worktrust 0.6.7 → 0.6.10

package/session-databases.mjs

@@ -0,0 +1,308 @@
+/**
+ * THE SESSION DATABASES — the clients that keep their sessions in SQLite, read into Claude Code's shape (2026-10-05).
+ *
+ * Hermes Agent, Goose, OpenCode and OpenClaw keep no transcript file: each writes its sessions to its own SQLite
+ * database. This reads them through node:sqlite (Node 22.5+), read-only, into the same lines transcript-readers.mjs
+ * makes of the files, so the session hook's one clock reads them all. Each query takes roles, clocks, models and token
+ * counts and no text column (scripts/test-database-clients.mjs holds every query to that). It ships beside the hook,
+ * like transcript-readers.mjs; without it, or without node:sqlite, these clients are not read and nothing else changes.
+ */
+import { createRequire } from "node:module";
+import { readdirSync, statSync } from "node:fs";
+import * as zlib from "node:zlib"; // zstd since Node 22.15; older Node reads OpenClaw's uncompressed rows only
+import { homedir, platform } from "node:os";
+import { join } from "node:path";
+import { cleanModel } from "./transcript-readers.mjs";
+
+// ── hermes session reader ──
+/**
+ * HERMES AGENT, READ FROM ITS OWN DATABASE (Nous Research, 2026-10-05). Hermes keeps every session in one SQLite file
+ * per profile: `state.db` under its home (~/.hermes, %LOCALAPPDATA%/hermes on Windows, HERMES_HOME when set) and under
+ * each profile in profiles/<name>/ (hermes-agent.nousresearch.com/docs/developer-guide/session-storage, /user-guide/profiles).
+ * A session is read as a transcript: each message's role and clock, never its `content`, which this query does not
+ * select. A user message is a human turn, a tool message the loop's own result. The session's token totals ride on its
+ * last assistant message (Hermes keeps them per session, not per response). `source` says how it was steered: the
+ * terminal or the desktop app is the desk, a chat app (Telegram, WhatsApp, Slack …) is the computer driven from
+ * elsewhere. A subagent's, a scheduled job's or a board task's session has no person at the controls and its time
+ * already lies inside its parent's: it is not read. Needs node:sqlite (Node 22.5+); without it Hermes is not read.
+ */
+const HERMES_DESK = new Set(["cli", "desktop", "dashboard", "tui"]);
+const HERMES_REMOTE = new Set(["telegram", "discord", "slack", "whatsapp", "signal", "matrix", "mattermost", "email", "sms", "homeassistant", "feishu", "dingtalk", "wecom", "weixin", "bluebubbles", "qqbot"]);
+const HERMES_UNATTENDED = new Set(["subagent", "cron", "kanban"]);
+export const hermesSteered = (source) => (HERMES_DESK.has(source) ? "desk" : HERMES_REMOTE.has(source) ? "remote" : null);
+let sqlite;
+/** A database session's pseudo-file, `<client>:<database>#<session id>`, back into its parts. */
+const splitSession = (pseudo) => { const at = pseudo.lastIndexOf("#"); return { file: pseudo.slice(pseudo.indexOf(":") + 1, at), id: pseudo.slice(at + 1) }; };
+const openDatabase = (file) => {
+  if (sqlite === undefined) {
+    // node:sqlite says it is experimental on some Node versions; that line is not the person's business inside a hook.
+    const warn = process.emitWarning;
+    try { process.emitWarning = () => {}; sqlite = createRequire(import.meta.url)("node:sqlite"); } catch { sqlite = null; } finally { process.emitWarning = warn; }
+  }
+  if (!sqlite) return null;
+  try { return new sqlite.DatabaseSync(file, { readOnly: true }); } catch { return null; }
+};
+/** Hermes's homes on this machine: the default, HERMES_HOME, and every profile's. A test names its own. */
+export function hermesHomes(given) {
+  if (given) return [given.replace(/^~(?=\/|$)/, homedir())];
+  const base = platform() === "win32" && process.env.LOCALAPPDATA ? join(process.env.LOCALAPPDATA, "hermes") : join(homedir(), ".hermes");
+  const homes = new Set([base, ...(process.env.HERMES_HOME ? [process.env.HERMES_HOME] : [])]);
+  try { for (const name of readdirSync(join(base, "profiles")).sort()) homes.add(join(base, "profiles", name)); } catch { /* no profiles */ }
+  return [...homes];
+}
+export const hermesHere = () => hermesHomes().some((home) => { try { return statSync(join(home, "config.yaml")).isFile() || statSync(join(home, "state.db")).isFile(); } catch { return false; } });
+const columnsOf = (db, table) => new Set(db.prepare(`pragma table_info(${table})`).all().map((row) => row.name));
+/** Every attended session under the homes: its id, its pseudo-file, its folder and its last message's moment. */
+export function* hermesSessions(homes) {
+  for (const home of homes) {
+    const file = join(home, "state.db");
+    try { if (!statSync(file).isFile()) continue; } catch { continue; }
+    const db = openDatabase(file);
+    if (!db) continue;
+    try {
+      const has = columnsOf(db, "sessions");
+      const rows = db.prepare(`select s.id, s.source, s.parent_session_id as parent, ${has.has("cwd") ? "s.cwd" : "null"} as cwd, max(m.timestamp) as last
+        from sessions s join messages m on m.session_id = s.id group by s.id order by s.id`).all();
+      for (const row of rows) {
+        if (row.parent || HERMES_UNATTENDED.has(row.source) || !/^[A-Za-z0-9_.:-]{1,120}$/.test(String(row.id))) continue;
+        yield { sessionId: String(row.id), file: `hermes:${file}#${row.id}`, cwd: typeof row.cwd === "string" ? row.cwd : null, writtenAt: Number(row.last) * 1000 };
+      }
+    } catch { /* an older or foreign schema: not read */ } finally { db.close(); }
+  }
+}
+/** One session → lines in Claude Code's shape: roles, clocks, the model, the totals, the folder and the steering. No text. */
+export function hermesLines(pseudo) {
+  const { file, id } = splitSession(pseudo);
+  const db = openDatabase(file);
+  if (!db) return null;
+  try {
+    const has = columnsOf(db, "sessions");
+    const pick = (name) => (has.has(name) ? `${name}` : `0 as ${name}`);
+    const session = db.prepare(`select source, model, ${has.has("cwd") ? "cwd" : "null as cwd"}, ${["input_tokens", "output_tokens", "cache_read_tokens", "cache_write_tokens"].map(pick).join(", ")} from sessions where id = ?`).get(id);
+    if (!session) return [];
+    const messages = db.prepare("select role, timestamp from messages where session_id = ? and timestamp is not null order by timestamp, id").all(id);
+    const model = cleanModel(session.model);
+    const out = [{ type: "meta", ...(typeof session.cwd === "string" ? { cwd: session.cwd } : {}), steered: hermesSteered(session.source) }];
+    const lastAssistant = messages.map((m) => m.role).lastIndexOf("assistant");
+    messages.forEach((message, i) => {
+      const timestamp = new Date(Number(message.timestamp) * 1000).toISOString();
+      if (message.role === "user") out.push({ type: "user", timestamp, message: { content: [{ type: "text" }] } });
+      else if (message.role === "tool") out.push({ type: "user", timestamp, message: { content: [{ type: "tool_result" }] } });
