feat(mcp): keep project MCP configs with resolved tokens out of git (#882)

docs/designs/data-directory-layout.md

@@ -439,13 +439,23 @@ every checkout, so that is where they live now:
 ├── reports-wt/                                (the side-branch locks sit beside them)
 ├── pending-learnings/                         pendingLearningsDir → <dataHome>/pending-learnings
 └── workspaces/<managedMcpWorkspaceId(root)>/
-    ├── managed-mcp.json                       managedMcpManifestPath, one per checkout
+    ├── managed-mcp.json                       managedMcpManifestPath, one per checkout; Copilot placement is true for bare, false for keyed, absent when unproven
     ├── managed-mcp-files.json                 resolvedMcpFilesPath: project MCP configs teamai may have written a resolved ${VAR} to, and whether
-    │                                          the paths earlier teamai.yaml revisions mapped were read; one of those git tracks is marked tracked (#882)
+    │                                          the paths earlier teamai.yaml revisions mapped were read; one of those git tracks is marked tracked (#882);
+    │                                          for an HTTP team, the configs the local agent wrote a credential to
     └── search-index.json                      getProjectSearchIndexPath, one per checkout
 <checkout>/.teamai/                            one per checkout: committed knowledge, knowledge-wt/
 ```
 
+MCP configs and ownership must describe the same completed writes. Existing
+JSON local-agent installs keep the old record until the config write succeeds;
+uninstall keeps it until the entry is removed. A later manifest-write failure
+restores the previous config. Reconcile keeps one snapshot per config before
+any tool writes it and restores those snapshots if saving ownership or a later
+config write fails. File records added by that failed run are cleaned up before
+Git protection is checked against the restored configs. If restoration also
+fails, the command reports both failures and keeps credential files excluded.
+
 `git worktree add` takes a path outside the repo, and the owning repo is still
 the business repo, whose refs every checkout shares. The search index is keyed
 per checkout, like managed MCP, because each checkout indexes its own branch's

skill-data/core/references/troubleshooting.md

@@ -94,6 +94,8 @@ ever committed with it; then `teamai pull`. Do not run `git rm` or commit for
 them. For an exclude file that is not writable, one another teamai command
 held, or a git error, relay the fix the line gives.
 
+For new HTTP local-agent MCP installs, a failed initial ownership-manifest write leaves the MCP config and Git exclusions unchanged. Retry the install after fixing the manifest write error. A bare Copilot entry beside `mcpServers` is removed only with a matching ownership record proving a completed bare write. Older records without that evidence preserve the bare entry. A bare ownership record cannot claim a same-named member entry under `mcpServers`: updates skip the collision, and removal leaves that keyed entry alone. An unmarked Copilot record needs a matching keyed hash that does not also match the bare entry. Completed writes record `bare: true` or `bare: false`; missing placement remains unproven, including after a failed placement-record write. Existing JSON MCP updates keep the old ownership until the config write completes; a later manifest failure restores the config. `uninstall_mcp` keeps ownership if reading or writing the config fails, and restores the entry if removing its manifest record fails. MCP reconcile also restores all configs written before an ownership-save failure. If restoration fails too, repair the named configs and ownership records before retrying; the error reports both failures, and configs still carrying credentials stay excluded from Git.
+
 ## Permission / access denied
 
 `init`, `pull`, or `push` failing with a permission error usually means the user

skill-data/setup/references/manage-admin.md

@@ -71,7 +71,12 @@ and that server noted: it keeps the line until it leaves the file. So is the
 file of a tool `managed-mcp.json` has no record for, when a pull writes that
 tool's first record (its record lost, or teamai's first delivery to it). While that
 note cannot be written (another teamai command holds the record), the line stays
-until a later pull writes it.
+until a later pull writes it. A Copilot project config's bare top-level servers
+still count once another tool writes `mcpServers` into the file. On an HTTP-backed
+team the local agent's `install_mcp` lists a project config before writing a
+server with any header, env value, argument or URL (only a bare stdio command is not), fails the install when it cannot, and only
+`teamai uninstall` takes that line out. The next sync or `teamai pull` in the
+workspace also lists a file an older local agent wrote a credential into; `teamai doctor` checks those files too.
