new URL("./extension/mcp/cliConfig.js", import.meta.url));
+    if (existsSync(bundled))
+        return bundled;
+    return fileURLToPath(new URL("../../pi-extension-yagni/dist/mcp/cliConfig.js", import.meta.url));
+}
+async function defaultLoadMcpModule() {
+    const mod = (await import(resolveMcpConfigPath()));
+    if (typeof mod?.loadMcpServers !== "function") {
+        throw new Error("The bundled extension is missing its MCP config entry point (is the CLI up to date?).");
+    }
+    return mod;
+}
+const USAGE = `Usage:
+  ${DISTRIBUTION.commandName} mcp add <name> <commandOrUrl> [args...] [options]
+  ${DISTRIBUTION.commandName} mcp add-json <name> <json> [-s scope]
+  ${DISTRIBUTION.commandName} mcp remove <name> [-s scope]
+  ${DISTRIBUTION.commandName} mcp list
+  ${DISTRIBUTION.commandName} mcp get <name>
+  ${DISTRIBUTION.commandName} mcp reset-project-choices
+  ${DISTRIBUTION.commandName} mcp add-from-claude [-s scope]
+
+Options (add/add-json):
+  -s, --scope <scope>          local | user | project (default: local)
+  -t, --transport <transport>  stdio | sse | http (default: stdio)
+  -e, --env <KEY=VALUE...>     environment variables for stdio servers
+  -H, --header <HEADER...>     headers for http/sse servers
+
+Scopes:
+  local    private to you, this project (~/.yagni-code/mcp.json)
+  user     available in all your projects (~/.yagni-code/mcp.json)
+  project  shared via .mcp.json at the repo root (approval-gated)
+
+Examples:
+  ${DISTRIBUTION.commandName} mcp add --transport http sentry https://mcp.sentry.dev/mcp
+  ${DISTRIBUTION.commandName} mcp add -e API_KEY=xxx my-server -- npx my-mcp-server
+`;
+const ENV_PAIR = /^[^=\s]+=.+$/;
+const HEADER_PAIR = /^[^:\s]+:.+$/;
+export function parseMcpArgs(argv) {
+    const [subcommand, ...after] = argv;
+    const rest = [];
+    let scope = "local";
+    let scopeExplicit = false;
+    let transport = "stdio";
+    let transportExplicit = false;
+    const env = {};
+    const headers = {};
+    let clientId;
+    let clientSecret = false;
+    let callbackPort;
+    let flag = null;
+    let flagSawValue = false;
+    const addEnv = (pair) => {
+        const eq = pair.indexOf("=");
+        env[pair.slice(0, eq)] = pair.slice(eq + 1);
+    };
+    const addHeader = (pair) => {
+        const colon = pair.indexOf(":");
+        headers[pair.slice(0, colon).trim()] = pair.slice(colon + 1).trim();
+    };
+    for (let i = 0; i < after.length; i++) {
+        const arg = after[i];
+        if (arg === "--") {
+            // Everything after -- is a raw stdio argument, not ours to parse.
+            rest.push(...after.slice(i + 1));
+            break;
+        }
+        if (flag === "s" || flag === "t" || flag === "client-id" || flag === "callback-port") {
+            if (flag === "s") {
+                scope = scopeFrom(arg);
+                scopeExplicit = true;
+            }
+            else if (flag === "t") {
+                transport = transportFrom(arg);
+                transportExplicit = true;
+            }
+            else if (flag === "client-id") {
+                clientId = arg;
+            }
+            else {
+                const port = Number(arg);
+                if (!Number.isInteger(port) || port <= 0) {
+                    throw new Error(`Invalid --callback-port ${arg} — expected a positive integer.`);
+                }
+                callbackPort = port;
+            }
+            flag = null;
+            continue;
+        }
+        // -e/-H are variadic with a shape gate: consume following tokens only
+        // while they look like KEY=VALUE / "Header: value" pairs, so both the
+        // `-e A=1 B=2 -- run` and the `-e KEY=val my-server -- npx` forms work.
