zubo 0.1.19 → 0.1.21

package/src/setup-web.ts

@@ -0,0 +1,165 @@
+import { configSchema } from "./config/schema";
+import type { ProviderConfig } from "./config/schema";
+import { createProvider, validateProvider } from "./llm/factory";
+import { finalizeSetup, type SetupResult } from "./setup";
+import { SETUP_WIZARD_HTML } from "./setup-web.html";
+
+const BOLD = "\x1b[1m";
+const DIM = "\x1b[2m";
+const CYAN = "\x1b[36m";
+const YELLOW = "\x1b[33m";
+const RESET = "\x1b[0m";
+
+const TIMEOUT_MS = 30 * 60 * 1000; // 30 minutes
+
+export async function runWebSetup() {
+  let resolve: (result: SetupResult) => void;
+  let reject: (err: Error) => void;
+  const done = new Promise<SetupResult>((res, rej) => {
+    resolve = res;
+    reject = rej;
+  });
+
+  const server = Bun.serve({
+    port: 0,
+    hostname: "127.0.0.1",
+
+    async fetch(req) {
+      const url = new URL(req.url);
+
+      // ── Serve wizard HTML ──
+      if (url.pathname === "/" && req.method === "GET") {
+        return new Response(SETUP_WIZARD_HTML, {
+          headers: { "Content-Type": "text/html; charset=utf-8" },
+        });
+      }
+
+      // ── API: Validate provider ──
+      if (url.pathname === "/api/validate-provider" && req.method === "POST") {
+        try {
+          const body = await req.json() as { name: string; config: ProviderConfig };
+          const testConfig = configSchema.parse({
+            providers: { [body.name]: body.config },
+            activeProvider: body.name,
+          });
+          const provider = await createProvider(testConfig);
+          const err = await validateProvider(provider);
+          if (err) return Response.json({ ok: false, error: err });
+          return Response.json({ ok: true });
+        } catch (e: any) {
+          return Response.json({ ok: false, error: e.message ?? String(e) });
+        }
+      }
+
+      // ── API: Detect local models (Ollama / LM Studio) ──
+      if (url.pathname === "/api/detect-local" && req.method === "POST") {
+        const body = await req.json() as { type: "ollama" | "lmstudio" };
+        const results: { running: boolean; models: string[] } = { running: false, models: [] };
+
+        if (body.type === "ollama") {
+          // Check CLI
+          const which = Bun.spawnSync(["which", "ollama"], { stdout: "pipe", stderr: "pipe" });
+          const cliInstalled = which.exitCode === 0;
+
+          try {
+            const res = await fetch("http://localhost:11434/api/tags", {
+              signal: AbortSignal.timeout(3000),
+            });
+            if (res.ok) {
+              const data = await res.json() as { models?: { name: string }[] };
+              results.running = true;
+              results.models = (data.models ?? []).map((m) => m.name);
+            }
+          } catch {}
+          return Response.json({ ...results, cliInstalled });
+        }
+
+        if (body.type === "lmstudio") {
+          try {
+            const res = await fetch("http://localhost:1234/v1/models", {
+              signal: AbortSignal.timeout(3000),
+            });
+            if (res.ok) {
+              const data = await res.json() as { data?: { id: string }[] };
+              results.running = true;
+              results.models = (data.data ?? []).map((m) => m.id);
+            }
+          } catch {}
+          return Response.json(results);
+        }
+
+        return Response.json(results);
+      }
+
+      // ── API: Detect CLI tools (Claude Code / Codex) ──
+      if (url.pathname === "/api/detect-cli" && req.method === "POST") {
+        const body = await req.json() as { tool: "claude" | "codex" };
+        const bin = body.tool === "claude" ? "claude" : "codex";
+        const which = Bun.spawnSync(["which", bin], { stdout: "pipe", stderr: "pipe" });
+        return Response.json({ installed: which.exitCode === 0 });
+      }
+
+      // ── API: Complete setup ──
+      if (url.pathname === "/api/complete" && req.method === "POST") {
+        try {
+          const body = await req.json() as SetupResult;
+          // Basic validation
+          if (!body.providers || !body.activeProvider) {
+            return Response.json({ ok: false, error: "Missing provider configuration" });
+          }
+          resolve!(body);
+          return Response.json({ ok: true });
+        } catch (e: any) {
+          return Response.json({ ok: false, error: e.message ?? String(e) });
+        }
+      }
+
+      return new Response("Not found", { status: 404 });
+    },
+  });
+
+  const port = server.port;
+  const url = `http://localhost:${port}`;
+
+  // Auto-open in browser
+  const platform = process.platform;
+  if (platform === "darwin") {
+    Bun.spawn(["open", url], { stdout: "ignore", stderr: "ignore" });
+  } else if (platform === "linux") {
+    Bun.spawn(["xdg-open", url], { stdout: "ignore", stderr: "ignore" });
+  } else if (platform === "win32") {
+    Bun.spawn(["cmd", "/c", "start", url], { stdout: "ignore", stderr: "ignore" });
+  }
+
+  console.log("");
+  console.log(`  ${CYAN}→${RESET} Setup wizard opened at ${BOLD}${url}${RESET}`);
+  console.log(`  ${DIM}  Waiting for setup to complete in the browser...${RESET}`);
+  console.log(`  ${DIM}  Press Ctrl+C to cancel.${RESET}`);
+  console.log("");
+
+  // Timeout
+  const timer = setTimeout(() => {
+    reject!(new Error("Setup timed out after 30 minutes"));
+  }, TIMEOUT_MS);
+
+  // SIGINT handler
+  const cleanup = () => {
+    clearTimeout(timer);
+    server.stop();
+  };
+  process.on("SIGINT", () => {
+    cleanup();
+    console.log(`\n  ${YELLOW}!${RESET} Setup cancelled.\n`);
+    process.exit(0);
+  });
+
+  try {
+    const result = await done;
+    cleanup();
+    await finalizeSetup(result);
+  } catch (err: any) {
+    cleanup();
+    console.log(`  ${YELLOW}!${RESET} ${err.message}\n`);
+    process.exit(1);
+  }
+}

