@zvec/zvec-grep 0.1.9 → 0.2.1

package/dist/cli/install.js

@@ -1,46 +1,82 @@
+import { applyEdits, createScanner, findNodeAtLocation, modify, parse as parseJsonWithComments, parseTree, } from "jsonc-parser";
 import { randomUUID } from "node:crypto";
 import { constants as fileSystemConstants } from "node:fs";
 import { access, chmod, lstat, mkdir, open, readFile, readlink, rename, stat, unlink, } from "node:fs/promises";
 import { homedir } from "node:os";
 import { delimiter, dirname, resolve } from "node:path";
 import { createInterface } from "node:readline/promises";
+import { parseEnv } from "node:util";
+import { REMOTE_EMBEDDING_ELICITATION_UNSUPPORTED_MESSAGE } from "../authorization/prompt.js";
 import { resolveServerUrl } from "../client/mode-router.js";
 import { formatPromptRules, ZVEC_GREP_WORKSPACE_EVIDENCE_RULES, } from "../prompts/zvec-grep-guidance.js";
 const AGENT_INSTALLERS = [
     {
         id: "claude",
+        aliases: ["cc", "claude-code"],
         label: "Claude Code",
-        executable: "claude",
+        executables: ["claude"],
         install: installClaudeIntegration,
         uninstall: uninstallClaudeIntegration,
     },
     {
         id: "codex",
         label: "Codex",
-        executable: "codex",
+        executables: ["codex"],
         install: installCodexIntegration,
         uninstall: uninstallCodexIntegration,
     },
     {
         id: "opencode",
         label: "OpenCode",
-        executable: "opencode",
+        executables: ["opencode"],
         install: installOpenCodeIntegration,
         uninstall: uninstallOpenCodeIntegration,
     },
     {
         id: "cursor",
         label: "Cursor",
-        executable: "cursor",
+        executables: ["cursor"],
         install: installCursorIntegration,
         uninstall: uninstallCursorIntegration,
     },
+    {
+        id: "qwen",
+        aliases: ["qwen-code", "qwencode"],
+        label: "Qwen Code",
+        executables: ["qwen"],
+        install: installQwenIntegration,
+        uninstall: uninstallQwenIntegration,
+    },
+    {
+        id: "qoder",
+        label: "Qoder",
+        executables: ["qoder", "qodercli", "qoder-ide"],
+        detect: qoderIdeIsAvailable,
+        install: installQoderIntegration,
+        uninstall: uninstallQoderIntegration,
+    },
 ];
 const ZVEC_GREP_CONFIG_START = "# ZVEC_GREP_START";
 const ZVEC_GREP_CONFIG_END = "# ZVEC_GREP_END";
 const ZVEC_GREP_AGENTS_START = "<!-- ZVEC_GREP_START -->";
 const ZVEC_GREP_AGENTS_END = "<!-- ZVEC_GREP_END -->";
 const CLAUDE_MCP_PERMISSION = "mcp__zvec_grep__*";
+const NAMESPACED_SEARCH_TOOL = "mcp__zvec_grep__zvec_grep_search";
+const NAMESPACED_RG_TOOL = "mcp__zvec_grep__zvec_grep_rg";
+const QODER_MCP_PERMISSION_RULES = [
+    {
+        permission: NAMESPACED_SEARCH_TOOL,
+        tool: "zvec_grep_search",
+    },
+    {
+        permission: NAMESPACED_RG_TOOL,
+        tool: "zvec_grep_rg",
+    },
+];
+const QODER_MCP_PERMISSIONS = QODER_MCP_PERMISSION_RULES.map(({ permission }) => permission);
+const QODER_CLI_MCP_DESCRIPTION = "Managed by zg install";
+const QODER_PERMISSION_OWNERSHIP_PREFIX = `${QODER_CLI_MCP_DESCRIPTION}; managed permissions=`;
+const QODER_IDE_MCP_DESCRIPTION = "Managed by zg install";
 const DEFAULT_MCP_TOOL_TIMEOUT_SECONDS = 600;
 export async function runInstall(parsed) {
     printInstallHeader();
@@ -252,6 +288,86 @@ async function uninstallCursorIntegration() {
     await uninstallJsonMcpServer(configPath, "mcpServers");
     return { files: [configPath] };
 }
+async function installQwenIntegration(options) {
+    const qwenHome = await resolveQwenHome();
+    const settingsPath = resolve(qwenHome, "settings.json");
+    const guidancePath = resolve(qwenHome, "QWEN.md");
+    const warnings = await updateQwenSettings({
+        ...options,
+        path: settingsPath,
+    });
+    await writeMarkedFile({
+        path: guidancePath,
+        startMarker: ZVEC_GREP_AGENTS_START,
+        endMarker: ZVEC_GREP_AGENTS_END,
+        block: agentGuidanceBlock({
+            search: NAMESPACED_SEARCH_TOOL,
+            rg: NAMESPACED_RG_TOOL,
+        }),
+        force: true,
+    });
+    for (const warning of warnings) {
+        console.warn(`    warning   ${warning}`);
+    }
+    return { files: [settingsPath, guidancePath] };
+}
+async function uninstallQwenIntegration() {
+    const qwenHome = await resolveQwenHome();
+    const settingsPath = resolve(qwenHome, "settings.json");
+    const guidancePath = resolve(qwenHome, "QWEN.md");
+    await removeQwenSettings(settingsPath);
+    await removeMarkedFile({
+        path: guidancePath,
+        startMarker: ZVEC_GREP_AGENTS_START,
+        endMarker: ZVEC_GREP_AGENTS_END,
+    });
+    return { files: [settingsPath, guidancePath] };
+}
+async function installQoderIntegration(options) {
