@yeaft/webchat-agent 1.0.408 → 1.0.410

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yeaft/webchat-agent",
-  "version": "1.0.408",
+  "version": "1.0.410",
   "description": "Remote worker agent for Yeaft Web Code Agent — connects the native Yeaft engine, CLI providers, and workbench tools",
   "main": "index.js",
   "type": "module",

package/workbench/file-ops.js

@@ -6,7 +6,7 @@ import ctx from '../context.js';
 import { resolveAndValidatePath, BINARY_EXTENSIONS } from './utils.js';
 
 export async function handleReadFile(msg) {
-  const { conversationId, filePath, _requestUserId } = msg;
+  const { conversationId, filePath, requestId, _requestUserId, _requestClientId } = msg;
   console.log('[Agent] handleReadFile received:', { filePath, conversationId, workDir: msg.workDir });
   const conv = ctx.conversations.get(conversationId);
   const workDir = msg.workDir || conv?.workDir || ctx.CONFIG.workDir;
@@ -23,7 +23,9 @@ export async function handleReadFile(msg) {
       ctx.sendToServer({
         type: 'file_content',
         conversationId,
+        requestId,
         _requestUserId,
+        _requestClientId,
         filePath: resolved,
         requestedFilePath: filePath,
         content: buffer.toString('base64'),
@@ -57,7 +59,9 @@ export async function handleReadFile(msg) {
       ctx.sendToServer({
         type: 'file_content',
         conversationId,
+        requestId,
         _requestUserId,
+        _requestClientId,
         filePath: resolved,
         requestedFilePath: filePath,
         content,
@@ -68,7 +72,9 @@ export async function handleReadFile(msg) {
     ctx.sendToServer({
       type: 'file_content',
       conversationId,
+      requestId,
       _requestUserId,
+      _requestClientId,
       filePath,
       requestedFilePath: filePath,
       content: '',
@@ -78,7 +84,7 @@ export async function handleReadFile(msg) {
 }
 
 export async function handleWriteFile(msg) {
-  const { conversationId, filePath, content, _requestUserId } = msg;
+  const { conversationId, filePath, content, requestId, _requestUserId, _requestClientId } = msg;
   const conv = ctx.conversations.get(conversationId);
   const workDir = msg.workDir || conv?.workDir || ctx.CONFIG.workDir;
 
@@ -89,16 +95,22 @@ export async function handleWriteFile(msg) {
     ctx.sendToServer({
       type: 'file_saved',
       conversationId,
+      requestId,
       _requestUserId,
+      _requestClientId,
       filePath: resolved,
+      requestedFilePath: filePath,
       success: true
     });
   } catch (e) {
     ctx.sendToServer({
       type: 'file_saved',
       conversationId,
+      requestId,
       _requestUserId,
+      _requestClientId,
       filePath,
+      requestedFilePath: filePath,
       success: false,
       error: e.message
     });

package/yeaft/cli-session-runner.js

@@ -2,6 +2,7 @@ import { randomUUID } from 'node:crypto';
 import { join } from 'node:path';
 import { Engine } from './engine.js';
 import { createRouter } from './routing/router.js';
+import { createLoopGuard } from './routing/loop-guard.js';
 import { createCoordinator } from './sessions/coordinator.js';
 import { resolveMemberId } from './sessions/roster.js';
 import { sessionsRoot } from './sessions/session-crud.js';
@@ -10,6 +11,86 @@ import { loadSessionConfig, resolveSessionConfig } from './sessions/session-conf
 import { readVp } from './vp/vp-crud.js';
 import { COLLAB_TOOL_POLICY } from './tools/registry.js';
 