package/src/setup.ts

@@ -1,9 +1,10 @@
 import { paths, ensureDirectories } from "./config/paths";
 import { saveConfig } from "./config/loader";
 import { configSchema } from "./config/schema";
-import type { ProviderConfig } from "./config/schema";
+import type { ProviderConfig, ZuboConfig } from "./config/schema";
 import { getDb } from "./db/connection";
 import { runMigrations } from "./db/migrations";
+import { createProvider, validateProvider } from "./llm/factory";
 import { logger } from "./util/logger";
 import { existsSync } from "fs";
 import { installBuiltinSkills } from "./tools/skill-installer";
@@ -77,15 +78,73 @@ const PROVIDER_OPTIONS: ProviderOption[] = [
     key: "3",
     label: "Ollama (local)",
     setup: async () => {
-      const baseUrl = await prompt("  Ollama URL [http://localhost:11434/v1]: ");
-      const model = await prompt("  Model [llama3.3]: ");
+      // Check if ollama is installed
+      const which = Bun.spawnSync(["which", "ollama"], { stdout: "pipe", stderr: "pipe" });
+      if (which.exitCode !== 0) {
+        warn("'ollama' not found on your system.\n");
+        console.log(`    Install Ollama from ${CYAN}https://ollama.com${RESET}`);
+        console.log(`    ${DIM}macOS:   brew install ollama${RESET}`);
+        console.log(`    ${DIM}Linux:   curl -fsSL https://ollama.com/install.sh | sh${RESET}`);
+        console.log(`    ${DIM}Windows: Download from https://ollama.com/download${RESET}\n`);
+        const cont = await prompt("  Press Enter after installing, or 'skip' to configure anyway: ");
+        if (cont.toLowerCase() !== "skip") {
+          const recheck = Bun.spawnSync(["which", "ollama"], { stdout: "pipe", stderr: "pipe" });
+          if (recheck.exitCode !== 0) {
+            warn("Still not found. Saving config anyway — install Ollama before starting.\n");
+          }
+        }
+      } else {
+        ok("'ollama' CLI found");
+      }
+
+      // Check if Ollama server is running
+      const baseUrl = "http://localhost:11434/v1";
+      info("Checking if Ollama server is running...");
+      let models: string[] = [];
+      try {
+        const res = await fetch("http://localhost:11434/api/tags", { signal: AbortSignal.timeout(3000) });
+        if (res.ok) {
+          const data = await res.json() as { models?: { name: string }[] };
+          models = (data.models ?? []).map(m => m.name);
+          ok(`Ollama is running (${models.length} model${models.length !== 1 ? "s" : ""} available)`);
+        } else {
+          warn("Ollama server responded with an error. Make sure it's running: ollama serve");
+        }
+      } catch {
+        warn("Ollama server not reachable at localhost:11434.");
+        info("Start it with: ollama serve");
+        info("Or on macOS, just open the Ollama app.\n");
+      }
+
+      // Show available models or suggest pulling one
+      let model = "";
+      if (models.length > 0) {
+        console.log(`\n    ${BOLD}Available models:${RESET}`);
+        models.slice(0, 10).forEach((m, i) => console.log(`    ${DIM}${(i + 1).toString().padStart(2)}.${RESET} ${m}`));
+        if (models.length > 10) console.log(`    ${DIM}   ... and ${models.length - 10} more${RESET}`);
+        console.log("");
+        const modelInput = await prompt(`  Model [${models[0]}]: `);
+        const num = parseInt(modelInput, 10);
+        if (modelInput && !isNaN(num) && num >= 1 && num <= models.length) {
+          model = models[num - 1];
+        } else {
+          model = modelInput || models[0];
+        }
+      } else {
+        info("No models downloaded yet. Pull one with:");
+        console.log(`    ${DIM}ollama pull llama3.3${RESET}`);
