onadit 0.0.1 → 0.1.0-beta.45

package/dist/src/cli/mcp-config-writers/codex-toml.js

@@ -0,0 +1,918 @@
+/**
+ * Surgical TOML writer for `~/.codex/config.toml`.
+ *
+ * Codex stores MCP servers as `[mcp_servers.<name>]` table sections.
+ * We don't depend on a TOML parser — the only edit Onadit makes is at
+ * the section-table level, so a line-based scan is enough and avoids
+ * round-tripping comments/blank lines/quoted strings the friend may
+ * have hand-written elsewhere in the file.
+ *
+ * Contract matches the JSON writer:
+ *   - Atomic (tmp + rename).
+ *   - Backup `<file>.bak.<iso-no-colons>` if file existed; surface only ID.
+ *   - Drop every `[mcp_servers.<legacy>]` section (bare or quoted, any
+ *     supported spacing, case-insensitive on the legacy server name).
+ *   - Replace any existing `[mcp_servers.onadit]` section, keeping the
+ *     user's policy for it (`enabled`, tool allow/deny lists, timeouts,
+ *     `[mcp_servers.onadit.tools.*]` approval tables). Only the executable
+ *     part (command, args) is Onadit's; env and unknown keys are still dropped.
+ *   - Treat `[mcp_servers.rift]`, the server's name before the product was
+ *     renamed, as that same entry: its policy moves to the new section with
+ *     the tool names it lists renamed, and the old section is removed.
+ *   - Stop, with the file untouched, wherever the entry cannot be carried
+ *     across exactly: the server written as an inline table or with dotted
+ *     keys instead of its own table (adding a table would create a second,
+ *     unrestricted entry), tool names spelled with escape sequences (a
+ *     text-level rename would miss them and a deny list would stop
+ *     matching), and, on a refresh, arguments it cannot read (the config
+ *     path must not be replaced by a guess).
+ *   - Preserve the rest of the file verbatim (preamble + other tables).
+ *   - Refuse to overwrite if any bracketed line is structurally
+ *     malformed: take a reference backup, throw `ParseFailedError`,
+ *     do not touch the file.
+ *   - On a write rollback (rename failure post-backup), restore the
+ *     backup contents in place.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { ParseFailedError } from "./errors.js";
+import { isLegacyServerName, redactForbidden } from "./redact.js";
+import { PREVIOUS_MCP_ENTRY_FILE, PREVIOUS_SERVER_NAME, SERVER_NAME, isMcpEntryFile, renamePreviousToolNames, } from "../../mcp/names.js";
+const SECTION_RE = /^\s*\[\s*([^\]]+?)\s*\]\s*(?:#.*)?$/;
+const ARRAY_TABLE_RE = /^\s*\[\[\s*([^\]]+?)\s*\]\]\s*(?:#.*)?$/;
+const LEADING_BRACKET_RE = /^\s*\[/;
+const MCP_SERVERS = "mcp_servers";
+/**
+ * Keys under `[mcp_servers.onadit]` that express the user's policy rather than
+ * how to launch or authenticate the server. A reinstall must not re-enable a
+ * disabled server, widen its tool list or drop an approval requirement.
+ *
+ * Taken from Codex's RawMcpServerConfig (codex-cli 0.154). The other fields —
+ * command, args, env, env_vars, cwd, url, http_headers, env_http_headers,
+ * bearer_token(_env_var), http_headers_helper, auth, oauth, oauth_resource,
+ * scopes, environment_id, name — are launch, transport or credentials: Onadit
+ * rebuilds command/args and drops the rest so no stale secret survives.
+ */
+const RIFT_POLICY_KEYS = new Set([
+    "enabled",
+    "required",
+    "enabled_tools",
+    "disabled_tools",
+    "default_tools_approval_mode",
+    "tools",
+    "startup_timeout_sec",
+    "startup_timeout_ms",
+    "tool_timeout_sec",
+    "supports_parallel_tool_calls",
+    "omit_tools_from",
+]);
+/** Policy keys whose value, or whose sub-keys, name tools. */
+const TOOL_NAMING_KEYS = new Set(["enabled_tools", "disabled_tools", "tools"]);
+class MalformedTomlError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "MalformedTomlError";
+    }
+}
+export function writeCodexTomlConfig(opts) {
+    const absolute = path.resolve(opts.configPath);
+    const preexisting = fs.existsSync(absolute);
+    const now = opts.now ?? defaultNow;
+    const raw = preexisting ? fs.readFileSync(absolute, "utf8") : "";
+    // Which of this server's entries are rebuilt and which are left in place.