+const MAX_ROUTE_FORWARD_RESULT_CHARS = 12_000;
+const MAX_ROUTE_FORWARD_PROMPT_CHARS = 60_000;
+
+function cleanString(value) {
+  return typeof value === 'string' && value.trim() ? value.trim() : null;
+}
+
+function routeForwardCompletionFor(row) {
+  const envelope = row?.envelope;
+  const meta = envelope?.msg?.meta;
+  if (!meta || row?.stopReason === 'tool_handoff' || row?.stopReason === 'aborted') return null;
+  const parent = meta.injectedBy === 'route_forward_result'
+    && meta.routeForwardParent
+    && typeof meta.routeForwardParent === 'object'
+    ? meta.routeForwardParent
+    : null;
+  if (meta.injectedBy !== 'route_forward' && !parent) return null;
+  const sourceVpId = cleanString(parent?.sourceVpId ?? meta.senderVpId);
+  const forwardId = cleanString(parent?.forwardId ?? envelope?.msg?.id);
+  if (!sourceVpId || !forwardId || sourceVpId === row.vpId) return null;
+  const rawExpectedVpIds = parent?.expectedVpIds ?? meta.routeForwardExpectedTargets;
+  const expectedVpIds = Array.isArray(rawExpectedVpIds)
+    ? [...new Set(rawExpectedVpIds.map(cleanString).filter(Boolean))]
+    : [row.vpId];
+  if (!expectedVpIds.includes(row.vpId)) return null;
+  return {
+    forwardId,
+    sourceVpId,
+    sourceThreadId: cleanString(parent?.sourceThreadId ?? meta.sourceThreadId) || 'main',
+    causedBy: Array.isArray(parent?.causedBy ?? meta.causedBy)
+      ? (parent?.causedBy ?? meta.causedBy).slice()
+      : [],
+    dispatchErrors: [
+      ...(Array.isArray(parent?.dispatchErrors) ? parent.dispatchErrors : []),
+      ...(Array.isArray(meta.routeForwardDispatchErrors) ? meta.routeForwardDispatchErrors : []),
+    ],
+    truncatedAtFanOutCap: Boolean(parent?.truncatedAtFanOutCap)
+      || Boolean(meta.routeForwardTruncatedAtFanOutCap),
+    parentRouteForward: parent?.parentRouteForward
+      || (meta.injectedBy === 'route_forward' ? (meta.routeForwardParent || null) : null),
+    expectedVpIds,
+    vpId: row.vpId,
+    result: row.result || '',
+    error: row.error || null,
+    stopReason: row.stopReason || 'end_turn',
+    envelope,
+  };
+}
+
+function formatRouteForwardResult(aggregate, results) {
+  const sections = results.map((entry) => {
+    const rawBody = entry.error
+      ? `Error: ${entry.error.message || String(entry.error)}`
+      : (entry.result || '(no text returned)');
+    const body = rawBody.length > MAX_ROUTE_FORWARD_RESULT_CHARS
+      ? `${rawBody.slice(0, MAX_ROUTE_FORWARD_RESULT_CHARS)}\n[Result truncated]`
+      : rawBody;
+    return `[${entry.vpId} — ${entry.stopReason}]\n${body}`;
+  });
+  const notices = [];
+  if (aggregate.truncatedAtFanOutCap) {
+    notices.push('Warning: the requested fan-out was truncated at the Session limit.');
+  }
+  if (aggregate.dispatchErrors.length > 0) {
+    notices.push(`Dispatch errors: ${JSON.stringify(aggregate.dispatchErrors)}`);
+  }
+  const prompt = [
+    '[RouteForward result]',
+    notices.length > 0
+      ? 'The accepted delegated VP work has finished, but dispatch was partial. Continue the same user request using the results and warnings below.'
+      : 'The delegated VP work has finished. Continue the same user request using the result below.',
+    ...notices,
+    '',
+    ...sections,
+  ].join('\n');
+  return prompt.length > MAX_ROUTE_FORWARD_PROMPT_CHARS
+    ? `${prompt.slice(0, MAX_ROUTE_FORWARD_PROMPT_CHARS)}\n[Combined RouteForward results truncated]`
+    : prompt;
+}
+
 function buildVpPersona(vpId, loaded) {
   const vp = readVp(vpId, { libDir: join(loaded.yeaftDir, 'virtual-persons') });
   if (!vp) return null;
@@ -79,6 +160,8 @@ export function createCliSessionRunner({
   // new row carries one durable causalRootId; the legacy ids remain fallbacks
   // for rows produced before that field existed.
   const rootOrderByIdentity = new Map();
+  const activeTurnContexts = new Map();
+  const routeForwardGuard = createLoopGuard();
   let nextRootOrder = 0;
   let closed = false;
 
