create-principles-disciple 1.146.9 → 1.147.1

package/release-manager/dist/installer.js

@@ -14,7 +14,8 @@ import { t } from './i18n.js';
 import { generateConfigYamlContent, ExistingConfigVerifyInfraError, validateExistingConfigYamlForPreserve, getConfigYamlPath, readEnabledChannelsFromConfigYaml, getOpenClawDir, getPdDir, getPdRuntimeDir, getInstallManifestPath, getPdRuntimeBackupsDir, getPluginExtDir, getInstalledPluginDir, getInstalledLayoutPackageDir, getPdBackupsDir, getInstalledPdCliDir, getInstalledBinDir, getInstalledConsoleDir, getHomeDir, isWindows, } from './mvp-config.js';
 import { getHostInstallers } from './installers/index.js';
 import { runWorkbuddyEarlyPreflight } from './installers/workbuddy-host-installer.js';
-import { INSTALL_LAYOUT_VERSION, getWorkbuddyWorkspaceDir, installManifestHostsForPersist, mergeInstallManifestWorkspaces, parseInstallManifest } from '@principles/install-layout';
+import { INSTALL_LAYOUT_VERSION, getInstallLayoutPaths, getWorkbuddyWorkspaceDir, installManifestHostsForPersist, mergeInstallManifestWorkspaces, parseInstallManifest } from '@principles/install-layout';
+import { resolveMcpServerDir } from './mcp-server-layout-compat.js';
 import { detectOpenClawMainWorkspaceDivergence } from './utils/workspace-divergence.js';
 import { applySkillLanguageSelection } from './skill-language.js';
 import { parseReleaseAssetIdentity, parseReleaseAssetManifest, ReleaseAssetManifestError, verifyReleaseAssetManifestAsync, verifyReleaseAssetTarget, } from './update/release-asset-manifest.js';
@@ -659,6 +660,7 @@ const NPM_DISTRIBUTED_COMPONENTS = [
     ['PD CLI', 'pd-cli'],
     ['Console', 'console'],
     ['Install layout', 'install-layout'],
+    ['MCP server', 'pd-mcp-server'],
 ];
 // Components whose install step demands MORE than the generic
 // package.json+dist shape check — the per-component extra files are
@@ -812,6 +814,7 @@ const SELF_CONTAINED_COMPONENTS = [
     ['PD CLI', 'pd-cli'],
     ['Console', 'console'],
     ['Install layout', 'install-layout'],
+    ['MCP server', 'pd-mcp-server'],
 ];
 export async function preflightSelfContainedReleaseAsset(assetDir) {
     const identityPath = path.join(assetDir, '_release', 'asset.json');
@@ -2190,6 +2193,38 @@ function getInstalledCodexAdapterDir() {
 function getInstalledWorkbuddyAdapterDir() {
     return path.join(getPdRuntimeDir(), 'workbuddy-adapter');
 }
+/**
+ * Gate 4 (PRI-1071): the shared MCP server installs as a runtime sibling so
+ * the three host launchers can point their PD-owned bindings at one canonical
+ * entry (~/.pd/runtime/pd-mcp-server/dist/index.js).
+ */
+function getInstalledMcpServerDir() {
+    return resolveMcpServerDir(getInstallLayoutPaths(getHomeDir()));
+}
+/**
+ * Gate 4 (PRI-1071): deploy the bundled @principles/pd-mcp-server the same
+ * way as the codex/workbuddy adapters. Observable skip (not a failure) for
+ * installer builds older than the component — the host launchers then fail
+ * closed at launch with the honest "server entry missing" state (SPEC §3.5).
+ * Link materialization happens via ensureComponentFileDependencyLinks AFTER
+ * all siblings exist (same ordering contract as the codex adapter).
