synartesis 0.8.8 → 0.9.1

package/dist/{chunk-JE7MOCZO.js → chunk-H4SPMXQW.js}

@@ -19,6 +19,77 @@ var PROXY_FLAGS = [
   "--token"
 ];
 
+// src/notify.ts
+import { spawn } from "child_process";
+import { platform } from "os";
+var SILENT = () => void 0;
+var NAME_MAX = 60;
+function shown(name) {
+  const clean = name.replace(/[\u0000-\u001f\u007f‪-‮⁦-⁩]/g, "");
+  return clean.length > NAME_MAX ? `${clean.slice(0, NAME_MAX - 1)}\u2026` : clean;
+}
+function unmarked(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function words(notice) {
+  return {
+    title: "Synartesis: a call is waiting for you",
+    body: `${shown(notice.server)}.${shown(notice.tool)} -- ${notice.approve}`
+  };
+}
+var KILL_AFTER_MS = 5e3;
+function launch(command, args) {
+  try {
+    const child = spawn(command, [...args], { stdio: "ignore" });
+    child.on("error", () => void 0);
+    const timer = setTimeout(() => child.kill(), KILL_AFTER_MS);
+    timer.unref();
+    child.on("exit", () => {
+      clearTimeout(timer);
+    });
+    child.unref();
+  } catch {
+  }
+}
+function desktopNotifier(env = process.env, os = platform()) {
+  if (env["SYNARTESIS_NOTIFY"] === "0") {
+    return SILENT;
+  }
+  if (os === "darwin") {
+    return (notice) => {
+      const { title, body } = words(notice);
+      launch("osascript", [
+        "-e",
+        "on run argv",
+        "-e",
+        "display notification (item 2 of argv) with title (item 1 of argv)",
+        "-e",
+        "end run",
+        "--",
+        title,
+        body
+      ]);
+    };
+  }
+  if (os === "linux") {
+    return (notice) => {
+      const { title, body } = words(notice);
+      launch("notify-send", ["--app-name=Synartesis", "--", title, unmarked(body)]);
+    };
+  }
+  return SILENT;
+}
+function canNotify(env = process.env) {
+  if (env["SYNARTESIS_NOTIFY"] === "0") {
+    return "switched off by SYNARTESIS_NOTIFY=0";
+  }
+  const os = platform();
+  if (os === "darwin" || os === "linux") {
+    return void 0;
+  }
+  return `there is no notifier for ${os} yet; use synartesis watch to see what is waiting`;
+}
+
 // src/invocation.ts
 import { spawnSync } from "child_process";
 import { accessSync, constants } from "fs";
@@ -202,6 +273,7 @@ var NOTHING_RECORDED_YET = [
 ];
 
 // src/journal/journal.ts
+import { randomBytes } from "crypto";
 import { chmodSync, existsSync as existsSync2, mkdirSync } from "fs";
 import { hostname } from "os";
 import { dirname as dirname2 } from "path";
@@ -289,6 +361,84 @@ CREATE TABLE IF NOT EXISTS leases (
   claimed_at TEXT NOT NULL
 );
 
+-- What each session's servers were started with, so an undo can tell whether
+-- it is about to act on the same thing.
+--
+-- An undo starts the server again, reading its environment from the client
+-- entry that wraps it. If that entry has changed since -- a memory server now
+-- pointed at a different file -- the undo reaches a different store from the
+-- one the session wrote to, sends its inverse there, and reports success. It
+-- cannot tell, because nothing recorded what the session's server was given.
+--
+-- The working directory, and for every variable the client entry or the policy
+-- declares, its name and a keyed HMAC of its value -- never the value. These
+-- are mostly tokens, and a token is a different class of secret from the file
+-- contents the rest of this journal holds: it must not land here in any form
+-- that gives it back. A keyed hash does not, for anything with a token's
+-- entropy, even to someone holding this file. The key is kept in the journal
+-- itself (the secrets table below) rather than beside it: this file is already
+-- the sensitive one and already owner-only, and a second file would be one
+-- more thing to protect and to lose.
+--
+-- Not a schema version bump, for the reason the leases table above is not.
+CREATE TABLE IF NOT EXISTS secrets (
+  name  TEXT PRIMARY KEY,
+  value BLOB NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS run_servers (
+  run_id       TEXT NOT NULL REFERENCES runs(id),
+  server       TEXT NOT NULL,
+  cwd          TEXT,
+  fingerprints TEXT NOT NULL,
+  PRIMARY KEY (run_id, server)
+);
+
+-- A person's no, kept apart from every other way a row ends up denied.
+--
+-- The status alone cannot say it. A spent approval is stored as denied, and so
+-- is an approval the client stopped waiting for, and a desktop timeout -- some
+-- of them with the approver's name on the row. So "has anybody refused this
+-- exact call?" asked of the status would tell an agent that arhaan said no to
+-- a call arhaan had approved. Only a person's deny writes here.
+--
+-- lifted_at is a person changing their mind: approving the same row afterwards
+-- lifts the denial rather than leaving two contradictory answers standing.
+--
+-- Not a schema version bump, for the reason the tables above are not.
+CREATE TABLE IF NOT EXISTS denials (
+  action_id  TEXT PRIMARY KEY REFERENCES actions(id),
+  server     TEXT NOT NULL,
+  tool       TEXT NOT NULL,
+  denied_by  TEXT NOT NULL,
+  reason     TEXT NOT NULL,
+  denied_at  TEXT NOT NULL,
+  lifted_at  TEXT,
+  lifted_by  TEXT
+);
+CREATE INDEX IF NOT EXISTS denials_recent ON denials(server, tool, denied_at);
+
+-- A person saying "stop asking me about this tool" for a while.
+--
+-- Before this the only way to stop being asked was to edit the policy by hand
+-- and restart the client, in the middle of whatever the agent was doing. This
+-- takes effect on the next call, with no reload, and runs out by itself: a
+-- yes that outlives the session it was given for is a yes nobody remembers
+-- giving. stopped_at is the person taking it back before then.
+--
+-- Not a schema version bump, for the reason the tables above are not.
+CREATE TABLE IF NOT EXISTS allows (
+  id          INTEGER PRIMARY KEY,
+  server      TEXT NOT NULL,
+  tool        TEXT NOT NULL,
+  allowed_by  TEXT NOT NULL,
+  allowed_at  TEXT NOT NULL,
+  until       TEXT NOT NULL,
+  stopped_at  TEXT,
+  stopped_by  TEXT
+);
+CREATE INDEX IF NOT EXISTS allows_current ON allows(server, tool, until);
+
 CREATE INDEX IF NOT EXISTS actions_by_run ON actions(run_id, seq);
 
 -- Deliberately not a schema version bump. Adding an index changes no row and
@@ -424,6 +574,26 @@ var runSchema = z.object({
 });
 var seenSchema = z.object({ server: z.string(), ts: z.string() });
 var countedSchema = z.object({ run_id: z.string(), n: z.number() });
+var allowanceSchema = z.object({
+  server: z.string(),
+  tool: z.string(),
+  allowed_by: z.string(),
+  allowed_at: z.string(),
+  until: z.string()
+});
+function toAllowance(raw) {
+  const row = allowanceSchema.parse(raw);
+  return { server: row.server, tool: row.tool, by: row.allowed_by, at: row.allowed_at, until: row.until };
+}
+var denialSchema = z.object({
+  denied_by: z.string(),
+  reason: z.string(),
+  denied_at: z.string()
+});
+var runServerSchema = z.object({
+  cwd: z.string().nullable(),
+  fingerprints: z.string()
+});
 var leaseSchema = z.object({
   action_id: z.string(),
   host: z.string(),
@@ -730,7 +900,7 @@ var SqliteJournal = class {
    * resource is contested.
    */
   markRollingBack(actionId, from = ["applied"]) {
-    return this.#run("markRollingBack", () => {
+    return this.#run("markRollingBack", () => this.#db.transaction(() => {
       const slots = from.map(() => "?").join(",");
       const result = this.#db.prepare(
         `UPDATE actions SET status = 'rolling_back' WHERE id = ? AND status IN (${slots})`
@@ -744,7 +914,7 @@ var SqliteJournal = class {
                pid = excluded.pid, claimed_at = excluded.claimed_at`
       ).run(actionId, hostname(), process.pid, (/* @__PURE__ */ new Date()).toISOString());
       return true;
-    });
+    }).immediate());
   }
   leaseFor(actionId) {
     return this.#run("leaseFor", () => {
@@ -1108,7 +1278,17 @@ var SqliteJournal = class {
         let actions = 0;
         const dropActions = this.#db.prepare("DELETE FROM actions WHERE run_id = ?");
         const dropRun = this.#db.prepare("DELETE FROM runs WHERE id = ?");
+        const dropServers = this.#db.prepare("DELETE FROM run_servers WHERE run_id = ?");
+        const dropLeases = this.#db.prepare(
+          "DELETE FROM leases WHERE action_id IN (SELECT id FROM actions WHERE run_id = ?)"
+        );
+        const dropDenials = this.#db.prepare(
+          "DELETE FROM denials WHERE action_id IN (SELECT id FROM actions WHERE run_id = ?)"
+        );
         for (const id of ids) {
+          dropServers.run(id);
+          dropLeases.run(id);
+          dropDenials.run(id);
           actions += dropActions.run(id).changes;
           runs += dropRun.run(id).changes;
         }
@@ -1117,6 +1297,131 @@ var SqliteJournal = class {
       return remove.immediate(runIds);
     });
   }
+  denyByPerson(actionId, by, reason) {
+    return this.#run(
+      "denyByPerson",
+      () => this.#db.transaction(() => {
+        const changed = this.deny(actionId, by, reason);
+        if (!changed) {
+          return false;
+        }
+        const row = this.getAction(actionId);
+        if (row === void 0) {
+          return false;
+        }
+        this.#db.prepare(
+          `INSERT INTO denials (action_id, server, tool, denied_by, reason, denied_at)
+             VALUES (?, ?, ?, ?, ?, ?)`
+        ).run(actionId, row.server, row.tool, by, reason, (/* @__PURE__ */ new Date()).toISOString());
+        return true;
+      }).immediate()
+    );
+  }
+  findDenial(query) {
+    return this.#run("findDenial", () => {
+      const raws = this.#db.prepare(
+        `SELECT a.*, d.denied_by, d.reason, d.denied_at
+             FROM denials d INDEXED BY denials_recent
+             JOIN actions a ON a.id = d.action_id
+            WHERE d.server = ? AND d.tool = ? AND d.lifted_at IS NULL AND d.denied_at >= ?