+        console.log(`    ${DIM}ollama pull mistral${RESET}`);
+        console.log(`    ${DIM}ollama pull qwen2.5${RESET}\n`);
+        model = await prompt("  Model [llama3.3]: ");
+        model = model || "llama3.3";
+      }
+
       return {
         name: "ollama",
         config: {
-          baseUrl: baseUrl || "http://localhost:11434/v1",
+          baseUrl,
           apiKey: "ollama",
-          model: model || "llama3.3",
-          streaming: false,
+          model,
         },
       };
     },
@@ -217,20 +276,147 @@ const PROVIDER_OPTIONS: ProviderOption[] = [
     key: "12",
     label: "LM Studio (local)",
     setup: async () => {
-      const baseUrl = await prompt("  LM Studio URL [http://localhost:1234/v1]: ");
-      const model = await prompt("  Model name: ");
+      const baseUrl = "http://localhost:1234/v1";
+      info("Checking if LM Studio server is running...");
+
+      let models: string[] = [];
+      try {
+        const res = await fetch(`${baseUrl}/models`, { signal: AbortSignal.timeout(3000) });
+        if (res.ok) {
+          const data = await res.json() as { data?: { id: string }[] };
+          models = (data.data ?? []).map(m => m.id);
+          ok(`LM Studio is running (${models.length} model${models.length !== 1 ? "s" : ""} loaded)`);
+        }
+      } catch {
+        warn("LM Studio server not reachable at localhost:1234.\n");
+        console.log(`    ${BOLD}To set up LM Studio:${RESET}`);
+        console.log(`    ${DIM}1.${RESET} Download from ${CYAN}https://lmstudio.ai${RESET}`);
+        console.log(`    ${DIM}2.${RESET} Open LM Studio and download a model (e.g. Llama 3.3, Mistral)`);
+        console.log(`    ${DIM}3.${RESET} Go to the "Local Server" tab (left sidebar)`);
+        console.log(`    ${DIM}4.${RESET} Click "Start Server" — it runs on port 1234 by default\n`);
+        const cont = await prompt("  Press Enter once LM Studio server is running, or 'skip' to configure anyway: ");
+        if (cont.toLowerCase() !== "skip") {
+          try {
+            const retry = await fetch(`${baseUrl}/models`, { signal: AbortSignal.timeout(3000) });
+            if (retry.ok) {
+              const data = await retry.json() as { data?: { id: string }[] };
+              models = (data.data ?? []).map(m => m.id);
+              ok(`LM Studio is running (${models.length} model${models.length !== 1 ? "s" : ""} loaded)`);
+            } else {
+              warn("Still not reachable. Config saved — start LM Studio before running Zubo.");
+            }
+          } catch {
+            warn("Still not reachable. Config saved — start LM Studio before running Zubo.");
+          }
+        }
+      }
+
+      let model = "";
+      if (models.length > 0) {
+        console.log(`\n    ${BOLD}Loaded models:${RESET}`);
+        models.forEach((m, i) => console.log(`    ${DIM}${(i + 1).toString().padStart(2)}.${RESET} ${m}`));
+        console.log("");
+        const lmsInput = await prompt(`  Model [${models[0]}]: `);
+        const lmsNum = parseInt(lmsInput, 10);
+        if (lmsInput && !isNaN(lmsNum) && lmsNum >= 1 && lmsNum <= models.length) {
+          model = models[lmsNum - 1];
+        } else {
+          model = lmsInput || models[0];
+        }
+      } else {
+        info("No models detected. Load a model in LM Studio first.");
+        model = await prompt("  Model name: ");
+        model = model || "default";
+      }
+
       return {
         name: "lmstudio",
         config: {
-          baseUrl: baseUrl || "http://localhost:1234/v1",
+          baseUrl,
           apiKey: "lm-studio",
-          model: model || "default",
+          model,
         },
       };
     },
   },
   {
     key: "13",
