zelari-code 2.20.0 → 2.21.0

package/dist/cli/main.bundled.js

@@ -55304,39 +55304,224 @@ var init_toolRegistry2 = __esm({
   }
 });
 
+// src/cli/mcp/httpTransport.ts
+var SSE_DATA_RE, ABORT_GRACE_MS, McpHttpTransport;
+var init_httpTransport = __esm({
+  "src/cli/mcp/httpTransport.ts"() {
+    "use strict";
+    SSE_DATA_RE = /^data:\s?(.*)$/;
+    ABORT_GRACE_MS = 250;
+    McpHttpTransport = class {
+      constructor(opts) {
+        this.opts = opts;
+      }
+      sessionId = null;
+      closed = false;
+      reinit = null;
+      controllers = /* @__PURE__ */ new Set();
+      get hasSession() {
+        return this.sessionId !== null;
+      }
+      /**
+       * Deliver one JSON-RPC message. Resolves once the response (if any) has
+       * been fed to onMessage. Transport-level failures are converted into
+       * JSON-RPC error responses so the client's pending map rejects cleanly
+       * through the same pump used for stdio.
+       */
+      async send(msg, timeoutMs2) {
+        if (this.closed) throw new Error(`[mcp:${this.opts.serverName}] transport closed`);
+        try {
+          await this.post(msg, timeoutMs2, false);
+        } catch (err) {
+          if (msg.id !== void 0) {
+            this.opts.onMessage({
+              jsonrpc: "2.0",
+              id: msg.id,
+              error: {
+                code: -32e3,
+                message: err instanceof Error ? err.message : String(err)
+              }
+            });
+          }
+        }
+      }
+      /** Best-effort session teardown (HTTP DELETE), then abort in-flight POSTs. */
+      close() {
+        this.closed = true;
+        for (const ac of this.controllers) ac.abort();
+        this.controllers.clear();
+        const sid = this.sessionId;
+        this.sessionId = null;
+        if (!sid) return;
+        const headers2 = {
+          ...this.opts.headers ?? {},
+          "mcp-session-id": sid
+        };
+        void fetch(this.opts.url, { method: "DELETE", headers: headers2 }).catch(() => {
+        });
+      }
+      // ── internals ────────────────────────────────────────────────────────
+      async post(msg, timeoutMs2, replayed) {
+        const ac = new AbortController();
+        this.controllers.add(ac);
+        const timer = setTimeout(() => ac.abort(), timeoutMs2 + ABORT_GRACE_MS);
+        const hadSession = this.sessionId !== null;
+        try {
+          const headers2 = {
+            "content-type": "application/json",
+            accept: "application/json, text/event-stream",
+            ...this.opts.headers ?? {}
+          };
+          if (this.sessionId) headers2["mcp-session-id"] = this.sessionId;
+          const res = await fetch(this.opts.url, {
+            method: "POST",
+            headers: headers2,
+            signal: ac.signal,
+            body: JSON.stringify({ jsonrpc: "2.0", ...msg })
+          });
+          const sid = res.headers.get("mcp-session-id");
+          if (sid) this.sessionId = sid;
+          if (res.status === 404 && hadSession && !replayed && msg.id !== void 0) {
+            this.sessionId = null;
+            await this.ensureSession();
+            return this.post(msg, timeoutMs2, true);
+          }
+          if (!res.ok && res.status !== 202) {
+            throw new Error(`HTTP ${res.status} ${res.statusText}`.trim());
+          }
+          if (msg.id === void 0) {
+            await res.body?.cancel();
+            return;
+          }
+          const contentType = res.headers.get("content-type") ?? "";
+          if (contentType.includes("text/event-stream")) {
+            await this.readSse(res);
+          } else {
+            const body = await res.text();
+            if (body) this.opts.onMessage(JSON.parse(body));
+          }
+        } finally {
+          clearTimeout(timer);
+          this.controllers.delete(ac);
+        }
+      }
+      /** Dedupe concurrent session-loss recoveries into one handshake. */
+      async ensureSession() {
+        if (!this.reinit) {
+          this.reinit = this.opts.onSessionLost().finally(() => {
+            this.reinit = null;
+          }).catch(() => {
+          });
+        }
+        await this.reinit;
+      }
+      /** Minimal SSE reader: dispatch complete `data:` events to onMessage. */
+      async readSse(res) {
+        const reader = res.body?.getReader();
+        if (!reader) return;
+        const decoder = new TextDecoder();
+        let buf = "";
+        let data = "";
+        const dispatch = () => {
+          const payload = data.trim();
+          data = "";
+          if (!payload) return;
+          try {
+            this.opts.onMessage(JSON.parse(payload));
+          } catch {
+          }
+        };
+        for (; ; ) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          buf += decoder.decode(value, { stream: true });
+          let nl;
+          while ((nl = buf.indexOf("\n")) >= 0) {
+            const line = buf.slice(0, nl).replace(/\r$/, "");