+            ORDER BY d.denied_at DESC`
+      ).all(query.server, query.tool, query.notBefore);
+      const rows = raws.map((raw) => ({ action: toAction(raw), denial: denialSchema.parse(raw) }));
+      const found = sameCall(
+        rows.map((row) => row.action),
+        query.args
+      );
+      const hit = found === void 0 ? void 0 : rows.find((row) => row.action.id === found.id);
+      return hit === void 0 ? void 0 : { action: hit.action, by: hit.denial.denied_by, reason: hit.denial.reason, at: hit.denial.denied_at };
+    });
+  }
+  reverseDenial(actionId, by) {
+    return this.#run(
+      "reverseDenial",
+      () => this.#db.transaction(() => {
+        const now = (/* @__PURE__ */ new Date()).toISOString();
+        const standing2 = this.#db.prepare("SELECT 1 FROM denials WHERE action_id = ? AND lifted_at IS NULL").get(actionId);
+        if (standing2 === void 0) {
+          return false;
+        }
+        const flipped = this.#db.prepare(
+          `UPDATE actions SET status = 'approved', approved_by = ?, approved_at = ?, error = NULL
+              WHERE id = ? AND status = 'denied'`
+        ).run(by, now, actionId);
+        if (flipped.changes !== 1) {
+          return false;
+        }
+        this.#db.prepare("UPDATE denials SET lifted_at = ?, lifted_by = ? WHERE action_id = ?").run(now, by, actionId);
+        return true;
+      }).immediate()
+    );
+  }
+  allow(server, tool, by, until) {
+    this.#run("allow", () => {
+      this.#db.prepare(
+        "INSERT INTO allows (server, tool, allowed_by, allowed_at, until) VALUES (?, ?, ?, ?, ?)"
+      ).run(server, tool, by, (/* @__PURE__ */ new Date()).toISOString(), until);
+    });
+  }
+  findAllowance(server, tool, now) {
+    return this.#run("findAllowance", () => {
+      const raw = this.#db.prepare(
+        `SELECT * FROM allows INDEXED BY allows_current
+            WHERE server = ? AND tool = ? AND until > ? AND stopped_at IS NULL
+            ORDER BY until DESC LIMIT 1`
+      ).get(server, tool, now);
+      return raw === void 0 ? void 0 : toAllowance(raw);
+    });
+  }
+  listAllowances(now) {
+    return this.#run(
+      "listAllowances",
+      () => this.#db.prepare("SELECT * FROM allows WHERE until > ? AND stopped_at IS NULL ORDER BY until").all(now).map(toAllowance)
+    );
+  }
+  stopAllowance(server, tool, by, now) {
+    return this.#run("stopAllowance", () => {
+      const result = this.#db.prepare(
+        `UPDATE allows SET stopped_at = ?, stopped_by = ?
+            WHERE server = ? AND tool = ? AND until > ? AND stopped_at IS NULL`
+      ).run(now, by, server, tool, now);
+      return result.changes > 0;
+    });
+  }
+  markAllowed(actionId, by) {
+    this.#run("markAllowed", () => {
+      this.#db.prepare(
+        "UPDATE actions SET approved_by = ?, approved_at = ? WHERE id = ? AND status = 'pending'"
+      ).run(by, (/* @__PURE__ */ new Date()).toISOString(), actionId);
+    });
+  }
+  recordRunServer(runId, server, cwd, fingerprints) {
+    this.#run("recordRunServer", () => {
+      this.#db.prepare(
+        `INSERT INTO run_servers (run_id, server, cwd, fingerprints) VALUES (?, ?, ?, ?)
+             ON CONFLICT(run_id, server) DO UPDATE SET cwd = excluded.cwd,
+               fingerprints = excluded.fingerprints`
+      ).run(runId, server, cwd ?? null, JSON.stringify(fingerprints));
+    });
+  }
+  runServer(runId, server) {
+    return this.#run("runServer", () => {
+      const raw = this.#db.prepare("SELECT cwd, fingerprints FROM run_servers WHERE run_id = ? AND server = ?").get(runId, server);
+      if (raw === void 0) {
+        return void 0;
+      }
+      const row = runServerSchema.parse(raw);
+      const fingerprints = z.record(z.string(), z.string()).parse(JSON.parse(row.fingerprints));
+      return { ...row.cwd === null ? {} : { cwd: row.cwd }, fingerprints };
+    });
+  }
+  fingerprintKey() {
+    return this.#run("fingerprintKey", () => {
+      this.#db.prepare("INSERT OR IGNORE INTO secrets (name, value) VALUES ('fingerprint', ?)").run(randomBytes(32));
+      const row = z.object({ value: z.instanceof(Buffer) }).parse(this.#db.prepare("SELECT value FROM secrets WHERE name = 'fingerprint'").get());
+      return row.value;
+    });
+  }
   vacuum() {
     this.#run("vacuum", () => {
       this.#db.exec("VACUUM");
@@ -1224,7 +1529,7 @@ function walk(current, parts, at, reference) {
       return walk(current[segment.index], parts, at + 1, reference);
     }
     case "key": {
-      if (typeof current !== "object" || !(segment.key in current)) {
+      if (typeof current !== "object" || !Object.hasOwn(current, segment.key)) {
         throw new ManifestError(`${reference} is unresolvable: ${segment.key} is absent`);
       }
       const next = Object.getOwnPropertyDescriptor(current, segment.key)?.value;
@@ -1333,11 +1638,39 @@ var serverSpec = z2.strictObject({
   command: z2.string().min(1),
   args: z2.array(z2.string()).default([]),
   env: z2.record(z2.string(), z2.string()).optional(),
-  provenance: z2.enum(["live", "documented"]).optional()
+  provenance: z2.enum(["live", "documented"]).optional(),
+  trust_annotations: z2.boolean().optional()
+});
+var LOOPBACK = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+var remoteSpec = z2.strictObject({
+  url: z2.string().refine((value) => URL.canParse(value), "url must be a full address, like https://example.com/mcp").refine((value) => {
+    const url = new URL(value);
+    return url.protocol === "https:" || url.protocol === "http:" && LOOPBACK.has(url.hostname);
+  }, "url must be https, since it carries a token; plain http is accepted only for this machine"),
+  transport: z2.enum(["auto", "http", "sse"]).default("auto"),
+  headers: z2.record(z2.string(), z2.string()).optional(),
+  env: z2.record(z2.string(), z2.string()).optional(),
+  provenance: z2.enum(["live", "documented"]).optional(),
+  trust_annotations: z2.boolean().optional()
+});
+var anyServer = z2.unknown().transform((value, context) => {
+  const has = (key) => typeof value === "object" && value !== null && key in value;
+  if (has("command") && has("url")) {
+    context.addIssue({ code: "custom", message: "give command or url, not both" });
+    return z2.NEVER;
+  }
+  const parsed = (has("url") ? remoteSpec : serverSpec).safeParse(value);
+  if (!parsed.success) {
+    for (const issue of parsed.error.issues) {
+      context.addIssue({ ...issue, code: "custom", message: issue.message });
+    }
+    return z2.NEVER;
+  }
+  return parsed.data;
 });
 var manifestSchema = z2.strictObject({
   version: z2.literal(1),
-  servers: z2.record(z2.string(), serverSpec),
+  servers: z2.record(z2.string(), anyServer),
   tools: z2.array(toolPolicy).default([]),
   pins: z2.record(z2.string(), z2.record(z2.string(), z2.string().min(1))).optional()
 });
@@ -1366,22 +1699,17 @@ var Source = class {
     throw new ManifestError(message, this.locate(path));
   }
 };
-var REFERENCE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
-function expandEnvironment(source, path, env) {
-  const expanded = {};
+var MALFORMED = /\$\{(?![A-Za-z_][A-Za-z0-9_]*\})/;
+function checkReferences(source, path, env, field = "env") {
   for (const [key, value] of Object.entries(env)) {
-    expanded[key] = value.replace(REFERENCE, (whole, name) => {
-      const found = process.env[name];
-      if (found === void 0) {
-        source.fail(
-          [...path, "env", key],
-          `${whole} is not set in this environment; export ${name} before starting, or write the value here`
-        );
-      }
-      return found;
-    });
+    if (MALFORMED.test(value)) {
+      source.fail(
+        [...path, field, key],
+        "a reference is written ${NAME}: letters, digits and underscores, not starting with a digit"
+      );
+    }
   }
-  return expanded;
+  return env;
 }
 function serverSegment(pattern) {
   const dot = pattern.indexOf(".");
@@ -1395,6 +1723,47 @@ function matchesAnyServer(segment, servers) {
   const test = new RegExp(`^${source}$`);
   return servers.some((name) => test.test(name));
 }
+function stringsIn(value, path) {
+  if (typeof value === "string") {
+    return [[path, value]];
+  }
+  if (Array.isArray(value)) {
+    return value.flatMap((item, index) => stringsIn(item, [...path, index]));
+  }
+  if (value !== null && typeof value === "object") {
+    return Object.entries(value).flatMap(([key, item]) => stringsIn(item, [...path, key]));
+  }
+  return [];
+}
+function spelled(inner) {
+  const trimmed = inner.trim().replace(/^\$/, "");
+  for (const [from, to] of [["args.", "$."], ["snapshot.", "$snapshot."], ["result.", "$result."]]) {
+    if (trimmed.startsWith(from)) {
+      return `"${to}${trimmed.slice(from.length)}"`;
+    }
+  }
+  return `"$.${trimmed}"`;
+}
+function checkSpelling(source, path, call) {
+  if (call === void 0) {
+    return;
+  }
+  for (const [at, text] of stringsIn(call.args, [...path, "args"])) {
+    const braces = /\{\{\s*([^}]*?)\s*\}\}/.exec(text);
+    if (braces !== null) {
+      source.fail(at, `${braces[0]} is sent as written; write ${spelled(braces[1] ?? "")} instead`);
+    }
+    const dollar = /^\$\{([^}]*)\}$/.exec(text);
+    if (dollar !== null) {
+      source.fail(at, `${text} is not a reference here; write ${spelled(dollar[1] ?? "")} instead`);
+    }
+    try {
+      referencesIn(text);
+    } catch (error) {
+      source.fail(at, error instanceof Error ? error.message : String(error));
+    }
+  }
+}
 function checkCall(source, path, call, servers, allowed) {
   const segment = serverSegment(call.tool);
   if (segment === "" || call.tool.endsWith(".")) {
@@ -1438,6 +1807,9 @@ function validate(source, manifest) {
       );
     }
     seen.set(policy.match, index);
+    checkSpelling(source, [...path, "snapshot"], policy.snapshot);
+    checkSpelling(source, [...path, "inverse"], policy.inverse);
+    checkSpelling(source, [...path, "verify"], policy.verify);
     const segment = serverSegment(policy.match);
     if (segment === "") {
       source.fail([...path, "match"], `${policy.match} must be qualified as server.tool`);
@@ -1550,10 +1922,14 @@ function parseManifest(text, file) {
       Object.entries(parsed.data.servers).map(([name, spec]) => [
         name,
         {
-          command: spec.command,
