expandai 0.0.3 → 0.0.5

package/src/Init/Status.ts

@@ -1,253 +0,0 @@
-import { DateTime, Effect, Option, Schema } from 'effect'
-import {
-	CLI_AUTHORIZATION_CLIENT_ID,
-	PendingInitCorrupt,
-	type PendingInitKey,
-	PendingInitRecord,
-} from '../Auth/Domain.js'
-import { PendingInitStore } from '../Auth/PendingInit.js'
-import { authMethodState } from '../Authentication.js'
-import { ConfigManager, ConfigParseError, CredentialStoreInsecure, NotAuthenticated } from '../Config.js'
-import { CLI_VERSION } from '../Version.js'
-import { CLAUDE_POLICY_READ_ONLY } from './ClaudeProfile.js'
-import { InitHarness, InitScope } from './Domain.js'
-import type { HarnessInspection } from './HarnessAdapter.js'
-import { HarnessRegistry } from './HarnessRegistry.js'
-
-const VERSION_PATTERN = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u
-const BoundedVersion = Schema.String.pipe(Schema.minLength(1), Schema.maxLength(64), Schema.pattern(VERSION_PATTERN))
-
-export class StatusRequest extends Schema.Class<StatusRequest>('StatusRequest')({
-	harness: InitHarness,
-	scope: InitScope,
-}) {}
-
-const StatusAuth = Schema.Struct({
-	// `healthy` means a call would authenticate right now. An expired access
-	// token with a refresh token on disk reports `refresh_required`, because the
-	// renewal has not happened and can fail.
-	state: Schema.Literal('absent', 'unusable', 'refresh_required', 'healthy'),
-	healthy: Schema.Boolean,
-})
-
-const PendingAuthorization = Schema.Union(
-	Schema.Struct({ state: Schema.Literal('none'), count: Schema.Literal(0) }),
-	Schema.Struct({
-		state: Schema.Literal('approval_pending'),
-		count: Schema.Literal(1),
-		approvalExpiresAt: Schema.DateTimeUtc,
-	}),
-)
-
-const StatusInstallation = Schema.Struct({
-	configured: Schema.Boolean,
-	integrationVersion: Schema.optional(BoundedVersion),
-	components: Schema.Struct({
-		webfetchHook: Schema.Boolean,
-		runtimeSkill: Schema.Boolean,
-		mcp: Schema.Boolean,
-	}),
-	runtimeState: Schema.Literal('unverified', 'reload_required', 'blocked'),
-	reloadState: Schema.Literal('not_required', 'required'),
-	consentState: Schema.Literal('not_required', 'may_be_required'),
-	policyState: Schema.Literal('unverified', 'blocked'),
-	policyCodes: Schema.Array(Schema.Literal('managed_policy_blocked', 'target_read_only')).pipe(Schema.maxItems(1)),
-})
-
-export class StatusResult extends Schema.Class<StatusResult>('StatusResult')({
-	schemaVersion: Schema.Literal(1),
-	status: Schema.Literal('ok'),
-	harness: InitHarness,
-	scope: InitScope,
-	cli: Schema.Struct({ version: BoundedVersion }),
-	auth: StatusAuth,
-	pendingAuthorization: PendingAuthorization,
-	installation: StatusInstallation,
-}) {}
-
-export const StatusServiceErrorCode = Schema.Literal(
-	'credential_config_malformed',
-	'credential_storage_insecure',
-	'credential_health_failed',
-	'pending_state_malformed',
-	'pending_state_unavailable',
-	'harness_inspection_failed',
-	'invalid_status_result',
-)
-
-export class StatusServiceError extends Schema.TaggedError<StatusServiceError>()('StatusServiceError', {
-	code: StatusServiceErrorCode,
-	recoverable: Schema.Boolean,
-}) {
-	get message() {
-		switch (this.code) {
-			case 'credential_config_malformed':
-				return 'Stored credential configuration is malformed.'
