open-multi-agent-kit 0.78.6 → 0.78.7

package/dist/commands/init/content.js

@@ -363,23 +363,15 @@ OMK is the root orchestrator. Kimi is an authority-capable compatibility provide
 
 ## v1.2 — Hardening the current surface
 
-### P0: native runtime safety hardening
-
-- Remaining: native chat turn capabilities must be intent-based: read-only by default, write only for edits, shell only for explicit command/build/test work, merge only for merge/release operations.
-- Remaining: \`--execution ask|auto|never\` and sandbox mode must propagate into runtime adapter metadata; provider adapters must not silently collapse ask into never.
-- Remaining: \`authority\`, \`primary\`, and \`omk\` provider policy must resolve to a concrete provider before bootstrap/router execution.
-- Remaining: CLI provider bootstrap must distinguish runtime/binary availability from auth/model/quota readiness.
-- Remaining: MCP, skills, hooks, and tool-plane parse or resolution failures must surface as diagnostics; runtime-required MCP failures should hard fail.
-
 ### P0: release and contract gates
 
 - Done: YAML validation now runs in local \`verify\` plus CI/smoke workflows.
-- Done: package dry-pack, package audit, tarball smoke, native safety build, and release matrix gates were re-verified against v1.1.17 artifacts.
+- Done: package dry-pack, package audit, tarball smoke, and release matrix gates were re-verified against v1.1.17 artifacts.
 - Done: provider/deepseek and screenshot JSON command contracts gained hermetic regression tests.
 - Done: current AGENTS/init templates and packaged workflow skills were aligned with the active skills/MCP/agents/harness surface, including all generated agent MCP/skills/hooks flags and parallel subagent orchestration guidance.
 - Remaining: lock broader provider fallback metadata with tests for rate limit, timeout, and authority fallback variants.
 - Remaining: define minimum machine-readable CLI envelopes for the rest of the automation-critical commands.
-- Remaining: release/tag only after local gates, native safety packaging, package audit, smoke-pack, tarball install smoke, GitHub Smoke Test, and GitHub CI pass on the exact target commit.
+- Remaining: release/tag only after local gates, package audit, smoke-pack, tarball install smoke, GitHub Smoke Test, and GitHub CI pass on the exact target commit.
 
 ### P1: observability and diagnostics
 
@@ -419,7 +411,7 @@ OMK is the root orchestrator. Kimi is an authority-capable compatibility provide
 | v0.4 | Google DESIGN.md integration, Stitch skills installer, screenshot UI review, Spec Kit planning + DAG execution, agent registry, project index, run summary |
 | v0.5 | MCP project server, plugin pack, CI agent mode |
 | v1.1.6 | provider/deepseek commands, provider policy flags, graph view, goal lifecycle, expanded run history and update JSON |
-| v1.1.9 | chat harness manifest, capability DAG lanes, Rust native safety loader, Windows clipboard screenshot bridge, release native matrix |
+| v1.1.9 | chat harness manifest, capability DAG lanes, Windows clipboard screenshot bridge, release matrix |
 | v1.1.12 | Replay system, skill assigner, decision trace coverage, evidence gates, and repair policy |
 | v1.1.13 | Bundled MCP server entrypoints, ACP/host transport groundwork, deployment-ready package metadata |
 | v1.1.14 | Current harness docs, external-inspired workflow skills, and release-safe public wording |

package/dist/commands/init.js

@@ -410,7 +410,7 @@ Provider routing and graph viewing are no longer purely future work:
 ### P0: release and contract gates
 