 
 ## Invite a member
 

src/__tests__/doctor-mcp-delivery.test.ts

@@ -348,6 +348,135 @@ describe('doctor — MCP servers delivered on disk', () => {
       expect(check.fix).not.toContain(path.join(projectRoot, '.mcp.json'));
     });
 
+    it('fails for a moved tool\'s file while the tool mapping it today owns that server name only under another key', async () => {
+      const { trackResolvedMcpFiles } = await import('../mcp-resolved-files.js');
+      teamConfig.toolPaths = { ...teamConfig.toolPaths, opencode: { skills: '.opencode/skills', mcp: '.config/opencode/opencode.json', mcpProject: 'shared/mcp.json' } };
+      const shared = path.join(projectRoot, 'shared', 'mcp.json');
+      await fse.outputJson(shared, {
+        mcpServers: { x: { type: 'http', url: 'https://x.example/mcp', headers: { Authorization: 'Bearer t0ken-of-cursor' } } },
+        mcp: { x: { type: 'remote', url: 'https://x.example/mcp' } },
+      });
+      expect(await trackResolvedMcpFiles(localConfig, [{ tool: 'cursor', file: shared }])).toBe('written');
+      await fse.outputJson(managedMcpManifestPath(getDataHome(localConfig), projectRoot), {
+        [managedMcpManifestKey('opencode', true)]: [{ name: 'x', hash: 'fixture-hash', resolved: false }],
+      });
+      await fse.appendFile(path.join(projectRoot, '.git', 'info', 'exclude'), '/.mcp.json\n');
+
+      const check = await excludeCheck();
+      if (!check) throw new Error('no git exclude check');
+      expect(await check.check()).toBe(false);
+      expect(check.fix ?? '').toContain(shared);
+    });
+
+    it('fails for a moved Copilot\'s file while the tool mapping it today owns that server name only under mcpServers', async () => {
+      const { trackResolvedMcpFiles } = await import('../mcp-resolved-files.js');
+      teamConfig.toolPaths = {
+        ...teamConfig.toolPaths,
+        cursor: { skills: '.cursor/skills', mcp: '.cursor/mcp.json', mcpProject: 'shared/mcp.json' },
+        copilot: { skills: '.github/skills', mcp: '.copilot/mcp-config.json', mcpProject: '.github/mcp.json' },
+      };
+      const shared = path.join(projectRoot, 'shared', 'mcp.json');
+      await fse.outputJson(shared, {
+        x: { type: 'http', url: 'https://x.example/mcp', headers: { Authorization: 'Bearer t0ken-of-copilot' } },
+        mcpServers: { x: { type: 'http', url: 'https://x.example/mcp' } },
+      });
+      expect(await trackResolvedMcpFiles(localConfig, [{ tool: 'copilot', file: shared }])).toBe('written');
+      await fse.outputJson(managedMcpManifestPath(getDataHome(localConfig), projectRoot), {
+        [managedMcpManifestKey('cursor', true)]: [{ name: 'x', hash: 'fixture-hash', resolved: false }],
+        // Copilot's record describes the file its mapping reaches today, not this one.
+        [managedMcpManifestKey('copilot', true)]: [],
+      });
+      // Cursor's x is still the team's, now a literal: its own rules find nothing to keep.
+      await writeTeamMcp('servers:\n  - name: x\n    transport: http\n    url: https://x.example/mcp\n');
+      await fse.appendFile(path.join(projectRoot, '.git', 'info', 'exclude'), '/.mcp.json\n');
+
+      const check = await excludeCheck();
+      if (!check) throw new Error('no git exclude check');
+      expect(await check.check()).toBe(false);
+      expect(check.fix ?? '').toContain(shared);
+    });
+
+    describe('for an HTTP-backed team, judged by the records the local agent wrote', () => {
+      const writeRecord = (record: Record<string, unknown>): Promise<void> =>
+        fse.outputJson(managedMcpManifestPath(getDataHome(localConfig), projectRoot), { [managedMcpManifestKey('claude', true)]: [record] });
+
+      beforeEach(async () => {
+        Object.assign(localConfig, { repo: { localPath: repoPath, remote: 'https://teamai.example', kind: 'http', url: 'https://teamai.example' } });
+        // An HTTP team has no mcp.yaml: its servers arrive through install_mcp.
