@aiwg/cli 2026.10.1 → 2026.10.3

package/dist/src/mcp/cli.mjs

@@ -7,20 +7,145 @@
  */
 
 import { startServer, createServer } from './server.mjs';
+import { assertConfigDestination, assertConfigObject, assertProjectCredentials, isPathInsideDir, classifyMcpDestination, projectCredentialRemedy, writeConfigAtomic, writeConfigTransaction } from './config-file.mjs';
 import fs from 'fs/promises';
 import path from 'path';
-import { fileURLToPath } from 'url';
+import os from 'os';
+import { existsSync as nodeExistsSync, readFileSync as nodeReadFileSync } from 'fs';
+import { fileURLToPath, pathToFileURL } from 'url';
 import {
   McpServerRegistry,
+  buildServerConfig,
   injectServers,
   SUPPORTED_PROVIDERS,
   getProviderConfigPath,
 } from './registry.mjs';
 import { McpProfileRegistry } from './profiles.mjs';
+import {
+  applyJsonToolFilterPlan,
+  hasToolFilters,
+  planToolFilters,
+  prepareClaudePermissions,
+  resolveToolFilters,
+} from './tool-filters.mjs';
+import { assertCredentialPolicy, CREDENTIAL_POLICIES, installPolicyCheckedServer, redactCredentialArgs, redactCredentialText, redactCredentialRecord, resolveCredentialPolicy } from './credentials.mjs';
 import { getMcpInjectionDefinition } from '../providers/provider-definitions.mjs';
 import { manageOmpMcp } from './omp-config.mjs';
 import { unmanageGrokBuildMcp } from './grok-build-config.mjs';
 
+/**
+ * Thrown when a recognized flag is present but has no usable value
+ * following it (#3062 review item 11). Mirrors `src/cli/flag-parsing.ts`'s
+ * `MissingFlagValueError`/`requireFlagValue`, duplicated in plain JS rather
+ * than imported: this file is exercised both compiled (`dist/src/mcp/
+ * cli.mjs`, where a `../cli/flag-parsing.js` sibling import would resolve)
+ * and directly from source in tests (`src/mcp/cli.mjs`, where it would
+ * not — there is no compiled `.js` sibling under `src/` itself).
+ */
+class MissingFlagValueError extends Error {
+  constructor(flagName) {
+    super(`${flagName} requires a value`);
+    this.name = 'MissingFlagValueError';
+    this.flagName = flagName;
+  }
+}
+
+/**
+ * Single-pass, every-occurrence-validated flag lookup (#3062 second
+ * review, finding 4 — mirrors `src/cli/flag-parsing.ts`'s
+ * `scanFlagOccurrences`/`requireFlagValue`, duplicated here for the same
+ * source/dist reason as the class above): stops at a bare `--`
+ * terminator; accepts `--flag value` and `--flag=value`; a space-
+ * separated value starting with `--` is treated as missing (use `=` for a
+ * value that must start with `--`); every occurrence is checked, not just
+ * the first; `options.rejectEmpty` additionally rejects an empty-string
+ * value. `options.precedence` picks which occurrence wins when the flag
+ * repeats — `'first'` (default) here matches this file's own pre-existing
+ * `parseFlag()` convention (first match wins).
+ */
+function requireFlagValue(args, options, ...names) {
+  const occurrences = [];
+  for (let i = 0; i < args.length; i += 1) {
+    const token = args[i];
+    if (token === undefined) continue;
+    if (token === '--') break;
+
+    if (token.startsWith('--')) {
+      const eq = token.indexOf('=');
+      if (eq !== -1) {
+        const flag = token.slice(0, eq);
+        const value = token.slice(eq + 1);
+        if (names.includes(flag)) {
+          if (options.rejectEmpty && value === '') throw new MissingFlagValueError(flag);
+          occurrences.push(value);
+          continue;
+        }
+      }
+    }
+
+    if (names.includes(token)) {
+      const next = args[i + 1];
+      if (next === undefined || next.startsWith('--')) throw new MissingFlagValueError(token);
+      if (options.rejectEmpty && next === '') throw new MissingFlagValueError(token);
+      occurrences.push(next);
+      i += 1;
+    }
+  }
+  if (occurrences.length === 0) return undefined;
+  return options.precedence === 'last' ? occurrences[occurrences.length - 1] : occurrences[0];
+}
+
+/**
+ * Find the AIWG package root by walking up from THIS file's own location
+ * (never from `AIWG_ROOT`/`process.cwd()`, which name the *served project*,
+ * not necessarily where this module's own package lives). Depth-independent
+ * on purpose: this file ships at `src/mcp/cli.mjs` in a dev checkout and at
+ * `dist/src/mcp/cli.mjs` in the published package. Mirrors
+ * `src/mcp/tools/worker-invoke.mjs`'s own `findOwnPackageRoot` (and
+ * `tools/_resolve-impl.mjs`'s `findPackageRoot`).
+ */
+function findOwnPackageRoot() {
+  let dir = path.dirname(fileURLToPath(import.meta.url));
+  for (let i = 0; i < 12; i += 1) {
+    const pkgPath = path.join(dir, 'package.json');
+    if (nodeExistsSync(pkgPath)) {
+      try {
+        const pkg = JSON.parse(nodeReadFileSync(pkgPath, 'utf8'));
+        if (pkg.name === 'aiwg' || pkg.name === '@aiwg/cli') return dir;
+      } catch { /* keep walking */ }
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error('Could not locate the AIWG package root from mcp/cli.mjs');
+}
+
+/**
+ * Load the compiled `loginInProfile()` adapter (#3062 second review,
+ * finding 3). The first round routed this through `tools/_resolve-impl.mjs`,
+ * which falls back to importing the TypeScript *source* when no compiled
+ * `dist/src/` exists — but that source module's own internal imports
+ * (e.g. `../../cli/env.js`) have no `.js` sibling under `src/` either, so
+ * the fallback itself fails deep inside the adapter with an unrelated-
+ * looking `ERR_MODULE_NOT_FOUND`, on every Node version, not just ones
+ * without native TypeScript support. This loads the compiled module
+ * directly — never TypeScript source — and fails fast with one actionable
+ * line when it is missing, instead of attempting (and failing inside) a
+ * source fallback.
+ */
+async function loadCodexRuntimeAdapter() {
+  const root = findOwnPackageRoot();
+  const compiledPath = path.join(root, 'dist', 'src', 'mcp', 'adapters', 'codex-runtime.js');
+  if (!nodeExistsSync(compiledPath)) {
+    throw new Error(
+      'aiwg mcp profile login requires the built CLI (missing dist/src/mcp/adapters/codex-runtime.js). ' +
+      'Use an installed `aiwg` for this command; a source checkout must be built first (see docs/contributing).',
+    );
+  }
+  return import(pathToFileURL(compiledPath).href);
+}
+
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 /**
@@ -42,6 +167,8 @@ Usage:
   aiwg mcp inject [opts]       Inject servers into provider configs
   aiwg mcp uninject [opts]     Remove unchanged AIWG-owned OMP server entries
   aiwg mcp profile <sub>       Manage MCP profiles (named server subsets)
+  aiwg mcp credential-policy [literal|references|none]
+                               Show or set the registry's default credential policy
 