+      else if (message.role === "assistant") out.push({ type: "assistant", timestamp, message: { model, ...(i === lastAssistant ? { usage: { input_tokens: Number(session.input_tokens) || 0, output_tokens: Number(session.output_tokens) || 0, cache_read_input_tokens: Number(session.cache_read_tokens) || 0, cache_creation_input_tokens: Number(session.cache_write_tokens) || 0 } } : {}), content: [] } });
+    });
+    return out;
+  } catch { return null; } finally { db.close(); }
+}
+// ── end hermes session reader ──
+
+// ── goose session reader ──
+/**
+ * GOOSE, READ FROM ITS OWN DATABASE (2026-10-05). Goose (aaif-goose/goose, formerly block/goose) keeps every session in
+ * one SQLite file since 1.10, `sessions/sessions.db` under its data folder (~/.local/share/goose, %APPDATA%\\Block\\goose\\data
+ * on Windows, <GOOSE_PATH_ROOT>/data when set; crates/goose/src/session/session_manager.rs, config/paths.rs). A session
+ * is read as a transcript: each message's role, its clock (`created_timestamp`, seconds) and the TYPE of each content
+ * block, read inside SQLite with json_extract so the text never leaves the database: a user message that answers a tool
+ * (`toolResponse`) is the loop, one with text or an image is the person. Tokens come from the per-call `usage_ledger`
+ * rows (model per call), each on the assistant message at or before it; without that table, the session's accumulated
+ * totals ride on its last assistant message. A subagent's, a scheduled run's or a hidden session is not read; a session
+ * through the gateway (a chat app) is steered from elsewhere, any other from the desk.
+ */
+const GOOSE_UNATTENDED = new Set(["sub_agent", "scheduled", "hidden"]);
+export const gooseSteered = (type) => (type === "gateway" ? "remote" : type ? "desk" : null);
+export function gooseHomes(given) {
+  if (given) return [given.replace(/^~(?=\/|$)/, homedir())];
+  const homes = [join(homedir(), ".local", "share", "goose"), join(homedir(), "Library", "Application Support", "Block", "goose")];
+  if (process.env.GOOSE_PATH_ROOT) homes.unshift(join(process.env.GOOSE_PATH_ROOT, "data"));
+  if (platform() === "win32" && process.env.APPDATA) homes.push(join(process.env.APPDATA, "Block", "goose", "data"));
+  return homes;
+}
+export function* gooseSessions(homes) {
+  for (const home of homes) {
+    const file = join(home, "sessions", "sessions.db");
+    try { if (!statSync(file).isFile()) continue; } catch { continue; }
+    const db = openDatabase(file);
+    if (!db) continue;
+    try {
+      const rows = db.prepare(`select s.id, s.session_type as type, s.parent_session_id as parent, s.working_dir as cwd, max(m.created_timestamp) as last
+        from sessions s join messages m on m.session_id = s.id group by s.id order by s.id`).all();
+      for (const row of rows) {
+        if (row.parent || GOOSE_UNATTENDED.has(row.type) || !/^[A-Za-z0-9_.:-]{1,120}$/.test(String(row.id))) continue;
+        const last = Number(row.last);
+        yield { sessionId: String(row.id), file: `goose:${file}#${row.id}`, cwd: typeof row.cwd === "string" ? row.cwd : null, writtenAt: (last > 1e10 ? last : last * 1000) };
+      }
+    } catch { /* an older or foreign schema: not read */ } finally { db.close(); }
+  }
+}
+export function gooseLines(pseudo) {
+  const { file, id } = splitSession(pseudo);
+  const db = openDatabase(file);
+  if (!db) return null;
+  const ms = (value) => { const n = Number(value); return n > 1e10 ? n : n * 1000; };
+  try {
+    const session = db.prepare(`select session_type as type, working_dir as cwd, json_extract(model_config_json, '$.model_name') as model,
+      accumulated_input_tokens as input, accumulated_output_tokens as output, accumulated_cache_read_tokens as cache_read, accumulated_cache_write_tokens as cache_write
+      from sessions where id = ?`).get(id);
+    if (!session) return [];
+    const messages = db.prepare(`select role, created_timestamp as at,
+      case when json_valid(content_json) then (select group_concat(json_extract(value, '$.type')) from json_each(content_json)) end as kinds
+      from messages where session_id = ? order by created_timestamp, id`).all(id);
+    const ledger = db.prepare("select 1 from sqlite_master where type = 'table' and name = 'usage_ledger'").get()
+      ? db.prepare("select created_timestamp as at, model, input_tokens as input, output_tokens as output, cache_read_tokens as cache_read, cache_write_tokens as cache_write from usage_ledger where session_id = ? order by created_timestamp, id").all(id)
+      : null;
+    const fallbackModel = cleanModel(session.model);
+    const lines = messages.map((message) => {
+      const kinds = new Set(String(message.kinds ?? "").split(","));
+      const timestamp = new Date(ms(message.at)).toISOString();
+      if (message.role === "user") return { type: "user", timestamp, message: { content: [{ type: kinds.has("toolResponse") ? "tool_result" : kinds.has("text") || kinds.has("image") ? "text" : "tool_result" }] } };
+      return { type: "assistant", timestamp, at: ms(message.at), message: { model: fallbackModel, content: [] } };
+    });
+    const assistants = lines.filter((line) => line.type === "assistant");
+    const usageOf = (row) => ({ input_tokens: Number(row.input) || 0, output_tokens: Number(row.output) || 0, cache_read_input_tokens: Number(row.cache_read) || 0, cache_creation_input_tokens: Number(row.cache_write) || 0 });
+    const add = (line, usage) => { const was = line.message.usage; line.message.usage = was ? Object.fromEntries(Object.entries(usage).map(([key, n]) => [key, n + (was[key] ?? 0)])) : usage; };
+    if (ledger) for (const row of ledger) {
+      const at = ms(row.at) + 1000;
+      const line = [...assistants].reverse().find((one) => one.at <= at) ?? assistants[0];
+      if (!line) continue;
+      add(line, usageOf(row));
+      if (cleanModel(row.model)) line.message.model = cleanModel(row.model);
+    } else if (assistants.length) add(assistants.at(-1), usageOf(session));
+    for (const line of assistants) delete line.at;
+    return [{ type: "meta", ...(typeof session.cwd === "string" ? { cwd: session.cwd } : {}), steered: gooseSteered(session.type) }, ...lines];
+  } catch { return null; } finally { db.close(); }
+}
+// ── end goose session reader ──
+
+// ── opencode session reader ──
+/**
+ * OPENCODE, READ FROM ITS OWN DATABASE (2026-10-05). OpenCode (anomalyco/opencode, formerly sst/opencode) keeps its
+ * sessions in SQLite, `opencode.db` (or `opencode-<channel>.db`) under ~/.local/share/opencode on every system
+ * (packages/core/src/database/database.ts, session/sql.ts). A message's `data` is JSON; only its role, its clock
+ * (`time.created`, ms), its model and its token counts are taken out, inside SQLite with json_extract, so no text
+ * leaves the database (text lives in the `part` table, which is never read). A subagent's session (`parent_id`) is not
+ * read. How it was steered is not said: the terminal, the desktop app and a phone on `opencode serve` look alike here.