+            buf = buf.slice(nl + 1);
+            if (line === "") {
+              dispatch();
+              continue;
+            }
+            const m = SSE_DATA_RE.exec(line);
+            if (m) data += (data ? "\n" : "") + m[1];
+          }
+        }
+        dispatch();
+      }
+    };
+  }
+});
+
 // src/cli/mcp/mcpClient.ts
 import { spawn as spawn14 } from "node:child_process";
-var DEFAULT_REQUEST_TIMEOUT_MS, INIT_TIMEOUT_MS, MCP_PROTOCOL_VERSION, McpClient;
+var DEFAULT_REQUEST_TIMEOUT_MS, INIT_TIMEOUT_MS, MAX_LIST_PAGES, MCP_PROTOCOL_VERSION, McpClient;
 var init_mcpClient = __esm({
   "src/cli/mcp/mcpClient.ts"() {
     "use strict";
     init_cmdline();
     init_updater();
+    init_httpTransport();
     DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
     INIT_TIMEOUT_MS = 15e3;
+    MAX_LIST_PAGES = 50;
     MCP_PROTOCOL_VERSION = "2025-03-26";
     McpClient = class {
       constructor(serverName, config2) {
         this.serverName = serverName;
         this.config = config2;
+        this.defaultTimeoutMs = config2.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+        this.serial = config2.serial ?? this.transportKind() === "http";
       }
       child = null;
+      transport = null;
       nextId = 1;
       pending = /* @__PURE__ */ new Map();
       stdoutBuffer = "";
       closed = false;
-      /** Spawn the server process and run the MCP initialize handshake. */
+      /** Tail of the serial queue (config.serial); requests run one at a time. */
+      queueTail = Promise.resolve();
+      /** True while the 404-recovery handshake runs: bypasses the serial queue
+       *  (the queued request that triggered the 404 is waiting on this handshake). */
+      recovering = false;
+      serial;
+      defaultTimeoutMs;
+      transportKind() {
+        if (this.config.type) return this.config.type;
+        return this.config.url && !this.config.command ? "http" : "stdio";
+      }
+      /** Connect (spawn / HTTP session) and run the MCP initialize handshake. */
       async start() {
-        if (this.child) return;
+        if (this.child || this.transport) return;
+        if (this.transportKind() === "http") {
+          const url2 = this.config.url;
+          if (!url2) {
+            throw new Error(`[mcp:${this.serverName}] http server requires a url`);
+          }
+          this.transport = new McpHttpTransport({
+            serverName: this.serverName,
+            url: url2,
+            // env may carry an explicit Authorization header for remote servers.
+            headers: this.config.env?.AUTHORIZATION ? { Authorization: this.config.env.AUTHORIZATION } : void 0,
+            onMessage: (msg) => this.handleMessage(msg),
+            onSessionLost: () => this.handshake()
+          });
+          await this.handshake();
+          return;
+        }
+        const command = this.config.command;
+        if (!command) {
+          throw new Error(`[mcp:${this.serverName}] stdio server requires a command`);
+        }
         const spawnOpts = {
           stdio: ["pipe", "pipe", "pipe"],
           env: { ...process.env, ...this.config.env ?? {} },
           windowsHide: true
         };
-        const child = process.platform === "win32" ? spawn14(buildCmdLine(this.config.command, this.config.args ?? []), {
+        const child = process.platform === "win32" ? spawn14(buildCmdLine(command, this.config.args ?? []), {
           ...spawnOpts,
           shell: true
-        }) : spawn14(this.config.command, this.config.args ?? [], spawnOpts);
+        }) : spawn14(command, this.config.args ?? [], spawnOpts);
         this.child = child;
         child.stdout.setEncoding("utf8");
         child.stdout.on("data", (chunk) => this.onStdout(chunk));
@@ -55355,37 +55540,60 @@ var init_mcpClient = __esm({
             );
           }
         });
-        await this.request(
-          "initialize",
-          {
-            protocolVersion: MCP_PROTOCOL_VERSION,
-            capabilities: {},
-            clientInfo: { name: "zelari-code", version: getCurrentVersion() }
-          },
-          INIT_TIMEOUT_MS
-        );
-        this.notify("notifications/initialized", {});
+        await this.handshake();
+      }
+      async handshake() {
+        const prev2 = this.recovering;
+        this.recovering = true;
+        try {
+          await this.request(
+            "initialize",
+            {
+              protocolVersion: MCP_PROTOCOL_VERSION,
+              capabilities: {},
+              clientInfo: { name: "zelari-code", version: getCurrentVersion() }
+            },
+            INIT_TIMEOUT_MS
+          );
+          this.notify("notifications/initialized", {});
+        } finally {
+          this.recovering = prev2;
+        }
       }
-      /** Discover the server's tools. */
+      /**
+       * Discover the server's tools. Follows `nextCursor` pagination so
+       * large servers (hundreds of tools) are listed completely.
