@aiwg/cli 2026.10.5 → 2026.10.7

package/dist/src/mcp/cli.mjs

@@ -8,6 +8,7 @@
 
 import { startServer, createServer } from './server.mjs';
 import { assertConfigDestination, assertConfigObject, assertProjectCredentials, isPathInsideDir, classifyMcpDestination, projectCredentialRemedy, writeConfigAtomic, writeConfigTransaction } from './config-file.mjs';
+import { replaceServer } from './toml-editor.mjs';
 import fs from 'fs/promises';
 import path from 'path';
 import os from 'os';
@@ -335,16 +336,14 @@ enabled_tools = [
           if (error.code !== 'ENOENT') throw error;
         }
 
-        // Check if AIWG MCP already configured
-        if (existing.includes('[mcp_servers.aiwg]')) {
+        // Parse before deciding whether to write, including already configured files.
+        const edited = replaceServer(existing, 'aiwg', tomlContent.trim());
+        if (edited.alreadyPresent) {
           console.log('AIWG MCP already configured in ~/.codex/config.toml');
           return true;
         }
 
-        // Append TOML config
-        const updated = existing.trimEnd() + '\n' + tomlContent.trim() + '\n';
-
-        await writeConfigAtomic(configPath, updated, { userScope: true });
+        await writeConfigAtomic(configPath, edited.text, { userScope: true });
         console.log(`MCP configuration appended to: ${configPath}`);
         console.log(`\nTo use AIWG MCP server with Codex:`);
         console.log(`  1. Restart Codex CLI`);
@@ -1125,7 +1124,7 @@ Usage:
   aiwg mcp profile import <file>
   aiwg mcp profile export <name> [--out <file>]
   aiwg mcp profile init-presets
-  aiwg mcp profile login <name> [--api-key-stdin | --api-key-file <path> | --api-key-env <ENV_VAR_NAME>]
+  aiwg mcp profile login <name> [--api-key-interactive | --api-key-stdin | --api-key-file <path> | --api-key-store <name> | --api-key-env <ENV_VAR_NAME>]
 
 Profiles let you define named subsets of your registered MCP servers:
   aiwg mcp profile add dev --servers git-gitea,memory-fortemi --description "Dev work"
@@ -1163,10 +1162,10 @@ Logging in to a Codex profile's isolated runtime home (#3062):
                                                      $OPENAI_KEY; visible to every other
                                                      child process this shell starts
   In every case the key reaches codex over stdin only; it never appears on
-  argv, in logs, or in error messages. Exactly one of the three may be
-  given. Without a terminal and without any of the three, this errors
-  naming all three. See "Supplying credentials safely" in the docs:
-  docs/mcp/codex-profiles.md#supplying-credentials-safely
+  argv, in logs, or in error messages. Use --api-key-store <name> for a named
+  OS-store entry, or --api-key-interactive for hidden terminal entry. Give
+  sources in preference order; a missing source without a terminal errors naming the options.
+  See docs/cli/sensitive-values.md for exposure details and manager examples.
 `);
 }
 