 Server Options (for add/update):
   --url <url>          Server URL (for http/sse types)
@@ -52,6 +179,8 @@ Server Options (for add/update):
   --headers <K=V,...>  HTTP headers (comma-separated K=V pairs)
   --header-env <K=ENV,...>
                        Resolve HTTP header values from environment variables
+  --env-from <K=ENV,...>
+                       Resolve stdio server variables from environment variables
   --description <text> Optional description
 
 Inject Options:
@@ -60,6 +189,10 @@ Inject Options:
   --all                Inject into all previously configured providers
   --servers <a,b,...>  Only inject specific servers (comma-separated names)
   --dry-run            Show what would change without writing
+  --strict-credentials Refuse servers with literal env/headers values; render
+                       only --header-env/--env-from references
+  --no-credentials     Refuse servers with any credential-bearing field,
+                       references included
 
 Serve Options:
   --transport <type>   Transport type: stdio (default), http
@@ -70,6 +203,8 @@ Examples:
   aiwg mcp add fortemi --url https://memory.s9.internal/mcp --type http
   aiwg mcp add fortemi-enterprise --url https://memory.example.internal/mcp --type http \
     --header-env Authorization=AIWG_FORTEMI_TOKEN
+  aiwg mcp add github --type stdio --command github-mcp-server \
+    --env-from GITHUB_PERSONAL_ACCESS_TOKEN=GITHUB_TOKEN
   aiwg mcp add gitea --url https://mcp-gitea.integrolabs.net/mcp
   aiwg mcp add mytools --type stdio --command npx --args mcp-server-mytools
 
@@ -96,20 +231,20 @@ Examples:
 /**
  * Generate MCP client configuration
  */
-async function generateConfig(target, projectDir = '.') {
+async function generateConfig(target, projectDir = '.', scope = 'project') {
   const homeDir = process.env.HOME || process.env.USERPROFILE;
 
   const configs = {
     claude: {
-      path: path.join(projectDir, '.claude/settings.local.json'),
+      path: scope === 'user' ? path.join(homeDir, '.claude.json') : path.join(projectDir, '.mcp.json'),
+      userScope: scope === 'user',
       content: {
         mcpServers: {
           aiwg: {
             command: 'aiwg',
             args: ['mcp', 'serve'],
-            env: {
-              AIWG_ROOT: process.env.AIWG_ROOT || '~/.local/share/ai-writing-guide'
-            }
+            ...(scope === 'user' && process.env.AIWG_ROOT
+              ? { env: { AIWG_ROOT: process.env.AIWG_ROOT } } : {})
           }
         }
       }
@@ -133,6 +268,7 @@ async function generateConfig(target, projectDir = '.') {
       })
     },
     factory: {
+      userScope: projectDir === '.' || projectDir === 'global',
       // Factory stores MCP config at user level in ~/.factory/mcp.json
       // or project level in .factory/mcp.json
       path: projectDir === '.' || projectDir === 'global'
@@ -158,7 +294,8 @@ async function generateConfig(target, projectDir = '.') {
     },
     codex: {
       // Codex stores config in ~/.codex/config.toml (TOML format)
-      path: path.join(homeDir, '.codex/config.toml'),
+      path: path.resolve(process.env.CODEX_HOME || path.join(homeDir, '.codex'), 'config.toml'),
+      userScope: true,
       // We generate TOML snippet to append, not JSON
       content: null,
       toml: `
@@ -185,8 +322,8 @@ enabled_tools = [
         let existing = '';
         try {
           existing = await fs.readFile(configPath, 'utf-8');
-        } catch {
-          // File doesn't exist
+        } catch (error) {
+          if (error.code !== 'ENOENT') throw error;
         }
 
         // Check if AIWG MCP already configured
@@ -198,8 +335,7 @@ enabled_tools = [
         // Append TOML config
         const updated = existing.trimEnd() + '\n' + tomlContent.trim() + '\n';
 
-        await fs.mkdir(path.dirname(configPath), { recursive: true });
-        await fs.writeFile(configPath, updated);
+        await writeConfigAtomic(configPath, updated, { userScope: true });
         console.log(`MCP configuration appended to: ${configPath}`);
         console.log(`\nTo use AIWG MCP server with Codex:`);
         console.log(`  1. Restart Codex CLI`);
@@ -209,12 +345,14 @@ enabled_tools = [
     },
     openai: {
       // Alias for codex
-      path: path.join(homeDir, '.codex/config.toml'),
+      path: path.resolve(process.env.CODEX_HOME || path.join(homeDir, '.codex'), 'config.toml'),
+      userScope: true,
       alias: 'codex'
     },
     windsurf: {
       // Windsurf stores MCP config at ~/.codeium/windsurf/mcp_config.json
       path: path.join(homeDir, '.codeium/windsurf/mcp_config.json'),
+      userScope: true,
       content: {
         mcpServers: {
           aiwg: {
@@ -312,17 +450,21 @@ enabled_tools = [
 
         // Find existing config
         for (const loc of locations) {
+          await assertConfigDestination(loc, projectRoot);
           try {
             const rawContent = await fs.readFile(loc, 'utf-8');
-            // Strip JSONC comments for parsing
-            const jsonContent = rawContent
-              .replace(/\/\/.*$/gm, '')
-              .replace(/\/\*[\s\S]*?\*\//g, '');
+            // Strip JSONC comments while preserving strings such as URLs.
+            const jsonContent = rawContent.replace(
+              /"(?:\\.|[^"\\])*"|\/\/[^\r\n]*|\/\*[\s\S]*?\*\//g,
+              match => match.startsWith('"') ? match : ' ',
+            );
             existing = JSON.parse(jsonContent);
+            assertConfigObject(existing, 'mcp');
             targetPath = loc;
             break;
-          } catch {
-            // Continue to next location
+          } catch (error) {
+            if (error instanceof SyntaxError) throw new Error(`Refusing to overwrite malformed MCP config ${loc}: invalid JSON`);
+            if (error.code !== 'ENOENT') throw error;
           }
         }
 