+    //
+    // A section under the earlier server name keeps that name unless the person
+    // asked for the move (`newNames`): its tools keep their ids, so every rule
+    // written against them, in settings this writer can see or not, keeps
+    // applying. It is only pointed at this install, at the entry file that
+    // serves the earlier names. A refresh (`existingOnly`) does the same for
+    // every entry of ours and nothing else.
+    //
+    // A rebuilt entry drops its parent section AND every descendant subtable
+    // (e.g. [mcp_servers.onadit.env]) so a stale env block — possibly carrying a
+    // Voyage key from an earlier hand-edit — can't survive. Same for every
+    // legacy-named server. Unrelated servers pass through verbatim. Any
+    // MalformedTomlError raised here flows through failParse so the friend's
+    // file is left untouched.
+    const removedLegacyNames = [];
+    const seenLegacy = new Set();
+    const current = emptyEntry();
+    const previous = emptyEntry();
+    const refresh = !!opts.existingOnly;
+    let keptSections;
+    let parsed;
+    let entry;
+    let hasCurrent;
+    let hasPrevious;
+    let rename;
+    try {
+        parsed = parseTomlSections(raw);
+        // The server defined without a table of its own. This writer only knows
+        // `[mcp_servers.<name>]`; appending one beside an inline or dotted
+        // definition would leave two entries, the new one with none of the
+        // person's restrictions.
+        if (definesOwnServerInline(parsed.preamble, [])) {
+            throw new MalformedTomlError("mcp_servers.<name> written with dotted keys is not supported");
+        }
+        const names = new Set(parsed.sections.filter((s) => s.keySegments[0] === MCP_SERVERS && s.keySegments.length >= 2).map((s) => s.keySegments[1]));
+        hasCurrent = names.has(SERVER_NAME);
+        hasPrevious = names.has(PREVIOUS_SERVER_NAME);
+        rename = !!opts.newNames && hasPrevious;
+        const earlierEntryFile = path.join(path.dirname(opts.spec.args[0]), PREVIOUS_MCP_ENTRY_FILE);
+        keptSections = [];
+        for (const section of parsed.sections) {
+            const segs = section.keySegments;
+            if (segs.length === 1 && segs[0] === MCP_SERVERS && definesOwnServerInline(section.bodyLines, segs)) {
+                throw new MalformedTomlError("mcp_servers.<name> written inline is not supported");
+            }
+            if (segs[0] === MCP_SERVERS && segs.length >= 2) {
+                const name = segs[1];
+                const isCurrent = name === SERVER_NAME;
+                const isPrevious = name === PREVIOUS_SERVER_NAME;
+                if (refresh ? isCurrent || isPrevious : isPrevious && !rename) {
+                    // Left in place, under its name. Only the parent table's command and
+                    // entry file change; sub-tables and every other line stay.
+                    if (section.arrayTable) {
+                        throw new MalformedTomlError("array-of-tables under [[mcp_servers.<name>]] is not supported");
+                    }
+                    keptSections.push(segs.length !== 2
+                        ? section
+                        : refresh
+                            ? { ...section, bodyLines: repointEntryFiles(section.bodyLines, path.dirname(opts.spec.args[0])) }
+                            : { ...section, bodyLines: repointBody(section.bodyLines, opts.spec, earlierEntryFile) });
+                    continue;
+                }
+                const isLegacy = !refresh && isLegacyServerName(name);
+                const own = refresh ? null : isCurrent ? current : isPrevious ? previous : null;
+                if (isLegacy || own) {
+                    // Array-of-tables under [[mcp_servers.<name>]] is not
+                    // intentionally supported by Onadit. Fail closed rather than
+                    // silently sweep — the friend's file is left untouched and
+                    // recovery flows from the reference backup.
+                    if (section.arrayTable) {
+                        throw new MalformedTomlError("array-of-tables under [[mcp_servers.<name>]] is not supported");
+                    }
+                    if (isLegacy && !seenLegacy.has(name)) {
+                        seenLegacy.add(name);
+                        removedLegacyNames.push(name);
+                    }
+                    // Mark the entry as seen whether we encountered the parent or
+                    // a descendant — the friend's file may have only the
+                    // implicit [mcp_servers.onadit.env] form.
+                    if (own) {
+                        own.seen = true;
+                        // User policy survives the rewrite: per-tool tables whole, and
+                        // allowlisted keys from the parent table.