+    const qoderHome = resolveQoderHome();
+    const settingsPath = resolve(qoderHome, "settings.json");
+    const ideMcpPath = resolveQoderIdeMcpPath();
+    const guidancePath = resolve(qoderHome, "AGENTS.md");
+    await assertQoderMcpSettingsReplaceable(settingsPath, "Qoder CLI", options.force, isManagedJsonMcpServer);
+    await assertQoderPermissionSettingsValid(settingsPath);
+    await assertQoderMcpSettingsReplaceable(ideMcpPath, "Qoder IDE", options.force, isManagedQoderIdeMcpServer);
+    const warnings = await updateQoderSettings({
+        ...options,
+        path: settingsPath,
+    });
+    await updateQoderIdeSettings({ ...options, path: ideMcpPath });
+    await writeMarkedFile({
+        path: guidancePath,
+        startMarker: ZVEC_GREP_AGENTS_START,
+        endMarker: ZVEC_GREP_AGENTS_END,
+        block: agentGuidanceBlock({
+            search: NAMESPACED_SEARCH_TOOL,
+            rg: NAMESPACED_RG_TOOL,
+            qoderAuthorizationRecovery: true,
+        }),
+        force: true,
+    });
+    for (const warning of warnings) {
+        console.warn(`    warning   ${warning}`);
+    }
+    return { files: [settingsPath, ideMcpPath, guidancePath] };
+}
+async function uninstallQoderIntegration() {
+    const qoderHome = resolveQoderHome();
+    const settingsPath = resolve(qoderHome, "settings.json");
+    const ideMcpPaths = qoderIdeMcpPathsForUninstall();
+    const guidancePath = resolve(qoderHome, "AGENTS.md");
+    await removeQoderSettings(settingsPath);
+    for (const path of ideMcpPaths) {
+        await removeQoderIdeSettings(path);
+    }
+    await removeMarkedFile({
+        path: guidancePath,
+        startMarker: ZVEC_GREP_AGENTS_START,
+        endMarker: ZVEC_GREP_AGENTS_END,
+    });
+    return { files: [settingsPath, ...ideMcpPaths, guidancePath] };
+}
 async function resolveInstallers(parsed, action) {
     const detected = await detectAgentInstallers();
     const targetTokens = [
@@ -308,8 +424,7 @@ function installersFromTokens(tokens, detected = new Set()) {
     }
     const selected = new Map();
     for (const token of normalized) {
-        const input = token.toLowerCase();
-        const lower = input === "cc" || input === "claude-code" ? "claude" : input;
+        const lower = token.toLowerCase();
         if (lower === "none") {
             return [];
         }
@@ -335,7 +450,9 @@ function installersFromTokens(tokens, detected = new Set()) {
             selected.set(installer.id, installer);
             continue;
         }
-        const installer = AGENT_INSTALLERS.find((candidate) => candidate.id === lower || candidate.label.toLowerCase() === lower);
+        const installer = AGENT_INSTALLERS.find((candidate) => candidate.id === lower ||
+            candidate.aliases?.includes(lower) ||
+            candidate.label.toLowerCase() === lower);
         if (!installer) {
             throw new Error(`Unknown install target: ${token}`);
         }
@@ -345,10 +462,13 @@ function installersFromTokens(tokens, detected = new Set()) {
 }
 async function detectAgentInstallers() {
     const detected = new Set();
-    const checks = await Promise.all(AGENT_INSTALLERS.map(async (installer) => ({
-        installer,
-        available: await executableIsAvailable(installer.executable),
-    })));
+    const checks = await Promise.all(AGENT_INSTALLERS.map(async (installer) => {
+        const executableDetected = (await Promise.all(installer.executables.map((executable) => executableIsAvailable(executable)))).some(Boolean);
+        return {
+            installer,
+            available: executableDetected || (await installer.detect?.()) === true,
+        };
+    }));
     for (const check of checks) {
         if (check.available) {
             detected.add(check.installer.id);
@@ -516,6 +636,101 @@ function resolveOpenCodeConfigPath() {
 function resolveCursorConfigPath() {
     return resolve(process.env.CURSOR_CONFIG_DIR ?? resolve(homedir(), ".cursor"), "mcp.json");
 }
+function resolveQoderHome() {
+    return resolve(process.env.QODER_CONFIG_DIR || resolve(homedir(), ".qoder"));
+}
+function resolveQoderIdeMcpPath() {
+    const configured = process.env.QODER_IDE_MCP_PATH?.trim();
+    if (configured)
+        return resolve(configured);
+    return resolve(homedir(), ".qoder", "mcp.json");
+}
+function qoderIdeMcpPathsForUninstall() {
+    return [resolveQoderIdeMcpPath()];
+}
+async function qoderIdeIsAvailable() {
+    const configured = process.env.QODER_IDE_EXECUTABLE?.trim();
+    const candidates = configured
+        ? [resolve(configured)]
+        : qoderIdeExecutableCandidates();
+    for (const candidate of candidates) {
+        try {
+            await access(candidate, fileSystemConstants.X_OK);
+            return true;
+        }
+        catch {
+            // Try the next platform-specific installation path.