-			case 'credential_storage_insecure':
-				return 'Credential storage is not secure enough to inspect.'
-			case 'credential_health_failed':
-				return 'Stored credentials could not be inspected safely.'
-			case 'pending_state_malformed':
-				return 'Pending authorization state is malformed.'
-			case 'pending_state_unavailable':
-				return 'Pending authorization state could not be inspected safely.'
-			case 'harness_inspection_failed':
-				return 'The harness configuration could not be inspected safely.'
-			case 'invalid_status_result':
-				return 'Local diagnostics returned an invalid result.'
-		}
-	}
-}
-
-function statusError(code: typeof StatusServiceErrorCode.Type, recoverable: boolean): StatusServiceError {
-	return new StatusServiceError({ code, recoverable })
-}
-
-function mapCredentialError(error: unknown): StatusServiceError {
-	if (error instanceof ConfigParseError) return statusError('credential_config_malformed', false)
-	if (error instanceof CredentialStoreInsecure) return statusError('credential_storage_insecure', false)
-	return statusError('credential_health_failed', false)
-}
-
-function mapPendingError(error: unknown): StatusServiceError {
-	if (error instanceof CredentialStoreInsecure) return statusError('credential_storage_insecure', false)
-	return error instanceof PendingInitCorrupt
-		? statusError('pending_state_malformed', true)
-		: statusError('pending_state_unavailable', true)
-}
-
-function authStatus(configManager: ConfigManager) {
-	return Effect.gen(function* () {
-		const loaded = yield* Effect.either(configManager.loadConfig())
-		if (loaded._tag === 'Left') {
-			if (loaded.left instanceof NotAuthenticated) return { state: 'absent' as const, healthy: false }
-			return yield* mapCredentialError(loaded.left)
-		}
-		const now = yield* DateTime.now
-		const state = authMethodState(loaded.right.authMethod, now)
-		return { state, healthy: state === 'healthy' }
-	})
-}
-
-function pendingStatus(record: Option.Option<PendingInitRecord>) {
-	return Effect.gen(function* () {
-		if (Option.isNone(record)) return { state: 'none' as const, count: 0 as const }
-		const now = DateTime.toEpochMillis(yield* DateTime.now)
-		if (DateTime.toEpochMillis(record.value.approvalExpiresAt) <= now) {
-			return { state: 'none' as const, count: 0 as const }
-		}
-		return {
-			state: 'approval_pending' as const,
-			count: 1 as const,
-			approvalExpiresAt: DateTime.formatIso(record.value.approvalExpiresAt),
-		}
-	})
-}
-
-function validateInspection(
-	harness: typeof InitHarness.Type,
-	inspection: HarnessInspection,
-): Effect.Effect<HarnessInspection, StatusServiceError> {
-	const componentSet = new Set(inspection.components)
-	// Only the harnesses with a web-fetch hook install three components; cursor
-	// and codex are complete with two. Demanding three of them reported a
-	// correctly configured machine as an invalid result.
