ghost-dragon 4.2.1

package/src/commands/lifecycle.ts

@@ -0,0 +1,273 @@
+/**
+ * dragon lifecycle commands — bootstrap + update + install + stop
+ *
+ *   dragon up                — clone every missing repo, install everything
+ *   dragon update            — git pull every product in the manifest
+ *   dragon install <key>     — install one product
+ *   dragon uninstall <key>   — remove a product directory (asks first)
+ *   dragon list              — print the manifest
+ *   dragon stop --all        — kill every running service (uses ~/.dragon/pids/)
+ *
+ * Copyright 2026 Ghost Protocol (Pvt) Ltd. All Rights Reserved.
+ * Author: Ryan Sebastian <ryan@ghosts.lk>
+ */
+
+import type { Command } from 'commander'
+import type { DragonConfig } from '../config.js'
+import { loadManifest, resolveRoot, productPath, type ManifestProduct } from '../manifest.js'
+import { run, label, eyebrow, success, error, info, warn, isInstalled, isRunning, readVersion, C } from '../utils.js'
+import chalk from 'chalk'
+import { existsSync, mkdirSync, rmSync } from 'node:fs'
+import { join } from 'node:path'
+import { execSync } from 'node:child_process'
+
+function clone(p: ManifestProduct, root: string): boolean {
+  const target = join(root, p.dir)
+  if (existsSync(join(target, '.git'))) {
+    info(`${p.name.padEnd(28)} already cloned`)
+    return true
+  }
+  if (existsSync(target)) {
+    warn(`${p.name.padEnd(28)} dir exists but no .git — skipping clone`)
+    return true
+  }
+  info(`${p.name.padEnd(28)} cloning ghosts-lk-style…`)
+  try {
+    execSync(`git clone https://github.com/${p.repo}.git "${target}"`, { stdio: 'inherit' })
+    return true
+  } catch (e) {
+    error(`${p.name}: clone failed (${e})`)
+    return false
+  }
+}
+
+function pull(p: ManifestProduct, root: string): boolean {
+  const target = join(root, p.dir)
+  if (!existsSync(join(target, '.git'))) {
+    warn(`${p.name.padEnd(28)} not cloned — skipping update`)
+    return false
+  }
+  try {
+    execSync(`git -C "${target}" pull --ff-only`, { stdio: 'inherit' })
+    return true
+  } catch (e) {
+    error(`${p.name}: update failed (${e})`)
+    return false
+  }
+}
+
+async function install(p: ManifestProduct, root: string): Promise<boolean> {
+  const target = join(root, p.dir)
+  if (!existsSync(target)) {
+    error(`${p.name}: dir missing at ${target}`)
+    return false
+  }
+  for (const step of p.install || []) {
+    info(`${p.name.padEnd(28)} → ${chalk.dim(step)}`)
+    const parts = step.split(' ').filter(Boolean)
+    const cmd = parts.shift() ?? ''
+    const exit = await run(cmd, parts, target)
+    if (exit !== 0) {
+      error(`${p.name}: install step "${step}" failed (exit ${exit})`)
+      return false
+    }
+  }
+  return true
+}
+
+function topoSort(products: ManifestProduct[]): ManifestProduct[] {
+  // Stable topo sort by `requires` so dependencies install first.
+  const out: ManifestProduct[] = []
+  const visited = new Set<string>()
+  const visiting = new Set<string>()
+  const byKey = new Map(products.map((p) => [p.key, p]))
+  function dfs(p: ManifestProduct): void {
+    if (visited.has(p.key)) return
+    if (visiting.has(p.key)) return
+    visiting.add(p.key)
+    for (const req of p.requires ?? []) {
+      const dep = byKey.get(req)
+      if (dep) dfs(dep)
+    }
+    visiting.delete(p.key)
+    visited.add(p.key)
+    out.push(p)
+  }
+  for (const p of products) dfs(p)
+  return out
+}
+
+export function registerLifecycleCommands(program: Command, _config: DragonConfig) {
+
+  program.command('list')
+    .description('Print the dragon stack with live install / running state')
+    .option('--stack <stack>', 'Filter by stack (operator|commercial|daemon|library)')
+    .option('--verbose', 'Include repo path + version per row')
+    .option('--json',    'Machine-readable output (skips pretty print)')
+    .action(async (opts) => {
+      const m = loadManifest()
+      const root = resolveRoot(m)
+      const items = opts.stack ? m.product.filter((p) => p.stack === opts.stack) : m.product
+
+      // Probe install / running / version in parallel so list is snappy.