 - Done: YAML validation now runs in local \`verify\` plus CI/smoke workflows.
-- Done: package dry-pack, package audit, tarball smoke, native safety build, and release matrix gates were re-verified against v1.1.17 artifacts.
+- Done: package dry-pack, package audit, tarball smoke, and release matrix gates were re-verified against v1.1.17 artifacts.
 - Done: provider/deepseek and screenshot JSON command contracts gained hermetic regression tests.
 - Done: current AGENTS/init templates and packaged workflow skills were aligned with the active skills/MCP/agents/harness surface, including all generated agent MCP/skills/hooks flags and parallel subagent orchestration guidance.
 - Remaining: lock broader provider fallback metadata with tests for rate limit, timeout, and Kimi fallback variants.
@@ -454,7 +454,7 @@ Provider routing and graph viewing are no longer purely future work:
 | v0.4 | Google DESIGN.md integration, Stitch skills installer, screenshot UI review, Spec Kit planning + DAG execution, agent registry, project index, run summary |
 | v0.5 | MCP project server, plugin pack, CI agent mode |
 | v1.1.6 | provider/deepseek commands, provider policy flags, graph view, goal lifecycle, expanded run history and update JSON |
-| v1.1.9 | chat harness manifest, capability DAG lanes, Rust native safety loader, Windows clipboard screenshot bridge, release native matrix |
+| v1.1.9 | chat harness manifest, capability DAG lanes, Windows clipboard screenshot bridge, release matrix |
 | v1.1.12 | Replay system, skill assigner, decision trace coverage, evidence gates, and repair policy |
 | v1.1.13 | Bundled MCP server entrypoints, ACP/host transport groundwork, deployment-ready package metadata |
 | v1.1.14 | Current harness docs, external-inspired workflow skills, and release-safe public wording |

package/dist/commands/mcp/config.d.ts

@@ -0,0 +1,32 @@
+export declare function mcpRemoveCommand(serverName: string, options?: {
+    global?: boolean;
+}): Promise<void>;
+export declare function mcpAddCommand(serverName: string): Promise<void>;
+export declare function mcpInstallCommand(name: string, command: string, args: string[], options?: {
+    env?: string[];
+    startupTimeoutSec?: number;
+}): Promise<void>;
+export interface BulkInstallEntry {
+    name: string;
+    command: string;
+    args: string[];
+    env?: string[] | Record<string, string>;
+    startupTimeoutSec?: number;
+}
+export interface BulkInstallResult {
+    installed: string[];
+    failed: Array<{
+        name: string;
+        error: string;
+    }>;
+    skipped: string[];
+}
+export declare function mcpBulkInstallCommand(entries: BulkInstallEntry[]): Promise<BulkInstallResult>;
+export declare function mcpSyncGlobalCommand(options: {
+    overwrite?: boolean;
+    omk?: boolean;
+}): Promise<void>;
+export declare function mcpMigrateCommand(options?: {
+    global?: boolean;
+    dryRun?: boolean;
+}): Promise<void>;