+    label: "Claude Code (CLI)",
+    setup: async () => {
+      // Check if claude CLI is installed
+      const which = Bun.spawnSync(["which", "claude"], { stdout: "pipe", stderr: "pipe" });
+      if (which.exitCode !== 0) {
+        warn("'claude' CLI not found. Install it first:");
+        console.log(`    ${DIM}npm install -g @anthropic-ai/claude-code${RESET}\n`);
+        const cont = await prompt("  Press Enter after installing, or 'skip' to continue anyway: ");
+        if (cont.toLowerCase() === "skip") {
+          return { name: "claude-code", config: { model: "default" } };
+        }
+        const recheck = Bun.spawnSync(["which", "claude"], { stdout: "pipe", stderr: "pipe" });
+        if (recheck.exitCode !== 0) {
+          warn("Still not found. Config saved — install 'claude' CLI before starting.");
+          return { name: "claude-code", config: { model: "default" } };
+        }
+      }
+      ok("'claude' CLI found");
+      // Quick auth check — run claude with a trivial prompt and short timeout
+      const check = Bun.spawnSync(["claude", "-p", "hi", "--max-turns", "1"], {
+        stdout: "pipe", stderr: "pipe", timeout: 10_000,
+      });
+      if (check.exitCode === 0) {
+        ok("Claude Code authenticated");
+      } else {
+        warn("Claude Code may not be authenticated yet.");
+        info("Open a separate terminal and run: claude");
+        info("Complete the login flow, then come back here.\n");
+        await prompt("  Press Enter once you've authenticated... ");
+        // Re-check
+        const recheck = Bun.spawnSync(["claude", "-p", "hi", "--max-turns", "1"], {
+          stdout: "pipe", stderr: "pipe", timeout: 10_000,
+        });
+        if (recheck.exitCode === 0) {
+          ok("Claude Code authenticated");
+        } else {
+          warn("Still not authenticated. Run 'claude' in a terminal to log in before starting Zubo.");
+        }
+      }
+      return { name: "claude-code", config: { model: "default" } };
+    },
+  },
+  {
+    key: "14",
+    label: "OpenAI Codex (CLI)",
+    setup: async () => {
+      // Check if codex CLI is installed
+      const which = Bun.spawnSync(["which", "codex"], { stdout: "pipe", stderr: "pipe" });
+      if (which.exitCode !== 0) {
+        warn("'codex' CLI not found. Install it first:");
+        console.log(`    ${DIM}npm install -g @openai/codex${RESET}\n`);
+        const cont = await prompt("  Press Enter after installing, or 'skip' to continue anyway: ");
+        if (cont.toLowerCase() === "skip") {
+          return { name: "codex", config: { model: "default" } };
+        }
+        const recheck = Bun.spawnSync(["which", "codex"], { stdout: "pipe", stderr: "pipe" });
+        if (recheck.exitCode !== 0) {
+          warn("Still not found. Config saved — install 'codex' CLI before starting.");
+          return { name: "codex", config: { model: "default" } };
+        }
+      }
+      ok("'codex' CLI found");
+      info("Authenticating — this will open your browser if needed...");
+      const login = Bun.spawnSync(["codex", "login"], {
+        stdin: "inherit", stdout: "inherit", stderr: "inherit",
+      });
+      if (login.exitCode !== 0) {
+        warn("Login may not have completed. Run 'codex login' manually later.");
+      } else {
+        ok("Codex ready");
+      }
+      return { name: "codex", config: { model: "default" } };
+    },
+  },
+  {
+    key: "15",
     label: "Other (OpenAI-compatible)",
     setup: async () => {
       const name = await prompt("  Provider name: ");
@@ -295,7 +481,29 @@ async function setupProvider(): Promise<{
   const anthropicApiKey =
     result.name === "anthropic" ? result.config.apiKey : undefined;
 
