codeep 2.14.0 → 2.15.0

package/dist/utils/export.d.ts

@@ -5,6 +5,18 @@ export interface ExportOptions {
     sessionName?: string;
     timestamp?: string;
 }
+/**
+ * Export messages to Markdown format
+ */
+export declare function exportToMarkdown(messages: Message[], sessionName?: string): string;
+/**
+ * Export messages to JSON format
+ */
+export declare function exportToJson(messages: Message[], sessionName?: string): string;
+/**
+ * Export messages to plain text format
+ */
+export declare function exportToText(messages: Message[], sessionName?: string): string;
 /**
  * Export messages to specified format
  */

package/dist/utils/export.js

@@ -3,7 +3,7 @@ import { join } from 'path';
 /**
  * Export messages to Markdown format
  */
-function exportToMarkdown(messages, sessionName) {
+export function exportToMarkdown(messages, sessionName) {
     const timestamp = new Date().toLocaleString('hr-HR');
     let markdown = `# Codeep Chat Export\n\n`;
     if (sessionName) {
@@ -24,7 +24,7 @@ function exportToMarkdown(messages, sessionName) {
 /**
  * Export messages to JSON format
  */
-function exportToJson(messages, sessionName) {
+export function exportToJson(messages, sessionName) {
     const exportData = {
         session: sessionName || 'Unnamed',
         exportedAt: new Date().toISOString(),
@@ -36,7 +36,7 @@ function exportToJson(messages, sessionName) {
 /**
  * Export messages to plain text format
  */
-function exportToText(messages, sessionName) {
+export function exportToText(messages, sessionName) {
     const timestamp = new Date().toLocaleString('hr-HR');
     let text = `Codeep Chat Export\n`;
     text += `===================\n\n`;

package/dist/utils/hooks.d.ts

@@ -44,6 +44,11 @@
  * machine the first time they trigger an agent tool call. The welcome
  * banner warns when hooks exist (see `summarizeHooks`); we do not run
  * hooks from `~/.codeep/hooks/` (global) for that reason.
+ *
+ * Platform note: hooks are POSIX shell (`.sh`) scripts. On macOS/Linux they
+ * run directly; on Windows they run through Git Bash's `sh` if installed.
+ * Windows without a POSIX shell → hooks are reported `unsupported` and skipped
+ * (never blocking). See `resolveShellMode` and the README "Windows notes".
  */
 export declare function isHooksTrusted(workspaceRoot: string): boolean;
 export declare function trustWorkspaceHooks(workspaceRoot: string): void;
@@ -75,7 +80,28 @@ export interface HookResult {
     /** True when a hook script exists but the workspace isn't trusted, so it was
      *  skipped (not run). Lets callers surface "run /hooks trust to enable". */
     untrusted?: boolean;
+    /** True when a hook script exists but this OS can't run it — Codeep hooks are
+     *  POSIX shell (`.sh`) scripts and no `sh` was found (e.g. Windows without
+     *  Git Bash). A non-blocking skip; surfaced by `/hooks` + the welcome banner. */
+    unsupported?: boolean;
 }
+/**
+ * Decide how a `.sh` hook runs on this platform. On POSIX it's executed
+ * directly (shebang); on Windows it needs a `sh`/`bash` interpreter, and if
+ * none is installed hooks are `unsupported` (skipped, never blocking). Pure +
+ * injectable so the platform matrix is unit-testable.
+ */
+export declare function resolveShellMode(platform?: NodeJS.Platform, findShell?: () => string | null): {
+    mode: 'direct';
+} | {
+    mode: 'shell';
+    shell: string;
+} | {
+    mode: 'unsupported';
+};
+/** True when this OS can actually run `.sh` hooks. Drives the `/hooks` and
+ *  welcome-banner "unsupported" state. */
+export declare function hooksExecutable(platform?: NodeJS.Platform, findShell?: () => string | null): boolean;
 /**
  * Execute the configured hook for an event, if any. Returns `executed: false`
  * if no script exists. Caller is responsible for checking `blocked` and

