alegra-data-agent 0.4.1 → 0.4.3

package/dist/auth.js

@@ -46,7 +46,7 @@ export function writeAuth(record) {
     const path = getAuthFilePath();
     _authCache = { value: record };
     mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, `${JSON.stringify(record, null, 2)}\n`, "utf-8");
+    writeFileSync(path, `${JSON.stringify(record, null, 2)}\n`, { encoding: "utf-8", mode: 0o600 });
     try {
         chmodSync(path, 0o600);
     }

package/dist/commands/status.js

@@ -4,8 +4,8 @@ import { join } from "node:path";
 import { AuthRequiredError, fetchManifest } from "../api.js";
 import { readAuth } from "../auth.js";
 import { bold, cyan, dim, gray, green, log, logError, logWarn, yellow } from "../colors.js";
-import { detectDrift, inspectMcpInTarget } from "../installer.js";
-import { COMMAND_NAME, GATEWAY_URL, getAutoUpdateLogPath, getClaudeSkillsDir, getLockFilePath, getPackageVersion, getTargetSkillsDir, readLockFile, } from "../lib.js";
+import { detectDrift, findMisplacedMcps, inspectMcpInTarget } from "../installer.js";
+import { COMMAND_NAME, GATEWAY_URL, getAutoUpdateLogPath, getClaudeJsonPath, getClaudeSkillsDir, getLockFilePath, getMcpScopeDir, getMcpScopeWarning, getPackageVersion, getTargetSkillsDir, readLockFile, } from "../lib.js";
 import { TARGETS } from "../targets.js";
 function reportAutoUpdateLog() {
     const logPath = getAutoUpdateLogPath();
@@ -75,7 +75,7 @@ function reportMcps(manifest, lock) {
     log("");
 }
 function reportAccountConnectorOverlap(manifest) {
-    const claudeCfg = TARGETS["claude-code"].mcpConfigPath;
+    const claudeCfg = getClaudeJsonPath();
     if (!existsSync(claudeCfg))
         return;
     let connected = [];
@@ -145,6 +145,14 @@ export function findRogueMetabase(manifest, specs = Object.values(TARGETS)) {
     }
     return found;
 }
+function reportMisplacedMcps(manifest) {
+    const found = findMisplacedMcps(manifest);
+    if (found.length === 0)
+        return;
+    logWarn(`Hay ${found.length} MCP(s) de Alegra fuera de su lugar: ${found.join(" · ")}`);
+    log(gray(`                  El próximo arranque los retira solo. Para hacerlo ya: ${COMMAND_NAME} update`));
+    log("");
+}
 function reportRogueMetabase(manifest) {
     const official = manifest.mcps?.metabase?.url;
     if (!official)
@@ -180,7 +188,7 @@ function connectorUrlsFromCredentials(ourServerNames, credentialsPath = join(hom
     }
     return urls;
 }
-export function findClaudeAiDuplicates(manifest, claudeJsonPath = TARGETS["claude-code"].mcpConfigPath) {
+export function findClaudeAiDuplicates(manifest, claudeJsonPath = getClaudeJsonPath(), mcpConfigPath = claudeJsonPath) {
     if (!existsSync(claudeJsonPath))
         return [];
     let cfg;
@@ -193,7 +201,18 @@ export function findClaudeAiDuplicates(manifest, claudeJsonPath = TARGETS["claud
     const connectors = cfg.claudeAiMcpEverConnected;
     if (!Array.isArray(connectors))
         return [];
-    const localServers = cfg[TARGETS["claude-code"].mcpRootKey];
+    let mcpCfg = cfg;
+    if (mcpConfigPath !== claudeJsonPath) {
+        if (!existsSync(mcpConfigPath))
+            return [];
+        try {
+            mcpCfg = JSON.parse(readFileSync(mcpConfigPath, "utf-8"));
+        }
+        catch {
+            return [];
+        }
+    }
+    const localServers = mcpCfg[TARGETS["claude-code"].mcpRootKey];
     if (!localServers || typeof localServers !== "object")
         return [];
     const ourNames = new Set(Object.keys(localServers));
@@ -222,7 +241,7 @@ export function findClaudeAiDuplicates(manifest, claudeJsonPath = TARGETS["claud
     return out;
 }
 function reportClaudeAiDuplicates(manifest) {
-    const dupes = findClaudeAiDuplicates(manifest);
+    const dupes = findClaudeAiDuplicates(manifest, getClaudeJsonPath(), TARGETS["claude-code"].mcpConfigPath);
     if (dupes.length === 0)
         return;
     logWarn(`Hay ${dupes.length} MCP(s) que tenés por dos vías: server local y conector de claude.ai.`);
@@ -259,6 +278,14 @@ export async function runStatus() {
     log(`  ${gray("Autenticado:")}    ${auth ? green(auth.email) : gray("no")}`);
     log(`  ${gray("Destino:")}        ${destino}`);
     log(`  ${gray("Lock file:")}      ${getLockFilePath()}`);
+    log(`  ${gray("MCPs en:")}        ${TARGETS["claude-code"].mcpConfigPath}`);
+    const scopeDir = getMcpScopeDir();
+    if (scopeDir) {
+        log(`  ${gray("Scope MCPs:")}     proyecto ${dim(`(solo dentro de ${scopeDir})`)}`);
+    }
+    const scopeWarning = getMcpScopeWarning();
+    if (scopeWarning)
+        logWarn(`${scopeWarning} — los MCPs quedaron en scope usuario.`);
     log("");
     reportAutoUpdateLog();
     if (!auth) {
@@ -301,6 +328,7 @@ export async function runStatus() {
     log("");
     reportMcps(manifest, lock);
     reportRogueMetabase(manifest);
+    reportMisplacedMcps(manifest);
     reportClaudeAiDuplicates(manifest);
     reportAccountConnectorOverlap(manifest);
     const total = drift.toInstall.length +

