mcpick 0.0.25 → 0.0.26

package/dist/{list-DMcaHDfM.js → list-CvpW_mNZ.js}

@@ -1,7 +1,5 @@
-import { a as get_enabled_servers_for_scope } from "./config-Bzh374VP.js";
-import { a as redact_url, n as redact_server, t as redact_portable_server } from "./redact-wBMtzbno.js";
-import { D as get_all_available_servers, P as get_client_adapter } from "./index.js";
-import { n as output, t as error } from "./output-BS1TMOWt.js";
+import { F as get_client_adapter, O as get_all_available_servers, S as redact_server, T as redact_url, Y as get_enabled_servers_for_scope, x as redact_portable_server } from "./index.js";
+import { n as output, t as error } from "./output-DGPi2IWN.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/list.ts
 var list_default = defineCommand({
@@ -97,4 +95,4 @@ async function list_client_servers(client, scope, json) {
 //#endregion
 export { list_default as default };
 
-//# sourceMappingURL=list-DMcaHDfM.js.map
+//# sourceMappingURL=list-CvpW_mNZ.js.map

package/dist/{marketplace-DTW7Ys8k.js → marketplace-BKGJ3UGr.js}

@@ -1,6 +1,6 @@
-import { u as read_marketplace_manifest } from "./plugin-cache-Dw1I2YuO.js";
-import { _ as marketplace_remove_via_cli, c as check_restored_hooks, f as redisable_restored_hooks, g as marketplace_list_via_cli, h as marketplace_add_via_cli, v as marketplace_update_via_cli } from "./index.js";
-import { n as output, t as error } from "./output-BS1TMOWt.js";
+import { _ as redisable_restored_hooks, l as read_marketplace_manifest, p as check_restored_hooks } from "./plugin-cache-Dj-lS1mA.js";
+import { d as marketplace_list_via_cli, f as marketplace_remove_via_cli, p as marketplace_update_via_cli, u as marketplace_add_via_cli } from "./index.js";
+import { n as output, t as error } from "./output-DGPi2IWN.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/marketplace.ts
 const list = defineCommand({
@@ -164,4 +164,4 @@ var marketplace_default = defineCommand({
 //#endregion
 export { marketplace_default as default };
 
-//# sourceMappingURL=marketplace-DTW7Ys8k.js.map
+//# sourceMappingURL=marketplace-BKGJ3UGr.js.map

package/dist/{mutation-ukRPw3qM.js → mutation-BBMIFB8H.js}

@@ -1,4 +1,4 @@
-import { i as get_claude_config_path, v as get_project_mcp_json_path } from "./paths-BPISiJi4.js";
+import { s as get_claude_config_path, x as get_project_mcp_json_path } from "./safe-apply-B5flt8QC.js";
 //#region src/cli/mutation.ts
 function claude_mutation_context(operation, scope, servers) {
 	return {
@@ -16,4 +16,4 @@ function print_mutation_details(input) {
 //#endregion
 export { print_mutation_details as n, claude_mutation_context as t };
 
-//# sourceMappingURL=mutation-ukRPw3qM.js.map
+//# sourceMappingURL=mutation-BBMIFB8H.js.map

package/dist/{output-BS1TMOWt.js → output-DGPi2IWN.js}

@@ -1,4 +1,4 @@
-import { i as redact_text, o as redact_value } from "./redact-wBMtzbno.js";
+import { E as redact_value, w as redact_text } from "./index.js";
 //#region src/cli/output.ts
 function output(data, json) {
 	const safe_data = redact_value(data);
@@ -14,4 +14,4 @@ function error(message) {
 //#endregion
 export { output as n, error as t };
 
-//# sourceMappingURL=output-BS1TMOWt.js.map
+//# sourceMappingURL=output-DGPi2IWN.js.map

