@agentteams/cli 0.1.83 → 0.1.84

package/dist/mcp-registration/install.js

@@ -3,7 +3,7 @@ import { PROJECT_SCOPE_FILE_MODE, USER_SCOPE_FILE_MODE, writeConfigFileAtomicall
 import { findClient, MCP_CLIENTS } from './clients.js';
 import { detectClients } from './detect.js';
 import { McpConfigParseError, upsertContainerEntry } from './jsonc.js';
-import { buildEntryValue, redactSecrets, renderConfigSnippet, renderVendorCommandLine } from './render.js';
+import { buildEntryValue, redactKeyMaterial, renderConfigSnippet, renderVendorCommandLine } from './render.js';
 import { buildServerSpec, MCP_SERVER_NAME } from './serverSpec.js';
 import { runVendorCommand } from './vendorCommand.js';
 function firstLines(text, limit = 4) {
@@ -22,9 +22,8 @@ function installViaVendorCommand(options, configPath, manualSnippet) {
     if (!vendor)
         throw new Error(`No vendor command configured for ${client.id}/${scope}`);
     const spec = buildServerSpec({
-        credentials: options.credentials,
-        secretMode: scope === 'user' ? 'literal' : 'reference',
         serverEntry: options.serverEntry,
+        context: options.context,
     });
     const executable = client.executables[0];
     const runner = options.vendorRunner ?? runVendorCommand;
@@ -38,9 +37,9 @@ function installViaVendorCommand(options, configPath, manualSnippet) {
             manualSnippet,
         };
     }
-    // Vendor CLIs echo their own argv on failure, and user-scope argv carries the
-    // API key, so nothing reaches the caller before passing through redaction.
-    const combined = redactSecrets(`${outcome.stdout}\n${outcome.stderr}`, [options.credentials.apiKey]);
+    // Registration passes no credential, so there is no value of ours to redact — but a
+    // vendor CLI echoing its own argv/environment on failure can still surface a `key_`.
+    const combined = redactKeyMaterial(`${outcome.stdout}\n${outcome.stderr}`);
     const alreadyRegistered = (vendor.alreadyRegisteredPatterns ?? []).some((pattern) => pattern.test(combined));
     if (alreadyRegistered) {
         return {
@@ -75,10 +74,8 @@ function installViaJsonMerge(options, configPath, manualSnippet) {
         throw new Error(`No container key configured for ${client.id}/${scope}`);
     const base = { clientId: client.id, scope, strategy: definition.strategy, configPath };
     const spec = buildServerSpec({
-        credentials: options.credentials,
-        // Project files are committable, so they never receive a literal key.
-        secretMode: scope === 'user' ? 'literal' : 'reference',
         serverEntry: options.serverEntry,
+        context: options.context,
     });
     let source = '';
     if (existsSync(configPath)) {
@@ -99,7 +96,7 @@ function installViaJsonMerge(options, configPath, manualSnippet) {
         edited = upsertContainerEntry(source, {
             containerKey,
             entryKey: serverName,
-            entryValue: buildEntryValue(definition.entryShape ?? 'plain', spec, client.secretReference),
+            entryValue: buildEntryValue(definition.entryShape ?? 'plain', spec),
         });
     }
     catch (error) {
@@ -145,9 +142,8 @@ export function installClient(options) {
     const definition = client.scopes[scope];
     const configPath = definition.configPath(options.context);
     const displaySpec = buildServerSpec({
-        credentials: options.credentials,
-        secretMode: 'reference',
         serverEntry: options.serverEntry,
+        context: options.context,
     });
     const manualSnippet = renderConfigSnippet(client, scope, displaySpec, serverName);
     if (definition.strategy === 'configOnly') {
@@ -208,7 +204,8 @@ export function buildBatchPlan(options) {
  * the collected outcomes.
  */
 export function runBatchInstall(options) {
-    const plan = buildBatchPlan({ ...options, scope: 'user' });
+    const scope = options.scope ?? 'user';
+    const plan = buildBatchPlan({ ...options, scope });
     const results = [];
     for (const entry of plan.entries) {
         const client = findClient(entry.clientId);
@@ -217,7 +214,7 @@ export function runBatchInstall(options) {
         if (!entry.applicable) {
             results.push({
                 clientId: entry.clientId,
-                scope: 'user',
+                scope: entry.scope,
                 strategy: entry.strategy,
                 configPath: entry.targetPath,
                 outcome: entry.strategy === 'configOnly' ? 'SKIPPED_CONFIG_ONLY' : 'SKIPPED_NOT_DETECTED',
@@ -227,7 +224,7 @@ export function runBatchInstall(options) {
         }
         results.push(installClient({
             client,
-            scope: 'user',
+            scope: entry.scope,
             credentials: options.credentials,
             context: options.context,
             serverEntry: options.serverEntry,