@@ -335,8 +477,7 @@ enabled_tools = [
         // Merge configuration
         const merged = mergeFunc(existing, content);
 
-        await fs.mkdir(path.dirname(targetPath), { recursive: true });
-        await fs.writeFile(targetPath, JSON.stringify(merged, null, 2));
+        await writeConfigAtomic(targetPath, JSON.stringify(merged, null, 2), { userScope, projectRoot });
         console.log(`MCP configuration written to: ${targetPath}`);
         console.log(`\nTo use AIWG MCP server with OpenCode:`);
         console.log(`  1. Restart OpenCode`);
@@ -358,21 +499,61 @@ enabled_tools = [
     config = configs[config.alias];
   }
 
+  // Destination-derived, not scope-derived (and never from a static
+  // `config.userScope` flag): a target whose resolved path still lands inside
+  // the project directory gets project containment, whatever scope was
+  // requested. Providers with no real user-scope destination (Cursor,
+  // opencode) refuse `--scope user` instead of silently writing the project
+  // file. `config.path` is null only for providers with no config file at all
+  // (Warp, UI-configured), which never reach a destination check.
+  const projectBase = target === 'opencode' && projectDir === 'global' ? process.cwd() : projectDir;
+  const { userScope, projectRoot } = config.path
+    ? classifyMcpDestination(target, scope, config.path, projectBase)
+    : { userScope: Boolean(config.userScope), projectRoot: undefined };
+  if (config.path) await assertConfigDestination(config.path, projectRoot);
+
   // Handle custom handler (for TOML configs like Codex, or OpenCode JSON)
   if (config.handler) {
     return await config.handler(config.path, config.toml, config.content, config.merge);
   }
 
-  // Ensure directory exists
-  await fs.mkdir(path.dirname(config.path), { recursive: true });
-
   // Check if file exists and merge
   let existing = {};
   try {
     const content = await fs.readFile(config.path, 'utf-8');
     existing = JSON.parse(content);
-  } catch {
-    // File doesn't exist, start fresh
+  } catch (error) {
+    if (error instanceof SyntaxError) throw new Error(`Refusing to overwrite malformed MCP config ${config.path}: invalid JSON`);
+    if (error.code !== 'ENOENT') throw error;
+  }
+
+  const installServerMapKey = Object.keys(config.content)[0];
+  assertConfigObject(existing, installServerMapKey);
+
+  // Install-generated server definitions go through the same resolved
+  // credential policy as `aiwg mcp inject`, before any write. AIWG_ROOT (the
+  // only literal env value any install target's fixed content can ever
+  // carry, and only on the built-in "aiwg" entry) is a named, narrow
+  // exemption - installPolicyCheckedServer/INSTALL_POLICY_EXEMPT_ENV - not
+  // an unexamined bypass: any other literal env/header is still refused.
+  const installRegistry = new McpServerRegistry();
+  assertCredentialPolicy(
+    Object.entries(config.content[installServerMapKey] || {})
+      .map(([name, server]) => installPolicyCheckedServer(name, server)),
+    resolveCredentialPolicy({
+      registryPolicy: await installRegistry.getCredentialPolicy(),
+      floorPolicy: await installRegistry.getCredentialPolicyFloor(),
+      floorSource: await installRegistry.getCredentialPolicyFloorSource(),
+    }),
+  );
+
+  // Only the claude target's install content can ever embed a literal credential
+  // (`AIWG_ROOT`, gated to `scope === 'user'` above, and exempted above); every
+  // other target's `configs[...]` entry above is a fixed `aiwg mcp serve`
+  // stdio/TOML stanza with no env/headers field, so there is nothing further
+  // for assertProjectCredentials to check there.
+  if (target === 'claude' && scope !== 'user') {
+    assertProjectCredentials(Object.entries(config.content.mcpServers).map(([name, server]) => ({ name, ...server })), config.path);
   }
 
   // Merge configuration using custom merge function if available
@@ -387,7 +568,7 @@ enabled_tools = [
         }
       };
 
-  await fs.writeFile(config.path, JSON.stringify(merged, null, 2));
+  await writeConfigAtomic(config.path, JSON.stringify(merged, null, 2), { userScope, projectRoot });
   console.log(`MCP configuration written to: ${config.path}`);
   console.log(`\nTo use AIWG MCP server with ${target}:`);
   console.log(`  1. Restart ${target}`);
@@ -477,6 +658,16 @@ function parseFlag(args, flag) {
   return args[idx + 1];
 }
 
+/** Skip option values when locating a server name, regardless of flag order. */
+function serverName(args) {
+  const valueFlags = new Set(['--type', '--url', '--command', '--args', '--env',
+    '--headers', '--header-env', '--env-from', '--description']);
+  for (let i = 0; i < args.length; i++) {
+    if (valueFlags.has(args[i])) { i++; continue; }
+    if (!args[i].startsWith('--')) return args[i];
+  }
+}
+
 /**
  * Parse comma-separated key=value pairs into an object
  */
@@ -495,8 +686,7 @@ function parseKVPairs(str) {
  * Handle `aiwg mcp add <name> [opts]`
  */
 async function handleAdd(args) {
-  const positional = args.filter(a => !a.startsWith('--'));
-  const name = positional[0];
+  const name = serverName(args);
 
   if (!name) {
     console.error('Usage: aiwg mcp add <name> --url <url> [--type http|stdio|sse] [--command <cmd>] [--args <a,b>]');
@@ -510,6 +700,7 @@ async function handleAdd(args) {
   const envStr = parseFlag(args, '--env');
   const headersStr = parseFlag(args, '--headers');
   const headerEnvStr = parseFlag(args, '--header-env');
+  const envFromStr = parseFlag(args, '--env-from');
   const description = parseFlag(args, '--description');
 
   if (type === 'stdio' && !command) {
@@ -531,13 +722,17 @@ async function handleAdd(args) {
     env: parseKVPairs(envStr),
     headers: parseKVPairs(headersStr),
     headerEnv: parseKVPairs(headerEnvStr),
+    envFrom: parseKVPairs(envFromStr),
     description,
   });
 
   console.log(`Added MCP server: ${name}`);
-  if (url) console.log(`  URL: ${url}`);
-  if (command) console.log(`  Command: ${command}`);
+  if (url) console.log(`  URL: ${redactUrlUserinfo(url)}`);
+  if (command) console.log(`  Command: ${redactCredentialText(command)}`);
   console.log(`  Type: ${type}`);
+  for (const [key, values] of [['env', parseKVPairs(envStr)], ['headers', parseKVPairs(headersStr)]]) {
+    if (values) console.log(`  ${key}: ${Object.keys(values).join(', ')}`);
+  }
   console.log(`\nUse "aiwg mcp inject --provider <name>" to inject into a provider config.`);
 }
 