+ */
+export function opencodeHomes(given) {
+  if (given) return [given.replace(/^~(?=\/|$)/, homedir())];
+  return [join(process.env.XDG_DATA_HOME || join(homedir(), ".local", "share"), "opencode")];
+}
+const opencodeDatabases = (home) => { try { return readdirSync(home).filter((name) => /^opencode(-[A-Za-z0-9_.-]+)?\.db$/.test(name)).sort().map((name) => join(home, name)); } catch { return []; } };
+export function* opencodeSessions(homes) {
+  for (const home of homes) for (const file of opencodeDatabases(home)) {
+    const db = openDatabase(file);
+    if (!db) continue;
+    try {
+      const rows = db.prepare(`select s.id, s.parent_id as parent, s.directory as cwd, max(m.time_created) as last
+        from session s join message m on m.session_id = s.id group by s.id order by s.id`).all();
+      for (const row of rows) {
+        if (row.parent || !/^[A-Za-z0-9_.:-]{1,120}$/.test(String(row.id))) continue;
+        yield { sessionId: String(row.id), file: `opencode:${file}#${row.id}`, cwd: typeof row.cwd === "string" ? row.cwd : null, writtenAt: Number(row.last) };
+      }
+    } catch { /* an older or foreign schema: not read */ } finally { db.close(); }
+  }
+}
+export function opencodeLines(pseudo) {
+  const { file, id } = splitSession(pseudo);
+  const db = openDatabase(file);
+  if (!db) return null;
+  try {
+    const session = db.prepare("select directory as cwd from session where id = ?").get(id);
+    if (!session) return [];
+    const messages = db.prepare(`select json_extract(data, '$.role') as role, coalesce(json_extract(data, '$.time.created'), time_created) as at,
+      json_extract(data, '$.modelID') as model, json_extract(data, '$.tokens.input') as input, json_extract(data, '$.tokens.output') as output,
+      json_extract(data, '$.tokens.reasoning') as reasoning, json_extract(data, '$.tokens.cache.read') as cache_read, json_extract(data, '$.tokens.cache.write') as cache_write
+      from message where session_id = ? order by time_created, id`).all(id);
+    const lines = messages.map((message) => {
+      const timestamp = new Date(Number(message.at)).toISOString();
+      if (message.role === "user") return { type: "user", timestamp, message: { content: [{ type: "text" }] } };
+      const counted = message.input !== null || message.output !== null;
+      return { type: "assistant", timestamp, message: { model: cleanModel(message.model), ...(counted ? { usage: { input_tokens: Number(message.input) || 0, output_tokens: (Number(message.output) || 0) + (Number(message.reasoning) || 0), cache_read_input_tokens: Number(message.cache_read) || 0, cache_creation_input_tokens: Number(message.cache_write) || 0 } } : {}), content: [] } };
+    });
+    return [{ type: "meta", ...(typeof session.cwd === "string" ? { cwd: session.cwd } : {}) }, ...lines];
+  } catch { return null; } finally { db.close(); }
+}
+// ── end opencode session reader ──
+
+// ── openclaw session reader ──
+/**
+ * OPENCLAW, READ FROM ITS OWN DATABASE (2026-10-05). OpenClaw keeps each agent's sessions in SQLite,
+ * ~/.openclaw/agents/<agentId>/agent/openclaw-agent.sqlite (OPENCLAW_STATE_DIR moves ~/.openclaw;
+ * src/state/openclaw-agent-schema.sql). A window (`session_windows`) is one session; its transcript is
+ * `transcript_events`, one JSON event per row, or the same JSON zstd-compressed when large. From a `message` event only
+ * the role, the clock (ms), the model and the usage are taken: in SQLite with json_extract for the plain rows, and in
+ * memory for a compressed row, whose text is dropped as soon as those four are read. A spawned, scheduled, plugin or
+ * internal session is not read. Steering: a Talk session (`created_via = 'talk'`) is voice; one that came through a
+ * chat channel (WhatsApp, Telegram, Slack …) is remote; the rest is not said.