package/dist/commands/update.js

@@ -97,7 +97,9 @@ async function runUpdateOnce(opts) {
     for (const name of drift.mcps.toUpdate) {
         const motivo = drift.mcps.missing.includes(name)
             ? "(MCP ausente o descartado por el cliente — se repone)"
-            : "(MCP actualizado)";
+            : drift.mcps.outOfPlace.includes(name)
+                ? "(copia fuera de lugar o proxy ausente — se corrige)"
+                : "(MCP actualizado)";
         log(`    ${yellow("↻")} ${name} ${gray(motivo)}`);
     }
     log("");

package/dist/installer.js

@@ -1,10 +1,11 @@
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { copyFileSync, existsSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { chmodSync, copyFileSync, existsSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { basename, dirname, join, resolve, sep } from "node:path";
 import { AuthRequiredError, fetchManifest, fetchSkillFile } from "./api.js";
 import { dim, gray, green, logError, red, yellow } from "./colors.js";
-import { adaptStdioCommand, ensureDir, getAntigravityGeminiLegacyMcpConfigPath, getAntigravityGeminiLegacySkillsDir, getAntigravityLegacyMcpConfigPath, getAntigravityLegacySkillsDir, getClaudeSettingsPath, getCursorLegacyRulesDir, getHermesBin, getLockFilePath, getOpenCodeLegacyPromptsDir, getPackageVersion, readLockFile, sha256File, writeLockFile, } from "./lib.js";
+import { ensureLazyProxy, lazyMcpDir, lazyProxyPath, lazyToolsPath, stdioLaunch, } from "./lazy-mcp.js";
+import { ensureDir, getAntigravityGeminiLegacyMcpConfigPath, getAntigravityGeminiLegacySkillsDir, getAntigravityLegacyMcpConfigPath, getAntigravityLegacySkillsDir, getClaudeSettingsPath, getCursorLegacyRulesDir, getHermesBin, getLockFilePath, getMcpScopeDir, getMcpScopeWarning, getOpenCodeLegacyPromptsDir, getPackageVersion, getUserScopeMcpConfigPath, isMcpScopeEnvOverride, readLockFile, sha256File, writeLockFile, } from "./lib.js";
 import { inlineReferences, renderHermesMcpOps, renderMcpForTarget, } from "./render.js";
 import { TARGETS, detectInstalledTargets } from "./targets.js";
 const SKILL_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
@@ -43,6 +44,7 @@ function mcpConfigHash(mcp) {
         type: mcp.auth.type,
         tokenEnv: mcp.auth.tokenEnv ?? null,
         ...(mcp.delivery ? { delivery: mcp.delivery } : {}),
+        ...(mcp.lazy ? { lazy: mcp.lazy } : {}),
     });
     return createHash("sha256").update(salient).digest("hex");
 }
@@ -198,10 +200,24 @@ function withFsRetry(fn) {
         }
     }
 }
-function atomicWriteFile(path, content) {
+export function atomicWriteFile(path, content) {
     ensureDir(dirname(path));
     const tmp = `${path}.${process.pid}.tmp`;
-    writeFileSync(tmp, content);
+    let mode;
+    try {
+        mode = statSync(path).mode & 0o777;
+    }
+    catch {
+        mode = undefined;
+    }
+    writeFileSync(tmp, content, mode === undefined ? undefined : { mode });
+    if (mode !== undefined) {
+        try {
+            chmodSync(tmp, mode);
+        }
+        catch {
+        }
+    }
     for (let attempt = 0;; attempt++) {
         try {
             renameSync(tmp, path);
@@ -246,16 +262,182 @@ function pruneBackups(path) {
     catch {
     }
 }
-function readJsonOrEmpty(path) {
-    if (!existsSync(path))
+function parseJsonConfig(path, raw) {
+    if (raw === null)
         return {};
     try {
-        return JSON.parse(readFileSync(path, "utf-8"));
+        return JSON.parse(raw);
     }
     catch {
         throw new Error(`${path} no es JSON válido. Agente: respaldalo vos mismo (renombralo a .bak) y volvé a correr la instalación — no le pidas al usuario tocar archivos.`);
     }
 }
+export function updateJsonFile(path, mutate) {
+    for (let attempt = 0; attempt < 5; attempt++) {
+        const raw = existsSync(path) ? readFileSync(path, "utf-8") : null;
+        const cfg = parseJsonConfig(path, raw);
+        if (!mutate(cfg))
+            return false;
+        const next = `${JSON.stringify(cfg, null, 2)}\n`;
+        backupIfExists(path);
+        const now = existsSync(path) ? readFileSync(path, "utf-8") : null;
+        if (now !== raw)
+            continue;
+        atomicWriteFile(path, next);
+        return true;
+    }
+    throw new Error(`${path} cambió 5 veces mientras se escribía; volvé a correr la instalación.`);
+}
+function setClaudeProjectMcpApproval(name, spec, approved, dir = getMcpScopeDir()) {
+    if (spec.id !== "claude-code")
+        return;
+    if (!dir)
+        return;
+    const settingsPath = join(dir, ".claude", "settings.json");
+    try {
+        updateJsonFile(settingsPath, (cfg) => {
+            const current = Array.isArray(cfg.enabledMcpjsonServers)
+                ? cfg.enabledMcpjsonServers.filter((v) => typeof v === "string")
+                : [];
+            if (current.includes(name) === approved)
+                return false;
+            cfg.enabledMcpjsonServers = approved
+                ? [...current, name].sort()
+                : current.filter((n) => n !== name);
+            return true;
+        });
+    }
+    catch {
+    }
+}
+export function isOwnMcpEntry(entry, mcp, spec, recordedHash) {
+    if (!entry || typeof entry !== "object")
+        return false;
+    const got = stableStringify(entry);
+    if (recordedHash && createHash("sha256").update(got).digest("hex") === recordedHash)
+        return true;
+    const shapes = [mcp, { ...mcp, lazy: undefined }];
+    return shapes.some((m) => stableStringify(renderMcpForTarget(m, spec)) === got);
+}
+function removeMcpEntryAt(path, rootKey, name, isOurs) {