+        }
+    }
+    return false;
+}
+function qoderIdeExecutableCandidates() {
+    if (process.platform === "darwin") {
+        return [
+            resolve(homedir(), "Applications", "Qoder IDE.app", "Contents", "MacOS", "Qoder"),
+            resolve("/Applications", "Qoder IDE.app", "Contents", "MacOS", "Qoder"),
+            resolve(homedir(), "Applications", "Qoder.app", "Contents", "MacOS", "Qoder"),
+            resolve("/Applications", "Qoder.app", "Contents", "MacOS", "Qoder"),
+        ];
+    }
+    if (process.platform === "win32") {
+        const localPrograms = resolve(process.env.LOCALAPPDATA || resolve(homedir(), "AppData", "Local"), "Programs");
+        return [
+            resolve(localPrograms, "Qoder IDE", "Qoder IDE.exe"),
+            resolve(localPrograms, "Qoder", "Qoder.exe"),
+            ...(process.env.ProgramFiles
+                ? [
+                    resolve(process.env.ProgramFiles, "Qoder IDE", "Qoder IDE.exe"),
+                    resolve(process.env.ProgramFiles, "Qoder", "Qoder.exe"),
+                ]
+                : []),
+        ];
+    }
+    return [
+        "/usr/share/qoder-ide/qoder-ide",
+        "/usr/share/qoder-ide/bin/qoder-ide",
+        "/usr/bin/qoder-ide",
+        "/usr/share/qoder/bin/qoder",
+    ];
+}
+async function resolveQwenHome() {
+    const defaultQwenHome = resolve(homedir(), ".qwen");
+    const configured = process.env.QWEN_HOME;
+    if (configured) {
+        return resolveQwenHomeValue(configured);
+    }
+    // Qwen Code treats an explicitly exported empty QWEN_HOME as the default
+    // directory and does not replace it from a user .env file.
+    if (Object.hasOwn(process.env, "QWEN_HOME")) {
+        return defaultQwenHome;
+    }
+    const discovered = (await readQwenHomeFromEnv(resolve(defaultQwenHome, ".env"))) ??
+        (await readQwenHomeFromEnv(resolve(homedir(), ".env")));
+    return discovered ? resolveQwenHomeValue(discovered) : defaultQwenHome;
+}
+async function readQwenHomeFromEnv(path) {
+    const source = await readTextFileIfExists(path);
+    if (!source)
+        return undefined;
+    try {
+        return parseEnv(source).QWEN_HOME || undefined;
+    }
+    catch {
+        // Match Qwen Code's quiet dotenv bootstrap behavior.
+        return undefined;
+    }
+}
+function resolveQwenHomeValue(value) {
+    if (value === "~")
+        return homedir();
+    if (value.startsWith("~/") || value.startsWith("~\\")) {
+        return resolve(homedir(), ...value
+            .slice(2)
+            .split(/[/\\]+/)
+            .filter(Boolean));
+    }
+    return resolve(value);
+}
 async function installJsonMcpServer(options) {
     const config = await readJsonObject(options.path);
     const existingContainer = config[options.containerKey];
@@ -652,6 +867,465 @@ async function updateClaudePermissionSettings(path, grant) {
     }
     await writeJsonObject(path, root);
 }
+async function updateQwenSettings(options) {
+    const root = await updateJsoncMcpSettings({
+        path: options.path,
+        force: options.force,
+        label: "Qwen Code",
+        server: qwenMcpServer(options),
+        isManaged: isManagedQwenMcpServer,
+    });
+    return contextFileWarnings(root, "QWEN.md");
+}
+async function removeQwenSettings(path) {
+    await removeJsoncMcpSettings(path, "Qwen Code", isManagedQwenMcpServer);
+}
+async function updateQoderSettings(options) {
+    const existing = await readTextFileIfExists(options.path);
+    let source = existing.trim() ? existing : "{}\n";
+    const root = parseJsoncSettings(options.path, source, "Qoder");
+    validateMcpSettingsContainer(options.path, root);
+    const mcpServers = isJsonObject(root.mcpServers) ? root.mcpServers : {};
+    const current = mcpServers.zvec_grep;
+    const currentIsManaged = isManagedJsonMcpServer(current);
+    if (current !== undefined && !currentIsManaged && !options.force) {
+        throw new Error(`Existing unmanaged zvec_grep MCP server found in ${options.path}. Re-run with --force to replace it for Qoder.`);
+    }
+    const allow = qoderPermissionAllowRules(options.path, root);
+    const ownedPermissions = new Set([
+        ...(currentIsManaged ? qoderOwnedPermissionRules(current) : []),
+        ...QODER_MCP_PERMISSIONS.filter((permission) => !allow.includes(permission)),
+    ]);