@@ -562,8 +757,7 @@ async function handleRemove(args) {
  * Handle `aiwg mcp update <name> [opts]`
  */
 async function handleUpdate(args) {
-  const positional = args.filter(a => !a.startsWith('--'));
-  const name = positional[0];
+  const name = serverName(args);
 
   if (!name) {
     console.error('Usage: aiwg mcp update <name> --url <url> [--type <type>] ...');
@@ -578,6 +772,7 @@ async function handleUpdate(args) {
   const envStr = parseFlag(args, '--env');
   const headersStr = parseFlag(args, '--headers');
   const headerEnvStr = parseFlag(args, '--header-env');
+  const envFromStr = parseFlag(args, '--env-from');
   const description = parseFlag(args, '--description');
 
   if (url !== undefined) updates.url = url;
@@ -587,6 +782,7 @@ async function handleUpdate(args) {
   if (envStr !== undefined) updates.env = parseKVPairs(envStr);
   if (headersStr !== undefined) updates.headers = parseKVPairs(headersStr);
   if (headerEnvStr !== undefined) updates.headerEnv = parseKVPairs(headerEnvStr);
+  if (envFromStr !== undefined) updates.envFrom = parseKVPairs(envFromStr);
   if (description !== undefined) updates.description = description;
 
   if (Object.keys(updates).length === 0) {
@@ -598,17 +794,24 @@ async function handleUpdate(args) {
   await registry.update(name, updates);
   console.log(`Updated MCP server: ${name}`);
   for (const [key, value] of Object.entries(updates)) {
-    console.log(`  ${key}: ${typeof value === 'object' ? JSON.stringify(value) : value}`);
+    const display = key === 'url' ? redactUrlUserinfo(value)
+      : key === 'args' ? JSON.stringify(redactCredentialArgs(value))
+      : ['env', 'headers', 'headerEnv', 'envFrom'].includes(key) ? Object.keys(value || {}).join(', ')
+      : typeof value === 'object' ? JSON.stringify(redactCredentialRecord(value)) : redactCredentialText(value);
+    console.log(`  ${key}: ${display}`);
   }
   console.log(`\nRe-run "aiwg mcp inject --all" to propagate changes to provider configs.`);
 }
 
+// Refusal and all display paths share the scanner in credentials.mjs.
+const redactUrlUserinfo = redactCredentialText;
+
 /**
  * Handle `aiwg mcp list` (managed servers from registry)
  */
 async function handleList() {
   const registry = new McpServerRegistry();
-  const servers = await registry.list();
+  const servers = redactCredentialRecord(await registry.list());
 
   if (servers.length === 0) {
     console.log('No MCP servers registered.');
@@ -621,13 +824,17 @@ async function handleList() {
   for (const server of servers) {
     console.log(`  ${server.name}`);
     console.log(`    Type: ${server.type}`);
-    if (server.url) console.log(`    URL: ${server.url}`);
-    if (server.command) console.log(`    Command: ${server.command}${server.args ? ' ' + server.args.join(' ') : ''}`);
+    if (server.url) console.log(`    URL: ${redactUrlUserinfo(server.url)}`);
+    if (server.command) console.log(`    Command: ${server.command}${server.args ? ' ' + redactCredentialArgs(server.args).join(' ') : ''}`);
     if (server.headerEnv) {
       const refs = Object.entries(server.headerEnv).map(([header, envName]) => `${header}←${envName}`);
       console.log(`    Credential refs: ${refs.join(', ')}`);
     }
-    if (server.description) console.log(`    Description: ${server.description}`);
+    if (server.envFrom) {
+      const refs = Object.entries(server.envFrom).map(([key, envName]) => `${key}←${envName}`);
+      console.log(`    Env refs: ${refs.join(', ')}`);
+    }
+    if (server.description) console.log(`    Description: ${redactCredentialText(server.description)}`);
     if (server.injectedProviders && server.injectedProviders.length > 0) {
       console.log(`    Injected into: ${server.injectedProviders.join(', ')}`);
     }
@@ -660,6 +867,12 @@ async function handleInject(args) {
   const profileName = parseFlag(args, '--profile');
   const ephemeral = args.includes('--ephemeral');
   const outPath = parseFlag(args, '--out');
+  const strictCredentials = args.includes('--strict-credentials');
+  const noCredentials = args.includes('--no-credentials');
+  if (strictCredentials && noCredentials) {
+    console.error('Error: --strict-credentials and --no-credentials are mutually exclusive.');
+    process.exit(1);
+  }
 
   if (!provider && !injectAll) {
     console.error('Usage: aiwg mcp inject --provider <name> [--profile <p>] [--ephemeral] [--servers a,b] [--dry-run]');
@@ -669,12 +882,19 @@ async function handleInject(args) {
   }
 
   const registry = new McpServerRegistry();
+  const credentialPolicy = resolveCredentialPolicy({
+    flag: noCredentials ? 'none' : strictCredentials ? 'references' : undefined,
+    registryPolicy: await registry.getCredentialPolicy(),
+    floorPolicy: await registry.getCredentialPolicyFloor(),
+    floorSource: await registry.getCredentialPolicyFloorSource(),
+  });
 
   // Resolve server filter: --profile takes precedence over --servers
   let serverFilter;
+  let profile;
   if (profileName) {
     const profiles = new McpProfileRegistry();
-    const profile = await profiles.get(profileName);
+    profile = await profiles.resolve(profileName);
     if (!profile) {
       const all = await profiles.list();
       console.error(`Profile "${profileName}" not found.`);
@@ -707,6 +927,20 @@ async function handleInject(args) {
     providers = [normalized];
   }
 
+  if (injectAll && !ephemeral) {
+    const selected = (await registry.list()).filter(server => !serverFilter || serverFilter.includes(server.name));
+    for (const p of providers) {
+      const configPath = getProviderConfigPath(p, projectDir, { scope });
+      const { projectRoot } = classifyMcpDestination(p, scope, configPath, projectDir);
+      await assertConfigDestination(configPath, projectRoot);
+      // Every destination inside the project directory is meant to be committed
+      // to version control; home destinations are private.
+      if (projectRoot) {
+        assertProjectCredentials(selected, configPath, projectCredentialRemedy(p, projectDir));
+      }
+    }
+  }
+
   if (ephemeral) {
     for (const p of providers) {
       const mcpDefinition = getMcpInjectionDefinition(p);
@@ -723,23 +957,27 @@ async function handleInject(args) {
 
   let totalInjected = 0;
 