+        if (flag === "e") {
+            if (!flagSawValue && !ENV_PAIR.test(arg)) {
+                throw new Error(`Invalid --env value "${arg}" — expected KEY=VALUE.`);
+            }
+            if (ENV_PAIR.test(arg)) {
+                addEnv(arg);
+                flagSawValue = true;
+                continue;
+            }
+            flag = null; // falls through: this token is a positional
+        }
+        else if (flag === "H") {
+            if (!flagSawValue && !HEADER_PAIR.test(arg)) {
+                throw new Error(`Invalid --header value "${arg}" — expected "Header-Name: value".`);
+            }
+            if (HEADER_PAIR.test(arg)) {
+                addHeader(arg);
+                flagSawValue = true;
+                continue;
+            }
+            flag = null;
+        }
+        if (arg === "-s" || arg === "--scope") {
+            flag = "s";
+            continue;
+        }
+        if (arg.startsWith("--scope=")) {
+            scope = scopeFrom(arg.slice("--scope=".length));
+            scopeExplicit = true;
+            continue;
+        }
+        if (arg === "-t" || arg === "--transport") {
+            flag = "t";
+            continue;
+        }
+        if (arg.startsWith("--transport=")) {
+            transport = transportFrom(arg.slice("--transport=".length));
+            transportExplicit = true;
+            continue;
+        }
+        if (arg === "-e" || arg === "--env") {
+            flag = "e";
+            flagSawValue = false;
+            continue;
+        }
+        if (arg.startsWith("--env=")) {
+            const pair = arg.slice("--env=".length);
+            if (!ENV_PAIR.test(pair))
+                throw new Error(`Invalid --env value "${pair}" — expected KEY=VALUE.`);
+            addEnv(pair);
+            continue;
+        }
+        if (arg === "-H" || arg === "--header") {
+            flag = "H";
+            flagSawValue = false;
+            continue;
+        }
+        if (arg.startsWith("--header=")) {
+            const pair = arg.slice("--header=".length);
+            if (!HEADER_PAIR.test(pair))
+                throw new Error(`Invalid --header value "${pair}" — expected "Header-Name: value".`);
+            addHeader(pair);
+            continue;
+        }
+        if (arg === "--client-secret") {
+            clientSecret = true;
+            continue;
+        }
+        if (arg === "--client-id") {
+            flag = "client-id";
+            continue;
+        }
+        if (arg.startsWith("--client-id=")) {
+            clientId = arg.slice("--client-id=".length);
+            continue;
+        }
+        if (arg === "--callback-port") {
+            flag = "callback-port";
+            continue;
+        }
+        if (arg.startsWith("--callback-port=")) {
+            const port = Number(arg.slice("--callback-port=".length));
+            if (!Number.isInteger(port) || port <= 0)
+                throw new Error(`Invalid --callback-port — expected a positive integer.`);
+            callbackPort = port;
+            continue;
+        }
+        rest.push(arg);
+    }
+    if (flag === "s" || flag === "t" || flag === "client-id" || flag === "callback-port") {
+        throw new Error("Missing flag value.");
+    }
+    const [name, ...commandArgs] = rest;
+    return { subcommand, name, rest, scope, scopeExplicit, transport, transportExplicit, env, headers, commandArgs, clientId, clientSecret, callbackPort };
+}
+function scopeFrom(value) {
+    if (value === "local" || value === "user" || value === "project")
+        return value;
+    throw new Error(`Invalid scope "${value}" — expected local, user, or project.`);
+}
+function transportFrom(value) {
+    if (value === "stdio" || value === "sse" || value === "http")
+        return value;
+    throw new Error(`Invalid transport "${value}" — expected stdio, sse, or http.`);