package/dist/commands/mcp/config.js

@@ -0,0 +1,264 @@
+import { mkdir, writeFile } from "fs/promises";
+import { join } from "path";
+import { getProjectRoot, pathExists, getUserHome, STALE_PACKAGE_NAMES, } from "../../util/fs.js";
+import { style, header, status, label } from "../../util/theme.js";
+import { maskSensitiveText } from "../../util/secret-mask.js";
+import { formatArgsForDisplay, isHttpUrl, isSecretEnvName, loadConfig, RAILWAY_REMOTE_MCP_URL, sanitizeMcpServerForProject, sanitizeMcpUrlForDisplay, } from "./shared.js";
+export async function mcpRemoveCommand(serverName, options = {}) {
+    const root = getProjectRoot();
+    const localPath = join(root, ".kimi", "mcp.json");
+    const omkPath = join(root, ".omk", "mcp.json");
+    const globalPath = join(getUserHome(), ".kimi", "mcp.json");
+    const sources = options.global
+        ? [{ path: globalPath, label: "global" }]
+        : [
+            { path: localPath, label: "project-local" },
+            { path: omkPath, label: "omk-project" },
+        ];
+    let removed = false;
+    for (const src of sources) {
+        const cfg = await loadConfig(src.path);
+        if (!cfg.parsed || !cfg.config.mcpServers || !(serverName in cfg.config.mcpServers)) {
+            continue;
+        }
+        const next = { ...cfg.config.mcpServers };
+        delete next[serverName];
+        await writeFile(src.path, JSON.stringify({ mcpServers: next }, null, 2) + "\n", "utf-8");
+        console.log(status.ok(`Removed "${serverName}" from ${src.label} MCP config: ${src.path}`));
+        removed = true;
+        break;
+    }
+    if (!removed) {
+        console.log(status.error(`Server "${serverName}" not found in ${options.global ? "global" : "project-local"} MCP configs.`));
+        console.log(style.gray(`Checked: ${sources.map((s) => s.path).join(", ")}`));
+        if (!options.global) {
+            console.log(style.gray(`To remove from global config, run \`omk mcp remove ${serverName} --global\`, or edit ~/.kimi/mcp.json manually.`));
+        }
+        else {
+            console.log(style.gray(`To remove from project-local configs, run \`omk mcp remove ${serverName}\`.`));
+        }
+        process.exit(1);
+    }
+}
+export async function mcpAddCommand(serverName) {
+    const root = getProjectRoot();
+    const globalPath = join(getUserHome(), ".kimi", "mcp.json");
+    const projectMcpPath = join(root, ".kimi", "mcp.json");
+    const globalSource = await loadConfig(globalPath);
+    if (!globalSource.parsed || !globalSource.config.mcpServers || !(serverName in globalSource.config.mcpServers)) {
+        console.log(status.error(`Server "${serverName}" not found in global MCP config: ${globalPath}`));
+        process.exit(1);
+    }
+    const projectMcpSource = await loadConfig(projectMcpPath);
+    const projectMcpServers = projectMcpSource.parsed && projectMcpSource.config.mcpServers
+        ? { ...projectMcpSource.config.mcpServers }
+        : {};
+    if (serverName in projectMcpServers) {
+        console.log(status.error(`Server "${serverName}" already exists in ${projectMcpPath}`));
+        process.exit(1);
+    }
+    projectMcpServers[serverName] = sanitizeMcpServerForProject(globalSource.config.mcpServers[serverName]);
+    await mkdir(join(root, ".kimi"), { recursive: true });
+    await writeFile(projectMcpPath, JSON.stringify({ mcpServers: projectMcpServers }, null, 2) + "\n", "utf-8");
+    console.log(header("MCP Add"));
+    console.log(status.ok(`Added "${serverName}" to ${projectMcpPath}`));
+}
+export async function mcpInstallCommand(name, command, args, options = {}) {
+    const root = getProjectRoot();
+    const projectMcpPath = join(root, ".kimi", "mcp.json");
+    const projectMcpSource = await loadConfig(projectMcpPath);
+    const projectMcpServers = projectMcpSource.parsed && projectMcpSource.config.mcpServers
+        ? { ...projectMcpSource.config.mcpServers }
+        : {};
+    if (name in projectMcpServers) {