+                        if (segs[2] === "tools") {
+                            own.toolSections.push(section);
+                            continue;
+                        }
+                        if (segs.length === 2) {
+                            own.policy.push(...extractPolicyEntries(section.bodyLines));
+                            const configArg = readConfigArg(section.bodyLines);
+                            if (configArg === null)
+                                own.argsUnreadable = true;
+                            else
+                                own.configArg ??= configArg;
+                        }
+                    }
+                    // A comment before the next header may describe that unrelated
+                    // section. Keep standalone comments and spacing when replacing Onadit.
+                    const preceding = keptSections.at(-1)?.bodyLines ?? parsed.preamble;
+                    preceding.push(...section.bodyLines.filter(isTomlTrivia));
+                    continue;
+                }
+            }
+            keptSections.push(section);
+        }
+        // On a move, the section under the earlier name is this same entry: its
+        // policy carries over, with the tool names it lists renamed. A section
+        // already under the current name wins, and the earlier one is dropped.
+        entry = current.seen ? current : rename ? renamedToCurrent(previous) : emptyEntry();
+        // A move keeps the config path the connection already used. When that
+        // path cannot be read, putting the default in its place could point the
+        // agent at another archive.
+        if (rename && !current.seen && previous.argsUnreadable) {
+            throw new MalformedTomlError("args are written in a form this writer cannot read");
+        }
+    }
+    catch (err) {
+        if (err instanceof MalformedTomlError) {
+            throw failParse(opts, absolute, raw, now, err);
+        }
+        throw err;
+    }
+    const removedNames = removedLegacyNames;
+    const renamedFromEarlier = rename && !hasCurrent;
+    const keptEarlierNames = hasPrevious && !rename;
+    // The current name: rebuilt where it is, written on a move, and created only
+    // where the server is not connected at all. Beside a connection kept on its
+    // earlier names it would be a second way in, with none of its rules.
+    const wroteCurrent = !refresh && (hasCurrent || rename || !hasPrevious);
+    const spec = renamedFromEarlier && previous.configArg
+        ? { command: opts.spec.command, args: [opts.spec.args[0], previous.configArg, ...opts.spec.args.slice(2)] }
+        : opts.spec;
+    let merged;
+    if (wroteCurrent) {
+        const riftBlock = [
+            [renderRiftSection(spec), ...entry.policy.flatMap((p) => p.lines)].join("\n"),
+            ...entry.toolSections.map((t) => [t.headerLine, ...trimTrailingTrivia(t.bodyLines)].join("\n")),
+        ].join("\n\n");
+        merged = renderToml(parsed.preamble, keptSections, riftBlock);
+    }
+    else {
+        merged = renderSections(parsed.preamble, keptSections, raw);
+    }
+    // A refresh with nothing of ours in the file, or nothing to change in it.
+    if (refresh && merged === raw)
+        return skipped(absolute, preexisting, opts.dryRun);
+    const redactedDiff = renderRedactedDiff({
+        removedNames,
+        rewroteRift: hasCurrent || hasPrevious,
+        renamedFromPrevious: renamedFromEarlier,
+        keptEarlierNames,
+        wroteCurrent,
+        spec,
+        keptPolicyKeys: [
+            ...entry.policy.map((p) => p.key),
+            ...entry.toolSections.map((t) => t.keySegments.slice(2).join(".")),
+        ],
+    });
+    const backupId = preexisting ? makeBackupId(opts.client, now) : null;
+    const backupPath = preexisting ? `${absolute}.bak.${backupId}` : null;
+    if (!opts.dryRun) {
+        if (preexisting && backupPath) {
+            fs.writeFileSync(backupPath, raw, { encoding: "utf8", mode: 0o600 });
+        }
+        else {
+            fs.mkdirSync(path.dirname(absolute), { recursive: true });
+        }
+        const tmp = `${absolute}.tmp.${process.pid}`;
+        // A config the person keeps private stays private.
+        const mode = preexisting ? fs.statSync(absolute).mode & 0o777 : 0o644;
+        try {
+            fs.writeFileSync(tmp, merged, { encoding: "utf8", mode });
+            fs.chmodSync(tmp, mode);
+            fs.renameSync(tmp, absolute);
+        }
+        catch (err) {
+            try {
+                if (fs.existsSync(tmp))
+                    fs.unlinkSync(tmp);
+            }
+            catch {
+                // ignore
+            }
+            if (preexisting && backupPath && fs.existsSync(backupPath)) {
+                try {
+                    fs.copyFileSync(backupPath, absolute);
+                }
+                catch {
+                    // best effort — operator-side recovery uses the backup file directly.