+ */
+function installBundledMcpServer(pluginDir) {
+    const mcpServerSrc = path.join(pluginDir, 'pd-mcp-server');
+    const mcpServerDest = getInstalledMcpServerDir();
+    if (!existsSync(mcpServerSrc)) {
+        logger.warn(`Bundled @principles/pd-mcp-server not found in this installer package (${mcpServerSrc}) — the pd-recall MCP tool stays unavailable in this deployment. Hook/CLI/Console installation is unaffected.`);
+        return false;
+    }
+    const mcpServerPkgJson = path.join(mcpServerSrc, 'package.json');
+    const mcpServerDistEntry = path.join(mcpServerSrc, 'dist', 'index.js');
+    if (!existsSync(mcpServerPkgJson) || !existsSync(mcpServerDistEntry)) {
+        throw new Error('Bundled @principles/pd-mcp-server is incomplete (missing package.json / dist/index.js). Package may be corrupted.');
+    }
+    rmSync(mcpServerDest, { recursive: true, force: true });
+    cpSync(mcpServerSrc, mcpServerDest, { recursive: true });
+    return true;
+}
 function installBundledCore(pluginDir) {
     const coreSrc = path.join(pluginDir, 'core');
     const coreDest = getInstalledCoreDir();
@@ -2598,6 +2633,9 @@ async function installConsoleDependencies() {
     const consoleDest = getInstalledConsoleDir();
     await prepareComponentDependencies(consoleDest, 'Console');
 }
+async function installMcpServerDependencies() {
+    await prepareComponentDependencies(getInstalledMcpServerDir(), 'MCP server');
+}
 const CONSOLE_PORT_MAX_RETRIES = 3;
 /**
  * P0-2 (SPEC v1.2 §5 step 6 / invariant I-4): terminate a child and WAIT for
@@ -3727,6 +3765,19 @@ transaction) {
         // installer builds is an observable skip, not a failure.
         installBundledWorkbuddyAdapter(pluginDir);
         ensureWorkbuddyAdapterResolution();
+        // Gate 4 (PRI-1071): the shared MCP server refreshes with the runtime so
+        // the host launchers' bindings always point at the current canonical
+        // entry. Older installer payloads skip observably (the launchers fail
+        // closed at start with the honest missing-entry state).
+        const mcpServerInstalled = installBundledMcpServer(pluginDir);
+        if (mcpServerInstalled) {
+            ensureComponentFileDependencyLinks(getInstalledMcpServerDir(), 'pd-mcp-server');
+            // The npm-distributed payload ships only dist/ + package.json, and the
+            // MCP server keeps @modelcontextprotocol/server + zod as registry deps
+            // (unlike the file:-linked siblings). Without this pass the launcher
+            // starts an entry whose imports cannot resolve.
+            await installMcpServerDependencies();
+        }
         if (spinner)
             updateProgress(spinner, stepIndex, 'Installing release-manager authority module...');
         installBundledReleaseManagerPackage(pluginDir);

package/release-manager/dist/installers/mcp-registration-conflict.js

@@ -0,0 +1,559 @@
+/**
+ * Three-host MCP same-name registration conflict gate — SPEC-PD-MCP-GATE4-001
+ * §7.5 ("同名冲突时停止，不覆盖用户配置") / §11.3 ("同名冲突 | 明确报告，不覆盖").
+ *
+ * The host-specific MCP configs PD shares a name with are:
+ *   - Codex:      ~/.codex/config.toml  `[mcp_servers.<name>]` (user tier
+ *                 overrides the plugin tier — Gate 4-A reality check).
+ *   - OpenClaw:   ~/.openclaw/openclaw.json  `mcp.servers.<name>` (operator
+ *                 tier overrides plugin-owned servers).
+ *   - WorkBuddy:  ~/.workbuddy/mcp.json  `mcpServers.<name>` (user-level MCP
+ *                 config; plugin servers are configured independently).
+ *
+ * Classification is ONE closed set of outcomes (never "guess and continue"):
+ *   - `absent`            no same-name registration, install may proceed.
+ *   - `other_servers_only` other names coexist; PD's name is free.
+ *   - `pd_owned`          the same name already points at PD's launcher —
+ *                         idempotent reuse, no duplicate registration.
+ *   - conflict            same name points at ANOTHER MCP server → STOP before
+ *                         any write; never overwrite or delete the entry.
+ *   - unverifiable        config/ownership cannot be proven → STOP fail-closed
+ *                         (rc-1/rc-3: unknown is not "PD-owned").
+ *
+ * This module is a READ-ONLY classifier: no registration manager, no second
+ * source of truth. Installers call it before any config/binding/cache write;
+ * `pd health` reports the same verdict.