+        console.log(status.error(`Server "${name}" already exists in ${projectMcpPath}`));
+        process.exit(1);
+    }
+    const server = sanitizeMcpServerForProject(createInstallServer(name, command, args, options));
+    projectMcpServers[name] = server;
+    await mkdir(join(root, ".kimi"), { recursive: true });
+    await writeFile(projectMcpPath, JSON.stringify({ mcpServers: projectMcpServers }, null, 2) + "\n", "utf-8");
+    console.log(header("MCP Install"));
+    console.log(status.ok(`Installed "${name}" into ${projectMcpPath}`));
+    if (server.url) {
+        console.log(label("URL", sanitizeMcpUrlForDisplay(server.url)));
+    }
+    else {
+        console.log(label("Command", maskSensitiveText(server.command ?? command)));
+        if (args.length > 0)
+            console.log(label("Args", formatArgsForDisplay(server.args ?? args)));
+    }
+}
+function createInstallServer(name, command, args, options = {}) {
+    if (isRailwayInstallPreset(name, command, args, options)) {
+        return { url: RAILWAY_REMOTE_MCP_URL };
+    }
+    if (isHttpUrl(command) && args.length === 0) {
+        return { url: sanitizeMcpUrlForDisplay(command) };
+    }
+    const server = { command, args: [...args] };
+    if (options.env) {
+        server.env = {};
+        if (Array.isArray(options.env)) {
+            for (const pair of options.env) {
+                const idx = pair.indexOf("=");
+                if (idx > 0) {
+                    const key = pair.slice(0, idx);
+                    server.env[key] = sanitizeInstallEnvValue(key, pair.slice(idx + 1));
+                }
+            }
+        }
+        else {
+            for (const [key, value] of Object.entries(options.env)) {
+                server.env[key] = sanitizeInstallEnvValue(key, value);
+            }
+        }
+    }
+    if (Number.isFinite(options.startupTimeoutSec) && options.startupTimeoutSec && options.startupTimeoutSec > 0) {
+        server.startup_timeout_sec = Math.trunc(options.startupTimeoutSec);
+    }
+    return server;
+}
+function sanitizeInstallEnvValue(key, value) {
+    if (!isSecretEnvName(key))
+        return value;
+    const trimmed = value.trim();
+    if (/^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/.test(trimmed))
+        return trimmed;
+    return `\${${key}}`;
+}
+function isRailwayInstallPreset(name, command, args, options) {
+    return name.toLowerCase() === "railway"
+        && command === "railway"
+        && args.length === 0
+        && (!options.env || options.env.length === 0);
+}
+export async function mcpBulkInstallCommand(entries) {
+    const root = getProjectRoot();
+    const projectMcpPath = join(root, ".kimi", "mcp.json");
+    const projectMcpSource = await loadConfig(projectMcpPath);
+    const projectMcpServers = projectMcpSource.parsed && projectMcpSource.config.mcpServers
+        ? { ...projectMcpSource.config.mcpServers }
+        : {};
+    const results = { installed: [], failed: [], skipped: [] };
+    await Promise.all(entries.map(async (entry) => {
+        try {
+            if (entry.name in projectMcpServers) {
+                results.skipped.push(entry.name);
+                return;
+            }
+            const server = sanitizeMcpServerForProject(createInstallServer(entry.name, entry.command, entry.args, {
+                env: entry.env,
+                startupTimeoutSec: entry.startupTimeoutSec,
+            }));
+            projectMcpServers[entry.name] = server;
+            results.installed.push(entry.name);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            results.failed.push({ name: entry.name, error: message });
+        }
+    }));
+    if (results.installed.length > 0 || results.skipped.length > 0) {
+        await mkdir(join(root, ".kimi"), { recursive: true });
+        await writeFile(projectMcpPath, JSON.stringify({ mcpServers: projectMcpServers }, null, 2) + "\n", "utf-8");
+    }
+    return results;
+}
+export async function mcpSyncGlobalCommand(options) {