+                }
+            }
+            throw err;
+        }
+    }
+    return {
+        configPath: absolute,
+        preexisting,
+        backedUp: preexisting,
+        backupId,
+        backupPath,
+        legacyRemovedCount: removedNames.length,
+        redactedDiff,
+        dryRun: opts.dryRun,
+        ...(opts.dryRun ? { wouldWrite: merged } : {}),
+        ...(renamedFromEarlier ? { renamedFromEarlier: true } : {}),
+        ...(keptEarlierNames ? { keptEarlierNames: true } : {}),
+    };
+}
+function failParse(opts, absolute, raw, now, cause) {
+    const id = makeBackupId(opts.client, now);
+    // A refresh runs on every upgrade and has changed nothing: no backup.
+    if (!opts.dryRun && !opts.existingOnly) {
+        try {
+            fs.mkdirSync(path.dirname(absolute), { recursive: true });
+            fs.writeFileSync(`${absolute}.bak.${id}`, raw, {
+                encoding: "utf8",
+                mode: 0o600,
+            });
+        }
+        catch {
+            // best-effort; the operator-side recovery flow handles missing backups.
+        }
+    }
+    return new ParseFailedError(opts.client, id, cause);
+}
+function parseTomlSections(raw) {
+    if (raw === "")
+        return { preamble: [], sections: [] };
+    // Preserve the original line-ending style by splitting on \n only.
+    const lines = raw.split("\n");
+    const trailingNewline = raw.endsWith("\n");
+    if (trailingNewline)
+        lines.pop();
+    const preamble = [];
+    const sections = [];
+    let current = null;
+    for (const line of lines) {
+        const arrayMatch = line.match(ARRAY_TABLE_RE);
+        const sectionMatch = arrayMatch ? null : line.match(SECTION_RE);
+        if (arrayMatch || sectionMatch) {
+            const rawKey = (arrayMatch?.[1] ?? sectionMatch?.[1] ?? "").trim();
+            const segments = normalizeTableKey(rawKey);
+            if (!segments) {
+                throw new MalformedTomlError("malformed table header");
+            }
+            if (current)
+                sections.push(current);
+            current = {
+                headerLine: line,
+                keySegments: segments,
+                arrayTable: !!arrayMatch,
+                bodyLines: [],
+            };
+            continue;
+        }
+        // Any line that begins with `[` but didn't match a header is
+        // structurally suspect — fail closed rather than silently shoving
+        // it into a body. Pure comments / blank lines / `key = value`
+        // lines are fine.
+        if (LEADING_BRACKET_RE.test(line)) {
+            throw new MalformedTomlError("bracketed line is not a valid table header");
+        }
+        if (current) {
+            current.bodyLines.push(line);
+        }
+        else {
+            preamble.push(line);
+        }
+    }
+    if (current)
+        sections.push(current);
+    return { preamble, sections };
+}
+function isTomlTrivia(line) {
+    return /^\s*(?:#.*)?$/.test(line);
+}
+function trimTrailingTrivia(lines) {
+    let end = lines.length;
+    while (end > 0 && /^\s*$/.test(lines[end - 1]))
+        end--;
+    return lines.slice(0, end);
+}
+/**
+ * Pull the allowlisted policy entries out of a `[mcp_servers.onadit]` body.
+ * An entry spans continuation lines while its brackets/braces are open, so a
+ * multi-line `enabled_tools = [ ... ]` is kept (or dropped) as a unit.
+ */
+function extractPolicyEntries(body) {
+    return bodyEntries(body).filter((entry) => RIFT_POLICY_KEYS.has(entry.key));
+}
+/** Every `key = value` entry of a table body, with its continuation lines. */
+function bodyEntries(body) {
+    const entries = [];
+    let i = 0;
+    while (i < body.length) {
+        const first = body[i];
+        const key = entryKey(first);
+        if (!key) {
+            i++;
+            continue;
+        }
+        const start = i;
+        const entry = [first];
+        let depth = bracketDepth(first.slice(key.valueStart));
+        i++;
+        while (depth > 0 && i < body.length) {
+            entry.push(body[i]);
+            depth += bracketDepth(body[i]);
+            i++;
+        }
+        entries.push({ key: key.segments[0], segments: key.segments, lines: entry, start });
+    }
+    return entries;
+}
+/**
+ * What a refresh does to a parent table's body: each argument that names one
+ * of the server's entry files is pointed at the same file in this install's
+ * folder. Nothing else changes, so the names it serves, the command that
+ * launches it (a wrapper, node with flags) and every other line stay as the
+ * person has them. A table with no such argument comes back as it is.