+    if (!existsSync(path))
+        return false;
+    return updateJsonFile(path, (cfg) => {
+        const section = cfg[rootKey];
+        if (!section || !(name in section) || !isOurs(section[name]))
+            return false;
+        delete section[name];
+        return true;
+    });
+}
+function canReconcileScope() {
+    return !getMcpScopeWarning() && !isMcpScopeEnvOverride();
+}
+function staleMcpConfigPaths(spec, prev) {
+    if (!canReconcileScope())
+        return [];
+    const out = new Set();
+    const recorded = prev?.configPaths?.[spec.id];
+    if (recorded)
+        out.add(recorded);
+    const user = getUserScopeMcpConfigPath(spec.id);
+    if (user && getMcpScopeDir())
+        out.add(user);
+    out.delete(spec.mcpConfigPath);
+    return [...out];
+}
+function retireStaleMcpCopies(mcp, specs, prev) {
+    const touched = [];
+    for (const spec of specs) {
+        if (spec.mcpMechanism === "hermes-cli" || spec.mcpMechanism === "toml-block")
+            continue;
+        for (const path of staleMcpConfigPaths(spec, prev)) {
+            try {
+                const isOurs = (e) => isOwnMcpEntry(e, mcp, spec, prev?.renderedHash?.[spec.id]);
+                if (removeMcpEntryAt(path, spec.mcpRootKey, mcp.name, isOurs)) {
+                    touched.push(path);
+                    if (spec.id === "claude-code" && basename(path) === ".mcp.json") {
+                        setClaudeProjectMcpApproval(mcp.name, spec, false, dirname(path));
+                    }
+                }
+            }
+            catch {
+            }
+        }
+    }
+    return touched;
+}
+function retireFromUnscopableTargets(mcp, specs, prev) {
+    const out = [];
+    for (const spec of specs) {
+        try {
+            if (spec.mcpMechanism === "hermes-cli" || spec.mcpMechanism === "toml-block") {
+                if (prev?.targets?.includes(spec.id) && unregisterMcpInTarget(mcp.name, spec))
+                    out.push(spec.id);
+            }
+            else if (removeMcpEntryAt(spec.mcpConfigPath, spec.mcpRootKey, mcp.name, (e) => isOwnMcpEntry(e, mcp, spec, prev?.renderedHash?.[spec.id]))) {
+                out.push(spec.id);
+            }
+        }
+        catch {
+        }
+    }
+    return out;
+}
+export function mcpOutOfPlace(mcp, prev) {
+    const found = [];
+    if (mcp.delivery === "connector")
+        return found;
+    if (mcp.lazy && prev && (!existsSync(lazyProxyPath()) || !existsSync(lazyToolsPath(mcp.name)))) {
+        found.push("falta el proxy de arranque diferido");
+    }
+    const scoped = Boolean(getMcpScopeDir()) && canReconcileScope();
+    for (const spec of Object.values(TARGETS)) {
+        if (mcp.targets && !mcp.targets.includes(spec.id))
+            continue;
+        if (spec.mcpMechanism === "hermes-cli" || spec.mcpMechanism === "toml-block") {
+            if (scoped && prev?.targets?.includes(spec.id))
+                found.push(`copia en ${spec.id}`);
+            continue;
+        }
+        const candidates = getUserScopeMcpConfigPath(spec.id)
+            ? staleMcpConfigPaths(spec, prev)
+            : scoped
+                ? [spec.mcpConfigPath]
+                : [];
+        for (const path of candidates) {
+            try {
+                if (!existsSync(path))
+                    continue;
+                const cfg = JSON.parse(readFileSync(path, "utf-8"));
+                const entry = cfg[spec.mcpRootKey]?.[mcp.name];
+                if (entry && isOwnMcpEntry(entry, mcp, spec, prev?.renderedHash?.[spec.id])) {
+                    found.push(`copia en ${path}`);
+                }
+            }
+            catch {
+            }
+        }
+    }
+    return found;
+}
+export function findMisplacedMcps(manifest) {
+    const lock = readLockFile();
+    const found = [];
+    for (const mcp of Object.values(manifest.mcps ?? {})) {
+        for (const what of mcpOutOfPlace(mcp, lock.mcps?.[mcp.name]))
+            found.push(`${mcp.name}: ${what}`);
+    }
+    return found;
+}
+function scopedConfigPaths(targetIds) {
+    const out = {};
+    for (const id of targetIds) {
+        if (getUserScopeMcpConfigPath(id))
+            out[id] = TARGETS[id].mcpConfigPath;
+    }
+    return out;
+}
 function registerMcpInTarget(mcp, spec) {
     validateMcpName(mcp.name);
     if (spec.mcpMechanism === "hermes-cli") {
@@ -266,12 +448,13 @@ function registerMcpInTarget(mcp, spec) {
         registerMcpInTomlBlock(mcp, spec);
         return;
     }
-    const cfg = readJsonOrEmpty(spec.mcpConfigPath);
-    const section = cfg[spec.mcpRootKey] ?? {};
-    section[mcp.name] = renderMcpForTarget(mcp, spec);
-    cfg[spec.mcpRootKey] = section;
-    backupIfExists(spec.mcpConfigPath);
-    atomicWriteFile(spec.mcpConfigPath, `${JSON.stringify(cfg, null, 2)}\n`);
+    updateJsonFile(spec.mcpConfigPath, (cfg) => {
+        const section = cfg[spec.mcpRootKey] ?? {};
+        section[mcp.name] = renderMcpForTarget(mcp, spec);
+        cfg[spec.mcpRootKey] = section;
+        return true;
+    });
+    setClaudeProjectMcpApproval(mcp.name, spec, true);
 }
 function unregisterMcpInTarget(mcpName, spec) {
     if (spec.mcpMechanism === "hermes-cli") {
@@ -282,14 +465,17 @@ function unregisterMcpInTarget(mcpName, spec) {
     }
     if (!existsSync(spec.mcpConfigPath))
         return false;
-    const cfg = readJsonOrEmpty(spec.mcpConfigPath);
-    const section = cfg[spec.mcpRootKey];
-    if (!section || !(mcpName in section))
+    const removed = updateJsonFile(spec.mcpConfigPath, (cfg) => {