+    const root = getProjectRoot();
+    const globalPath = join(getUserHome(), ".kimi", "mcp.json");
+    const targetPath = options.omk ? join(root, ".omk", "mcp.json") : join(root, ".kimi", "mcp.json");
+    const globalSource = await loadConfig(globalPath);
+    if (!globalSource.parsed || !globalSource.config.mcpServers) {
+        console.log(status.error(`No global MCP config found at ${globalPath}`));
+        process.exit(1);
+    }
+    const targetSource = await loadConfig(targetPath);
+    const targetServers = targetSource.parsed && targetSource.config.mcpServers ? targetSource.config.mcpServers : {};
+    let imported = 0;
+    let skipped = 0;
+    const merged = options.overwrite ? {} : { ...targetServers };
+    for (const [name, server] of Object.entries(globalSource.config.mcpServers)) {
+        if (name === "omk-project") {
+            skipped++;
+            continue;
+        }
+        if (!options.overwrite && name in merged) {
+            skipped++;
+            continue;
+        }
+        merged[name] = sanitizeMcpServerForProject(server);
+        imported++;
+    }
+    const output = { mcpServers: merged };
+    await writeFile(targetPath, JSON.stringify(output, null, 2) + "\n", "utf-8");
+    console.log(header("MCP Sync Global"));
+    console.log(status.ok(`Imported ${imported} global MCP server(s)`));
+    if (skipped > 0) {
+        console.log(style.gray(`Skipped ${skipped} (omk-project or existing local)`));
+    }
+    console.log(label("Written to", targetPath));
+}
+export async function mcpMigrateCommand(options = {}) {
+    const root = getProjectRoot();
+    const globalPath = join(getUserHome(), ".kimi", "mcp.json");
+    const projectPath = join(root, ".kimi", "mcp.json");
+    const omkPath = join(root, ".omk", "mcp.json");
+    const configs = [];
+    if (options.global) {
+        configs.push({ path: globalPath, label: "global" });
+    }
+    else {
+        configs.push({ path: projectPath, label: "project" });
+        if (await pathExists(omkPath)) {
+            configs.push({ path: omkPath, label: "project-omk" });
+        }
+    }
+    let totalFixed = 0;
+    const fixedServers = [];
+    for (const { path: configPath } of configs) {
+        const source = await loadConfig(configPath);
+        if (!source.parsed || !source.config.mcpServers)
+            continue;
+        const servers = source.config.mcpServers;
+        let changed = false;
+        for (const [name, server] of Object.entries(servers)) {
+            const args = server.args ?? [];
+            for (let i = 0; i < args.length; i++) {
+                const arg = args[i];
+                if (typeof arg !== "string")
+                    continue;
+                for (const [stale, current] of Object.entries(STALE_PACKAGE_NAMES)) {
+                    if (arg.includes(stale)) {
+                        const newArg = arg.replace(stale, current);
+                        if (!options.dryRun) {
+                            args[i] = newArg;
+                            changed = true;
+                        }
+                        totalFixed++;
+                        fixedServers.push({ name, file: configPath, from: stale, to: current });
+                    }
+                }
+            }
+        }
+        if (changed) {
+            await writeFile(configPath, JSON.stringify(source.config, null, 2) + "\n", "utf-8");
+        }
+    }
+    console.log(header("MCP Migrate"));
+    if (totalFixed === 0) {
+        console.log(status.ok("No stale package names found"));
+    }
+    else {
+        if (options.dryRun) {
+            console.log(style.skin(`${totalFixed} stale package reference(s) would be fixed:`));
+        }
+        else {
+            console.log(status.ok(`Fixed ${totalFixed} stale package reference(s):`));
+        }
+        for (const entry of fixedServers) {
+            console.log(`  ${label(entry.name, `${entry.from} → ${entry.to}`)} (${entry.file})`);
+        }
+    }
+}