-	const expectsHook = harness === 'claude-code' || harness === 'opencode'
-	const allComponents =
-		componentSet.has('runtime-skill') &&
-		componentSet.has('mcp') &&
-		(expectsHook ? componentSet.has('webfetch-hook') && componentSet.size === 3 : componentSet.size === 2)
-	const versionValid =
-		inspection.integrationVersion === undefined ||
-		(inspection.integrationVersion.length <= 64 && VERSION_PATTERN.test(inspection.integrationVersion))
-	const configuredValid = inspection.configured === allComponents
-	const runtimeValid = inspection.runtimeState !== 'observed'
-	return componentSet.size === inspection.components.length && versionValid && configuredValid && runtimeValid
-		? Effect.succeed(inspection)
-		: statusError('invalid_status_result', false)
-}
-
-function installationStatus(inspection: HarnessInspection, scope: typeof InitScope.Type) {
-	const components = new Set(inspection.components)
-	const policyBlocked = inspection.policyBlock !== undefined || inspection.runtimeState === 'blocked'
-	const policyCodes =
-		inspection.policyBlock === CLAUDE_POLICY_READ_ONLY
-			? (['target_read_only'] as const)
-			: policyBlocked
-				? (['managed_policy_blocked'] as const)
-				: []
-	const reloadRequired = !policyBlocked && inspection.runtimeState === 'reload_required'
-	return {
-		configured: inspection.configured,
-		...(inspection.integrationVersion === undefined ? {} : { integrationVersion: inspection.integrationVersion }),
-		components: {
-			webfetchHook: components.has('webfetch-hook'),
-			runtimeSkill: components.has('runtime-skill'),
-			mcp: components.has('mcp'),
-		},
-		runtimeState: policyBlocked
-			? ('blocked' as const)
-			: reloadRequired
-				? ('reload_required' as const)
-				: ('unverified' as const),
-		reloadState: reloadRequired ? ('required' as const) : ('not_required' as const),
-		consentState: scope === 'project' ? ('may_be_required' as const) : ('not_required' as const),
-		policyState: policyBlocked ? ('blocked' as const) : ('unverified' as const),
-		policyCodes,
-	}
-}
-
-export class StatusService extends Effect.Service<StatusService>()('@expandai/cli/Init/StatusService', {
-	dependencies: [ConfigManager.Default, PendingInitStore.Default, HarnessRegistry.Default],
-	effect: Effect.gen(function* () {
-		const configManager = yield* ConfigManager
-		const pendingStore = yield* PendingInitStore
-		const registry = yield* HarnessRegistry
-
-		const run = Effect.fn('StatusService.run')(function* (request: StatusRequest) {
-			yield* Effect.annotateCurrentSpan({ harness: request.harness, scope: request.scope })
-			return yield* Effect.gen(function* () {
-				yield* configManager
-					.inspectSecureStorage()
-					.pipe(Effect.withTracerEnabled(false), Effect.mapError(mapCredentialError))
-				const auth = yield* authStatus(configManager).pipe(Effect.withTracerEnabled(false))
-				const apiUrl = yield* configManager
-					.getApiUrl()
-					.pipe(Effect.withTracerEnabled(false), Effect.mapError(mapCredentialError))
-				const canonicalScopeRoot = yield* pendingStore
-					.canonicalScopeRoot(request.scope)
-					.pipe(Effect.withTracerEnabled(false), Effect.mapError(mapPendingError))
-				const key: PendingInitKey = {
-					apiOrigin: apiUrl.origin,
-					clientId: CLI_AUTHORIZATION_CLIENT_ID,
-					harness: 'agent-harnesses',
-					scope: request.scope,
-					canonicalScopeRoot,
-				}
-				const pending = yield* pendingStore
-					.peek(key)
-					.pipe(Effect.withTracerEnabled(false), Effect.mapError(mapPendingError))
-				const inspection = yield* registry.inspect(request.harness, request.scope).pipe(
-					Effect.withTracerEnabled(false),
-					Effect.mapError(() => statusError('harness_inspection_failed', true)),
-					Effect.flatMap((inspection) => validateInspection(request.harness, inspection)),
-				)
-				const candidate = {
-					schemaVersion: 1 as const,
-					status: 'ok' as const,
-					harness: request.harness,
-					scope: request.scope,
-					cli: { version: CLI_VERSION },
-					auth,
-					pendingAuthorization: yield* pendingStatus(pending),
-					installation: installationStatus(inspection, request.scope),
-				}
-				return yield* Schema.decodeUnknown(StatusResult)(candidate).pipe(
-					Effect.mapError(() => statusError('invalid_status_result', false)),
-				)
-			})
-		})
-
-		return { run } as const
-	}),
-}) {}

package/src/Install/Claude/Hook.ts

@@ -1,286 +0,0 @@
-import { homedir } from 'node:os'
-import { Array, Config, Console, Effect, Match, Schema } from 'effect'
-import { CLI_VERSION } from '../../Version.js'
-import { type CliCommand, ConfigIo, cliShellCommand, DIRECT_CLI } from '../Domain.js'
-import type { InstallScope } from '../Mcp.js'
-
-/** Claude Code WebFetch hook invocation persisted in harness settings. */
-export const HOOK_INVOCATION = 'expandai hook claude-code'
-export const HOOK_COMMAND = HOOK_INVOCATION
-const HOOK_ARGS = ['hook', 'claude-code'] as const
-
-/**
- * The hook line for a resolved CLI. Defaults to the bare `expandai` command;
- * when the CLI is not on PATH — an `npx expandai init` with no global install —
- * `CliInvocation` resolves to the npx form and the written hook stays runnable.