+ */
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+export const PD_MCP_SERVER_NAME = 'pd-recall';
+/** Stamp carried by PD's own launcher (see mcp/launcher.cjs `PD_LAUNCHER_ID`). */
+const PD_LAUNCHER_ID = 'pd-mcp-launcher.v1';
+/** Second stamp: the launcher's own binding-schema constant. Filename alone proves nothing. */
+const PD_BINDING_SCHEMA_MARKER = 'pd.mcp-binding.v1';
+/** A launcher is a small script; refuse to slurp arbitrary large files. */
+const MAX_LAUNCHER_BYTES = 512 * 1024;
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function getHomeDir(options) {
+    return path.resolve(options.homeDir ?? os.homedir());
+}
+export function resolveMcpRegistrationConfigPath(host, options = {}) {
+    const home = getHomeDir(options);
+    if (host === 'codex') {
+        const codexHome = options.codexHome ?? (process.env.CODEX_HOME && process.env.CODEX_HOME.length > 0
+            ? process.env.CODEX_HOME
+            : path.join(home, '.codex'));
+        return path.join(codexHome, 'config.toml');
+    }
+    if (host === 'openclaw')
+        return path.join(home, '.openclaw', 'openclaw.json');
+    const configDir = options.workbuddyConfigDir
+        ?? (process.env.WORKBUDDY_CONFIG_DIR && process.env.WORKBUDDY_CONFIG_DIR.length > 0
+            ? process.env.WORKBUDDY_CONFIG_DIR
+            : path.join(home, '.workbuddy'));
+    return path.join(configDir, 'mcp.json');
+}
+const HOST_MARKER_PATHS = {
+    codex: ['.codex-plugin', 'plugin.json'],
+    openclaw: ['openclaw.plugin.json'],
+    workbuddy: ['.codebuddy-plugin', 'plugin.json'],
+};
+function isPathWithin(child, root) {
+    const relative = path.relative(root, child);
+    return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+/** Resolve BOTH sides before checking containment; lexical paths are not trust boundaries. */
+function isInsideRoot(child, root) {
+    try {
+        const realRoot = fs.realpathSync(root);
+        const realChild = fs.realpathSync(child);
+        return isPathWithin(realChild, realRoot);
+    }
+    catch {
+        return false;
+    }
+}
+function readPluginHostIdentity(pluginRoot, expectedHost) {
+    const realRoot = fs.realpathSync(pluginRoot);
+    const detected = [];
+    for (const host of Object.keys(HOST_MARKER_PATHS)) {
+        const markerPath = path.join(realRoot, ...HOST_MARKER_PATHS[host]);
+        let markerStat;
+        try {
+            markerStat = fs.lstatSync(markerPath);
+        }
+        catch (error) {
+            if (isRecord(error) && error.code === 'ENOENT')
+                continue;
+            return 'unverifiable';
+        }
+        // Marker files are identity evidence, not links to identity evidence.
+        if (!markerStat.isFile() || markerStat.isSymbolicLink())
+            return 'unverifiable';
+        let realMarker;
+        try {
+            realMarker = fs.realpathSync(markerPath);
+        }
+        catch {
+            return 'unverifiable';
+        }
+        if (!isPathWithin(realMarker, realRoot))
+            return 'unverifiable';
+        let markerRecord;
+        try {
+            markerRecord = JSON.parse(fs.readFileSync(realMarker, 'utf8'));
+        }
+        catch {
+            return 'unverifiable';
+        }
+        const markerKey = host === 'openclaw' ? 'id' : 'name';
+        if (!isRecord(markerRecord) || markerRecord[markerKey] !== 'principles-disciple')
+            return 'unverifiable';
+        detected.push(host);
+    }
+    if (detected.length !== 1)
+        return 'unverifiable';
+    return detected[0] === expectedHost ? 'match' : 'other';
+}
+/**
+ * Prove launcher identity by BOTH content and host ownership. The launcher
+ * copies are intentionally byte-identical across hosts, so their containing
+ * plugin root's unique manifest marker is part of the identity contract.
+ */
+function readLauncherIdentity(file, expectedHost, trustedRoots = []) {
+    let real;
+    try {
+        real = fs.realpathSync(file);
+    }
+    catch {
+        return 'unverifiable';
+    }
+    if (path.basename(real).toLowerCase() !== 'launcher.cjs'
+        || path.basename(path.dirname(real)).toLowerCase() !== 'mcp')
+        return 'other';
+    // If the configured path is lexically under a known payload root, its real
+    // target must remain under that root. This blocks file/directory symlink and
+    // junction escapes before any ownership shortcut can be considered.