+ */
+const OPENCLAW_UNATTENDED = new Set(["spawn", "cron", "plugin", "internal"]);
+const OPENCLAW_LOCAL = new Set(["webchat", "cli", "tui", "terminal", "desktop", "macos", "control-ui"]);
+export const openclawSteered = (createdVia, channel) => (createdVia === "talk" ? "voice" : channel && !OPENCLAW_LOCAL.has(String(channel).toLowerCase()) ? "remote" : null);
+export function openclawHomes(given) {
+  if (given) return [given.replace(/^~(?=\/|$)/, homedir())];
+  const base = process.env.OPENCLAW_STATE_DIR || join(homedir(), ".openclaw");
+  try { return readdirSync(join(base, "agents")).sort().map((agent) => join(base, "agents", agent, "agent")); } catch { return []; }
+}
+const msOf = (value) => { const n = Number(value); return n > 1e11 ? n : n * 1000; };
+export function* openclawSessions(homes) {
+  for (const home of homes) {
+    const file = join(home, "openclaw-agent.sqlite");
+    try { if (!statSync(file).isFile()) continue; } catch { continue; }
+    const db = openDatabase(file);
+    if (!db) continue;
+    try {
+      const rows = db.prepare(`select w.session_id as id, n.created_via as via, coalesce(w.spawned_by, w.parent_session_key, n.spawned_by, n.parent_session_key) as parent, max(e.created_at) as last
+        from session_windows w join session_nodes n on n.session_key = w.session_key join transcript_events e on e.session_id = w.session_id group by w.session_id order by w.session_id`).all();
+      for (const row of rows) {
+        if (row.parent || OPENCLAW_UNATTENDED.has(row.via) || !/^[A-Za-z0-9_.:-]{1,120}$/.test(String(row.id))) continue;
+        yield { sessionId: String(row.id), file: `openclaw:${file}#${row.id}`, cwd: null, writtenAt: msOf(row.last) };
+      }
+    } catch { /* an older or foreign schema: not read */ } finally { db.close(); }
+  }
+}
+export function openclawLines(pseudo) {
+  const { file, id } = splitSession(pseudo);
+  const db = openDatabase(file);
+  if (!db) return null;
+  try {
+    const session = db.prepare("select n.created_via as via, w.channel as channel, w.model as model from session_windows w join session_nodes n on n.session_key = w.session_key where w.session_id = ?").get(id);
+    if (!session) return [];
+    const plain = db.prepare(`select seq, json_extract(event_json, '$.message.role') as role, json_extract(event_json, '$.message.timestamp') as at, json_extract(event_json, '$.message.model') as model,
+      json_extract(event_json, '$.message.usage.input') as input, json_extract(event_json, '$.message.usage.output') as output, json_extract(event_json, '$.message.usage.cacheRead') as cache_read, json_extract(event_json, '$.message.usage.cacheWrite') as cache_write
+      from transcript_events where session_id = ? and event_json is not null and json_extract(event_json, '$.type') = 'message'`).all(id);
+    const packed = db.prepare("select seq, event_zstd as packed from transcript_events where session_id = ? and event_json is null and event_zstd is not null").all(id).map(({ seq, packed: blob }) => {
+      try {
+        const event = JSON.parse(zlib.zstdDecompressSync(Buffer.from(blob)).toString("utf8"));
+        if (event?.type !== "message") return null;
+        const { role, timestamp, model, usage } = event.message ?? {};
+        return { seq, role, at: timestamp, model, input: usage?.input ?? null, output: usage?.output ?? null, cache_read: usage?.cacheRead ?? null, cache_write: usage?.cacheWrite ?? null };
+      } catch { return null; }
+    }).filter(Boolean);
+    const lines = [...plain, ...packed].filter((event) => Number.isFinite(Number(event.at))).sort((a, b) => a.seq - b.seq).map((event) => {
+      const timestamp = new Date(msOf(event.at)).toISOString();
+      if (event.role === "user") return { type: "user", timestamp, message: { content: [{ type: "text" }] } };
+      if (event.role === "toolResult") return { type: "user", timestamp, message: { content: [{ type: "tool_result" }] } };
+      const counted = event.input !== null || event.output !== null;
+      return { type: "assistant", timestamp, message: { model: cleanModel(event.model) ?? cleanModel(session.model), ...(counted ? { usage: { input_tokens: Number(event.input) || 0, output_tokens: Number(event.output) || 0, cache_read_input_tokens: Number(event.cache_read) || 0, cache_creation_input_tokens: Number(event.cache_write) || 0 } } : {}), content: [] } };
+    });
+    return [{ type: "meta", steered: openclawSteered(session.via, session.channel) }, ...lines];
+  } catch { return null; } finally { db.close(); }
+}
+// ── end openclaw session reader ──
+
+// ── database clients ──
+/** The clients whose sessions live in a database, one registry: the hook and the counter ask it, not each client. */
+const DATABASE_CLIENTS = {
+  hermes: { homes: hermesHomes, sessions: hermesSessions, lines: hermesLines },
+  goose: { homes: gooseHomes, sessions: gooseSessions, lines: gooseLines },
+  opencode: { homes: opencodeHomes, sessions: opencodeSessions, lines: opencodeLines },
+  openclaw: { homes: openclawHomes, sessions: openclawSessions, lines: openclawLines },
+};
+export const DATABASE_SESSION = new RegExp(`^(${Object.keys(DATABASE_CLIENTS).join("|")}):.+#[A-Za-z0-9_.:-]{1,120}$`);
+/** Every attended session of every database client; `given` names a client's own home (a test), `onlyGiven` reads no other. */
+export function* databaseSessions(given = {}, onlyGiven = false) {
+  for (const [client, reader] of Object.entries(DATABASE_CLIENTS)) {
+    const homes = given[client] ? reader.homes(given[client]) : onlyGiven ? [] : reader.homes();
+    for (const session of reader.sessions(homes)) yield { client, ...session };
+  }
+}
+export const databaseLines = (pseudo) => DATABASE_CLIENTS[pseudo.slice(0, pseudo.indexOf(":"))]?.lines(pseudo) ?? null;
+// ── end database clients ──

package/setup-mcp.mjs

@@ -8,17 +8,18 @@
  *   node setup-mcp.mjs --remove --write                                             (takes it out again)
  *
  * One machine, one token, many clients: Claude Code, Cursor, Codex, Gemini CLI, VS Code's
- * Copilot agent mode, Windsurf. Each keeps its own config file in its own shape; this finds
+ * Copilot agent mode, Windsurf, Mistral Vibe, Google Antigravity, Grok Build, Zed, Cline, Hermes Agent, Goose. Each keeps its own config file in its own shape; this finds
  * the ones that exist here and adds the same WorkTrust server to each, so a coupling made once
  * counts everywhere — and every client names itself when it first speaks, which is how Sources
  * shows each product as coupled. Without --write nothing is touched. The token is shown
  * masked; it lives only in the files it is written to. A config that already names the server
  * is left as it is.
  */
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { homedir, platform } from "node:os";
 import { dirname, join } from "node:path";
+import { placeUnder, takeOut } from "./config-edits.mjs";
 
 const args = process.argv.slice(2);
 const value = (name) => { const i = args.indexOf(`--${name}`); return i >= 0 ? args[i + 1] : undefined; };
@@ -67,8 +68,109 @@ const masked = BRIDGE ? "kept in ~/.worktrust/key.json, not in these files" : `$
 const stdio = { command: NODE, args: [BRIDGE ?? "", "mcp"] };
 const home = homedir();
 /** Whether Claude Code's own command is on this machine: asked of the shell, never guessed from a file. */
-const claudeOnPath = () => spawnSync(platform() === "win32" ? "where" : "which", ["claude"], { encoding: "utf8", shell: platform() === "win32" }).status === 0;
+const onPath = (command) => spawnSync(platform() === "win32" ? "where" : "which", [command], { encoding: "utf8", shell: platform() === "win32" }).status === 0;
+const claudeOnPath = () => onPath("claude");
+const VIBE_DIR = process.env.VIBE_HOME?.trim() || join(home, ".vibe");
+const GROK_DIR = process.env.GROK_HOME?.trim() || join(home, ".grok");
+const ZED_DIR = platform() === "win32" ? join(process.env.APPDATA ?? home, "Zed") : join(home, ".config", "zed");
 const vscodeUser = platform() === "darwin" ? join(home, "Library", "Application Support", "Code", "User") : platform() === "win32" ? join(process.env.APPDATA ?? home, "Code", "User") : join(home, ".config", "Code", "User");
+const CLINE_DIR = join(vscodeUser, "globalStorage", "saoudrizwan.claude-dev", "settings");
+/**
+ * HERMES AGENT (Nous Research, 2026-10-05): `mcp_servers` in config.yaml under its home (~/.hermes, %LOCALAPPDATA%/hermes
+ * on Windows, HERMES_HOME) and under every profile's own home (profiles/<name>), `command`/`args` for a local server,
+ * `url`/`headers` for a remote one (hermes-agent.nousresearch.com/docs/user-guide/features/mcp). With the bridge it also
+ * gets one shell hook on `on_session_end` that wakes the session hook, which reads Hermes's own session database
+ * (features/hooks); Hermes asks the person once before it runs a new hook. YAML is edited line by line and only in
+ * block style: a file whose sections are written inline is left alone and the entry printed to add by hand.