+      type Row = { p: ManifestProduct; installed: boolean; running: boolean; version: string | null }
+      const rows: Row[] = await Promise.all(items.map(async (p) => {
+        const dir = productPath(m, p)
+        const installed = isInstalled(dir)
+        const running   = installed && p.port ? await isRunning(p.port) : false
+        const version   = installed ? readVersion(dir) : null
+        return { p, installed, running, version }
+      }))
+
+      if (opts.json) {
+        console.log(JSON.stringify({
+          manifest_version: m.manifest_version, root,
+          rows: rows.map((r) => ({
+            key: r.p.key, name: r.p.name, stack: r.p.stack, kind: r.p.kind,
+            repo: r.p.repo, port: r.p.port,
+            installed: r.installed, running: r.running, version: r.version,
+          })),
+        }, null, 2))
+        return
+      }
+
+      console.log()
+      console.log(`  ${label('Dragon')}  ${C.info(`manifest v${m.manifest_version} · root ${root}`)}`)
+      console.log()
+
+      // Stack labels + per-stack accent glyph mirror the rail dividers
+      // in the Dragon Console. Glyphs picked to evoke each stack's
+      // shape language (chevron / diamond / graph-node / stacked rows).
+      const STACK_LABELS: Record<string, string> = {
+        operator:   'OPERATOR  · internal tools',
+        commercial: 'COMMERCIAL · customer-facing',
+        daemon:     'DAEMON     · background services',
+        library:    'LIBRARY    · reusable modules',
+      }
+      const STACK_GLYPH: Record<string, string> = {
+        operator:   '▲',
+        commercial: '◆',
+        daemon:     '◇',
+        library:    '▤',
+      }
+      let section = 0
+      for (const stack of ['operator', 'commercial', 'daemon', 'library'] as const) {
+        const sub = rows.filter((r) => r.p.stack === stack)
+        if (sub.length === 0) continue
+        section += 1
+        const glyph = C.accent(STACK_GLYPH[stack])
+        console.log(`  ${glyph}  ${eyebrow(section, STACK_LABELS[stack])}`)
+        for (const { p, installed, running, version } of sub) {
+          // Three-state mark — matches the web UI status dots:
+          //   ● hot-teal (running)  ·  ✓ teal (installed)  ·  ○ grey (available)
+          const mark =
+            running   ? C.hot.bold('●') :
+            installed ? C.accent('✓')   :
+                        C.info('○')
+          const nameRaw = p.name.padEnd(28)
+          const name  = installed ? chalk.bold(nameRaw) : C.info(nameRaw)
+          const port  = p.port ? C.info(`:${p.port}`.padStart(6)) : '      '
+          const ver   = version ? C.faint(` v${version}`.padEnd(11)) : C.faint(' —'.padEnd(11))
+          const repo  = opts.verbose ? `  ${C.faint(p.repo)}` : ''
+          console.log(`     ${mark}  ${name}${port}${ver}${repo}`)
+        }
+        console.log()
+      }
+
+      const installed = rows.filter((r) => r.installed).length
+      const running   = rows.filter((r) => r.running).length
+      console.log(`  ${C.faint('—')}`)
+      console.log(
+        `  ${C.info(`${rows.length} total`)}` +
+        `  ${C.accent(`✓ ${installed} installed`)}` +
+        `  ${C.hot.bold(`● ${running} running`)}` +
+        `  ${C.info(`○ ${rows.length - installed} available`)}`,
+      )
+      console.log()
+      console.log(`  ${C.faint('next:')} ${C.accent('dragon install <key>')} · ${C.accent('dragon up')} (everything) · ${C.accent('dragon serve')} (start daemons)`)
+      console.log()
+    })
+
+  program.command('up')
+    .description('Clone every missing repo + install — full fresh-machine bootstrap')
+    .option('--stack <stack>', 'Limit to one stack')
+    .option('--dry-run', 'Show what would happen, take no action')
+    .action(async (opts) => {
+      const m = loadManifest()
+      const root = resolveRoot(m)
+      mkdirSync(root, { recursive: true })
+      const items = topoSort(opts.stack ? m.product.filter((p) => p.stack === opts.stack) : m.product)
+      console.log(label('Dragon'), `Bootstrapping ${items.length} product(s) into ${root}\n`)
+      let ok = 0
+      for (const p of items) {
+        if (opts.dryRun) {
+          info(`would clone + install ${p.name}`)
+          continue
+        }
+        if (!clone(p, root)) continue
+        if (await install(p, root)) {
+          ok++
+          success(`${p.name} ready`)
+        }
+      }
+      console.log()