+       */
       async listTools() {
-        const res = await this.request("tools/list", {});
-        return (res.tools ?? []).filter(
-          (t) => !!t.name
-        ).map((t) => ({
-          name: t.name,
-          description: t.description ?? "",
-          inputSchema: t.inputSchema ?? { type: "object", properties: {} }
-        }));
+        const tools = [];
+        let cursor;
+        for (let page = 0; page < MAX_LIST_PAGES; page++) {
+          const res = await this.request(
+            "tools/list",
+            cursor ? { cursor } : {}
+          );
+          for (const t of res.tools ?? []) {
+            if (!t.name) continue;
+            tools.push({
+              name: t.name,
+              description: t.description ?? "",
+              inputSchema: t.inputSchema ?? { type: "object", properties: {} }
+            });
+          }
+          cursor = typeof res.nextCursor === "string" ? res.nextCursor : void 0;
+          if (!cursor) break;
+        }
+        return tools;
       }
       /**
        * Call a tool. Returns the concatenated text content; non-text content
        * items are summarized by type. Throws when the server flags isError.
        */
-      async callTool(name, args, timeoutMs2 = DEFAULT_REQUEST_TIMEOUT_MS) {
+      async callTool(name, args, timeoutMs2) {
         const res = await this.request(
           "tools/call",
           { name, arguments: args },
-          timeoutMs2
+          timeoutMs2 ?? this.defaultTimeoutMs
         );
         const text = (res.content ?? []).map(
           (c) => c.type === "text" && typeof c.text === "string" ? c.text : `[${c.type ?? "unknown"} content]`
@@ -55394,20 +55602,39 @@ var init_mcpClient = __esm({
           throw new Error(text || `tool "${name}" reported an error`);
         return text;
       }
-      /** Terminate the server process and reject all in-flight requests. */
+      /** Terminate the server / session and reject all in-flight requests. */
       close() {
         this.closed = true;
         this.failAll(new Error(`[mcp:${this.serverName}] client closed`));
+        if (this.transport) {
+          this.transport.close();
+          this.transport = null;
+          return;
+        }
         this.child?.kill();
         this.child = null;
       }
-      // ── JSON-RPC plumbing ────────────────────────────────────────────────
-      request(method, params, timeoutMs2 = DEFAULT_REQUEST_TIMEOUT_MS) {
+      // ── JSON-RPC plumbing (shared by both transports) ────────────────────
+      request(method, params, timeoutMs2) {
+        const effective = timeoutMs2 ?? this.defaultTimeoutMs;
+        if (!this.serial || this.recovering)
+          return this.dispatch(method, params, effective);
+        const run = this.queueTail.then(
+          () => this.dispatch(method, params, effective),
+          () => this.dispatch(method, params, effective)
+        );
+        this.queueTail = run.then(
+          () => void 0,
+          () => void 0
+        );
+        return run;
+      }
+      dispatch(method, params, timeoutMs2) {
+        const transport = this.transport;
         const child = this.child;
-        if (!child)
+        if (!transport && !child)
           return Promise.reject(new Error(`[mcp:${this.serverName}] not started`));
         const id3 = this.nextId++;
-        const payload = JSON.stringify({ jsonrpc: "2.0", id: id3, method, params });
         return new Promise((resolve9, reject) => {
           const timer = setTimeout(() => {
             this.pending.delete(id3);
@@ -55418,16 +55645,25 @@ var init_mcpClient = __esm({
             );
           }, timeoutMs2);
           this.pending.set(id3, { resolve: resolve9, reject, timer });
-          child.stdin.write(payload + "\n", (err) => {
-            if (err) {
-              clearTimeout(timer);
-              this.pending.delete(id3);
-              reject(err);
-            }
-          });
+          if (transport) {
+            void transport.send({ id: id3, method, params }, timeoutMs2);
+          } else {
+            const payload = JSON.stringify({ jsonrpc: "2.0", id: id3, method, params });
+            child.stdin.write(payload + "\n", (err) => {
+              if (err) {
+                clearTimeout(timer);
+                this.pending.delete(id3);
+                reject(err);
+              }
+            });
+          }
         });
       }
       notify(method, params) {
+        if (this.transport) {
+          void this.transport.send({ method, params }, this.defaultTimeoutMs);