+        const section = cfg[spec.mcpRootKey];
+        if (!section || !(mcpName in section))
+            return false;
+        delete section[mcpName];
+        cfg[spec.mcpRootKey] = section;
+        return true;
+    });
+    if (!removed)
         return false;
-    delete section[mcpName];
-    cfg[spec.mcpRootKey] = section;
-    backupIfExists(spec.mcpConfigPath);
-    atomicWriteFile(spec.mcpConfigPath, `${JSON.stringify(cfg, null, 2)}\n`);
+    setClaudeProjectMcpApproval(mcpName, spec, false);
     return true;
 }
 const HERMES_CLI_TIMEOUT_MS = 20_000;
@@ -439,7 +625,7 @@ function tomlBasicString(s) {
 }
 export function renderMcpToml(mcp) {
     if (mcp.transport === "stdio") {
-        const { command, args } = adaptStdioCommand(mcp.command ?? "", mcp.args ?? []);
+        const { command, args } = stdioLaunch(mcp);
         const lines = [`[mcp_servers.${mcp.name}]`, `command = ${tomlBasicString(command)}`];
         if (args.length > 0) {
             lines.push(`args = [${args.map((a) => tomlBasicString(a)).join(", ")}]`);
@@ -619,31 +805,27 @@ const LEGACY_RENAMED_SKILLS = ["alanube", "alegra-producto", "alegra-ce-universe
 function stripMcpEntries(path, names) {
     if (!existsSync(path) || names.length === 0)
         return;
-    let cfg;
     try {
-        cfg = JSON.parse(readFileSync(path, "utf-8"));
+        updateJsonFile(path, (cfg) => {
+            let changed = false;
+            for (const key of ["mcpServers", "mcp"]) {
+                const section = cfg[key];
+                if (!section || typeof section !== "object")
+                    continue;
+                for (const n of names) {
+                    if (n in section) {
+                        delete section[n];
+                        changed = true;
+                    }
+                }
+                if (Object.keys(section).length === 0)
+                    delete cfg[key];
+            }
+            return changed;
+        });
     }
     catch {
-        return;
-    }
-    let changed = false;
-    for (const key of ["mcpServers", "mcp"]) {
-        const section = cfg[key];
-        if (!section || typeof section !== "object")
-            continue;
-        for (const n of names) {
-            if (n in section) {
-                delete section[n];
-                changed = true;
-            }
-        }
-        if (Object.keys(section).length === 0)
-            delete cfg[key];
     }
-    if (!changed)
-        return;
-    backupIfExists(path);
-    atomicWriteFile(path, `${JSON.stringify(cfg, null, 2)}\n`);
 }
 function cleanupLegacySkillArtifacts(spec) {
     try {
@@ -829,16 +1011,48 @@ export function installMcp(mcp, opts = {}) {
             error: `entry local retirada — ${hint}`,
         };
     }
-    const wantedTargets = resolveTargets(opts).filter((t) => !mcp.targets || mcp.targets.includes(t.id));
+    const selected = resolveTargets(opts).filter((t) => !mcp.targets || mcp.targets.includes(t.id));
+    const unscopable = getMcpScopeDir()
+        ? selected.filter((t) => !getUserScopeMcpConfigPath(t.id))
+        : [];
+    const wantedTargets = selected.filter((t) => !unscopable.includes(t));
     const targetIds = wantedTargets.map((t) => t.id);
+    const retiredUnscoped = opts.dryRun || unscopable.length === 0
+        ? []
+        : retireFromUnscopableTargets(mcp, unscopable, lock.mcps[mcp.name]);
+    const unscopedNote = unscopable.length > 0
+        ? `con MCP_DIR solo va a Claude Code/Cursor; no se instala en ${unscopable.map((t) => t.id).join(", ")}${retiredUnscoped.length > 0 ? ` (retirado de ${retiredUnscoped.join(", ")})` : ""}`
+        : undefined;
     if (targetIds.length === 0) {
+        const prevEntry = lock.mcps[mcp.name];
+        if (prevEntry && retiredUnscoped.length > 0) {
+            const left = (prevEntry.targets ?? []).filter((t) => !retiredUnscoped.includes(t));
+            if (left.length > 0)
+                lock.mcps[mcp.name] = { ...prevEntry, targets: left };
+            else
+                delete lock.mcps[mcp.name];
+            writeLockFile(lock);
+        }
         return {
             name: mcp.name,
             kind: "mcp",
-            status: "skipped",
-            error: "ningún target soportado disponible",
+            status: retiredUnscoped.length > 0 ? "updated" : "skipped",
+            error: unscopedNote ?? "ningún target soportado disponible",
         };
     }
+    if (mcp.lazy && !opts.dryRun) {
+        try {
+            ensureLazyProxy(mcp);
+        }
+        catch (err) {
+            return {
+                name: mcp.name,
+                kind: "mcp",
+                status: "failed",
+                error: `no se pudo escribir el proxy de arranque diferido: ${err instanceof Error ? err.message : String(err)}`,
+            };
+        }
+    }
     const prev = lock.mcps[mcp.name];
     const targetsMatch = prev?.targets &&
         prev.targets.length === targetIds.length &&
@@ -854,6 +1068,27 @@ export function installMcp(mcp, opts = {}) {
         .filter((t) => !writeTargets.includes(t) && !needsWrite(t))
         .map((t) => t.id);
     if (writeTargets.length === 0 && targetsMatch) {
+        const retired = opts.dryRun ? [] : retireStaleMcpCopies(mcp, wantedTargets, prev);
+        const configPaths = { ...(prev?.configPaths ?? {}), ...scopedConfigPaths(targetIds) };
+        if (prev &&
+            (retired.length > 0 ||
+                stableStringify(configPaths) !== stableStringify(prev.configPaths ?? {}))) {
+            lock.mcps[mcp.name] = { ...prev, configPaths };