+      success(`${ok} of ${items.length} ready · run \`dragon serve\` to start daemons`)
+    })
+
+  program.command('update')
+    .description('git pull every product in the manifest')
+    .option('--stack <stack>', 'Limit to one stack')
+    .action((opts) => {
+      const m = loadManifest()
+      const root = resolveRoot(m)
+      const items = opts.stack ? m.product.filter((p) => p.stack === opts.stack) : m.product
+      console.log(label('Dragon'), `Pulling latest for ${items.length} product(s)\n`)
+      let ok = 0
+      for (const p of items) {
+        if (pull(p, root)) ok++
+      }
+      console.log()
+      success(`${ok} of ${items.length} updated`)
+    })
+
+  program.command('install <key>')
+    .description('Install one product (clone + install) from the manifest')
+    .action(async (key: string) => {
+      const m = loadManifest()
+      const root = resolveRoot(m)
+      const p = m.product.find((q) => q.key === key)
+      if (!p) {
+        error(`Unknown product key '${key}'`)
+        info(`Run \`dragon list\` to see all keys.`)
+        process.exit(2)
+      }
+      // Install requires first
+      const order = topoSort([p])
+      for (const dep of order) {
+        if (!existsSync(productPath(m, dep))) clone(dep, root)
+        if (!await install(dep, root)) {
+          error(`${dep.name} install failed`)
+          process.exit(3)
+        }
+      }
+      success(`${p.name} ready`)
+    })
+
+  program.command('uninstall <key>')
+    .description('Remove a product directory (asks first)')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .action(async (key: string, opts) => {
+      const m = loadManifest()
+      const p = m.product.find((q) => q.key === key)
+      if (!p) { error(`Unknown product '${key}'`); process.exit(2) }
+      const target = productPath(m, p)
+      if (!existsSync(target)) { info(`Not installed at ${target}`); return }
+      if (!opts.yes) {
+        warn(`This will rm -rf ${target}`)
+        info(`Re-run with -y to confirm.`)
+        return
+      }
+      rmSync(target, { recursive: true, force: true })
+      success(`Removed ${target}`)
+    })
+}

package/src/commands/login.ts

@@ -0,0 +1,184 @@
+/**
+ * dragon login / logout / whoami — authenticate the CLI with the Dragon assistant
+ * (account.ghosts.lk).
+ *
+ * Default is a browser DEVICE-CODE flow (like gh/Claude Code): `dragon login` opens
+ * the approve page, you confirm while signed in, and the CLI receives a 90-day bearer
+ * token — no cookie pasting. Fallbacks: `--session <gp_session>` (works even before the
+ * device-flow backend is deployed) and `--token <pat>`. Credentials live in
+ * ~/.dragon/config.json (locked to 0600).
+ *
+ * Copyright 2026 Ghost Protocol (Pvt) Ltd. All Rights Reserved.
+ */
+
+import type { Command } from 'commander'
+import type { DragonConfig } from '../config.js'
+import { resolveAuth, saveAuth, clearAuth, whoami, isBrowsableHttpUrl } from '../auth.js'
+import { C, success, error, info } from '../utils.js'
+import { createInterface } from 'node:readline/promises'
+import { stdin, stdout } from 'node:process'
+import { spawn } from 'node:child_process'
+import { chmodSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms))
+
+/** Open a URL in the browser. Returns false (without spawning) if the URL isn't
+ *  something a browser will accept — so we never trigger "this address is
+ *  restricted"; the caller has already printed the URL for manual use. */
+function openBrowser(url: string): boolean {
+  if (!isBrowsableHttpUrl(url)) return false
+  const isMac = process.platform === 'darwin'
+  const isWin = process.platform === 'win32'
+  const cmd = isMac ? 'open' : isWin ? 'cmd' : 'xdg-open'
+  const args = isWin ? ['/c', 'start', '', url] : [url]
+  try {
+    const child = spawn(cmd, args, { stdio: 'ignore', detached: true })
+    child.on('error', () => {})
+    child.unref()
+    return true
+  } catch {
+    return false
+  }
+}
+
+function lockConfig(): void {
+  try { chmodSync(join(homedir(), '.dragon', 'config.json'), 0o600) } catch { /* best-effort */ }
+}
+
+async function verifyAndReport(): Promise<boolean> {
+  const me = await whoami()
+  if (me.ok) {
+    if (me.email) saveAuth({ email: me.email })
+    lockConfig()
+    success(`signed in${me.email ? ` as ${C.accent(me.email)}` : ''}`)
+    return true
+  }
+  if (me.status === 401) error('credential rejected — sign in again.')