@@ -1420,59 +1419,18 @@ async function handleProfileInitPresets() {
   }
 }
 
-/**
- * Read all of stdin and return it as one trimmed string (go/no-go review,
- * blocker 1C's `--api-key-stdin`). Mirrors `src/cli/handlers/decision.ts`'s
- * own private `readStdin()` + `.trim()` for `--token-stdin` — duplicated
- * rather than imported for the same source/dist reason documented on
- * `requireFlagValue` above (this file runs both compiled and directly from
- * source). Input is expected to be a single line; a value containing
- * additional lines is not specially rejected, matching that precedent.
- */
-async function readStdinAll() {
-  const chunks = [];
-  for await (const chunk of process.stdin) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
-  return Buffer.concat(chunks).toString('utf8');
-}
-
-/**
- * Handle `aiwg mcp profile login <name> [--api-key-env <ENV_VAR_NAME> |
- * --api-key-stdin | --api-key-file <path>]` (#3062, #3069, go/no-go review
- * blocker 1C).
- *
- * Wires `loginInProfile()` (src/mcp/adapters/codex-runtime.ts), which
- * already implements the full headless-safe behavior this command needs:
- * with a terminal attached and none of the three given, it runs the
- * interactive `codex login` OAuth flow. Exactly one credential source may
- * be given; more than one is a usage error naming the flags given. In
- * every case the key reaches `loginInProfile()` only as an in-memory value
- * (or, for `--api-key-env`, a variable *name*) — never on argv, in logs, or
- * in an error message — and travels to `codex` only on its stdin (see
- * `spawnCodexLoginWithApiKey()`'s own doc comment). Without a terminal and
- * without any of the three, `loginInProfile()` itself refuses, naming all
- * three flags.
- *
- * `--api-key-env` reads the key from that named environment variable, as
- * before. `--api-key-stdin` reads one line from this process's own stdin
- * (refusing if stdin is a terminal, or if it is empty) — the least
- * observable source, since the key then never exists in any environment or
- * on any command line. `--api-key-file <path>` reads the key from a file
- * that `readApiKeyFromFile()` requires to be a non-symlink, single-hard-
- * link, regular file owned by the current user with no group/other
- * permission bits on POSIX — refused otherwise, without ever printing the
- * path's contents. `--api-key-env` remains the least preferred of the
- * three (see "Supplying credentials safely" in the docs): the named
- * variable is visible to every other child process this shell starts.
- */
+/** Standard sensitive input; the Codex adapter still receives only an in-memory key. */
 async function handleProfileLogin(args) {
   let apiKeyEnv;
   let apiKeyFilePath;
+  let apiKeyStore;
   try {
     // rejectEmpty: an explicitly-given-but-empty variable name/path can
     // never name a real environment variable or file (#3062 second review,
     // finding 4; go/no-go review blocker 1C).
     apiKeyEnv = requireFlagValue(args, { rejectEmpty: true }, '--api-key-env');
     apiKeyFilePath = requireFlagValue(args, { rejectEmpty: true }, '--api-key-file');
+    apiKeyStore = requireFlagValue(args, { rejectEmpty: true }, '--api-key-store');
   } catch (err) {
     if (err instanceof MissingFlagValueError) {
       console.error(`${err.message}.`);
@@ -1482,16 +1440,6 @@ async function handleProfileLogin(args) {
   }
   const useStdin = args.includes('--api-key-stdin');
 
-  const sourcesGiven = [
-    apiKeyEnv !== undefined ? '--api-key-env' : null,
-    useStdin ? '--api-key-stdin' : null,
-    apiKeyFilePath !== undefined ? '--api-key-file' : null,
-  ].filter(Boolean);
-  if (sourcesGiven.length > 1) {
-    console.error(`Only one credential source may be given; got ${sourcesGiven.join(', ')}.`);
-    process.exit(2);
-  }
-
   // Skip --api-key-env's/--api-key-file's own value when hunting for the
   // positional profile name, so e.g. `login --api-key-env FOO` (missing
   // name) never misreads FOO as the name (mirrors this file's own
@@ -1501,46 +1449,24 @@ async function handleProfileLogin(args) {
   for (let i = 0; i < args.length; i += 1) {
     const token = args[i];
     if (token === '--') break;
-    if (token === '--api-key-env' || token === '--api-key-file') { i += 1; continue; }
+    if (token === '--api-key-env' || token === '--api-key-file' || token === '--api-key-store') { i += 1; continue; }
     if (!token.startsWith('--')) positional.push(token);
   }
   const name = positional[0];
   if (!name) {
-    console.error('Usage: aiwg mcp profile login <name> [--api-key-env <ENV_VAR_NAME> | --api-key-stdin | --api-key-file <path>]');
+    console.error('Usage: aiwg mcp profile login <name> [--api-key-interactive | --api-key-stdin | --api-key-file <path> | --api-key-store <name> | --api-key-env <ENV_VAR_NAME>]');
     process.exit(1);
   }
 