+            writeLockFile(lock);
+        }
+        if (retired.length > 0 || retiredUnscoped.length > 0) {
+            const notes = [
+                retired.length > 0 ? `copia de otro scope retirada de ${retired.join(", ")}` : "",
+                retiredUnscoped.length > 0 ? (unscopedNote ?? "") : "",
+            ].filter(Boolean);
+            return {
+                name: mcp.name,
+                kind: "mcp",
+                status: "updated",
+                targets: targetIds,
+                error: notes.join("; "),
+            };
+        }
         return { name: mcp.name, kind: "mcp", status: "unchanged", targets: targetIds };
     }
     if (opts.dryRun) {
@@ -885,6 +1120,7 @@ export function installMcp(mcp, opts = {}) {
             error: failures.join("; "),
         };
     }
+    const retired = retireStaleMcpCopies(mcp, okTargets.map((id) => TARGETS[id]), prev);
     const renderedHash = { ...(prev?.renderedHash ?? {}) };
     for (const t of writeTargets) {
         if (okTargets.includes(t.id))
@@ -892,7 +1128,10 @@ export function installMcp(mcp, opts = {}) {
     }
     const outOfScopeTargets = configChanged
         ? []
-        : (prev?.targets ?? []).filter((t) => !targetIds.includes(t) && (!mcp.targets || mcp.targets.includes(t)));
+        : (prev?.targets ?? []).filter((t) => !targetIds.includes(t) &&
+            (!mcp.targets || mcp.targets.includes(t)) &&
+            !retiredUnscoped.includes(t) &&
+            !(getMcpScopeDir() && !getUserScopeMcpConfigPath(t)));
     const lockTargets = [...new Set([...outOfScopeTargets, ...okTargets])];
     lock.mcps[mcp.name] = {
         name: mcp.name,
@@ -901,6 +1140,7 @@ export function installMcp(mcp, opts = {}) {
         configHash: mcpConfigHash(mcp),
         targets: lockTargets,
         renderedHash,
+        configPaths: { ...(prev?.configPaths ?? {}), ...scopedConfigPaths(okTargets) },
     };
     writeLockFile(lock);
     return {
@@ -908,7 +1148,13 @@ export function installMcp(mcp, opts = {}) {
         kind: "mcp",
         status: prev ? "updated" : "installed",
         targets: okTargets,
-        error: failures.length > 0 ? `targets con fallo — ${failures.join("; ")}` : undefined,
+        error: [
+            failures.length > 0 ? `targets con fallo — ${failures.join("; ")}` : "",
+            retired.length > 0 ? `copia de otro scope retirada de ${retired.join(", ")}` : "",
+            unscopedNote ?? "",
+        ]
+            .filter(Boolean)
+            .join("; ") || undefined,
     };
 }
 export async function installAll(opts = {}) {
@@ -936,6 +1182,15 @@ export async function installAll(opts = {}) {
         const mcp = manifest.mcps?.[name];
         if (!mcp)
             continue;
+        if (mcp.name !== name) {
+            results.push({
+                name,
+                kind: "mcp",
+                status: "failed",
+                error: `la entry "${name}" declara name "${mcp.name}"`,
+            });
+            continue;
+        }
         results.push(installMcp(mcp, { ...opts, targets }));
     }
     return { manifest, results, targets };
@@ -1002,6 +1257,18 @@ export function uninstallMcp(name, opts = {}) {
         try {
             for (const tId of targetIds) {
                 unregisterMcpInTarget(name, TARGETS[tId]);
+                const recorded = prev.configPaths?.[tId];
+                if (recorded && recorded !== TARGETS[tId].mcpConfigPath) {
+                    try {
+                        if (removeMcpEntryAt(recorded, TARGETS[tId].mcpRootKey, name, () => true)) {
+                            if (tId === "claude-code" && basename(recorded) === ".mcp.json") {
+                                setClaudeProjectMcpApproval(name, TARGETS[tId], false, dirname(recorded));
+                            }
+                        }
+                    }
+                    catch {
+                    }
+                }
             }
         }
         catch (err) {
@@ -1014,6 +1281,7 @@ export function uninstallMcp(name, opts = {}) {
         }
         delete lock.mcps[name];
         writeLockFile(lock);
+        rmSync(lazyToolsPath(name), { force: true });
     }
     return { name, kind: "mcp", status: "installed", targets: targetIds };
 }
@@ -1032,6 +1300,13 @@ export function uninstallAll(opts = {}) {
             catch {
             }
         }
+        if (Object.keys(readLockFile().mcps ?? {}).length === 0) {
+            try {
+                rmSync(lazyMcpDir(), { recursive: true, force: true });
+            }
+            catch {
+            }
+        }
     }
     return results;
 }
@@ -1064,6 +1339,7 @@ export function detectDrift(manifest) {
         unchanged: [],
         orphaned: [],
         missing: [],
+        outOfPlace: [],
     };
     const manifestMcps = manifest.mcps ?? {};
     for (const name of Object.keys(manifestMcps)) {
@@ -1079,9 +1355,13 @@ export function detectDrift(manifest) {
             continue;
         }
         const missing = mcpNeedsRepairInTargets(manifestMcps[name], (prevMcp.targets ?? []), prevMcp.renderedHash);
-        if (missing.length > 0) {
+        const outOfPlace = mcpOutOfPlace(manifestMcps[name], prevMcp);
+        if (missing.length > 0 || outOfPlace.length > 0) {
             mcps.toUpdate.push(name);
-            mcps.missing.push(name);
+            if (missing.length > 0)
+                mcps.missing.push(name);
+            if (outOfPlace.length > 0)
+                mcps.outOfPlace.push(name);
         }
         else {
             mcps.unchanged.push(name);