package/dist/mcp-registration/install.js.map

@@ -1 +1 @@
-{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/mcp-registration/install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,aAAa,EAA8B,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC3G,OAAO,EAAE,eAAe,EAAE,eAAe,EAAuB,MAAM,iBAAiB,CAAC;AAExF,OAAO,EAAE,gBAAgB,EAAqB,MAAM,oBAAoB,CAAC;AAYzE,SAAS,UAAU,CAAC,IAAY,EAAE,KAAK,GAAG,CAAC;IACzC,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SACjC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;SACf,IAAI,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAA6B,EAC7B,UAAkB,EAClB,aAAqB;IAErB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,eAAe,CAAC;IACzD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IACjC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC;IAEvF,MAAM,IAAI,GAAG,eAAe,CAAC;QAC3B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;QACtD,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,IAAI,gBAAgB,CAAC;IACxD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAE/G,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAW,CAAC;IAEhG,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,mBAAmB,UAAU,OAAO,OAAO,CAAC,UAAU,EAAE;YAChE,aAAa;SACd,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAErG,MAAM,iBAAiB,GAAG,CAAC,MAAM,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7G,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,oBAAoB;YAC7B,MAAM,EAAE,KAAK,UAAU,eAAe,UAAU,wJAAwJ;YACxM,aAAa;SACd,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,WAAW;YACpB,MAAM,EACJ,MAAM,CAAC,aAAa,KAAK,QAAQ;gBAC/B,CAAC,CAAC,eAAe,UAAU,WAAW,UAAU,qDAAqD;gBACrG,CAAC,CAAC,eAAe,UAAU,WAAW,UAAU,aAAa;SAClE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,IAAI;QACP,OAAO,EAAE,QAAQ;QACjB,MAAM,EAAE,KAAK,UAAU,+BAA+B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC,QAAQ,CAAC,IAAI,WAAW,EAAE;QACtH,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,OAA6B,EAAE,UAAkB,EAAE,aAAqB;IACnG,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAClC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,eAAe,CAAC;IACzD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;IAC7C,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,CAAC,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC;IAE5F,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAW,CAAC;IAEhG,MAAM,IAAI,GAAG,eAAe,CAAC;QAC3B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,sEAAsE;QACtE,UAAU,EAAE,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;QACtD,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,GAAG,IAAI;gBACP,OAAO,EAAE,QAAQ;gBACjB,MAAM,EAAE,kBAAkB,UAAU,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;gBACjG,aAAa;aACd,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,oBAAoB,CAAC,MAAM,EAAE;YACpC,YAAY;YACZ,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC,UAAU,IAAI,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC;SAC5F,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpF,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,GAAG,UAAU,yBAAyB,MAAM,wEAAwE;YAC5H,aAAa;SACd,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,oBAAoB;YAC7B,MAAM,EAAE,IAAI,UAAU,2BAA2B,UAAU,gDAAgD;SAC5G,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,yBAAyB,CACvC,UAAU,EACV,MAAM,CAAC,IAAI,EACX,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,uBAAuB,EACjE,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CACpD,CAAC;QACF,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,MAAM,CAAC,OAAO;gBACpB,CAAC,CAAC,gBAAgB,UAAU,cAAc,UAAU,GAAG;gBACvD,CAAC,CAAC,UAAU,UAAU,QAAQ,UAAU,GAAG;YAC7C,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,SAAS;SAC5C,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,mBAAmB,UAAU,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC;YACzI,aAAa;SACd,CAAC;IACJ,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAClC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,eAAe,CAAC;IACzD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1D,MAAM,WAAW,GAAG,eAAe,CAAC;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,WAAW;QACvB,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAElF,IAAI,UAAU,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QACzC,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,KAAK;YACL,QAAQ,EAAE,YAAY;YACtB,UAAU;YACV,OAAO,EAAE,qBAAqB;YAC9B,MAAM,EAAE,UAAU,CAAC,gBAAgB,IAAI,qDAAqD;YAC5F,aAAa;SACd,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;QAC5C,OAAO,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,mBAAmB,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AACjE,CAAC;AA8BD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC;IACtC,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAE7G,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/E,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,KAAK,CAAC;QAC3C,MAAM,UAAU,GAAG,QAAQ,IAAI,UAAU,CAAC,QAAQ,KAAK,YAAY,CAAC;QAEpE,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC,QAAQ;YAAE,MAAM,GAAG,+BAA+B,CAAC;aACnD,IAAI,UAAU,CAAC,QAAQ,KAAK,YAAY;YAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC;QAEpF,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,MAAM;YACpC,cAAc,EAAE,MAAM,EAAE,cAAc,IAAI,IAAI;YAC9C,WAAW,EAAE,MAAM,EAAE,WAAW,IAAI,EAAE;YACtC,KAAK;YACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC;YAClD,UAAU;YACV,MAAM;SACP,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;QACL,OAAO;QACP,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE;KAC1F,CAAC;AACJ,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC7D,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,OAAO,EAAE,KAAK,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,sBAAsB;gBACzF,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,UAAU;aACnC,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,OAAO,CAAC,IAAI,CACV,aAAa,CAAC;YACZ,MAAM;YACN,KAAK,EAAE,MAAM;YACb,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,sBAAsB,CAAC,OAAwB;IAC7D,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,CAAC"}
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/mcp-registration/install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,aAAa,EAA8B,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC/G,OAAO,EAAE,eAAe,EAAE,eAAe,EAAuB,MAAM,iBAAiB,CAAC;AAExF,OAAO,EAAE,gBAAgB,EAAqB,MAAM,oBAAoB,CAAC;AAYzE,SAAS,UAAU,CAAC,IAAY,EAAE,KAAK,GAAG,CAAC;IACzC,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SACjC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;SACf,IAAI,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAA6B,EAC7B,UAAkB,EAClB,aAAqB;IAErB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,eAAe,CAAC;IACzD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IACjC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC;IAEvF,MAAM,IAAI,GAAG,eAAe,CAAC;QAC3B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,IAAI,gBAAgB,CAAC;IACxD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAE/G,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAW,CAAC;IAEhG,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,mBAAmB,UAAU,OAAO,OAAO,CAAC,UAAU,EAAE;YAChE,aAAa;SACd,CAAC;IACJ,CAAC;IAED,oFAAoF;IACpF,qFAAqF;IACrF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE3E,MAAM,iBAAiB,GAAG,CAAC,MAAM,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7G,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,oBAAoB;YAC7B,MAAM,EAAE,KAAK,UAAU,eAAe,UAAU,wJAAwJ;YACxM,aAAa;SACd,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,WAAW;YACpB,MAAM,EACJ,MAAM,CAAC,aAAa,KAAK,QAAQ;gBAC/B,CAAC,CAAC,eAAe,UAAU,WAAW,UAAU,qDAAqD;gBACrG,CAAC,CAAC,eAAe,UAAU,WAAW,UAAU,aAAa;SAClE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,IAAI;QACP,OAAO,EAAE,QAAQ;QACjB,MAAM,EAAE,KAAK,UAAU,+BAA+B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC,QAAQ,CAAC,IAAI,WAAW,EAAE;QACtH,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,OAA6B,EAAE,UAAkB,EAAE,aAAqB;IACnG,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAClC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,eAAe,CAAC;IACzD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;IAC7C,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,CAAC,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC;IAE5F,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAW,CAAC;IAEhG,MAAM,IAAI,GAAG,eAAe,CAAC;QAC3B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,GAAG,IAAI;gBACP,OAAO,EAAE,QAAQ;gBACjB,MAAM,EAAE,kBAAkB,UAAU,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;gBACjG,aAAa;aACd,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,oBAAoB,CAAC,MAAM,EAAE;YACpC,YAAY;YACZ,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC,UAAU,IAAI,OAAO,EAAE,IAAI,CAAC;SACpE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpF,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,GAAG,UAAU,yBAAyB,MAAM,wEAAwE;YAC5H,aAAa;SACd,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,oBAAoB;YAC7B,MAAM,EAAE,IAAI,UAAU,2BAA2B,UAAU,gDAAgD;SAC5G,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,yBAAyB,CACvC,UAAU,EACV,MAAM,CAAC,IAAI,EACX,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,uBAAuB,EACjE,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CACpD,CAAC;QACF,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,MAAM,CAAC,OAAO;gBACpB,CAAC,CAAC,gBAAgB,UAAU,cAAc,UAAU,GAAG;gBACvD,CAAC,CAAC,UAAU,UAAU,QAAQ,UAAU,GAAG;YAC7C,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,SAAS;SAC5C,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,mBAAmB,UAAU,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC;YACzI,aAAa;SACd,CAAC;IACJ,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAClC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,eAAe,CAAC;IACzD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1D,MAAM,WAAW,GAAG,eAAe,CAAC;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAElF,IAAI,UAAU,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QACzC,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,KAAK;YACL,QAAQ,EAAE,YAAY;YACtB,UAAU;YACV,OAAO,EAAE,qBAAqB;YAC9B,MAAM,EAAE,UAAU,CAAC,gBAAgB,IAAI,qDAAqD;YAC5F,aAAa;SACd,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;QAC5C,OAAO,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,mBAAmB,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AACjE,CAAC;AA8BD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC;IACtC,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAE7G,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/E,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,KAAK,CAAC;QAC3C,MAAM,UAAU,GAAG,QAAQ,IAAI,UAAU,CAAC,QAAQ,KAAK,YAAY,CAAC;QAEpE,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC,QAAQ;YAAE,MAAM,GAAG,+BAA+B,CAAC;aACnD,IAAI,UAAU,CAAC,QAAQ,KAAK,YAAY;YAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC;QAEpF,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,MAAM;YACpC,cAAc,EAAE,MAAM,EAAE,cAAc,IAAI,IAAI;YAC9C,WAAW,EAAE,MAAM,EAAE,WAAW,IAAI,EAAE;YACtC,KAAK;YACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC;YAClD,UAAU;YACV,MAAM;SACP,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;QACL,OAAO;QACP,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE;KAC1F,CAAC;AACJ,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC;IACtC,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,OAAO,EAAE,KAAK,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,sBAAsB;gBACzF,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,UAAU;aACnC,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,OAAO,CAAC,IAAI,CACV,aAAa,CAAC;YACZ,MAAM;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,sBAAsB,CAAC,OAAwB;IAC7D,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/mcp-registration/render.d.ts