- */
-export function hookCommandFor(cli: CliCommand = DIRECT_CLI): string {
-	return cliShellCommand(cli, HOOK_ARGS)
-}
-export const WEBFETCH_MATCHER = 'WebFetch'
-
-export const HookCommandEntry = Schema.Struct(
-	{
-		type: Schema.Literal('command'),
-		command: Schema.String,
-		expandaiProfileVersion: Schema.optional(Schema.String),
-		/** Whether this install added the `WebFetch` deny rule — see `makeExpandaiMatcher`. */
-		expandaiManagedDeny: Schema.optional(Schema.Boolean),
-	},
-	Schema.Record({ key: Schema.String, value: Schema.Unknown }),
-)
-
-export const HookMatcher = Schema.Struct(
-	{
-		matcher: Schema.optional(Schema.String),
-		hooks: Schema.Array(HookCommandEntry),
-	},
-	Schema.Record({ key: Schema.String, value: Schema.Unknown }),
-)
-
-const HooksSection = Schema.Struct(
-	{ PreToolUse: Schema.optional(Schema.Array(HookMatcher)) },
-	Schema.Record({ key: Schema.String, value: Schema.Unknown }),
-)
-
-const PermissionsSection = Schema.Struct(
-	{ deny: Schema.optional(Schema.Array(Schema.String)) },
-	Schema.Record({ key: Schema.String, value: Schema.Unknown }),
-)
-
-export const SettingsSchema = Schema.parseJson(
-	Schema.Struct(
-		{
-			hooks: Schema.optionalWith(HooksSection, { default: () => ({}) as typeof HooksSection.Type }),
-			permissions: Schema.optional(PermissionsSection),
-		},
-		Schema.Record({ key: Schema.String, value: Schema.Unknown }),
-	),
-	{ space: 2 },
-)
-
-export interface ClaudeHookPlan {
-	readonly changed: boolean
-	readonly settings: typeof SettingsSchema.Type
-}
-
-export function isExpandaiHookCommand(command: string): boolean {
-	const value = command.trim()
-	const invocation = String.raw`expandai(?:\.exe)?\s+hook\s+(?:claude-code|claude)`
-	const direct = new RegExp(String.raw`^(?:npx\s+-y\s+)?${invocation}$`, 'u')
-	const absolute = new RegExp(
-		String.raw`^(?:"(?:[A-Za-z]:\\|/)[^"]*[\\/]expandai(?:\.exe)?"|'(?:[A-Za-z]:\\|/)[^']*[\\/]expandai(?:\.exe)?'|(?:[A-Za-z]:\\|/)[^\s]*[\\/]expandai(?:\.exe)?)\s+hook\s+(?:claude-code|claude)$`,
-		'u',
-	)
-	const shellFallback =
-		/^if\s+command\s+-v\s+expandai\s+>\/dev\/null\s+2>&1;\s*then\s+expandai\s+hook\s+(?:claude-code|claude);\s*else\s+npx\s+-y\s+expandai\s+hook\s+(?:claude-code|claude);\s*fi$/u
-	return direct.test(value) || absolute.test(value) || shellFallback.test(value)
-}
-
-/**
- * `expandaiManagedDeny` records whether *we* added `WebFetch` to
- * `permissions.deny`, so uninstall can tell our entry from an identical one the
- * user set first. A deny entry is a bare string with nowhere to carry that, and
- * "our hook is present" is not the same claim: installing over a settings file
- * that already denied `WebFetch` leaves the hook without us having written the
- * rule, and removing it then revokes a control its owner chose.