package/dist/lazy-mcp.js

@@ -0,0 +1,198 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { COMMAND_NAME, adaptStdioCommand } from "./lib.js";
+export function lazyMcpDir() {
+    return join(homedir(), ".alegra", "mcp");
+}
+export function lazyProxyPath() {
+    return join(lazyMcpDir(), "lazy-mcp-proxy.mjs");
+}
+export function lazyToolsPath(name) {
+    return join(lazyMcpDir(), `${name}.tools.json`);
+}
+export function stdioLaunch(mcp, platform = process.platform) {
+    const inner = adaptStdioCommand(mcp.command ?? "", mcp.args ?? [], platform);
+    if (!mcp.lazy)
+        return inner;
+    return {
+        command: "node",
+        args: [lazyProxyPath(), lazyToolsPath(mcp.name), "--", inner.command, ...inner.args],
+    };
+}
+export function ensureLazyProxy(mcp) {
+    if (!mcp.lazy)
+        return;
+    mkdirSync(lazyMcpDir(), { recursive: true });
+    writeIfChanged(lazyProxyPath(), lazyProxySource());
+    writeIfChanged(lazyToolsPath(mcp.name), `${JSON.stringify({
+        name: mcp.name,
+        ...(mcp.lazy.protocolVersion ? { protocolVersion: mcp.lazy.protocolVersion } : {}),
+        tools: mcp.lazy.tools,
+    }, null, 2)}\n`);
+}
+function writeIfChanged(path, content) {
+    if (existsSync(path) && readFileSync(path, "utf-8") === content)
+        return;
+    const tmp = `${path}.${process.pid}.tmp`;
+    writeFileSync(tmp, content, { mode: 0o644 });
+    renameSync(tmp, path);
+}
+export function lazyProxySource() {
+    const product = JSON.stringify(COMMAND_NAME);
+    return `#!/usr/bin/env node
+// Proxy de arranque diferido de ${COMMAND_NAME}. Generado por el instalador: no
+// editar, se reescribe en cada install/update. Uso:
+//   node lazy-mcp-proxy.mjs <tools.json> -- <comando real> [args…]
+import { spawn, spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { createInterface } from "node:readline";
+
+const argv = process.argv.slice(2);
+const sep = argv.indexOf("--");
+if (sep !== 1 || argv.length < 3) {
+  process.stderr.write("uso: lazy-mcp-proxy.mjs <tools.json> -- <comando> [args…]\\n");
+  process.exit(2);
+}
+const spec = JSON.parse(readFileSync(argv[0], "utf8"));
+const [cmd, ...args] = argv.slice(2);
+const INIT_ID = "__alegra_lazy_init__";
+const START_TIMEOUT_MS = 10 * 60 * 1000;
+
+const send = (m) => process.stdout.write(JSON.stringify(m) + "\\n");
+const key = (id) => JSON.stringify(id);
+let initParams = null;
+let child = null;
+let ready = false;
+let dead = null;
+let startTimer = null;
+const queue = [];
+// Requests reenviadas al server que todavía no tuvieron respuesta.
+const inflight = new Map();
+
+function errorFor(m, reason) {
+  if (m.method === "tools/call") {
+    return { jsonrpc: "2.0", id: m.id, result: { content: [{ type: "text", text: reason }], isError: true } };
+  }
+  return { jsonrpc: "2.0", id: m.id, error: { code: -32603, message: reason } };
+}
+
+function killChild() {
+  if (!child || child.exitCode !== null) return;
+  if (process.platform === "win32") {
+    spawnSync("taskkill", ["/pid", String(child.pid), "/T", "/F"], { stdio: "ignore" });
+  } else {
+    child.kill("SIGTERM");
+  }
+}
+
+function die(reason) {
+  if (dead) return;
+  dead = reason;
+  ready = false;
+  clearTimeout(startTimer);
+  for (const m of queue.splice(0)) send(errorFor(m, reason));
+  for (const m of inflight.values()) send(errorFor(m, reason));
+  inflight.clear();
+  killChild();
+}
+
+function forward(m) {
+  if (m.id !== undefined && m.id !== null && m.method) inflight.set(key(m.id), m);
+  child.stdin.write(JSON.stringify(m) + "\\n");
+}
+
+function start() {
+  if (child || dead) return;
+  child = spawn(cmd, args, { stdio: ["pipe", "pipe", "inherit"] });
+  startTimer = setTimeout(
+    () => die("El MCP " + spec.name + " tardó más de 10 min en arrancar (¿se cortó la descarga?). Reintentá en una sesión nueva."),
+    START_TIMEOUT_MS,
+  );
+  child.on("error", (e) => die("No se pudo arrancar el MCP " + spec.name + ": " + e.message));
+  // "close" y no "exit": en "exit" el stdout del server todavía puede tener
+  // respuestas sin leer.
+  child.on("close", (code, signal) => {
+    die("El MCP " + spec.name + " terminó (" + (signal ?? "código " + code) + "). Reintentá en una sesión nueva; si persiste, corré " + ${product} + " status.");
+  });
+  createInterface({ input: child.stdout }).on("line", (line) => {
+    let m;
+    try { m = JSON.parse(line); } catch { m = null; }
+    if (ready) {
+      if (m && m.id !== undefined && !m.method) inflight.delete(key(m.id));
+      process.stdout.write(line + "\\n");
+      return;
+    }
+    if (!m || m.id !== INIT_ID) return; // notificaciones previas al handshake
+    if (m.error) {
+      die("El MCP " + spec.name + " rechazó el handshake: " + (m.error.message ?? "sin detalle"));
+      return;
+    }
+    ready = true;
+    clearTimeout(startTimer);
+    child.stdin.write(JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }) + "\\n");
+    for (const q of queue.splice(0)) forward(q);
+  });
+  child.stdin.on("error", () => {});
+  child.stdin.write(JSON.stringify({ jsonrpc: "2.0", id: INIT_ID, method: "initialize", params: initParams }) + "\\n");
+}
+
+createInterface({ input: process.stdin }).on("line", (line) => {
+  let m;
+  try { m = JSON.parse(line); } catch { return; }
+  if (ready) {
+    forward(m);
+    return;
+  }
+  switch (m.method) {
+    case "initialize":
+      initParams = m.params ?? {};
+      send({
+        jsonrpc: "2.0",
+        id: m.id,
+        result: {
+          protocolVersion: spec.protocolVersion ?? initParams.protocolVersion ?? "2025-06-18",
+          capabilities: { tools: {} },
+          serverInfo: { name: spec.name, version: "lazy" },
+        },
+      });
+      return;
+    case "ping":
+      send({ jsonrpc: "2.0", id: m.id, result: {} });
+      return;
+    case "tools/list":
+      send({ jsonrpc: "2.0", id: m.id, result: { tools: spec.tools } });
+      return;
+    case "resources/list":
+      send({ jsonrpc: "2.0", id: m.id, result: { resources: [] } });
+      return;
+    case "resources/templates/list":
+      send({ jsonrpc: "2.0", id: m.id, result: { resourceTemplates: [] } });
+      return;
+    case "prompts/list":
+      send({ jsonrpc: "2.0", id: m.id, result: { prompts: [] } });
+      return;
+    case "notifications/cancelled": {
+      // Una request cancelada mientras el server arranca no se reenvía.
+      const i = queue.findIndex((q) => key(q.id) === key(m.params?.requestId));
+      if (i >= 0) queue.splice(i, 1);
+      return;
+    }
+  }
+  if (m.id === undefined || m.id === null) return; // notificación: nada que contestar
+  if (dead) {
+    send(errorFor(m, dead));
+    return;
+  }
+  queue.push(m);
+  start();
+});
+
+function shutdown() {
+  killChild();
+  process.exit(0);
+}
+process.stdin.on("end", shutdown);
+for (const sig of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(sig, shutdown);
+`;
+}