@@ -107,6 +190,8 @@ export function createCliSessionRunner({
     const rootOrder = Number.isInteger(envelope?._cliRootOrder)
       ? envelope._cliRootOrder
       : null;
+    const inboundMessageId = cleanString(envelope?.msg?.id);
+    const includeCurrentRoot = envelope?.msg?.meta?.injectedBy === 'route_forward_result';
     // Engine.query() appends `prompt` itself. Exclude this root's durable user
     // row and every later root turn, regardless of where their assistant/tool
     // rows landed in the globally sequenced transcript. This preserves rows
@@ -115,6 +200,10 @@ export function createCliSessionRunner({
     const messages = loaded.conversationStore
       .loadSessionHistoryForVp(sessionId, vpId)
       .filter((message) => {
+        if (inboundMessageId
+            && (message?.id === inboundMessageId || message?.messageId === inboundMessageId)) {
+          return false;
+        }
         if (persistedUserClientMessageId
             && message?.role === 'user'
             && message.clientMessageId === persistedUserClientMessageId) return false;
@@ -129,11 +218,14 @@ export function createCliSessionRunner({
         } else if (typeof message?.turnId === 'string') {
           messageRootOrder = rootOrderByIdentity.get(message.turnId);
         }
-        return !Number.isInteger(messageRootOrder) || messageRootOrder < rootOrder;
+        return !Number.isInteger(messageRootOrder)
+          || messageRootOrder < rootOrder
+          || (includeCurrentRoot && messageRootOrder === rootOrder);
       });
     const todos = [];
     let resultText = '';
     let failed = null;
+    let stopReason = null;
     const scopedCoordinator = {
       group: coordinator.group,
       ingest(input, opts) {
@@ -158,7 +250,7 @@ export function createCliSessionRunner({
       sessionMembers: meta.roster.slice(),
       sessionAnnouncement: meta.announcement || '',
       vpPersona: personaFactory(vpId, loaded),
-      router: createRouter({ coordinator: scopedCoordinator }),
+      router: createRouter({ coordinator: scopedCoordinator, guard: routeForwardGuard }),
       inboundEnvelope: envelope,
       userAlreadyPersisted: true,
       causalRootId,
@@ -177,6 +269,8 @@ export function createCliSessionRunner({
       userEffort: options.modelEffort || null,
     };
 
+    const turnContext = envelope?._cliTurnContext;
+    turnContext?.activeEngines.add(engine);
     try {
       for await (const event of engine.query(queryOptions)) {
         if (event.type === 'text_delta') resultText += event.text || '';
@@ -185,6 +279,11 @@ export function createCliSessionRunner({
             ? event.error
             : new Error(String(event.error?.message || event.error || 'Unknown Engine error'));
         }
+        if (event.type === 'turn_end' && event.terminal && event.stopReason) {
+          stopReason = event.stopReason;
+        } else if (event.type === 'stop' && event.stopReason) {
+          stopReason = event.stopReason;
+        }
         await options.onEvent?.({ vpId, event, sessionId, turnId: queryOptions.vpTurnId });
       }
     } catch (error) {
@@ -195,20 +294,53 @@ export function createCliSessionRunner({
         turnId: queryOptions.vpTurnId,
         event: { type: 'error', error, retryable: false },
       });
+    } finally {
+      turnContext?.activeEngines.delete(engine);
     }
-    return { vpId, result: resultText, error: failed };
+    return {
+      vpId,
+      result: resultText,
+      error: failed,
+      stopReason: failed ? 'error' : (stopReason || 'end_turn'),
+      envelope,
+    };
   };
 