@@ -1,6 +1,6 @@
-import type { McpClientDefinition, McpEntryShape, McpScope, McpSecretReference, McpServerSpec } from './types.js';
+import type { McpClientDefinition, McpEntryShape, McpScope, McpServerSpec } from './types.js';
 /** Serialize the AgentTeams server entry in the shape the target client expects. */
-export declare function buildEntryValue(shape: McpEntryShape, spec: McpServerSpec, reference?: McpSecretReference): Record<string, unknown>;
+export declare function buildEntryValue(shape: McpEntryShape, spec: McpServerSpec): Record<string, unknown>;
 /**
  * The copy-pasteable config fragment for one client/scope. This is the escape
  * hatch every failure path points at, so it must be complete on its own: the
@@ -10,9 +10,11 @@ export declare function renderConfigSnippet(client: McpClientDefinition, scope:
 /** The equivalent vendor command, for users who prefer to run it themselves. */
 export declare function renderVendorCommandLine(client: McpClientDefinition, scope: McpScope, spec: McpServerSpec, serverName: string): string | null;
 /**
- * Strip credential values from anything that reaches a terminal, a log or a
- * test snapshot. Vendor CLIs echo their own arguments on failure, so their
- * captured output has to pass through here before it is shown.
+ * Strip AgentTeams key material from vendor output before it reaches a terminal or a log.
+ *
+ * Registration itself no longer holds a credential — the server spec embeds nothing — so
+ * there is no value to pass in. What remains is that vendor CLIs echo their own argv and
+ * environment on failure, and that output can carry a `key_` this process never saw.
  */
-export declare function redactSecrets(text: string, secrets: string[]): string;
+export declare function redactKeyMaterial(text: string): string;
 //# sourceMappingURL=render.d.ts.map

package/dist/mcp-registration/render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/mcp-registration/render.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,QAAQ,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAYlH,oFAAoF;AACpF,wBAAgB,eAAe,CAC7B,KAAK,EAAE,aAAa,EACpB,IAAI,EAAE,aAAa,EACnB,SAAS,GAAE,kBAAmC,GAC7C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAiBzB;AA+BD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,QAAQ,EACf,IAAI,EAAE,aAAa,EACnB,UAAU,EAAE,MAAM,GACjB,MAAM,CAWR;AAED,gFAAgF;AAChF,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,QAAQ,EACf,IAAI,EAAE,aAAa,EACnB,UAAU,EAAE,MAAM,GACjB,MAAM,GAAG,IAAI,CAMf;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAOrE"}
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/mcp-registration/render.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE9F,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBlG;AAwBD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,QAAQ,EACf,IAAI,EAAE,aAAa,EACnB,UAAU,EAAE,MAAM,GACjB,MAAM,CAWR;AAED,gFAAgF;AAChF,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,QAAQ,EACf,IAAI,EAAE,aAAa,EACnB,UAAU,EAAE,MAAM,GACjB,MAAM,GAAG,IAAI,CAMf;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD"}