-  let apiKey;
-  if (useStdin) {
-    if (process.stdin.isTTY) {
-      console.error(
-        '--api-key-stdin requires piped input, not a terminal; run ' +
-        `\`aiwg mcp profile login ${name}\` with no credential flag for the interactive login instead.`,
-      );
-      process.exit(2);
-    }
-    apiKey = (await readStdinAll()).trim();
-    if (!apiKey) {
-      console.error('--api-key-stdin received no key (stdin was empty).');
-      process.exit(2);
-    }
-  } else if (apiKeyFilePath !== undefined) {
-    const { readApiKeyFromFile } = await loadCodexRuntimeAdapter();
-    try {
-      apiKey = await readApiKeyFromFile(apiKeyFilePath);
-    } catch (err) {
-      console.error(err instanceof Error ? err.message : String(err));
-      process.exit(2);
-    }
-    if (!apiKey) {
-      console.error(`--api-key-file "${apiKeyFilePath}" is empty.`);
-      process.exit(2);
-    }
-  }
-
   try {
+    await loadCodexRuntimeAdapter();
+    const { resolveSensitiveInput } = await import(pathToFileURL(path.join(findOwnPackageRoot(), 'dist', 'src', 'auth', 'sensitive-input.js')).href);
+    const apiKey = await resolveSensitiveInput({
+      prefix: 'api-key', stdin: useStdin, file: apiKeyFilePath, store: apiKeyStore,
+      env: apiKeyEnv, interactive: args.includes('--api-key-interactive'),
+    });
     const { loginInProfile } = await loadCodexRuntimeAdapter();
-    const loginOptions = apiKey !== undefined ? { apiKey } : apiKeyEnv ? { apiKeyEnv } : {};
+    const loginOptions = { apiKey };
     await loginInProfile(name, loginOptions);
     console.log(`\nLogged in to profile "${name}".`);
   } catch (err) {

package/dist/src/mcp/config-file.mjs

@@ -187,11 +187,15 @@ export async function writeConfigAtomic(file, content, { userScope = false, proj
   if (rejectSymlinkParents) await assertNoSymlinkParents(file, symlinkRoot);
   const info = await assertConfigDestination(file, projectRoot);
   const mode = restoreMode ?? (userScope ? 0o600 : info ? info.mode & 0o7777 : newFileMode ?? 0o666);
-  await mkdir(dirname(file), { recursive: true });
+  // Restrict newly created parents for private settings, ownership and output files.
+  // Recursive mkdir leaves every existing directory's permissions unchanged.
+  await mkdir(dirname(file), { recursive: true, mode: (mode & 0o077) === 0 ? 0o700 : undefined });
   const temporary = `${file}.${randomUUID()}.tmp`;
   let handle;
+  let created = false;
   try {
     handle = await open(temporary, 'wx', mode);
+    created = true;
     await handle.writeFile(content, 'utf-8');
     if (userScope || info || restoreMode !== undefined || newFileMode !== undefined) await handle.chmod(mode);
     await handle.sync();
@@ -204,7 +208,7 @@ export async function writeConfigAtomic(file, content, { userScope = false, proj
     try {
       if (handle) await handle.close();
     } finally {
-      await unlink(temporary).catch(() => {});
+      if (created) await unlink(temporary).catch(() => {});
     }
   }
 }

package/dist/src/mcp/config-layers.mjs

@@ -17,8 +17,8 @@
 
 import { lstat, mkdtemp, readFile, readlink, realpath, rmdir } from 'fs/promises';
 import { basename, dirname, isAbsolute, posix, relative, resolve, sep, win32 } from 'path';
-import { assertConfigDestination, assertNoSymlinkParents, writeConfigAtomic } from './config-file.mjs';
-import { resolveCredentialPolicy, stricterCredentialPolicy, warnCredentialPolicyRelaxation, warnDroppedOverlayPolicy } from './credentials.mjs';
+import { assertConfigDestination, assertConfigObject, assertNoSymlinkParents, writeConfigAtomic } from './config-file.mjs';
+import { credentialPolicyViolations, resolveCredentialPolicy, stricterCredentialPolicy, warnCredentialPolicyRelaxation, warnDroppedOverlayPolicy } from './credentials.mjs';
 
