fix(installer): stop clobbering foreign and JSONC MCP server config

[latekvo]

Summary

The MCP config installer (packages/argent-installer/src/mcp-configs.ts) is supposed to only ever touch the argent entry in a user's editor MCP config. Two confirmed defects broke that contract and silently corrupted unrelated configuration. This PR fixes both across every backend (JSON, JSONC, and TOML) and adds regression coverage.

Defect A — uninstall over-prunes unrelated config

writeJsonOrRemove(value) ran the whole config through pruneEmptyConfig, which recursively drops any empty object/array anywhere in the tree, and then wrote the pruned result. So when remove() deleted the argent entry and wrote back, other MCP servers lost their args: [] / env: {} keys, and any sibling user key containing an empty object/array was deleted. The TOML-backed Codex config had the identical bug in writeTomlOrRemove.

Repro: a Cursor .cursor/mcp.json with
mcpServers: { argent: {...}, other: { command: "other-bin", args: [], env: {} } }, userSettings: { theme: "dark", overrides: {} }

• Observed after Cursor.remove(path): other becomes just { command: "other-bin" } (its args/env gone) and userSettings.overrides is stripped.
• Expected: other and userSettings are preserved byte-for-byte; only argent is removed.

Defect B — clobbering a JSONC config on write

.vscode/mcp.json is JSONC (VS Code allows comments and trailing commas), but the VS Code adapter read it with readJson, whose catch { return {} } turns any non-strict-JSON file into {}. write then persisted only { servers: { argent } }, destroying every pre-existing user server (and comments). The same flaw affected the other readJson → writeJson adapters — most importantly Cursor and Kiro, which are comment-tolerant VS Code forks whose mcp.json legitimately contains comments, plus Claude Code, Windsurf, and Gemini (strict JSON, but a hand-added comment would have wiped the file). The Zed and opencode adapters were already hardened with readJsonc + editJsoncFile.

Repro: a Cursor/Kiro mcp.json containing a // comment and mcpServers: { myserver: {...} }

• Observed after the adapter's write(path, getMcpEntry()): myserver and the comment are gone.
• Expected: myserver and the comment survive; argent is added alongside.

Fixes

• A: writeJsonOrRemove no longer deep-prunes. It writes data unchanged, and deletes the file only when the top-level object has no own keys. Each remover collapses just its own now-empty argent container along the argent path (new deleteIfEmpty helper) before writing, so a config that held only argent still results in file deletion. Foreign servers and user keys are preserved exactly. writeTomlOrRemove received the identical non-deep-pruning treatment so the Codex TOML config is protected the same way (pruneEmptyConfig is removed entirely). Applied to the Cursor / Claude Code / Windsurf / Gemini / Kiro / Codex removers, the Cursor allowlist remover, and removeClaudePermission.
• B: the JSONC-safe write path (read with readJsonc, mutate via editJsoncFile — path-targeted edits that preserve comments and foreign servers) now covers VS Code (servers key) and the mcpServers-keyed adapters Cursor, Kiro, Claude Code, Windsurf, and Gemini, matching the Zed/opencode adapters. write, remove, and hasArgentEntry all go through the JSONC path per adapter so a commented file round-trips cleanly on install and uninstall. JSONC is a superset of JSON, so this is safe for the strict-JSON adapters and unifies the write path; each adapter keeps its own key structure, value shape (e.g. Claude Code's type: "stdio"), and config location. The allowlist helpers (Cursor's permissions.json, and the autoApprove/alwaysAllow/trust toggles) are left on readJson/writeJson — they are a separate concern and never clobber (they early-return when the argent entry is absent), so they stay out of scope.

Tests

Added to the describe("installer preserves foreign MCP config") block in packages/argent-installer/test/mcp-configs.test.ts. Each new test fails on the original code and passes with the fix:

• Defect A (JSON): Cursor.remove keeps a foreign server's empty env/args and a sibling user key.
• Defect A (TOML): Codex.remove keeps a foreign server's args = [] and a sibling empty table, and deletes the file when argent was the only content.
• Defect B (JSONC): parametrized write test over Cursor, Claude Code, Windsurf, Gemini, Kiro — a hand-authored comment and a pre-existing foreign server both survive an argent write (alongside the existing VS Code case).

Full installer suite: 309 passed. tsc --noEmit (src + tests), eslint, and prettier all clean.

[hubgan]

Reviewed the installer changes and drove the write/remove paths end-to-end across all backends — both defects are genuinely fixed: foreign servers and comments are preserved on install and uninstall for JSON, JSONC, and TOML, and typecheck/lint/the full suite are clean. A few inline notes below — one scope gap in the allowlist helpers that the "only touch argent" contract doesn't yet cover (pre-existing, but newly reachable via update), plus a couple of behaviors that are correct but not pinned by a test.

[hubgan]

A few inline notes below: one test-coverage gap on the update/hasArgentEntry path plus a couple of cleanups. No blocking correctness issues — the foreign-server and JSONC/comment preservation itself holds up.