+ */
+function repointEntryFiles(body, installDir) {
+    const args = bodyEntries(body).find((entry) => entry.segments.length === 1 && entry.key === "args");
+    if (!args)
+        return body;
+    const value = [args.lines[0].slice(entryKey(args.lines[0]).valueStart), ...args.lines.slice(1)].join("\n");
+    const strings = tomlStrings(value);
+    // Whether one of them is an entry file cannot be told.
+    if (strings === null)
+        throw new MalformedTomlError("args are written in a form this writer cannot read");
+    const next = strings.map((arg) => (isMcpEntryFile(arg) ? path.join(installDir, path.basename(arg)) : arg));
+    if (next.every((arg, i) => arg === strings[i]))
+        return body;
+    return [
+        ...body.slice(0, args.start),
+        `args = [${next.map(quoteTomlString).join(", ")}]`,
+        ...body.slice(args.start + args.lines.length),
+    ];
+}
+/**
+ * A parent table's body pointed at this install: `command` and the first
+ * element of `args` change; the config path the table already carries, any
+ * further arguments, and every other line stay as they are. A table that
+ * launches nothing (no `command`, no `args`) is returned unchanged.
+ */
+function repointBody(body, spec, entryFile) {
+    const entries = bodyEntries(body).filter((entry) => entry.segments.length === 1);
+    const command = entries.find((entry) => entry.key === "command");
+    const args = entries.find((entry) => entry.key === "args");
+    if (!command && !args)
+        return body;
+    let rest = spec.args.slice(1);
+    if (args) {
+        const value = [args.lines[0].slice(entryKey(args.lines[0]).valueStart), ...args.lines.slice(1)].join("\n");
+        const strings = tomlStrings(value);
+        // The config path must not be replaced by a guess.
+        if (strings === null)
+            throw new MalformedTomlError("args are written in a form this writer cannot read");
+        if (strings.length > 1)
+            rest = strings.slice(1);
+    }
+    const commandLine = `command = ${quoteTomlString(spec.command)}`;
+    const argsLine = `args = [${[entryFile, ...rest].map(quoteTomlString).join(", ")}]`;
+    const out = [];
+    for (let i = 0; i < body.length; i++) {
+        if (command && i === command.start) {
+            out.push(commandLine, ...(args ? [] : [argsLine]));
+            i += command.lines.length - 1;
+        }
+        else if (args && i === args.start) {
+            out.push(...(command ? [] : [commandLine]), argsLine);
+            i += args.lines.length - 1;
+        }
+        else {
+            out.push(body[i]);
+        }
+    }
+    return out;
+}
+/** The file as parsed, written back: unchanged sections come out byte for byte. */
+function renderSections(preamble, sections, raw) {
+    const lines = [...preamble];
+    for (const section of sections)
+        lines.push(section.headerLine, ...section.bodyLines);
+    return lines.join("\n") + (raw.endsWith("\n") && lines.length > 0 ? "\n" : "");
+}
+function emptyEntry() {
+    return { seen: false, policy: [], toolSections: [], configArg: undefined, argsUnreadable: false };
+}
+function isOwnServerName(name) {
+    return name === SERVER_NAME || name === PREVIOUS_SERVER_NAME || isLegacyServerName(name);
+}
+/**
+ * True when a table body defines one of this product's servers without a
+ * table of its own: `rift = { … }` or `rift.command = …` under `[mcp_servers]`,
+ * `mcp_servers.rift.command = …` at the top of the file, or the whole
+ * `mcp_servers` as one inline table.
+ */
+function definesOwnServerInline(body, tablePath) {
+    return bodyEntries(body).some((entry) => {
+        const segments = [...tablePath, ...entry.segments];
+        if (segments[0] !== MCP_SERVERS)
+            return false;
+        return segments.length === 1 || isOwnServerName(segments[1]);
+    });
+}
+/**
+ * The second element of the section's `args`, which is the config path the
+ * server was installed with. Undefined when the section has no `args` or no
+ * second element; null when `args` is there in a form this reader does not
+ * handle, so the caller can stop instead of guessing.
+ */
+function readConfigArg(body) {
+    const args = bodyEntries(body).find((entry) => entry.key === "args");
+    if (!args)
+        return undefined;
+    // Only the value: a key written with quotes ("args" = [...]) is not an argument.
+    const value = [args.lines[0].slice(entryKey(args.lines[0]).valueStart), ...args.lines.slice(1)].join("\n");
+    const strings = tomlStrings(value);
+    return strings === null ? null : strings[1];
+}
+const MULTI_LINE_QUOTES = ['"'.repeat(3), "'".repeat(3)];
+/**
+ * The strings in a TOML value, in order and decoded: basic ("…", with
+ * escapes) and literal ('…'). Comments are skipped. Null for multi-line
+ * strings and invalid escapes, which this reader does not handle.