 /**
  * `platform` lets tests validate Windows path semantics (`C:\org`, UNC
@@ -62,9 +62,15 @@ export function resolveConfigLayers(configDirOverride, env = process.env, { plat
   return layers.length > 0 ? layers : null;
 }
 
-async function readLayer(path) {
+async function readLayer(path, collection) {
   try {
-    return JSON.parse(await readFile(path, 'utf-8'));
+    const parsed = JSON.parse(await readFile(path, 'utf-8'));
+    try {
+      assertConfigObject(parsed, collection);
+    } catch {
+      throw new Error(`Invalid MCP configuration layer ${path}: expected an object root and an object ${collection} map`);
+    }
+    return parsed;
   } catch (error) {
     if (error?.code === 'ENOENT') return null;
     if (error instanceof SyntaxError) throw new Error(`Invalid JSON in MCP configuration layer ${path}`);
@@ -115,7 +121,7 @@ export async function loadLayered(layers, filename, collection, defaults) {
   let lowerPolicySource;
   const writeLayer = layers.length - 1;
   for (const [index, dir] of layers.entries()) {
-    const parsed = await readLayer(resolve(dir, filename));
+    const parsed = await readLayer(resolve(dir, filename), collection);
     if (!parsed) continue;
     const { [collection]: entries, ...rest } = parsed;
     if (index === writeLayer) {
@@ -298,16 +304,26 @@ export async function assertLayerWriteDestination(layers, filename) {
 /** Persist atomically, then refresh ownership only after a successful write. */
 export async function saveLayerData(file, data, collection, layers, layering, explicitPolicy = false) {
   if (layers) await assertLayerWriteDestination(layers, basename(file));
+  // Validate the current bytes even if the caller loaded and cached an older
+  // version, or called save(data) on a fresh standalone registry.
+  await readLayer(file, collection);
   const persisted = layering ? writeLayerData(data, collection, layering, explicitPolicy) : data;
   // The active identity layer file is always 0600: it is the personal write
   // layer of an active AIWG_CONFIG_LAYERS configuration and may carry secrets.
   // Without layering, `file` is whatever single directory the caller
   // configured (which may be a shared, group-readable organisation checkout
   // maintained directly, not a private identity directory): an existing file
-  // keeps its mode, while a newly created file starts private at 0600.
+  // keeps its mode unless the persisted servers carry literal credentials,
+  // while a newly created file starts private at 0600.
+  const info = layers ? null : await assertConfigDestination(file);
+  const tighten = info && (info.mode & 0o077) !== 0 && collection === 'servers'
+    && Object.values(persisted[collection] || {}).some(server => credentialPolicyViolations(server, 'references').length > 0);
   await writeConfigAtomic(file, JSON.stringify(persisted, null, 2) + '\n', layers
     ? { userScope: true, rejectSymlinkParents: true }
-    : { newFileMode: 0o600, rejectSymlinkParents: true });
+    : { newFileMode: 0o600, rejectSymlinkParents: true, ...(tighten ? { mode: 0o600 } : {}) });
+  if (tighten) {
+    console.warn(`Warning: tightened MCP registry ${file} from ${(info.mode & 0o7777).toString(8).padStart(4, '0')} to 0600 because it contains literal credentials.`);
+  }
   if (layering) {
     layering.own = new Set(Object.keys(persisted[collection] || {}));
     layering.ownFields = new Set(Object.keys(persisted).filter(field => field !== collection));

package/dist/src/mcp/grok-build-config.mjs

@@ -3,6 +3,7 @@ import { constants } from 'node:fs';
 import { access, lstat, readFile } from 'node:fs/promises';
 import { dirname, relative, resolve } from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { helperEnvironment } from '../process/cli-command.mjs';
 import { replaceServer } from './toml-editor.mjs';
 import { tomlString as string } from './toml-string.mjs';
 