package/dist/{plugin-cache-Dw1I2YuO.js → plugin-cache-Dj-lS1mA.js}

@@ -1,27 +1,175 @@
-import { t as __exportAll } from "./rolldown-runtime-CiIaOW0V.js";
-import { d as get_marketplace_manifest_path, h as get_plugin_cache_dir, l as get_installed_plugins_path, t as ensure_directory_exists, u as get_known_marketplaces_path } from "./paths-BPISiJi4.js";
-import { K as atomic_json_write, c as check_restored_hooks, f as redisable_restored_hooks } from "./index.js";
+import { d as get_disabled_hooks_path, f as get_installed_plugins_path, g as get_mcpick_dir, h as get_marketplaces_dir, i as ensure_directory_exists, m as get_marketplace_manifest_path, p as get_known_marketplaces_path, r as safe_json_write, v as get_plugin_cache_dir } from "./safe-apply-B5flt8QC.js";
+import { t as atomic_json_write } from "./atomic-write-9pfXia-x.js";
 import { lstat, readFile, readdir, readlink, rename, rm, symlink } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
+//#region src/core/hook-state.ts
+async function read_disabled_hooks() {
+	try {
+		const content = await readFile(get_disabled_hooks_path(), "utf-8");
+		return JSON.parse(content);
+	} catch {
+		return [];
+	}
+}
+async function write_disabled_hooks(entries) {
+	await ensure_directory_exists(get_mcpick_dir());
+	await safe_json_write(get_disabled_hooks_path(), entries, "	");
+}
+/**
+* Remove a specific hook handler from a hooks.json file by matching the handler.
+* Returns true if the hook was found and removed.
+*/
+async function remove_hook_from_file(hooks_path, event, handler) {
+	let content;
+	try {
+		content = await readFile(hooks_path, "utf-8");
+	} catch {
+		return false;
+	}
+	const hooks_data = JSON.parse(content);
+	const hooks_obj = hooks_data.hooks || hooks_data;
+	const matchers = hooks_obj[event];
+	if (!matchers) return false;
+	let removed = false;
+	for (const m of matchers) {
+		const idx = m.hooks?.findIndex((h) => h.type === handler.type && h.command === handler.command && h.url === handler.url && h.prompt === handler.prompt);
+		if (idx !== void 0 && idx >= 0) {
+			m.hooks.splice(idx, 1);
+			removed = true;
+			if (m.hooks.length === 0) matchers.splice(matchers.indexOf(m), 1);
+			break;
+		}
+	}
+	if (!removed) return false;
+	if (matchers.length === 0) delete hooks_obj[event];
+	await safe_json_write(hooks_path, hooks_data, "	");
+	return true;
+}
+/**
+* Get all hooks.json paths for a plugin (cache + marketplace source).
+*/
+function get_all_hooks_paths(plugin_key, primary_path) {
+	const paths = [primary_path];
+	const at_index = plugin_key.lastIndexOf("@");
+	if (at_index > 0) {
+		const plugin_name = plugin_key.substring(0, at_index);
+		const marketplace_name = plugin_key.substring(at_index + 1);
+		paths.push(join(get_marketplaces_dir(), marketplace_name, "plugins", plugin_name, "hooks", "hooks.json"));
+	}
+	return [...new Set(paths)];
+}
+/**
+* Disable a specific hook from a plugin.
+* Removes from both cache and marketplace source hooks.json files.
+*/
+async function disable_plugin_hook(entry) {
+	if (!entry.hooks_json_path || !entry.plugin_key) throw new Error("Not a plugin hook");
+	const disabled = await read_disabled_hooks();
+	disabled.push({
+		plugin_key: entry.plugin_key,
+		hooks_json_path: entry.hooks_json_path,
+		event: entry.event,
+		matcher: entry.matcher,
+		matcher_index: entry.matcher_index,
+		hook_index: entry.hook_index,
+		original_handler: entry.handler,
+		disabled_at: (/* @__PURE__ */ new Date()).toISOString()
+	});
+	await write_disabled_hooks(disabled);
+	const all_paths = get_all_hooks_paths(entry.plugin_key, entry.hooks_json_path);
+	for (const hooks_path of all_paths) await remove_hook_from_file(hooks_path, entry.event, entry.handler);
+}
+/**
+* Add a hook handler back into a hooks.json file.
+*/
+async function add_hook_to_file(hooks_path, event, matcher_pattern, handler) {
+	let hooks_data;
+	try {
+		const content = await readFile(hooks_path, "utf-8");
+		hooks_data = JSON.parse(content);
+	} catch {
+		hooks_data = { hooks: {} };
+	}
+	const hooks_obj = hooks_data.hooks || (hooks_data.hooks = {});
+	if (!hooks_obj[event]) hooks_obj[event] = [];
+	const matchers = hooks_obj[event];
+	let matcher = matchers.find((m) => (m.matcher || void 0) === matcher_pattern);
+	if (!matcher) {
+		matcher = { hooks: [] };
+		if (matcher_pattern) matcher.matcher = matcher_pattern;
+		matchers.push(matcher);
+	}
+	if (matcher.hooks.some((h) => h.type === handler.type && h.command === handler.command && h.url === handler.url && h.prompt === handler.prompt)) return;