+    const lexicalFile = path.resolve(file);
+    for (const root of trustedRoots) {
+        const lexicalRoot = path.resolve(root);
+        if (isPathWithin(lexicalFile, lexicalRoot) && !isInsideRoot(real, root))
+            return 'unverifiable';
+    }
+    // Read through ONE open descriptor: a stat-then-read pair leaves a window in
+    // which the path can be swapped (CodeQL js/file-system-race). fstat+read on
+    // the same handle validates and reads the same file instance.
+    let fd;
+    try {
+        fd = fs.openSync(real, 'r');
+    }
+    catch {
+        return 'unverifiable';
+    }
+    try {
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile())
+            return 'unverifiable';
+        if (stat.size > MAX_LAUNCHER_BYTES)
+            return 'other';
+        const buffer = Buffer.alloc(stat.size);
+        fs.readSync(fd, buffer, 0, stat.size, 0);
+        const content = buffer.toString('utf8');
+        if (!content.includes(PD_LAUNCHER_ID) || !content.includes(PD_BINDING_SCHEMA_MARKER))
+            return 'other';
+        const pluginRoot = path.dirname(path.dirname(real));
+        const hostIdentity = readPluginHostIdentity(pluginRoot, expectedHost);
+        return hostIdentity === 'match' ? 'pd' : hostIdentity;
+    }
+    catch {
+        return 'unverifiable';
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+/** Is this arg shaped like a PD launcher argument at all (`.../mcp/launcher.cjs`)? */
+function launcherArgPath(arg) {
+    const normalized = arg.replace(/\\/g, '/');
+    if (path.basename(normalized) !== 'launcher.cjs')
+        return undefined;
+    if (path.basename(path.dirname(normalized)) !== 'mcp')
+        return undefined;
+    return arg;
+}
+function entryOwnership(entry, expectedHost, options = {}) {
+    if (!isRecord(entry))
+        return 'unverifiable';
+    const command = typeof entry.command === 'string' ? entry.command : undefined;
+    const args = Array.isArray(entry.args) ? entry.args.filter((arg) => typeof arg === 'string') : undefined;
+    const url = typeof entry.url === 'string' ? entry.url : undefined;
+    if (command === undefined) {
+        // No command: a URL-based server is definitely someone else's; anything
+        // else cannot be attributed.
+        return url !== undefined ? 'other' : 'unverifiable';
+    }
+    const commandBase = path.basename(command).toLowerCase();
+    if (commandBase !== 'node' && commandBase !== 'node.exe' && commandBase !== path.basename(process.execPath).toLowerCase()) {
+        return 'other';
+    }
+    if (args === undefined)
+        return 'unverifiable';
+    const candidate = args.map(launcherArgPath).find((arg) => arg !== undefined);
+    if (candidate === undefined)
+        return 'other';
+    // Relative args and unresolved host placeholders (${CODEBUDDY_PLUGIN_ROOT})
+    // depend on a cwd/variable the config does not fix: ownership is unprovable.
+    if (candidate.includes('${') || !path.isAbsolute(candidate))
+        return 'unverifiable';
+    const resolved = path.resolve(candidate);
+    const identity = readLauncherIdentity(resolved, expectedHost, options.pdLauncherRoots ?? []);
+    if (identity === 'pd')
+        return 'pd_owned';
+    return identity === 'other' ? 'other' : 'unverifiable';
+}
+function classifyEntryPresence(input) {
+    const { present, entry, host, configPath, ownershipOptions } = input;
+    if (!present)
+        return { ok: true, host, configPath, state: 'absent' };
+    const ownership = entryOwnership(entry, host, ownershipOptions);
+    if (ownership === 'pd_owned')
+        return { ok: true, host, configPath, state: 'pd_owned' };
+    if (ownership === 'unverifiable') {
+        return {
+            ok: false,
+            host,
+            configPath,
+            kind: 'unverifiable',
+            reason: `mcp_registration_unverifiable: ${configPath} declares mcpServers["${PD_MCP_SERVER_NAME}"] but its launcher identity cannot be proven (relative path, unresolved placeholder, or unreadable file). No PD write was performed.`,
+            nextAction: `Inspect ${configPath} manually: point the "${PD_MCP_SERVER_NAME}" entry at PD's absolute mcp/launcher.cjs path, remove it if it is not PD's, then re-run the installer. PD never guesses ownership from a file name.`,