@@ -144,7 +145,7 @@ export async function unmanageGrokBuildMcp(configPath, names, options = {}) {
 }
 
 function runJson(binary, args, cwd, env) {
-  const run = spawnSync(binary, args, { cwd, env, encoding: 'utf8', timeout: 30_000, killSignal: 'SIGKILL' });
+  const run = spawnSync(binary, args, { cwd, env: helperEnvironment(env), encoding: 'utf8', timeout: 30_000, killSignal: 'SIGKILL' });
   if (run.error || run.status !== 0) return { ok: false, detail: run.error?.message || run.stderr || `exit ${run.status}` };
   try { return { ok: true, value: JSON.parse(run.stdout || '{}') }; }
   catch { return { ok: false, detail: 'Grok returned malformed JSON' }; }

package/dist/src/mcp/muse-native-config.mjs

@@ -4,6 +4,7 @@ import { spawnSync } from 'node:child_process';
 import { dirname, join } from 'node:path';
 import os from 'node:os';
 import { resolveMuseXdgSkillsDir } from '../providers/muse-paths.js';
+import { helperEnvironment } from '../process/cli-command.mjs';
 
 // Mirrors tools/agents/providers/muse-hooks.mjs. src/ cannot import tools/:
 // tools/ is not part of the compiled dist/ tree.
@@ -47,7 +48,7 @@ function deepEqual(a, b) {
 
 function inspectMuseCli(env) {
   const result = spawnSync('muse', ['--version'], {
-    env,
+    env: helperEnvironment(env),
     encoding: 'utf8',
     timeout: MUSE_VERSION_TIMEOUT_MS,
     killSignal: 'SIGKILL',

package/dist/src/mcp/profiles.js

@@ -9,10 +9,10 @@
  *
  * @implements #889
  */
-import { resolveCredentialPolicy } from './credentials.mjs';
 import { isLowerLayerEntry, loadLayered, resolveProfileExtends, resolveConfigLayers, saveLayerData } from './config-layers.mjs';
-import { readFile, writeFile } from 'fs/promises';
-import { resolve } from 'path';
+import { writeConfigAtomic } from './config-file.mjs';
+import { readFile } from 'fs/promises';
+import { parse, resolve } from 'path';
 import { resolveConfigDir } from '../config/user-config.js';
 // ─────────────────────────────────────────────
 // Constants
@@ -81,38 +81,21 @@ export class McpProfileRegistry {
     async load() {
         if (this.cache)
             return this.cache;
-        if (this.layers) {
-            const layered = await loadLayered(this.layers, PROFILES_FILENAME, 'profiles', DEFAULT_DATA);
-            this.cache = layered.data;
-            this.layering = layered.layering;
-            return this.cache;
-        }
-        const filePath = this.getPath();
-        try {
-            const content = await readFile(filePath, 'utf-8');
-            const parsed = JSON.parse(content);
-            this.cache = {
-                ...DEFAULT_DATA,
-                ...parsed,
-                profiles: parsed.profiles || {},
-            };
-        }
-        catch {
-            this.cache = { ...DEFAULT_DATA, profiles: {} };
-        }
-        try {
-            resolveCredentialPolicy({ registryPolicy: this.cache.credentialPolicy, env: {} });
-        }
-        catch (error) {
-            this.cache = null;
-            throw new Error(`Invalid MCP credential policy in ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
-        }
+        const loaded = await loadLayered(this.layers ?? [this.configDir], PROFILES_FILENAME, 'profiles', DEFAULT_DATA);
+        this.cache = loaded.data;
+        this.layering = this.layers ? loaded.layering : null;
         return this.cache;
     }
     async save(data = this.cache) {
         if (!data)
             return;
-        await saveLayerData(this.getPath(), data, 'profiles', this.layers, this.layering);
+        // Load ownership before a fresh save so inherited fields stay in their layer.
+        let layering = this.layering;
+        if (this.layers && !layering) {
+            await this.load();
+            layering = this.layering;
+        }
+        await saveLayerData(this.getPath(), data, 'profiles', this.layers, layering);
         this.cache = data;
         if (this.layers) {
             this.clearCache();
@@ -311,7 +294,11 @@ export class McpProfileRegistry {
         const toExport = profileName
             ? { [profileName]: data.profiles[profileName] }
             : data.profiles;
-        await writeFile(filePath, JSON.stringify({ profiles: toExport }, null, 2) + '\n', 'utf-8');
+        await writeConfigAtomic(filePath, JSON.stringify({ profiles: toExport }, null, 2) + '\n', {
+            userScope: true,
+            rejectSymlinkParents: true,
+            symlinkRoot: parse(resolve(filePath)).root,
+        });
     }
     async initPresets() {
         const data = structuredClone(await this.load());