- */
-export function makeExpandaiMatcher(
-	profileVersion: string,
-	cli: CliCommand = DIRECT_CLI,
-	managedDeny = true,
-): typeof HookMatcher.Type {
-	return {
-		matcher: WEBFETCH_MATCHER,
-		hooks: [
-			{
-				type: 'command',
-				command: hookCommandFor(cli),
-				expandaiProfileVersion: profileVersion,
-				expandaiManagedDeny: managedDeny,
-			},
-		],
-	}
-}
-
-/** True only when our own hook entry says we wrote the deny rule. */
-export function expandaiOwnsWebFetchDeny(settings: typeof SettingsSchema.Type): boolean {
-	return (settings.hooks.PreToolUse ?? []).some((entry) =>
-		entry.hooks.some((hook) => isExpandaiHookCommand(hook.command) && hook.expandaiManagedDeny === true),
-	)
-}
-
-function webFetchAlreadyDenied(settings: typeof SettingsSchema.Type): boolean {
-	return (settings.permissions?.deny ?? []).includes(WEBFETCH_MATCHER)
-}
-
-export const expandaiMatcher = makeExpandaiMatcher(CLI_VERSION)
-
-function stripExpandaiHooks(entries: ReadonlyArray<typeof HookMatcher.Type>): Array<typeof HookMatcher.Type> {
-	return Array.flatMap(entries, (entry) => {
-		const hooks = Array.filter(entry.hooks, (hook) => !isExpandaiHookCommand(hook.command))
-		return hooks.length === 0 && hooks.length !== entry.hooks.length ? [] : [{ ...entry, hooks }]
-	})
-}
-
-/**
- * Denying `WebFetch` removes it from the toolset rather than blocking it per call,
- * so the agent reaches for Expand's tool instead of being refused. That difference
- * is the whole point: a hook can only answer a WebFetch call with `deny`, which
- * Claude Code renders to the user as `Error:` on every single fetch.
- *
- * The hook stays installed as the fallback. With the deny rule in force WebFetch is
- * never called, so the hook never fires; if the rule is ever absent or overridden,
- * the hook still intercepts — with the red line, but correctly.
- */
-export function planClaudeWebFetchDeny(settings: typeof SettingsSchema.Type): ClaudeHookPlan {
-	const deny = settings.permissions?.deny ?? []
-	if (deny.includes(WEBFETCH_MATCHER)) return { changed: false, settings }
-	return {
-		changed: true,
-		settings: {
-			...settings,
-			permissions: { ...(settings.permissions ?? {}), deny: [...deny, WEBFETCH_MATCHER] },
-		},
-	}
-}
-
-/**
- * Drops the `WebFetch` entry; anything else the user denied is left alone.
- *
- * A deny entry is a bare string with nowhere to record who wrote it, so this
- * cannot tell our rule from an identical one the user added themselves. The
- * caller supplies that evidence — see `uninstall`.
