buddy-agent-harness 0.9.1 → 0.11.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "buddy-agent-harness",
-	"version": "0.9.1",
+	"version": "0.11.0",
 	"description": "Initialize standards-based agent configuration across agent harnesses",
 	"author": {
 		"name": "repobuddy"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "buddy-agent-harness",
-	"version": "0.9.1",
+	"version": "0.11.0",
 	"description": "Initialize standards-based agent configuration across agent harnesses",
 	"author": {
 		"name": "repobuddy"

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "buddy-agent-harness",
-	"version": "0.9.1",
+	"version": "0.11.0",
 	"description": "Initialize standards-based agent configuration across agent harnesses",
 	"author": {
 		"name": "repobuddy"

package/dist/cli.mjs

@@ -17876,6 +17876,13 @@ function transportOf(entry) {
 * is a string is not a timeout, and letting it into the model would report a divergence whose real
 * cause is a typo the finding does not name.
 */
+/**
+* Exported for `mcp-inventory.ts`, which reads a handful of sources this module's own `McpConfig`
+* shape cannot describe — a plugin's flat `.mcp.json`, a project entry nested inside `~/.claude.json`,
+* and hosts whose `command` is an array or an object rather than a string. Each of those normalizes
+* its raw entry into this same field shape before calling this function, so one reader still decides
+* what counts as `transport`, `args`, and the rest.
+*/
 function serverFrom(entry) {
 	const args = Array.isArray(entry["args"]) && entry["args"].every((item) => typeof item === "string");
 	const transport = transportOf(entry);

package/dist/index.d.mts

@@ -110,7 +110,7 @@ type NonstandardArtifact = {
 };
 //#endregion
 //#region src/harness-registry/harness-registry.d.ts
-type HarnessName = "claude-code" | "cursor" | "codex" | "copilot-cli" | "gemini-cli" | "devin-desktop" | "windsurf";
+type HarnessName = "claude-code" | "cursor" | "codex" | "copilot-cli" | "gemini-cli" | "devin-desktop" | "windsurf" | "vscode" | "opencode" | "zed";
 /** The two scopes a harness reads configuration at. Their roots differ; their shape does not. */
 type HarnessScopeName = "project" | "user";
 /**
@@ -598,5 +598,83 @@ type InitializeResult = {
 };
 export declare function initializeHarnesses({ root, harnesses: preferred, copy, force }: InitializeOptions): InitializeResult;
 //#endregion
-export type { BridgeFinding, BridgeKind, BridgeProblem, BridgeReport, BridgeStatus, ConfigurationFault, ConfigurationProblem, DiagnoseMcpOptions, DiagnoseOptions, DiagnoseResult, DivergenceDirection, DivergenceReport, DoctorProblem, DoctorReport, Harness, HarnessName, HarnessScope, HarnessScopeName, InitializeOptions, InitializeResult, InstructionBridge, InstructionKind, InstructionProblem, InstructionReport, InstructionStatus, McpConfig, McpDirection, McpField, McpProblem, McpServer, McpTransport, Repair };
+//#region src/mcp-inventory/mcp-inventory.d.ts
+/**
+ * A public, redaction-safe inventory of configured MCP servers: what `diagnoseMcp` already knows how
+ * to read, reshaped for a consumer that wants a list rather than a drift diagnosis.
+ *
+ * This is a **different question** than `doctor` answers, not a wider version of it. `doctor`
+ * compares project-scope configuration against a golden set the user authors, and stays
+ * project-scope only by design — see `apps/web/src/content/docs/agent-configuration/mcp-servers.md`
+ * for why reading a user's home directory is a wider blast radius than diagnosis needs. An inventory
+ * has no golden set to compare against and nothing to diagnose; it answers "what MCP servers does
+ * this project, and this machine, already have configured", which is a question a consumer can only
+ * answer by reading both scopes. Adding user scope here changes nothing about what `doctor` reads:
+ * `diagnoseMcp` still touches `harness.project.mcpConfig` alone.
+ *
+ * Beyond `harnessRegistry`'s own harnesses this module also covers sources `doctor` never diagnoses
+ * at all and that carry no `harnessRegistry` entry: VS Code, Windsurf/Devin Desktop's legacy config
+ * path, OpenCode, and Zed at both scopes; Claude Code's project-local servers nested inside
+ * `~/.claude.json`; and the MCP servers an installed Claude Code plugin ships. None of this changes
+ * `selectHarnesses`, `diagnoseMcp`, or `doctor`'s project-scope-only policy — this module reads none
+ * of it through those functions.