package/dist/utils/hooks.js

@@ -44,6 +44,11 @@
  * machine the first time they trigger an agent tool call. The welcome
  * banner warns when hooks exist (see `summarizeHooks`); we do not run
  * hooks from `~/.codeep/hooks/` (global) for that reason.
+ *
+ * Platform note: hooks are POSIX shell (`.sh`) scripts. On macOS/Linux they
+ * run directly; on Windows they run through Git Bash's `sh` if installed.
+ * Windows without a POSIX shell → hooks are reported `unsupported` and skipped
+ * (never blocking). See `resolveShellMode` and the README "Windows notes".
  */
 import { existsSync, readdirSync, statSync, accessSync, constants } from 'fs';
 import { join } from 'path';
@@ -80,6 +85,45 @@ const NOT_EXECUTED = { executed: false, exitCode: 0, stdout: '', stderr: '', blo
 function getHooksDir(workspaceRoot) {
     return join(workspaceRoot, '.codeep', 'hooks');
 }
+/**
+ * Locate a POSIX shell able to run `.sh` hooks on Windows. `.sh` scripts can't
+ * be `spawn`ed directly there (no shebang support), so we invoke them through
+ * `sh`/`bash`. Scans PATH plus the default Git-for-Windows install locations.
+ * Returns the shell's path, or null if none is installed.
+ */
+function findWindowsPosixShell() {
+    const candidates = [];
+    for (const dir of (process.env.PATH ?? '').split(';')) {
+        if (dir)
+            candidates.push(join(dir, 'sh.exe'), join(dir, 'bash.exe'));
+    }
+    candidates.push('C:\\Program Files\\Git\\bin\\sh.exe', 'C:\\Program Files\\Git\\usr\\bin\\sh.exe', 'C:\\Program Files (x86)\\Git\\bin\\sh.exe');
+    for (const c of candidates) {
+        try {
+            if (statSync(c).isFile())
+                return c;
+        }
+        catch { /* next candidate */ }
+    }
+    return null;
+}
+/**
+ * Decide how a `.sh` hook runs on this platform. On POSIX it's executed
+ * directly (shebang); on Windows it needs a `sh`/`bash` interpreter, and if
+ * none is installed hooks are `unsupported` (skipped, never blocking). Pure +
+ * injectable so the platform matrix is unit-testable.
+ */
+export function resolveShellMode(platform = process.platform, findShell = findWindowsPosixShell) {
+    if (platform !== 'win32')
+        return { mode: 'direct' };
+    const shell = findShell();
+    return shell ? { mode: 'shell', shell } : { mode: 'unsupported' };
+}
+/** True when this OS can actually run `.sh` hooks. Drives the `/hooks` and
+ *  welcome-banner "unsupported" state. */
+export function hooksExecutable(platform = process.platform, findShell = findWindowsPosixShell) {
+    return resolveShellMode(platform, findShell).mode !== 'unsupported';
+}
 function findHookScript(workspaceRoot, event) {
     const dir = getHooksDir(workspaceRoot);
     if (!existsSync(dir))
@@ -120,6 +164,14 @@ export function runHook(ctx, opts = {}) {
     if (!isHooksTrusted(ctx.workspaceRoot)) {
         return { executed: false, exitCode: 0, stdout: '', stderr: '', blocked: false, untrusted: true, scriptPath: script };
     }
+    // Platform gate: a `.sh` hook needs a POSIX shell. On Windows without one we
+    // must NOT spawn the script directly — that fails, and for a blocking event
+    // (pre_tool_call / pre_commit) a spawn error would wedge every tool call.
+    // Skip cleanly instead and let `/hooks` explain why.
+    const shellMode = resolveShellMode();
+    if (shellMode.mode === 'unsupported') {
+        return { executed: false, exitCode: 0, stdout: '', stderr: '', blocked: false, unsupported: true, scriptPath: script };
+    }
     const env = {
         ...process.env,
         CODEEP_HOOK_EVENT: ctx.event,
@@ -146,9 +198,12 @@ export function runHook(ctx, opts = {}) {
     // 30s ceiling so a runaway lint / test command can't wedge the agent
     // loop. Configurable per-call so tests can use a tight timeout.
     const timeout = opts.timeoutMs ?? 30_000;
+    // POSIX: run the script directly (shebang). Windows-with-shell: invoke it
+    // through the located `sh`/`bash` so the shebang isn't required.
+    const [cmd, cmdArgs] = shellMode.mode === 'shell' ? [shellMode.shell, [script]] : [script, []];
     let proc;
     try {
-        proc = spawnSync(script, [], {
+        proc = spawnSync(cmd, cmdArgs, {
             cwd: ctx.workspaceRoot,
             env,
             timeout,
@@ -250,6 +305,16 @@ export function formatHookTrust(workspaceRoot) {
     const hooks = listInstalledHooks(workspaceRoot);
     if (hooks.length === 0)
         return '';
+    if (!hooksExecutable()) {
+        return [
+            '⚠️ These hooks **cannot run on this system.** Codeep hooks are POSIX shell',
+            '(`.sh`) scripts, and no `sh` was found — on Windows this means Git Bash',
+            "isn't installed or isn't on your PATH.",
+            '',
+            'Install [Git for Windows](https://git-scm.com/download/win) (it provides',
+            '`sh.exe`) or add a POSIX shell to PATH. See the “Windows notes” in the README.',
+        ].join('\n');
+    }
     if (isHooksTrusted(workspaceRoot)) {
         return '✓ This workspace is **trusted** — its hooks will run. Use `/hooks untrust` to revoke.';
     }
@@ -267,6 +332,9 @@ export function summarizeHooks(workspaceRoot) {
     if (hooks.length === 0)
         return '';
     const list = hooks.map(h => h.event).join(', ');
+    if (!hooksExecutable()) {
+        return `${hooks.length} hook${hooks.length === 1 ? '' : 's'} present but this system has no POSIX shell — they won't run (see README “Windows notes”) (${list})`;
+    }
     if (!isHooksTrusted(workspaceRoot)) {
         return `${hooks.length} hook${hooks.length === 1 ? '' : 's'} present but NOT trusted — run /hooks trust to enable (${list})`;
     }