+ */
+function tomlStrings(value) {
+    if (MULTI_LINE_QUOTES.some((quotes) => value.includes(quotes)))
+        return null;
+    const strings = [];
+    let i = 0;
+    while (i < value.length) {
+        const c = value[i];
+        if (c === "#") {
+            while (i < value.length && value[i] !== "\n")
+                i++;
+        }
+        else if (c === "'") {
+            const end = value.indexOf("'", i + 1);
+            if (end < 0)
+                return null;
+            strings.push(value.slice(i + 1, end));
+            i = end + 1;
+        }
+        else if (c === '"') {
+            let end = i + 1;
+            while (end < value.length && value[end] !== '"')
+                end += value[end] === "\\" ? 2 : 1;
+            if (end >= value.length)
+                return null;
+            const decoded = decodeBasicString(value.slice(i + 1, end));
+            if (decoded === null)
+                return null;
+            strings.push(decoded);
+            i = end + 1;
+        }
+        else {
+            i++;
+        }
+    }
+    return strings;
+}
+const BASIC_ESCAPES = { '"': '"', "\\": "\\", b: "\b", t: "\t", n: "\n", f: "\f", r: "\r" };
+/** The value of a TOML basic string's body, or null on an escape TOML does not define. */
+function decodeBasicString(body) {
+    let out = "";
+    for (let i = 0; i < body.length; i++) {
+        if (body[i] !== "\\") {
+            out += body[i];
+            continue;
+        }
+        const esc = body[++i];
+        if (esc !== undefined && esc in BASIC_ESCAPES) {
+            out += BASIC_ESCAPES[esc];
+        }
+        else if (esc === "u" || esc === "U") {
+            const length = esc === "u" ? 4 : 8;
+            const hex = body.slice(i + 1, i + 1 + length);
+            if (!new RegExp(`^[0-9A-Fa-f]{${length}}$`).test(hex))
+                return null;
+            const code = parseInt(hex, 16);
+            if (code > 0x10ffff || (code >= 0xd800 && code <= 0xdfff))
+                return null;
+            out += String.fromCodePoint(code);
+            i += length;
+        }
+        else {
+            return null;
+        }
+    }
+    return out;
+}
+/**
+ * An entry written under the server's earlier name, as it reads under the
+ * current one. Tool names are renamed in the text. That is exact only while
+ * the text is what TOML reads: an escape sequence ("\u0072ift_search") spells
+ * a name the rename cannot see, and the restriction it expressed would stop
+ * applying. So anything that names tools and contains a backslash stops the
+ * write.
+ */
+function renamedToCurrent(entry) {
+    const namesTools = [
+        ...entry.policy.filter((p) => TOOL_NAMING_KEYS.has(p.key)).flatMap((p) => p.lines),
+        ...entry.toolSections.flatMap((section) => [section.headerLine, ...section.bodyLines]),
+    ];
+    if (namesTools.some((line) => line.includes("\\"))) {
+        throw new MalformedTomlError("tool names written with escape sequences are not supported");
+    }
+    return {
+        ...entry,
+        policy: entry.policy.map((p) => TOOL_NAMING_KEYS.has(p.key) ? { ...p, lines: p.lines.map(renamePreviousToolNames) } : p),
+        toolSections: entry.toolSections.map((section) => {
+            const keySegments = [MCP_SERVERS, SERVER_NAME, ...section.keySegments.slice(2).map(renamePreviousToolNames)];
+            return {
+                ...section,
+                keySegments,
+                headerLine: `[${keySegments.map(tomlKey).join(".")}]`,
+                // A `[mcp_servers.<name>.tools]` table keys its entries by tool name.
+                bodyLines: section.bodyLines.map(renamePreviousToolNames),
+            };
+        }),
+    };
+}
+function tomlKey(segment) {
+    return /^[A-Za-z0-9_-]+$/.test(segment) ? segment : quoteTomlString(segment);
+}
+function skipped(configPath, preexisting, dryRun) {
+    return {
+        configPath,
+        preexisting,
+        backedUp: false,
+        backupId: null,
+        backupPath: null,
+        legacyRemovedCount: 0,
+        redactedDiff: "",
+        dryRun,
+        skipped: true,
+    };
+}
+/**
+ * The key of a `key = value` line — bare, "quoted", 'literal' or dotted —
+ * and where its value starts. Null for comments, blanks and continuations.