+ *
+ * Every field that could carry a credential is reduced before it leaves this module, the same
+ * discipline `mcp-secrets.ts` documents for `doctor`'s own findings: `command` is trimmed to its
+ * basename, `args` drops any `--flag=value` pair `nonSecretArgs` flags, and `url` is trimmed to its
+ * origin and path. `env` and `headers` are not returned at all — a name alone does not say whether
+ * the value behind it is a literal or a reference, and the safe answer is not to carry the map.
+ */
+/**
+ * The two scopes `harnessRegistry` knows, plus the two this module adds on top of it.
+ *
+ * `local` is Claude Code's project-scoped entry inside the user-level `~/.claude.json` — a server
+ * declared for one project only, not visible to any other. `plugin` is a server an installed Claude
+ * Code plugin ships; `McpServerEntry.plugin` names which one. Neither fits `project` (there is no
+ * project-scope file) or `user` (the entry does not apply to every project), so both get their own
+ * name rather than being folded into the nearer of the two and read wrong.
+ */
+type McpServerScope = HarnessScopeName | "local" | "plugin";
+/** One configured MCP server, redacted of everything that could carry a credential. */
+type McpServerEntry = {
+  harness: HarnessName;
+  scope: McpServerScope;
+  /** The absolute path of the config file this entry was read from. */
+  configFile: string;
+  /** The name the server is declared under. */
+  name: string;
+  transport: McpTransport | undefined;
+  /** The command's basename, never its full path. */
+  command: string | undefined;
+  /** `args`, with any credential-bearing `--flag=value` pair dropped. */
+  args: readonly string[];
+  /** The URL's origin and path, never its query string. */
+  url: string | undefined;
+  enabled: boolean;
+  /** The plugin id this server came from, set only when `scope` is `'plugin'`. */
+  plugin?: string;
+};
+type ListMcpServersOptions = {
+  /** The project directory to read project-scope configuration from. */
+  projectDir: string;
+  /** Overrides `os.homedir()`, for a test that must not touch the real one. */
+  homeDir?: string;
+  /** Overrides `process.env`, for a test — read only for `CODEX_HOME`, `COPILOT_HOME`, and `XDG_CONFIG_HOME`. */
+  env?: Readonly<Record<string, string | undefined>>;
+  /** Overrides `os.platform()`, so the VS Code user directory is testable on every OS. */
+  platform?: NodeJS.Platform;
+};
+/**
+ * Every MCP server configured for a project, across every supported harness and every scope that
+ * harness documents — without ever surfacing a credential.
+ *
+ * Reuses `diagnoseMcp`'s own parsing (`parseTarget`, `serverFrom`), model (`McpServer`), and
+ * redaction (`nonSecretArgs`, and the URL/command trimming this module adds) rather than re-reading
+ * or re-parsing any of the supported harnesses' MCP files. A harness with no file present, or one