   const enqueue = (vpId, envelope) => {
     if (closed) throw new Error('CLI Session runner is closed');
     const turnContext = envelope?._cliTurnContext;
     if (!turnContext) throw new Error('CLI Session envelope is missing its turn context');
-    if (turnContext.claimedVpIds.has(vpId)) {
+    if (turnContext.cancellation.cancelled) {
+      return Promise.resolve({
+        vpId,
+        result: '',
+        error: null,
+        stopReason: 'aborted',
+        envelope,
+      });
+    }
+    const routeForwardResultId = cleanString(envelope?.msg?.meta?.routeForwardId);
+    const isRouteForwardResult = envelope?.msg?.meta?.injectedBy === 'route_forward_result'
+      && cleanString(envelope?.msg?.meta?.routeTargetVpId) === vpId
+      && routeForwardResultId
+      && turnContext.routeForwardReturnIds.has(routeForwardResultId);
+    if (turnContext.claimedVpIds.has(vpId) && !isRouteForwardResult) {
       return { ok: false, error: 'target_already_claimed' };
     }
-    turnContext.claimedVpIds.add(vpId);
+    if (!isRouteForwardResult) turnContext.claimedVpIds.add(vpId);
     const previous = tails.get(vpId) || Promise.resolve();
-    const task = previous.catch(() => {}).then(() => runEnvelope(vpId, envelope, turnContext.options));
+    const task = previous.catch(() => {}).then(() => {
+      if (turnContext.cancellation.cancelled) {
+        return {
+          vpId,
+          result: '',
+          error: null,
+          stopReason: 'aborted',
+          envelope,
+        };
+      }
+      return runEnvelope(vpId, envelope, turnContext.options);
+    });
     tails.set(vpId, task);
     pending.add(task);
     turnContext.tasks.push(task);
@@ -221,6 +353,56 @@ export function createCliSessionRunner({
 
   coordinator = createCoordinator(handle, { deliver: enqueue });
 