+    const alwaysAllow = currentIsManaged ? qoderAlwaysAllowTools(current) : [];
+    for (const { tool } of QODER_MCP_PERMISSION_RULES) {
+        if (!alwaysAllow.includes(tool)) {
+            alwaysAllow.push(tool);
+        }
+    }
+    source = editJsonWithComments(source, ["mcpServers", "zvec_grep"], qoderMcpServer(options, alwaysAllow, [...ownedPermissions]));
+    source = addQoderPermissionRules(source, options.path, root);
+    await writeTextFileAtomic(options.path, ensureTrailingNewline(source));
+    return contextFileWarnings(root, "AGENTS.md");
+}
+async function removeQoderSettings(path) {
+    const existing = await readTextFileIfExists(path);
+    if (!existing.trim())
+        return;
+    let source = existing;
+    const root = parseJsoncSettings(path, source, "Qoder");
+    validateMcpSettingsContainer(path, root);
+    qoderPermissionAllowRules(path, root);
+    const mcpServers = isJsonObject(root.mcpServers) ? root.mcpServers : {};
+    const current = mcpServers.zvec_grep;
+    if (!isManagedJsonMcpServer(current))
+        return;
+    const ownedPermissions = qoderOwnedPermissionRules(current);
+    source = hasJsoncComments(source)
+        ? removeJsoncPropertyPreservingComments(source, ["mcpServers", "zvec_grep"])
+        : editJsonWithComments(source, Object.keys(mcpServers).length === 1
+            ? ["mcpServers"]
+            : ["mcpServers", "zvec_grep"], undefined);
+    source = removeQoderPermissionRules(source, path, root, ownedPermissions);
+    if (source !== existing) {
+        await writeTextFileAtomic(path, ensureTrailingNewline(source));
+    }
+}
+async function assertQoderPermissionSettingsValid(path) {
+    const source = await readTextFileIfExists(path);
+    if (!source.trim())
+        return;
+    const root = parseJsoncSettings(path, source, "Qoder");
+    qoderPermissionAllowRules(path, root);
+}
+function addQoderPermissionRules(source, path, root) {
+    const allow = qoderPermissionAllowRules(path, root);
+    const missing = QODER_MCP_PERMISSIONS.filter((permission) => !allow.includes(permission));
+    if (missing.length === 0)
+        return source;
+    const hasAllowArray = isJsonObject(root.permissions) && Array.isArray(root.permissions.allow);
+    if (!hasAllowArray) {
+        return editJsonWithComments(source, ["permissions", "allow"], [...allow, ...missing]);
+    }
+    return insertJsoncArrayValuesAtStart(source, ["permissions", "allow"], missing);
+}
+function removeQoderPermissionRules(source, path, root, ownedPermissions) {
+    const allow = qoderPermissionAllowRules(path, root);
+    let removedCount = 0;
+    for (const permission of ownedPermissions) {
+        const removal = removeFirstJsoncArrayStringValue(source, ["permissions", "allow"], permission);
+        source = removal.source;
+        if (removal.removed)
+            removedCount += 1;
+    }
+    if (removedCount === 0)
+        return source;
+    if (removedCount < allow.length)
+        return source;
+    const permissions = root.permissions;
+    const hasOtherPermissionSettings = Object.keys(permissions).some((key) => key !== "allow");
+    if (hasJsoncComments(source)) {
+        return source;
+    }
+    if (hasOtherPermissionSettings) {
+        return editJsonWithComments(source, ["permissions", "allow"], undefined);
+    }
+    return editJsonWithComments(source, ["permissions"], undefined);
+}
+function qoderOwnedPermissionRules(server) {
+    if (!isJsonObject(server) ||
+        typeof server.description !== "string" ||
+        !server.description.startsWith(QODER_PERMISSION_OWNERSHIP_PREFIX)) {
+        return [];
+    }
+    const alwaysAllow = server.description
+        .slice(QODER_PERMISSION_OWNERSHIP_PREFIX.length)
+        .split(",")
+        .filter(Boolean);
+    return QODER_MCP_PERMISSION_RULES.filter(({ tool }) => alwaysAllow.includes(tool)).map(({ permission }) => permission);
+}
+function qoderMcpDescription(ownedPermissions) {
+    const tools = QODER_MCP_PERMISSION_RULES.filter(({ permission }) => ownedPermissions.includes(permission)).map(({ tool }) => tool);
+    return tools.length > 0
+        ? `${QODER_PERMISSION_OWNERSHIP_PREFIX}${tools.join(",")}`
+        : QODER_CLI_MCP_DESCRIPTION;
+}
+function qoderAlwaysAllowTools(server) {
+    if (!isJsonObject(server) || !Array.isArray(server.alwaysAllow))
+        return [];