+ */
+const HERMES_BASE = platform() === "win32" && process.env.LOCALAPPDATA ? join(process.env.LOCALAPPDATA, "hermes") : join(home, ".hermes");
+const hermesHomes = () => {
+  const homes = new Set([HERMES_BASE, ...(process.env.HERMES_HOME ? [process.env.HERMES_HOME] : [])]);
+  try { for (const name of readdirSync(join(HERMES_BASE, "profiles")).sort()) homes.add(join(HERMES_BASE, "profiles", name)); } catch { /* no profiles */ }
+  return [...homes].filter((dir) => existsSync(dir));
+};
+const HERMES_HOOK = `"${NODE}" "${BRIDGE ?? ""}" hook --hermes`;
+const ours = (text) => text.includes(URL_) || /worktrust\.mjs/.test(text);
+/** A YAML client's file with our entry (and hook) taken out and, unless removing, put back in; null when it cannot be. */
+function yamlConfig(client, text, remove) {
+  const lines = text.trim() === "" ? [] : text.replace(/\n$/, "").split("\n");
+  takeOut(lines, [client.root], (unit) => new RegExp(`^\\s*${NAME}:`).test(unit) || ours(unit));
+  if (client.hook) takeOut(lines, client.hook.path, ours);
+  if (!remove) {
+    if (!placeUnder(lines, [client.root], client.server)) return null;
+    if (client.hook && BRIDGE && !placeUnder(lines, client.hook.path, client.hook.unit)) return null;
+  }
+  return lines.length ? `${lines.join("\n")}\n` : "";
+}
+const bridgeOrUrl = (local, remote) => (BRIDGE ? local : remote);
+const HERMES_SERVER = bridgeOrUrl([`${NAME}:`, `  command: ${JSON.stringify(NODE)}`, `  args: [${JSON.stringify(BRIDGE)}, "mcp"]`], [`${NAME}:`, `  url: ${JSON.stringify(URL_)}`, "  headers:", `    Authorization: ${JSON.stringify(`Bearer ${TOKEN}`)}`]);
+/**
+ * GOOSE (2026-10-05, aaif-goose/goose: crates/goose/src/config/extensions.rs, agents/extension.rs; documentation
+ * guides/config-files.md): `extensions` in config.yaml (~/.config/goose, %APPDATA%\\Block\\goose\\config on Windows,
+ * <GOOSE_PATH_ROOT>/config), each entry `type: stdio` with `cmd` and `args`, or `type: streamable_http` with `uri` and
+ * `headers`. Its hooks come from Open Plugins folders (~/.agents/plugins/<name>/plugin.json + hooks/hooks.json,
+ * guides/context-engineering/hooks.md); with the bridge one plugin named worktrust runs the session hook on SessionEnd.
+ */
+const GOOSE_SERVER = bridgeOrUrl(
+  [`${NAME}:`, "  type: stdio", `  name: ${NAME}`, "  enabled: true", `  cmd: ${JSON.stringify(NODE)}`, `  args: [${JSON.stringify(BRIDGE)}, "mcp"]`, "  envs: {}", "  timeout: 300"],
+  [`${NAME}:`, "  type: streamable_http", `  name: ${NAME}`, "  enabled: true", `  uri: ${JSON.stringify(URL_)}`, "  headers:", `    Authorization: ${JSON.stringify(`Bearer ${TOKEN}`)}`, "  envs: {}", "  timeout: 300"],
+);
+const gooseDirs = () => [...new Set([...(process.env.GOOSE_PATH_ROOT ? [join(process.env.GOOSE_PATH_ROOT, "config")] : []), join(home, ".config", "goose"), ...(platform() === "win32" && process.env.APPDATA ? [join(process.env.APPDATA, "Block", "goose", "config")] : [])])].filter((dir) => existsSync(dir));
+const GOOSE_PLUGIN = join(process.env.GOOSE_PATH_ROOT || home, ".agents", "plugins", NAME);
+const GOOSE_HOOKS = { hooks: { SessionEnd: [{ hooks: [{ type: "command", command: `"${NODE}" "${BRIDGE ?? ""}" hook --goose`, timeout: 30 }] }] } };
+const goosePluginStands = () => { try { return JSON.stringify(JSON.parse(readFileSync(join(GOOSE_PLUGIN, "hooks", "hooks.json"), "utf8"))) === JSON.stringify(GOOSE_HOOKS); } catch { return false; } };
+/** Our plugin folder in, or out; another plugin is never touched, and a folder of that name that is not ours stays. */
+function goosePlugin(remove) {
+  let manifest = null; try { manifest = JSON.parse(readFileSync(join(GOOSE_PLUGIN, "plugin.json"), "utf8")); } catch { /* none */ }
+  if (existsSync(GOOSE_PLUGIN) && manifest?.description !== GOOSE_DESCRIPTION) return false;
+  if (remove) { rmSync(GOOSE_PLUGIN, { recursive: true, force: true }); return true; }
+  mkdirSync(join(GOOSE_PLUGIN, "hooks"), { recursive: true });
+  writeFileSync(join(GOOSE_PLUGIN, "plugin.json"), `${JSON.stringify({ name: NAME, version: "1.0.0", description: GOOSE_DESCRIPTION }, null, 2)}\n`);
+  writeFileSync(join(GOOSE_PLUGIN, "hooks", "hooks.json"), `${JSON.stringify(GOOSE_HOOKS, null, 2)}\n`);
+  return true;
+}
+const GOOSE_DESCRIPTION = "WorkTrust: wakes the WorkTrust session hook when a goose session ends (counts only, never content).";
+
+/**
+ * OPENCODE (2026-10-05, anomalyco/opencode: packages/core/src/v1/config/mcp.ts, opencode.ai/docs/mcp-servers): `mcp` in
+ * ~/.config/opencode/opencode.json(c) (XDG_CONFIG_HOME moves it), `type: "local"` with `command` as one array, or
+ * `type: "remote"` with `url` and `headers`. A file with comments is left alone, as for Zed. With the bridge one plugin
+ * file, plugin/worktrust.js, wakes the session hook when a session goes idle (opencode.ai/docs/plugins: `session.idle`).