+ */
+function entryKey(line) {
+    let quote = null;
+    for (let i = 0; i < line.length; i++) {
+        const c = line[i];
+        if (quote) {
+            if (c === "\\" && quote === '"')
+                i++;
+            else if (c === quote)
+                quote = null;
+            continue;
+        }
+        if (c === '"' || c === "'")
+            quote = c;
+        else if (c === "#")
+            return null;
+        else if (c === "=") {
+            const segments = normalizeTableKey(line.slice(0, i));
+            return segments ? { segments, valueStart: i + 1 } : null;
+        }
+    }
+    return null;
+}
+/** Net `[`/`{` minus `]`/`}` outside strings and comments. */
+function bracketDepth(text) {
+    let depth = 0;
+    let quote = null;
+    for (let i = 0; i < text.length; i++) {
+        const c = text[i];
+        if (quote) {
+            if (c === "\\" && quote === '"')
+                i++;
+            else if (c === quote)
+                quote = null;
+            continue;
+        }
+        if (c === "#")
+            break;
+        if (c === '"' || c === "'")
+            quote = c;
+        else if (c === "[" || c === "{")
+            depth++;
+        else if (c === "]" || c === "}")
+            depth--;
+    }
+    return depth;
+}
+/** Remove only owned tables, keeping unrelated text and standalone comments. */
+export function stripRiftTomlSections(raw) {
+    let parsed;
+    try {
+        parsed = parseTomlSections(raw);
+    }
+    catch (err) {
+        if (err instanceof MalformedTomlError)
+            return null;
+        throw err;
+    }
+    const lines = [...parsed.preamble];
+    let changed = false;
+    for (const section of parsed.sections) {
+        const [root, name] = section.keySegments;
+        const owned = root === MCP_SERVERS && name !== undefined
+            && (name === SERVER_NAME || name === PREVIOUS_SERVER_NAME || isLegacyServerName(name));
+        if (owned) {
+            if (section.arrayTable)
+                return null;
+            changed = true;
+            lines.push(...section.bodyLines.filter(isTomlTrivia));
+        }
+        else {
+            lines.push(section.headerLine, ...section.bodyLines);
+        }
+    }
+    if (!changed)
+        return raw;
+    return lines.join("\n") + (raw.endsWith("\n") && lines.length > 0 ? "\n" : "");
+}
+/**
+ * Parse a TOML table key into its dotted segments, with quoted forms
+ * unquoted. Returns null on malformed input.
+ *
+ * Accepts:
+ *   - bare keys (chars `A-Za-z0-9_-`)
+ *   - basic-quoted keys (`"..."` with `\"` and `\\` escapes)
+ *   - literal-quoted keys (`'...'`, no escape processing)
+ *   - dotted keys with arbitrary whitespace around the dots
+ */
+function normalizeTableKey(raw) {
+    const trimmed = raw.trim();
+    if (trimmed === "")
+        return null;
+    const segments = [];
+    let i = 0;
+    const n = trimmed.length;
+    let expectKey = true;
+    while (i < n) {
+        while (i < n && (trimmed[i] === " " || trimmed[i] === "\t"))
+            i++;
+        if (i >= n) {
+            if (expectKey)
+                return null; // trailing dot
+            break;
+        }
+        if (!expectKey) {
+            if (trimmed[i] === ".") {
+                i++;
+                expectKey = true;
+                continue;
+            }
+            return null;
+        }
+        const ch = trimmed[i];
+        let segment = "";
+        if (ch === '"') {
+            i++;
+            let closed = false;
+            while (i < n) {
+                const c = trimmed[i];
+                if (c === "\\") {
+                    if (i + 1 >= n)
+                        return null; // trailing backslash, no escape char
+                    const esc = trimmed[i + 1];
+                    switch (esc) {
+                        case '"':
+                            segment += '"';
+                            i += 2;
+                            break;
+                        case "\\":
+                            segment += "\\";
+                            i += 2;
+                            break;
+                        case "b":
+                            segment += "\b";
+                            i += 2;
+                            break;
+                        case "t":
+                            segment += "\t";
+                            i += 2;
+                            break;
+                        case "n":
+                            segment += "\n";
+                            i += 2;
+                            break;
+                        case "f":
+                            segment += "\f";
+                            i += 2;
+                            break;
+                        case "r":
+                            segment += "\r";
+                            i += 2;
+                            break;
+                        case "u": {
+                            if (i + 6 > n)
+                                return null;
+                            const hex = trimmed.slice(i + 2, i + 6);
+                            if (!/^[0-9A-Fa-f]{4}$/.test(hex))
+                                return null;
+                            const code = parseInt(hex, 16);
+                            if (code >= 0xd800 && code <= 0xdfff)
+                                return null;
+                            segment += String.fromCodePoint(code);
+                            i += 6;
+                            break;
+                        }
+                        case "U": {
+                            if (i + 10 > n)
+                                return null;
+                            const hex = trimmed.slice(i + 2, i + 10);
+                            if (!/^[0-9A-Fa-f]{8}$/.test(hex))
+                                return null;
+                            const code = parseInt(hex, 16);
+                            if (code > 0x10ffff)
+                                return null;
+                            if (code >= 0xd800 && code <= 0xdfff)
+                                return null;
+                            segment += String.fromCodePoint(code);
+                            i += 10;
+                            break;
+                        }
+                        default:
+                            return null; // invalid escape (e.g. \q)
+                    }
+                    continue;
+                }
+                if (c === '"') {
+                    closed = true;
+                    i++;
+                    break;
+                }
+                // Reject control characters (other than tab) inside a basic
+                // string — matches TOML spec for in-line table keys.