-  ok(`${result.name} configured (${result.config.model})`);
+  const isCliProvider = result.name === "claude-code" || result.name === "codex";
+  ok(`${result.name} configured` + (isCliProvider ? "" : ` (${result.config.model})`));
+
+  // Quick validation — test if the provider actually works
+  if (!isCliProvider) {
+    info("Testing connection...");
+    try {
+      const testConfig = configSchema.parse({
+        providers: { [result.name]: result.config },
+        activeProvider: result.name,
+      }) as ZuboConfig;
+      const testLlm = await createProvider(testConfig);
+      const validationErr = await validateProvider(testLlm);
+      if (validationErr) {
+        warn(validationErr);
+        info("You can fix this later with: zubo config set providers." + result.name + ".apiKey <key>");
+      } else {
+        ok("Connection verified — API key works!");
+      }
+    } catch {
+      // Validation itself failed — not critical, move on
+    }
+  }
 
   // Offer fallback
   const addFallback = await prompt("\n  Add a fallback provider? (y/N): ");
@@ -307,7 +515,8 @@ async function setupProvider(): Promise<{
     if (fb) {
       providers[fb.name] = fb.config;
       failover.push(fb.name);
-      ok(`${fb.name} added as fallback (${fb.config.model})`);
+      const isFbCli = fb.name === "claude-code" || fb.name === "codex";
+      ok(`${fb.name} added as fallback` + (isFbCli ? "" : ` (${fb.config.model})`));
     }
   }
 
@@ -515,6 +724,18 @@ export async function runSetup() {
   console.log("");
   console.log(`  ${DIM}This wizard will configure your agent in 4 steps.${RESET}`);
   console.log(`  ${DIM}Press Enter at any prompt to accept the default [in brackets].${RESET}`);
+  console.log("");
+
+  // ── Setup mode choice ──
+  console.log(`  ${BOLD}Setup mode:${RESET}`);
+  console.log(`    ${DIM}1.${RESET} Terminal`);
+  console.log(`    ${DIM}2.${RESET} Dashboard ${DIM}(opens in your browser)${RESET}`);
+  console.log("");
+  const mode = await prompt("  Choice [1]: ");
+  if (mode === "2" || mode.toLowerCase() === "d" || mode.toLowerCase() === "dashboard") {
+    const { runWebSetup } = await import("./setup-web");
+    return runWebSetup();
+  }
 