-          args: spec.args,
-          ...spec.env === void 0 ? {} : { env: expandEnvironment(source, ["servers", name], spec.env) },
-          ...spec.provenance === void 0 ? {} : { provenance: spec.provenance }
+          ..."url" in spec ? {
+            url: spec.url,
+            transport: spec.transport,
+            ...spec.headers === void 0 ? {} : { headers: checkReferences(source, ["servers", name], spec.headers, "headers") }
+          } : { command: spec.command, args: spec.args },
+          ...spec.env === void 0 ? {} : { env: checkReferences(source, ["servers", name], spec.env) },
+          ...spec.provenance === void 0 ? {} : { provenance: spec.provenance },
+          ...spec.trust_annotations === void 0 ? {} : { trustAnnotations: spec.trust_annotations }
         }
       ])
     ),
@@ -1581,9 +1957,6 @@ function loadManifest(path) {
   return parseManifest(text, path);
 }
 
-// src/manifest/pin.ts
-import { createHash } from "crypto";
-
 // src/manifest/match.ts
 function toRegExp(pattern) {
   const source = pattern.split("*").map((literal) => literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("[^.]*");
@@ -1618,6 +1991,9 @@ function createPolicyResolver(manifest) {
 }
 
 // src/manifest/types.ts
+function isRemote(spec) {
+  return spec.url !== void 0;
+}
 function qualify(server, tool) {
   return `${server}.${tool}`;
 }
@@ -1630,6 +2006,7 @@ function splitQualified(qualified) {
 }
 
 // src/manifest/pin.ts
+import { createHash } from "crypto";
 function fingerprint(inputSchema) {
   return `sha256:${createHash("sha256").update(canonical(inputSchema)).digest("hex")}`;
 }
@@ -1640,9 +2017,9 @@ function auditPins(server, advertised, manifest) {
   }
   const resolver = createPolicyResolver(manifest);
   const faults = [];
-  const present = /* @__PURE__ */ new Set();
+  const present2 = /* @__PURE__ */ new Set();
   for (const tool of advertised) {
-    present.add(tool.name);
+    present2.add(tool.name);
     if (!resolver.resolve(qualify(server, tool.name)).matched) {
       continue;
     }
@@ -1655,7 +2032,7 @@ function auditPins(server, advertised, manifest) {
     }
   }
   for (const name of Object.keys(pins)) {
-    if (!present.has(name)) {
+    if (!present2.has(name)) {
       faults.push({ kind: "gone", tool: name });
     }
   }
@@ -1694,8 +2071,19 @@ function explainPins(server, faults) {
 
 // src/manifest/verify.ts
 import { z as z3 } from "zod";
+async function listAll(upstreams) {
+  return new Map(
+    await Promise.all(upstreams.map(async (upstream) => [upstream.name, await toolShapes(upstream)]))
+  );
+}
 var listSchema = z3.looseObject({
-  tools: z3.array(z3.looseObject({ name: z3.string(), inputSchema: z3.unknown() })),
+  tools: z3.array(
+    z3.looseObject({
+      name: z3.string(),
+      inputSchema: z3.unknown(),
+      annotations: z3.looseObject({ readOnlyHint: z3.unknown().optional() }).optional().catch(void 0)
+    })
+  ),
   nextCursor: z3.string().optional()
 });
 async function toolShapes(upstream) {
@@ -1709,17 +2097,21 @@ async function toolShapes(upstream) {
       )
     );
     for (const tool of page.tools) {
-      shapes.push({ name: tool.name, inputSchema: tool.inputSchema });
+      shapes.push({
+        name: tool.name,
+        inputSchema: tool.inputSchema,
+        ...tool.annotations?.readOnlyHint === true ? { readOnly: true } : {}
+      });
     }
     cursor = page.nextCursor;
   } while (cursor !== void 0);
   return shapes;
 }
-async function verifyAgainstServers(upstreams, manifest) {
+async function verifyAgainstServers(upstreams, manifest, listed) {
   const shapes = /* @__PURE__ */ new Map();
   const available = /* @__PURE__ */ new Map();
   for (const upstream of upstreams) {
-    const advertised = await toolShapes(upstream);
+    const advertised = listed?.get(upstream.name) ?? await toolShapes(upstream);
     shapes.set(upstream.name, advertised);
     available.set(upstream.name, new Set(advertised.map((tool) => tool.name)));
   }
@@ -1766,6 +2158,37 @@ async function verifyAgainstServers(upstreams, manifest) {
     );
   }
 }
+async function withoutMissingTools(upstreams, manifest, listed) {
+  const available = /* @__PURE__ */ new Map();
+  for (const upstream of upstreams) {
+    const advertised = listed?.get(upstream.name) ?? await toolShapes(upstream);
+    available.set(upstream.name, new Set(advertised.map((tool) => tool.name)));
+  }
+  const missing = (qualified) => {
+    const target = splitQualified(qualified);
+    if (target === void 0) {
+      return false;
+    }
+    const names = available.get(target.server);
+    return names !== void 0 && !names.has(target.tool);
+  };
+  const disabled = [];
+  const tools = manifest.tools.map((policy) => {
+    const gone = [
+      ["snapshot", policy.snapshot?.tool],
+      ["inverse", policy.inverse?.tool],
+      ["verify", policy.verify?.tool]
+    ].filter((pair) => pair[1] !== void 0 && missing(pair[1]));
+    if (gone.length === 0) {
+      return policy;
+    }
+    disabled.push(
+      `${policy.match}: its ${gone.map(([role, tool]) => `${role} ${tool}`).join(" and ")} ${gone.length === 1 ? "is" : "are"} gone from the server, so it is held until the policy is updated`
+    );
+    return { match: policy.match, class: "irreversible", gate: "always", refusal: "uncertain" };
+  });
+  return { manifest: { ...manifest, tools }, disabled };
+}
 
 // src/manifest/standing.ts
 function standing(manifest) {
@@ -1793,6 +2216,9 @@ function warnUntested(servers) {
   const these = servers.length === 1 ? "this policy has" : "these policies have";
   return `${names}: ${these} never been run against the real server. The classes and inverses here come from documentation, so undo may not work where it says it will. Run \`synartesis check\` against your own credentials, and expect to correct something.`;
 }
+function trustsMarks(manifest, server) {
+  return manifest.servers[server]?.trustAnnotations !== false && manifest.pins?.[server] === void 0;
+}
 function ungoverned(manifest, advertised) {
   const resolver = createPolicyResolver(manifest);
   const found = [];
@@ -1861,9 +2287,73 @@ function createRouter(upstreams, manifest) {
   };
 }
 
+// src/proxy/environment.ts
+import { createHmac } from "crypto";
+var LAUNCHER = /^(SYNARTESIS_|npm_)/;
+var LAUNCHER_EXACT = /* @__PURE__ */ new Set(["INIT_CWD", "NODE"]);
+function ownedByTheLauncher(name) {
+  return LAUNCHER.test(name) || LAUNCHER_EXACT.has(name);
+}
+var REFERENCE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
+function expandReferences(server, key, value, lookup) {
+  return value.replace(REFERENCE, (whole, name) => {
+    const found = lookup(name);
+    if (found === void 0) {
+      throw new ManifestError(
+        `server ${server} needs ${whole} for ${key}, and it is not set; set ${name} where this server is started, or write the value in the policy`
+      );
+    }
+    return found;
+  });
+}
+function present(env) {
+  const out = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (value !== void 0) {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+function upstreamEnv(server, spec, source) {
+  const own = Object.fromEntries(
+    Object.entries(present(process.env)).filter(([name]) => !ownedByTheLauncher(name))
+  );
+  const base = source.kind === "inherit" ? own : source.kind === "client" ? { ...source.own === false ? {} : own, ...source.env } : {};
+  const lookup = (name) => base[name] ?? process.env[name];
+  const declared = {};
+  for (const [key, value] of Object.entries(spec.env ?? {})) {
+    declared[key] = expandReferences(server, key, value, lookup);
+  }
+  if (source.kind === "manifest") {
+    return spec.env === void 0 ? void 0 : declared;
+  }
+  return { ...base, ...declared };
+}
+var ABSENT = "-";
+function fingerprint2(key, env, names) {
+  const out = {};
+  for (const name of [...new Set(names)].sort()) {
+    const value = env?.[name];
+    out[name] = value === void 0 ? ABSENT : createHmac("sha256", key).update(value).digest("hex");
+  }
+  return out;
+}
+function differing(recorded, now) {
+  return Object.keys(recorded).filter((name) => recorded[name] !== now[name]).sort();
+}
+function declaredNames(spec, client) {
+  return [.../* @__PURE__ */ new Set([...Object.keys(spec.env ?? {}), ...Object.keys(client ?? {})])].sort();
+}
+
 // src/proxy/upstream.ts
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { SSEClientTransport, SseError } from "@modelcontextprotocol/sdk/client/sse.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import {
+  StreamableHTTPClientTransport,
+  StreamableHTTPError
+} from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 function describeError(error) {
   return error instanceof Error ? error.message : String(error);
 }
@@ -1874,10 +2364,10 @@ function settled(stream, ms) {
   if (stream.readableEnded === true) {
     return Promise.resolve();
   }
-  return new Promise((resolve2) => {
+  return new Promise((resolve5) => {
     const done = () => {
       clearTimeout(timer);
-      resolve2();
+      resolve5();
     };
     const timer = setTimeout(done, ms);
     timer.unref?.();
@@ -1915,8 +2405,22 @@ function lastWords(text) {
   if (named !== void 0) {
     return named;
   }
-  const kept = lines.slice(-4).join("; ");
-  return kept === "" ? void 0 : kept;
+  const kept2 = lines.slice(-4).join("; ");
+  return kept2 === "" ? void 0 : kept2;
+}
+async function connectUpstream(name, spec, options) {
+  const env = upstreamEnv(name, spec, options.env);
+  if (isRemote(spec)) {
+    return await connectRemoteUpstream(name, spec, (variable) => env?.[variable] ?? process.env[variable]);
+  }
+  return await connectStdioUpstream({
+    name,
+    command: spec.command,
+    args: spec.args,
+    ...env === void 0 ? {} : { env },
+    ...options.cwd === void 0 ? {} : { cwd: options.cwd },
+    ...options.stderr === void 0 ? {} : { stderr: options.stderr }
+  });
 }
 async function connectStdioUpstream(spec) {
   const started = await start(spec);
@@ -1941,6 +2445,7 @@ async function start(spec) {
     command: spec.command,
     args: [...spec.args ?? []],
     ...spec.env === void 0 ? {} : { env: { ...spec.env } },
+    ...spec.cwd === void 0 ? {} : { cwd: spec.cwd },
     // "pipe" is what the sdk calls it; captured here so a failure can quote it.