+        };
+    }
+    return {
+        ok: false,
+        host,
+        configPath,
+        kind: 'conflict',
+        reason: `mcp_same_name_conflict: ${configPath} registers "${PD_MCP_SERVER_NAME}" with a launcher not owned by ${host} (third-party or another PD host). The installer stopped before any write; the existing entry was left byte-identical.`,
+        nextAction: `Point "${PD_MCP_SERVER_NAME}" at ${host}'s own absolute mcp/launcher.cjs path, or remove/rename the foreign entry in ${configPath}, then re-run the installer. PD never reuses another host's launcher.`,
+    };
+}
+// ─── JSON hosts (OpenClaw / WorkBuddy) ──────────────────────────────────────
+function readJsonObject(configPath) {
+    let raw;
+    try {
+        raw = fs.readFileSync(configPath, 'utf8');
+    }
+    catch (error) {
+        if (isRecord(error) && error.code === 'ENOENT')
+            return { ok: true, value: undefined };
+        return { ok: false, reason: `unreadable: ${error instanceof Error ? error.message : String(error)}` };
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (!isRecord(parsed))
+            return { ok: false, reason: 'root is not a JSON object' };
+        return { ok: true, value: parsed };
+    }
+    catch (error) {
+        return { ok: false, reason: `not valid JSON: ${error instanceof Error ? error.message : String(error)}` };
+    }
+}
+function classifyJsonHost(host, configPath, options = {}) {
+    const file = readJsonObject(configPath);
+    if (!file.ok) {
+        return {
+            ok: false,
+            host,
+            configPath,
+            kind: 'unverifiable',
+            reason: `mcp_registration_unverifiable: ${configPath} ${file.reason}. No PD write was performed.`,
+            nextAction: `Fix or remove ${configPath} manually so the MCP server list is readable, then re-run the installer. PD never merges into a config it cannot parse.`,
+        };
+    }
+    if (file.value === undefined)
+        return { ok: true, host, configPath, state: 'absent' };
+    const root = host === 'openclaw' ? file.value.mcp : file.value;
+    if (root === undefined)
+        return { ok: true, host, configPath, state: 'absent' };
+    if (!isRecord(root)) {
+        return {
+            ok: false,
+            host,
+            configPath,
+            kind: 'unverifiable',
+            reason: `mcp_registration_unverifiable: ${configPath} ${host === 'openclaw' ? 'mcp' : 'root'} is not an object. No PD write was performed.`,
+            nextAction: `Repair ${configPath} manually, then re-run the installer.`,
+        };
+    }
+    const servers = host === 'openclaw' ? root.servers : root.mcpServers;
+    if (servers === undefined)
+        return { ok: true, host, configPath, state: 'absent' };
+    if (!isRecord(servers)) {
+        return {
+            ok: false,
+            host,
+            configPath,
+            kind: 'unverifiable',
+            reason: `mcp_registration_unverifiable: ${configPath} ${host === 'openclaw' ? 'mcp.servers' : 'mcpServers'} is not an object. No PD write was performed.`,
+            nextAction: `Repair ${configPath} manually, then re-run the installer.`,
+        };
+    }
+    const present = Object.hasOwn(servers, PD_MCP_SERVER_NAME);
+    if (present)
+        return classifyEntryPresence({ present: true, entry: servers[PD_MCP_SERVER_NAME], host, configPath, ownershipOptions: options });
+    return {
+        ok: true,
+        host,
+        configPath,
+        state: Object.keys(servers).length === 0 ? 'absent' : 'other_servers_only',
+    };
+}
+export function classifyOpenClawConfigObject(config, configPath, options = {}) {
+    const { mcp } = config;
+    if (mcp === undefined)
+        return { ok: true, host: 'openclaw', configPath, state: 'absent' };
+    if (!isRecord(mcp)) {
+        return {
+            ok: false,
+            host: 'openclaw',
+            configPath,
+            kind: 'unverifiable',
+            reason: `mcp_registration_unverifiable: ${configPath} mcp is not an object. No PD write was performed.`,