+          return;
+        }
         this.child?.stdin.write(
           JSON.stringify({ jsonrpc: "2.0", method, params }) + "\n"
         );
@@ -55439,26 +55675,29 @@ var init_mcpClient = __esm({
           const line = this.stdoutBuffer.slice(0, nl).trim();
           this.stdoutBuffer = this.stdoutBuffer.slice(nl + 1);
           if (!line) continue;
-          let msg;
           try {
-            msg = JSON.parse(line);
+            this.handleMessage(JSON.parse(line));
           } catch {
             continue;
           }
-          if (typeof msg.id !== "number") continue;
-          const pending = this.pending.get(msg.id);
-          if (!pending) continue;
-          this.pending.delete(msg.id);
-          clearTimeout(pending.timer);
-          if (msg.error) {
-            pending.reject(
-              new Error(
-                `[mcp:${this.serverName}] ${msg.error.message ?? "JSON-RPC error"} (code ${msg.error.code ?? "?"})`
-              )
-            );
-          } else {
-            pending.resolve(msg.result);
-          }
+        }
+      }
+      /** Route one parsed JSON-RPC message to its pending request (both transports). */
+      handleMessage(msg) {
+        const m = msg;
+        if (typeof m.id !== "number") return;
+        const pending = this.pending.get(m.id);
+        if (!pending) return;
+        this.pending.delete(m.id);
+        clearTimeout(pending.timer);
+        if (m.error) {
+          pending.reject(
+            new Error(
+              `[mcp:${this.serverName}] ${m.error.message ?? "JSON-RPC error"} (code ${m.error.code ?? "?"})`
+            )
+          );
+        } else {
+          pending.resolve(m.result);
         }
       }
       failAll(err) {
@@ -55493,11 +55732,17 @@ function readFile6(path91) {
     const parsed = JSON.parse(readFileSync29(path91, "utf8"));
     const out = {};
     for (const [name, cfg] of Object.entries(parsed.mcpServers ?? {})) {
-      if (!cfg || typeof cfg.command !== "string" || !cfg.command.trim()) continue;
+      const hasCommand = !!cfg && typeof cfg.command === "string" && !!cfg.command.trim();
+      const hasUrl = !!cfg && typeof cfg.url === "string" && /^https?:\/\//i.test(cfg.url);
+      if (!cfg || !hasCommand && !hasUrl) continue;
       out[name] = {
-        command: cfg.command.trim(),
+        command: hasCommand ? cfg.command.trim() : void 0,
         args: Array.isArray(cfg.args) ? cfg.args.map(String) : void 0,
         env: cfg.env && typeof cfg.env === "object" ? cfg.env : void 0,
+        type: hasUrl && !hasCommand ? "http" : cfg.type === "http" ? "http" : "stdio",
+        url: hasUrl ? cfg.url.trim() : void 0,
+        timeoutMs: typeof cfg.timeoutMs === "number" && cfg.timeoutMs > 0 ? cfg.timeoutMs : void 0,
+        serial: typeof cfg.serial === "boolean" ? cfg.serial : void 0,
         enabled: cfg.enabled !== false
       };
     }
@@ -55539,8 +55784,13 @@ function upsertMcpServer(opts) {
       error: "Invalid server name (use letters, digits, _ -)"
     };
   }
-  if (!opts.config.command?.trim()) {
-    return { ok: false, error: "command is required" };
+  const hasCommand = !!opts.config.command?.trim();
+  const hasUrl = typeof opts.config.url === "string" && /^https?:\/\//i.test(opts.config.url);
+  if (!hasCommand && !hasUrl) {
+    return {
+      ok: false,
+      error: "either command (stdio) or url (http) is required"
+    };
   }
   let path91;
   if (opts.scope === "user") {
@@ -55557,9 +55807,13 @@ function upsertMcpServer(opts) {
   }
   const current = readFile6(path91);
   current[name] = {
-    command: opts.config.command.trim(),
+    command: hasCommand ? opts.config.command.trim() : void 0,
     args: opts.config.args,
     env: opts.config.env,
+    type: hasUrl ? "http" : opts.config.type === "http" ? "http" : "stdio",
+    url: hasUrl ? opts.config.url.trim() : void 0,
+    timeoutMs: opts.config.timeoutMs,
+    serial: opts.config.serial,
     enabled: opts.config.enabled !== false
   };
   writeFile2(path91, current);
@@ -55634,9 +55888,35 @@ function buildQwenMmPreset() {
     ]
   };
 }
+function buildUnrealPreset() {
+  const url2 = process.env.UNREAL_MCP_URL?.trim() || "http://127.0.0.1:8000/mcp";
+  return {
+    id: "unreal-mcp",
+    servers: {
+      "unreal-mcp": {
+        type: "http",
+        url: url2,
+        // Editor tool calls (asset scans, builds, PIE) can be slow.
+        timeoutMs: 12e4,
+        // Epic guidance: never overlap calls on the editor's game thread.