     stderr: wanted === "capture" ? "pipe" : wanted
   });
@@ -1970,39 +2475,1309 @@ async function start(spec) {
   }
   return { client };
 }
-
-// src/idempotency.ts
-var IDEMPOTENCY_META_KEY = "synartesis.dev/idempotency-key";
-function withIdempotencyKey(meta, key) {
-  const merged = {};
-  if (typeof meta === "object" && meta !== null) {
-    for (const [name, value] of Object.entries(meta)) {
-      merged[name] = value;
+async function connectRemoteUpstream(name, spec, lookup) {
+  const headers = {};
+  for (const [key, value] of Object.entries(spec.headers ?? {})) {
+    headers[key] = expandReferences(name, key, value, lookup);
+  }
+  const url = new URL(spec.url);
+  const requestInit = { headers, redirect: "error" };
+  const open = async (kind2) => {
+    const client = new Client({ ...PROXY_CLIENT_INFO });
+    if (kind2 === "http") {
+      await client.connect(new StreamableHTTPClientTransport(url, { requestInit }));
+    } else {
+      await client.connect(new SSEClientTransport(url, { requestInit }));
+    }
+    return client;
+  };
+  let kind = spec.transport === "sse" ? "sse" : "http";
+  let current;
+  try {
+    current = await open(kind);
+  } catch (error) {
+    const code = statusOf(error);
+    if (spec.transport === "auto" && (code === 400 || code === 404 || code === 405)) {
+      kind = "sse";
+      try {
+        current = await open(kind);
+      } catch (fallback) {
+        throw new UpstreamError(name, "connect", fallback);
+      }
+    } else {
+      throw new UpstreamError(name, "connect", refusal(error) ?? error);
     }
   }
-  merged[IDEMPOTENCY_META_KEY] = key;
-  return merged;
+  return {
+    name,
+    get client() {
+      return current;
+    },
+    async reconnect() {
+      await current.close().catch(() => void 0);
+      current = await open(kind);
+    },
+    classify(error) {
+      const code = statusOf(error);
+      if (code === void 0 || code < 400 || code >= 500) {
+        return void 0;
+      }
+      return code === 404 ? "lost" : "not-sent";
+    },
+    close: async () => {
+      await current.close();
+    }
+  };
+}
+function statusOf(error) {
+  if (error instanceof StreamableHTTPError || error instanceof SseError) {
+    return typeof error.code === "number" && error.code > 0 ? error.code : void 0;
+  }
+  return void 0;
+}
+function refusal(error) {
+  const code = statusOf(error);
+  if (code === 401 || code === 403) {
+    return `the server refused the credentials it was given (HTTP ${String(code)}); check the token its headers name`;
+  }
+  return void 0;
+}
+async function startTogether(items, start2) {
+  const settled2 = await Promise.allSettled(
+    items.map(async (item) => ({ item, upstream: await start2(item) }))
+  );
+  const started = [];
+  const failed = [];
+  items.forEach((item, index) => {
+    const result = settled2[index];
+    if (result?.status === "fulfilled") {
+      started.push(result.value.upstream);
+    } else if (result !== void 0) {
+      failed.push({ item, error: result.reason });
+    }
+  });
+  return { started, failed };
+}
+async function startAll(items, start2) {
+  const { started, failed } = await startTogether(items, start2);
+  const first = failed[0];
+  if (first !== void 0) {
+    await Promise.all(started.map((upstream) => upstream.close().catch(() => void 0)));
+    throw first.error;
+  }
+  return started;
 }
 
-// src/proxy/snapshot.ts
-import { z as z4 } from "zod";
-var ToolResult = z4.looseObject({
-  isError: z4.boolean().default(false),
-  content: z4.array(z4.looseObject({ type: z4.string() })).default([])
-});
-function refusal(result) {
-  const parsed = ToolResult.safeParse(result);
-  if (!parsed.success || !parsed.data.isError) {
+// src/install/clients.ts
+import { existsSync as existsSync3, readFileSync as readFileSync2, readdirSync, renameSync, rmSync, unlinkSync, writeFileSync } from "fs";
+import { homedir as homedir2, platform as platform2 } from "os";
+import { basename as basename2, dirname as dirname3, join as join3, resolve as resolve2 } from "path";
+
+// src/install/toml.ts
+var HEADER = /^\s*\[(?!\[)([^[\]]+)\]\s*$/;
+function serverTables(lines) {
+  const tables = [];
+  let open;
+  const close = (at) => {
+    if (open !== void 0) {
+      tables.push({ name: open.name, start: open.start, end: at });
+      open = void 0;
+    }
+  };
+  lines.forEach((line, index) => {
+    const header = HEADER.exec(line)?.[1];
+    if (header === void 0) {
+      return;
+    }
+    const parts = header.split(".");
+    if (parts[0] === "mcp_servers" && parts.length === 2 && parts[1] !== void 0) {
+      close(index);
+      open = { name: unquote(parts[1]), start: index };
+      return;
+    }
+    close(index);
+  });
+  close(lines.length);
+  return tables;
+}
+function unquote(text) {
+  const trimmed = text.trim();
+  if (/^'.*'$/s.test(trimmed)) {
+    return trimmed.slice(1, -1);
+  }
+  if (!/^".*"$/s.test(trimmed)) {
+    return trimmed;
+  }
+  return trimmed.slice(1, -1).replace(/\\(["\\])/g, "$1");
+}
+function readKey(lines, table, key) {
+  const pattern = new RegExp(`^\\s*${key}\\s*=\\s*(.*)$`);
+  for (let index = table.start + 1; index < table.end; index += 1) {
+    const line = lines[index];
+    if (line === void 0 || HEADER.test(line)) {
+      break;
+    }
+    const value = pattern.exec(line)?.[1];
+    if (value !== void 0) {
+      return value.trim();
+    }
+  }
+  return void 0;
+}
+function splitItems(inner) {
+  const items = [];
+  let current = "";
+  let quote3;
+  let escaped = false;
+  for (const character of inner) {
+    if (escaped) {
+      current += character;
+      escaped = false;
+      continue;
+    }
+    if (character === "\\" && quote3 === '"') {
+      current += character;
+      escaped = true;
+      continue;
+    }
+    if (quote3 === void 0 && (character === '"' || character === "'")) {
+      quote3 = character;
+      current += character;
+      continue;
+    }
+    if (character === quote3) {
+      quote3 = void 0;
+      current += character;
+      continue;
+    }
+    if (character === "," && quote3 === void 0) {
+      items.push(current);
+      current = "";
+      continue;
+    }
+    current += character;
+  }
+  items.push(current);
+  return items;
+}
+function parseArray(value) {
+  if (value === void 0 || !value.startsWith("[")) {
     return void 0;
   }
-  const said = parsed.data.content.map((block) => typeof block["text"] === "string" ? block["text"] : "").filter((text) => text !== "").join(" ");
-  return said === "" ? JSON.stringify(result) : said;
+  if (!value.endsWith("]")) {
+    return void 0;
+  }
+  const inner = value.slice(1, -1).trim();
+  if (inner === "") {
+    return [];
+  }
+  return splitItems(inner).map((item) => item.trim()).filter((item, index, all) => item !== "" || index !== all.length - 1).map(unquote);
+}
+function readServers(text) {
+  const lines = text.split("\n");
+  const servers = {};
+  for (const table of serverTables(lines)) {
+    const command = readKey(lines, table, "command");
+    const entry = {};
+    if (command !== void 0) {
+      entry["command"] = unquote(command);
+    }
+    const rawArgs = readKey(lines, table, "args");
+    const args = parseArray(rawArgs);
+    if (args !== void 0) {
+      entry["args"] = args;
+    } else if (rawArgs !== void 0) {
+      entry["unreadable"] = "its args array spans several lines, which this cannot read exactly";
+    }
+    const url = readKey(lines, table, "url");
+    if (url !== void 0) {
+      entry["url"] = unquote(url);
+    }
+    const enabled = readKey(lines, table, "enabled");
+    if (enabled !== void 0) {
+      entry["enabled"] = enabled.trim() === "true";
+    }
+    servers[table.name] = entry;
+  }
+  return servers;
+}
+var quote = (text) => `"${text.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+function writeServers(text, servers) {
+  const lines = text.split("\n");
+  const current = readServers(text);
+  for (const table of serverTables(lines).reverse()) {
+    const wanted = servers[table.name];
+    if (wanted === void 0 || wanted.command === void 0) {
+      continue;
+    }
+    const now = current[table.name];
+    const unreadable = now?.["unreadable"];
+    if (typeof unreadable === "string") {
+      throw new Error(`cannot rewrite [mcp_servers.${table.name}]: ${unreadable}`);
+    }
+    if (now?.command === wanted.command && JSON.stringify(now.args ?? []) === JSON.stringify(wanted.args ?? [])) {
+      continue;
+    }
+    setKey(lines, table, "command", quote(wanted.command));
+    setKey(lines, table, "args", `[${(wanted.args ?? []).map(quote).join(", ")}]`);
+  }
+  return lines.join("\n");
 }
-function isRecord(value) {
+function setKey(lines, table, key, value) {
+  const pattern = new RegExp(`^(\\s*)${key}\\s*=`);
+  for (let index = table.start + 1; index < table.end; index += 1) {
+    const line = lines[index];
+    if (line === void 0 || HEADER.test(line)) {
+      break;
+    }
+    const indent = pattern.exec(line)?.[1];
+    if (indent !== void 0) {
+      lines[index] = `${indent}${key} = ${value}`;
+      return;
+    }
+  }
+  lines.splice(table.start + 1, 0, `${key} = ${value}`);
+}
+
+// src/install/clients.ts
+var LABELS = {
+  "claude-code": "Claude Code",
+  "claude-desktop": "Claude Desktop",
+  cursor: "Cursor",
+  codex: "Codex",
+  devin: "Devin Desktop",
+  windsurf: "Windsurf",
+  "gemini-cli": "Gemini CLI",
+  "copilot-cli": "Copilot CLI",
+  antigravity: "Antigravity"
+};
+var LOOKED_FOR = `Looked for ${Object.values(LABELS).slice(0, -1).join(", ")} and ${Object.values(LABELS).slice(-1).join("")}.`;