+}
+function looksLikeUrl(value) {
+    return (value.startsWith("http://") ||
+        value.startsWith("https://") ||
+        value.startsWith("localhost") ||
+        value.endsWith("/sse") ||
+        value.endsWith("/mcp"));
+}
+function describeScopePath(scope, cwd) {
+    if (scope === "project")
+        return join(cwd, ".mcp.json");
+    return "~/.yagni-code/mcp.json";
+}
+export async function mcpCommand(args, deps = {}) {
+    const stdout = deps.stdout ?? ((t) => process.stdout.write(t));
+    const stderr = deps.stderr ?? ((t) => process.stderr.write(t));
+    const cwd = deps.cwd ?? process.cwd();
+    let mod;
+    try {
+        mod = await (deps.loadMcpModule ?? defaultLoadMcpModule)();
+    }
+    catch (err) {
+        stderr(`${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+    let parsed;
+    try {
+        parsed = parseMcpArgs(args);
+    }
+    catch (err) {
+        stderr(`${err instanceof Error ? err.message : String(err)}\n${USAGE}`);
+        return 1;
+    }
+    switch (parsed.subcommand) {
+        case undefined:
+        case "help":
+            stdout(USAGE);
+            return 0;
+        case "add":
+            return mcpAdd(mod, parsed, { cwd, stdout, stderr });
+        case "add-json":
+            return mcpAddJson(mod, parsed, { cwd, stdout, stderr });
+        case "remove":
+            return mcpRemove(mod, parsed, { cwd, stdout, stderr });
+        case "list":
+            return mcpList(mod, { cwd, stdout, stderr, env: deps.env ?? process.env, probeServer: deps.probeServer });
+        case "get":
+            return mcpGet(mod, parsed, { cwd, stdout, stderr, env: deps.env ?? process.env, probeServer: deps.probeServer });
+        case "reset-project-choices":
+            return mcpResetChoices(mod, { cwd, stdout, stderr });
+        case "add-from-claude":
+            return mcpAddFromClaude(mod, parsed, { cwd, stdout, stderr, home: deps.home ?? homedir() });
+        default:
+            stderr(`Unknown mcp subcommand "${parsed.subcommand}".\n${USAGE}`);
+            return 1;
+    }
+}
+function mcpAdd(mod, parsed, io) {
+    const { name, rest } = parsed;
+    const commandOrUrl = rest[1];
+    const stdioArgs = rest.slice(2);
+    if (!name || !commandOrUrl) {
+        io.stderr(`Error: name and command/URL are required.\nUsage: ${DISTRIBUTION.commandName} mcp add <name> <commandOrUrl> [args...]\n`);
+        return 1;
+    }
+    let serverConfig;
+    if (parsed.transport === "http" || parsed.transport === "sse") {
+        serverConfig = {
+            type: parsed.transport,
+            url: commandOrUrl,
+            ...(Object.keys(parsed.headers).length > 0 ? { headers: parsed.headers } : {}),
+            ...(oauthBlock(parsed) ? { oauth: oauthBlock(parsed) } : {}),
+        };
+    }
+    else {
+        if (parsed.clientId || parsed.clientSecret || parsed.callbackPort) {
+            io.stderr(`Warning: --client-id, --client-secret, and --callback-port are only supported for HTTP/SSE transports and will be ignored for stdio.\n`);
+        }
+        if (!parsed.transportExplicit && looksLikeUrl(commandOrUrl)) {
+            io.stderr(`Warning: "${commandOrUrl}" looks like a URL but is being interpreted as a stdio command (--transport not specified).\n` +
+                `If this is an HTTP server: ${DISTRIBUTION.commandName} mcp add --transport http ${name} ${commandOrUrl}\n` +
+                `If this is an SSE server: ${DISTRIBUTION.commandName} mcp add --transport sse ${name} ${commandOrUrl}\n`);
+        }
+        serverConfig = {
+            type: "stdio",
+            command: commandOrUrl,
+            ...(stdioArgs.length > 0 ? { args: stdioArgs } : {}),
+            ...(Object.keys(parsed.env).length > 0 ? { env: parsed.env } : {}),
+        };
+    }
+    return persistAdd(mod, name, serverConfig, parsed, io);