+  const enqueueRouteForwardReturns = (completed, turnContext) => {
+    if (turnContext.cancellation.cancelled) return;
+    for (const row of completed) {
+      const completion = routeForwardCompletionFor(row);
+      if (!completion) continue;
+      let aggregate = turnContext.routeForwardReturns.get(completion.forwardId);
+      if (!aggregate) {
+        aggregate = {
+          ...completion,
+          results: new Map(),
+        };
+        turnContext.routeForwardReturns.set(completion.forwardId, aggregate);
+      }
+      aggregate.results.set(completion.vpId, completion);
+      if (turnContext.routeForwardReturnIds.has(completion.forwardId)
+          || !aggregate.expectedVpIds.every(vpId => aggregate.results.has(vpId))) continue;
+
+      // A RouteForward can return to its source exactly once. The source
+      // remains claimed for the root turn, so this explicit, internally
+      // marked continuation is the only allowed re-entry path.
+      turnContext.routeForwardReturnIds.add(completion.forwardId);
+      const results = aggregate.expectedVpIds.map(vpId => aggregate.results.get(vpId));
+      const representative = results[0];
+      coordinator.ingest({
+        id: randomUUID(),
+        from: representative.vpId,
+        role: 'assistant',
+        text: formatRouteForwardResult(aggregate, results),
+        internal: true,
+        meta: {
+          synthetic: true,
+          injectedBy: 'route_forward_result',
+          routeTargetVpId: aggregate.sourceVpId,
+          senderVpId: representative.vpId,
+          sourceThreadId: aggregate.sourceThreadId,
+          routeForwardId: aggregate.forwardId,
+          ...(aggregate.parentRouteForward
+            ? { routeForwardParent: aggregate.parentRouteForward }
+            : {}),
+          causedBy: aggregate.causedBy,
+          routeForwardDispatchErrors: aggregate.dispatchErrors,
+          routeForwardTruncatedAtFanOutCap: aggregate.truncatedAtFanOutCap,
+        },
+        _cliRootOrder: representative.envelope?._cliRootOrder,
+        _cliCausalRootId: representative.envelope?._cliCausalRootId,
+        _cliTurnContext: turnContext,
+      });
+    }
+  };
+
   async function drain(tasks = pending) {
     const results = [];
     while (tasks.size > 0) {
@@ -263,12 +445,24 @@ export function createCliSessionRunner({
           explicit: routingIntent.explicit === true,
         });
       }
+      const messageId = randomUUID();
+      const cancellationId = cleanString(options.cancellationId) || messageId;
+      if (activeTurnContexts.has(cancellationId)) {
+        throw new Error(`CLI Session cancellation id ${cancellationId} is already active`);
+      }
       const turnContext = Object.freeze({
+        rootId: messageId,
+        cancellationId,
         options: Object.freeze({ ...options }),
         tasks: [],
         claimedVpIds: new Set(),
+        routeForwardReturns: new Map(),
+        routeForwardReturnIds: new Set(),
+        cancellation: { cancelled: false, reason: null },
+        activeEngines: new Set(),
       });
-      const messageId = randomUUID();
+      activeTurnContexts.set(cancellationId, turnContext);
+      try {
       const rootOrder = nextRootOrder++;
       rootOrderByIdentity.set(messageId, rootOrder);
       // The shared user row is the durability boundary. Validate structured
@@ -314,14 +508,29 @@ export function createCliSessionRunner({
       while (cursor < turnContext.tasks.length) {
         const batch = turnContext.tasks.slice(cursor);
         cursor += batch.length;
-        results.push(...await Promise.all(batch));
+        const completed = await Promise.all(batch);
+        results.push(...completed);
+        enqueueRouteForwardReturns(completed, turnContext);
         await Promise.resolve();
       }
       return { report, results };
+      } finally {
+        activeTurnContexts.delete(cancellationId);
+      }
     },
-    abort(reason = 'user') {
+    abort(reason = 'user', options = {}) {
+      const cancellationId = cleanString(options?.cancellationId);
+      const contexts = cancellationId
+        ? [activeTurnContexts.get(cancellationId)].filter(Boolean)
+        : Array.from(activeTurnContexts.values());
+      const enginesToAbort = new Set();
+      for (const turnContext of contexts) {
+        turnContext.cancellation.cancelled = true;
+        turnContext.cancellation.reason = reason;
+        for (const engine of turnContext.activeEngines) enginesToAbort.add(engine);
+      }
       let count = 0;
-      for (const engine of engines.values()) {
+      for (const engine of enginesToAbort) {
         if (engine.abort?.(reason)) count += 1;
       }
       return count;

package/yeaft/config-api.js

@@ -13,8 +13,33 @@ import { join } from 'path';
 import { DEFAULT_YEAFT_DIR } from './init.js';
 import { normalizeProviderModels, parseModelRef, serializeModelForPersistence } from './models.js';
 import { normaliseTelemetrySection, normaliseYeaftSection } from './config.js';
+import { normalizePluginConfig } from './plugins.js';
 import { isGitHubCopilotProvider, serializeKnownProviderForPersistence } from './llm/known-providers.js';
 
+/**
+ * Read config.json before any public mutation. A missing file is a valid
+ * first-run state, but an existing malformed file, non-object root, or invalid
+ * Plugins schema must never be replaced by an unrelated Settings/MCP write.
+ * Otherwise the runtime's fail-closed policy could silently become inheritance
+ * (all capabilities enabled) on the next config reload.
+ *
+ * @param {string} configPath
+ * @returns {Record<string, unknown>}
+ * @throws {Error} when an existing config cannot be safely preserved
+ */
+function readConfigForWrite(configPath) {
+  if (!existsSync(configPath)) return {};
+  const json = JSON.parse(readFileSync(configPath, 'utf8'));
+  if (!json || typeof json !== 'object' || Array.isArray(json)
+    || Object.getPrototypeOf(json) !== Object.prototype) {
+    throw new Error('config.json must contain an object');
+  }
+  if (Object.prototype.hasOwnProperty.call(json, 'plugins')) {
+    normalizePluginConfig(json.plugins);
+  }
+  return json;
+}
+
 /**
  * Read the LLM-relevant portion of config.json.
  *
@@ -119,15 +144,13 @@ export function updateLlmConfig(update, dir) {
   const root = dir || process.env.YEAFT_DIR || DEFAULT_YEAFT_DIR;
   const configPath = join(root, 'config.json');
 