+ * whose file does not parse, contributes no entries; this function reports an inventory, not a
+ * diagnosis, so it has nothing to say about why a file is missing or broken.
+ */
+export declare function listMcpServers(options: ListMcpServersOptions): McpServerEntry[];
+//#endregion
+export type { BridgeFinding, BridgeKind, BridgeProblem, BridgeReport, BridgeStatus, ConfigurationFault, ConfigurationProblem, DiagnoseMcpOptions, DiagnoseOptions, DiagnoseResult, DivergenceDirection, DivergenceReport, DoctorProblem, DoctorReport, Harness, HarnessName, HarnessScope, HarnessScopeName, InitializeOptions, InitializeResult, InstructionBridge, InstructionKind, InstructionProblem, InstructionReport, InstructionStatus, ListMcpServersOptions, McpConfig, McpDirection, McpField, McpProblem, McpServer, McpServerEntry, McpTransport, Repair };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/cli.ts","../src/harness-registry/instruction-bridge.ts","../src/harness-registry/mcp-config.ts","../src/harness-registry/nonstandard-artifact.ts","../src/harness-registry/harness-registry.ts","../src/diagnose-bridges/diagnose-instructions.ts","../src/diagnose-bridges/locator.ts","../src/diagnose-bridges/doctor-guidance.ts","../src/diagnose-bridges/git-bridge-state.ts","../src/diagnose-bridges/diagnose-bridges.ts","../src/diagnose-configuration/diagnose-configuration.ts","../src/diagnose-bridges/doctor.command.ts","../src/diagnose-mcp/diagnose-mcp.ts","../src/diagnose-mcp/mcp-model.ts","../src/diagnose-mcp/mcp-baseline.ts","../src/diagnose-mcp/mcp-sources.ts","../src/initialize-harnesses/init.command.ts","../src/skill-projection/skill-projection.ts","../src/initialize-harnesses/initialize-harnesses.ts"],"mappings":";;;;;;;;;;;;;wBAiDsB,IAAI,iBAAiB;;;;;;;;;;;;;;;KCrC/B;;;;;;EAOT;;EAEA;;;EAIA;;EAEA;;EAEA;;;;;;;;;;;;;;;;;;;;KCbS;;EAEX;;;;;;EAMA;;;;;EAKA;;;;;;EAMA;;;;;;;;;;;;;;;;;KCtBW;KAgBA;;;;;EAKX;;EAEA;EACA,MAAM;;;;KC/BK;;KAUA;;;;;;;;;;;;;;;;;;;;;;;;;KA0BA;EACX;EACA;EACA,oBAAoB;EACpB,YAAY;EACZ,uBAAuB;;KAGZ;EACX,MAAM;;EAEN,SAAS;;;;;EAKT,OAAO;;EAEP,aAAa;;;;;;;;;;;;;;;;;;;;;;qBAuBD,0BAA0B;;;;KCzE3B;;;;;;KAMA;KAEA;EACX,SAAS;;EAET;EACA,MAAM;EACN,QAAQ;;;;;;;;;;wBAkFO,qBACf,cACA,oBAAoB,WACpB;EACI,cAAc;EAAqB,UAAU;;;;;;;;;;;;;;;;;;;;KC5FtC;EAAa;EAAc;;KAE3B;;EAEX;;EAEA;;EAEA;;EAEA,WAAW;;;;;;;;;;KCbA;;;;;;;;;;;KAqBA;;;;;;;;;KAUA;;;;;;;;;KAoBA;KAOA;;KAOA,gBAAgB,gBAAgB,qBAAqB,qBAAqB,aAAa;;KAGvF,uBAAuB;;;;;;;;;;;;;;;;;;KAmBvB;;EAEX;;EAEA;;KAGW;EACX,SAAS;;EAET;;;;;;;EAOA,OAAO,IAAI,SAAS,cAAc;;;;;;EAMlC,YAAY,IAAI;;qBAyLJ,wBAAwB;qBA4CxB,6BAA6B;qBAuM7B,wBAAwB;qBAOxB;WACZ;WACA;;;;;;;;;;wBAmCe,kBAAkB;;;;KC/kBtB;;KAGA;;;;;;cAwBC;mBAIA;;mBAFK;EAEjB,YAAY;;;;;;EASZ,WAAW,eAAe;;;;;;;EAa1B,UAAU;;;;;;;;;EAaV,gBAAgB;;EAMhB,UAAU,gBAAgB;;;;;EAS1B,YAAY,gBAAgB,oBAAoB;;UAYxC;;;;;UAmBA;;;;KC5GG;KACA;KAEA;EACX,SAAS;;EAET;EACA,MAAM;EACN,QAAQ;;KAGG;EACX;;;;;EAKA,SAAS;EACT;;EAEA,QAAQ;;KAGG;EACX;EACA,WAAW;;KAGA;EACX;EACA,YAAY;;EAEZ;;KAGW;EACX,SAAS;;;;;EAKT,cAAc;EACd,YAAY;EACZ,UAAU;;;;;;;wBA2EK,kBAAkB,MAAM,WAAW,WAAgB,OAAO,kBAAkB;;;;;;;;;;;;;;;;;KC1GhF;;EAEX;EACA,SAAS;EACT;;EAEA,QAAQ;;;;KCfG;EACX;EACA,SAAS;EACT,cAAc;EACd,aAAa;;;;;EAKb;IAAY;IAAc,SAAS;IAAe;;;;;;;;;;EASlD,OAAO;;;;;;wBAOQ,kBACf,aACA,QAAQ,gBACR,gBAAe,yBACb;qBAgCU,eAAe,MAAI;;;;;;;;;;;;;;;;;;KC7CpB;EACX;EACA,KAAK;;EAEL;;wBAgCe,cAAc,MAAM,KAAK,OAAO,qBAAqB;;;;;;;;;;;;;;;;KClDzD;KAEA;EACX,YAAY;EACZ;EACA;EACA,MAAM,SAAS;EACf;EACA,UAAU,SAAS;EACnB;EACA;EACA;EACA;;;cAIY;KAaD,mBAAmB;;;;KCnCnB;;;;qBCAC;;;qBCAA,aAAa,MAAI;qBAoDjB,gBAAgB,MAAI;wBAMjB,WAAW;EAAgB,WAAW,gBAAgB;;;;;;;;;KCV1D;;;KCpDA;EACX;EACA,YAAY;EACZ;EACA,QAAQ;;KAEG;EACX;EACA,WAAW;EACX,QAAQ;EACR,QAAQ;;EAER,SAAS;;EAET;IAAc,MAAM;IAAa,YAAY;;EAC7C;EACA;;wBAGe,sBACf,MACA,WAAW,WACX,MACA,SACE,oBAAoB"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/cli.ts","../src/harness-registry/instruction-bridge.ts","../src/harness-registry/mcp-config.ts","../src/harness-registry/nonstandard-artifact.ts","../src/harness-registry/harness-registry.ts","../src/diagnose-bridges/diagnose-instructions.ts","../src/diagnose-bridges/locator.ts","../src/diagnose-bridges/doctor-guidance.ts","../src/diagnose-bridges/git-bridge-state.ts","../src/diagnose-bridges/diagnose-bridges.ts","../src/diagnose-configuration/diagnose-configuration.ts","../src/diagnose-bridges/doctor.command.ts","../src/diagnose-mcp/diagnose-mcp.ts","../src/diagnose-mcp/mcp-model.ts","../src/diagnose-mcp/mcp-baseline.ts","../src/diagnose-mcp/mcp-sources.ts","../src/initialize-harnesses/init.command.ts","../src/skill-projection/skill-projection.ts","../src/initialize-harnesses/initialize-harnesses.ts","../src/mcp-inventory/mcp-inventory.ts"],"mappings":";;;;;;;;;;;;;wBAiDsB,IAAI,iBAAiB;;;;;;;;;;;;;;;KCrC/B;;;;;;EAOT;;EAEA;;;EAIA;;EAEA;;EAEA;;;;;;;;;;;;;;;;;;;;KCbS;;EAEX;;;;;;EAMA;;;;;EAKA;;;;;;EAMA;;;;;;;;;;;;;;;;;KCtBW;KAgBA;;;;;EAKX;;EAEA;EACA,MAAM;;;;KC/BK;;KAqBA;;;;;;;;;;;;;;;;;;;;;;;;;KA0BA;EACX;EACA;EACA,oBAAoB;EACpB,YAAY;EACZ,uBAAuB;;KAGZ;EACX,MAAM;;EAEN,SAAS;;;;;EAKT,OAAO;;EAEP,aAAa;;;;;;;;;;;;;;;;;;;;;;qBAuBD,0BAA0B;;;;KCpF3B;;;;;;KAMA;KAEA;EACX,SAAS;;EAET;EACA,MAAM;EACN,QAAQ;;;;;;;;;;wBAkFO,qBACf,cACA,oBAAoB,WACpB;EACI,cAAc;EAAqB,UAAU;;;;;;;;;;;;;;;;;;;;KC5FtC;EAAa;EAAc;;KAE3B;;EAEX;;EAEA;;EAEA;;EAEA,WAAW;;;;;;;;;;KCbA;;;;;;;;;;;KAqBA;;;;;;;;;KAUA;;;;;;;;;KAoBA;KAOA;;KAOA,gBAAgB,gBAAgB,qBAAqB,qBAAqB,aAAa;;KAGvF,uBAAuB;;;;;;;;;;;;;;;;;;KAmBvB;;EAEX;;EAEA;;KAGW;EACX,SAAS;;EAET;;;;;;;EAOA,OAAO,IAAI,SAAS,cAAc;;;;;;EAMlC,YAAY,IAAI;;qBAyLJ,wBAAwB;qBA4CxB,6BAA6B;qBAuM7B,wBAAwB;qBAOxB;WACZ;WACA;;;;;;;;;;wBAmCe,kBAAkB;;;;KC/kBtB;;KAGA;;;;;;cAwBC;mBAIA;;mBAFK;EAEjB,YAAY;;;;;;EASZ,WAAW,eAAe;;;;;;;EAa1B,UAAU;;;;;;;;;EAaV,gBAAgB;;EAMhB,UAAU,gBAAgB;;;;;EAS1B,YAAY,gBAAgB,oBAAoB;;UAYxC;;;;;UAmBA;;;;KC5GG;KACA;KAEA;EACX,SAAS;;EAET;EACA,MAAM;EACN,QAAQ;;KAGG;EACX;;;;;EAKA,SAAS;EACT;;EAEA,QAAQ;;KAGG;EACX;EACA,WAAW;;KAGA;EACX;EACA,YAAY;;EAEZ;;KAGW;EACX,SAAS;;;;;EAKT,cAAc;EACd,YAAY;EACZ,UAAU;;;;;;;wBA2EK,kBAAkB,MAAM,WAAW,WAAgB,OAAO,kBAAkB;;