+ */
+const OPENCODE_DIR = join(process.env.XDG_CONFIG_HOME || join(home, ".config"), "opencode");
+const OPENCODE_FILE = ["opencode.jsonc", "opencode.json", "config.json"].map((name) => join(OPENCODE_DIR, name)).find((file) => existsSync(file)) ?? join(OPENCODE_DIR, "opencode.json");
+const OPENCODE_PLUGIN = join(OPENCODE_DIR, "plugin", `${NAME}.js`);
+const OPENCODE_MARK = "// WorkTrust: wakes the WorkTrust session hook when an OpenCode session goes idle (counts only, never content).";
+const OPENCODE_PLUGIN_TEXT = `${OPENCODE_MARK}
+import { spawn } from "node:child_process";
+let last = 0;
+export const WorkTrust = async () => ({
+  event: async ({ event }) => {
+    if (event?.type !== "session.idle" || Date.now() - last < 30_000) return;
+    last = Date.now();
+    try { spawn(${JSON.stringify(NODE)}, [${JSON.stringify(BRIDGE ?? "")}, "hook"], { detached: true, stdio: "ignore" }).unref(); } catch { /* the next run sweeps it */ }
+  },
+});
+`;
+/** Our plugin file in, or out; a file of that name that is not ours stays. */
+function opencodePlugin(remove) {
+  let text = null; try { text = readFileSync(OPENCODE_PLUGIN, "utf8"); } catch { /* none */ }
+  if (text !== null && !text.startsWith(OPENCODE_MARK)) return false;
+  if (remove) { rmSync(OPENCODE_PLUGIN, { force: true }); return true; }
+  mkdirSync(dirname(OPENCODE_PLUGIN), { recursive: true });
+  writeFileSync(OPENCODE_PLUGIN, OPENCODE_PLUGIN_TEXT);
+  return true;
+}
+const opencodePluginStands = () => { try { return readFileSync(OPENCODE_PLUGIN, "utf8") === OPENCODE_PLUGIN_TEXT; } catch { return false; } };
+/**
+ * OPENCLAW (2026-10-05, openclaw/openclaw: docs/cli/mcp/registry.md, transports.md): its servers live under `mcp.servers`
+ * in ~/.openclaw/openclaw.json, a JSON5 file OpenClaw replaces atomically, so it is never edited here: `openclaw mcp set
+ * <name> <json>` writes the entry and `openclaw mcp unset <name>` takes it out (config only, no connection is made).
+ * Without the `openclaw` command on this machine's PATH the command is printed to run. OpenClaw runs no shell hook; its
+ * sessions are read whenever another client's hook runs.
+ */
+const OPENCLAW_FILE = process.env.OPENCLAW_CONFIG_PATH || join(process.env.OPENCLAW_STATE_DIR || join(home, ".openclaw"), "openclaw.json");
+const OPENCLAW_ENTRY = BRIDGE ? { command: NODE, args: [BRIDGE, "mcp"] } : { url: URL_, transport: "streamable-http", headers: { Authorization: `Bearer ${TOKEN}` } };
 
 /** Each client: where it lives, how it says "an HTTP MCP server with a header". */
 const CLIENTS = [
@@ -77,6 +179,25 @@ const CLIENTS = [
   { key: "gemini", label: "Gemini CLI", present: () => existsSync(join(home, ".gemini")), file: join(home, ".gemini", "settings.json"), shape: "json", root: "mcpServers", entry: BRIDGE ? stdio : { httpUrl: URL_, headers: { Authorization: `Bearer ${TOKEN}` } } },
   { key: "copilot", label: "VS Code (Copilot agent mode)", present: () => existsSync(vscodeUser), file: join(vscodeUser, "mcp.json"), shape: "json", root: "servers", entry: BRIDGE ? { type: "stdio", ...stdio } : { type: "http", url: URL_, headers: { Authorization: `Bearer ${TOKEN}` } } },
   { key: "windsurf", label: "Windsurf", present: () => existsSync(join(home, ".codeium", "windsurf")), file: join(home, ".codeium", "windsurf", "mcp_config.json"), shape: "json", root: "mcpServers", entry: BRIDGE ? stdio : { serverUrl: URL_, headers: { Authorization: `Bearer ${TOKEN}` } } },
+  // MISTRAL VIBE (2026-10-04, docs.mistral.ai/vibe/code/cli/mcp-servers): `[[mcp_servers]]` tables in
+  // ~/.vibe/config.toml (or $VIBE_HOME), each with a name, a transport and a url or a command.
+  { key: "vibe", label: "Mistral Vibe", present: () => existsSync(VIBE_DIR), file: join(VIBE_DIR, "config.toml"), shape: "vibe", block: BRIDGE ? `\n[[mcp_servers]]\nname = "${NAME}"\ntransport = "stdio"\ncommand = ${JSON.stringify(NODE)}\nargs = [${JSON.stringify(BRIDGE)}, "mcp"]\n` : `\n[[mcp_servers]]\nname = "${NAME}"\ntransport = "streamable-http"\nurl = "${URL_}"\nheaders = { "Authorization" = "Bearer ${TOKEN}" }\n` },
+  // GOOGLE ANTIGRAVITY (2026-10-04, antigravity.google/docs/mcp/): the 2.0 app, the `agy` CLI and the IDE read
+  // ~/.gemini/config/mcp_config.json; a remote server is `serverUrl` with headers (`url` and `httpUrl` are not
+  // read), a local one `command` and `args`. Present when its config folder or one of its data folders is here.
+  { key: "antigravity", label: "Antigravity", present: () => existsSync(join(home, ".gemini", "config")) || (() => { try { return readdirSync(join(home, ".gemini")).some((name) => /^antigravity/.test(name)); } catch { return false; } })(), file: join(home, ".gemini", "config", "mcp_config.json"), shape: "json", root: "mcpServers", entry: BRIDGE ? stdio : { serverUrl: URL_, headers: { Authorization: `Bearer ${TOKEN}` } } },
+  // GROK BUILD (2026-10-04, docs.x.ai/build/settings/reference): `[mcp_servers.<name>]` in ~/.grok/config.toml (or
+  // $GROK_HOME), `url` and `headers` for a remote server, `command` and `args` for a local one.