+}
+function mcpAddJson(mod, parsed, io) {
+    const { name } = parsed;
+    const json = parsed.rest[1];
+    if (!name || !json) {
+        io.stderr(`Error: name and JSON are required.\nUsage: ${DISTRIBUTION.commandName} mcp add-json <name> '<json>'\n`);
+        return 1;
+    }
+    let parsedJson;
+    try {
+        parsedJson = JSON.parse(json);
+    }
+    catch (err) {
+        io.stderr(`Error: invalid JSON (${err instanceof Error ? err.message : String(err)})\n`);
+        return 1;
+    }
+    const type = typeof parsedJson["type"] === "string" ? parsedJson["type"] : "stdio";
+    io.stdout(`Adding ${type} MCP server ${name} to ${parsed.scope} config\n`);
+    return persistAdd(mod, name, parsedJson, parsed, io);
+}
+function persistAdd(mod, name, serverConfig, parsed, io) {
+    const validation = validateConfigShape(serverConfig);
+    if (!validation.ok) {
+        io.stderr(`Error: ${validation.message}\n`);
+        return 1;
+    }
+    try {
+        writeServerToScope(mod, name, serverConfig, parsed.scope, io.cwd);
+        if (parsed.clientSecret) {
+            const secret = readClientSecret(io);
+            if (secret) {
+                mod.updateStoredOAuthEntry(name, serverConfig, (entry) => {
+                    entry.clientSecret = secret;
+                });
+            }
+            else {
+                io.stderr(`Warning: no client secret supplied — it will be prompted at connect time if the server requires one.\n`);
+            }
+        }
+        io.stdout(`Added ${serverConfig["type"] ?? "stdio"} MCP server ${name} to ${parsed.scope} config\n`);
+        io.stdout(`File modified: ${describeScopePath(parsed.scope, io.cwd)}\n`);
+        return 0;
+    }
+    catch (err) {
+        io.stderr(`Error: ${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+}
+function oauthBlock(parsed) {
+    if (!parsed.clientId && !parsed.callbackPort)
+        return undefined;
+    return {
+        ...(parsed.clientId ? { clientId: parsed.clientId } : {}),
+        ...(parsed.callbackPort ? { callbackPort: parsed.callbackPort } : {}),
+    };
+}
+function readClientSecret(io) {
+    // Secret comes from MCP_CLIENT_SECRET env when present; otherwise from stdin
+    // (TTY prompt). The CLI has no interactive password input, so env is the
+    // documented path, mirroring Claude Code's readClientSecret.
+    const envSecret = process.env.MCP_CLIENT_SECRET;
+    if (envSecret)
+        return envSecret;
+    io.stderr(`Set MCP_CLIENT_SECRET to supply the client secret (a plain stdin prompt is not supported in this CLI).\n`);
+    return undefined;
+}
+function validateConfigShape(config) {
+    const type = config["type"];
+    if (type === undefined || type === "stdio") {
+        if (typeof config["command"] !== "string" || config["command"].length === 0) {
+            return { ok: false, message: 'stdio server requires a non-empty "command"' };
+        }
+        return { ok: true };
+    }
+    if (type === "http" || type === "sse") {
+        if (typeof config["url"] !== "string" || config["url"].length === 0) {
+            return { ok: false, message: `${type} server requires a non-empty "url"` };
+        }
+        return { ok: true };
+    }
+    return { ok: false, message: 'unknown "type" — expected stdio, http, or sse' };
+}
+function writeServerToScope(mod, name, config, scope, cwd) {
+    if (scope === "project") {
+        const path = join(cwd, mod.PROJECT_CONFIG_FILENAME);
+        let file;
+        try {
+            file = JSON.parse(readFileSync(path, "utf-8"));
+        }
+        catch {
+            file = {};
+        }
+        file.mcpServers = { ...(file.mcpServers ?? {}), [name]: config };
+        // Project .mcp.json is hand-shareable: no atomic rename dance, match the
+        // simple write the repo would expect from a git-managed file.