package/dist/commands/mcp/doctor-fix.d.ts

@@ -0,0 +1,12 @@
+export interface McpDoctorFixReport {
+    changed: boolean;
+    dryRun: boolean;
+    global: boolean;
+    actions: string[];
+    skipped: string[];
+    backups: string[];
+}
+export declare function repairMcpDoctorIssues(options?: {
+    dryRun?: boolean;
+    global?: boolean;
+}): Promise<McpDoctorFixReport>;

package/dist/commands/mcp/doctor-fix.js

@@ -0,0 +1,261 @@
+import { chmod, mkdir, readFile, writeFile } from "fs/promises";
+import { dirname, join } from "path";
+import { collectMcpConfigs, diagnoseRuntimeMcpServer, getProjectRoot, pathExists, getUserHome, STALE_PACKAGE_NAMES, } from "../../util/fs.js";
+import { getOmkResourceSettings } from "../../util/resource-profile.js";
+import { maskSensitiveText } from "../../util/secret-mask.js";
+import { collectServers, isHttpUrl, isNpmLauncherCommand, resolveAllConfigs, sanitizeMcpServerForProject, } from "./shared.js";
+const AUTO_DISABLE_RUNTIME_BLOCKERS = new Set([
+    "missing-command",
+    "command-path-not-found",
+    "arg-path-not-found",
+    "shell-builtin-command",
+    "windows-set-inline",
+    "inline-script-path-not-found",
+    "stale-home-reference",
+    "stdio-http-transport",
+    "invalid-server",
+]);
+async function ensureMcpConfigFile(filePath, config, actions, options = {}) {
+    if (await pathExists(filePath))
+        return;
+    if (options.dryRun) {
+        actions.push(`would create MCP config ${filePath}`);
+        return;
+    }
+    await mkdir(dirname(filePath), { recursive: true });
+    await writeFile(filePath, JSON.stringify(config, null, 2) + "\n", "utf-8");
+    actions.push(`created MCP config ${filePath}`);
+}
+function hasConfiguredMcpServers(config) {
+    return Object.keys(config?.mcpServers ?? {}).length > 0;
+}
+async function readParsedMcpConfig(filePath) {
+    if (!(await pathExists(filePath)))
+        return null;
+    try {
+        const parsed = JSON.parse(await readFile(filePath, "utf-8"));
+        return parsed && typeof parsed === "object" ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function migrateLegacyOmkMcpBeforeEnsure(omkMcpPath, projectMcpPath, actions, options = {}) {
+    const legacyConfig = await readParsedMcpConfig(omkMcpPath);
+    if (!hasConfiguredMcpServers(legacyConfig))
+        return;
+    const projectConfig = await readParsedMcpConfig(projectMcpPath);
+    if (projectConfig && hasConfiguredMcpServers(projectConfig))
+        return;
+    if (options.dryRun) {
+        actions.push(`would migrate legacy MCP servers from ${omkMcpPath} to ${projectMcpPath}`);
+        return;
+    }
+    const migratedConfig = {
+        ...(projectConfig ?? {}),
+        _comment: "Project-local MCP config migrated from legacy .omk/mcp.json; review secrets before sharing.",
+        mcpServers: { ...(legacyConfig?.mcpServers ?? {}) },
+    };
+    if (projectConfig) {
+        await createSanitizedMcpBackup(projectMcpPath, projectConfig, options.backups ?? [], actions);
+    }
+    await mkdir(dirname(projectMcpPath), { recursive: true });
+    await writeFile(projectMcpPath, JSON.stringify(migratedConfig, null, 2) + "\n", "utf-8");
+    actions.push(`migrated legacy MCP servers from ${omkMcpPath} to ${projectMcpPath}`);
+}
+function cloneMcpConfig(config) {
+    return JSON.parse(JSON.stringify(config));
+}
+function timestampForBackup() {
+    return new Date().toISOString().replace(/[:.]/g, "-");
+}
+async function createSanitizedMcpBackup(filePath, config, backups, actions) {
+    if (!(await pathExists(filePath)))
+        return;
+    const backupPath = `${filePath}.omk-backup-${timestampForBackup()}-${backups.length + 1}.json`;
+    const dir = dirname(filePath);
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    await chmod(dir, 0o700).catch(() => undefined);
+    await writeFile(backupPath, JSON.stringify(sanitizeMcpConfigForBackup(config), null, 2) + "\n", { encoding: "utf-8", mode: 0o600 });
+    await chmod(backupPath, 0o600).catch(() => undefined);
+    backups.push(backupPath);
+    actions.push(`created sanitized MCP backup ${backupPath}`);