- */
-export function planClaudeWebFetchDenyRemoval(settings: typeof SettingsSchema.Type): ClaudeHookPlan {
-	const deny = settings.permissions?.deny
-	if (deny === undefined || !deny.includes(WEBFETCH_MATCHER)) return { changed: false, settings }
-	const remaining = deny.filter((entry) => entry !== WEBFETCH_MATCHER)
-	const permissions = { ...settings.permissions, deny: remaining }
-	return { changed: true, settings: { ...settings, permissions } }
-}
-
-export function planClaudeHook(
-	settings: typeof SettingsSchema.Type,
-	profileVersion: string = CLI_VERSION,
-	cli: CliCommand = DIRECT_CLI,
-): ClaudeHookPlan {
-	const preToolUse = settings.hooks.PreToolUse ?? []
-	const owned = preToolUse.flatMap((entry) =>
-		entry.hooks.filter((hook) => isExpandaiHookCommand(hook.command)).map((hook) => ({ entry, hook })),
-	)
-	// The marker records history — did *this* install add the rule — so once it is
-	// written it must be preserved, not recomputed. Recomputing it from present
-	// state makes the plan disagree with what it just wrote: after we add the deny
-	// rule, `webFetchAlreadyDenied` is true, so a second plan would decide the rule
-	// was never ours and rewrite the hook forever.
-	const existingMarker = owned[0]?.hook.expandaiManagedDeny
-	const managedDeny = existingMarker ?? !webFetchAlreadyDenied(settings)
-	const current =
-		owned.length === 1 &&
-		owned[0]?.entry.matcher === WEBFETCH_MATCHER &&
-		owned[0]?.hook.command === hookCommandFor(cli) &&
-		owned[0]?.hook.expandaiProfileVersion === profileVersion &&
-		owned[0]?.hook.expandaiManagedDeny === managedDeny
-	if (current) return { changed: false, settings }
-
-	return {
-		changed: true,
-		settings: {
-			...settings,
-			hooks: {
-				...settings.hooks,
-				PreToolUse: [...stripExpandaiHooks(preToolUse), makeExpandaiMatcher(profileVersion, cli, managedDeny)],
-			},
-		},
-	}
-}
-
-export function planClaudeHookRemoval(settings: typeof SettingsSchema.Type): ClaudeHookPlan {
-	const preToolUse = settings.hooks.PreToolUse ?? []
-	const changed = preToolUse.some((entry) => entry.hooks.some((hook) => isExpandaiHookCommand(hook.command)))
-	return changed
-		? {
-				changed,
-				settings: {
-					...settings,
-					hooks: { ...settings.hooks, PreToolUse: stripExpandaiHooks(preToolUse) },
-				},
-			}
-		: { changed, settings }
-}
-
-export class ClaudeHook extends Effect.Service<ClaudeHook>()('@expandai/cli/Install/Claude/Hook', {
-	dependencies: [ConfigIo.Default],
-	effect: Effect.gen(function* () {
-		const io = yield* ConfigIo
-		const home = yield* Config.string('HOME').pipe(Config.withDefault(homedir()))
-		const cwd = yield* Config.string('PWD').pipe(Config.withDefault(process.cwd()))
-
-		const pathFor = Effect.fn(function* (scope: InstallScope) {
-			return yield* Match.value(scope).pipe(
-				Match.when('global', () => Effect.succeed(`${home}/.claude/settings.json`)),
-				Match.when('project', () => Effect.succeed(`${cwd}/.claude/settings.json`)),
-				Match.exhaustive,
-			)
-		})
-
-		const install = Effect.fn('ClaudeHook.install')(function* (scope: InstallScope) {
-			const target = yield* pathFor(scope)
-			const settings = yield* io.read(target, SettingsSchema)
-			// Both halves, exactly as `init` writes them. This used to install the hook
-			// alone, which left the deny rule to `init` only — and made `uninstall`'s
-			// ownership rule false: it treats our hook as evidence that we wrote the
-			// deny entry, so a rule the user added after a bare `hook install` was
-			// deleted as if it were ours.