+        writeFileSync(path, JSON.stringify(file, null, 2) + "\n");
+        return;
+    }
+    const { file, errors } = mod.readUserMcpConfig();
+    if (errors.length > 0)
+        throw new Error(`could not read ${mod.mcpConfigPath()} — fix or remove the file first`);
+    const userFile = file;
+    if (scope === "user") {
+        userFile.mcpServers = { ...(userFile.mcpServers ?? {}), [name]: config };
+    }
+    else {
+        const projects = userFile.projects ?? {};
+        const entry = projects[cwd] ?? {};
+        entry.mcpServers = { ...(entry.mcpServers ?? {}), [name]: config };
+        projects[cwd] = entry;
+        userFile.projects = projects;
+    }
+    mod.writeUserMcpConfig(userFile);
+}
+async function mcpRemove(mod, parsed, io) {
+    const { name } = parsed;
+    if (!name) {
+        io.stderr(`Error: name is required.\nUsage: ${DISTRIBUTION.commandName} mcp remove <name> [-s scope]\n`);
+        return 1;
+    }
+    // An explicit -s selects that scope. Without one, remove the name from
+    // every scope file it exists in (raw reads, not the merged view, since a
+    // name defined in several scopes only surfaces once after merging).
+    // An explicit -s acts on the raw scope file, not the merged view — a
+    // local server can shadow a user one with the same name, and the merged
+    // view would then hide the very scope being targeted.
+    if (parsed.scopeExplicit) {
+        let removed = false;
+        try {
+            removed = removeServerFromScope(mod, name, parsed.scope, io.cwd);
+        }
+        catch (err) {
+            io.stderr(`Error removing ${name} from ${parsed.scope}: ${err instanceof Error ? err.message : String(err)}\n`);
+            return 1;
+        }
+        if (!removed) {
+            io.stderr(`No MCP server "${name}" in ${parsed.scope} scope.\n`);
+            return 1;
+        }
+        await revokeOnRemove(mod, name, io);
+        io.stdout(`Removed ${name} from ${parsed.scope} config\n`);
+        return 0;
+    }
+    await revokeOnRemove(mod, name, io);
+    let removed = 0;
+    const removedScopes = [];
+    for (const scope of ["local", "user", "project"]) {
+        try {
+            if (removeServerFromScope(mod, name, scope, io.cwd)) {
+                removed++;
+                removedScopes.push(scope);
+            }
+        }
+        catch {
+            // unreadable scope file — treat as absent
+        }
+    }
+    if (removed === 0) {
+        io.stderr(`No MCP server found with name: ${name}\n`);
+        return 1;
+    }
+    for (const scope of removedScopes)
+        io.stdout(`Removed ${name} from ${scope} config\n`);
+    return 0;
+}
+/**
+ * Revoke OAuth tokens for a server before it is removed. Reads the merged
+ * server config for `name` to get its type/url, and only acts on http/sse
+ * servers (stdio has no OAuth). Best-effort and never throws — removal must
+ * proceed even if the server's auth endpoint is unreachable.