package/dist/src/mcp/profiles.mjs

@@ -10,10 +10,10 @@
  * @implements #889
  */
 
-import { resolveCredentialPolicy } from './credentials.mjs';
 import { isLowerLayerEntry, loadLayered, resolveProfileExtends, resolveConfigLayers, saveLayerData } from './config-layers.mjs';
-import { readFile, writeFile } from 'fs/promises';
-import { resolve } from 'path';
+import { writeConfigAtomic } from './config-file.mjs';
+import { readFile } from 'fs/promises';
+import { parse, resolve } from 'path';
 import { homedir } from 'os';
 import { existsSync } from 'fs';
 
@@ -112,39 +112,21 @@ export class McpProfileRegistry {
   async load() {
     if (this.#cache) return this.#cache;
 
-    if (this.#layers) {
-      const layered = await loadLayered(this.#layers, PROFILES_FILENAME, 'profiles', DEFAULT_DATA);
-      this.#cache = layered.data;
-      this.#layering = layered.layering;
-      return this.#cache;
-    }
-
-    const filePath = this.getPath();
-    try {
-      const content = await readFile(filePath, 'utf-8');
-      const parsed = JSON.parse(content);
-      this.#cache = {
-        ...DEFAULT_DATA,
-        ...parsed,
-        profiles: parsed.profiles || {},
-      };
-    } catch {
-      this.#cache = { ...DEFAULT_DATA, profiles: {} };
-    }
-
-    try {
-      resolveCredentialPolicy({ registryPolicy: this.#cache.credentialPolicy, env: {} });
-    } catch (error) {
-      this.#cache = null;
-      throw new Error(`Invalid MCP credential policy in ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
-    }
-
+    const loaded = await loadLayered(this.#layers ?? [this.#configDir], PROFILES_FILENAME, 'profiles', DEFAULT_DATA);
+    this.#cache = loaded.data;
+    this.#layering = this.#layers ? loaded.layering : null;
     return this.#cache;
   }
 
   async save(data = this.#cache) {
     if (!data) return;
-    await saveLayerData(this.getPath(), data, 'profiles', this.#layers, this.#layering);
+    // Load ownership before a fresh save so inherited fields stay in their layer.
+    let layering = this.#layering;
+    if (this.#layers && !layering) {
+      await this.load();
+      layering = this.#layering;
+    }
+    await saveLayerData(this.getPath(), data, 'profiles', this.#layers, layering);
     this.#cache = data;
     if (this.#layers) {
       this.clearCache();
@@ -402,7 +384,11 @@ export class McpProfileRegistry {
       throw new Error(`Profile "${profileName}" not found.`);
     }
 