+  const printWarnings = (warnings = []) => {
+    for (const warning of warnings) console.error(`  WARNING ${warning}`);
+  };
+
   for (const p of providers) {
+    const toolFilters = profile ? resolveToolFilters(profile, p) : undefined;
     if (ephemeral) {
       // Generate a standalone ephemeral config file
-      const targetPath = outPath ?? path.join(
-        process.env.TMPDIR || '/tmp',
-        `aiwg-mcp-${profileName ?? 'custom'}-${p}-${Date.now()}.json`,
-      );
-
       const allServers = await registry.list();
       const servers = serverFilter
         ? allServers.filter(s => serverFilter.includes(s.name))
         : allServers;
+      const toolPlan = hasToolFilters(toolFilters)
+        ? planToolFilters(p, servers.map(server => server.name), toolFilters)
+        : null;
 
       if (servers.length === 0) {
         console.error(`  ${p}: no servers to write`);
         continue;
       }
+      assertCredentialPolicy(servers, credentialPolicy);
 
       // Build ephemeral config in provider's format
       const mcpDefinition = getMcpInjectionDefinition(p);
@@ -752,32 +990,59 @@ async function handleInject(args) {
           console.log(`  Use "aiwg session --provider codex --profile ${profileName}" instead.`);
           continue;
         }
-        const cfg = {};
-        if (server.type === 'stdio') {
-          cfg.command = server.command;
-          cfg.args = server.args || [];
-          if (server.env) cfg.env = server.env;
-        } else {
-          cfg.url = server.url;
-          if (server.headers) cfg.headers = server.headers;
-        }
-        mcpBlock[server.name] = cfg;
+        mcpBlock[server.name] = buildServerConfig(server, p);
       }
 
       if (Object.keys(mcpBlock).length === 0) continue;
 
       const config = { [mcpKey]: mcpBlock };
+      if (toolPlan) applyJsonToolFilterPlan(config, mcpKey, toolPlan);
+      const tempDir = outPath || dryRun
+        ? undefined
+        : await fs.mkdtemp(path.join(os.tmpdir(), 'aiwg-mcp-'));
+      const targetPath = outPath ?? path.join(
+        tempDir ?? path.join(os.tmpdir(), 'aiwg-mcp-<random>'),
+        `${profileName ?? 'custom'}-${p}.json`,
+      );
+
+      // Claude Code reads permission rules from settings, not from --mcp-config.
+      const settingsPath = toolPlan?.claudePermissions ? targetPath.replace(/(\.json)?$/, '.settings.json') : null;
+      // Explicit --out paths may be outside the project. Check every parent from
+      // the filesystem root so neither destination can traverse a symlink.
+      const outputRoot = path.parse(path.resolve(targetPath)).root;
+      await assertConfigDestination(targetPath, outputRoot);
+      const realProject = await fs.realpath(path.resolve(projectDir)).catch(error => {
+        if (error.code !== 'ENOENT') throw error;
+        return path.resolve(projectDir);
+      });
+      if (isPathInsideDir(targetPath, projectDir) || isPathInsideDir(targetPath, realProject)) {
+        assertProjectCredentials(servers, targetPath, projectCredentialRemedy(p, projectDir));
+      }
+      const preparedPermissions = settingsPath
+        ? await prepareClaudePermissions(settingsPath, toolPlan.claudePermissions, {
+          projectRoot: outputRoot,
+          userScope: true,
+          managedDir: path.dirname(registry.getPath()),
+          sidecar: true,
+          mcpPath: targetPath,
+        })
+        : null;
 
       if (!dryRun) {
-        await fs.mkdir(path.dirname(targetPath), { recursive: true });
-        await fs.writeFile(targetPath, JSON.stringify(config, null, 2) + '\n', 'utf-8');
+        await writeConfigTransaction([
+          { file: targetPath, content: JSON.stringify(config, null, 2) + '\n',
+            options: { userScope: true, projectRoot: outputRoot } },
+          ...(preparedPermissions?.writes || []),
+        ]);
       }
 
       const prefix = dryRun ? '[DRY RUN] ' : '';
       console.log(`${prefix}${p}: ${targetPath}`);
       console.log(`  ${prefix}Servers: ${Object.keys(mcpBlock).join(', ')}`);
+      if (settingsPath) console.log(`  ${prefix}Tool permissions: ${settingsPath}`);
+      printWarnings([...(toolPlan?.warnings || []), ...(preparedPermissions?.warnings || [])]);
       if (!dryRun && (p === 'claude-code' || p === 'claude')) {
-        console.log(`  Launch with: claude --mcp-config ${targetPath}`);
+        console.log(`  Launch with: claude --mcp-config ${targetPath}${settingsPath ? ` --settings ${settingsPath}` : ''}`);
       }
       totalInjected += Object.keys(mcpBlock).length;
       continue;
@@ -789,6 +1054,8 @@ async function handleInject(args) {
       projectDir,
       dryRun,
       scope,
+      ...(hasToolFilters(toolFilters) ? { toolFilters } : {}),
+      credentialPolicy,
     });
 
     if (result.error) {
@@ -806,6 +1073,8 @@ async function handleInject(args) {
     if (result.alreadyPresent.length > 0) {
       console.log(`  ${prefix}Updated in place: ${result.alreadyPresent.join(', ')}`);
     }
+    if (result.settingsPath) console.log(`  ${prefix}Tool permissions: ${result.settingsPath}`);
+    printWarnings(result.warnings);
   }
 
   if (!dryRun && totalInjected > 0 && !ephemeral) {
@@ -825,14 +1094,18 @@ function printProfileUsage() {
 aiwg mcp profile — MCP server profiles (named server subsets)
 
 Usage:
-  aiwg mcp profile add <name> --servers a,b,c [--description "..."]
+  aiwg mcp profile add <name> --servers a,b,c [--extends base,...] [--description "..."]
+                          [--provider <p|*>] [--tool-deny s__t,...] [--tool-allow s__t,...]
   aiwg mcp profile list
-  aiwg mcp profile show <name>
+  aiwg mcp profile show <name> [--json]
   aiwg mcp profile edit <name> [--add-server x] [--remove-server y] [--description "..."]
+                          [--provider <p|*>] [--tool-deny s__t,...] [--tool-allow s__t,...]
+                          [--clear-tool-filters]
   aiwg mcp profile remove <name>
   aiwg mcp profile import <file>
   aiwg mcp profile export <name> [--out <file>]
   aiwg mcp profile init-presets
+  aiwg mcp profile login <name> [--api-key-stdin | --api-key-file <path> | --api-key-env <ENV_VAR_NAME>]
 