+ */
+async function revokeOnRemove(mod, name, io) {
+    try {
+        const loaded = mod.loadMcpServers(io.cwd, process.env);
+        const found = loaded.servers.find((s) => s.name === name);
+        if (!found)
+            return;
+        const config = found.config;
+        if (config.type !== "http" && config.type !== "sse")
+            return;
+        await mod.revokeTokensOnRemove(name, config);
+    }
+    catch {
+        // best-effort
+    }
+}
+function removeServerFromScope(mod, name, scope, cwd) {
+    let removed = false;
+    if (scope === "project") {
+        const path = join(cwd, mod.PROJECT_CONFIG_FILENAME);
+        const file = JSON.parse(readFileSync(path, "utf-8"));
+        if (file.mcpServers && name in file.mcpServers) {
+            delete file.mcpServers[name];
+            writeFileSync(path, JSON.stringify(file, null, 2) + "\n");
+            removed = true;
+        }
+        return removed;
+    }
+    const { file, errors } = mod.readUserMcpConfig();
+    if (errors.length > 0)
+        throw new Error(`could not read ${mod.mcpConfigPath()}`);
+    const userFile = file;
+    if (scope === "user" && userFile.mcpServers && name in userFile.mcpServers) {
+        delete userFile.mcpServers[name];
+        if (Object.keys(userFile.mcpServers).length === 0)
+            delete userFile.mcpServers;
+        removed = true;
+    }
+    if (scope === "local") {
+        const projects = userFile.projects ?? {};
+        const entry = projects[cwd];
+        if (entry?.mcpServers && name in entry.mcpServers) {
+            delete entry.mcpServers[name];
+            if (Object.keys(entry.mcpServers).length === 0)
+                delete entry.mcpServers;
+            if (Object.keys(entry).length === 0)
+                delete projects[cwd];
+            else
+                projects[cwd] = entry;
+            userFile.projects = projects;
+            removed = true;
+        }
+    }
+    if (removed)
+        mod.writeUserMcpConfig(userFile);
+    return removed;
+}
+async function mcpGet(mod, parsed, io) {
+    const { name } = parsed;
+    if (!name) {
+        io.stderr(`Error: name is required.\nUsage: ${DISTRIBUTION.commandName} mcp get <name>\n`);
+        return 1;
+    }
+    const loaded = mod.loadMcpServers(io.cwd, io.env);
+    const server = loaded.servers.find((s) => s.name === name);
+    if (!server) {
+        io.stderr(`No MCP server found with name: ${name}\n`);
+        return 1;
+    }
+    io.stdout(`${name}:\n`);
+    io.stdout(`  Scope: ${scopeLabel(server.scope)}\n`);
+    const config = server.config;
+    if (config["type"] === "http" || config["type"] === "sse") {
+        io.stdout(`  Type: ${config["type"]}\n`);
+        io.stdout(`  URL: ${config["url"]}\n`);
+        for (const [key, value] of Object.entries(config["headers"] ?? {})) {
+            io.stdout(`  Header: ${key}: ${value}\n`);
+        }
+        printOAuthDetail(mod, name, server.config, io.stdout);
+    }
+    else {
+        io.stdout(`  Type: stdio\n`);
+        io.stdout(`  Command: ${config["command"]}\n`);
+        const args = Array.isArray(config["args"]) ? config["args"] : [];
+        if (args.length > 0)
+            io.stdout(`  Args: ${args.join(" ")}\n`);
+        for (const [key, value] of Object.entries(config["env"] ?? {})) {
+            io.stdout(`  Env: ${key}=${value}\n`);
+        }
+    }
+    if (server.scope === "project") {
+        const { state } = mod.readProjectApproval(mod.resolveProjectRoot(io.cwd));
+        const decision = mod.decisionFor(state, name);
+        io.stdout(`  Approved: ${decision === "enabled" ? "yes" : decision === "disabled" ? "no" : "not yet decided"}\n`);
+    }
+    io.stdout(`  Config file: ${server.sourcePath}\n`);
+    io.stdout(await healthLine(mod, server, io));
+    io.stdout(`\nTo remove this server, run: ${DISTRIBUTION.commandName} mcp remove "${name}"\n`);
+    return 0;
+}
+function printOAuthDetail(mod, name, config, stdout) {
+    const cfg = config;
+    const oauth = cfg["oauth"] ?? {};
+    const clientId = typeof oauth["clientId"] === "string" ? oauth["clientId"] : undefined;
+    const callbackPort = typeof oauth["callbackPort"] === "number" ? oauth["callbackPort"] : undefined;
+    const stored = mod.getStoredOAuthEntry(name, config);
+    if (clientId || callbackPort || stored?.clientSecret) {
+        stdout(`  OAuth: client_id ${clientId ? "configured" : "(DCR)"}, client_secret ${stored?.clientSecret ? "configured" : "not set"}${callbackPort ? `, callback_port ${callbackPort}` : ""}\n`);
+    }
+}
+async function healthLine(mod, server, io) {
+    // Approval gate: an undecided/disabled project server is reported WITHOUT
+    // connecting (fail-closed — never spawn an unapproved process).