-    await writeFile(filePath, JSON.stringify({ profiles: toExport }, null, 2) + '\n', 'utf-8');
+    await writeConfigAtomic(filePath, JSON.stringify({ profiles: toExport }, null, 2) + '\n', {
+      userScope: true,
+      rejectSymlinkParents: true,
+      symlinkRoot: parse(resolve(filePath)).root,
+    });
   }
 
   /** Install preset profiles (does not overwrite existing) */

package/dist/src/mcp/registry.js

@@ -120,32 +120,9 @@ export class McpServerRegistry {
     async load() {
         if (this.cache)
             return this.cache;
-        if (this.layers) {
-            const layered = await loadLayered(this.layers, REGISTRY_FILENAME, 'servers', DEFAULT_REGISTRY);
-            this.cache = layered.data;
-            this.layering = layered.layering;
-            return this.cache;
-        }
-        const filePath = this.getPath();
-        try {
-            const content = await readFile(filePath, 'utf-8');
-            const parsed = JSON.parse(content);
-            this.cache = {
-                ...DEFAULT_REGISTRY,
-                ...parsed,
-                servers: parsed.servers || {},
-            };
-        }
-        catch {
-            this.cache = { ...DEFAULT_REGISTRY, servers: {} };
-        }
-        try {
-            resolveCredentialPolicy({ registryPolicy: this.cache.credentialPolicy, env: {} });
-        }
-        catch (error) {
-            this.cache = null;
-            throw new Error(`Invalid MCP credential policy in ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
-        }
+        const loaded = await loadLayered(this.layers ?? [this.configDir], REGISTRY_FILENAME, 'servers', DEFAULT_REGISTRY);
+        this.cache = loaded.data;
+        this.layering = this.layers ? loaded.layering : null;
         return this.cache;
     }
     /** Save the registry to disk */
@@ -536,6 +513,9 @@ async function injectJson(registry, servers, configPath, provider, dryRun, resul
     return result;
 }
 async function injectToml(registry, servers, configPath, provider, dryRun, result, userScope, projectRoot, toolPlan = null) {
+    // A deliberately aliased Codex home is trusted; descendants below it are not.
+    const destinationRoot = projectRoot ?? (process.env.CODEX_HOME || resolve(process.env.HOME || process.env.USERPROFILE || homedir(), '.codex'));
+    await assertConfigDestination(configPath, destinationRoot);
     let existing = '';
     try {
         existing = await readFile(configPath, 'utf-8');
@@ -553,7 +533,7 @@ async function injectToml(registry, servers, configPath, provider, dryRun, resul
         result.serversInjected.push(server.name);
     }
     if (!dryRun) {
-        await writeConfigAtomic(configPath, existing, { userScope, projectRoot });
+        await writeConfigAtomic(configPath, existing, { userScope, projectRoot: destinationRoot });
         for (const server of servers) {
             await registry.recordInjection(server.name, provider);
         }

package/dist/src/mcp/registry.mjs

@@ -115,33 +115,9 @@ export class McpServerRegistry {
   async load() {
     if (this.#cache) return this.#cache;
 
-    if (this.#layers) {
-      const layered = await loadLayered(this.#layers, REGISTRY_FILENAME, 'servers', DEFAULT_REGISTRY);
-      this.#cache = layered.data;
-      this.#layering = layered.layering;
-      return this.#cache;
-    }
-
-    const filePath = this.getPath();
-    try {
-      const content = await readFile(filePath, 'utf-8');
-      const parsed = JSON.parse(content);
-      this.#cache = {
-        ...DEFAULT_REGISTRY,
-        ...parsed,
-        servers: parsed.servers || {},
-      };
-    } catch {
-      this.#cache = { ...DEFAULT_REGISTRY, servers: {} };
-    }
-
-    try {
-      resolveCredentialPolicy({ registryPolicy: this.#cache.credentialPolicy, env: {} });
-    } catch (error) {
-      this.#cache = null;
-      throw new Error(`Invalid MCP credential policy in ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
-    }
-
+    const loaded = await loadLayered(this.#layers ?? [this.#configDir], REGISTRY_FILENAME, 'servers', DEFAULT_REGISTRY);
+    this.#cache = loaded.data;
+    this.#layering = this.#layers ? loaded.layering : null;
     return this.#cache;
   }
 