+	matcher.hooks.push(handler);
+	await safe_json_write(hooks_path, hooks_data, "	");
+}
+/**
+* Re-enable a previously disabled plugin hook.
+* Restores to both cache and marketplace source hooks.json files.
+*/
+async function enable_plugin_hook(disabled_entry) {
+	const all_paths = get_all_hooks_paths(disabled_entry.plugin_key, disabled_entry.hooks_json_path);
+	for (const hooks_path of all_paths) await add_hook_to_file(hooks_path, disabled_entry.event, disabled_entry.matcher, disabled_entry.original_handler);
+	await write_disabled_hooks((await read_disabled_hooks()).filter((d) => !(d.plugin_key === disabled_entry.plugin_key && d.event === disabled_entry.event && d.disabled_at === disabled_entry.disabled_at)));
+}
+/**
+* Check if any previously disabled hooks have been restored (e.g. by marketplace update).
+* Returns entries that were re-added and need to be re-disabled.
+*/
+async function check_restored_hooks() {
+	const disabled = await read_disabled_hooks();
+	if (disabled.length === 0) return [];
+	const restored = [];
+	for (const entry of disabled) {
+		const all_paths = get_all_hooks_paths(entry.plugin_key, entry.hooks_json_path);
+		let found = false;
+		for (const hooks_path of all_paths) {
+			let hooks_data;
+			try {
+				const content = await readFile(hooks_path, "utf-8");
+				hooks_data = JSON.parse(content);
+			} catch {
+				continue;
+			}
+			const matchers = (hooks_data.hooks || hooks_data)[entry.event];
+			if (!matchers) continue;
+			for (const m of matchers) {
+				if ((m.matcher || void 0) !== entry.matcher) continue;
+				if (m.hooks?.some((h) => h.type === entry.original_handler.type && (h.command === entry.original_handler.command || h.url === entry.original_handler.url || h.prompt === entry.original_handler.prompt))) {
+					found = true;
+					break;
+				}
+			}
+			if (found) break;
+		}
+		if (found) restored.push(entry);
+	}
+	return restored;
+}
+/**
+* Re-disable hooks that were restored by a marketplace update.
+*/
+async function redisable_restored_hooks(restored) {
+	let success = 0;
+	let failed = 0;
+	for (const entry of restored) try {
+		const all_paths = get_all_hooks_paths(entry.plugin_key, entry.hooks_json_path);
+		let any_removed = false;
+		for (const hooks_path of all_paths) if (await remove_hook_from_file(hooks_path, entry.event, entry.original_handler)) any_removed = true;
+		if (any_removed) success++;
+		else failed++;
+	} catch {
+		failed++;
+	}
+	return {
+		success,
+		failed
+	};
+}
+//#endregion
 //#region src/core/plugin-cache.ts
-var plugin_cache_exports = /* @__PURE__ */ __exportAll({
-	clean_orphaned_versions: () => clean_orphaned_versions,
-	clear_plugin_caches: () => clear_plugin_caches,
-	get_cached_plugins_info: () => get_cached_plugins_info,
-	link_local_plugin: () => link_local_plugin,
-	list_linked_plugins: () => list_linked_plugins,
-	parse_plugin_key: () => parse_plugin_key,
-	read_installed_plugins: () => read_installed_plugins,
-	read_known_marketplaces: () => read_known_marketplaces,
-	read_marketplace_manifest: () => read_marketplace_manifest,
-	refresh_all_marketplaces: () => refresh_all_marketplaces,
-	refresh_marketplace: () => refresh_marketplace,
-	scan_all_cache_keys: () => scan_all_cache_keys,
-	unlink_local_plugin: () => unlink_local_plugin,
-	write_installed_plugins: () => write_installed_plugins
-});
 const execFileAsync = promisify(execFile);
 function git(dir, args, timeout) {
 	return execFileAsync("git", [
@@ -426,6 +574,6 @@ async function list_linked_plugins() {
 	return links;
 }
 //#endregion
-export { list_linked_plugins as a, read_installed_plugins as c, refresh_all_marketplaces as d, scan_all_cache_keys as f, link_local_plugin as i, read_known_marketplaces as l, clear_plugin_caches as n, parse_plugin_key as o, unlink_local_plugin as p, get_cached_plugins_info as r, plugin_cache_exports as s, clean_orphaned_versions as t, read_marketplace_manifest as u };
+export { redisable_restored_hooks as _, list_linked_plugins as a, read_known_marketplaces as c, scan_all_cache_keys as d, unlink_local_plugin as f, read_disabled_hooks as g, enable_plugin_hook as h, link_local_plugin as i, read_marketplace_manifest as l, disable_plugin_hook as m, clear_plugin_caches as n, parse_plugin_key as o, check_restored_hooks as p, get_cached_plugins_info as r, read_installed_plugins as s, clean_orphaned_versions as t, refresh_all_marketplaces as u };
 