;;;;;;;;;;;;;;;KC1GhF;;EAEX;EACA,SAAS;EACT;;EAEA,QAAQ;;;;KCfG;EACX;EACA,SAAS;EACT,cAAc;EACd,aAAa;;;;;EAKb;IAAY;IAAc,SAAS;IAAe;;;;;;;;;;EASlD,OAAO;;;;;;wBAOQ,kBACf,aACA,QAAQ,gBACR,gBAAe,yBACb;qBAgCU,eAAe,MAAI;;;;;;;;;;;;;;;;;;KC7CpB;EACX;EACA,KAAK;;EAEL;;wBAgCe,cAAc,MAAM,KAAK,OAAO,qBAAqB;;;;;;;;;;;;;;;;KClDzD;KAEA;EACX,YAAY;EACZ;EACA;EACA,MAAM,SAAS;EACf;EACA,UAAU,SAAS;EACnB;EACA;EACA;EACA;;;cAIY;KAaD,mBAAmB;;;;KCnCnB;;;;qBCAC;;;qBCAA,aAAa,MAAI;qBAoDjB,gBAAgB,MAAI;wBAMjB,WAAW;EAAgB,WAAW,gBAAgB;;;;;;;;;KCV1D;;;KCpDA;EACX;EACA,YAAY;EACZ;EACA,QAAQ;;KAEG;EACX;EACA,WAAW;EACX,QAAQ;EACR,QAAQ;;EAER,SAAS;;EAET;IAAc,MAAM;IAAa,YAAY;;EAC7C;EACA;;wBAGe,sBACf,MACA,WAAW,WACX,MACA,SACE,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KCmBX,iBAAiB;;KA2DjB;EACX,SAAS;EACT,OAAO;;EAEP;;EAEA;EACA,WAAW;;EAEX;;EAEA;;EAEA;EACA;;EAEA;;KAGW;;EAEX;;EAEA;;EAEA,MAAM,SAAS;;EAEf,WAAW,OAAO;;;;;;;;;;;;wBAwNH,eAAe,SAAS,wBAAwB"}

package/dist/index.mjs

@@ -2,7 +2,7 @@ import { createRequire } from "node:module";
 import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
 import { cli, command, exitCodes, z } from "clibuilder";
 import { homedir, platform } from "node:os";
-import { dirname, join, posix, relative, resolve, sep } from "node:path";
+import { basename, dirname, join, posix, relative, resolve, sep } from "node:path";
 import { encode } from "@toon-format/toon";
 import { parse } from "smol-toml";
 import { execFileSync } from "node:child_process";
@@ -1564,6 +1564,13 @@ function transportOf(entry) {
 * is a string is not a timeout, and letting it into the model would report a divergence whose real
 * cause is a typo the finding does not name.
 */
+/**
+* Exported for `mcp-inventory.ts`, which reads a handful of sources this module's own `McpConfig`
+* shape cannot describe — a plugin's flat `.mcp.json`, a project entry nested inside `~/.claude.json`,
+* and hosts whose `command` is an array or an object rather than a string. Each of those normalizes
+* its raw entry into this same field shape before calling this function, so one reader still decides
+* what counts as `transport`, `args`, and the rest.
+*/
 function serverFrom(entry) {
 	const args = Array.isArray(entry["args"]) && entry["args"].every((item) => typeof item === "string");
 	const transport = transportOf(entry);
@@ -1831,9 +1838,25 @@ function credentialFields(server) {
 		...server.url && urlHoldsCredential(server.url) ? ["url"] : []
 	];
 }
+/**
+* `args` with any `--flag=value` pair dropped whose flag names a credential and whose value is a
+* literal rather than a reference — the same test `credentialKey` and `holdsLiteral` apply to `env`
+* and `headers`, applied here to the one field that carries names and values in a single string
+* instead of a map.
+*
+* A positional argument, or a flag with no `=`, passes through unfiltered: `-y` and a package name
+* are not a place a credential's value is written, and there is no key in either to test.