package/dist/mcp-registration/render.js

@@ -1,32 +1,19 @@
-import { CREDENTIAL_ENV_KEYS } from './serverSpec.js';
-function referencedSpec(spec, reference) {
-    if (reference !== 'opencodeEnv')
-        return spec;
-    const apiKey = spec.env[CREDENTIAL_ENV_KEYS.apiKey];
-    if (apiKey !== `\${${CREDENTIAL_ENV_KEYS.apiKey}}`)
-        return spec;
-    return {
-        ...spec,
-        env: { ...spec.env, [CREDENTIAL_ENV_KEYS.apiKey]: `{env:${CREDENTIAL_ENV_KEYS.apiKey}}` },
-    };
-}
 /** Serialize the AgentTeams server entry in the shape the target client expects. */
-export function buildEntryValue(shape, spec, reference = 'dollarBraces') {
-    const clientSpec = referencedSpec(spec, reference);
+export function buildEntryValue(shape, spec) {
     if (shape === 'opencode') {
         return {
             type: 'local',
-            command: [clientSpec.command, ...clientSpec.args],
-            environment: { ...clientSpec.env },
+            command: [spec.command, ...spec.args],
+            environment: { ...spec.env },
             enabled: true,
         };
     }
     const entry = {};
     if (shape === 'stdio')
         entry.type = 'stdio';
-    entry.command = clientSpec.command;
-    entry.args = [...clientSpec.args];
-    entry.env = { ...clientSpec.env };
+    entry.command = spec.command;
+    entry.args = [...spec.args];
+    entry.env = { ...spec.env };
     return entry;
 }
 function tomlString(value) {
@@ -38,11 +25,7 @@ function renderCodexToml(serverName, spec) {
         `command = ${tomlString(spec.command)}`,
         `args = [${spec.args.map(tomlString).join(', ')}]`,
     ];
-    const apiKey = spec.env[CREDENTIAL_ENV_KEYS.apiKey];
-    if (apiKey === `\${${CREDENTIAL_ENV_KEYS.apiKey}}`) {
-        lines.push(`env_vars = [${tomlString(CREDENTIAL_ENV_KEYS.apiKey)}]`);
-    }
-    const envEntries = Object.entries(spec.env).filter(([key, value]) => key !== CREDENTIAL_ENV_KEYS.apiKey || value !== `\${${CREDENTIAL_ENV_KEYS.apiKey}}`);
+    const envEntries = Object.entries(spec.env);
     if (envEntries.length > 0) {
         lines.push('', `[mcp_servers.${serverName}.env]`);
         for (const [key, value] of envEntries) {
@@ -62,7 +45,7 @@ export function renderConfigSnippet(client, scope, spec, serverName) {
         return renderCodexToml(serverName, spec);
     }
     const containerKey = definition.containerKey;
-    const entry = buildEntryValue(definition.entryShape ?? 'plain', spec, client.secretReference);
+    const entry = buildEntryValue(definition.entryShape ?? 'plain', spec);
     const document = containerKey ? { [containerKey]: { [serverName]: entry } } : { [serverName]: entry };
     return JSON.stringify(document, null, 2);
 }
@@ -75,17 +58,13 @@ export function renderVendorCommandLine(client, scope, spec, serverName) {
     return [client.executables[0], ...args].join(' ');
 }
 /**
- * Strip credential values from anything that reaches a terminal, a log or a
- * test snapshot. Vendor CLIs echo their own arguments on failure, so their
- * captured output has to pass through here before it is shown.
+ * Strip AgentTeams key material from vendor output before it reaches a terminal or a log.
+ *
+ * Registration itself no longer holds a credential — the server spec embeds nothing — so
+ * there is no value to pass in. What remains is that vendor CLIs echo their own argv and
+ * environment on failure, and that output can carry a `key_` this process never saw.
  */
-export function redactSecrets(text, secrets) {
-    let redacted = text;
-    for (const secret of secrets) {
-        if (!secret || secret.length < 4)
-            continue;
-        redacted = redacted.split(secret).join('***');
-    }
-    return redacted;
+export function redactKeyMaterial(text) {
+    return text.replace(/(?<![A-Za-z0-9_-])key_[A-Za-z0-9][A-Za-z0-9_-]{7,}/g, '***');
 }
 //# sourceMappingURL=render.js.map

package/dist/mcp-registration/render.js.map

@@ -1 +1 @@
-{"version":3,"file":"render.js","sourceRoot":"","sources":["../../src/mcp-registration/render.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAGtD,SAAS,cAAc,CAAC,IAAmB,EAAE,SAA6B;IACxE,IAAI,SAAS,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,MAAM,mBAAmB,CAAC,MAAM,GAAG;QAAE,OAAO,IAAI,CAAC;IAChE,OAAO;QACL,GAAG,IAAI;QACP,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,QAAQ,mBAAmB,CAAC,MAAM,GAAG,EAAE;KAC1F,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAC7B,KAAoB,EACpB,IAAmB,EACnB,YAAgC,cAAc;IAE9C,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC;YACjD,WAAW,EAAE,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE;YAClC,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,IAAI,KAAK,KAAK,OAAO;QAAE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC;IAC5C,KAAK,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IACnC,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,CAAC,GAAG,GAAG,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC;IAClC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB,EAAE,IAAmB;IAC9D,MAAM,KAAK,GAAG;QACZ,gBAAgB,UAAU,GAAG;QAC7B,aAAa,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QACvC,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;KACnD,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,MAAM,mBAAmB,CAAC,MAAM,GAAG,EAAE,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,eAAe,UAAU,CAAC,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAChD,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,mBAAmB,CAAC,MAAM,IAAI,KAAK,KAAK,MAAM,mBAAmB,CAAC,MAAM,GAAG,CACtG,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,UAAU,OAAO,CAAC,CAAC;QAClD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAA2B,EAC3B,KAAe,EACf,IAAmB,EACnB,UAAkB;IAElB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAExC,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACjC,OAAO,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;IAC7C,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,UAAU,IAAI,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAC9F,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC;IACtG,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,uBAAuB,CACrC,MAA2B,EAC3B,KAAe,EACf,IAAmB,EACnB,UAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACvG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAiB;IAC3D,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC3C,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"render.js","sourceRoot":"","sources":["../../src/mcp-registration/render.ts"],"names":[],"mappings":"AAEA,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,KAAoB,EAAE,IAAmB;IACvE,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;YACrC,WAAW,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;YAC5B,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,IAAI,KAAK,KAAK,OAAO;QAAE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC;IAC5C,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,KAAK,CAAC,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB,EAAE,IAAmB;IAC9D,MAAM,KAAK,GAAG;QACZ,gBAAgB,UAAU,GAAG;QAC7B,aAAa,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QACvC,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;KACnD,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,UAAU,OAAO,CAAC,CAAC;QAClD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAA2B,EAC3B,KAAe,EACf,IAAmB,EACnB,UAAkB;IAElB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAExC,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACjC,OAAO,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;IAC7C,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,UAAU,IAAI,OAAO,EAAE,IAAI,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC;IACtG,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,uBAAuB,CACrC,MAA2B,EAC3B,KAAe,EACf,IAAmB,EACnB,UAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACvG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,qDAAqD,EAAE,KAAK,CAAC,CAAC;AACpF,CAAC"}