+  else error(`could not verify (${me.error ?? me.status}).`)
+  return false
+}
+
+interface StartResp { device_code: string; user_code: string; verification_uri: string; verification_uri_complete: string; interval: number; expires_in: number }
+
+/** Returns 'ok' | 'failed' | 'unavailable' (unavailable → caller falls back to paste). */
+async function deviceFlow(apiBase: string, open: boolean): Promise<'ok' | 'failed' | 'unavailable'> {
+  let start: StartResp
+  try {
+    const r = await fetch(`${apiBase}/api/v1/cli/auth/start`, { method: 'POST' })
+    if (r.status === 404) return 'unavailable'   // route not deployed → caller offers paste
+    if (!r.ok) { error(`login couldn't start: HTTP ${r.status} from ${apiBase}.`); return 'failed' }
+    start = (await r.json()) as StartResp
+    if (!start?.verification_uri_complete || !start?.device_code) { error('the server returned an unexpected response.'); return 'failed' }
+  } catch (e) {
+    error(`couldn't reach ${apiBase} — ${e instanceof Error ? e.message : String(e)}.`)
+    info('check your connection, or pass a valid endpoint with `--api`.')
+    return 'failed'
+  }
+
+  console.log()
+  console.log(`  ${C.accent.bold('Dragon login')} ${C.faint('· ' + apiBase)}`)
+  console.log(`  Approve this device in your browser:`)
+  console.log(`    ${C.info(start.verification_uri_complete)}`)
+  console.log(`  Verification code: ${C.accent.bold(start.user_code)}`)
+  console.log()
+  if (open && !openBrowser(start.verification_uri_complete)) info('open the link above manually to approve.')
+
+  const deadline = Date.now() + start.expires_in * 1000
+  const interval = Math.max(2, start.interval || 3) * 1000
+  process.stdout.write(`  ${C.faint('waiting for approval')} `)
+  while (Date.now() < deadline) {
+    await sleep(interval)
+    process.stdout.write(C.faint('·'))
+    let poll: { status: string; token?: string }
+    try {
+      poll = (await fetch(`${apiBase}/api/v1/cli/auth/poll`, {
+        method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ device_code: start.device_code }),
+      }).then((r) => r.json())) as { status: string; token?: string }
+    } catch {
+      continue
+    }
+    if (poll.status === 'approved' && poll.token) {
+      process.stdout.write('\n')
+      saveAuth({ token: poll.token, session: undefined })   // token wins; drop any stale session
+      return (await verifyAndReport()) ? 'ok' : 'failed'
+    }
+    if (poll.status === 'denied') { process.stdout.write('\n'); error('approval was denied in the browser.'); return 'failed' }
+    if (poll.status === 'expired' || poll.status === 'not_found') { process.stdout.write('\n'); error('the code expired — run `dragon login` again.'); return 'failed' }
+  }
+  process.stdout.write('\n'); error('timed out waiting for approval.')
+  return 'failed'
+}
+
+async function pasteFlow(apiBase: string, open: boolean): Promise<boolean> {
+  console.log()
+  console.log(`  ${C.accent.bold('Dragon login')} ${C.faint('· ' + apiBase)} ${C.faint('(session paste)')}`)
+  console.log(`  ${C.faint('1.')} Sign in at ${C.info(apiBase + '/login')}`)
+  console.log(`  ${C.faint('2.')} DevTools → Application → Cookies → ${C.info(new URL(apiBase).host)}`)
+  console.log(`  ${C.faint('3.')} Copy the ${C.accent('gp_session')} value and paste it below.`)
+  console.log()
+  if (open && !openBrowser(`${apiBase}/login`)) info('open the sign-in link above manually.')