+var CLIENT_IDS = Object.keys(LABELS).filter(
+  (name) => name in LABELS
+);
+function isClientId(value) {
+  return CLIENT_IDS.some((known) => known === value);
+}
+function claudeDesktopPath() {
+  const home2 = homedir2();
+  switch (platform2()) {
+    case "darwin":
+      return join3(home2, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+    case "win32":
+      return join3(process.env["APPDATA"] ?? join3(home2, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
+    default:
+      return join3(process.env["XDG_CONFIG_HOME"] ?? join3(home2, ".config"), "Claude", "claude_desktop_config.json");
+  }
+}
+function expandForClient(client, value) {
+  if (client === "devin" || client === "windsurf") {
+    return value.replace(/\$\{env:([A-Za-z_][A-Za-z0-9_]*)\}/g, (_whole, name) => process.env[name] ?? "").replace(/\{\{env:([A-Za-z_][A-Za-z0-9_]*)\}\}/g, (_whole, name) => process.env[name] ?? "");
+  }
+  if (client === "gemini-cli") {
+    return value.replace(
+      /\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g,
+      (_whole, braced, bare) => process.env[braced ?? bare ?? ""] ?? ""
+    );
+  }
+  if (client === "claude-code") {
+    return value.replace(
+      /\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}/g,
+      (whole, name, fallback) => process.env[name] ?? fallback ?? whole
+    );
+  }
+  if (client === "cursor") {
+    return value.replace(
+      /\$\{env:([A-Za-z_][A-Za-z0-9_]*)\}/g,
+      (whole, name) => process.env[name] ?? whole
+    );
+  }
+  return value;
+}
+function discover(cwd) {
+  const home2 = homedir2();
+  const sites = [];
+  const claudeCode = join3(home2, ".claude.json");
+  if (existsSync3(claudeCode)) {
+    const document = readJson(claudeCode);
+    const projects = document?.["projects"];
+    const here = resolve2(cwd);
+    if (isRecord(projects)) {
+      const others = Object.keys(projects).filter((path) => path !== here).sort();
+      for (const project of Object.prototype.hasOwnProperty.call(projects, here) ? [here, ...others] : others) {
+        const entry = projects[project];
+        const servers = isRecord(entry) ? entry["mcpServers"] : void 0;
+        if (project !== here && !(isRecord(servers) && Object.keys(servers).length > 0)) {
+          continue;
+        }
+        sites.push({
+          client: "claude-code",
+          label: LABELS["claude-code"],
+          format: "json",
+          path: claudeCode,
+          scope: `project ${project}`,
+          at: ["projects", project, "mcpServers"]
+        });
+      }
+    }
+    sites.push({
+      client: "claude-code",
+      label: LABELS["claude-code"],
+      format: "json",
+      path: claudeCode,
+      scope: "global",
+      at: ["mcpServers"]
+    });
+  }
+  const projectFile = join3(resolve2(cwd), ".mcp.json");
+  if (existsSync3(projectFile)) {
+    sites.push({
+      client: "claude-code",
+      label: LABELS["claude-code"],
+      format: "json",
+      path: projectFile,
+      scope: "project file",
+      at: ["mcpServers"]
+    });
+  }
+  const desktop = claudeDesktopPath();
+  if (existsSync3(desktop)) {
+    sites.push({
+      client: "claude-desktop",
+      label: LABELS["claude-desktop"],
+      format: "json",
+      path: desktop,
+      scope: "global",
+      at: ["mcpServers"]
+    });
+  }
+  const codex = join3(process.env["CODEX_HOME"] ?? join3(home2, ".codex"), "config.toml");
+  if (existsSync3(codex)) {
+    sites.push({
+      client: "codex",
+      label: LABELS.codex,
+      format: "toml",
+      path: codex,
+      scope: "global",
+      at: ["mcp_servers"]
+    });
+  }
+  const config = process.env["XDG_CONFIG_HOME"] ?? join3(home2, ".config");
+  const plain = [
+    ["cursor", join3(resolve2(cwd), ".cursor", "mcp.json"), "project"],
+    ["cursor", join3(home2, ".cursor", "mcp.json"), "global"],
+    // Windsurf is Devin Desktop now, which reads its own directory; an older
+    // Windsurf keeps the one it always had.
+    [
+      "devin",
+      platform2() === "win32" ? join3(process.env["APPDATA"] ?? join3(home2, "AppData", "Roaming"), "devin", "mcp_config.json") : join3(config, "devin", "mcp_config.json"),
+      "global"
+    ],
+    ["windsurf", join3(home2, ".codeium", "windsurf", "mcp_config.json"), "global"],
+    ["gemini-cli", join3(resolve2(cwd), ".gemini", "settings.json"), "project"],
+    ["gemini-cli", join3(home2, ".gemini", "settings.json"), "global"],
+    ["copilot-cli", join3(process.env["COPILOT_HOME"] ?? join3(home2, ".copilot"), "mcp-config.json"), "global"],
+    ["antigravity", join3(resolve2(cwd), ".agents", "mcp_config.json"), "workspace"],
+    ["antigravity", join3(home2, ".gemini", "config", "mcp_config.json"), "global"]
+  ];
+  for (const [client, path, scope] of plain) {
+    if (existsSync3(path)) {
+      sites.push({ client, label: LABELS[client], format: "json", path, scope, at: ["mcpServers"] });
+    }
+  }
+  const seen = /* @__PURE__ */ new Set();
+  return sites.filter((site) => {
+    const key = `${resolve2(site.path)}\0${site.at.join("\0")}`;
+    if (seen.has(key)) {
+      return false;
+    }
+    seen.add(key);
+    return true;
+  });
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readJson(path) {
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    return isRecord(parsed) ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var ConfigError = class extends Error {
+};
+function readDocument(site) {
+  let text;
+  try {
+    text = readFileSync2(site.path, "utf8");
+  } catch (error) {
+    throw new ConfigError(`cannot read ${site.path}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error) {
+    throw new ConfigError(
+      `${site.path} is not valid JSON (${error instanceof Error ? error.message : String(error)}). Fix it or move it aside; synartesis will not rewrite a file it cannot read.`
+    );
+  }
+  if (!isRecord(parsed)) {
+    throw new ConfigError(`${site.path} is not a JSON object, so it has no server list to change`);
+  }
+  return parsed;
+}
+function readServers2(document, at) {
+  let node = document;
+  for (const key of at) {
+    if (!isRecord(node)) {
+      return {};
+    }
+    node = node[key];
+  }
+  if (!isRecord(node)) {
+    return {};
+  }
+  const servers = {};
+  for (const [name, entry] of Object.entries(node)) {
+    if (isRecord(entry)) {
+      servers[name] = entry;
+    }
+  }
+  return servers;
+}
+function withServers(document, at, servers) {
+  const head = at[0];
+  if (head === void 0) {
+    throw new ConfigError("no path to the server list");
+  }
+  const rest = at.slice(1);
+  const below = document[head];
+  const child = rest.length === 0 ? servers : withServers(isRecord(below) ? below : {}, rest, servers);
+  return { ...document, [head]: child };
+}
+function indentOf(path) {
+  try {
+    const line = /\n([ \t]+)"/.exec(readFileSync2(path, "utf8"));
+    const found = line?.[1];
+    if (found === void 0) {
+      return 2;
+    }
+    return found.startsWith("	") ? "	" : found.length;
+  } catch {
+    return 2;
+  }
+}
+function backupPathFor(path) {
+  return `${path}.synartesis-backup-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
+}
+var KEEP_BACKUPS = 5;
+function pruneBackups(path) {
+  try {
+    const dir = dirname3(path);
+    const prefix = `${basename2(path)}.synartesis-backup-`;
+    const ours = readdirSync(dir).filter((name) => name.startsWith(prefix)).sort();
+    for (const name of ours.slice(0, Math.max(0, ours.length - KEEP_BACKUPS))) {
+      rmSync(join3(dir, name), { force: true });
+    }
+  } catch {
+  }
+}
+function writeDocument(site, document) {
+  return writeText(site, `${JSON.stringify(document, void 0, indentOf(site.path))}
+`);
+}
+function writeText(site, text) {
+  const backup = backupPathFor(site.path);
+  const original = readFileSync2(site.path);
+  writeFileSync(backup, original);
+  pruneBackups(site.path);
+  const temporary = join3(dirname3(site.path), `.synartesis-write-${String(process.pid)}.tmp`);
+  try {
+    writeFileSync(temporary, text);
+    renameSync(temporary, site.path);
+  } catch (error) {
+    try {
+      unlinkSync(temporary);
+    } catch {
+    }
+    throw new ConfigError(
+      `could not write ${site.path}: ${error instanceof Error ? error.message : String(error)}. The original is untouched, and a copy is at ${backup}.`
+    );
+  }
+  return backup;
+}
+function serversAt(site) {
+  if (site.format === "toml") {
+    try {
+      return readServers(readFileSync2(site.path, "utf8"));
+    } catch (error) {
+      throw new ConfigError(
+        `cannot read ${site.path}: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+  return readServers2(readDocument(site), site.at);
+}
+function saveServers(site, servers) {
+  if (site.format === "toml") {
+    const text = readFileSync2(site.path, "utf8");
+    return writeText(site, writeServers(text, servers));
+  }
+  return writeDocument(site, withServers(readDocument(site), site.at, servers));
+}
+
+// src/init/draft.ts
+import { z as z4 } from "zod";
+
+// src/init/known.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var KNOWN = [
+  { marker: "server-filesystem", manifest: "filesystem" },
+  { marker: "server-github", manifest: "github" },
+  { marker: "github-mcp-server", manifest: "github" },
+  { marker: "server-memory", manifest: "memory" },
+  { marker: "mcp-server-git", manifest: "git" },
+  { marker: "server-git", manifest: "git" },
+  { marker: "@playwright/mcp", manifest: "playwright" },
+  { marker: "chrome-devtools-mcp", manifest: "chrome-devtools" },
+  // Servers that only read, so their whole policy is "let it look".