package/dist/mcp-registration/serverSpec.d.ts

@@ -1,31 +1,44 @@
-import type { McpServerSpec } from './types.js';
+import type { McpPathContext, McpServerSpec } from './types.js';
 /** Server name registered in every client. Kept stable so re-runs update rather than duplicate. */
 export declare const MCP_SERVER_NAME = "agentteams";
-export declare const CREDENTIAL_ENV_KEYS: {
-    readonly apiKey: "AGENTTEAMS_API_KEY";
-    readonly projectId: "AGENTTEAMS_PROJECT_ID";
-    readonly teamId: "AGENTTEAMS_TEAM_ID";
-    readonly apiUrl: "AGENTTEAMS_API_URL";
-};
+/** Published package the `npx` fallback runs. */
+export declare const MCP_RUNTIME_PACKAGE = "@agentteams/cli";
+/** Name of the globally installed executable, when there is one. */
+export declare const MCP_GLOBAL_EXECUTABLE = "agentteams";
+/**
+ * Project identity for command context and human-readable output only.
+ *
+ * There is no credential field on purpose: the generated server spec embeds nothing,
+ * and `agentteams mcp` resolves project config plus the OS credential store at request
+ * time. Re-adding one here would put a secret back into a client config file.
+ */
 export interface McpCredentials {
-    apiKey: string;
     projectId: string;
     teamId: string;
     apiUrl: string;
 }
-/**
- * `literal` writes the real API key into the client's own config file — only
- * ever used for user-scope `install`, where the file lives outside the repo and
- * is chmod 0600. Everything a human can read (`config` output, dry-run plans,
- * project-scope files that get committed) uses `reference`. The renderer then
- * converts that marker to each client's supported inheritance syntax.
- */
-export type SecretMode = 'literal' | 'reference';
 export interface BuildServerSpecOptions {
-    credentials: McpCredentials;
-    secretMode: SecretMode;
     /** Absolute path to a local `cli/dist/index.js`; omit to use the published package. */
     serverEntry?: string;
+    /**
+     * Registration context. When present, the spec is chosen from what this machine can
+     * actually spawn; when absent, the global executable is assumed.
+     */
+    context?: McpPathContext;
+    /** Injection seam so tests drive a fake PATH instead of the developer's machine. */
+    fileExists?: (path: string) => boolean;
 }
+/** Is a bare `agentteams` resolvable from this context's PATH? */
+export declare function hasGlobalExecutable(context: McpPathContext, fileExists?: (path: string) => boolean): boolean;
+/**
+ * What the client will spawn.
+ *
+ * A bare `agentteams` is the fast path, but it is only correct when the package is
+ * installed globally *and* the client inherits a PATH that contains it — neither holds
+ * for `npx @agentteams/cli mcp install` or for a GUI-launched client that never sourced
+ * a login shell. Those failures surface as an opaque "server failed to start" inside the
+ * client, so when the executable is not resolvable the spec falls back to `npx`, which
+ * works in both cases.
+ */
 export declare function buildServerSpec(options: BuildServerSpecOptions): McpServerSpec;
 //# sourceMappingURL=serverSpec.d.ts.map

package/dist/mcp-registration/serverSpec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serverSpec.d.ts","sourceRoot":"","sources":["../../src/mcp-registration/serverSpec.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,mGAAmG;AACnG,eAAO,MAAM,eAAe,eAAe,CAAC;AAE5C,eAAO,MAAM,mBAAmB;;;;;CAKtB,CAAC;AAEX,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,WAAW,CAAC;AAEjD,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,cAAc,CAAC;IAC5B,UAAU,EAAE,UAAU,CAAC;IACvB,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa,CAqB9E"}
+{"version":3,"file":"serverSpec.d.ts","sourceRoot":"","sources":["../../src/mcp-registration/serverSpec.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhE,mGAAmG;AACnG,eAAO,MAAM,eAAe,eAAe,CAAC;AAE5C,iDAAiD;AACjD,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD,oEAAoE;AACpE,eAAO,MAAM,qBAAqB,eAAe,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,oFAAoF;IACpF,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACxC;AAMD,kEAAkE;AAClE,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,cAAc,EACvB,UAAU,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAoB,GACjD,OAAO,CAUT;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa,CAc9E"}