+            nextAction: `Repair ${configPath} manually, then re-run the installer.`,
+        };
+    }
+    const { servers } = mcp;
+    if (servers === undefined)
+        return { ok: true, host: 'openclaw', configPath, state: 'absent' };
+    if (!isRecord(servers)) {
+        return {
+            ok: false,
+            host: 'openclaw',
+            configPath,
+            kind: 'unverifiable',
+            reason: `mcp_registration_unverifiable: ${configPath} mcp.servers is not an object. No PD write was performed.`,
+            nextAction: `Repair ${configPath} manually, then re-run the installer.`,
+        };
+    }
+    if (Object.hasOwn(servers, PD_MCP_SERVER_NAME)) {
+        return classifyEntryPresence({ present: true, entry: servers[PD_MCP_SERVER_NAME], host: 'openclaw', configPath, ownershipOptions: options });
+    }
+    return {
+        ok: true,
+        host: 'openclaw',
+        configPath,
+        state: Object.keys(servers).length === 0 ? 'absent' : 'other_servers_only',
+    };
+}
+function parseTomlScalarString(raw) {
+    const value = raw.trim();
+    if (value.startsWith('"') && value.endsWith('"')) {
+        try {
+            const parsed = JSON.parse(value);
+            return typeof parsed === 'string' ? parsed : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    if (value.startsWith("'") && value.endsWith("'"))
+        return value.slice(1, -1);
+    return undefined;
+}
+function parseTomlStringArray(raw) {
+    const value = raw.trim();
+    if (!value.startsWith('[') || !value.endsWith(']'))
+        return undefined;
+    const inner = value.slice(1, -1).trim();
+    if (inner.length === 0)
+        return [];
+    const parts = inner.split(',').map((part) => part.trim()).filter((part) => part.length > 0);
+    const out = [];
+    for (const part of parts) {
+        const parsed = parseTomlScalarString(part);
+        if (parsed === undefined)
+            return undefined;
+        out.push(parsed);
+    }
+    return out;
+}
+function scanCodexToml(raw) {
+    const entry = { opaque: false };
+    let found = false;
+    let otherServers = false;
+    let table;
+    let multilineArgs = undefined;
+    const header = (line) => {
+        const captured = /^\s*\[\[?([^\]]+)\]\]?\s*(?:#.*)?$/.exec(line)?.[1];
+        return captured === undefined ? undefined : captured.trim();
+    };
+    for (const line of raw.split(/\r?\n/)) {
+        if (multilineArgs !== undefined) {
+            const close = line.indexOf(']');
+            const segment = close === -1 ? line : line.slice(0, close);
+            const parsed = parseTomlScalarString(segment.replace(/,$/, '').trim());
+            if (parsed !== undefined)
+                multilineArgs.push(parsed);
+            if (close !== -1) {
+                entry.args = multilineArgs;
+                multilineArgs = undefined;
+            }
+            continue;
+        }
+        const trimmed = line.trim();
+        if (trimmed.length === 0 || trimmed.startsWith('#'))
+            continue;
+        const named = header(line);
+        if (named !== undefined) {
+            if (/^mcp_servers\./.test(named)) {
+                const parts = named.split('.').map((part) => part.trim().replace(/^"(.*)"$/, '$1').replace(/^'(.*)'$/, '$1'));
+                const [, serverName] = parts;
+                if (serverName === PD_MCP_SERVER_NAME) {
+                    found = true;
+                    table = parts.length === 2 ? 'server' : 'child';
+                }
+                else {
+                    // Another server is fine; a nested table of pd-recall is ignored.
+                    if (parts.length >= 2)
+                        otherServers = true;
+                    table = undefined;
+                }
+            }
+            else {
+                table = undefined;
+            }
+            continue;
+        }
+        if (/^\s*mcp_servers\s*=/.test(line)) {
+            // Top-level inline table / array form — not modelled.
+            found = true;
+            entry.opaque = true;
+            table = undefined;
+            continue;
+        }
+        if (table === undefined) {
+            // Dotted keys: mcp_servers."pd-recall".command = ...