+  { marker: "mcp-server-fetch", manifest: "fetch" },
+  { marker: "brave-search-mcp-server", manifest: "brave" },
+  { marker: "exa-mcp-server", manifest: "exa" },
+  { marker: "tavily-mcp", manifest: "tavily" },
+  { marker: "aws-documentation-mcp-server", manifest: "aws-docs" }
+];
+function manifestsDir() {
+  for (const up of ["../manifests/", "../../manifests/"]) {
+    const candidate = fileURLToPath2(new URL(up, import.meta.url));
+    if (existsSync4(candidate)) {
+      return candidate;
+    }
+  }
+  return void 0;
+}
+function knownPolicyFor(command, args) {
+  const line = [command, ...args].join(" ");
+  const hit = KNOWN.find((entry) => line.includes(entry.marker));
+  const dir = manifestsDir();
+  if (hit === void 0 || dir === void 0) {
+    return void 0;
+  }
+  const path = `${dir}${hit.manifest}.yaml`;
+  if (!existsSync4(path)) {
+    return void 0;
+  }
+  try {
+    const text = readFileSync3(path, "utf8");
+    const source = toolsBlock(text);
+    const key = serverKey(text);
+    if (source === void 0 || key === void 0) {
+      return void 0;
+    }
+    const rules = parseManifest(
+      `version: 1
+servers:
+  ${key}:
+    command: "true"
+tools:
+${source}
+`,
+      path
+    ).tools;
+    const claimed = /^\s*provenance:\s*(live|documented)\s*$/m.exec(text)?.[1];
+    return {
+      key,
+      rules,
+      name: hit.manifest,
+      source,
+      ...claimed === "live" || claimed === "documented" ? { provenance: claimed } : {}
+    };
+  } catch {
+    return void 0;
+  }
+}
+function toolsBlock(text) {
+  const at = text.search(/^tools:[ \t]*$/m);
+  if (at === -1) {
+    return void 0;
+  }
+  const body = text.slice(text.indexOf("\n", at) + 1);
+  const lines = [];
+  for (const line of body.split("\n")) {
+    if (/^[^\s#]/.test(line)) {
+      break;
+    }
+    lines.push(line);
+  }
+  return lines.join("\n").replace(/\s+$/, "");
+}
+function serverKey(text) {
+  const at = text.search(/^servers:[ \t]*$/m);
+  if (at === -1) {
+    return void 0;
+  }
+  const body = text.slice(text.indexOf("\n", at) + 1);
+  for (const line of body.split("\n")) {
+    if (/^[^\s#]/.test(line)) {
+      return void 0;
+    }
+    const named = /^ {2}([A-Za-z0-9_-]+):[ \t]*$/.exec(line);
+    if (named?.[1] !== void 0) {
+      return named[1];
+    }
+  }
+  return void 0;
+}
+function toolsReferencedBy(rule2, key) {
+  const local = (qualified) => qualified === void 0 || !qualified.startsWith(`${key}.`) ? void 0 : qualified.slice(key.length + 1);
+  return [local(rule2.snapshot?.tool), local(rule2.inverse?.tool)].filter(
+    (name) => name !== void 0
+  );
+}
+
+// src/init/draft.ts
+var toolSchema = z4.looseObject({
+  name: z4.string(),
+  description: z4.string().optional(),
+  annotations: z4.looseObject({
+    readOnlyHint: z4.boolean().optional(),
+    destructiveHint: z4.boolean().optional(),
+    idempotentHint: z4.boolean().optional()
+  }).optional()
+});
+var listSchema2 = z4.looseObject({
+  tools: z4.array(toolSchema),
+  nextCursor: z4.string().optional()
+});
+function quote2(value) {
+  return JSON.stringify(value);
+}
+function summarise(text) {
+  if (text === void 0) {
+    return "";
+  }
+  const single = text.replace(/\s+/g, " ").trim();
+  return single.length > 96 ? `${single.slice(0, 93)}...` : single;
+}
+function draftTool(server, tool) {
+  const match = `${server}.${tool.name}`;
+  const lines = [];
+  const description = summarise(tool.description);
+  if (description !== "") {
+    lines.push(`  # ${description}`);
+  }
+  if (tool.annotations?.readOnlyHint === true) {
+    lines.push(`  # classified readonly from the server's readOnlyHint; verify it before relying on it.`);
+    lines.push(`  - match: ${quote2(match)}`);
+    lines.push(`    class: readonly`);
+    return lines.join("\n");
+  }
+  lines.push(`  # TODO: this is gated on every call until you describe how to undo it.`);
+  lines.push(`  #   reversible  needs a snapshot (a pre-read) and an inverse.`);
+  lines.push(`  #   compensable needs an inverse only, usually built from $result.`);
+  lines.push(`  #   irreversible is correct when neither exists; leave gate: always.`);
+  lines.push(`  - match: ${quote2(match)}`);
+  lines.push(`    class: irreversible`);
+  lines.push(`    gate: always`);
+  return lines.join("\n");
+}
+function patternFor(match) {
+  const source = match.split("*").map((literal) => literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("[^.]*");
+  return new RegExp(`^${source}$`);
+}
+function adopt(known, name, tools) {
+  const advertised = new Set(tools.map((tool) => tool.name));
+  const covered = /* @__PURE__ */ new Set();
+  for (const rule2 of known.rules) {
+    for (const needed of toolsReferencedBy(rule2, known.key)) {
+      if (!advertised.has(needed)) {
+        return void 0;
+      }
+    }
+    const test = patternFor(rule2.match);
+    for (const tool of tools) {
+      if (test.test(`${known.key}.${tool.name}`)) {
+        covered.add(tool.name);
+      }
+    }
+  }
+  if (covered.size === 0) {
+    return void 0;
+  }
+  const renamed = known.source.replaceAll(`"${known.key}.`, `"${name}.`);
+  const missing = tools.filter((tool) => !covered.has(tool.name));
+  const extra = missing.length === 0 ? "" : [
+    "",
+    `  # Not mentioned by the bundled ${known.name} policy, so gated until you say otherwise.`,
+    ...missing.map((tool) => draftTool(name, tool))
+  ].join("\n");
+  return { source: `${renamed}${extra}`, covered: covered.size };
+}
+async function draftManifest(options) {
+  const upstream = await connectUpstream(
+    options.name,
+    options.remote === void 0 ? { command: options.command, args: options.args } : { ...options.remote },
+    {
+      env: options.env === void 0 ? { kind: "inherit" } : { kind: "client", env: options.env },
+      stderr: "capture",
+      ...options.cwd === void 0 ? {} : { cwd: options.cwd }
+    }
+  );
+  let tools;
+  try {
+    const collected = [];
+    let cursor;
+    do {
+      const page = listSchema2.parse(
+        await upstream.client.request(
+          { method: "tools/list", params: cursor === void 0 ? {} : { cursor } },
+          z4.looseObject({})
+        )
+      );
+      collected.push(...page.tools);
+      cursor = page.nextCursor;
+    } while (cursor !== void 0);
+    tools = collected;
+  } catch (error) {
+    throw new UpstreamError(options.name, "tools/list", error);
+  } finally {
+    await upstream.close();
+  }
+  if (tools.length === 0) {
+    throw new ManifestError(`${options.name} exposes no tools, so there is no policy to write`);
+  }
+  const existing = options.existing?.trimEnd();
+  if (existing !== void 0 && existing.includes(`
+  ${options.name}:`)) {
+    throw new ManifestError(
+      `${options.name} is already declared in the manifest; remove it first or choose another name`
+    );
+  }
+  const known = options.remote === void 0 ? knownPolicyFor(options.command, options.args) : void 0;
+  const claim = known?.provenance === void 0 ? [] : [
+    ...known.provenance === "documented" ? [
+      `    # This policy has never been run against the real server. Check it`,
+      `    # against your own setup before trusting undo on it.`
+    ] : [],
+    `    provenance: ${known.provenance}`
+  ];
+  const reach = options.remote === void 0 ? [`    command: ${quote2(options.command)}`, `    args: [${options.args.map(quote2).join(", ")}]`] : [
+    `    url: ${quote2(options.remote.url)}`,
+    `    transport: ${options.remote.transport}`,
+    ...Object.keys(options.remote.headers).length === 0 ? [] : [
+      `    # Names, not values: each is filled in from the client entry's env`,
+      `    # when the server is reached, so the token never lands in this file.`,
+      `    headers:`,
+      ...Object.entries(options.remote.headers).map(
+        ([key, value]) => `      ${quote2(key)}: ${quote2(value)}`
+      )
+    ]
+  ];
+  const server = [`  ${options.name}:`, ...reach, ...claim].join("\n");
+  const adopted = known === void 0 ? void 0 : adopt(known, options.name, tools);
+  const policies = adopted?.source ?? tools.map((tool) => draftTool(options.name, tool)).join("\n\n");
+  if (existing === void 0) {
+    const yaml = [
+      `# Generated by synartesis init from ${options.name}'s tools/list.`,
+      ...adopted === void 0 ? [
+        `# Every tool starts gated. Working through the TODOs is the whole job:`,
+        `# a tool with no inverse is one an agent cannot use unsupervised.`
+      ] : [
+        `# ${String(adopted.covered)} of its tools were recognised, so the policy that ships`,
+        `# with Synartesis for ${known?.name ?? "this server"} was used and checked against what this`,
+        `# server actually advertises. Read it before trusting it: it is a starting`,
+        `# point that happens to be finished, not a promise about your setup.`
+      ],
+      ``,
+      `version: 1`,
+      ``,
+      `servers:`,
+      server,
+      ``,
+      `tools:`,
+      policies,
+      ``
+    ].join("\n");
+    return adopted === void 0 || known === void 0 ? { yaml } : {
+      yaml,
+      adopted: {
+        server: known.name,
+        tools: adopted.covered,
+        ...known.provenance === void 0 ? {} : { provenance: known.provenance }
+      }
+    };
+  }
+  const merged = mergeInto(existing, server, policies, options.name);
+  return adopted === void 0 || known === void 0 ? { yaml: merged } : {
+    yaml: merged,
+    adopted: {
+      server: known.name,
+      tools: adopted.covered,
+      ...known.provenance === void 0 ? {} : { provenance: known.provenance }
+    }
+  };
+}
+function mergeInto(existing, server, policies, name) {
+  const serversAt2 = existing.indexOf("\nservers:");
+  const toolsAt = existing.indexOf("\ntools:");
+  if (serversAt2 === -1 || toolsAt === -1 || toolsAt < serversAt2) {
+    throw new ManifestError(
+      "the existing manifest does not have a servers: block followed by a tools: block, so it cannot be extended automatically"
+    );
+  }
+  const head = existing.slice(0, toolsAt);
+  const tail = existing.slice(toolsAt);
+  return [
+    head.trimEnd(),
+    server,
+    tail.trimEnd(),
+    ``,
+    `  # --- added by synartesis init for ${name} ---`,
+    policies,
+    ``
+  ].join("\n");
+}
+
+// src/install/install.ts
+import { chmodSync as chmodSync2, existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname4, resolve as resolve3 } from "path";
+function recordPathFor(manifestPath) {
+  return resolve3(dirname4(manifestPath), "installed.json");
+}
+var EMPTY = { version: 1, wrapped: {} };
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function asRecord(value) {
+  if (!isRecord2(value)) {
+    return void 0;
+  }
+  const wrapped = value["wrapped"];
+  if (!isRecord2(wrapped)) {
+    return void 0;
+  }
+  const kept2 = {};
+  for (const [key, entry] of Object.entries(wrapped)) {
+    if (!isRecord2(entry)) {
+      continue;
+    }
+    const original = entry["original"];
+    const at = entry["at"];
+    if (!isRecord2(original)) {
+      continue;
+    }
+    if (!Array.isArray(at) || !at.every((step) => typeof step === "string")) {
+      continue;
+    }
+    kept2[key] = { original, at };
+  }
+  return { version: 1, wrapped: kept2 };
+}
+function keyFor(site, server) {
+  return [site.path, site.scope, server].join("");
+}
+function readRecord(manifestPath) {
+  const path = recordPathFor(manifestPath);
+  if (!existsSync5(path)) {
+    return EMPTY;
+  }
+  try {
+    const parsed = JSON.parse(readFileSync4(path, "utf8"));
+    const record = asRecord(parsed);
+    if (record !== void 0) {
+      return record;
+    }
+  } catch {
+  }
+  return EMPTY;
+}
+function writeRecord(manifestPath, record) {
+  mkdirSync2(dirname4(recordPathFor(manifestPath)), { recursive: true, mode: 448 });
+  const path = recordPathFor(manifestPath);
+  writeFileSync2(path, `${JSON.stringify(record, void 0, 2)}
+`, { mode: 384 });
+  chmodSync2(path, 384);
+}
+function proxyEntry(manifestPath, server, original, invoker) {
+  const command = { command: invoker.command, args: [...invoker.args] };
+  return {
+    // What the client keeps about a server besides how to start it: Copilot
+    // CLI's `tools` list, Gemini CLI's `trust` and timeout, a stdio `type`.