+        serial: true,
+        enabled: true
+      }
+    },
+    notes: [
+      "Unreal Engine 5.8+ \u2014 MCP server embedded in the editor (Experimental feature).",
+      "Editor: enable the 'Model Context Protocol' plugin, then Edit \u2192 Project Settings \u2192 Plugins \u2192 MCP Server.",
+      `Endpoint: ${url2} (override with UNREAL_MCP_URL; port/path configurable in the editor).`,
+      "Tool Search ON by default: tools surface as list_toolsets / describe_toolset / call_tool.",
+      "Requests are serialized and time out after 120s (editor tools can be slow).",
+      "Start the editor before OR after zelari \u2014 unreachable servers are retried on each turn.",
+      "Kill switch: disable the unreal-mcp server in mcp.json or ZELARI_MCP=0"
+    ]
+  };
+}
 function listMcpPresetIds() {
   return Object.keys(PRESETS).filter(
-    (k) => k === "cua" || k === "composio" || k === "qwen-mm-plugins"
+    (k) => k === "cua" || k === "composio" || k === "qwen-mm-plugins" || k === "unreal-mcp"
   );
 }
 function getMcpPreset(id3) {
@@ -55705,7 +55985,10 @@ var init_mcpPresets = __esm({
       "cua-driver": () => CUA_DRIVER_PRESET,
       composio: buildComposioPreset,
       "qwen-mm-plugins": buildQwenMmPreset,
-      "qwen-mm": buildQwenMmPreset
+      "qwen-mm": buildQwenMmPreset,
+      unreal: buildUnrealPreset,
+      "unreal-mcp": buildUnrealPreset,
+      unrealEditor: buildUnrealPreset
     };
   }
 });
@@ -55735,7 +56018,9 @@ function readMcpConfig(projectRoot = process.cwd(), opts) {
     try {
       const parsed = JSON.parse(readFileSync30(p3, "utf8"));
       for (const [name, cfg] of Object.entries(parsed.mcpServers ?? {})) {
-        if (!cfg || typeof cfg.command !== "string" || cfg.command.length === 0) continue;
+        const hasCommand = !!cfg && typeof cfg.command === "string" && cfg.command.length > 0;
+        const hasUrl = !!cfg && typeof cfg.url === "string" && /^https?:\/\//i.test(cfg.url);
+        if (!cfg || !hasCommand && !hasUrl) continue;
         merged[name] = cfg;
       }
     } catch {
@@ -55776,16 +56061,52 @@ async function ensureLoaded(projectRoot) {
       }
     } catch (err) {
       client.close();
-      state2.warnings.push(`[mcp:${name}] disabled: ${err instanceof Error ? err.message : String(err)}`);
+      const msg = err instanceof Error ? err.message : String(err);
+      if (isHttpConfig(cfg)) {
+        state2.pendingHttp.push({ name, cfg });
+        state2.warnings.push(
+          `[mcp:${name}] not reachable yet (${msg}) \u2014 will retry each turn`
+        );
+      } else {
+        state2.warnings.push(`[mcp:${name}] disabled: ${msg}`);
+      }
     }
   }
 }
+function isHttpConfig(cfg) {
+  return cfg.type === "http" || !!cfg.url && !cfg.command;
+}
+async function retryPendingHttp() {
+  if (state2.pendingHttp.length === 0) return;
+  const remaining = [];
+  for (const p3 of state2.pendingHttp) {
+    const client = new McpClient(p3.name, p3.cfg);
+    try {
+      await client.start();
+      const tools = await client.listTools();
+      state2.clients.push(client);
+      for (const info of tools) {
+        state2.tools.push({
+          registryName: sanitizeToolName(`mcp_${p3.name}_${info.name}`),
+          serverName: p3.name,
+          info,
+          client
+        });
+      }
+    } catch {
+      client.close();
+      remaining.push(p3);
+    }
+  }
+  state2.pendingHttp = remaining;
+}
 function sanitizeToolName(raw) {
   return raw.replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 64);
 }
 async function registerMcpTools(registry4, projectRoot = process.cwd(), opts) {
   if (process.env["ZELARI_MCP"] === "0") return { registered: [], warnings: [] };
   await ensureLoaded(projectRoot);
+  await retryPendingHttp();
   const skipCuaForCouncil = opts?.councilMode === true && !isCuaAllowedForCouncil();
   const registered = [];
   for (const t of state2.tools) {
@@ -55823,6 +56144,7 @@ function closeMcpClients() {
   state2.tools = [];
   state2.loaded = false;
   state2.warnings = [];
+  state2.pendingHttp = [];
 }
 function _resetMcpForTests() {
   closeMcpClients();
@@ -55836,7 +56158,7 @@ var init_mcpManager = __esm({
     init_mcpClient();
     init_mcpPresets();
     init_folderTrust();
-    state2 = { loaded: false, tools: [], warnings: [], clients: [] };
+    state2 = { loaded: false, tools: [], warnings: [], clients: [], pendingHttp: [] };
   }
 });
 
@@ -67537,6 +67859,7 @@ var init_skillConfigIo = __esm({
       "@zelari/core/skills/builtin/planning",
       "@zelari/core/skills/builtin/refactoring",
       "@zelari/core/skills/builtin/review",
+      "@zelari/core/skills/builtin/unrealEditor",
       "@zelari/core/skills/builtin/testing",
       "@zelari/core/skills/builtin/schema-loop",
       "@zelari/core/skills/builtin/computer-use-cua",
@@ -80423,7 +80746,7 @@ function pickRootComponent() {
   }
   if (argv.includes("--help") || argv.includes("-h")) {
     console.log(