-//# sourceMappingURL=plugin-cache-Dw1I2YuO.js.map
+//# sourceMappingURL=plugin-cache-Dj-lS1mA.js.map

package/dist/{plugins-BzLD4og0.js → plugins-elIQYM38.js}

@@ -1,6 +1,6 @@
-import { l as read_known_marketplaces, o as parse_plugin_key } from "./plugin-cache-Dw1I2YuO.js";
-import { B as build_enabled_plugins, C as uninstall_plugin_via_cli, G as write_claude_settings, H as get_all_plugins, T as validate_plugin_via_cli, U as read_claude_settings, m as install_plugin_via_cli, w as update_plugin_via_cli } from "./index.js";
-import { n as output, t as error } from "./output-BS1TMOWt.js";
+import { c as read_known_marketplaces, o as parse_plugin_key } from "./plugin-cache-Dj-lS1mA.js";
+import { K as write_claude_settings, U as get_all_plugins, V as build_enabled_plugins, W as read_claude_settings, b as validate_plugin_via_cli, l as install_plugin_via_cli, v as uninstall_plugin_via_cli, y as update_plugin_via_cli } from "./index.js";
+import { n as output, t as error } from "./output-DGPi2IWN.js";
 import { defineCommand } from "citty";
 var plugins_default = defineCommand({
 	meta: {
@@ -208,4 +208,4 @@ var plugins_default = defineCommand({
 //#endregion
 export { plugins_default as default };
 
-//# sourceMappingURL=plugins-BzLD4og0.js.map
+//# sourceMappingURL=plugins-elIQYM38.js.map

package/dist/{profile-CmIWUJH_.js → profile-NVbTnJKI.js}

@@ -1,6 +1,6 @@
-import { L as resolve_client_location, P as get_client_adapter, a as save_profile_for_client, i as save_current_claude_profile, n as apply_profile_to_client, r as list_profiles, t as apply_profile_to_claude } from "./index.js";
-import { n as print_mutation_details } from "./mutation-ukRPw3qM.js";
-import { n as output, t as error } from "./output-BS1TMOWt.js";
+import { F as get_client_adapter, R as resolve_client_location, a as save_profile_for_client, i as save_current_claude_profile, n as apply_profile_to_client, r as list_profiles, t as apply_profile_to_claude } from "./index.js";
+import { n as print_mutation_details } from "./mutation-BBMIFB8H.js";
+import { n as output, t as error } from "./output-DGPi2IWN.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/profile.ts
 const CLIENTS = "claude-code, gemini-cli, vscode, cursor, windsurf, opencode, or pi";
@@ -160,4 +160,4 @@ var profile_default = defineCommand({
 //#endregion
 export { profile_default as default };
 
-//# sourceMappingURL=profile-CmIWUJH_.js.map
+//# sourceMappingURL=profile-NVbTnJKI.js.map

package/dist/{reload-Di28s_rY.js → reload-BkVtWaf0.js}

@@ -1,4 +1,4 @@
-import { n as output } from "./output-BS1TMOWt.js";
+import { n as output } from "./output-DGPi2IWN.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/reload.ts
 var reload_default = defineCommand({
@@ -28,4 +28,4 @@ var reload_default = defineCommand({
 //#endregion
 export { reload_default as default };
 