package/dist/utils/keychain.js

@@ -1,22 +1,17 @@
 import { logger } from './logger.js';
-// keytar is a native addon — load it LAZILY (on first use), never at module
-// top level. A top-level `await import()` here gives the module a top-level
-// await, which makes `bun build --compile` reject any CommonJS require() that
-// transitively depends on this file (renderer/main.js → codeepCloud → config →
-// keychain). Lazy loading keeps the module side-effect-free at import time.
-let _keytar = null;
-let _keytarTried = false;
-async function loadKeytar() {
-    if (!_keytarTried) {
-        _keytarTried = true;
+let _keyring = null;
+let _keyringTried = false;
+async function loadKeyring() {
+    if (!_keyringTried) {
+        _keyringTried = true;
         try {
-            _keytar = (await import('keytar')).default;
+            _keyring = (await import('@napi-rs/keyring'));
         }
         catch {
-            _keytar = null; /* native addon unavailable */
+            _keyring = null; /* native binary unavailable (headless / minimal install) */
         }
     }
-    return _keytar;
+    return _keyring;
 }
 const SERVICE_NAME = 'codeep';
 class KeychainStorage {
@@ -25,11 +20,12 @@ class KeychainStorage {
     }
     async getApiKey(providerId) {
         try {
-            const kt = await loadKeytar();
-            if (!kt)
+            const kr = await loadKeyring();
+            if (!kr)
                 return null;
             const account = this.getAccountName(providerId);
-            return await kt.getPassword(SERVICE_NAME, account);
+            const entry = new kr.AsyncEntry(SERVICE_NAME, account);
+            return await entry.getPassword();
         }
         catch (error) {
             logger.debug(`Failed to get API key from keychain: ${error}`);
@@ -38,11 +34,12 @@ class KeychainStorage {
     }
     async setApiKey(providerId, apiKey) {
         try {
-            const kt = await loadKeytar();
-            if (!kt)
-                throw new Error('keytar unavailable');
+            const kr = await loadKeyring();
+            if (!kr)
+                throw new Error('keyring unavailable');
             const account = this.getAccountName(providerId);
-            await kt.setPassword(SERVICE_NAME, account, apiKey);
+            const entry = new kr.AsyncEntry(SERVICE_NAME, account);
+            await entry.setPassword(apiKey);
         }
         catch (error) {
             throw new Error(`Failed to store API key in keychain: ${error}`);
@@ -50,11 +47,12 @@ class KeychainStorage {
     }
     async deleteApiKey(providerId) {
         try {
-            const kt = await loadKeytar();
-            if (!kt)
+            const kr = await loadKeyring();
+            if (!kr)
                 return;
             const account = this.getAccountName(providerId);
-            await kt.deletePassword(SERVICE_NAME, account);
+            const entry = new kr.AsyncEntry(SERVICE_NAME, account);
+            await entry.deletePassword();
         }
         catch (error) {
             logger.debug(`Failed to delete API key from keychain: ${error}`);
@@ -99,22 +97,26 @@ class FallbackStorage {
 class SmartStorage {
     keychain;
     fallback;
+    config;
     useKeychain = true;
     keychainTested = false;
+    warnedLegacyKeytar = false;
     constructor(config) {
         this.keychain = new KeychainStorage();
         this.fallback = new FallbackStorage(config);
+        this.config = config;
     }
     async ensureKeychainTested() {
         if (this.keychainTested)
             return;
         try {
             const testKey = '__codeep_test__';
-            const kt = await loadKeytar();
-            if (!kt)
-                throw new Error('keytar unavailable');
-            await kt.setPassword(SERVICE_NAME, testKey, 'test');
-            await kt.deletePassword(SERVICE_NAME, testKey);
+            const kr = await loadKeyring();
+            if (!kr)
+                throw new Error('keyring unavailable');
+            const entry = new kr.AsyncEntry(SERVICE_NAME, testKey);
+            await entry.setPassword('test');
+            await entry.deletePassword();
             this.useKeychain = true;
         }
         catch {
@@ -135,7 +137,21 @@ class SmartStorage {
             if (key)
                 return key;
         }
-        return this.fallback.getApiKey(providerId);
+        const fromFallback = await this.fallback.getApiKey(providerId);
+        // Migration note (Linux/Windows only): keys stored by the old keytar
+        // addon live under a different credential-store naming than keyring-rs
+        // uses, so they're invisible here — and the plaintext copies were
+        // already purged by the keysSecured migration. Nothing to silently
+        // recover; tell the user once so a missing key isn't a mystery.
+        // (macOS is unaffected — both libraries share the same Keychain items.)
+        if (fromFallback === null && !this.warnedLegacyKeytar
+            && process.platform !== 'darwin' && this.useKeychain
+            && this.config?.get?.('keysSecured') === true) {
+            this.warnedLegacyKeytar = true;
+            logger.warn('API keys saved by Codeep ≤ 2.14 (keytar) can\'t be read by the new keychain backend on this OS. ' +
+                'Re-add the affected key with /login <provider> <key> — it will be stored under the new backend.');
+        }
+        return fromFallback;
     }
     async setApiKey(providerId, apiKey) {
         await this.ensureKeychainTested();