-			const hookPlan = planClaudeHook(settings)
-			const plan = planClaudeWebFetchDeny(hookPlan.settings)
-			if (!hookPlan.changed && !plan.changed) {
-				yield* Console.log(`expandai WebFetch hook already installed at ${target}`)
-				return
-			}
-			yield* io.write(target, plan.settings, SettingsSchema)
-			yield* Console.log(`Installed expandai WebFetch hook and deny rule at ${target}`)
-		})
-
-		const uninstall = Effect.fn('ClaudeHook.uninstall')(function* (scope: InstallScope) {
-			const target = yield* pathFor(scope)
-			if (!(yield* io.exists(target))) return
-			const settings = yield* io.read(target, SettingsSchema)
-			// Uninstall has to undo both halves, or `WebFetch` stays denied with nothing
-			// left to serve the fetch — worse than never having installed us.
-			//
-			// But only the halves we wrote. `expandaiManagedDeny` on our hook records
-			// whether this install added the deny rule; without it, the rule is either
-			// the user's own or from an install predating the marker, and those are
-			// indistinguishable. Guessing "ours" revokes a control its owner chose;
-			// guessing "theirs" leaves `WebFetch` denied with nothing serving fetches.
-			// So leave it and say so — `uninstall` also fans out over both scopes, and
-			// would otherwise reach into a global settings file a project-scoped
-			// install never touched.
-			const hookPlan = planClaudeHookRemoval(settings)
-			if (!hookPlan.changed) return
-			// Read the marker off the hook before it is stripped.
-			const owned = expandaiOwnsWebFetchDeny(settings)
-			const denyPlan = owned ? planClaudeWebFetchDenyRemoval(hookPlan.settings) : hookPlan
-			const strandedDeny = !owned && (settings.permissions?.deny ?? []).includes(WEBFETCH_MATCHER)
-			yield* io.write(target, denyPlan.settings, SettingsSchema)
-			// `denyPlan` is the hook plan itself when we do not own the rule, so its
-			// `changed` flag reports the hook removal — not a deny removal that never
-			// happened.
-			const removedDeny = owned && denyPlan.changed
-			yield* Console.log(
-				removedDeny
-					? `Removed expandai WebFetch hook and deny rule from ${target}`
-					: `Removed expandai WebFetch hook from ${target}`,
-			)
-			if (strandedDeny) {
-				yield* Console.log(
-					`Left "WebFetch" in permissions.deny at ${target} — expandai could not confirm it added that rule. Remove it by hand if you want Claude Code's built-in WebFetch back.`,
-				)
-			}
-		})
-
-		return { install, uninstall, pathFor } as const
-	}),
-}) {}

package/src/Install/Claude/Mcp.ts

@@ -1,129 +0,0 @@
-import { homedir } from 'node:os'
-import { Config, Console, Effect, Match, Record, Schema } from 'effect'
-import {
-	type CliCommand,
-	ConfigIo,
-	DIRECT_CLI,
-	McpParseError,
-	McpServersConfigSchema,
-	McpWriteError,
-	SERVER_KEY,
-} from '../Domain.js'
-import type { InstallScope } from '../Mcp.js'
-
-/** Claude Code MCP descriptor stored under the Expand-owned server key. */
-export class Entry extends Schema.Class<Entry>('ClaudeMcpEntry')({
-	type: Schema.Literal('stdio'),
-	command: Schema.NonEmptyTrimmedString,
-	args: Schema.Array(Schema.String),
-	env: Schema.optional(Schema.Record({ key: Schema.String, value: Schema.String })),
-}) {}
-
-export interface ClaudeMcpPlan {
-	readonly changed: boolean
-	readonly config: typeof McpServersConfigSchema.Type
-}
-
-const MCP_ARGS = ['mcp', 'run'] as const
-
-/** Claude execs the descriptor directly, so `command`/`args` stay separate. */