package/dist/mcp-registration/serverSpec.js

@@ -1,29 +1,45 @@
-import { isAbsolute, resolve } from 'node:path';
-import { DEFAULT_API_URL } from '../utils/config.js';
+import { existsSync } from 'node:fs';
+import { delimiter, isAbsolute, join, resolve } from 'node:path';
 /** Server name registered in every client. Kept stable so re-runs update rather than duplicate. */
 export const MCP_SERVER_NAME = 'agentteams';
-export const CREDENTIAL_ENV_KEYS = {
-    apiKey: 'AGENTTEAMS_API_KEY',
-    projectId: 'AGENTTEAMS_PROJECT_ID',
-    teamId: 'AGENTTEAMS_TEAM_ID',
-    apiUrl: 'AGENTTEAMS_API_URL',
-};
-export function buildServerSpec(options) {
-    const { credentials, secretMode, serverEntry } = options;
-    const env = {
-        [CREDENTIAL_ENV_KEYS.apiKey]: secretMode === 'literal' ? credentials.apiKey : `\${${CREDENTIAL_ENV_KEYS.apiKey}}`,
-        [CREDENTIAL_ENV_KEYS.projectId]: credentials.projectId,
-        [CREDENTIAL_ENV_KEYS.teamId]: credentials.teamId,
-    };
-    // Only non-default API URLs are worth pinning; emitting the default would make
-    // every generated config break the day the hosted URL changes.
-    if (credentials.apiUrl && credentials.apiUrl !== DEFAULT_API_URL) {
-        env[CREDENTIAL_ENV_KEYS.apiUrl] = credentials.apiUrl;
+/** Published package the `npx` fallback runs. */
+export const MCP_RUNTIME_PACKAGE = '@agentteams/cli';
+/** Name of the globally installed executable, when there is one. */
+export const MCP_GLOBAL_EXECUTABLE = 'agentteams';
+function executableSuffixes() {
+    return process.platform === 'win32' ? ['', '.cmd', '.exe', '.bat', '.ps1'] : [''];
+}
+/** Is a bare `agentteams` resolvable from this context's PATH? */
+export function hasGlobalExecutable(context, fileExists = existsSync) {
+    const pathDirs = (context.env.PATH ?? '').split(delimiter).filter((entry) => entry.length > 0);
+    for (const directory of pathDirs) {
+        for (const suffix of executableSuffixes()) {
+            if (fileExists(join(directory, `${MCP_GLOBAL_EXECUTABLE}${suffix}`)))
+                return true;
+        }
     }
+    return false;
+}
+/**
+ * What the client will spawn.
+ *
+ * A bare `agentteams` is the fast path, but it is only correct when the package is
+ * installed globally *and* the client inherits a PATH that contains it — neither holds
+ * for `npx @agentteams/cli mcp install` or for a GUI-launched client that never sourced
+ * a login shell. Those failures surface as an opaque "server failed to start" inside the
+ * client, so when the executable is not resolvable the spec falls back to `npx`, which
+ * works in both cases.
+ */
+export function buildServerSpec(options) {
+    const { serverEntry } = options;
+    const env = {};
     if (serverEntry) {
         const entryPath = isAbsolute(serverEntry) ? serverEntry : resolve(serverEntry);
         return { command: 'node', args: [entryPath, 'mcp'], env };
     }
-    return { command: 'npx', args: ['-y', '@agentteams/cli', 'mcp'], env };
+    if (options.context && !hasGlobalExecutable(options.context, options.fileExists)) {
+        return { command: 'npx', args: ['-y', MCP_RUNTIME_PACKAGE, 'mcp'], env };
+    }
+    return { command: MCP_GLOBAL_EXECUTABLE, args: ['mcp'], env };
 }
 //# sourceMappingURL=serverSpec.js.map

package/dist/mcp-registration/serverSpec.js.map

@@ -1 +1 @@
-{"version":3,"file":"serverSpec.js","sourceRoot":"","sources":["../../src/mcp-registration/serverSpec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,mGAAmG;AACnG,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC;AAE5C,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,MAAM,EAAE,oBAAoB;IAC5B,SAAS,EAAE,uBAAuB;IAClC,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,oBAAoB;CACpB,CAAC;AAyBX,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC7D,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAEzD,MAAM,GAAG,GAA2B;QAClC,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,MAAM,GAAG;QACjH,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,SAAS;QACtD,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,MAAM;KACjD,CAAC;IAEF,+EAA+E;IAC/E,+DAA+D;IAC/D,IAAI,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACjE,GAAG,CAAC,mBAAmB,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC;IACvD,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC;IAC5D,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC;AACzE,CAAC"}
+{"version":3,"file":"serverSpec.js","sourceRoot":"","sources":["../../src/mcp-registration/serverSpec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGjE,mGAAmG;AACnG,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC;AAE5C,iDAAiD;AACjD,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAErD,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC;AA2BlD,SAAS,kBAAkB;IACzB,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,mBAAmB,CACjC,OAAuB,EACvB,aAAwC,UAAU;IAElD,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE/F,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;QACjC,KAAK,MAAM,MAAM,IAAI,kBAAkB,EAAE,EAAE,CAAC;YAC1C,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,qBAAqB,GAAG,MAAM,EAAE,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACpF,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC7D,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAChC,MAAM,GAAG,GAA2B,EAAE,CAAC;IAEvC,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC;IAC5D,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACjF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC;IAC3E,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC;AAChE,CAAC"}

package/dist/mcp-registration/types.d.ts

@@ -2,8 +2,6 @@
 export declare const MCP_CLIENT_IDS: readonly ["claude-code", "codex", "copilot-cli", "opencode", "amp", "cursor-cli", "kimi-cli", "antigravity"];
 export type McpClientId = (typeof MCP_CLIENT_IDS)[number];
 export type McpScope = 'user' | 'project';
-/** Syntax the client uses to inherit a secret from its parent process. */
-export type McpSecretReference = 'dollarBraces' | 'opencodeEnv' | 'codexEnvVars';
 /** How the AgentTeams entry reaches the client's configuration. */
 export type McpInstallStrategy = 
 /** The client owns the format; we shell out to its documented non-interactive command. */
@@ -61,7 +59,6 @@ export interface McpClientDefinition {
     label: string;
     /** Executable names looked up on PATH. */
     executables: string[];
-    secretReference: McpSecretReference;
     /** Extra directories to probe when the client installs outside PATH (e.g. Kimi). */
     extraBinDirs?: (context: McpPathContext) => string[];
     /** Files/directories whose presence proves the client has been configured on this machine. */