package/dist/utils/logger.d.ts

@@ -2,6 +2,17 @@
  * Set current project path for local logging
  */
 export declare function setLogProjectPath(projectPath: string | null): void;
+type LogLevel = 'info' | 'warn' | 'error' | 'debug';
+export interface LogEntry {
+    timestamp: string;
+    level: LogLevel;
+    message: string;
+    data?: any;
+}
+/**
+ * Format log entry as string
+ */
+export declare function formatLogEntry(entry: LogEntry): string;
 /**
  * Logger API
  */
@@ -31,3 +42,4 @@ export declare function logStartup(version: string): void;
  * Log application error
  */
 export declare function logAppError(error: Error, context?: string): void;
+export {};

package/dist/utils/logger.js

@@ -49,7 +49,7 @@ function getLogFilePaths() {
 /**
  * Format log entry as string
  */
-function formatLogEntry(entry) {
+export function formatLogEntry(entry) {
     const dataStr = entry.data ? ` ${JSON.stringify(entry.data)}` : '';
     return `[${entry.timestamp}] [${entry.level.toUpperCase()}] ${entry.message}${dataStr}\n`;
 }

package/dist/utils/mcpConfig.d.ts

@@ -34,8 +34,34 @@ export interface McpConfigFile {
  * Load MCP server definitions for a workspace. Project entries shadow
  * global entries with the same server name. Workspace-less calls
  * (TUI without project) return only the global config.
+ *
+ * Sources read (highest precedence first on name collisions):
+ *   1. <workspace>/.codeep/mcp_servers.json  (Codeep-native project file)
+ *   2. <workspace>/.mcp.json                 (cross-tool standard — same
+ *      shape Claude Code/Cursor/Kilo Code read, so users can keep one MCP
+ *      config for their whole fleet)
+ *   3. ~/.codeep/mcp_servers.json            (global — user's machine)
  */
 export declare function loadMcpServerConfig(workspaceRoot?: string): McpServer[];
+/**
+ * Same sources as `loadMcpServerConfig`, but split by trust domain:
+ * `global` (~/.codeep — the user's own machine-wide file) vs `workspace`
+ * (files that arrive WITH a repo: `.codeep/mcp_servers.json` + `.mcp.json`).
+ *
+ * Workspace entries are attacker-controllable — anyone who clones a repo
+ * containing one of these files would otherwise spawn arbitrary commands
+ * at startup — so callers must gate them behind `isWorkspaceMcpTrusted`
+ * before spawning (mirrors the `trustedHookProjects` gate for hooks).
+ * On name collisions a workspace entry shadows a global one, matching
+ * the merged loader's precedence.
+ */
+export declare function loadMcpServerConfigSplit(workspaceRoot?: string): {
+    global: McpServer[];
+    workspace: McpServer[];
+};
+export declare function isWorkspaceMcpTrusted(workspaceRoot: string): boolean;
+export declare function trustWorkspaceMcp(workspaceRoot: string): void;
+export declare function untrustWorkspaceMcp(workspaceRoot: string): void;
 /**
  * Merge two server lists: ACP-provided + on-disk. ACP wins on collisions
  * — the client knows its own config, so a Zed-passed server overrides a