 Profiles let you define named subsets of your registered MCP servers:
   aiwg mcp profile add dev --servers git-gitea,memory-fortemi --description "Dev work"
@@ -840,11 +1113,60 @@ Profiles let you define named subsets of your registered MCP servers:
   aiwg mcp inject --provider claude --profile dev --ephemeral
   aiwg session --provider claude --profile dev
 
+Layered configuration (organisation base, identity overlay):
+  AIWG_CONFIG_LAYERS=/etc/aiwg/org:/home/me/.aiwg/acme aiwg mcp inject \
+    --provider claude --profile acme-dev --ephemeral --out /tmp/acme.json
+  Directories are listed lowest precedence first (path delimiter separated).
+  A server or profile in a later layer replaces one of the same name in an
+  earlier layer. Writes go to the last layer. --extends lets a profile inherit
+  another profile's servers and tool filters from any layer.
+
+Tool filters name tools as <server>__<tool>; <tool> may contain *. --provider
+defaults to *, which applies to every provider. inject renders them into each
+provider's own setting and warns about any filter the provider cannot express:
+  aiwg mcp profile edit dev --tool-deny git-gitea__delete_repo
+  aiwg mcp profile edit dev --provider codex --tool-allow git-gitea__list_repos
+
 Preset profiles (minimal, dev, ops, research, incident, full):
   aiwg mcp profile init-presets
+
+Logging in to a Codex profile's isolated runtime home (#3062):
+  aiwg mcp profile login ops                        interactive (requires a terminal)
+  vault read -field=key secret/openai |
+    aiwg mcp profile login ops --api-key-stdin      headless, most preferred — key never
+                                                     touches an environment variable or argv
+  aiwg mcp profile login ops --api-key-file ~/.openai-key
+                                                     headless — file must be owned by you,
+                                                     mode 600, not a symlink
+  aiwg mcp profile login ops --api-key-env OPENAI_KEY
+                                                     headless, least preferred — reads
+                                                     $OPENAI_KEY; visible to every other
+                                                     child process this shell starts
+  In every case the key reaches codex over stdin only; it never appears on
+  argv, in logs, or in error messages. Exactly one of the three may be
+  given. Without a terminal and without any of the three, this errors
+  naming all three. See "Supplying credentials safely" in the docs:
+  docs/mcp/codex-profiles.md#supplying-credentials-safely
 `);
 }
 
+/**
+ * Parse --provider / --tool-deny / --tool-allow into a providerOverrides map.
+ */
+function parseToolFilterFlags(args) {
+  const deny = parseFlag(args, '--tool-deny');
+  const allow = parseFlag(args, '--tool-allow');
+  if (!deny && !allow) return undefined;
+  const split = value => value.split(',').map(s => s.trim()).filter(Boolean);
+  const provider = parseFlag(args, '--provider') || '*';
+  return {
+    [provider]: {
+      ...(deny ? { toolDeny: split(deny) } : {}),
+      ...(allow ? { toolAllow: split(allow) } : {}),
+    },
+  };
+}
+
 /**
  * Handle `aiwg mcp profile add <name> [opts]`
  */
@@ -858,17 +1180,26 @@ async function handleProfileAdd(args) {
 
   const serversStr = parseFlag(args, '--servers');
   const description = parseFlag(args, '--description');
+  const extendsStr = parseFlag(args, '--extends');
+  const bases = extendsStr ? extendsStr.split(',').map(s => s.trim()).filter(Boolean) : undefined;
 
-  if (!serversStr && name !== 'minimal') {
+  if (!serversStr && !bases && name !== 'minimal') {
     console.error('Warning: no --servers specified. Profile will start empty.');
   }
 
   const servers = serversStr ? serversStr.split(',').map(s => s.trim()).filter(Boolean) : [];
+  const providerOverrides = parseToolFilterFlags(args);
 
   const profiles = new McpProfileRegistry();
   const registry = new McpServerRegistry();
 
-  await profiles.add({ name, description, servers }, registry);
+  await profiles.add({
+    name,
+    description,
+    servers,
+    ...(bases ? { extends: bases } : {}),
+    ...(providerOverrides ? { providerOverrides } : {}),
+  }, registry);
 
   console.log(`Profile added: ${name}`);
   if (description) console.log(`  Description: ${description}`);
@@ -881,7 +1212,7 @@ async function handleProfileAdd(args) {
  */
 async function handleProfileList() {
   const profiles = new McpProfileRegistry();
-  const all = await profiles.list();
+  const all = redactCredentialRecord(await profiles.list());
 
   if (all.length === 0) {
     console.log('No profiles defined.');
@@ -911,7 +1242,7 @@ async function handleProfileShow(args) {
   }
 
   const profiles = new McpProfileRegistry();
-  const profile = await profiles.get(name);
+  const profile = redactCredentialRecord(await profiles.get(name));
 
   if (!profile) {
     const all = await profiles.list();
@@ -922,8 +1253,18 @@ async function handleProfileShow(args) {
     process.exit(1);
   }
 
+  if (args.includes('--json')) {
+    console.log(JSON.stringify(redactCredentialRecord(profile), null, 2));
+    return;
+  }
+
   console.log(`Profile: ${profile.name}`);
   if (profile.description) console.log(`Description: ${profile.description}`);
+  if (profile.extends?.length) {
+    console.log(`Extends: ${profile.extends.join(', ')}`);
+    const resolved = await profiles.resolve(name);
+    console.log(`Resolved servers: ${resolved.servers.join(', ') || '(none)'}`);
+  }
   console.log(`\nServers (${profile.servers.length}):`);
 
   if (profile.servers.length === 0) {
@@ -934,11 +1275,11 @@ async function handleProfileShow(args) {
     // Resolve server configs
     const registry = new McpServerRegistry();
     for (const serverName of profile.servers) {
-      const server = await registry.get(serverName);
+      const server = redactCredentialRecord(await registry.get(serverName));
       if (server) {
         const detail = server.type === 'stdio'
-          ? `stdio  ${server.command}${server.args ? ' ' + server.args.join(' ') : ''}`
-          : `${server.type}  ${server.url}`;
+          ? `stdio  ${server.command}${server.args ? ' ' + redactCredentialArgs(server.args).join(' ') : ''}`
+          : `${server.type}  ${redactUrlUserinfo(server.url)}`;
         console.log(`  ${serverName.padEnd(24)} ${detail}`);
         if (server.description) console.log(`  ${''.padEnd(24)} ${server.description}`);
       } else {
@@ -975,14 +1316,18 @@ async function handleProfileEdit(args) {
   const removeServer = parseFlag(args, '--remove-server');
   const description = parseFlag(args, '--description');
 