package/dist/mcp-registration/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/mcp-registration/types.ts"],"names":[],"mappings":"AAAA,+HAA+H;AAC/H,eAAO,MAAM,cAAc,8GASjB,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAE1C,0EAA0E;AAC1E,MAAM,MAAM,kBAAkB,GAAG,cAAc,GAAG,aAAa,GAAG,cAAc,CAAC;AAEjF,mEAAmE;AACnE,MAAM,MAAM,kBAAkB;AAC5B,0FAA0F;AACxF,eAAe;AACjB,6EAA6E;GAC3E,WAAW;AACb,6FAA6F;GAC3F,YAAY,CAAC;AAEjB,+EAA+E;AAC/E,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEtD,wEAAwE;AACxE,MAAM,MAAM,aAAa;AACvB,8CAA8C;AAC5C,OAAO;AACT,+BAA+B;GAC7B,OAAO;AACT,gEAAgE;GAC9D,UAAU,CAAC;AAEf,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,6DAA6D;IAC7D,UAAU,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,CAAC;IAChD,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IAClC,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,mDAAmD;IACnD,MAAM,CAAC,EAAE;QACP,SAAS,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;QACjE,aAAa,EAAE,mBAAmB,CAAC;QACnC,6DAA6D;QAC7D,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAC;KACtC,CAAC;IACF,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,WAAW,CAAC;IAChB,oFAAoF;IACpF,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,kBAAkB,CAAC;IACpC,oFAAoF;IACpF,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,EAAE,CAAC;IACrD,8FAA8F;IAC9F,aAAa,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,EAAE,CAAC;IACrD,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;CAC9C;AAED,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,oBAAoB,GACpB,qBAAqB,GACrB,sBAAsB,GACtB,QAAQ,CAAC;AAEb,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,WAAW,CAAC;IACtB,KAAK,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,cAAc,CAAC;IACxB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,WAAW,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,QAAQ,EAAE,YAAY,GAAG,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;IACxD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;CACnB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/mcp-registration/types.ts"],"names":[],"mappings":"AAAA,+HAA+H;AAC/H,eAAO,MAAM,cAAc,8GASjB,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAE1C,mEAAmE;AACnE,MAAM,MAAM,kBAAkB;AAC5B,0FAA0F;AACxF,eAAe;AACjB,6EAA6E;GAC3E,WAAW;AACb,6FAA6F;GAC3F,YAAY,CAAC;AAEjB,+EAA+E;AAC/E,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEtD,wEAAwE;AACxE,MAAM,MAAM,aAAa;AACvB,8CAA8C;AAC5C,OAAO;AACT,+BAA+B;GAC7B,OAAO;AACT,gEAAgE;GAC9D,UAAU,CAAC;AAEf,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,6DAA6D;IAC7D,UAAU,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,CAAC;IAChD,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IAClC,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,mDAAmD;IACnD,MAAM,CAAC,EAAE;QACP,SAAS,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;QACjE,aAAa,EAAE,mBAAmB,CAAC;QACnC,6DAA6D;QAC7D,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAC;KACtC,CAAC;IACF,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,WAAW,CAAC;IAChB,oFAAoF;IACpF,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,oFAAoF;IACpF,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,EAAE,CAAC;IACrD,8FAA8F;IAC9F,aAAa,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,EAAE,CAAC;IACrD,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;CAC9C;AAED,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,oBAAoB,GACpB,qBAAqB,GACrB,sBAAsB,GACtB,QAAQ,CAAC;AAEb,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,WAAW,CAAC;IACtB,KAAK,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,cAAc,CAAC;IACxB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,WAAW,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,QAAQ,EAAE,YAAY,GAAG,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;IACxD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;CACnB"}

package/dist/types/index.d.ts

@@ -6,6 +6,14 @@
  * CLI Configuration stored in .agentteams/config.json
  * Contains credentials and project context for API communication
  */
+/**
+ * Which credential family this project is configured to authenticate with.
+ *
+ * `personal-token` is the default: project config stays secret-free while a
+ * rotating refresh token lives in the OS credential store. `api-key` is the
+ * explicit compatibility path for existing automation and legacy projects.
+ */
+export type AuthMode = 'api-key' | 'personal-token';
 export interface Config {
     /** Team ID from AgentTeams */
     teamId: string;
@@ -15,6 +23,8 @@ export interface Config {
     apiKey: string;
     /** API URL (e.g., "http://localhost:3001") */
     apiUrl: string;
+    /** Legacy migration marker; absent configs choose by whether an apiKey exists. */
+    authMode?: AuthMode;
 }
 /**
  * Plan from API

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH;;;GAGG;AACH,MAAM,WAAW,MAAM;IACrB,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;CAChB;AAMD;;;GAGG;AACH,MAAM,WAAW,IAAI;IACnB,wBAAwB;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,iBAAiB;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAMD;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH;;;GAGG;AACH;;;;;;GAMG;AACH,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,gBAAgB,CAAC;AAEpD,MAAM,WAAW,MAAM;IACrB,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAMD;;;GAGG;AACH,MAAM,WAAW,IAAI;IACnB,wBAAwB;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,iBAAiB;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAMD;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC"}

package/dist/utils/apiKeyInput.d.ts

@@ -0,0 +1,16 @@
+export interface ApiKeyInputOptions {
+    apiKey?: string;
+    apiKeyFile?: string;
+}
+export interface ApiKeyInputDependencies {
+    readFile: (path: string) => string;
+    readStdin: () => string;
+    warn: (message: string) => void;
+}
+/**
+ * Resolve explicit credential input without ever writing the credential to
+ * output. The legacy argv path remains compatible, but every use explains the
+ * safer environment, file and stdin alternatives on stderr.
+ */
+export declare function resolveApiKeyInput(options: ApiKeyInputOptions, dependencies?: ApiKeyInputDependencies): string | undefined;
+//# sourceMappingURL=apiKeyInput.d.ts.map

package/dist/utils/apiKeyInput.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKeyInput.d.ts","sourceRoot":"","sources":["../../src/utils/apiKeyInput.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACnC,SAAS,EAAE,MAAM,MAAM,CAAC;IACxB,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAmBD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,kBAAkB,EAC3B,YAAY,GAAE,uBAA6C,GAC1D,MAAM,GAAG,SAAS,CA8BpB"}