package/dist/utils/mcpConfig.js

@@ -28,8 +28,50 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
 import { join, dirname } from 'path';
 import { homedir } from 'os';
+import { config } from '../config/index.js';
 const PROJECT_CONFIG_PATH = '.codeep/mcp_servers.json';
+const PROJECT_DOTMCP_PATH = '.mcp.json';
 const GLOBAL_CONFIG_PATH = '.codeep/mcp_servers.json';
+/**
+ * Expand `${VAR}` / `${VAR:-default}` references from the process env —
+ * the same substitution Claude Code applies to `.mcp.json`, so a shared
+ * config with `"env": {"GITHUB_TOKEN": "${GITHUB_TOKEN}"}` works verbatim.
+ *
+ * Unset vars WITHOUT a default keep the literal `${VAR}` text: silently
+ * substituting '' would hide the misconfiguration, and the literal at
+ * least shows up as-is in error messages / `/mcp` output. (Previously the
+ * literal also SHADOWED a real env var of the same name at spawn time —
+ * expansion when the var IS set fixes that.)
+ */
+function expandEnvRefs(value) {
+    return value.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}/g, (match, name, def) => {
+        const fromEnv = process.env[name];
+        if (fromEnv !== undefined)
+            return fromEnv;
+        if (def !== undefined)
+            return def;
+        return match;
+    });
+}
+function expandRecord(rec) {
+    if (!rec)
+        return undefined;
+    const out = {};
+    for (const [k, v] of Object.entries(rec))
+        out[k] = typeof v === 'string' ? expandEnvRefs(v) : v;
+    return out;
+}
+/** Apply ${VAR} expansion to every string field of a server entry. */
+function expandServer(s) {
+    return {
+        ...s,
+        command: typeof s.command === 'string' ? expandEnvRefs(s.command) : s.command,
+        args: Array.isArray(s.args) ? s.args.map(a => expandEnvRefs(a)) : s.args,
+        env: expandRecord(s.env),
+        url: typeof s.url === 'string' ? expandEnvRefs(s.url) : s.url,
+        headers: expandRecord(s.headers),
+    };
+}
 function parseEntries(raw, source) {
     let parsed;
     try {
@@ -46,7 +88,9 @@ function parseEntries(raw, source) {
         return [];
     if (Array.isArray(servers)) {
         // Defensively filter — any entry needs name + either command or url.
-        return servers.filter(s => s && typeof s.name === 'string' && (typeof s.command === 'string' || typeof s.url === 'string'));
+        return servers
+            .filter(s => s && typeof s.name === 'string' && (typeof s.command === 'string' || typeof s.url === 'string'))
+            .map(expandServer);
     }
     return Object.entries(servers).flatMap(([name, cfg]) => {
         if (!cfg)
@@ -56,7 +100,7 @@ function parseEntries(raw, source) {
         const hasHttp = typeof cfg.url === 'string';
         if (!hasStdio && !hasHttp)
             return [];
-        return [{
+        return [expandServer({
                 name,
                 command: hasStdio ? cfg.command : undefined,
                 args: Array.isArray(cfg.args) ? cfg.args.filter(a => typeof a === 'string') : [],
@@ -65,7 +109,7 @@ function parseEntries(raw, source) {
                 headers: cfg.headers && typeof cfg.headers === 'object'
                     ? cfg.headers
                     : undefined,
-            }];
+            })];
     });
 }
 function loadFromFile(path) {
@@ -83,20 +127,81 @@ function loadFromFile(path) {
  * Load MCP server definitions for a workspace. Project entries shadow
  * global entries with the same server name. Workspace-less calls
  * (TUI without project) return only the global config.
+ *
+ * Sources read (highest precedence first on name collisions):