+    // Dropped, a client that requires one would stop offering the server.
+    // Not the ways of reaching it, which are all replaced by the proxy.
+    ...Object.fromEntries(Object.entries(original).filter(([key, value]) => kept(key, value))),
+    ...command,
+    args: [...command.args, "--manifest", resolve3(manifestPath), "--server", server],
+    // The agent's environment, not ours: the upstream is started by the proxy
+    // from the manifest, but a client that set `env` here meant it for the
+    // server, and the manifest reads `${VAR}` out of exactly this environment.
+    ...original.env === void 0 ? {} : { env: original.env },
+    ...original.cwd === void 0 ? {} : { cwd: original.cwd }
+  };
+}
+var REPLACED = /* @__PURE__ */ new Set(["command", "args", "env", "cwd", "url", "serverUrl", "httpUrl", "headers"]);
+function kept(key, value) {
+  if (key === "type") {
+    return value === "stdio" || value === "local";
+  }
+  return !REPLACED.has(key);
+}
+function isWrapped(entry) {
+  const args = entry.args ?? [];
+  return args.includes("proxy") && (entry.command === "synartesis" || entry.command === "synartesis-proxy" || args.includes("synartesis") || args.some((arg) => arg.endsWith("dist/cli.js") || arg.endsWith("dist/proxy.js")));
+}
+function invokerFor(ourVersion, cliPath) {
+  if (pathBinaryMatches(ourVersion)) {
+    return { command: "synartesis", args: ["proxy"] };
+  }
+  return {
+    command: process.execPath,
+    args: [cliPath, "proxy"],
+    note: "the synartesis on your PATH is a different build, so the entries name this one directly"
+  };
+}
+function headersOf(entry) {
+  const headers = entry["headers"];
+  if (typeof headers !== "object" || headers === null || Array.isArray(headers)) {
+    return void 0;
+  }
+  const text = Object.entries(headers).filter(
+    (pair) => typeof pair[1] === "string"
+  );
+  return text.length === 0 ? void 0 : Object.fromEntries(text);
+}
+function headerVariable(server, header) {
+  const part = (text) => text.toUpperCase().replace(/[^A-Z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  const name = `${part(server)}_MCP_${part(header)}`;
+  return /^[A-Z_]/.test(name) ? name : `S_${name}`;
+}
+function transportOf(site, entry) {
+  if (entry.type === "sse") {
+    return "sse";
+  }
+  if (typeof entry["httpUrl"] === "string" || entry.type === "http" || entry.type === "streamable-http") {
+    return "http";
+  }
+  if (site.client === "gemini-cli" && typeof entry.url === "string") {
+    return "sse";
+  }
+  return "auto";
+}
+function bridgeFor(url) {
+  return { command: "npx", args: ["-y", "mcp-remote", url] };
+}
+function unbridgeable(site, entry, remote) {
+  if (site.format === "toml") {
+    return "hosted; covering one in Codex's config is not supported yet";
+  }
+  if (!remote) {
+    return "hosted; install --remote covers it through mcp-remote, which signs you in through your browser";
+  }
+  return void 0;
+}
+async function planInstall(sites, manifestPath, invoker, only, options = {}) {
+  let yaml = existsSync5(manifestPath) ? readFileSync4(manifestPath, "utf8") : void 0;
+  const plans = [];
+  const existing = yaml === void 0 ? {} : parseManifest(yaml, manifestPath).servers;
+  const claimed = new Set(Object.keys(existing));
+  const pointedAt = /* @__PURE__ */ new Set();
+  for (const site of sites) {
+    let entries;
+    try {
+      entries = serversAt(site);
+    } catch {
+      continue;
+    }
+    for (const entry of Object.values(entries)) {
+      const args = entry.args ?? [];
+      const manifest = args[args.indexOf("--manifest") + 1];
+      const server = args[args.indexOf("--server") + 1];
+      if (isWrapped(entry) && args.includes("--server") && manifest !== void 0 && server !== void 0 && resolve3(manifest) === resolve3(manifestPath)) {
+        pointedAt.add(server);
+      }
+    }
+  }
+  for (const site of sites) {
+    const servers = serversAt(site);
+    const planned = [];
+    const skipped = [];
+    for (const [name, original] of Object.entries(servers)) {
+      if (only !== void 0 && !only(site, name)) {
+        continue;
+      }
+      if (isWrapped(original)) {
+        skipped.push({ name, why: "already covered" });
+        continue;
+      }
+      const address = [original.url, original["serverUrl"], original["httpUrl"]].find(
+        (one) => typeof one === "string"
+      );
+      const hosted = original.command === void 0 && address !== void 0;
+      const headers = headersOf(original);
+      const native = hosted && headers !== void 0 && site.format !== "toml" ? {
+        url: address,
+        transport: transportOf(site, original),
+        headers: Object.fromEntries(
+          Object.keys(headers).map((header) => [header, `\${${headerVariable(name, header)}}`])
+        ),
+        env: Object.fromEntries(
+          Object.entries(headers).map(([header, value]) => [headerVariable(name, header), value])
+        )
+      } : void 0;
+      if (hosted && native === void 0) {
+        const why = unbridgeable(site, original, options.remote === true);
+        if (why !== void 0) {
+          skipped.push({ name, why });
+          continue;
+        }
+      }
+      const entry = native !== void 0 ? { ...original, env: { ...original.env ?? {}, ...native.env } } : hosted ? (options.bridge ?? bridgeFor)(address) : original;
+      if (entry.command === void 0 && native === void 0) {
+        skipped.push({ name, why: "no command to start" });
+        continue;
+      }
+      if (original.enabled === false || original.disabled === true) {
+        skipped.push({ name, why: "switched off in the config" });
+        continue;
+      }
+      if (typeof original["unreadable"] === "string") {
+        skipped.push({ name, why: `left alone: ${original["unreadable"]}. Put args on one line, or wrap it by hand` });
+        continue;
+      }
+      const again = [name, `${name}-${site.client}`].find((candidate) => {
+        const spec = existing[candidate];
+        const args = entry.args ?? [];
+        if (native !== void 0) {
+          return spec?.url === native.url && !pointedAt.has(candidate);
+        }
+        return spec !== void 0 && spec.url === void 0 && !pointedAt.has(candidate) && spec.command === entry.command && spec.args.length === args.length && spec.args.every((arg, index) => arg === args[index]);
+      });
+      if (again !== void 0) {
+        pointedAt.add(again);
+        planned.push({
+          name,
+          original,
+          wrapped: proxyEntry(manifestPath, again, entry, invoker),
+          again: true
+        });
+        continue;
+      }
+      const key = claimed.has(name) ? `${name}-${site.client}` : name;
+      if (claimed.has(key)) {
+        skipped.push({ name, why: `already in the policy as ${key}` });
+        continue;
+      }
+      if (options.start === false) {
+        claimed.add(key);
+        const known = native === void 0 ? knownPolicyFor(entry.command ?? "", entry.args ?? []) : void 0;
+        planned.push({
+          name,
+          original,
+          wrapped: proxyEntry(manifestPath, key, entry, invoker),
+          unstarted: true,
+          ...hosted && native === void 0 ? { bridged: address } : {},
+          ...native === void 0 ? {} : { direct: native.url },
+          ...known === void 0 ? {} : { adopted: known.name }
+        });
+        continue;
+      }
+      options.starting?.(name);
+      let draft;
+      try {
+        draft = await draftManifest({
+          name: key,
+          command: entry.command ?? "",
+          args: [...entry.args ?? []],
+          ...native === void 0 ? {} : { remote: { url: native.url, transport: native.transport, headers: native.headers } },
+          // As the client would start it, so a server that needs its token to
+          // list its tools is drafted rather than reported as broken.