+*/
+function nonSecretArgs(args) {
+	return (args ?? []).filter((arg) => {
+		const at = arg.indexOf("=");
+		if (at === -1) return true;
+		return !(credentialKey(arg.slice(0, at)) && holdsLiteral(arg.slice(at + 1)));
+	});
+}
 //#endregion
 //#region src/diagnose-mcp/diagnose-mcp.ts
-function read(root, path) {
+function read$1(root, path) {
 	const absolute = join(root, path);
 	return existsSync(absolute) ? readFileSync(absolute, "utf8") : void 0;
 }
@@ -1884,7 +1907,7 @@ function diagnoseMcp({ root, git, cli }) {
 	const targets = /* @__PURE__ */ new Map();
 	const configs = [];
 	for (const config of targetsOf(root)) {
-		const parsed = parseTarget(config, read(root, config.path));
+		const parsed = parseTarget(config, read$1(root, config.path));
 		if (parsed.kind === "unreadable") {
 			add({ file: config.path }, "mcp-target-unreadable");
 			continue;
@@ -1894,7 +1917,7 @@ function diagnoseMcp({ root, git, cli }) {
 		targets.set(config.path, parsed.servers);
 		configs.push(config);
 	}
-	const golden = parseGoldenSet(read(root, goldenSetPath));
+	const golden = parseGoldenSet(read$1(root, goldenSetPath));
 	if (golden.kind === "unreadable") {
 		add({
 			file: goldenSetPath,
@@ -1906,7 +1929,7 @@ function diagnoseMcp({ root, git, cli }) {
 	reportSecrets(goldenSetPath, golden.servers);
 	const baseline = new McpBaseline({
 		git,
-		record: parseProjectionRecord(read(root, projectionRecordPath))
+		record: parseProjectionRecord(read$1(root, projectionRecordPath))
 	});
 	for (const config of configs) {
 		const servers = targets.get(config.path);
@@ -2723,6 +2746,303 @@ async function run(argv) {
 	}
 }
 //#endregion
-export { activate, bridgeRepairs, buildDoctorReport, diagnoseBridges, diagnoseInstructions, diagnoseMcp, doctorCommand, doctorRepairs, doctorSkill, goldenSetPath, harnessCommand, harnessRegistry, initCommand, initializeHarnesses, instructionRepairs, renderDoctorSkill, run };
+//#region src/mcp-inventory/mcp-inventory.ts
+/** Where a harness keeps its **user-scope** MCP configuration, as that harness documents it.
+*
+* Unlike `harnessRegistry`, this table is read only from here: it is not wired into `doctor`, and
+* adding a harness to it never changes what `doctor` reads. Codex and Copilot CLI each let their
+* whole configuration directory move via an environment variable — `CODEX_HOME` and `COPILOT_HOME`
+* — so those two resolve through `env` before falling back to the home directory; the rest do not
+* document one.
+*/
+function userScopeConfig(harness, home, env) {
+	switch (harness) {
+		case "claude-code": return {
+			file: join(home, ".claude.json"),
+			config: {
+				path: ".claude.json",
+				key: "mcpServers",
+				format: "json"
+			}
+		};
+		case "cursor": return {
+			file: join(home, ".cursor", "mcp.json"),
+			config: {
+				path: ".cursor/mcp.json",
+				key: "mcpServers",
+				format: "json"
+			}
+		};
+		case "codex": return {
+			file: join(env["CODEX_HOME"] || join(home, ".codex"), "config.toml"),
+			config: {
+				path: "config.toml",
+				key: "mcp_servers",
+				format: "toml"
+			}
+		};
+		case "copilot-cli": return {
+			file: join(env["COPILOT_HOME"] || join(home, ".copilot"), "mcp-config.json"),
+			config: {
+				path: "mcp-config.json",
+				key: "mcpServers",
+				format: "json"
+			}
+		};
+		case "gemini-cli": return {
+			file: join(home, ".gemini", "settings.json"),
+			config: {
+				path: ".gemini/settings.json",
+				key: "mcpServers",
+				format: "json",
+				shared: true
+			}
+		};
+		default: return;
+	}
+}
+function read(file) {
+	return existsSync(file) ? readFileSync(file, "utf8") : void 0;
+}
+/** A URL trimmed to its origin and path, dropping any query string a token could ride in on. */
+function safeUrl(value) {
+	if (!value) return void 0;
+	try {
+		const url = new URL(value);
+		return `${url.origin}${url.pathname}`;
+	} catch {
+		return;
+	}
+}
+function toEntry(harness, scope, file, name, server, plugin) {
+	return {
+		harness,
+		scope,
+		configFile: file,
+		name,
+		transport: server.transport,
+		command: server.command ? basename(server.command) : void 0,
+		args: nonSecretArgs(server.args),
+		url: safeUrl(server.url),
+		enabled: server.enabled !== false,
+		...plugin ? { plugin } : {}
+	};
+}
+function entriesFrom(harness, scope, file, config) {
+	const parsed = parseTarget(config, read(file));
+	if (parsed.kind !== "servers") return [];
+	return [...parsed.servers].map(([name, server]) => toEntry(harness, scope, file, name, server));
+}
+/**
+* A raw entry reshaped so `serverFrom` recognizes fields the registry-driven harnesses never write:
+* OpenCode's `command` as an array (its first element is the command, the rest are args), Zed's
+* `command` as `{ path, args }`, and Windsurf's `serverUrl` as an alias for `url`. A field none of
+* those apply to is passed through unchanged.