+    return server.alwaysAllow.filter((tool) => typeof tool === "string");
+}
+function insertJsoncArrayValuesAtStart(source, path, values) {
+    if (values.length === 0)
+        return source;
+    const root = parseTree(source);
+    const arrayNode = root ? findNodeAtLocation(root, [...path]) : undefined;
+    if (arrayNode?.type !== "array")
+        return source;
+    const children = arrayNode.children ?? [];
+    const insertionOffset = arrayNode.offset + 1;
+    const closingBracketOffset = arrayNode.offset + arrayNode.length - 1;
+    const multiline = source
+        .slice(arrayNode.offset, closingBracketOffset + 1)
+        .includes("\n");
+    const serialized = values.map((value) => JSON.stringify(value));
+    let insertion;
+    if (multiline) {
+        const formatting = jsonFormattingOptions(source);
+        const lineStart = source.lastIndexOf("\n", arrayNode.offset - 1) + 1;
+        const propertyIndent = source.slice(lineStart, arrayNode.offset).match(/^[\t ]*/)?.[0] ?? "";
+        const indentUnit = formatting.insertSpaces
+            ? " ".repeat(formatting.tabSize ?? 2)
+            : "\t";
+        const itemIndent = `${propertyIndent}${indentUnit}`;
+        const lines = serialized.map((value, index) => `${itemIndent}${value}${index < serialized.length - 1 || children.length > 0 ? "," : ""}`);
+        insertion = `${formatting.eol}${lines.join(formatting.eol)}`;
+    }
+    else {
+        insertion = `${serialized.join(", ")}${children.length > 0 ? ", " : ""}`;
+    }
+    return (source.slice(0, insertionOffset) + insertion + source.slice(insertionOffset));
+}
+function removeFirstJsoncArrayStringValue(source, path, value) {
+    const root = parseTree(source);
+    const arrayNode = root ? findNodeAtLocation(root, [...path]) : undefined;
+    if (arrayNode?.type !== "array" || !arrayNode.children) {
+        return { source, removed: false };
+    }
+    const index = arrayNode.children.findIndex((child) => child.type === "string" && child.value === value);
+    if (index < 0)
+        return { source, removed: false };
+    const target = arrayNode.children[index];
+    const previous = arrayNode.children[index - 1];
+    const next = arrayNode.children[index + 1];
+    const ranges = [nodeRange(target)];
+    const commaOffset = next
+        ? findComma(source, target.offset + target.length, next.offset)
+        : previous
+            ? findComma(source, previous.offset + previous.length, target.offset)
+            : undefined;
+    if (commaOffset !== undefined) {
+        ranges.push({ offset: commaOffset, length: 1 });
+    }
+    return {
+        source: ranges
+            .sort((left, right) => right.offset - left.offset)
+            .reduce((current, range) => current.slice(0, range.offset) +
+            current.slice(range.offset + range.length), source),
+        removed: true,
+    };
+}
+function qoderPermissionAllowRules(path, root) {
+    const currentPermissions = root.permissions;
+    if (currentPermissions !== undefined && !isJsonObject(currentPermissions)) {
+        throw new Error(`Invalid permissions configuration in ${path}.`);
+    }
+    const permissions = isJsonObject(currentPermissions)
+        ? currentPermissions
+        : {};
+    const currentAllow = permissions.allow;
+    if (currentAllow !== undefined && !Array.isArray(currentAllow)) {
+        throw new Error(`Invalid permissions.allow configuration in ${path}.`);
+    }
+    if (Array.isArray(currentAllow) &&
+        currentAllow.some((permission) => typeof permission !== "string")) {
+        throw new Error(`Invalid permissions.allow rule in ${path}.`);
+    }
+    return Array.isArray(currentAllow) ? currentAllow : [];
+}
+async function updateQoderIdeSettings(options) {
+    await updateJsoncMcpSettings({
+        path: options.path,
+        force: options.force,
+        label: "Qoder IDE",
+        server: qoderIdeMcpServer(options),
+        isManaged: isManagedQoderIdeMcpServer,
+    });
+}
+async function removeQoderIdeSettings(path) {
+    await removeJsoncMcpSettings(path, "Qoder IDE", isManagedQoderIdeMcpServer);
+}
+function qwenMcpServer(options) {
+    const timeout = options.mcpToolTimeoutSeconds * 1_000;
+    // Qwen otherwise defers MCP schemas behind tool_search, so the managed
+    // search tool would not be directly callable on the first turn.