-  // Read existing config (preserve non-LLM fields)
-  let existing = {};
-  if (existsSync(configPath)) {
-    try {
-      existing = JSON.parse(readFileSync(configPath, 'utf8'));
-    } catch {
-      // Start fresh if corrupt
-      existing = {};
-    }
+  // Preserve all existing fields only when the on-disk document and its
+  // Plugins policy are valid. Never turn a failed read into a fresh config.
+  let existing;
+  try {
+    existing = readConfigForWrite(configPath);
+  } catch (err) {
+    return { error: `Failed to read config.json: ${err?.message || err}` };
   }
 
   // Validate providers structure
@@ -265,14 +288,14 @@ export function updateYeaftSettings(update, dir) {
     }
   }
 
-  // Read existing config (preserve LLM and other top-level fields).
-  let existing = {};
-  if (existsSync(configPath)) {
-    try {
-      existing = JSON.parse(readFileSync(configPath, 'utf8'));
-    } catch {
-      existing = {};
-    }
+  // Preserve all existing fields only when the on-disk document and its
+  // Plugins policy are valid. A Settings update must not repair bad JSON into
+  // a config whose missing Plugins fields inherit all capabilities.
+  let existing;
+  try {
+    existing = readConfigForWrite(configPath);
+  } catch (err) {
+    return { error: `Failed to read config.json: ${err?.message || err}` };
   }
 
   const prev = normaliseYeaftSection(existing.yeaft);
@@ -336,7 +359,12 @@ export function updateTelemetrySettings(update, dir) {
   }
   const root = dir || process.env.YEAFT_DIR || DEFAULT_YEAFT_DIR;
   const configPath = join(root, 'config.json');
-  const existing = readConfigJson(configPath);
+  let existing;
+  try {
+    existing = readConfigForWrite(configPath);
+  } catch (err) {
+    return { error: `Failed to read config.json: ${err?.message || err}` };
+  }
   const merged = normaliseTelemetrySection({
     ...(existing.telemetry && typeof existing.telemetry === 'object' ? existing.telemetry : {}),
     ...update,
@@ -427,13 +455,11 @@ export function updateSearchSettings(update, dir) {
     return { error: 'tavilyApiKey must be a string' };
   }
 
-  let existing = {};
-  if (existsSync(configPath)) {
-    try {
-      existing = JSON.parse(readFileSync(configPath, 'utf8'));
-    } catch {
-      existing = {};
-    }
+  let existing;
+  try {
+    existing = readConfigForWrite(configPath);
+  } catch (err) {
+    return { error: `Failed to read config.json: ${err?.message || err}` };
   }
   const prev = (existing && typeof existing.search === 'object' && existing.search) || {};
   const merged = { ...prev };
@@ -500,6 +526,49 @@ export async function fetchTavilyUsage(dir) {
   }
 }
 