-//# sourceMappingURL=reload-Di28s_rY.js.map
+//# sourceMappingURL=reload-BkVtWaf0.js.map

package/dist/{remove-B32EuYRC.js → remove-BC2vomi_.js}

@@ -1,6 +1,6 @@
-import { A as read_server_registry, D as get_all_available_servers, I as remove_client_server, L as resolve_client_location, P as get_client_adapter, S as remove_mcp_via_cli, j as write_server_registry } from "./index.js";
-import { n as print_mutation_details, t as claude_mutation_context } from "./mutation-ukRPw3qM.js";
-import { n as output, t as error } from "./output-BS1TMOWt.js";
+import { F as get_client_adapter, L as remove_client_server, M as write_server_registry, O as get_all_available_servers, R as resolve_client_location, _ as remove_mcp_via_cli, j as read_server_registry } from "./index.js";
+import { n as print_mutation_details, t as claude_mutation_context } from "./mutation-BBMIFB8H.js";
+import { n as output, t as error } from "./output-DGPi2IWN.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/remove.ts
 var remove_default = defineCommand({
@@ -89,4 +89,4 @@ async function remove_from_client(client, server, scope, location_path, json) {
 //#endregion
 export { remove_default as default };
 
-//# sourceMappingURL=remove-B32EuYRC.js.map
+//# sourceMappingURL=remove-BC2vomi_.js.map

package/dist/{reset-project-choices-DX4TnZ2i.js → reset-project-choices-DhJsWQx2.js}

@@ -1,5 +1,5 @@
-import { x as mcp_reset_project_choices_via_cli } from "./index.js";
-import { n as output, t as error } from "./output-BS1TMOWt.js";
+import { g as mcp_reset_project_choices_via_cli } from "./index.js";
+import { n as output, t as error } from "./output-DGPi2IWN.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/reset-project-choices.ts
 var reset_project_choices_default = defineCommand({
@@ -25,4 +25,4 @@ var reset_project_choices_default = defineCommand({
 //#endregion
 export { reset_project_choices_default as default };
 
-//# sourceMappingURL=reset-project-choices-DX4TnZ2i.js.map
+//# sourceMappingURL=reset-project-choices-DhJsWQx2.js.map

package/dist/{restore-ByS4xi0y.js → restore-CeYSOFt8.js}

@@ -1,7 +1,5 @@
-import { t as validate_claude_config } from "./validation-CfPAjPJ5.js";
-import { s as write_claude_config } from "./config-Bzh374VP.js";
-import { G as write_claude_settings, O as list_backups, k as list_plugin_backups } from "./index.js";
-import { n as output, t as error } from "./output-BS1TMOWt.js";
+import { A as list_plugin_backups, K as write_claude_settings, Q as validate_claude_config, Z as write_claude_config, k as list_backups } from "./index.js";
+import { n as output, t as error } from "./output-DGPi2IWN.js";
 import { readFile } from "node:fs/promises";
 import { defineCommand } from "citty";
 //#region src/cli/commands/restore.ts
@@ -80,4 +78,4 @@ var restore_default = defineCommand({
 //#endregion
 export { restore_default as default };
 
-//# sourceMappingURL=restore-ByS4xi0y.js.map
+//# sourceMappingURL=restore-CeYSOFt8.js.map

package/dist/{rollback-DdDJrA8y.js → rollback-g-WX6b3o.js}

@@ -1,5 +1,5 @@
-import { J as restore_config_backup, q as list_config_backups } from "./index.js";
-import { n as output, t as error } from "./output-BS1TMOWt.js";
+import { n as restore_config_backup, t as list_config_backups } from "./safe-apply-B5flt8QC.js";
+import { n as output, t as error } from "./output-DGPi2IWN.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/rollback.ts
 var rollback_default = defineCommand({
@@ -52,4 +52,4 @@ var rollback_default = defineCommand({
 //#endregion
 export { rollback_default as default };
 
-//# sourceMappingURL=rollback-DdDJrA8y.js.map
+//# sourceMappingURL=rollback-g-WX6b3o.js.map