+  { key: "grok", label: "Grok Build", present: () => existsSync(GROK_DIR), file: join(GROK_DIR, "config.toml"), shape: "toml", block: BRIDGE ? `\n[mcp_servers.${NAME}]\ncommand = ${JSON.stringify(NODE)}\nargs = [${JSON.stringify(BRIDGE)}, "mcp"]\n` : `\n[mcp_servers.${NAME}]\nurl = "${URL_}"\nheaders = { Authorization = "Bearer ${TOKEN}" }\n` },
+  // ZED (zed.dev/docs/ai/mcp): `context_servers` in its settings.json, `url` and `headers` for a remote server.
+  { key: "zed", label: "Zed", present: () => existsSync(ZED_DIR), file: join(ZED_DIR, "settings.json"), shape: "json", root: "context_servers", entry: BRIDGE ? { ...stdio, env: {} } : { url: URL_, headers: { Authorization: `Bearer ${TOKEN}` } } },
+  // CLINE (docs.cline.bot/mcp): `mcpServers` in the extension's cline_mcp_settings.json; `type` must be
+  // "streamableHttp" exactly, or Cline falls back to SSE and the door answers 405.
+  { key: "cline", label: "Cline (VS Code)", present: () => existsSync(CLINE_DIR), file: join(CLINE_DIR, "cline_mcp_settings.json"), shape: "json", root: "mcpServers", entry: BRIDGE ? { ...stdio, disabled: false } : { type: "streamableHttp", url: URL_, headers: { Authorization: `Bearer ${TOKEN}` }, disabled: false } },
+  ...hermesHomes().map((dir) => ({ key: "hermes", label: dir === HERMES_BASE ? "Hermes Agent" : `Hermes Agent (${dir.split(/[\\/]/).pop()})`, present: () => true, file: join(dir, "config.yaml"), shape: "yaml", root: "mcp_servers", server: HERMES_SERVER, hook: { path: ["hooks", "on_session_end"], unit: [`- command: ${JSON.stringify(HERMES_HOOK)}`, "  timeout: 30"], note: "an on_session_end hook (Hermes asks once before it runs it)" } })),
+  ...gooseDirs().map((dir) => ({ key: "goose", label: "Goose", present: () => true, file: join(dir, "config.yaml"), shape: "yaml", root: "extensions", server: GOOSE_SERVER, plugin: true })),
+  { key: "opencode", label: "OpenCode", present: () => existsSync(OPENCODE_DIR), file: OPENCODE_FILE, shape: "json", root: "mcp", entry: BRIDGE ? { type: "local", command: [NODE, BRIDGE, "mcp"], enabled: true } : { type: "remote", url: URL_, headers: { Authorization: `Bearer ${TOKEN}` }, enabled: true }, plugin: "opencode" },
+  { key: "openclaw", label: "OpenClaw", present: () => existsSync(dirname(OPENCLAW_FILE)) || onPath("openclaw"), file: OPENCLAW_FILE, shape: "openclaw" },
   { key: "claude", label: "Claude Code", present: () => existsSync(join(home, ".claude.json")), file: join(home, ".claude.json"), shape: "claude" },
 ];
 
@@ -85,6 +206,19 @@ let touched = 0;
 let standing = 0;
 for (const client of CLIENTS) {
   if (!client.present()) { console.log(`  – ${client.label}: not on this machine`); continue; }
+  if (client.shape === "openclaw") {
+    const text = existsSync(client.file) ? readFileSync(client.file, "utf8") : "";
+    const named = new RegExp(`["']?${NAME}["']?\\s*:\\s*\\{`).test(text) && ours(text);
+    const verb = REMOVE ? ["mcp", "unset", NAME] : ["mcp", "set", NAME, JSON.stringify(OPENCLAW_ENTRY)];
+    const shown = `openclaw ${verb.slice(0, 3).join(" ")}${REMOVE ? "" : ` '${JSON.stringify(OPENCLAW_ENTRY).replace(/Bearer [^"]+/, "Bearer <token>")}'`}`;
+    if (REMOVE ? !named : named && text.includes(JSON.stringify(BRIDGE ?? URL_).slice(1, -1)) && (BRIDGE === undefined || !text.includes(URL_))) { console.log(REMOVE ? `  – ${client.label}: does not name the door` : `  ✓ ${client.label}: already names the door (${client.file})`); if (!REMOVE) standing += 1; continue; }
+    if (!WRITE) { console.log(`  ${REMOVE ? "−" : "+"} ${client.label}: would run ${shown}`); continue; }
+    if (!onPath("openclaw")) { console.log(`  ! ${client.label}: the \`openclaw\` command is not on this machine's PATH; run ${shown}`); continue; }
+    const run = spawnSync("openclaw", verb, { encoding: "utf8", shell: platform() === "win32" });
+    if (run.status === 0) { console.log(`  ${REMOVE ? "−" : "+"} ${client.label}: ${REMOVE ? "removed" : "coupled"} through \`openclaw mcp ${REMOVE ? "unset" : "set"}\``); touched += 1; }
+    else console.log(`  ! ${client.label}: \`openclaw mcp\` refused (${(run.stderr || run.stdout || "").trim().split("\n")[0] || "no output"}); run it yourself: ${shown}`);
+    continue;
+  }
   if (client.shape === "claude") {
     // Claude Code owns this file and has its own verb for it, so this never edits the file: it RUNS
     // the verb when the `claude` command is on this machine (2026-09-28; before, the line was only
@@ -112,7 +246,7 @@ for (const client of CLIENTS) {
   }
   const text = existsSync(client.file) ? readFileSync(client.file, "utf8") : "";
   // With the bridge, coupled means the bridge is in AND no entry with a key in it is left beside it.
-  const already = REMOVE ? text.includes(URL_) || /worktrust\.mjs/.test(text) : BRIDGE !== undefined ? text.includes(JSON.stringify(BRIDGE).slice(1, -1)) && !text.includes(URL_) : text.includes(URL_);
+  const already = client.shape === "yaml" && !REMOVE ? (BRIDGE !== undefined ? text.includes(JSON.stringify(BRIDGE)) && (!client.plugin || goosePluginStands()) : text.includes(URL_)) && yamlConfig(client, text, false) === text : REMOVE ? text.includes(URL_) || /worktrust\.mjs/.test(text) : BRIDGE !== undefined ? text.includes(JSON.stringify(BRIDGE).slice(1, -1)) && !text.includes(URL_) : text.includes(URL_);
   // THE WAY OUT, ON THE MACHINE. Uncoupling in the app ends the TOKEN; the config that names the
   // door stays behind on every client here, so the next person to read this file believes the
   // machine is coupled. `--remove` takes the entry out; the account side is a separate act and
@@ -121,15 +255,27 @@ for (const client of CLIENTS) {
     if (!already) { console.log(`  – ${client.label}: does not name the door`); continue; }
     if (client.shape === "json") {
       let config = {};
-      try { config = JSON.parse(readFileSync(client.file, "utf8")); } catch { config = {}; }
+      // A file that does not parse (comments, a trailing comma: Zed and VS Code allow both) is never rewritten.