+*/
+function normalizeRawEntry(raw) {
+	const command = raw["command"];
+	if (Array.isArray(command)) {
+		const [first, ...rest] = command;
+		return {
+			...raw,
+			command: first,
+			args: raw["args"] ?? rest
+		};
+	}
+	if (isRecord(command)) return {
+		...raw,
+		command: command["path"],
+		args: raw["args"] ?? command["args"]
+	};
+	if (raw["url"] === void 0 && typeof raw["serverUrl"] === "string") return {
+		...raw,
+		url: raw["serverUrl"]
+	};
+	return raw;
+}
+/** Every server under `key` in an already-parsed JSON(C) document, normalized and converted. */
+function serversFromDocument(document, key) {
+	const table = isRecord(document) ? document[key] : void 0;
+	if (!isRecord(table)) return /* @__PURE__ */ new Map();
+	return new Map(Object.entries(table).filter((pair) => isRecord(pair[1])).map(([name, entry]) => [name, serverFrom(normalizeRawEntry(entry))]));
+}
+function entriesFromDocument(harness, scope, file, document, key, options = {}) {
+	return [...serversFromDocument(document, key)].map(([name, server]) => {
+		const entry = toEntry(harness, scope, file, name, server, options.plugin);
+		return options.forceDisabled ? {
+			...entry,
+			enabled: false
+		} : entry;
+	});
+}
+/** Where VS Code keeps its user-scope settings, per platform — mirrors what VS Code itself documents. */
+function vscodeUserDir(env, home, plat) {
+	if (plat === "win32") return join(env["APPDATA"] || join(home, "AppData", "Roaming"), "Code", "User");
+	if (plat === "darwin") return join(home, "Library", "Application Support", "Code", "User");
+	return join(env["XDG_CONFIG_HOME"] || join(home, ".config"), "Code", "User");
+}
+/**
+* Sources `harnessRegistry` carries no entry for at all, so they cannot be read through
+* `userScopeConfig` or a harness's `project.mcpConfig`. Each of these harnesses is either not one
+* `doctor` diagnoses (VS Code, OpenCode, Zed have no `HarnessScope.mcpConfig`) or is diagnosed under
+* a different name than the one its own vendor uses for this file: Windsurf was rebranded to Devin
+* Desktop (`.research/agentic-configuration-standards/evidence.md`, E-WS-02), and
+* `~/.codeium/windsurf/mcp_config.json` is that product's legacy config path, read here under
+* `devin-desktop` rather than under a separate `windsurf` MCP source. This is a deliberate departure
+* from `repobuddy`'s scanner, which has no such mapping and reports the file under a standalone
+* `windsurf` harness name.
+*/
+function extraSources(projectDir, home, env, plat) {
+	const xdg = env["XDG_CONFIG_HOME"] || join(home, ".config");
+	return [
+		{
+			harness: "vscode",
+			scope: "user",
+			file: join(vscodeUserDir(env, home, plat), "mcp.json"),
+			key: "servers"
+		},
+		{
+			harness: "vscode",
+			scope: "project",
+			file: join(projectDir, ".vscode", "mcp.json"),
+			key: "servers"
+		},
+		{
+			harness: "devin-desktop",
+			scope: "user",
+			file: join(home, ".codeium", "windsurf", "mcp_config.json"),
+			key: "mcpServers"
+		},
+		{
+			harness: "opencode",
+			scope: "user",
+			file: join(xdg, "opencode", "opencode.json"),
+			key: "mcp"
+		},
+		{
+			harness: "opencode",
+			scope: "project",
+			file: join(projectDir, "opencode.json"),
+			key: "mcp"
+		},
+		{
+			harness: "zed",
+			scope: "user",
+			file: join(xdg, "zed", "settings.json"),
+			key: "context_servers"
+		},
+		{
+			harness: "zed",
+			scope: "project",
+			file: join(projectDir, ".zed", "settings.json"),
+			key: "context_servers"
+		}
+	];
+}
+/**
+* Claude Code's project-local servers: `~/.claude.json`'s `projects["<absolute project dir>"]
+* .mcpServers`, a server declared for this one project rather than every project the way the file's
+* top-level `mcpServers` (read as `'user'` scope, above) is.