+          env: Object.fromEntries(
+            Object.entries(entry.env ?? {}).map(([k, v]) => [k, expandForClient(site.client, v)])
+          ),
+          ...entry.cwd === void 0 ? {} : { cwd: expandForClient(site.client, entry.cwd) },
+          ...yaml === void 0 ? {} : { existing: yaml }
+        });
+      } catch (error) {
+        skipped.push({
+          name,
+          // Whole. The sentence worth reading comes last -- the server's own
+          // "Please set SLACK_BOT_TOKEN" -- and cutting at sixty characters
+          // kept only the SDK's preamble ahead of it.
+          why: `will not start: ${error instanceof Error ? error.message : String(error)}`
+        });
+        continue;
+      }
+      yaml = draft.yaml;
+      claimed.add(key);
+      planned.push({
+        name,
+        original,
+        wrapped: proxyEntry(manifestPath, key, entry, invoker),
+        ...hosted && native === void 0 ? { bridged: address } : {},
+        ...native === void 0 ? {} : { direct: native.url },
+        ...draft.adopted === void 0 ? {} : {
+          adopted: draft.adopted.server,
+          tools: draft.adopted.tools,
+          ...draft.adopted.provenance === void 0 ? {} : { provenance: draft.adopted.provenance }
+        }
+      });
+    }
+    plans.push({ site, servers: planned, skipped });
+  }
+  return { plans, yaml: yaml ?? "" };
+}
+function applyInstall(plans, manifestPath, yaml) {
+  if (!plans.some((plan) => plan.servers.length > 0)) {
+    return [];
+  }
+  parseManifest(yaml, manifestPath);
+  mkdirSync2(dirname4(resolve3(manifestPath)), { recursive: true, mode: 448 });
+  writeFileSync2(manifestPath, yaml);
+  const record = readRecord(manifestPath);
+  const wrapped = { ...record.wrapped };
+  const applied = [];
+  for (const plan of plans) {
+    if (plan.servers.length === 0) {
+      continue;
+    }
+    const servers = { ...serversAt(plan.site) };
+    for (const server of plan.servers) {
+      servers[server.name] = server.wrapped;
+      wrapped[keyFor(plan.site, server.name)] = { original: server.original, at: plan.site.at };
+    }
+    writeRecord(manifestPath, { version: 1, wrapped });
+    const backup = saveServers(plan.site, servers);
+    applied.push({ site: plan.site, backup, servers: plan.servers.map((server) => server.name) });
+  }
+  return applied;
+}
+function applyUninstall(sites, manifestPath) {
+  const record = readRecord(manifestPath);
+  const restoredKeys = /* @__PURE__ */ new Set();
+  const restored = [];
+  for (const site of sites) {
+    const servers = { ...serversAt(site) };
+    const put = [];
+    const unknown = [];
+    for (const [name, entry] of Object.entries(servers)) {
+      if (!isWrapped(entry)) {
+        continue;
+      }
+      const known = record.wrapped[keyFor(site, name)];
+      if (known === void 0) {
+        unknown.push(name);
+        continue;
+      }
+      servers[name] = known.original;
+      put.push(name);
+      restoredKeys.add(keyFor(site, name));
+    }
+    if (put.length === 0 && unknown.length === 0) {
+      continue;
+    }
+    const backup = put.length === 0 ? "" : saveServers(site, servers);
+    restored.push({ site, backup, servers: put, unknown });
+  }
+  const remaining = Object.fromEntries(
+    Object.entries(record.wrapped).filter(([key]) => !restoredKeys.has(key))
+  );
+  writeRecord(manifestPath, { version: 1, wrapped: remaining });
+  return restored;
+}
+
+// src/install/entry-env.ts
+import { resolve as resolve4 } from "path";
+function argAfter(args, flag) {
+  const at = args.indexOf(flag);
+  return at === -1 ? void 0 : args[at + 1];
+}
+function expanded(client, env) {
+  const out = {};
+  for (const [key, value] of Object.entries(env ?? {})) {
+    out[key] = expandForClient(client, value);
+  }
+  return out;
+}
+function sameEnv(a, b) {
+  const keys = Object.keys(a);
+  return keys.length === Object.keys(b).length && keys.every((key) => a[key] === b[key]);
+}
+function clientEnvFor(manifestPath, server, cwd = process.cwd()) {
+  const wanted = resolve4(manifestPath);
+  const found = [];
+  for (const site of discover(cwd)) {
+    let entries;
+    try {
+      entries = serversAt(site);
+    } catch {
+      continue;
+    }
+    for (const [name, entry] of Object.entries(entries)) {
+      if (!isWrapped(entry)) {
+        continue;
+      }
+      const args = entry.args ?? [];
+      const manifest = argAfter(args, "--manifest");
+      if (argAfter(args, "--server") !== server || manifest === void 0) {
+        continue;
+      }
+      if (resolve4(manifest) !== wanted) {
+        continue;
+      }
+      found.push({
+        env: expanded(site.client, entry.env),
+        ...entry.cwd === void 0 ? {} : { cwd: expandForClient(site.client, entry.cwd) },
+        from: `${site.label} (${site.scope}) entry ${name}`
+      });
+    }
+  }
+  const [first, ...rest] = found;
+  if (first === void 0) {
+    return void 0;
+  }
+  const differing2 = rest.filter((other) => !sameEnv(other.env, first.env) || other.cwd !== first.cwd);
+  if (differing2.length > 0) {
+    throw new ConfigError(
+      `server ${server} is wrapped by more than one client entry, with different settings: ` + [first, ...differing2].map((one) => one.from).join("; ") + `. Starting it with one of them could act on a different store from the one a session used, so it is not started.`
+    );
+  }
+  return first;
+}
+
+// src/idempotency.ts
+var IDEMPOTENCY_META_KEY = "synartesis.dev/idempotency-key";
+function withIdempotencyKey(meta, key) {
+  const merged = {};
+  if (typeof meta === "object" && meta !== null) {
+    for (const [name, value] of Object.entries(meta)) {
+      merged[name] = value;
+    }
+  }
+  merged[IDEMPOTENCY_META_KEY] = key;
+  return merged;
+}
+
+// src/proxy/snapshot.ts
+import { z as z5 } from "zod";
+var ToolResult = z5.looseObject({
+  isError: z5.boolean().default(false),
+  content: z5.array(z5.looseObject({ type: z5.string() })).default([])
+});
+function refusal2(result) {
+  const parsed = ToolResult.safeParse(result);
+  if (!parsed.success || !parsed.data.isError) {
+    return void 0;
+  }
+  const said = parsed.data.content.map((block) => typeof block["text"] === "string" ? block["text"] : "").filter((text) => text !== "").join(" ");
+  return said === "" ? JSON.stringify(result) : said;
+}
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function toPayload(result) {
-  if (!isRecord(result)) {
+  if (!isRecord3(result)) {
     return result;
   }
   const structured = result["structuredContent"];
@@ -2012,7 +3787,7 @@ function toPayload(result) {
   const content = result["content"];
   if (Array.isArray(content) && content.length === 1) {
     const block = content[0];
-    if (isRecord(block) && block["type"] === "text" && typeof block["text"] === "string") {
+    if (isRecord3(block) && block["type"] === "text" && typeof block["text"] === "string") {
       const text = block["text"];
       try {
         return JSON.parse(text);
@@ -2025,7 +3800,7 @@ function toPayload(result) {
 }
 function resolveArgs(call, context) {
   const resolved = resolveTemplate(call.args, context);
-  if (!isRecord(resolved)) {
+  if (!isRecord3(resolved)) {
     throw new ManifestError(`${call.tool} resolved to arguments that are not an object`);
   }
   return resolved;
@@ -2037,11 +3812,11 @@ function planInverse(call, context) {
   }
   return { server: target.server, tool: target.tool, args: resolveArgs(call, context) };
 }
-var resolvedRead = z4.object({
-  server: z4.string(),
-  tool: z4.string(),
-  args: z4.record(z4.string(), z4.unknown()),
-  absentWhen: z4.array(z4.string()).optional()
+var resolvedRead = z5.object({
+  server: z5.string(),
+  tool: z5.string(),
+  args: z5.record(z5.string(), z5.unknown()),
+  absentWhen: z5.array(z5.string()).optional()
 });
 function toResolvedRead(parsed) {
   return {
@@ -2080,14 +3855,15 @@ async function runRead(router, read2, signal) {
   const { tool, args } = read2;
   const ask = () => upstream.client.request(
     { method: "tools/call", params: { name: tool, arguments: args } },
-    z4.looseObject({}),
+    z5.looseObject({}),
     { signal }
   );
   let raw;
   try {
     raw = await ask();
   } catch (error) {
-    if (!isDisconnected(error) || upstream.reconnect === void 0) {
+    const lost = isDisconnected(error) || upstream.classify?.(error) === "lost";
+    if (!lost || upstream.reconnect === void 0) {
       throw new SnapshotError(label, describe(error), { cause: error });
     }
     try {
@@ -2126,10 +3902,12 @@ async function observeState(router, read2, signal) {
 
 export {
   PROXY_FLAGS,
+  SILENT,
+  desktopNotifier,
+  canNotify,
   cliCommand,
   cliCommandFrom,
   proxyCommand,
-  pathBinaryMatches,
   findManifest,
   findJournal,
   counted,
@@ -2148,19 +3926,24 @@ export {
   loadManifest,
   createPolicyResolver,
   qualify,
+  splitQualified,
+  fingerprint,
   pinBlock,
+  listAll,
   toolShapes,
   verifyAgainstServers,
+  withoutMissingTools,
   standing,
   untested,
   describeStanding,
   LIVE_IS_NOT_RECOVERY,
   warnUntested,
+  trustsMarks,
   ungoverned,
   IDEMPOTENCY_META_KEY,
   withIdempotencyKey,
   createRouter,
-  refusal,
+  refusal2 as refusal,
   toPayload,
   planInverse,
   resolvedRead,
@@ -2169,6 +3952,25 @@ export {
   isDisconnected,
   runRead,
   observeState,
-  connectStdioUpstream
+  upstreamEnv,
+  fingerprint2,
+  differing,
+  declaredNames,
+  connectUpstream,
+  startTogether,
+  startAll,
+  LOOKED_FOR,
+  CLIENT_IDS,
+  isClientId,
+  discover,
+  ConfigError,
+  serversAt,
+  draftManifest,
+  isWrapped,
+  invokerFor,
+  planInstall,
+  applyInstall,
+  applyUninstall,
+  clientEnvFor
 };
-//# sourceMappingURL=chunk-JE7MOCZO.js.map
+//# sourceMappingURL=chunk-H4SPMXQW.js.map