package/dist/safe-apply-B5flt8QC.js

@@ -0,0 +1,185 @@
+import { access, mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { createHash, randomUUID } from "node:crypto";
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+//#region src/utils/paths.ts
+function get_base_dir() {
+	const configDir = process.env.CLAUDE_CONFIG_DIR;
+	if (configDir && configDir.length > 0 && existsSync(configDir)) return {
+		baseDir: configDir,
+		parentDir: dirname(configDir),
+		coLocatedConfig: true
+	};
+	const defaultDir = join(homedir(), ".claude");
+	return {
+		baseDir: defaultDir,
+		parentDir: dirname(defaultDir),
+		coLocatedConfig: false
+	};
+}
+function get_claude_config_path() {
+	const { baseDir, parentDir, coLocatedConfig } = get_base_dir();
+	if (coLocatedConfig) return join(baseDir, ".claude.json");
+	return join(parentDir, ".claude.json");
+}
+function get_claude_settings_path() {
+	return join(get_base_dir().baseDir, "settings.json");
+}
+function get_mcpick_dir() {
+	return join(get_base_dir().baseDir, "mcpick");
+}
+function get_dev_overrides_path() {
+	return join(get_mcpick_dir(), "dev-overrides.json");
+}
+function get_server_registry_path() {
+	return join(get_mcpick_dir(), "servers.json");
+}
+function get_backups_dir() {
+	return join(get_mcpick_dir(), "backups");
+}
+function get_profiles_dir() {
+	return join(get_mcpick_dir(), "profiles");
+}
+function get_profile_path(name) {
+	const filename = name.endsWith(".json") ? name : `${name}.json`;
+	return join(get_profiles_dir(), filename);
+}
+function format_backup_timestamp() {
+	const now = /* @__PURE__ */ new Date();
+	return `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}-${String(now.getDate()).padStart(2, "0")}-${String(now.getHours()).padStart(2, "0")}${String(now.getMinutes()).padStart(2, "0")}${String(now.getSeconds()).padStart(2, "0")}`;
+}
+function get_backup_filename() {
+	return `mcp-servers-${format_backup_timestamp()}.json`;
+}
+function get_plugin_backup_filename() {
+	return `plugins-${format_backup_timestamp()}.json`;
+}
+async function ensure_directory_exists(dir_path) {
+	try {
+		await access(dir_path);
+	} catch {
+		await mkdir(dir_path, { recursive: true });
+	}
+}
+/**
+* Get the current working directory (project path)
+*/
+function get_current_project_path() {
+	return process.cwd();
+}
+/**
+* Get the path to .mcp.json in the current project directory (project scope)
+*/
+function get_project_mcp_json_path() {
+	return join(get_current_project_path(), ".mcp.json");
+}
+function get_plugins_dir() {
+	return join(get_base_dir().baseDir, "plugins");
+}
+function get_installed_plugins_path() {
+	return join(get_plugins_dir(), "installed_plugins.json");
+}
+function get_known_marketplaces_path() {
+	return join(get_plugins_dir(), "known_marketplaces.json");
+}
+function get_plugin_cache_dir() {
+	return join(get_plugins_dir(), "cache");
+}
+function get_marketplaces_dir() {
+	return join(get_plugins_dir(), "marketplaces");
+}
+function get_disabled_hooks_path() {
+	return join(get_mcpick_dir(), "disabled-hooks.json");
+}
+function get_marketplace_manifest_path(name) {
+	return join(get_marketplaces_dir(), name, ".claude-plugin", "marketplace.json");
+}
+//#endregion
+//#region src/utils/safe-apply.ts
+async function file_exists(path) {
+	try {
+		await access(path);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function backup_name(path) {
+	const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z");
+	const hash = createHash("sha256").update(path).digest("hex").slice(0, 10);
+	return `config-${basename(path).replace(/[^A-Za-z0-9._-]/g, "_")}-${stamp}-${hash}.json`;
+}
+async function create_backup(path, content) {
+	const backups_dir = get_backups_dir();
+	await ensure_directory_exists(backups_dir);
+	const backup_path = join(backups_dir, backup_name(path));
+	await writeFile(backup_path, content, "utf-8");
+	await writeFile(`${backup_path}.meta.json`, JSON.stringify({
+		original_path: path,
+		created_at: (/* @__PURE__ */ new Date()).toISOString()
+	}, null, 2), "utf-8");
+	return backup_path;
+}
+/**
+* Safely replace a JSON file: backup existing content, write via temp+rename,
+* verify the result parses, and restore the original content on failure.
+*/
+async function safe_json_write(path, data, indent = 2) {
+	await mkdir(dirname(path), { recursive: true });
+	const original_content = await file_exists(path) ? await readFile(path, "utf-8") : void 0;
+	const backup_path = original_content !== void 0 ? await create_backup(path, original_content) : void 0;
+	const tmp_path = join(dirname(path), `.${basename(path)}.${process.pid}.${Date.now()}.${randomUUID()}.tmp`);
+	const next_content = JSON.stringify(data, null, indent);
+	try {
+		await writeFile(tmp_path, next_content, "utf-8");
+		await rename(tmp_path, path);
+		const written = await readFile(path, "utf-8");
+		JSON.parse(written);
+		return {
+			path,
+			...backup_path ? { backup_path } : {}
+		};
+	} catch (error) {
+		await rm(tmp_path, { force: true }).catch(() => void 0);
+		if (original_content !== void 0) await writeFile(path, original_content, "utf-8");
+		else await rm(path, { force: true }).catch(() => void 0);
+		throw error;
+	}
+}
+async function list_config_backups() {
+	const backups_dir = get_backups_dir();
+	try {
+		const files = await readdir(backups_dir);
+		const backups = [];
+		for (const file of files) {
+			if (!file.startsWith("config-") || !file.endsWith(".json")) continue;
+			if (file.endsWith(".meta.json")) continue;
+			const backup_path = join(backups_dir, file);
+			try {
+				const meta = JSON.parse(await readFile(`${backup_path}.meta.json`, "utf-8"));
+				if (typeof meta.original_path !== "string" || typeof meta.created_at !== "string") continue;
+				backups.push({
+					path: backup_path,
+					original_path: meta.original_path,
+					created_at: meta.created_at
+				});
+			} catch {}
+		}
+		return backups.sort((a, b) => b.created_at.localeCompare(a.created_at));
+	} catch {
+		return [];
+	}
+}
+async function restore_config_backup(backup_path) {
+	const backup = (await list_config_backups()).find((candidate) => candidate.path === backup_path || basename(candidate.path) === backup_path);
+	if (!backup) throw new Error(`Config backup '${backup_path}' not found.`);
+	const content = await readFile(backup.path, "utf-8");
+	const parsed = JSON.parse(content);
+	await safe_json_write(backup.original_path, parsed);
+	return backup;
+}
+//#endregion
+export { get_server_registry_path as S, get_plugin_backup_filename as _, get_backup_filename as a, get_profiles_dir as b, get_claude_settings_path as c, get_disabled_hooks_path as d, get_installed_plugins_path as f, get_mcpick_dir as g, get_marketplaces_dir as h, ensure_directory_exists as i, get_current_project_path as l, get_marketplace_manifest_path as m, restore_config_backup as n, get_backups_dir as o, get_known_marketplaces_path as p, safe_json_write as r, get_claude_config_path as s, list_config_backups as t, get_dev_overrides_path as u, get_plugin_cache_dir as v, get_project_mcp_json_path as x, get_profile_path as y };
+
+//# sourceMappingURL=safe-apply-B5flt8QC.js.map