+    if (options.transport === "stdio") {
+        return {
+            command: "zg",
+            args: stdioArgs(options.mcpToolset),
+            timeout,
+            alwaysLoadTools: true,
+            trust: true,
+        };
+    }
+    return {
+        httpUrl: resolveServerUrl(),
+        timeout,
+        alwaysLoadTools: true,
+        trust: true,
+        ...(options.mcpTokenEnv
+            ? {
+                headers: {
+                    Authorization: `Bearer \${${options.mcpTokenEnv}}`,
+                },
+            }
+            : {}),
+    };
+}
+function qoderMcpServer(options, alwaysAllow = [], ownedPermissions = []) {
+    const timeout = options.mcpToolTimeoutSeconds * 1_000;
+    const permissionPolicy = alwaysAllow.length > 0 ? { alwaysAllow: [...alwaysAllow] } : {};
+    if (options.transport === "stdio") {
+        return {
+            command: "zg",
+            args: stdioArgs(options.mcpToolset),
+            timeout,
+            trust: true,
+            description: qoderMcpDescription(ownedPermissions),
+            ...permissionPolicy,
+        };
+    }
+    return {
+        type: "http",
+        url: resolveServerUrl(),
+        timeout,
+        trust: true,
+        description: qoderMcpDescription(ownedPermissions),
+        ...permissionPolicy,
+        ...(options.mcpTokenEnv
+            ? {
+                headers: {
+                    Authorization: `Bearer \${${options.mcpTokenEnv}}`,
+                },
+            }
+            : {}),
+    };
+}
+function qoderIdeMcpServer(options) {
+    const timeout = options.mcpToolTimeoutSeconds * 1_000;
+    if (options.transport === "stdio") {
+        const launch = stableQoderIdeStdioLaunch(options.mcpToolset);
+        return {
+            command: launch.command,
+            args: launch.args,
+            timeout,
+            description: QODER_IDE_MCP_DESCRIPTION,
+        };
+    }
+    return {
+        type: "sse",
+        url: resolveServerUrl(),
+        timeout,
+        description: QODER_IDE_MCP_DESCRIPTION,
+        ...(options.mcpTokenEnv
+            ? {
+                headers: {
+                    Authorization: `Bearer \${${options.mcpTokenEnv}}`,
+                },
+            }
+            : {}),
+    };
+}
+async function assertQoderMcpSettingsReplaceable(path, label, force, isManaged) {
+    const existing = await readTextFileIfExists(path);
+    const source = existing.trim() ? existing : "{}\n";
+    const root = parseJsoncSettings(path, source, label);
+    validateMcpSettingsContainer(path, root);
+    const mcpServers = isJsonObject(root.mcpServers) ? root.mcpServers : {};
+    if (mcpServers.zvec_grep !== undefined &&
+        !isManaged(mcpServers.zvec_grep) &&
+        !force) {
+        throw new Error(`Existing unmanaged zvec_grep MCP server found in ${path}. Re-run with --force to replace it for ${label}.`);
+    }
+}
+async function updateJsoncMcpSettings(options) {
+    const existing = await readTextFileIfExists(options.path);
+    let source = existing.trim() ? existing : "{}\n";
+    const root = parseJsoncSettings(options.path, source, options.label);
+    validateMcpSettingsContainer(options.path, root);
+    const mcpServers = isJsonObject(root.mcpServers) ? root.mcpServers : {};
+    const current = mcpServers.zvec_grep;
+    if (current !== undefined && !options.isManaged(current) && !options.force) {
+        throw new Error(`Existing unmanaged zvec_grep MCP server found in ${options.path}. Re-run with --force to replace it for ${options.label}.`);
+    }
+    source = editJsonWithComments(source, ["mcpServers", "zvec_grep"], options.server);
+    await writeTextFileAtomic(options.path, ensureTrailingNewline(source));
+    return root;
+}
+async function removeJsoncMcpSettings(path, label, isManaged) {
+    const existing = await readTextFileIfExists(path);
+    if (!existing.trim())
+        return;
+    let source = existing;
+    const root = parseJsoncSettings(path, source, label);
+    validateMcpSettingsContainer(path, root);
+    const mcpServers = isJsonObject(root.mcpServers) ? root.mcpServers : {};
+    if (isManaged(mcpServers.zvec_grep)) {
+        source = hasJsoncComments(source)
+            ? removeJsoncPropertyPreservingComments(source, [
+                "mcpServers",
+                "zvec_grep",
+            ])
+            : editJsonWithComments(source, Object.keys(mcpServers).length === 1
+                ? ["mcpServers"]
+                : ["mcpServers", "zvec_grep"], undefined);
+    }
+    if (source !== existing) {
+        await writeTextFileAtomic(path, ensureTrailingNewline(source));
+    }
+}
+function parseJsoncSettings(path, source, label) {
+    const errors = [];
+    const parsed = parseJsonWithComments(source, errors, {
+        allowTrailingComma: false,
+        disallowComments: false,
+    });
+    if (errors.length > 0 || !isJsonObject(parsed)) {
+        throw new Error(`Invalid ${label} configuration in ${path}.`);
+    }
+    return parsed;
+}
+function validateMcpSettingsContainer(path, root) {
+    if (root.mcpServers !== undefined && !isJsonObject(root.mcpServers)) {
+        throw new Error(`Invalid mcpServers configuration in ${path}.`);
+    }
+}
+function editJsonWithComments(source, path, value) {
+    return applyEdits(source, modify(source, [...path], value, {