package/dist/lib.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join, relative, sep } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 export const PRODUCT_NAME = "alegra-data-agent";
 export const COMMAND_NAME = "alegra-data-agent";
@@ -29,6 +29,84 @@ export function getClaudeSettingsPath() {
 export function getClaudeJsonPath() {
     return join(homedir(), ".claude.json");
 }
+export function getAgentConfPath() {
+    return join(homedir(), ".alegra", "agent.conf");
+}
+function readAgentConf() {
+    const path = getAgentConfPath();
+    if (!existsSync(path))
+        return {};
+    let raw;
+    try {
+        raw = readFileSync(path, "utf-8");
+    }
+    catch {
+        return {};
+    }
+    const out = {};
+    for (const line0 of raw.split("\n")) {
+        const line = line0.trim();
+        if (line.length === 0 || line.startsWith("#"))
+            continue;
+        const eq = line.indexOf("=");
+        if (eq <= 0)
+            continue;
+        const key = line.slice(0, eq).trim();
+        const value = line
+            .slice(eq + 1)
+            .trim()
+            .replace(/^(["'])(.*)\1$/, "$2");
+        if (key.length > 0)
+            out[key] = value;
+    }
+    return out;
+}
+function resolveMcpScope() {
+    const raw = process.env.ALEGRA_DATA_AGENT_MCP_DIR ?? readAgentConf().MCP_DIR;
+    if (!raw || raw.trim().length === 0)
+        return { dir: undefined, warning: undefined };
+    const expanded = raw.trim().replace(/^~(?=$|\/)/, homedir());
+    if (!isAbsolute(expanded)) {
+        return {
+            dir: undefined,
+            warning: `MCP_DIR debe ser una ruta absoluta; se ignoró "${raw.trim()}"`,
+        };
+    }
+    const dir = resolve(expanded);
+    let isDir;
+    try {
+        isDir = existsSync(dir) && statSync(dir).isDirectory();
+    }
+    catch {
+        isDir = false;
+    }
+    if (!isDir) {
+        return {
+            dir: undefined,
+            warning: `MCP_DIR apunta a una carpeta que no existe; se ignoró "${dir}"`,
+        };
+    }
+    return { dir, warning: undefined };
+}
+export function isMcpScopeEnvOverride() {
+    const env = process.env.ALEGRA_DATA_AGENT_MCP_DIR;
+    if (env === undefined)
+        return false;
+    return env.trim() !== (readAgentConf().MCP_DIR ?? "").trim();
+}
+export function getMcpScopeWarning() {
+    return resolveMcpScope().warning;
+}
+export function getMcpScopeDir() {
+    return resolveMcpScope().dir;
+}
+function mcpScopedPath(relPath, fallback) {
+    const dir = getMcpScopeDir();
+    return dir ? join(dir, relPath) : fallback;
+}
+export function getClaudeMcpConfigPath() {
+    return mcpScopedPath(".mcp.json", getClaudeJsonPath());
+}
 export function getCursorSkillsDir() {
     return join(homedir(), ".cursor", "skills");
 }
@@ -36,8 +114,18 @@ export function getCursorLegacyRulesDir() {
     return join(homedir(), ".cursor", "rules");
 }
 export function getCursorMcpPath() {
+    return mcpScopedPath(join(".cursor", "mcp.json"), getCursorUserMcpPath());
+}
+export function getCursorUserMcpPath() {
     return join(homedir(), ".cursor", "mcp.json");
 }
+export function getUserScopeMcpConfigPath(target) {
+    if (target === "claude-code")
+        return getClaudeJsonPath();
+    if (target === "cursor")
+        return getCursorUserMcpPath();
+    return undefined;
+}
 export function getOpenCodeSkillsDir() {
     const xdgHome = process.env.XDG_CONFIG_HOME;
     const base = xdgHome && xdgHome.length > 0 ? xdgHome : join(homedir(), ".config");
@@ -137,7 +225,7 @@ export function getTargetSkillsDir(target) {
 export function getTargetMcpConfigPath(target) {
     switch (target) {
         case "claude-code":
-            return getClaudeJsonPath();
+            return getClaudeMcpConfigPath();
         case "cursor":
             return getCursorMcpPath();
         case "opencode":