+                const code = c.charCodeAt(0);
+                if ((code < 0x20 && code !== 0x09) || code === 0x7f)
+                    return null;
+                segment += c;
+                i++;
+            }
+            if (!closed)
+                return null;
+        }
+        else if (ch === "'") {
+            i++;
+            let closed = false;
+            while (i < n) {
+                const c = trimmed[i];
+                if (c === "'") {
+                    closed = true;
+                    i++;
+                    break;
+                }
+                segment += c;
+                i++;
+            }
+            if (!closed)
+                return null;
+        }
+        else if (/[A-Za-z0-9_-]/.test(ch)) {
+            while (i < n && /[A-Za-z0-9_-]/.test(trimmed[i])) {
+                segment += trimmed[i];
+                i++;
+            }
+        }
+        else {
+            return null;
+        }
+        if (segment === "")
+            return null;
+        segments.push(segment);
+        expectKey = false;
+    }
+    if (expectKey)
+        return null; // trailing dot
+    return segments;
+}
+function renderToml(preamble, sections, riftBlock) {
+    const parts = [];
+    if (preamble.length > 0)
+        parts.push(preamble.join("\n"));
+    for (const s of sections) {
+        parts.push([s.headerLine, ...s.bodyLines].join("\n"));
+    }
+    const kept = parts.join("\n");
+    return kept + (kept && !kept.endsWith("\n") ? "\n\n" : "") + riftBlock + "\n";
+}
+function renderRiftSection(spec) {
+    const argsToml = spec.args.map(quoteTomlString).join(", ");
+    return [
+        `[mcp_servers.${SERVER_NAME}]`,
+        `command = ${quoteTomlString(spec.command)}`,
+        `args = [${argsToml}]`,
+    ].join("\n");
+}
+function quoteTomlString(s) {
+    return `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function renderRedactedDiff(opts) {
+    const lines = [];
+    for (const name of opts.removedNames) {
+        lines.push(`- [mcp_servers.${redactForbidden(name)}] (removed)`);
+    }
+    if (opts.renamedFromPrevious) {
+        lines.push(`- [mcp_servers.${PREVIOUS_SERVER_NAME}] (renamed to ${SERVER_NAME})`);
+    }
+    if (opts.keptEarlierNames) {
+        lines.push(`~ [mcp_servers.${PREVIOUS_SERVER_NAME}] (kept under its earlier name, pointed at this install)`);
+    }
+    // The command and arguments are those of the section under the current name;
+    // a connection kept under its earlier name launches a different entry file.
+    if (opts.wroteCurrent) {
+        lines.push(opts.rewroteRift
+            ? `~ [mcp_servers.${SERVER_NAME}] (updated)`
+            : `+ [mcp_servers.${SERVER_NAME}] (added)`);
+        lines.push(`  command = "${redactForbidden(opts.spec.command)}"`);
+        lines.push(`  args = [${opts.spec.args
+            .map((a) => `"${redactForbidden(a)}"`)
+            .join(", ")}]`);
+    }
+    if (opts.keptPolicyKeys.length > 0) {
+        lines.push(`  kept your settings: ${[...new Set(opts.keptPolicyKeys)].map(redactForbidden).join(", ")}`);
+    }
+    return lines.join("\n");
+}
+function makeBackupId(client, now) {
+    return `rift-mcp-${client}-${formatBackupTimestamp(now())}`;
+}
+function formatBackupTimestamp(d) {
+    return d.toISOString().replace(/\.\d{3}Z$/, "Z").replace(/:/g, "-");
+}
+function defaultNow() {
+    return new Date();
+}
+//# sourceMappingURL=codex-toml.js.map