-      "zelari-code \u2014 AI Council coding agent CLI.\n\nUsage: zelari-code [options]\n\nOptions:\n  --version, -v       Print version and exit\n  --help, -h          Print this help and exit\n  --doctor            Diagnose install health (shim, bundle, PATH, deps,\n                      node/git/bash in the agent shell)\n  --inspect [--json]  Unified project inspection (config, skills, MCP,\n                      hooks, plugins, AGENTS.md, trust status)\n  --trust [path]      Trust the cwd (or path) so project MCP + hooks load\n  --fix-path          Add the npm global prefix to the user PATH\n                      (Windows only; fixes 'command not found' after install)\n  --fix-budget        Set recommended ZELARI_MAX_TOOL_LOOP_HARD=180,\n                      ZELARI_MAX_TOOL_LOOP_ITERATIONS=60, ZELARI_CONTEXT_LIMIT=400000\n                      at User scope (prevents the agent stopping mid-task)\n  --permission-mcp <socket>  MCP stdio server for external agent permission prompts\n                      (spawned by claude --permission-prompt-tool)\n  --memory-mcp       Optional MCP stdio server for project memory\n    --cwd <path>      Trusted project root (requires ZELARI_MEMORY_MCP=1)\n    --client-id <id>  Stable local owner identity for private memories\n  --memory-json <json>  Read-only project-memory bridge for Zelari Desktop\n  --skip-checks       Skip the boot-time prerequisite check\n                      (alias for ZELARI_SKIP_PREFLIGHT=1)\n  --no-wizard         Skip the first-run wizard\n  --reset-config      Re-run the wizard (clears provider.json on commit)\n  --headless          Run a single task without mounting the TUI\n    --task <text>       Task prompt (required in headless mode)\n    --output json|plain Output format (default: json)\n    --mode kraken|council|zelari  Dispatch mode (default: kraken; agent=alias)\n    --council          Alias for --mode council\n    --phase plan|build  Work phase (default: build)\n    --provider <id>    Provider override (default: active)\n    --model <id>       Model override (default: provider default)\n    --profile <id>     Capability profile (minimal/v1|kraken/v1|council/v1|mission/v1)\n    --resume <id>      Continue a 2.0 spine session\n    --export-session <path>  Write zelari-session-export/1 after the run\n    --strict-done      Evidence-based BUILD completion gate\n  --session-export <id>  Print a portable 2.0 session export (no LLM)\n  serve               Companion host for Android/remote clients (Tailscale)\n    --bind <ip>       Listen address (default: 127.0.0.1; use Tailscale IP)\n    --port <n>        Port (default: 7421)\n    --token <secret>  Bearer token (default: ~/.zelari-code/companion.token)\n    --project <path>  Allowlisted project root (repeatable)\n    --save-projects   Persist --project list to companion.json\n  --print-config      Print provider/model config as JSON (no secrets)\n  --plugins-status    JSON status of optional plugins (Playwright, eslint, \u2026)\n  --plugins-install <id>  Install plugin (playwright also fetches Chromium)\n    --cwd <path>       Workspace for -D installs (default: process.cwd())\n  --set-config        Persist provider/model/endpoint\n    --provider <id>    Set active provider\n    --model <id>       Set model for that provider\n    --endpoint <url>   Custom OpenAI-compatible base URL\n    --endpoint-clear   Remove custom endpoint override\n    --thinking <spec>  Thinking effort (auto|off|low|medium|high|budget:N)\n  --set-key           Store an API key (never printed back)\n    --provider <id>    Provider id (required)\n    --key <secret>     API key (required)\n  --login-oauth       Start subscription OAuth (grok, chatgpt, anthropic)\n    --provider <id>    grok | chatgpt | anthropic\n    --code <paste>    Anthropic magic-link code (CODE#STATE)\n    --no-browser      Do not open the system browser\n  --refresh-oauth     Force-refresh an OAuth access token\n    --provider <id>    grok | chatgpt | anthropic\n  --logout-oauth      Clear stored OAuth credentials\n    --provider <id>    grok | chatgpt | anthropic\n  --discover-models   Refresh model list for a provider\n    --provider <id>    Provider (default: active)\n  --print-mcp         Print MCP server config (user + project)\n    --cwd <path>      Project root for .zelari/mcp.json\n  --set-mcp           Add/update an MCP server entry\n    --name <id>       Server name (required)\n    --command <bin>   Executable (required)\n    --args <json>     JSON array of args (optional)\n    --scope user|project  Default: user\n    --enabled true|false  Default: true\n    --cwd <path>      Required when scope=project\n  --set-mcp-preset    Install a named MCP preset (e.g. cua)\n    --preset cua      Cua Driver desktop computer-use (MCP)\n    --scope user|project  Default: user\n    --cwd <path>      Required when scope=project\n  --remove-mcp        Remove an MCP server entry\n    --name <id> --scope user|project [--cwd <path>]\n  --print-skills      Print skills (builtin + user + project)\n    --cwd <path>      Project root for .zelari/skills\n  --set-skill         Add/update a SKILL.md skill\n    --name <id>       Skill id (required)\n    --description <t> One-line description (required)\n    --body <text>     Markdown instructions (required)\n    --category <c>    plan|refactor|debug|review|test|docs|ops|git|db|maint\n    --tools <csv>     Comma-separated required tools (optional)\n    --cost <l>        low|medium|high (default: medium)\n    --scope user|project  Default: user\n    --cwd <path>      Required when scope=project\n  --remove-skill      Remove a user/project SKILL.md\n    --name <id> --scope user|project [--cwd <path>]\n  --generate-skill-from-url  Fetch URL + draft skill via model (JSON)\n    --url <https://...>  Required\n    --provider <id>   Override active provider\n    --model <name>    Override model for the selected provider\n  --print-ssh-targets Print SSH deploy/monitor targets\n  --set-ssh-target    Upsert target (--json '{...}' or flags)\n  --remove-ssh-target --id <id>\n  --test-ssh-target   --id <id>  (BatchMode ssh true)\n  --print-ssh-pubkey  --path <private-or-.pub>  (display public key)\n\nEnvironment:\n  ZELARI_NO_WIZARD=1    Skip the first-run wizard\n  ZELARI_SKIP_PREFLIGHT=1  Skip the boot prerequisite check\n  ZELARI_NO_PLUGIN_PROMPT=1  Skip the boot plugin-install prompt\n  ZELARI_MEMORY_MCP=1  Enable the optional external memory MCP server\n  ANATHEMA_DEV=1        Disable background update check + preflight\n"
+      "zelari-code \u2014 AI Council coding agent CLI.\n\nUsage: zelari-code [options]\n\nOptions:\n  --version, -v       Print version and exit\n  --help, -h          Print this help and exit\n  --doctor            Diagnose install health (shim, bundle, PATH, deps,\n                      node/git/bash in the agent shell)\n  --inspect [--json]  Unified project inspection (config, skills, MCP,\n                      hooks, plugins, AGENTS.md, trust status)\n  --trust [path]      Trust the cwd (or path) so project MCP + hooks load\n  --fix-path          Add the npm global prefix to the user PATH\n                      (Windows only; fixes 'command not found' after install)\n  --fix-budget        Set recommended ZELARI_MAX_TOOL_LOOP_HARD=180,\n                      ZELARI_MAX_TOOL_LOOP_ITERATIONS=60, ZELARI_CONTEXT_LIMIT=400000\n                      at User scope (prevents the agent stopping mid-task)\n  --permission-mcp <socket>  MCP stdio server for external agent permission prompts\n                      (spawned by claude --permission-prompt-tool)\n  --memory-mcp       Optional MCP stdio server for project memory\n    --cwd <path>      Trusted project root (requires ZELARI_MEMORY_MCP=1)\n    --client-id <id>  Stable local owner identity for private memories\n  --memory-json <json>  Read-only project-memory bridge for Zelari Desktop\n  --skip-checks       Skip the boot-time prerequisite check\n                      (alias for ZELARI_SKIP_PREFLIGHT=1)\n  --no-wizard         Skip the first-run wizard\n  --reset-config      Re-run the wizard (clears provider.json on commit)\n  --headless          Run a single task without mounting the TUI\n    --task <text>       Task prompt (required in headless mode)\n    --output json|plain Output format (default: json)\n    --mode kraken|council|zelari  Dispatch mode (default: kraken; agent=alias)\n    --council          Alias for --mode council\n    --phase plan|build  Work phase (default: build)\n    --provider <id>    Provider override (default: active)\n    --model <id>       Model override (default: provider default)\n    --profile <id>     Capability profile (minimal/v1|kraken/v1|council/v1|mission/v1)\n    --resume <id>      Continue a 2.0 spine session\n    --export-session <path>  Write zelari-session-export/1 after the run\n    --strict-done      Evidence-based BUILD completion gate\n  --session-export <id>  Print a portable 2.0 session export (no LLM)\n  serve               Companion host for Android/remote clients (Tailscale)\n    --bind <ip>       Listen address (default: 127.0.0.1; use Tailscale IP)\n    --port <n>        Port (default: 7421)\n    --token <secret>  Bearer token (default: ~/.zelari-code/companion.token)\n    --project <path>  Allowlisted project root (repeatable)\n    --save-projects   Persist --project list to companion.json\n  --print-config      Print provider/model config as JSON (no secrets)\n  --plugins-status    JSON status of optional plugins (Playwright, eslint, \u2026)\n  --plugins-install <id>  Install plugin (playwright also fetches Chromium)\n    --cwd <path>       Workspace for -D installs (default: process.cwd())\n  --set-config        Persist provider/model/endpoint\n    --provider <id>    Set active provider\n    --model <id>       Set model for that provider\n    --endpoint <url>   Custom OpenAI-compatible base URL\n    --endpoint-clear   Remove custom endpoint override\n    --thinking <spec>  