   // ── Step 1: LLM Provider ──
   step(1, 4, "LLM Provider");
@@ -533,6 +754,39 @@ export async function runSetup() {
   const smartRouting = await setupSmartRouting(providers, activeProvider);
 
   // ── Finalize ──────────────────────────────────────────────────
+  await finalizeSetup({
+    providers,
+    activeProvider,
+    failover,
+    anthropicApiKey,
+    telegramBotToken,
+    channels,
+    smartRouting,
+    agentName,
+    personality,
+  });
+}
+
+// ── Shared finalization (used by both terminal & web setup) ──
+
+export interface SetupResult {
+  providers: Record<string, ProviderConfig>;
+  activeProvider: string;
+  failover: string[];
+  anthropicApiKey?: string;
+  telegramBotToken?: string;
+  channels: Record<string, any>;
+  smartRouting: { enabled: boolean; fastProvider?: string; fastModel?: string };
+  agentName: string;
+  personality: string;
+}
+
+export async function finalizeSetup(result: SetupResult) {
+  const {
+    providers, activeProvider, failover, anthropicApiKey, telegramBotToken,
+    channels, smartRouting, agentName, personality,
+  } = result;
+
   console.log("");
   console.log(`  ${DIM}─────────────────────────────────────────${RESET}`);
   console.log(`  ${BOLD}Setting up...${RESET}`);
@@ -590,8 +844,6 @@ export async function runSetup() {
   ok("Memory file ready");
 
   // Create SYSTEM.md only if the user customized the name or personality.
-  // Otherwise, let the built-in DEFAULT_PERSONALITY in prompts.ts be used —
-  // it has the full capability set and stays up-to-date with new features.
   if (!existsSync(paths.systemPrompt)) {
     if (agentName !== "Zubo" || personality) {
       const nameLine = agentName !== "Zubo"
@@ -606,7 +858,6 @@ export async function runSetup() {
         `${nameLine}${personalityLine}\n`
       );
     }
-    // If no customization, no SYSTEM.md is created — the default personality is used.
   }
   ok("System prompt ready");
 

package/src/start.ts

@@ -5,7 +5,7 @@ import { ensureDirectories, paths } from "./config/paths";
 import type { ZuboConfig } from "./config/schema";
 import { getDb, closeDb } from "./db/connection";
 import { runMigrations } from "./db/migrations";
-import { createProvider } from "./llm/factory";
+import { createProvider, validateProvider } from "./llm/factory";
 import { registerDatetimeTool } from "./tools/builtin/datetime";
 import { registerMemoryWriteTool } from "./tools/builtin/memory-write";
 import { registerMemorySearchTool } from "./tools/builtin/memory-search";
@@ -108,7 +108,17 @@ export async function startZubo(isDaemon = false) {
   await initMemory(db);
 
   // Init LLM
-  const llm = createProvider(config);
+  const llm = await createProvider(config);
+
+  // Validate LLM connectivity (non-blocking — warn but don't prevent startup)
+  validateProvider(llm).then((err) => {
+    if (err) {
+      logger.warn(`LLM validation: ${err}`);
+      console.log(`\n  ⚠  ${err}\n`);
+    } else {
+      logger.info("LLM connectivity verified");
+    }
+  }).catch(() => {});
 