+*/
+function claudeLocalEntries(home, projectDir) {
+	const file = join(home, ".claude.json");
+	const text = read(file);
+	if (text === void 0) return [];
+	const document = parseJsonWithComments(text);
+	const projects = isRecord(document) ? document["projects"] : void 0;
+	const project = isRecord(projects) ? projects[resolve(projectDir)] : void 0;
+	if (!isRecord(project)) return [];
+	return entriesFromDocument("claude-code", "local", file, project, "mcpServers");
+}
+/** `enabledPlugins`, merged from global settings up through project-local settings, last write wins. */
+function enabledPlugins(home, projectDir) {
+	const enabled = {};
+	for (const file of [
+		join(home, ".claude", "settings.json"),
+		join(projectDir, ".claude", "settings.json"),
+		join(projectDir, ".claude", "settings.local.json")
+	]) {
+		const text = read(file);
+		if (text === void 0) continue;
+		const document = parseJsonWithComments(text);
+		const table = isRecord(document) ? document["enabledPlugins"] : void 0;
+		if (!isRecord(table)) continue;
+		for (const [id, value] of Object.entries(table)) if (typeof value === "boolean") enabled[id] = value;
+	}
+	return enabled;
+}
+/**
+* MCP servers shipped by installed Claude Code plugins, with `enabled` reflecting whether the plugin
+* itself is enabled for this project — a plugin not set to `true` in the merged `enabledPlugins` is
+* disabled, and every server it ships is reported disabled regardless of that server's own field. An
+* install whose `projectPath` names a different project contributes nothing: that install is not
+* this project's.
+*/
+function pluginEntries(home, projectDir) {
+	const text = read(join(home, ".claude", "plugins", "installed_plugins.json"));
+	if (text === void 0) return [];
+	const document = parseJsonWithComments(text);
+	const installed = isRecord(document) ? document["plugins"] : void 0;
+	if (!isRecord(installed)) return [];
+	const enabled = enabledPlugins(home, projectDir);
+	const absoluteProject = resolve(projectDir);
+	const entries = [];
+	for (const [id, list] of Object.entries(installed)) {
+		if (!Array.isArray(list)) continue;
+		for (const install of list) {
+			if (!isRecord(install)) continue;
+			const projectPath = install["projectPath"];
+			if (typeof projectPath === "string" && resolve(projectPath) !== absoluteProject) continue;
+			const installPath = install["installPath"];
+			if (typeof installPath !== "string") continue;
+			const mcpFile = join(installPath, ".mcp.json");
+			const mcpText = read(mcpFile);
+			if (mcpText === void 0) continue;
+			const mcpDocument = parseJsonWithComments(mcpText);
+			if (!isRecord(mcpDocument)) continue;
+			const document2 = isRecord(mcpDocument["mcpServers"]) ? mcpDocument : { mcpServers: mcpDocument };
+			entries.push(...entriesFromDocument("claude-code", "plugin", mcpFile, document2, "mcpServers", {
+				plugin: id,
+				forceDisabled: enabled[id] !== true
+			}));
+		}
+	}
+	return entries;
+}
+/**
+* Every MCP server configured for a project, across every supported harness and every scope that
+* harness documents — without ever surfacing a credential.
+*
+* Reuses `diagnoseMcp`'s own parsing (`parseTarget`, `serverFrom`), model (`McpServer`), and
+* redaction (`nonSecretArgs`, and the URL/command trimming this module adds) rather than re-reading
+* or re-parsing any of the supported harnesses' MCP files. A harness with no file present, or one
+* whose file does not parse, contributes no entries; this function reports an inventory, not a
+* diagnosis, so it has nothing to say about why a file is missing or broken.
+*/
+function listMcpServers(options) {
+	const home = options.homeDir ?? homedir();
+	const env = options.env ?? process.env;
+	const plat = options.platform ?? platform();
+	const entries = [];
+	for (const harness of harnessRegistry) {
+		if (harness.deprecated) continue;
+		const project = harness.project.mcpConfig;
+		if (project) entries.push(...entriesFrom(harness.name, "project", join(options.projectDir, project.path), project));
+		const user = userScopeConfig(harness.name, home, env);
+		if (user) entries.push(...entriesFrom(harness.name, "user", user.file, user.config));
+	}
+	entries.push(...claudeLocalEntries(home, options.projectDir));
+	entries.push(...pluginEntries(home, options.projectDir));
+	for (const source of extraSources(options.projectDir, home, env, plat)) {
+		const text = read(source.file);
+		if (text === void 0) continue;
+		const document = parseJsonWithComments(text);
+		if (document === void 0) continue;
+		entries.push(...entriesFromDocument(source.harness, source.scope, source.file, document, source.key));
+	}
+	return entries;
+}
+//#endregion
+export { activate, bridgeRepairs, buildDoctorReport, diagnoseBridges, diagnoseInstructions, diagnoseMcp, doctorCommand, doctorRepairs, doctorSkill, goldenSetPath, harnessCommand, harnessRegistry, initCommand, initializeHarnesses, instructionRepairs, listMcpServers, renderDoctorSkill, run };
 
 //# sourceMappingURL=index.mjs.map