+    if (server.scope === "project") {
+        const { state } = mod.readProjectApproval(mod.resolveProjectRoot(io.cwd));
+        const decision = mod.decisionFor(state, server.name);
+        if (decision === "disabled")
+            return `  Status: ! disabled (not approved for this project)\n`;
+        if (decision === "undecided")
+            return `  Status: ! not yet approved — run /mcp to approve it\n`;
+    }
+    const result = await (io.probeServer ?? mod.probeServer)(server.name, server.config, { env: io.env });
+    if (result.status === "connected")
+        return `  Status: ✓ connected\n`;
+    if (result.status === "needs_auth")
+        return `  Status: ! needs authentication\n`;
+    return `  Status: ✗ failed to connect${result.error ? ` — ${result.error}` : ""}\n`;
+}
+async function mcpList(mod, io) {
+    const { servers, errors } = mod.loadMcpServers(io.cwd, io.env);
+    if (servers.length === 0 && errors.length === 0) {
+        io.stdout("No MCP servers configured.\n");
+        io.stdout(`Use \`${DISTRIBUTION.commandName} mcp add\` to add a server.\n`);
+        return 0;
+    }
+    const lines = [];
+    const byScope = { user: [], project: [], local: [] };
+    for (const s of servers)
+        (byScope[s.scope] ??= []).push(s);
+    for (const scope of ["local", "project", "user"]) {
+        const group = byScope[scope];
+        if (!group?.length)
+            continue;
+        lines.push(`${scope === "local" ? "Local" : scope === "project" ? "Project" : "User"} servers:`);
+        for (const s of group) {
+            const status = await listHealthLine(mod, s, io);
+            lines.push(`  ${s.name} · ${status}`);
+        }
+    }
+    for (const err of errors)
+        lines.push(`  ⚠ ${err.serverName ? `${err.serverName}: ` : ""}${err.message}`);
+    lines.push("");
+    lines.push(`Run \`${DISTRIBUTION.commandName} mcp get <name>\` for a server's full config.`);
+    io.stdout(lines.join("\n"));
+    return 0;
+}
+async function listHealthLine(mod, server, io) {
+    if (server.scope === "project") {
+        const { state } = mod.readProjectApproval(mod.resolveProjectRoot(io.cwd));
+        const decision = mod.decisionFor(state, server.name);
+        if (decision === "disabled")
+            return "! disabled";
+        if (decision === "undecided")
+            return "! not approved";
+    }
+    const result = await (io.probeServer ?? mod.probeServer)(server.name, server.config, { env: io.env });
+    if (result.status === "connected")
+        return "✓ connected";
+    if (result.status === "needs_auth")
+        return "! needs auth";
+    return `✗ ${result.error ?? "failed"}`;
+}
+function scopeLabel(scope) {
+    if (scope === "local")
+        return "Local config (private to you in this project)";
+    if (scope === "project")
+        return "Project config (shared via .mcp.json)";
+    return "User config (available in all your projects)";
+}
+function mcpResetChoices(mod, io) {
+    const repoRoot = mod.resolveProjectRoot(io.cwd);
+    const { errors } = mod.resetProjectChoices(repoRoot);
+    if (errors.length > 0) {
+        io.stderr(`Error: could not reset project choices (${errors[0]?.message ?? "unknown"}).\n`);
+        return 1;
+    }
+    io.stdout(`Reset all approved and rejected project-scoped (.mcp.json) servers in this project.\n`);
+    return 0;
+}
+function mcpAddFromClaude(mod, parsed, io) {
+    const claudePath = join(io.home, ".claude.json");
+    let claude;
+    try {
+        claude = JSON.parse(readFileSync(claudePath, "utf-8"));
+    }
+    catch {
+        io.stderr(`No Claude Code config found at ${claudePath} — nothing to import.\n`);