-export function claudeMcpEntry(cli: CliCommand = DIRECT_CLI): Entry {
-	return new Entry({
-		type: 'stdio',
-		command: cli.command,
-		args: [...cli.args, ...MCP_ARGS],
-		env: { EXPANDAI_HARNESS: 'claude-code' },
-	})
-}
-
-export const CLAUDE_MCP_ENTRY = claudeMcpEntry()
-
-function isUnknownRecord(value: unknown): value is Record<string, unknown> {
-	return typeof value === 'object' && value !== null && !Array.isArray(value)
-}
-
-function isCurrentEntry(value: unknown, expected: Entry): boolean {
-	if (!isUnknownRecord(value)) return false
-	const args = value.args
-	const env = value.env
-	return (
-		value.type === expected.type &&
-		value.command === expected.command &&
-		Array.isArray(args) &&
-		args.length === expected.args.length &&
-		args.every((arg, index) => arg === expected.args[index]) &&
-		isUnknownRecord(env) &&
-		env.EXPANDAI_HARNESS === 'claude-code'
-	)
-}
-
-export function planClaudeMcp(config: typeof McpServersConfigSchema.Type, cli: CliCommand = DIRECT_CLI): ClaudeMcpPlan {
-	const entry = claudeMcpEntry(cli)
-	if (isCurrentEntry(config.mcpServers[SERVER_KEY], entry)) return { changed: false, config }
-	return {
-		changed: true,
-		config: {
-			...config,
-			mcpServers: { ...config.mcpServers, [SERVER_KEY]: entry },
-		},
-	}
-}
-
-export function planClaudeMcpRemoval(config: typeof McpServersConfigSchema.Type): ClaudeMcpPlan {
-	if (!(SERVER_KEY in config.mcpServers)) return { changed: false, config }
-	return {
-		changed: true,
-		config: { ...config, mcpServers: Record.remove(config.mcpServers, SERVER_KEY) },
-	}
-}
-
-export class ClaudeMcp extends Effect.Service<ClaudeMcp>()('@expandai/cli/Install/Claude/Mcp', {
-	dependencies: [ConfigIo.Default],
-	effect: Effect.gen(function* () {
-		const io = yield* ConfigIo
-		const home = yield* Config.string('HOME').pipe(Config.withDefault(homedir()))
-		const cwd = yield* Config.string('PWD').pipe(Config.withDefault(process.cwd()))
-
-		const pathFor = Effect.fn(function* (scope: InstallScope) {
-			return yield* Match.value(scope).pipe(
-				Match.when('global', () => Effect.succeed(`${home}/.claude.json`)),
-				Match.when('project', () => Effect.succeed(`${cwd}/.mcp.json`)),
-				Match.exhaustive,
-			)
-		})
-
-		const readConfig = Effect.fn(function* (file: string) {
-			return yield* io
-				.read(file, McpServersConfigSchema)
-				.pipe(Effect.mapError((error) => new McpParseError({ path: file, error })))
-		})
-
-		const writeConfig = Effect.fn(function* (file: string, value: unknown) {
-			yield* io
-				.write(file, value, McpServersConfigSchema)
-				.pipe(Effect.mapError((error) => new McpWriteError({ path: file, error })))
-		})
-
-		const install = Effect.fn(function* (scope: InstallScope) {
-			const file = yield* pathFor(scope)
-			const plan = planClaudeMcp(yield* readConfig(file))
-			if (plan.changed) yield* writeConfig(file, plan.config)
-			yield* Console.log(`Installed expandai MCP server into ${file}`)
-		})
-
-		const uninstall = Effect.fn(function* (scope: InstallScope) {
-			const file = yield* pathFor(scope)
-			const plan = planClaudeMcpRemoval(yield* readConfig(file))
-			if (!plan.changed) return
-			yield* writeConfig(file, plan.config)
-			yield* Console.log(`Removed expandai MCP server from ${file}`)
-		})
-
-		const isInstalled = Effect.fn(function* (scope: InstallScope) {
-			const file = yield* pathFor(scope)
-			return SERVER_KEY in (yield* readConfig(file)).mcpServers
-		})
-
-		return { install, uninstall, isInstalled, pathFor } as const
-	}),
-}) {}