package/dist/{skills-pvyQ17XU.js → skills-zuQ5kCL1.js}

@@ -1,5 +1,5 @@
 import { o as run_skills_cli, s as split_cli_list } from "./index.js";
-import { n as output, t as error } from "./output-BS1TMOWt.js";
+import { n as output, t as error } from "./output-DGPi2IWN.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/skills.ts
 function add_agent_args(cli_args, agent) {
@@ -213,4 +213,4 @@ var skills_default = defineCommand({
 //#endregion
 export { skills_default as default };
 
-//# sourceMappingURL=skills-pvyQ17XU.js.map
+//# sourceMappingURL=skills-zuQ5kCL1.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcpick",
-  "version": "0.0.25",
+  "version": "0.0.26",
   "description": "Vendor-neutral MCP configuration manager with first-class Claude Code support",
   "keywords": [
     "claude",
@@ -31,15 +31,15 @@
   "type": "module",
   "main": "./dist/index.js",
   "dependencies": {
-    "@clack/prompts": "^1.3.0",
+    "@clack/prompts": "^1.4.0",
     "citty": "^0.2.2",
-    "valibot": "^1.3.1"
+    "valibot": "^1.4.0"
   },
   "devDependencies": {
     "@changesets/cli": "^2.31.0",
-    "@types/node": "^25.6.0",
-    "vite-plus": "^0.1.20",
-    "vitest": "^4.1.5"
+    "@types/node": "^25.9.0",
+    "vite-plus": "^0.2.0",
+    "vitest": "^4.1.6"
   },
   "engines": {
     "node": ">=22.0.0"

package/pnpm-workspace.yaml

@@ -0,0 +1 @@
+minimumReleaseAge: 2880