package/dist/utils/apiKeyInput.js

@@ -0,0 +1,47 @@
+import { readFileSync } from 'node:fs';
+const defaultDependencies = {
+    readFile: (path) => readFileSync(path, 'utf-8'),
+    readStdin: () => readFileSync(0, 'utf-8'),
+    warn: (message) => process.stderr.write(message),
+};
+const normalizeApiKey = (value, source) => {
+    const normalized = value.trim();
+    if (!normalized) {
+        throw new Error(`${source} is empty.`);
+    }
+    if (/\s/.test(normalized)) {
+        throw new Error(`${source} must contain exactly one API key without whitespace.`);
+    }
+    return normalized;
+};
+/**
+ * Resolve explicit credential input without ever writing the credential to
+ * output. The legacy argv path remains compatible, but every use explains the
+ * safer environment, file and stdin alternatives on stderr.
+ */
+export function resolveApiKeyInput(options, dependencies = defaultDependencies) {
+    if (options.apiKey !== undefined && options.apiKeyFile !== undefined) {
+        throw new Error('--api-key and --api-key-file cannot be used together.');
+    }
+    if (options.apiKey !== undefined) {
+        dependencies.warn('[warn] --api-key exposes credentials in shell history and process listings. Prefer AGENTTEAMS_API_KEY, --api-key-file <path>, or --api-key-file - for stdin.\n');
+        return normalizeApiKey(options.apiKey, '--api-key');
+    }
+    if (options.apiKeyFile === undefined) {
+        return undefined;
+    }
+    const source = options.apiKeyFile === '-' ? 'stdin' : `API key file ${options.apiKeyFile}`;
+    try {
+        const value = options.apiKeyFile === '-' ? dependencies.readStdin() : dependencies.readFile(options.apiKeyFile);
+        return normalizeApiKey(value, source);
+    }
+    catch (error) {
+        if (error instanceof Error &&
+            (error.message.endsWith('is empty.') || error.message.includes('exactly one API key'))) {
+            throw error;
+        }
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new Error(`Could not read ${source}: ${detail}`);
+    }
+}
+//# sourceMappingURL=apiKeyInput.js.map

package/dist/utils/apiKeyInput.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKeyInput.js","sourceRoot":"","sources":["../../src/utils/apiKeyInput.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAavC,MAAM,mBAAmB,GAA4B;IACnD,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC;IAC/C,SAAS,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC;IACzC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;CACjD,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,KAAa,EAAE,MAAc,EAAU,EAAE;IAChE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,YAAY,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,uDAAuD,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA2B,EAC3B,eAAwC,mBAAmB;IAE3D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,YAAY,CAAC,IAAI,CACf,gKAAgK,CACjK,CAAC;QACF,OAAO,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,OAAO,CAAC,UAAU,EAAE,CAAC;IAC3F,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAChH,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,KAAK;YACtB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,EACtF,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC"}

package/dist/utils/authServer.d.ts

@@ -7,9 +7,18 @@ export type AuthResult = {
     configId: string;
     seedPlanId?: string | null;
 };
-type AuthServerResult = {
+/**
+ * The authorization-code callback. Deliberately smaller than {@link AuthResult}:
+ * a single-use code that is worthless without the `code_verifier` this process
+ * never sent anywhere, instead of a long-lived key travelling through a browser.
+ */
+export type AuthorizationCodeResult = {
+    code: string;
+    state: string;
+};
+type AuthServerResult<T> = {
     server: Server;
-    waitForCallback: () => Promise<AuthResult>;
+    waitForCallback: () => Promise<T>;
     port: number;
     /** Echo this back through the authorize URL; the callback is rejected without it. */
     state: string;
@@ -19,6 +28,26 @@ type StartLocalAuthServerOptions = {
 };
 /** Unguessable value that proves a callback belongs to the login this process started. */
 export declare function createAuthState(): string;
-export declare function startLocalAuthServer(options?: StartLocalAuthServerOptions): Promise<AuthServerResult>;
+export type PkcePair = {
+    /** Stays in this process. Without it a stolen code cannot be redeemed. */
+    verifier: string;
+    /** S256 hash sent through the browser. */
+    challenge: string;
+};
+/**
+ * PKCE S256 pair.
+ *
+ * 48 random bytes base64url-encode to 64 characters, inside the server's
+ * 43–128 range (`api/src/routes/desktop-auth/index.ts`).
+ */
+export declare function createPkcePair(): PkcePair;
+/**
+ * Legacy login callback: the web posts the issued agent key back to this port.
+ * Kept unchanged for CLI/web combinations that predate the authorization-code
+ * path; `P3` is where it goes away.
+ */
+export declare function startLocalAuthServer(options?: StartLocalAuthServerOptions): Promise<AuthServerResult<AuthResult>>;
+/** Authorization-code login callback: only `{ code, state }` crosses this boundary. */
+export declare function startAuthorizationCodeServer(options?: StartLocalAuthServerOptions): Promise<AuthServerResult<AuthorizationCodeResult>>;
 export {};
 //# sourceMappingURL=authServer.d.ts.map

package/dist/utils/authServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authServer.d.ts","sourceRoot":"","sources":["../../src/utils/authServer.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,MAAM,EAA6C,MAAM,WAAW,CAAC;AAejG,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,KAAK,gBAAgB,GAAG;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,KAAK,2BAA2B,GAAG;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,0FAA0F;AAC1F,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAwJD,wBAAsB,oBAAoB,CAAC,OAAO,CAAC,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAmJ3G"}
+{"version":3,"file":"authServer.d.ts","sourceRoot":"","sources":["../../src/utils/authServer.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,MAAM,EAA6C,MAAM,WAAW,CAAC;AAejG,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,KAAK,gBAAgB,CAAC,CAAC,IAAI;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,KAAK,2BAA2B,GAAG;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,0FAA0F;AAC1F,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,MAAM,MAAM,QAAQ,GAAG;IACrB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,QAAQ,CAGzC;AAkUD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAEjH;AAED,uFAAuF;AACvF,wBAAgB,4BAA4B,CAC1C,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC,CAKpD"}