+}
+function sanitizeMcpConfigForBackup(config) {
+    const cleaned = cloneMcpConfig(config);
+    if (cleaned.mcpServers && typeof cleaned.mcpServers === "object") {
+        cleaned.mcpServers = Object.fromEntries(Object.entries(cleaned.mcpServers).map(([name, server]) => [name, sanitizeMcpServerForProject(server)]));
+    }
+    const disabled = cleaned._omkDisabledMcpServers;
+    if (disabled && typeof disabled === "object" && !Array.isArray(disabled)) {
+        cleaned._omkDisabledMcpServers = Object.fromEntries(Object.entries(disabled).map(([name, server]) => [
+            name,
+            server && typeof server === "object" && !Array.isArray(server)
+                ? sanitizeMcpServerForProject(server)
+                : server,
+        ]));
+    }
+    return cleaned;
+}
+function repairMcpServerConfig(name, server) {
+    const actions = [];
+    if (server.command && isHttpUrl(server.command) && (!server.args || server.args.length === 0)) {
+        server.url = server.command;
+        delete server.command;
+        delete server.args;
+        actions.push(`converted "${name}" command URL to remote url transport`);
+    }
+    if (!server.url && server.args?.includes("@modelcontextprotocol/server-pdf") && !server.args.includes("--stdio")) {
+        server.args = [...server.args, "--stdio"];
+        actions.push(`added --stdio to "${name}" PDF MCP server`);
+    }
+    if (!server.url && server.args) {
+        let replaced = false;
+        server.args = server.args.map((arg) => {
+            const replacement = STALE_PACKAGE_NAMES[arg];
+            if (!replacement)
+                return arg;
+            replaced = true;
+            return replacement;
+        });
+        if (replaced)
+            actions.push(`replaced stale MCP package argument for "${name}"`);
+    }
+    if (!server.url && isNpmLauncherCommand(server.command) && !server.startup_timeout_sec) {
+        server.startup_timeout_sec = 15;
+        actions.push(`set 15s startup timeout for npm-based MCP "${name}"`);
+    }
+    return actions;
+}
+function disabledMcpServers(config) {
+    const current = config._omkDisabledMcpServers;
+    if (current && typeof current === "object" && !Array.isArray(current)) {
+        return current;
+    }
+    const next = {};
+    config._omkDisabledMcpServers = next;
+    return next;
+}
+function moveMcpServerToDisabled(source, name, server, reason) {
+    const disabled = disabledMcpServers(source.config);
+    disabled[name] = {
+        ...server,
+        _omkDisabledAt: new Date().toISOString(),
+        _omkDisabledReason: reason,
+    };
+    delete source.config.mcpServers?.[name];
+    source.changed = true;
+}
+export async function repairMcpDoctorIssues(options = {}) {
+    const root = getProjectRoot();
+    const projectOmkDir = join(root, ".omk");
+    const projectKimiDir = join(root, ".kimi");
+    const omkMcpPath = join(projectOmkDir, "mcp.json");
+    const projectMcpPath = join(projectKimiDir, "mcp.json");
+    const dryRun = Boolean(options.dryRun);
+    const includeGlobal = Boolean(options.global);
+    const actions = [];
+    const skipped = [];
+    const backups = [];
+    if (!dryRun) {
+        await Promise.all([
+            mkdir(projectOmkDir, { recursive: true }),
+            mkdir(projectKimiDir, { recursive: true }),
+        ]);
+    }
+    await migrateLegacyOmkMcpBeforeEnsure(omkMcpPath, projectMcpPath, actions, { dryRun, backups });
+    await ensureMcpConfigFile(omkMcpPath, { mcpServers: {} }, actions, { dryRun });
+    await ensureMcpConfigFile(projectMcpPath, {
+        _comment: "Project-local MCP config. omk-project is virtual runtime MCP injected; global MCP servers remain in ~/.kimi/mcp.json and must be imported explicitly only after secret review.",
+        mcpServers: {},
+    }, actions, { dryRun });
+    const sources = await resolveAllConfigs();
+    const resources = await getOmkResourceSettings();
+    const activePathOrder = await collectMcpConfigs(resources.mcpScope);
+    const activePaths = new Set(activePathOrder);