+// ─── Agent plugin selection ────────────────────────────────────
+
+/**
+ * Read the Agent-local plugin allowlists. Missing category fields mean
+ * inheritance (all discovered capabilities remain available).
+ */
+export function getPluginConfig(dir) {
+  const root = dir || process.env.YEAFT_DIR || DEFAULT_YEAFT_DIR;
+  const configPath = join(root, 'config.json');
+  try {
+    const json = readConfigForWrite(configPath);
+    return { plugins: normalizePluginConfig(json.plugins) };
+  } catch (err) {
+    return { error: `Failed to read plugin config: ${err?.message || err}` };
+  }
+}
+
+/**
+ * Persist Agent-local plugin allowlists without touching providers, MCP server
+ * definitions, or any other config.json field.
+ */
+export function updatePluginConfig(plugins, dir) {
+  const root = dir || process.env.YEAFT_DIR || DEFAULT_YEAFT_DIR;
+  const configPath = join(root, 'config.json');
+  let normalized;
+  let existing;
+  try {
+    existing = readConfigForWrite(configPath);
+    normalized = normalizePluginConfig(plugins);
+  } catch (err) {
+    return { error: `Failed to read plugin config: ${err?.message || err}` };
+  }
+
+  if (Object.keys(normalized).length === 0) delete existing.plugins;
+  else existing.plugins = normalized;
+  try {
+    writeFileSync(configPath, JSON.stringify(existing, null, 2) + '\n', 'utf8');
+  } catch (err) {
+    return { error: `Failed to write plugin config: ${err?.message || err}` };
+  }
+  return { plugins: normalized };
+}
+
 // ─── MCP server config (mcpServers array in config.json) ──
 
 /**
@@ -579,24 +648,6 @@ function validateMcpServer(entry) {
   return null;
 }
 
-/**
- * Read existing config.json (silently start fresh on missing / corrupt).
- * Internal helper used by the MCP CRUD trio to share one parse path.
- *
- * @param {string} configPath
- * @returns {object}
- */
-function readConfigJson(configPath) {
-  if (!existsSync(configPath)) return {};
-  try {
-    const raw = readFileSync(configPath, 'utf8');
-    const json = JSON.parse(raw);
-    return (json && typeof json === 'object') ? json : {};
-  } catch {
-    return {};
-  }
-}
-
 /**
  * List MCP servers currently saved in config.json. Returns an array — empty
  * when none configured. Each entry is the normalised on-disk shape, NOT
@@ -609,12 +660,12 @@ export function listMcpServers(dir) {
   const root = dir || process.env.YEAFT_DIR || DEFAULT_YEAFT_DIR;
   const configPath = join(root, 'config.json');
   try {
-    const json = readConfigJson(configPath);
+    const json = readConfigForWrite(configPath);
     const raw = Array.isArray(json.mcpServers) ? json.mcpServers : [];
     const servers = raw.map(normaliseMcpServer).filter(Boolean);
     return { servers };
-  } catch (e) {
-    return { error: `Failed to read config.json: ${e.message}` };
+  } catch (err) {
+    return { error: `Failed to read config.json: ${err?.message || err}` };
   }
 }
 
@@ -634,7 +685,12 @@ export function upsertMcpServer(server, dir) {
 
   const root = dir || process.env.YEAFT_DIR || DEFAULT_YEAFT_DIR;
   const configPath = join(root, 'config.json');
-  const existing = readConfigJson(configPath);
+  let existing;
+  try {
+    existing = readConfigForWrite(configPath);
+  } catch (err) {
+    return { error: `Failed to read config.json: ${err?.message || err}` };
+  }
   const list = Array.isArray(existing.mcpServers) ? existing.mcpServers.slice() : [];
 
   const normalised = normaliseMcpServer(server);
@@ -677,7 +733,12 @@ export function removeMcpServer(name, dir) {
   const target = name.trim();
   const root = dir || process.env.YEAFT_DIR || DEFAULT_YEAFT_DIR;
   const configPath = join(root, 'config.json');
-  const existing = readConfigJson(configPath);
+  let existing;
+  try {
+    existing = readConfigForWrite(configPath);
+  } catch (err) {
+    return { error: `Failed to read config.json: ${err?.message || err}` };
+  }
   const list = Array.isArray(existing.mcpServers) ? existing.mcpServers.slice() : [];
   const next = list.filter(s => !(s && typeof s === 'object' && s.name === target));
   const removed = next.length !== list.length;