+  const rl = createInterface({ input: stdin, output: stdout })
+  let value = ''
+  try { value = (await rl.question(`  ${C.accent('gp_session')} ▸ `)).trim() } finally { rl.close() }
+  if (!value) { error('no value entered — aborted.'); return false }
+  saveAuth({ session: value, token: undefined })
+  return verifyAndReport()
+}
+
+export function registerLoginCommands(program: Command, _config: DragonConfig) {
+  program
+    .command('login')
+    .description('Authenticate the CLI (browser device-code flow by default)')
+    .option('--token <token>', 'use a personal-access-token directly')
+    .option('--session <value>', 'use a gp_session cookie value (fallback)')
+    .option('--paste', 'force the gp_session paste flow instead of the browser device flow')
+    .option('--api <url>', 'point at a non-default origin (e.g. http://localhost:8799)')
+    .option('--no-open', "don't auto-open the browser")
+    .action(async (opts: { token?: string; session?: string; paste?: boolean; api?: string; open?: boolean }) => {
+      try {
+        if (opts.api) {
+          const base = opts.api.replace(/\/+$/, '')
+          if (!isBrowsableHttpUrl(base)) { error(`--api "${opts.api}" isn't a usable http(s) URL (or it uses a restricted port).`); process.exitCode = 1; return }
+          saveAuth({ apiBase: base })
+        }
+        const { apiBase } = resolveAuth()   // sanitized — a bad stored value self-heals to the default
+
+        if (opts.token) { saveAuth({ token: opts.token, session: undefined }); if (!(await verifyAndReport())) process.exitCode = 1; return }
+        if (opts.session) { saveAuth({ session: opts.session.trim(), token: undefined }); if (!(await verifyAndReport())) process.exitCode = 1; return }
+        if (opts.paste) { if (!(await pasteFlow(apiBase, opts.open !== false))) process.exitCode = 1; return }
+
+        const result = await deviceFlow(apiBase, opts.open !== false)
+        if (result === 'unavailable') {
+          info('device-code flow not available on this server yet — falling back to session paste.')
+          if (!(await pasteFlow(apiBase, opts.open !== false))) process.exitCode = 1
+          return
+        }
+        if (result === 'ok') info('run `dragon chat` to start, or `dragon ask "…"` for one-shot.')
+        else process.exitCode = 1
+      } catch (e) {
+        error(`login failed: ${e instanceof Error ? e.message : String(e)}`)
+        process.exitCode = 1
+      }
+    })
+
+  program
+    .command('logout')
+    .description('Forget the stored Dragon assistant credentials')
+    .action(() => { clearAuth(); success('signed out — credentials cleared from ~/.dragon/config.json') })
+
+  program
+    .command('whoami')
+    .description('Show the current Dragon assistant identity + endpoint')
+    .action(async () => {
+      const { apiBase, mode, email } = resolveAuth()
+      console.log(`  ${C.faint('endpoint:')} ${C.info(apiBase)}`)
+      console.log(`  ${C.faint('auth:')}     ${mode === 'none' ? C.faint('none') : C.accent(mode)}`)
+      if (mode === 'none') { info('not signed in — run `dragon login`.'); return }
+      const me = await whoami()
+      if (me.ok) success(`verified${me.email ? ` as ${C.accent(me.email)}` : ''}`)
+      else if (me.status === 401) error('stored credential is no longer valid — run `dragon login`.')
+      else { error(`could not verify (${me.error ?? me.status}).`); if (email) info(`last known: ${email}`) }
+    })
+}

package/src/commands/maintenance.ts

@@ -0,0 +1,54 @@
+/**
+ * dragon completions / upgrade — quality-of-life maintenance.
+ *
+ *   dragon completions [bash|zsh|fish]   # shell tab-completion script
+ *   dragon upgrade                        # git pull + build (from-source installs)
+ *
+ * Copyright 2026 Ghost Protocol (Pvt) Ltd. All Rights Reserved.