+ *   1. <workspace>/.codeep/mcp_servers.json  (Codeep-native project file)
+ *   2. <workspace>/.mcp.json                 (cross-tool standard — same
+ *      shape Claude Code/Cursor/Kilo Code read, so users can keep one MCP
+ *      config for their whole fleet)
+ *   3. ~/.codeep/mcp_servers.json            (global — user's machine)
  */
 export function loadMcpServerConfig(workspaceRoot) {
     const globalServers = loadFromFile(join(homedir(), GLOBAL_CONFIG_PATH));
     const projectServers = workspaceRoot
         ? loadFromFile(join(workspaceRoot, PROJECT_CONFIG_PATH))
         : [];
-    // Project wins on name collisions.
+    const dotMcpServers = workspaceRoot
+        ? loadFromFile(join(workspaceRoot, PROJECT_DOTMCP_PATH))
+        : [];
+    // Higher-precedence sources win on name collisions: project (Codeep-native)
+    // beats .mcp.json beats global.
     const byName = new Map();
     for (const s of globalServers)
         byName.set(s.name, s);
+    for (const s of dotMcpServers)
+        byName.set(s.name, s);
     for (const s of projectServers)
         byName.set(s.name, s);
     return [...byName.values()];
 }
+/**
+ * Same sources as `loadMcpServerConfig`, but split by trust domain:
+ * `global` (~/.codeep — the user's own machine-wide file) vs `workspace`
+ * (files that arrive WITH a repo: `.codeep/mcp_servers.json` + `.mcp.json`).
+ *
+ * Workspace entries are attacker-controllable — anyone who clones a repo
+ * containing one of these files would otherwise spawn arbitrary commands
+ * at startup — so callers must gate them behind `isWorkspaceMcpTrusted`
+ * before spawning (mirrors the `trustedHookProjects` gate for hooks).
+ * On name collisions a workspace entry shadows a global one, matching
+ * the merged loader's precedence.
+ */
+export function loadMcpServerConfigSplit(workspaceRoot) {
+    const globalServers = loadFromFile(join(homedir(), GLOBAL_CONFIG_PATH));
+    if (!workspaceRoot)
+        return { global: globalServers, workspace: [] };
+    const projectServers = loadFromFile(join(workspaceRoot, PROJECT_CONFIG_PATH));
+    const dotMcpServers = loadFromFile(join(workspaceRoot, PROJECT_DOTMCP_PATH));
+    const byName = new Map();
+    for (const s of dotMcpServers)
+        byName.set(s.name, s);
+    for (const s of projectServers)
+        byName.set(s.name, s);
+    const workspace = [...byName.values()];
+    const workspaceNames = new Set(workspace.map(s => s.name));
+    return {
+        global: globalServers.filter(s => !workspaceNames.has(s.name)),
+        workspace,
+    };
+}
+// ── Workspace MCP trust ────────────────────────────────────────────────────────
+// Workspace-sourced MCP servers spawn child processes with repo-author-chosen
+// command/args/env, so they need a one-time per-workspace approval — the same
+// model as `trustedHookProjects` for hooks. Global (~/.codeep) servers are the
+// user's own config and never need approval.
+export function isWorkspaceMcpTrusted(workspaceRoot) {
+    const cur = config.get('trustedMcpProjects') ?? [];
+    return cur.includes(workspaceRoot);
+}
+export function trustWorkspaceMcp(workspaceRoot) {
+    const cur = config.get('trustedMcpProjects') ?? [];
+    if (!cur.includes(workspaceRoot))
+        config.set('trustedMcpProjects', [...cur, workspaceRoot]);
+}
+export function untrustWorkspaceMcp(workspaceRoot) {
+    const cur = config.get('trustedMcpProjects') ?? [];
+    config.set('trustedMcpProjects', cur.filter((p) => p !== workspaceRoot));
+}
 /**
  * Merge two server lists: ACP-provided + on-disk. ACP wins on collisions
  * — the client knows its own config, so a Zed-passed server overrides a

