fix(mcp): surface managed-mcp.json errors in headless startup

The headless (-p) MCP consumer destructured only servers from the
config promise and discarded errors. A fatal managed-mcp.json
fail-closes every file-based MCP source, so scripted users saw an empty
server list with no diagnostic — indistinguishable from an intentionally
empty configuration. Emit the config errors on stderr in non-interactive
sessions (interactive already surfaces them via the MCP error UI).

Author: 0xfandom

src/main.tsx

@@ -147,6 +147,8 @@ import { registerMcpXaaIdpCommand } from 'src/commands/mcp/xaaIdpCommand.js';
 import { fetchClaudeAIMcpConfigsIfEligible } from 'src/services/mcp/claudeai.js';
 import { clearServerCache } from 'src/services/mcp/client.js';
 import { areMcpConfigsAllowedWithEnterpriseMcpConfig, dedupClaudeAiMcpServers, doesEnterpriseMcpConfigExist, filterMcpServersByPolicy, getClaudeCodeMcpConfigs, getMcpServerSignature, parseMcpConfig, parseMcpConfigFromFilePath } from 'src/services/mcp/config.js';
+import { getHeadlessMcpConfigWarnings } from 'src/services/mcp/headlessErrors.js';
+import type { PluginError } from 'src/types/plugin.js';
 import { excludeCommandsByServer, excludeResourcesByServer } from 'src/services/mcp/utils.js';
 import { isXaaEnabled } from 'src/services/mcp/xaaIdpLogin.js';
 import { getRelevantTips } from 'src/services/tips/tipRegistry.js';
@@ -1778,7 +1780,8 @@ async function run(): Promise<CommanderCommand> {
     // only explicit --mcp-config works. dynamicMcpConfig is spread onto
     // allMcpConfigs downstream so it survives this skip.
     const mcpConfigPromise = (strictMcpConfig || isBareMode() ? Promise.resolve({
-      servers: {} as Record<string, ScopedMcpServerConfig>
+      servers: {} as Record<string, ScopedMcpServerConfig>,
+      errors: [] as PluginError[]
     }) : getClaudeCodeMcpConfigs(dynamicMcpConfig)).then(result => {
       mcpConfigResolvedMs = Date.now() - mcpConfigStart;
       return result;
@@ -2334,8 +2337,16 @@ async function run(): Promise<CommanderCommand> {
     }
 
     const {
-      servers: existingMcpConfigs
+      servers: existingMcpConfigs,
+      errors: mcpConfigErrors = []
     } = await mcpConfigPromise;
+    // Headless (-p) has no MCP-error UI, so a fatal managed-mcp.json fail-closes
+    // every file-based source with no diagnostic — indistinguishable from an
+    // intentionally empty config. Surface those errors on stderr so scripted
+    // users see why nothing loaded. Interactive surfaces them via the MCP UI.
+    for (const line of getHeadlessMcpConfigWarnings(isNonInteractiveSession, mcpConfigErrors)) {
+      process.stderr.write(`${line}\n`);
+    }
     // CLI flag (--mcp-config) should override file-based configs, matching settings precedence
     const allMcpConfigs = {
       ...existingMcpConfigs,

src/services/mcp/headlessErrors.test.ts

@@ -0,0 +1,25 @@
+import { expect, test } from 'bun:test'
+
+import type { PluginError } from '../../types/plugin.js'
+import { getHeadlessMcpConfigWarnings } from './headlessErrors.js'
+
+const managedError: PluginError = {
+  type: 'generic-error',
+  source: '/managed/managed-mcp.json',
+  error: 'Managed MCP config is invalid (mcpServers.__proto__): reserved name',
+}
+
+test('emits a warning line per error in a headless session', () => {
+  const lines = getHeadlessMcpConfigWarnings(true, [managedError])
+  expect(lines).toEqual([
+    'Warning: Managed MCP config is invalid (mcpServers.__proto__): reserved name',
+  ])
+})
+
+test('stays silent in an interactive session (MCP UI surfaces errors there)', () => {
+  expect(getHeadlessMcpConfigWarnings(false, [managedError])).toEqual([])
+})
+
+test('emits nothing when there are no errors', () => {
+  expect(getHeadlessMcpConfigWarnings(true, [])).toEqual([])
+})

src/services/mcp/headlessErrors.ts

@@ -0,0 +1,21 @@
+import { getPluginErrorMessage, type PluginError } from '../../types/plugin.js'
+
+/**
+ * Build the stderr warning lines a headless (`-p`) session should emit for MCP
+ * config errors.
+ *
+ * Interactive sessions surface these through the MCP error UI, but headless has
+ * no such surface: a fatal managed-mcp.json fail-closes every file-based source
+ * and, without this, the caller sees an empty server list with no reason why —
+ * indistinguishable from an intentionally empty config. Returns [] when not
+ * headless or when there is nothing to report, so the caller writes nothing.
+ */
+export function getHeadlessMcpConfigWarnings(
+  isNonInteractiveSession: boolean,
+  errors: PluginError[],
+): string[] {
+  if (!isNonInteractiveSession || errors.length === 0) {
+    return []
+  }
+  return errors.map(error => `Warning: ${getPluginErrorMessage(error)}`)
+}