   // Init voice (STT/TTS) if configured
   if (config.voice?.stt) {

package/src/tools/builtin/config-update.ts

@@ -113,7 +113,24 @@ export function registerConfigUpdateTool() {
           const validated = configSchema.parse(configObj);
           await saveConfig(validated);
           logger.info(`Config updated: ${key} = ${JSON.stringify(value)}`);
-          return `Config updated: ${key} = ${JSON.stringify(value)}. Changes take effect on next restart (run \`zubo start\` again).`;
+
+          // Hot-swap LLM provider if activeProvider changed
+          if (key === "activeProvider") {
+            try {
+              const { createProvider } = await import("../../llm/factory");
+              const newLlm = await createProvider(validated);
+              const router = (globalThis as any).__zuboRouter;
+              if (router?.setLlm) {
+                router.setLlm(newLlm);
+                return `Switched to ${value}. Active now — no restart needed.`;
+              }
+            } catch (swapErr: any) {
+              logger.warn("Provider hot-swap failed", { error: swapErr.message });
+              return `Config updated: activeProvider = ${JSON.stringify(value)}, but hot-swap failed: ${swapErr.message}. Restart to apply.`;
+            }
+          }
+
+          return `Config updated: ${key} = ${JSON.stringify(value)}.`;
         } catch (err: any) {
           return `Error: Invalid config value. ${err.message}`;
         }

package/src/tools/executor.ts

@@ -121,7 +121,7 @@ export async function executeTool(
     logger.warn(`Tool blocked by allowedTools: ${name}`);
     return {
       tool_use_id: toolUseId,
-      content: `Error: Tool '${name}' is not available in this agent context.`,
+      content: `Error: The '${name}' feature is not available right now.`,
       is_error: true,
     };
   }
@@ -141,7 +141,7 @@ export async function executeTool(
     logger.warn(`Tool denied: ${name}`);
     return {
       tool_use_id: toolUseId,
-      content: `Error: Tool '${name}' is not permitted.`,
+      content: `Error: The '${name}' feature is not permitted. You can change permissions in Settings.`,
       is_error: true,
     };
   }

package/src/tools/mcp-registry.ts

@@ -46,14 +46,16 @@ export async function searchRegistry(
   if (cached) return cached;
 
   try {
-    const url = `${BASE_URL}/servers?q=${encodeURIComponent(query)}&limit=${limit}`;
+    const url = `${BASE_URL}/servers?search=${encodeURIComponent(query)}&limit=${limit}`;
     const res = await fetch(url);
     if (!res.ok) {
       logger.warn(`MCP registry search failed: ${res.status} ${res.statusText}`);
       return [];
     }
     const data = await res.json();
-    const servers: any[] = Array.isArray(data) ? data : data.servers ?? [];
+    const raw: any[] = Array.isArray(data) ? data : data.servers ?? [];
+    // Registry wraps each entry in { server: {...}, _meta: {...} } — unwrap
+    const servers: any[] = raw.map((e: any) => e.server ?? e);
     setCache(cacheKey, servers);
     return servers;
   } catch (err: any) {
@@ -83,8 +85,10 @@ export async function getServerDetail(name: string): Promise<any | null> {
       return null;
     }
     const data = await res.json();
-    setCache(cacheKey, data);
-    return data;
+    // Registry may wrap in { server: {...}, _meta: {...} } — unwrap
+    const server = data.server ?? data;
+    setCache(cacheKey, server);
+    return server;
   } catch (err: any) {
     logger.warn(`MCP registry detail error for "${name}"`, { error: err.message });
     return null;
@@ -115,9 +119,11 @@ export async function listRegistry(
       return { servers: [] };
     }
     const data = await res.json();
+    const raw: any[] = Array.isArray(data) ? data : data.servers ?? [];
+    // Registry wraps each entry in { server: {...}, _meta: {...} } — unwrap
     const result = {
-      servers: Array.isArray(data) ? data : data.servers ?? [],
-      nextCursor: data.nextCursor as string | undefined,
+      servers: raw.map((e: any) => e.server ?? e),
+      nextCursor: (data.metadata?.nextCursor ?? data.nextCursor) as string | undefined,
     };
     setCache(cacheKey, result);
     return result;

package/src/tools/permissions.ts

@@ -15,8 +15,8 @@ const DEFAULT_PERMISSIONS: Record<string, ToolPermission> = {
   secret_list: "auto",
   secret_delete: "confirm",
 
-  // Config & integrations — require confirmation (can change system behavior)
-  config_update: "confirm",
+  // Config — auto (tool has built-in guards: blocks secrets, security settings, validates via schema)
+  config_update: "auto",
   connect_service: "confirm",
 
   // Agent delegation — delegate is auto, but creating/managing agents requires confirmation