+ */
+
+import type { Command } from 'commander'
+import type { DragonConfig } from '../config.js'
+import { C, success, error, info } from '../utils.js'
+import { execFile } from 'node:child_process'
+import { existsSync, realpathSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+
+function installRoot(): string | null {
+  const entry = process.argv[1]
+  if (!entry) return null
+  try { return dirname(dirname(realpathSync(entry))) } catch { return dirname(dirname(entry)) } // dist/index.js → root
+}
+
+function run(cmd: string, args: string[], cwd: string): Promise<number> {
+  return new Promise((res) => {
+    execFile(cmd, args, { cwd }, (err, stdout, stderr) => { process.stdout.write((stdout || '') + (stderr || '')); res(err ? 1 : 0) })
+  })
+}
+
+export function registerMaintenanceCommands(program: Command, _config: DragonConfig) {
+  program
+    .command('completions [shell]')
+    .description('Print a shell completion script (bash | zsh | fish)')
+    .action((shell = 'bash') => {
+      const cmds = program.commands.map((c) => c.name()).filter((n) => n && n !== 'completions').sort().join(' ')
+      if (shell === 'fish') console.log(`complete -c dragon -f -a "${cmds}"`)
+      else if (shell === 'zsh') console.log(`#compdef dragon\n_dragon(){ _arguments '1:command:(${cmds})' '*::arg:_files' }\ncompdef _dragon dragon`)
+      else console.log(`_dragon(){ COMPREPLY=( $(compgen -W "${cmds}" -- "\${COMP_WORDS[1]}") ); }\ncomplete -F _dragon dragon`)
+      process.stderr.write(C.faint(`# install: dragon completions ${shell} >> ~/.${shell === 'fish' ? 'config/fish/completions/dragon.fish' : shell + 'rc'}\n`))
+    })
+
+  program
+    .command('upgrade')
+    .description('Update the dragon CLI from source (git pull + build)')
+    .action(async () => {
+      const root = installRoot()
+      if (!root) { error('could not locate the install directory'); process.exitCode = 1; return }
+      if (!existsSync(join(root, '.git'))) { info(`installed at ${C.info(root)} — not a git checkout, update it however you installed it.`); return }
+      info(`upgrading dragon at ${C.info(root)} …`)
+      if (await run('git', ['pull', '--ff-only'], root)) { error('git pull failed (commit/stash local changes first?)'); process.exitCode = 1; return }
+      if (await run('npm', ['install'], root)) { error('npm install failed'); process.exitCode = 1; return }
+      if (await run('npm', ['run', 'build'], root)) { error('build failed'); process.exitCode = 1; return }
+      success('dragon upgraded.')
+    })
+}

package/src/commands/mcp.ts

@@ -0,0 +1,57 @@
+/**
+ * dragon mcp — manage extra MCP servers wired into the agent.
+ *
+ *   dragon mcp add <name> <command> [args...]   # e.g. dragon mcp add fs npx -- -y @modelcontextprotocol/server-filesystem ~/code
+ *   dragon mcp list
+ *   dragon mcp remove <name>
+ *
+ * Configured servers connect on `dragon chat` and their tools become agent tools
+ * (namespaced <server>__<tool>). Wyrm is built-in and not managed here.
+ *
+ * Copyright 2026 Ghost Protocol (Pvt) Ltd. All Rights Reserved.
+ */
+
+import type { Command } from 'commander'
+import { loadConfig, saveConfig, type DragonConfig } from '../config.js'
+import { C, success, error, info } from '../utils.js'
+import { panel, chrome, statusDot } from '../ui.js'
+
+export function registerMcpCommands(program: Command, _config: DragonConfig) {
+  const mcp = program.command('mcp').description('Manage MCP servers wired into the agent')
+
+  mcp
+    .command('add <name> <command> [args...]')
+    .description('Add an MCP server (stdio). Args after the command are passed to it.')
+    .action((name: string, command: string, args: string[] = []) => {
+      const c = loadConfig()
+      c.mcpServers = { ...(c.mcpServers ?? {}), [name]: { command, args } }
+      saveConfig(c)
+      success(`mcp server "${name}" added → ${command} ${args.join(' ')}`)
+      info('it connects on `dragon chat`; its tools appear namespaced as ' + C.info(`${name}__<tool>`))
+    })
+
+  mcp
+    .command('remove <name>')
+    .description('Remove a configured MCP server')
+    .action((name: string) => {
+      const c = loadConfig()
+      if (!c.mcpServers?.[name]) { error(`no MCP server named "${name}"`); process.exitCode = 1; return }
+      delete c.mcpServers[name]
+      saveConfig(c)
+      success(`removed "${name}"`)
+    })
+
+  mcp
+    .command('list')
+    .description('List configured MCP servers')
+    .action(() => {
+      const servers = loadConfig().mcpServers ?? {}
+      const names = Object.keys(servers)
+      const lines = names.length
+        ? names.map((n) => `${statusDot(true)} ${C.info(n.padEnd(12))} ${C.faint(servers[n].command + ' ' + (servers[n].args ?? []).join(' '))}`)
+        : [C.faint('none — add one with `dragon mcp add <name> <command> [args...]`')]
+      lines.push('', C.faint('Wyrm memory is built-in (not listed here).'))
+      console.log()
+      console.log(panel(lines, { title: chrome('MCP SERVERS') }))
+    })
+}