+  const providerOverrides = parseToolFilterFlags(args);
+  const clearToolFilters = args.includes('--clear-tool-filters');
   const changes = {
     description,
     addServers: addServer ? addServer.split(',').map(s => s.trim()) : undefined,
     removeServers: removeServer ? removeServer.split(',').map(s => s.trim()) : undefined,
+    providerOverrides,
+    clearToolFilters: clearToolFilters ? (parseFlag(args, '--provider') || '*') : undefined,
   };
 
-  if (!description && !addServer && !removeServer) {
-    console.error('No changes specified. Use --add-server, --remove-server, or --description.');
+  if (!description && !addServer && !removeServer && !providerOverrides && !clearToolFilters) {
+    console.error('No changes specified. Use --add-server, --remove-server, --description, --tool-deny, --tool-allow or --clear-tool-filters.');
     process.exit(1);
   }
 
@@ -1055,6 +1400,135 @@ async function handleProfileInitPresets() {
   }
 }
 
+/**
+ * Read all of stdin and return it as one trimmed string (go/no-go review,
+ * blocker 1C's `--api-key-stdin`). Mirrors `src/cli/handlers/decision.ts`'s
+ * own private `readStdin()` + `.trim()` for `--token-stdin` — duplicated
+ * rather than imported for the same source/dist reason documented on
+ * `requireFlagValue` above (this file runs both compiled and directly from
+ * source). Input is expected to be a single line; a value containing
+ * additional lines is not specially rejected, matching that precedent.
+ */
+async function readStdinAll() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+  return Buffer.concat(chunks).toString('utf8');
+}
+
+/**
+ * Handle `aiwg mcp profile login <name> [--api-key-env <ENV_VAR_NAME> |
+ * --api-key-stdin | --api-key-file <path>]` (#3062, #3069, go/no-go review
+ * blocker 1C).
+ *
+ * Wires `loginInProfile()` (src/mcp/adapters/codex-runtime.ts), which
+ * already implements the full headless-safe behavior this command needs:
+ * with a terminal attached and none of the three given, it runs the
+ * interactive `codex login` OAuth flow. Exactly one credential source may
+ * be given; more than one is a usage error naming the flags given. In
+ * every case the key reaches `loginInProfile()` only as an in-memory value
+ * (or, for `--api-key-env`, a variable *name*) — never on argv, in logs, or
+ * in an error message — and travels to `codex` only on its stdin (see
+ * `spawnCodexLoginWithApiKey()`'s own doc comment). Without a terminal and
+ * without any of the three, `loginInProfile()` itself refuses, naming all
+ * three flags.
+ *
+ * `--api-key-env` reads the key from that named environment variable, as
+ * before. `--api-key-stdin` reads one line from this process's own stdin
+ * (refusing if stdin is a terminal, or if it is empty) — the least
+ * observable source, since the key then never exists in any environment or
+ * on any command line. `--api-key-file <path>` reads the key from a file
+ * that `readApiKeyFromFile()` requires to be a non-symlink, single-hard-
+ * link, regular file owned by the current user with no group/other
+ * permission bits on POSIX — refused otherwise, without ever printing the
+ * path's contents. `--api-key-env` remains the least preferred of the
+ * three (see "Supplying credentials safely" in the docs): the named
+ * variable is visible to every other child process this shell starts.
+ */
+async function handleProfileLogin(args) {
+  let apiKeyEnv;
+  let apiKeyFilePath;
+  try {
+    // rejectEmpty: an explicitly-given-but-empty variable name/path can
+    // never name a real environment variable or file (#3062 second review,
+    // finding 4; go/no-go review blocker 1C).
+    apiKeyEnv = requireFlagValue(args, { rejectEmpty: true }, '--api-key-env');
+    apiKeyFilePath = requireFlagValue(args, { rejectEmpty: true }, '--api-key-file');
+  } catch (err) {
+    if (err instanceof MissingFlagValueError) {
+      console.error(`${err.message}.`);
+      process.exit(2);
+    }
+    throw err;
+  }
+  const useStdin = args.includes('--api-key-stdin');
+
+  const sourcesGiven = [
+    apiKeyEnv !== undefined ? '--api-key-env' : null,
+    useStdin ? '--api-key-stdin' : null,
+    apiKeyFilePath !== undefined ? '--api-key-file' : null,
+  ].filter(Boolean);
+  if (sourcesGiven.length > 1) {
+    console.error(`Only one credential source may be given; got ${sourcesGiven.join(', ')}.`);
+    process.exit(2);
+  }
+
+  // Skip --api-key-env's/--api-key-file's own value when hunting for the
+  // positional profile name, so e.g. `login --api-key-env FOO` (missing
+  // name) never misreads FOO as the name (mirrors this file's own
+  // `serverName()` helper). Stops at a bare `--` the same way
+  // requireFlagValue() does.
+  const positional = [];
+  for (let i = 0; i < args.length; i += 1) {
+    const token = args[i];
+    if (token === '--') break;
+    if (token === '--api-key-env' || token === '--api-key-file') { i += 1; continue; }
+    if (!token.startsWith('--')) positional.push(token);
+  }
+  const name = positional[0];
+  if (!name) {
+    console.error('Usage: aiwg mcp profile login <name> [--api-key-env <ENV_VAR_NAME> | --api-key-stdin | --api-key-file <path>]');
+    process.exit(1);
+  }
+
+  let apiKey;
+  if (useStdin) {
+    if (process.stdin.isTTY) {
+      console.error(
+        '--api-key-stdin requires piped input, not a terminal; run ' +
+        `\`aiwg mcp profile login ${name}\` with no credential flag for the interactive login instead.`,
+      );
+      process.exit(2);
+    }
+    apiKey = (await readStdinAll()).trim();
+    if (!apiKey) {
+      console.error('--api-key-stdin received no key (stdin was empty).');
+      process.exit(2);
+    }
+  } else if (apiKeyFilePath !== undefined) {
+    const { readApiKeyFromFile } = await loadCodexRuntimeAdapter();
+    try {
+      apiKey = await readApiKeyFromFile(apiKeyFilePath);
+    } catch (err) {
+      console.error(err instanceof Error ? err.message : String(err));
+      process.exit(2);
+    }
+    if (!apiKey) {
+      console.error(`--api-key-file "${apiKeyFilePath}" is empty.`);
+      process.exit(2);
+    }
+  }
+
+  try {
+    const { loginInProfile } = await loadCodexRuntimeAdapter();
+    const loginOptions = apiKey !== undefined ? { apiKey } : apiKeyEnv ? { apiKeyEnv } : {};
+    await loginInProfile(name, loginOptions);
+    console.log(`\nLogged in to profile "${name}".`);
+  } catch (err) {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+}
+
 /**
  * Route `aiwg mcp profile <subcommand>`
  */
@@ -1080,6 +1554,9 @@ async function handleProfile(args) {
     case 'rm':
       await handleProfileRemove(subArgs);
       break;
+    case 'login':
+      await handleProfileLogin(subArgs);
+      break;
     case 'import':
       await handleProfileImport(subArgs);
       break;
@@ -1137,14 +1614,21 @@ export async function main(args = process.argv.slice(2)) {
         if (!['project', 'user'].includes(scope)) throw new Error('Scope must be project or user');
         const projectDir = parseFlag(args, '--project') || (args[2] && !args[2].startsWith('--') ? args[2] : '.');
         const configPath = getProviderConfigPath('omp', projectDir, { scope });
-        const result = await manageOmpMcp(configPath, [{ name: 'aiwg', type: 'stdio', command: 'aiwg', args: ['mcp', 'serve'] }], { dryRun: args.includes('--dry-run') });
+        // Destination-derived, not scope-derived: a provider home-directory
+        // override (e.g. PI_CODING_AGENT_DIR) that still resolves inside the
+        // project must get project containment, whatever scope was requested.
+        const { userScope, projectRoot } = classifyMcpDestination('omp', scope, configPath, projectDir);
+        await assertConfigDestination(configPath, projectRoot);
+        const result = await manageOmpMcp(configPath, [{ name: 'aiwg', type: 'stdio', command: 'aiwg', args: ['mcp', 'serve'] }], { dryRun: args.includes('--dry-run'), userScope, projectRoot });
         console.log(JSON.stringify(result, null, 2));
         break;
       }
       // Parse install arguments (skip flags)
-      const installArgs = args.slice(1).filter(a => !a.startsWith('--'));
+      const scope = parseFlag(args, '--scope') || 'project';
+      if (!['project', 'user'].includes(scope)) throw new Error('Scope must be project or user');
+      const installArgs = args.slice(1).filter((a, index, rest) => !a.startsWith('--') && !['--scope', '--project'].includes(rest[index - 1]));
       const target = installArgs[0] || 'claude';
-      const projectDir = installArgs[1] || '.';
+      const projectDir = parseFlag(args, '--project') || installArgs[1] || '.';
 