Thinking effort (auto|off|low|medium|high|budget:N)\n  --set-key           Store an API key (never printed back)\n    --provider <id>    Provider id (required)\n    --key <secret>     API key (required)\n  --login-oauth       Start subscription OAuth (grok, chatgpt, anthropic)\n    --provider <id>    grok | chatgpt | anthropic\n    --code <paste>    Anthropic magic-link code (CODE#STATE)\n    --no-browser      Do not open the system browser\n  --refresh-oauth     Force-refresh an OAuth access token\n    --provider <id>    grok | chatgpt | anthropic\n  --logout-oauth      Clear stored OAuth credentials\n    --provider <id>    grok | chatgpt | anthropic\n  --discover-models   Refresh model list for a provider\n    --provider <id>    Provider (default: active)\n  --print-mcp         Print MCP server config (user + project)\n    --cwd <path>      Project root for .zelari/mcp.json\n  --set-mcp           Add/update an MCP server entry\n    --name <id>       Server name (required)\n    --command <bin>   Executable for stdio servers\n    --url <endpoint>  Streamable HTTP endpoint (e.g. UE 5.8 editor)\n    --args <json>     JSON array of args (stdio, optional)\n    --timeout <ms>    Per-server request timeout (http, optional)\n    --scope user|project  Default: user\n    --enabled true|false  Default: true\n    --cwd <path>      Required when scope=project\n  --set-mcp-preset    Install a named MCP preset (e.g. cua)\n    --preset cua      Cua Driver desktop computer-use (MCP)\n    --preset unreal-mcp  Unreal Engine 5.8+ editor (MCP over HTTP)\n    --scope user|project  Default: user\n    --cwd <path>      Required when scope=project\n  --remove-mcp        Remove an MCP server entry\n    --name <id> --scope user|project [--cwd <path>]\n  --print-skills      Print skills (builtin + user + project)\n    --cwd <path>      Project root for .zelari/skills\n  --set-skill         Add/update a SKILL.md skill\n    --name <id>       Skill id (required)\n    --description <t> One-line description (required)\n    --body <text>     Markdown instructions (required)\n    --category <c>    plan|refactor|debug|review|test|docs|ops|git|db|maint\n    --tools <csv>     Comma-separated required tools (optional)\n    --cost <l>        low|medium|high (default: medium)\n    --scope user|project  Default: user\n    --cwd <path>      Required when scope=project\n  --remove-skill      Remove a user/project SKILL.md\n    --name <id> --scope user|project [--cwd <path>]\n  --generate-skill-from-url  Fetch URL + draft skill via model (JSON)\n    --url <https://...>  Required\n    --provider <id>   Override active provider\n    --model <name>    Override model for the selected provider\n  --print-ssh-targets Print SSH deploy/monitor targets\n  --set-ssh-target    Upsert target (--json '{...}' or flags)\n  --remove-ssh-target --id <id>\n  --test-ssh-target   --id <id>  (BatchMode ssh true)\n  --print-ssh-pubkey  --path <private-or-.pub>  (display public key)\n\nEnvironment:\n  ZELARI_NO_WIZARD=1    Skip the first-run wizard\n  ZELARI_SKIP_PREFLIGHT=1  Skip the boot prerequisite check\n  ZELARI_NO_PLUGIN_PROMPT=1  Skip the boot plugin-install prompt\n  ZELARI_MEMORY_MCP=1  Enable the optional external memory MCP server\n  ANATHEMA_DEV=1        Disable background update check + preflight\n"
     );
     process.exit(0);
   }
@@ -80449,6 +80772,8 @@ function pickRootComponent() {
       };
       const name = get("--name");
       const command = get("--command");
+      const url2 = get("--url");
+      const timeoutRaw = get("--timeout");
       const scopeRaw = get("--scope") ?? "user";
       const scope = scopeRaw === "project" ? "project" : "user";
       const cwd = get("--cwd") ?? process.cwd();
@@ -80461,14 +80786,22 @@ function pickRootComponent() {
         if (!Array.isArray(parsed)) throw new Error("--args must be a JSON array");
         args = parsed.map(String);
       }
-      if (!name || !command) {
-        throw new Error("--name and --command are required");
+      const timeoutMs2 = timeoutRaw !== void 0 ? Number(timeoutRaw) : void 0;
+      if (timeoutMs2 !== void 0 && (!Number.isFinite(timeoutMs2) || timeoutMs2 <= 0)) {
+        throw new Error("--timeout must be a positive number of milliseconds");
+      }
+      if (!name) throw new Error("--name is required");
+      if (!command && !url2) {
+        throw new Error("either --command (stdio) or --url (http) is required");
+      }
+      if (url2 && !/^https?:\/\//i.test(url2)) {
+        throw new Error("--url must be an http(s) endpoint");
       }
       const result = upsertMcpServer({
         scope,
         name,
         projectRoot: cwd,
-        config: { command, args, enabled }
+        config: url2 ? { type: "http", url: url2, timeoutMs: timeoutMs2, serial: true, enabled } : { command, args, enabled }
       });
       if (!result.ok) throw new Error(result.error);
       console.log(JSON.stringify({ ok: true, path: result.path, name, scope }));