@@ -488,6 +464,9 @@ async function injectJson(registry, servers, configPath, provider, dryRun, resul
 }
 
 async function injectToml(registry, servers, configPath, provider, dryRun, result, userScope, projectRoot, toolPlan = null) {
+  // A deliberately aliased Codex home is trusted; descendants below it are not.
+  const destinationRoot = projectRoot ?? (process.env.CODEX_HOME || resolve(process.env.HOME || process.env.USERPROFILE || homedir(), '.codex'));
+  await assertConfigDestination(configPath, destinationRoot);
   let existing = '';
   try {
     existing = await readFile(configPath, 'utf-8');
@@ -504,7 +483,7 @@ async function injectToml(registry, servers, configPath, provider, dryRun, resul
   }
 
   if (!dryRun) {
-    await writeConfigAtomic(configPath, existing, { userScope, projectRoot });
+    await writeConfigAtomic(configPath, existing, { userScope, projectRoot: destinationRoot });
 
     for (const server of servers) {
       await registry.recordInjection(server.name, provider);

package/dist/src/mcp/server.mjs

@@ -34,6 +34,27 @@ const FRAMEWORKS = {
   'media-marketing-kit': path.join(AIWG_ROOT, 'agentic/code/frameworks/media-marketing-kit')
 };
 
+/** Keep the published object contracts stable across native Zod converters. */
+function retainToolJsonSchema(schema, seen = new Set()) {
+  if (!(schema instanceof z.ZodType) || seen.has(schema)) return;
+  seen.add(schema);
+  const definition = schema._zod.def;
+  if (schema instanceof z.ZodObject) {
+    const catchall = definition.catchall;
+    if ((!catchall && Object.keys(schema.shape).length > 0) || catchall instanceof z.ZodNever || catchall instanceof z.ZodUnknown) {
+      z.globalRegistry.add(schema, { ...z.globalRegistry.get(schema), additionalProperties: catchall instanceof z.ZodUnknown });
+    }
+  }
+  if (schema instanceof z.ZodRecord && definition.keyType instanceof z.ZodString && !definition.keyType._zod.def.checks?.length) {
+    z.globalRegistry.add(schema, { ...z.globalRegistry.get(schema), propertyNames: undefined });
+  }
+  for (const value of Object.values(definition)) {
+    if (value instanceof z.ZodType) retainToolJsonSchema(value, seen);
+    else if (Array.isArray(value)) for (const child of value) retainToolJsonSchema(child, seen);
+    else if (value && typeof value === 'object') for (const child of Object.values(value)) retainToolJsonSchema(child, seen);
+  }
+}
+
 /**
  * Create and configure the AIWG MCP Server
  */
@@ -43,6 +64,18 @@ export async function createServer() {
     version: '1.0.0'
   });
 
+  const registerTool = server.registerTool.bind(server);
+  server.registerTool = (name, config, handler) => {
+    const schemas = {};
+    for (const key of ['inputSchema', 'outputSchema']) {
+      if (!config[key]) continue;
+      const schema = config[key] instanceof z.ZodType ? config[key] : z.object(config[key]);
+      retainToolJsonSchema(schema);
+      schemas[key] = schema;
+    }
+    return registerTool(name, { ...config, ...schemas }, handler);
+  };
+
   // ============================================
   // TOOLS
   // ============================================
@@ -248,7 +281,7 @@ export async function createServer() {
     description: 'Render AIWG template with provided variables',
     inputSchema: {
       template: z.string().describe('Template path (e.g., "sdlc/intake/project-intake-template.md")'),
-      variables: z.record(z.string()).optional().describe('Template variable substitutions')
+      variables: z.record(z.string(), z.string()).optional().describe('Template variable substitutions')
     }
   }, async ({ template, variables = {} }) => {
     try {