+        formattingOptions: jsonFormattingOptions(source),
+    }));
+}
+function hasJsoncComments(source) {
+    const scanner = createScanner(source, false);
+    for (let token = scanner.scan(); token !== 17 /* SyntaxKind.EOF */; token = scanner.scan()) {
+        if (token === 12 /* SyntaxKind.LineCommentTrivia */ ||
+            token === 13 /* SyntaxKind.BlockCommentTrivia */) {
+            return true;
+        }
+    }
+    return false;
+}
+function removeJsoncPropertyPreservingComments(source, path) {
+    const root = parseTree(source);
+    if (!root)
+        return source;
+    const valueNode = findNodeAtLocation(root, [...path]);
+    const propertyNode = valueNode?.parent;
+    const objectNode = propertyNode?.parent;
+    if (propertyNode?.type !== "property" ||
+        objectNode?.type !== "object" ||
+        !objectNode.children) {
+        return source;
+    }
+    const propertyIndex = objectNode.children.indexOf(propertyNode);
+    if (propertyIndex < 0)
+        return source;
+    const ranges = [nodeRange(propertyNode)];
+    const previousProperty = objectNode.children[propertyIndex - 1];
+    const nextProperty = objectNode.children[propertyIndex + 1];
+    const separatorOffset = nextProperty
+        ? findComma(source, propertyNode.offset + propertyNode.length, nextProperty.offset)
+        : previousProperty
+            ? findComma(source, previousProperty.offset + previousProperty.length, propertyNode.offset)
+            : undefined;
+    if (separatorOffset !== undefined) {
+        ranges.push({ offset: separatorOffset, length: 1 });
+    }
+    return ranges
+        .sort((left, right) => right.offset - left.offset)
+        .reduce((current, range) => current.slice(0, range.offset) +
+        current.slice(range.offset + range.length), source);
+}
+function nodeRange(node) {
+    return { offset: node.offset, length: node.length };
+}
+function findComma(source, startOffset, endOffset) {
+    const scanner = createScanner(source, false);
+    scanner.setPosition(startOffset);
+    for (let token = scanner.scan(); token !== 17 /* SyntaxKind.EOF */; token = scanner.scan()) {
+        const tokenOffset = scanner.getTokenOffset();
+        if (tokenOffset >= endOffset)
+            return undefined;
+        if (token === 5 /* SyntaxKind.CommaToken */)
+            return tokenOffset;
+    }
+    return undefined;
+}
+function jsonFormattingOptions(source) {
+    const eol = source.includes("\r\n") ? "\r\n" : "\n";
+    const indentation = source.match(/^[ \t]+(?=")/m)?.[0];
+    if (indentation?.startsWith("\t")) {
+        return { insertSpaces: false, tabSize: 1, eol };
+    }
+    return {
+        insertSpaces: true,
+        tabSize: indentation?.length ?? 2,
+        eol,
+    };
+}
+function contextFileWarnings(root, fileName) {
+    if (!isJsonObject(root.context))
+        return [];
+    const configured = root.context.fileName;
+    const fileNames = typeof configured === "string"
+        ? [configured]
+        : Array.isArray(configured) &&
+            configured.every((value) => typeof value === "string")
+            ? configured
+            : undefined;
+    if (!fileNames || fileNames.includes(fileName))
+        return [];
+    return [
+        `context.fileName does not include ${fileName}; the installed zvec-grep guidance may not be loaded.`,
+    ];
+}
+function isManagedQwenMcpServer(value) {
+    return (isJsonObject(value) &&
+        (value.httpUrl === resolveServerUrl() ||
+            (value.command === "zg" && isStdioArgs(value.args))));
+}
+function ensureTrailingNewline(source) {
+    return source.endsWith("\n") ? source : `${source}\n`;
+}
 async function readJsonObject(path) {
     const source = await readTextFileIfExists(path);
     return source.trim() ? parseJsonObject(path, source) : {};
@@ -689,6 +1363,12 @@ function isManagedJsonMcpServer(value) {
             (value.command[3] === "--mcp-toolset" &&
                 (value.command[4] === "agent" || value.command[4] === "full"))));
 }
+function isManagedQoderIdeMcpServer(value) {
+    return (isJsonObject(value) &&
+        value.description === QODER_IDE_MCP_DESCRIPTION &&
+        ((typeof value.command === "string" && isStableStdioArgs(value.args)) ||
+            (value.type === "sse" && typeof value.url === "string")));
+}
 function isStdioArgs(value) {
     return (Array.isArray(value) &&
         (value.length === 2 || value.length === 4) &&
@@ -698,6 +1378,16 @@ function isStdioArgs(value) {
             (value[2] === "--mcp-toolset" &&
                 (value[3] === "agent" || value[3] === "full"))));
 }
+function isStableStdioArgs(value) {
+    return (Array.isArray(value) &&
+        (value.length === 3 || value.length === 5) &&
+        typeof value[0] === "string" &&
+        value[1] === "server" &&
+        value[2] === "--stdio" &&
+        (value.length === 3 ||
+            (value[3] === "--mcp-toolset" &&
+                (value[4] === "agent" || value[4] === "full"))));
+}
 function stdioArgs(mcpToolset) {
     return [
         "server",
@@ -708,6 +1398,16 @@ function stdioArgs(mcpToolset) {
 function stdioCommand(mcpToolset) {
     return ["zg", ...stdioArgs(mcpToolset)];
 }
+function stableQoderIdeStdioLaunch(mcpToolset) {
+    const cliPath = process.argv[1];