+        await fse.remove(path.join(repoPath, 'mcp'));
+      });
+
+      it.each([
+        ['notes it carried a header or env value', { name: 'jira', hash: 'h', resolved: true }],
+        ['is an older local agent\'s, without that note, and its entry holds a header', { name: 'jira', hash: 'h' }],
+      ])('fails while git would track the file, and names it, when the record %s', async (_label, record) => {
+        await writeRecord(record);
+
+        const check = await excludeCheck();
+        if (!check) throw new Error('no git exclude check');
+        expect(await check.check()).toBe(false);
+        expect(check.fix).toContain(path.join(projectRoot, '.mcp.json'));
+        // No pull writes an HTTP team's servers, so none lists the file.
+        expect(check.fix).not.toContain('teamai pull');
+      });
+
+      it('passes once git ignores the file', async () => {
+        await writeRecord({ name: 'jira', hash: 'h', resolved: true });
+        await fse.appendFile(path.join(projectRoot, '.git', 'info', 'exclude'), '/.mcp.json\n');
+
+        const check = await excludeCheck();
+        if (!check) throw new Error('no git exclude check');
+        expect(await check.check()).toBe(true);
+      });
+
+      it('still fails for a file managed-mcp-files.json lists, holding a server, while the manifest has no record for it', async () => {
+        const { trackResolvedMcpFiles } = await import('../mcp-resolved-files.js');
+        await fse.remove(managedMcpManifestPath(getDataHome(localConfig), projectRoot));
+        expect(await trackResolvedMcpFiles(localConfig, [{ tool: 'claude', file: path.join(projectRoot, '.mcp.json') }])).toBe('written');
+
+        const check = await excludeCheck();
+        if (!check) throw new Error('no git exclude check');
+        expect(await check.check()).toBe(false);
+        expect(check.fix).toContain(path.join(projectRoot, '.mcp.json'));
+      });
+
+      it('still fails while a server carrying a credential has lost its record, though another server\'s remains', async () => {
+        await fse.writeJson(path.join(projectRoot, '.mcp.json'), {
+          mcpServers: {
+            jira: { type: 'http', url: 'https://jira.example/mcp', headers: { Authorization: 'Bearer t0ken' } },
+            local: { command: 'local-mcp' },
+          },
+        });
+        await writeRecord({ name: 'local', hash: 'h', resolved: false });
+
+        const check = await excludeCheck();
+        if (!check) throw new Error('no git exclude check');
+        expect(await check.check()).toBe(false);
+      });
+
+      it('fails for a credential a local agent from before 57636a27 wrote at CodeBuddy\'s former .codebuddy/mcp.json', async () => {
+        const old = path.join(projectRoot, '.codebuddy', 'mcp.json');
+        await fse.outputJson(old, { mcpServers: { clawpro: { type: 'http', url: 'https://clawpro.example/mcp', headers: { Authorization: 'Bearer t0ken' } } } });
+        await fse.outputJson(managedMcpManifestPath(getDataHome(localConfig), projectRoot), {
+          [managedMcpManifestKey('codebuddy', true)]: [{ name: 'clawpro', hash: 'h' }],
+        });
+
+        const check = await excludeCheck();
+        if (!check) throw new Error('no git exclude check');
+        expect(await check.check()).toBe(false);
+        expect(check.fix ?? '').toContain(old);
+      });
+
+      it('has nothing to say of a file whose recorded server carries neither header nor env value', async () => {
+        const jira = { type: 'http', url: 'https://jira.example/mcp' };
+        await fse.writeJson(path.join(projectRoot, '.mcp.json'), { mcpServers: { jira } });
+        const { entryHash } = await import('../resources/mcp-format.js');
+        await writeRecord({ name: 'jira', hash: entryHash(jira), resolved: false });
+
+        expect(await excludeCheck()).toBeUndefined();
+      });
+    });
+
     describe('a config an older teamai wrote under a mapping an earlier teamai.yaml made, before a pull on this version', () => {
       const old = (): string => path.join(projectRoot, '.cursor', 'team-mcp.json');
       const commitTeamYaml = (toolPaths: object): void => {