package/dist/utils/skillBundles.d.ts

@@ -61,6 +61,19 @@ export interface SkillBundle extends SkillBundleMeta {
     /** Body content (everything after the frontmatter). */
     body: string;
 }
+interface ParsedFrontmatter {
+    meta: Record<string, unknown>;
+    body: string;
+}
+/**
+ * Tolerant YAML-frontmatter parser — handles `key: value`, `key: [a, b]`,
+ * and `key:` followed by `- item` block-list lines. Quoted strings are
+ * unquoted. We don't ship a real YAML dep for this — the keys we care
+ * about are scalars or simple arrays.
+ */
+export declare function parseFrontmatter(raw: string): ParsedFrontmatter;
+export declare function stripQuotes(s: string): string;
+export declare function asStringArray(v: unknown): string[] | null;
 /**
  * Load all skill bundles available in this workspace. Project entries
  * shadow global entries with the same name.
@@ -82,3 +95,4 @@ export declare function formatBundleList(bundles: SkillBundle[]): string;
  * pattern as custom commands and hooks. Empty string if no bundles.
  */
 export declare function summarizeBundles(workspaceRoot: string): string;
+export {};

package/dist/utils/skillBundles.js

@@ -42,7 +42,7 @@ import { homedir } from 'os';
  * unquoted. We don't ship a real YAML dep for this — the keys we care
  * about are scalars or simple arrays.
  */
-function parseFrontmatter(raw) {
+export function parseFrontmatter(raw) {
     // BOM + CRLF normalisation. Real-world files copy/paste from various
     // editors and pick up either; YAML strictly forbids tabs in scalars
     // but we don't care for the keys we read.
@@ -94,7 +94,7 @@ function parseFrontmatter(raw) {
     }
     return { meta, body: match[2].trimStart() };
 }
-function stripQuotes(s) {
+export function stripQuotes(s) {
     return s.replace(/^["']|["']$/g, '');
 }
 function loadFromDir(dir, scope) {
@@ -158,7 +158,7 @@ function loadFromDir(dir, scope) {
     }
     return bundles;
 }
-function asStringArray(v) {
+export function asStringArray(v) {
     if (Array.isArray(v))
         return v.filter(x => typeof x === 'string');
     if (typeof v === 'string')

package/dist/utils/skillBundlesCloud.d.ts

@@ -10,6 +10,7 @@
  * Auth uses the same `x-sync-token` header `codeepCloud.ts` already sends
  * for /api/tasks and friends.
  */
+import { type SkillBundle } from './skillBundles.js';
 export interface RemoteSkill {
     id: number;
     github_id: string;
@@ -63,6 +64,12 @@ export declare function unpublishBundle(idOrPath: string): Promise<{
     ok: boolean;
     error?: string;
 }>;
+/**
+ * Re-serialise a loaded SkillBundle back into the SKILL.md text format.
+ * Used by publish so the round-trip is lossless (sort of — we drop
+ * unknown frontmatter keys for now to keep the published format stable).
+ */
+export declare function serialiseSkillMd(bundle: SkillBundle): string;
 /** Read raw SKILL.md from disk — used when we want the unmodified bytes. */
 export declare function readRawSkillMd(workspaceRoot: string, slug: string): string | null;
 /** Delete the local copy of an installed skill bundle (for /skills uninstall). */

package/dist/utils/skillBundlesCloud.js

@@ -144,7 +144,7 @@ export async function unpublishBundle(idOrPath) {
  * Used by publish so the round-trip is lossless (sort of — we drop
  * unknown frontmatter keys for now to keep the published format stable).
  */
-function serialiseSkillMd(bundle) {
+export function serialiseSkillMd(bundle) {
     const meta = ['---'];
     meta.push(`name: ${bundle.name}`);
     meta.push(`description: ${bundle.description}`);