+    if (!cliPath) {
+        return { command: "zg", args: stdioArgs(mcpToolset) };
+    }
+    return {
+        command: process.execPath,
+        args: [resolve(cliPath), ...stdioArgs(mcpToolset)],
+    };
+}
 function tomlStringArray(values) {
     return `[${values.map((value) => JSON.stringify(value)).join(", ")}]`;
 }
@@ -918,6 +1618,17 @@ function agentGuidanceBlock(toolNames) {
     const searchTool = toolNames?.search ?? "zvec_grep_search";
     const rgTool = toolNames?.rg ?? "zvec_grep_rg";
     const exactLookupRoute = `\`${rgTool}\` when it is listed by the current host; otherwise native Grep or \`rg\``;
+    const qoderAuthorizationRecovery = toolNames?.qoderAuthorizationRecovery
+        ? `
+
+${formatPromptRules("### Qoder Remote Embedding authorization recovery", [
+            `When \`${searchTool}\` needs \`remote_embedding_authorization\` and the current Qoder host returns \`code = 51500 message = method not found: No request handler configured\` without showing an authorization form, returns \`${REMOTE_EMBEDDING_ELICITATION_UNSUPPORTED_MESSAGE}\`, or reports that authorization was declined or cancelled without showing the user an authorization form, treat it as a Qoder client interaction limitation: the host lacks the server-to-client \`elicitation/create\` request handler. The outer MCP \`tools/call\` has already reached the registered MCP server and tool, so do not diagnose this error as a disconnected or missing MCP server or as a missing tool. Apply this recovery only to the Remote Embedding authorization path, not to arbitrary 51500 failures. Do not immediately fall back to broad file reads, do not treat it as a missing API credential, and do not grant access silently. If the user actually declined a displayed authorization form, respect that decision and do not ask again.`,
+            "Use the current Qoder host's built-in user-question tool (`ask_user_question` in Qoder IDE or `AskUserQuestion` in Qoder CLI/SDK) to offer exactly these choices: allow Remote Embedding for this workspace, use local FTS only, or cancel. Explain that workspace approval may send query text and selected workspace content to the configured provider and endpoint and may incur provider charges.",
+            'Only after the user explicitly chooses workspace approval, run `zg auth grant "<absolute-root>" --capability embedding --scope workspace`, substituting the same absolute root used by the failed search, and then retry the original search call once. Do not use `--allow-remote`; it applies only to one CLI command and does not authorize the MCP retry.',
+            `If the user chooses local FTS, retry \`${searchTool}\` once with the original search text in \`fts\`, omit \`query\`, \`queries\`, and \`vector\`, set \`autoUpdate\` to \`false\` and \`freshness\` to \`eventual\`, and preserve \`root\`, filters, and limits. This route is lexical-only, does not refresh the remote-embedding index, and sends no query text or workspace content to a remote Embedding provider.`,
+            "If the user cancels, the grant command fails, or interactive user input is unavailable, stop and report that no remote data was sent. Provider credentials and Remote Embedding data authorization are separate; never request or modify an API key merely to resolve this interaction error.",
+        ])}`
+        : "";
     return `${ZVEC_GREP_AGENTS_START}
 ## zvec-grep
 
@@ -933,24 +1644,10 @@ ${formatPromptRules("### Retrieval routing", [
         "Before broad file reads or delegating workspace discovery, use the appropriate search route. Do not delegate solely to locate material, and stop when the evidence is sufficient.",
     ])}
 
-${formatPromptRules("### Search arguments and evidence", [
-        "`query` creates one primary hybrid result group; `queries` creates one or more primary hybrid result groups.",
-        "`fts` and `vector` add supplemental lexical and semantic routes. `fts` is a retrieval route, not a hard filter or constraint.",
-        "Without `fuse`, search groups are evaluated separately and returned as one deduplicated, reranked list with query-group metadata. Set `fuse: true` to collapse the supplied primary and supplemental intents into one search plan.",
+${formatPromptRules("### Search evidence", [
         "Search results include bounded source snippets. Treat a sufficient snippet as already-read evidence, and read a cited file only when a required detail falls outside the snippet.",
     ])}
 
-Example mixed search:
-
-\`\`\`json
-{
-  "root": "/absolute/workspace",
-  "query": "how are search results ranked and fused",
-  "fts": ["RRF", "score"],
-  "fuse": true
-}
-\`\`\`
-
 ${formatPromptRules("### Freshness and index lifecycle", [
         "Pass a daemon-visible absolute `root` on every zvec-grep workspace call.",
         "Read `freshness` and `background_refresh` from search results without a status preflight.",
@@ -958,6 +1655,7 @@ ${formatPromptRules("### Freshness and index lifecycle", [
         `If the index is missing but exact or regex lookup can answer the task, use ${exactLookupRoute}.`,
         "Creating, rebuilding, or dropping a persistent index requires an explicit user request or authorization; never do so silently.",
     ])}
+${qoderAuthorizationRecovery}
 ${ZVEC_GREP_AGENTS_END}`;
 }
 //# sourceMappingURL=install.js.map