package/dist/render.js

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { extname, join } from "node:path";
-import { adaptStdioCommand, parseFrontmatter } from "./lib.js";
+import { stdioLaunch } from "./lazy-mcp.js";
+import { parseFrontmatter } from "./lib.js";
 function readSkillEntryPoint(skillDir) {
     const candidates = ["SKILL.md", "README.md"];
     for (const c of candidates) {
@@ -95,7 +96,7 @@ export function renderMcpForTarget(mcp, spec) {
     return obj;
 }
 function renderStdioMcpForTarget(mcp, spec) {
-    const { command, args } = adaptStdioCommand(mcp.command ?? "", mcp.args ?? []);
+    const { command, args } = stdioLaunch(mcp);
     const hasEnv = mcp.env && Object.keys(mcp.env).length > 0;
     if (spec.id === "opencode") {
         const obj = { type: "local", command: [command, ...args], enabled: true };
@@ -125,7 +126,7 @@ function bearerInterpolation(env, target) {
 }
 export function renderHermesMcpOps(mcp) {
     if (mcp.transport === "stdio") {
-        const { command, args } = adaptStdioCommand(mcp.command ?? "", mcp.args ?? []);
+        const { command, args } = stdioLaunch(mcp);
         const ops = [{ path: "command", value: command }];
         if (args.length > 0)
             ops.push({ path: "args", value: JSON.stringify(args) });

package/dist/signature.js

@@ -12,16 +12,19 @@ export const TRUSTED_KEYS = [
 ];
 export const PUBLIC_KEY_B64 = TRUSTED_KEYS[0].publicKeyB64;
 export function canonicalize(obj) {
-    if (obj === null || typeof obj !== "object")
-        return JSON.stringify(obj);
-    if (Array.isArray(obj)) {
-        return `[${obj.map((v) => canonicalize(v)).join(",")}]`;
+    return canonicalValue(obj, true);
+}
+function canonicalValue(value, isRoot) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value)) {
+        return `[${value.map((v) => canonicalValue(v, false)).join(",")}]`;
     }
-    const o = obj;
+    const o = value;
     const keys = Object.keys(o)
-        .filter((k) => k !== "signature")
+        .filter((k) => !(isRoot && k === "signature"))
         .sort();
-    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalize(o[k])}`).join(",")}}`;
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalValue(o[k], false)}`).join(",")}}`;
 }
 const MAX_MANIFEST_AGE_DAYS = 90;
 export function verifyManifestSignature(manifest, options = {}) {

package/dist/targets.js

@@ -1,7 +1,7 @@
 import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { getAntigravityGeminiSkillsDir, getAntigravityMcpConfigPath, getAntigravitySkillsDir, getClaudeJsonPath, getClaudeSkillsDir, getCodexConfigPath, getCodexSkillsDir, getCursorMcpPath, getCursorSkillsDir, getHermesConfigPath, getHermesHome, getHermesSkillsDir, getOpenCodeConfigPath, getOpenCodeSkillsDir, } from "./lib.js";
+import { getAntigravityGeminiSkillsDir, getAntigravityMcpConfigPath, getAntigravitySkillsDir, getClaudeMcpConfigPath, getClaudeSkillsDir, getCodexConfigPath, getCodexSkillsDir, getCursorMcpPath, getCursorSkillsDir, getHermesConfigPath, getHermesHome, getHermesSkillsDir, getOpenCodeConfigPath, getOpenCodeSkillsDir, } from "./lib.js";
 export const TARGETS = {
     "claude-code": {
         id: "claude-code",
@@ -9,7 +9,7 @@ export const TARGETS = {
         mcpHttpTypeValue: "http",
         skillsDir: getClaudeSkillsDir(),
         skillFormat: "folder",
-        mcpConfigPath: getClaudeJsonPath(),
+        mcpConfigPath: getClaudeMcpConfigPath(),
         mcpRootKey: "mcpServers",
         mcpUrlKey: "url",
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alegra-data-agent",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "private": false,
   "description": "Agente de Data interno de Alegra. Instala skills + MCPs en tu cliente de IA con un comando.",
   "license": "UNLICENSED",