+        return 1;
+    }
+    const userServers = claude.mcpServers ?? {};
+    const localServers = (claude.projects ?? {})[io.cwd]?.mcpServers ?? {};
+    const total = Object.keys(userServers).length + Object.keys(localServers).length;
+    if (total === 0) {
+        io.stdout(`No MCP servers found in Claude Code config (user or this project).\n`);
+        return 0;
+    }
+    let imported = 0;
+    const skipped = [];
+    const warned = [];
+    /**
+     * An imported config may reference ${VAR} env vars that Claude Code expanded
+     * in its own shell. We import verbatim (the raw reference is the correct
+     * stored form) but warn when a var is not set in THIS shell, with the export
+     * line to fix it — the var may legitimately be set only in the shell that
+     * runs sessions. The canonical expandServerEnv walks every expandable field
+     * (url, headers, stdio command/args/env), so the warning can never diverge
+     * from what the session will actually fail on.
+     */
+    const warnUnsetEnvVars = (name, config) => {
+        if (typeof config !== "object" || config === null)
+            return;
+        if (typeof mod.expandServerEnv !== "function")
+            return;
+        const { missingVars } = mod.expandServerEnv(config, process.env);
+        if (missingVars.length > 0) {
+            const names = missingVars.join(", ");
+            io.stderr(`Note: ${name} references ${names} — not currently set in this shell. ` +
+                `It will expand at connect time; export it (e.g. export ${missingVars[0]}=... in your shell profile) before your next session, or the server will report a missing-variable error.\n`);
+            warned.push(name);
+        }
+    };
+    // Claude Code's user scope maps to yagni user scope (unless -s local is
+    // explicit); its per-project entries map to yagni local scope for this cwd.
+    const claudeUserTarget = parsed.scopeExplicit && parsed.scope === "local" ? "local" : "user";
+    for (const [name, config] of Object.entries(userServers)) {
+        if (!isImportable(config)) {
+            skipped.push(name);
+            continue;
+        }
+        try {
+            writeServerToScope(mod, name, config, claudeUserTarget, io.cwd);
+            warnUnsetEnvVars(name, config);
+            io.stdout(`Imported ${name} (Claude Code user scope → ${claudeUserTarget})\n`);
+            imported++;
+        }
+        catch (err) {
+            io.stderr(`Skipped ${name}: ${err instanceof Error ? err.message : String(err)}\n`);
+            skipped.push(name);
+        }
+    }
+    for (const [name, config] of Object.entries(localServers)) {
+        if (!isImportable(config)) {
+            skipped.push(name);
+            continue;
+        }
+        try {
+            writeServerToScope(mod, name, config, "local", io.cwd);
+            warnUnsetEnvVars(name, config);
+            io.stdout(`Imported ${name} (this project, from Claude Code → local)\n`);
+            imported++;
+        }
+        catch (err) {
+            io.stderr(`Skipped ${name}: ${err instanceof Error ? err.message : String(err)}\n`);
+            skipped.push(name);
+        }
+    }
+    if (skipped.length > 0)
+        io.stderr(`Skipped (unsupported config shape): ${skipped.join(", ")}\n`);
+    io.stdout(`Imported ${imported} server(s) from Claude Code${warned.length > 0 ? ` (${warned.length} with env-var notes)` : ""}.\n`);
+    return imported > 0 ? 0 : 1;
+}
+function isImportable(config) {
+    const validation = validateConfigShape((typeof config === "object" && config !== null ? config : {}));
+    return validation.ok;
+}
+//# sourceMappingURL=mcpCommand.js.map