       // Check for --dry-run flag
       if (args.includes('--dry-run')) {
@@ -1152,13 +1636,13 @@ export async function main(args = process.argv.slice(2)) {
         console.log(`[DRY RUN] Would generate MCP config for: ${target}`);
         console.log(`[DRY RUN] Target directory: ${projectDir}`);
         const configPaths = {
-          claude: '.claude/settings.local.json',
+          claude: scope === 'user' ? path.join(homeDir, '.claude.json') : path.join(projectDir, '.mcp.json'),
           cursor: '.cursor/mcp.json',
           factory: (projectDir === '.' || projectDir === 'global')
             ? path.join(homeDir, '.factory/mcp.json')
             : path.join(projectDir, '.factory/mcp.json'),
-          codex: path.join(homeDir, '.codex/config.toml'),
-          openai: path.join(homeDir, '.codex/config.toml'),
+          codex: path.resolve(process.env.CODEX_HOME || path.join(homeDir, '.codex'), 'config.toml'),
+          openai: path.resolve(process.env.CODEX_HOME || path.join(homeDir, '.codex'), 'config.toml'),
           vscode: '.vscode/mcp.json',
           copilot: '.vscode/mcp.json',
           opencode: (projectDir === '.' || projectDir === 'global')
@@ -1171,7 +1655,7 @@ export async function main(args = process.argv.slice(2)) {
         break;
       }
 
-      await generateConfig(target, projectDir);
+      if (!await generateConfig(target, projectDir, scope)) process.exitCode = 1;
       break;
     }
 
@@ -1208,9 +1692,9 @@ export async function main(args = process.argv.slice(2)) {
       if (!['project', 'user'].includes(scope)) throw new Error('Scope must be project or user');
       const remove = (parseFlag(subArgs, '--servers') || '').split(',').map(s => s.trim()).filter(Boolean);
       if (!remove.length) throw new Error('uninject requires --servers name[,name]');
-      const configPath = getProviderConfigPath(provider, parseFlag(subArgs, '--project') || '.', { scope });
+      const projectDir = parseFlag(subArgs, '--project') || '.';
+      const configPath = getProviderConfigPath(provider, projectDir, { scope });
       if (provider === 'grok-build') {
-        const projectDir = parseFlag(subArgs, '--project') || '.';
         const result = await unmanageGrokBuildMcp(configPath, remove, {
           dryRun: subArgs.includes('--dry-run'),
           root: scope === 'user' ? path.dirname(path.dirname(configPath)) : path.resolve(projectDir),
@@ -1218,7 +1702,17 @@ export async function main(args = process.argv.slice(2)) {
         console.log(JSON.stringify(result, null, 2));
         break;
       }
-      const result = await manageOmpMcp(configPath, [], { remove, dryRun: subArgs.includes('--dry-run') });
+      // Destination-derived, not scope-derived: a provider home-directory
+      // override that still resolves inside the project must get project
+      // containment, whatever scope was requested.
+      const { userScope: ompUserScope, projectRoot: ompProjectRoot } =
+        classifyMcpDestination(provider, scope, configPath, projectDir);
+      const result = await manageOmpMcp(configPath, [], {
+        remove,
+        dryRun: subArgs.includes('--dry-run'),
+        userScope: ompUserScope,
+        projectRoot: ompProjectRoot,
+      });
       console.log(JSON.stringify(result, null, 2));
       break;
     }
@@ -1227,6 +1721,22 @@ export async function main(args = process.argv.slice(2)) {
       await handleProfile(subArgs);
       break;
 
+    case 'credential-policy': {
+      const registry = new McpServerRegistry();
+      const value = subArgs.find(a => !a.startsWith('--'));
+      if (!value) {
+        console.log(await registry.getCredentialPolicy() || 'literal');
+        break;
+      }
+      if (!CREDENTIAL_POLICIES.includes(value)) {
+        console.error(`Unknown credential policy "${value}". Use one of: ${CREDENTIAL_POLICIES.join(', ')}`);
+        process.exit(1);
+      }
+      await registry.setCredentialPolicy(value);
+      console.log(`Credential policy: ${value}`);
+      break;
+    }
+
     case '--help':
     case '-h':
     case 'help':