+    const activePreferredPath = activePathOrder.at(-1);
+    const globalMcpPath = join(getUserHome(), ".kimi", "mcp.json");
+    const mutableSources = new Map();
+    for (const source of sources) {
+        if (!source.exists)
+            continue;
+        if (!source.parsed) {
+            skipped.push(`invalid JSON left unchanged: ${source.path}`);
+            continue;
+        }
+        const clonedConfig = cloneMcpConfig(source.config);
+        mutableSources.set(source.path, {
+            path: source.path,
+            config: clonedConfig,
+            originalConfig: cloneMcpConfig(source.config),
+            changed: false,
+        });
+    }
+    const writableConfigPaths = new Set([omkMcpPath, projectMcpPath]);
+    if (includeGlobal)
+        writableConfigPaths.add(globalMcpPath);
+    const servers = collectServers(sources);
+    for (const [name, info] of servers) {
+        const activeSources = info.sources.filter((sourcePath) => activePaths.has(sourcePath));
+        if (activeSources.length <= 1)
+            continue;
+        const projectActiveSources = activeSources.filter((sourcePath) => sourcePath !== globalMcpPath);
+        if (activeSources.includes(globalMcpPath) && projectActiveSources.length > 0) {
+            skipped.push(`duplicate MCP "${name}" spans global/project; kept project override: ${activeSources.join(", ")}`);
+            continue;
+        }
+        const removableSources = activeSources.includes(globalMcpPath)
+            ? activeSources.filter((sourcePath) => sourcePath !== globalMcpPath)
+            : activeSources.filter((sourcePath) => sourcePath !== activePreferredPath);
+        for (const sourcePath of removableSources) {
+            if (!writableConfigPaths.has(sourcePath)) {
+                skipped.push(`duplicate MCP "${name}" not modified outside requested repair scope: ${sourcePath}`);
+                continue;
+            }
+            const source = mutableSources.get(sourcePath);
+            if (!source?.config.mcpServers?.[name])
+                continue;
+            delete source.config.mcpServers[name];
+            source.changed = true;
+            actions.push(`removed duplicate MCP "${name}" from ${sourcePath}`);
+        }
+        if (removableSources.length === 0) {
+            skipped.push(`duplicate MCP "${name}" requires manual choice: ${activeSources.join(", ")}`);
+        }
+    }
+    for (const source of mutableSources.values()) {
+        if (!writableConfigPaths.has(source.path))
+            continue;
+        const serversByName = source.config.mcpServers ?? {};
+        for (const [name, server] of Object.entries(serversByName)) {
+            const serverActions = repairMcpServerConfig(name, server);
+            if (serverActions.length > 0) {
+                source.changed = true;
+                actions.push(...serverActions.map((action) => `${source.path}: ${action}`));
+            }
+            const diagnostics = await diagnoseRuntimeMcpServer(name, server);
+            const blockers = diagnostics.filter((diagnostic) => AUTO_DISABLE_RUNTIME_BLOCKERS.has(diagnostic.kind));
+            if (blockers.length > 0) {
+                const reason = blockers.map((diagnostic) => diagnostic.message).join("; ");
+                moveMcpServerToDisabled(source, name, server, reason);
+                actions.push(`${source.path}: disabled MCP "${name}" due to runtime startup blocker: ${reason}`);
+            }
+        }
+    }
+    for (const source of mutableSources.values()) {
+        if (!source.changed)
+            continue;
+        if (dryRun)
+            continue;
+        await createSanitizedMcpBackup(source.path, source.originalConfig, backups, actions);
+        await writeFile(source.path, JSON.stringify(source.config, null, 2) + "\n", "utf-8");
+    }
+    return {
+        changed: !dryRun && actions.length > 0,
+        dryRun,
+        global: includeGlobal,
+        actions: actions.map(maskSensitiveText),
+        skipped: skipped.map(maskSensitiveText),
+        backups,
+    };
+}