+      try { config = JSON.parse(readFileSync(client.file, "utf8")); } catch { console.log(`  ! ${client.label}: ${client.file} is not plain JSON; take the "${NAME}" entry out by hand`); continue; }
       const root = config[client.root] ?? {};
       for (const [key, entry] of Object.entries(root)) {
         const named = JSON.stringify(entry ?? {}).includes(URL_) || /worktrust\.mjs/.test(JSON.stringify(entry ?? {}));
         if (key === NAME || named) delete root[key];
       }
       config[client.root] = root;
+      console.log(`  − ${client.label}: ${WRITE ? "removed from" : "would remove from"} ${client.file}${client.plugin && existsSync(OPENCODE_PLUGIN) ? ` and ${OPENCODE_PLUGIN}` : ""}`);
+      if (WRITE) { writeFileSync(client.file, JSON.stringify(config, null, 2) + "\n"); if (client.plugin) opencodePlugin(true); }
+    } else if (client.shape === "yaml") {
+      const next = yamlConfig(client, readFileSync(client.file, "utf8"), true);
+      console.log(`  − ${client.label}: ${WRITE ? "removed from" : "would remove from"} ${client.file}${client.plugin && existsSync(GOOSE_PLUGIN) ? ` and ${GOOSE_PLUGIN}` : ""}`);
+      if (WRITE) { writeFileSync(client.file, next); if (client.plugin) goosePlugin(true); }
+    } else if (client.shape === "vibe") {
+      // Vibe's servers are an ARRAY of tables, so a block is found by what it says, not by its header: every
+      // `[[mcp_servers]]` that names ours, the door, or the bridge goes, up to the next header at a line start.
+      const text = readFileSync(client.file, "utf8");
+      const stripped = text.replace(/\n?\[\[mcp_servers\]\][\s\S]*?(?=\n\[|$)/g, (block) => (block.includes(`name = "${NAME}"`) || block.includes(URL_) || /worktrust\.mjs/.test(block) ? "" : block));
       console.log(`  − ${client.label}: ${WRITE ? "removed from" : "would remove from"} ${client.file}`);
-      if (WRITE) writeFileSync(client.file, JSON.stringify(config, null, 2) + "\n");
+      if (WRITE) writeFileSync(client.file, stripped);
     } else if (client.shape === "toml") {
       const text = readFileSync(client.file, "utf8");
       // The block and nothing after it: from its own header to the next one, or the end.
@@ -143,15 +289,34 @@ for (const client of CLIENTS) {
     touched += 1;
     continue;
   }
-  if (already) { console.log(`  ✓ ${client.label}: already names the door (${client.file})`); standing += 1; continue; }
+  if (already && !(client.plugin === "opencode" && BRIDGE && !opencodePluginStands())) { console.log(`  ✓ ${client.label}: already names the door (${client.file})`); standing += 1; continue; }
   if (client.shape === "json") {
     let config = {};
-    try { config = JSON.parse(readFileSync(client.file, "utf8")); } catch { config = {}; }
+    // NEVER OVERWRITE WHAT DOES NOT PARSE (2026-10-04): Zed's and VS Code's settings allow comments and trailing
+    // commas, and reading such a file as empty would write the person's settings away. An empty or absent file is
+    // a new one; anything else that fails to parse is left alone and the entry is printed to add by hand.
+    const raw = existsSync(client.file) ? readFileSync(client.file, "utf8") : "";
+    try { config = raw.trim() ? JSON.parse(raw) : {}; } catch {
+      console.log(`  ! ${client.label}: ${client.file} is not plain JSON (comments?), so it is left as it is. Add this under "${client.root}" yourself:\n    "${NAME}": ${JSON.stringify(client.entry).replace(/Bearer [^"]+/, "Bearer <token>")}`);
+      continue;
+    }
     config[client.root] = { ...(config[client.root] ?? {}), [NAME]: client.entry };
-    console.log(`  + ${client.label}: ${WRITE ? "wrote" : "would write"} ${client.file} → ${client.root}.${NAME}`);
-    if (WRITE) { mkdirSync(dirname(client.file), { recursive: true }); writeFileSync(client.file, JSON.stringify(config, null, 2) + "\n"); touched += 1; }
-  } else if (client.shape === "toml") {
-    console.log(`  + ${client.label}: ${WRITE ? "appended to" : "would append to"} ${client.file} → [mcp_servers.${NAME}]`);
+    console.log(`  + ${client.label}: ${WRITE ? "wrote" : "would write"} ${client.file} → ${client.root}.${NAME}${client.plugin && BRIDGE ? ` and ${OPENCODE_PLUGIN}` : ""}`);
+    if (WRITE) {
+      mkdirSync(dirname(client.file), { recursive: true }); writeFileSync(client.file, JSON.stringify(config, null, 2) + "\n"); touched += 1;
+      if (client.plugin && BRIDGE && !opencodePlugin(false)) console.log(`  ! ${client.label}: ${OPENCODE_PLUGIN} exists and is not WorkTrust's, so no plugin was written; OpenCode sessions are still read whenever another hook runs`);
+    }
+  } else if (client.shape === "yaml") {
+    const next = yamlConfig(client, text, false);
+    if (next === null) { console.log(`  ! ${client.label}: ${client.file} writes ${client.root}${client.hook ? " or hooks" : ""} inline, so it is left as it is. Add under ${client.root}:\n    ${client.server.join("\n    ")}`); continue; }
+    const hookNote = !BRIDGE ? "" : client.hook ? ` and ${client.hook.note}` : client.plugin ? ` and a SessionEnd hook in ${GOOSE_PLUGIN}` : "";
+    console.log(`  + ${client.label}: ${WRITE ? "wrote" : "would write"} ${client.file} → ${client.root}.${NAME}${hookNote}`);
+    if (WRITE) {
+      mkdirSync(dirname(client.file), { recursive: true }); writeFileSync(client.file, next); touched += 1;
+      if (client.plugin && BRIDGE && !goosePlugin(false)) console.log(`  ! ${client.label}: ${GOOSE_PLUGIN} exists and is not WorkTrust's, so no hook was written; goose sessions are still read whenever another hook runs`);
+    }
+  } else if (client.shape === "toml" || client.shape === "vibe") {
+    console.log(`  + ${client.label}: ${WRITE ? "appended to" : "would append to"} ${client.file} → ${client.shape === "vibe" ? `[[mcp_servers]] name = "${NAME}"` : `[mcp_servers.${NAME}]`}`);
     if (WRITE) { mkdirSync(dirname(client.file), { recursive: true }); writeFileSync(client.file, (existsSync(client.file) ? readFileSync(client.file, "utf8") : "") + client.block); touched += 1; }
   }
 }