+            const dotted = /^\s*mcp_servers\.(?:"([^"]+)"|'([^']+)'|([A-Za-z0-9_-]+))\.(command|args|url)\s*=\s*(.*)$/.exec(line);
+            if (dotted) {
+                const name = dotted[1] ?? dotted[2] ?? dotted[3];
+                if (name === PD_MCP_SERVER_NAME) {
+                    found = true;
+                    const [, , , , key, value] = dotted;
+                    if (key === undefined || value === undefined) {
+                        entry.opaque = true;
+                        continue;
+                    }
+                    if (key === 'command')
+                        entry.command = parseTomlScalarString(value);
+                    else if (key === 'url')
+                        entry.url = parseTomlScalarString(value);
+                    else {
+                        const parsed = parseTomlStringArray(value);
+                        if (parsed !== undefined)
+                            entry.args = parsed;
+                        else if (value.trim().startsWith('[')) {
+                            multilineArgs = [];
+                        }
+                        else {
+                            entry.opaque = true;
+                        }
+                    }
+                }
+                continue;
+            }
+            continue;
+        }
+        if (table !== 'server')
+            continue;
+        const pair = /^\s*(command|args|url)\s*=\s*(.*)$/.exec(line);
+        if (!pair)
+            continue;
+        const [, key, value] = pair;
+        if (key === undefined || value === undefined)
+            continue;
+        if (key === 'command') {
+            entry.command = parseTomlScalarString(value);
+            if (entry.command === undefined)
+                entry.opaque = true;
+        }
+        else if (key === 'url') {
+            entry.url = parseTomlScalarString(value);
+            if (entry.url === undefined)
+                entry.opaque = true;
+        }
+        else {
+            const parsed = parseTomlStringArray(value);
+            if (parsed !== undefined)
+                entry.args = parsed;
+            else if (value.trim().startsWith('['))
+                multilineArgs = [];
+            else
+                entry.opaque = true;
+        }
+    }
+    return found ? { entry, otherServers } : { otherServers };
+}
+function classifyCodex(configPath, options = {}) {
+    let raw;
+    try {
+        raw = fs.readFileSync(configPath, 'utf8');
+    }
+    catch (error) {
+        if (isRecord(error) && error.code === 'ENOENT')
+            return { ok: true, host: 'codex', configPath, state: 'absent' };
+        return {
+            ok: false,
+            host: 'codex',
+            configPath,
+            kind: 'unverifiable',
+            reason: `mcp_registration_unverifiable: ${configPath} is unreadable (${error instanceof Error ? error.message : String(error)}). No PD write was performed.`,
+            nextAction: `Fix ${configPath} read access, then re-run the installer. PD never guesses another server's ownership.`,
+        };
+    }
+    const scan = scanCodexToml(raw);
+    if (scan.entry === undefined) {
+        return { ok: true, host: 'codex', configPath, state: scan.otherServers ? 'other_servers_only' : 'absent' };
+    }
+    const { entry } = scan;
+    if (entry.opaque) {
+        return {
+            ok: false,
+            host: 'codex',
+            configPath,
+            kind: 'unverifiable',
+            reason: `mcp_registration_unverifiable: ${configPath} uses an mcp_servers construct PD cannot parse, so the "${PD_MCP_SERVER_NAME}" ownership is unknown. No PD write was performed.`,
+            nextAction: `Inspect ${configPath} manually (PD only understands [mcp_servers.<name>] tables and dotted mcp_servers.<name>.* keys), then re-run the installer.`,
+        };
+    }
+    const ownership = entryOwnership({ command: entry.command, args: entry.args, url: entry.url }, 'codex', options);
+    if (ownership === 'pd_owned')
+        return { ok: true, host: 'codex', configPath, state: 'pd_owned' };
+    if (ownership === 'unverifiable') {
+        return {
+            ok: false,
+            host: 'codex',
+            configPath,
+            kind: 'unverifiable',
+            reason: `mcp_registration_unverifiable: ${configPath} declares [mcp_servers.${PD_MCP_SERVER_NAME}] without a verifiable command/args. No PD write was performed.`,
+            nextAction: `Inspect ${configPath} manually and remove/repair the "${PD_MCP_SERVER_NAME}" entry, then re-run the installer.`,
+        };
+    }
+    return {
+        ok: false,
+        host: 'codex',
+        configPath,
+        kind: 'conflict',
+        reason: `mcp_same_name_conflict: ${configPath} registers "${PD_MCP_SERVER_NAME}" with a launcher not owned by Codex (third-party or another PD host; user tier overrides the plugin tier). The installer stopped before any write; the existing entry was left byte-identical.`,
+        nextAction: `Point [mcp_servers.${PD_MCP_SERVER_NAME}] at the Codex plugin's own absolute mcp/launcher.cjs path, or remove/rename the foreign entry in ${configPath}, then re-run $pd-control setup. PD never reuses another host's launcher.`,
+    };
+}
+export function checkMcpRegistrationConflict(host, options = {}) {
+    const configPath = resolveMcpRegistrationConfigPath(host, options);
+    if (host === 'codex')
+        return classifyCodex(configPath, options);
+    return classifyJsonHost(host, configPath, options);
+}
+//# sourceMappingURL=mcp-registration-conflict.js.map