@aiwg/cli 2026.10.6 → 2026.10.8

package/dist/src/marketplace/provenance.js

@@ -8,6 +8,7 @@
  * @implements #2009
  */
 import { execFile } from 'node:child_process';
+import { helperEnvironment } from '../process/cli-command.mjs';
 import { createHash, createPrivateKey, createPublicKey, sign as cryptoSign, verify as cryptoVerify, } from 'node:crypto';
 import { lstat, readFile, readdir } from 'node:fs/promises';
 import path from 'node:path';
@@ -157,7 +158,7 @@ async function git(cwd, args) {
         cwd,
         encoding: 'utf8',
         timeout: 120_000,
-        env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+        env: { ...helperEnvironment(), GIT_TERMINAL_PROMPT: '0' },
     });
     return stdout.trim();
 }
@@ -166,7 +167,7 @@ async function gitBytes(cwd, args) {
         cwd,
         encoding: 'buffer',
         timeout: 120_000,
-        env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+        env: { ...helperEnvironment(), GIT_TERMINAL_PROMPT: '0' },
     });
     return stdout;
 }

package/dist/src/mcp/adapters/codex-runtime.js

@@ -14,11 +14,13 @@
  *
  * @implements #892
  */
+import { readPrivateValueFile } from '../../auth/sensitive-input.js';
 import { signalChild } from '../../process/signal-child.mjs';
-import { readFile, mkdir, symlink, access, readdir, chmod, lstat, open } from 'fs/promises';
+import { helperEnvironment, HELPER_ENV_ALLOWLIST, DESKTOP_HELPER_ENV_ALLOWLIST } from '../../process/cli-command.mjs';
+import { readFile, mkdir, symlink, access, readdir, chmod } from 'fs/promises';
 import { join } from 'path';
 import { homedir } from 'os';
-import { existsSync, constants } from 'fs';
+import { existsSync } from 'fs';
 import { spawn, spawnSync } from 'child_process';
 import { boundedSpawnSync, resolveSyncProcessTimeoutMs } from '../../process/bounded-child-process.mjs';
 import { isInteractive } from '../../cli/env.js';
@@ -228,73 +230,9 @@ function envWithoutSecretValue(base, envVarName, secretValue) {
     }
     return result;
 }
-/**
- * Read an API key from a private file (#3062 go/no-go review, blocker 1C):
- * `--api-key-file <path>` reads the key from disk instead of an
- * environment variable, so a file that does not meet the same bar the
- * decision ledger's own file writer enforces
- * (`src/decision/ledger.ts`'s `openLedgerFileForAppend`) is refused rather
- * than silently trusted. This mirrors that check for a read instead of a
- * write — there is no already-exported helper at this layer to reuse (the
- * ledger's checks are private to that module and tied to its own
- * create-if-missing write path), so this re-implements the same checks for
- * a read: never follow a symlink; the open file descriptor must resolve to
- * a regular file with exactly one hard link; and, on POSIX, must be owned
- * by the current user with no group/other permission bits. The file's
- * contents are returned trimmed; no error message here ever includes them.
- */
+/** Backward-compatible MCP export; the validation is shared by all input commands. */
 async function readApiKeyFromFile(filePath) {
-    try {
-        const pre = await lstat(filePath);
-        if (pre.isSymbolicLink()) {
-            throw new Error(`--api-key-file: "${filePath}" is a symlink; refusing to follow it.`);
-        }
-    }
-    catch (error) {
-        if (error.code === 'ENOENT') {
-            throw new Error(`--api-key-file: "${filePath}" does not exist.`);
-        }
-        if (error instanceof Error && error.message.startsWith('--api-key-file:'))
-            throw error;
-        throw new Error(`--api-key-file: cannot stat "${filePath}": ${error.message}`);
-    }
-    const hasNoFollow = typeof constants.O_NOFOLLOW === 'number';
-    const flags = constants.O_RDONLY | (hasNoFollow ? constants.O_NOFOLLOW : 0);
-    let handle;
-    try {
-        handle = await open(filePath, flags);
-    }
-    catch (error) {
-        const code = error.code;
-        if (code === 'ELOOP')
-            throw new Error(`--api-key-file: "${filePath}" is a symlink; refusing to follow it.`);
-        if (code === 'ENOENT')
-            throw new Error(`--api-key-file: "${filePath}" does not exist.`);
-        throw new Error(`--api-key-file: cannot open "${filePath}": ${error.message}`);
-    }
-    try {
-        const stat = await handle.stat();
-        if (!stat.isFile()) {
-            throw new Error(`--api-key-file: "${filePath}" is not a regular file.`);
-        }
-        if (stat.nlink !== 1) {
-            throw new Error(`--api-key-file: "${filePath}" has more than one hard link; refusing to read it.`);
-        }
-        if (process.platform !== 'win32') {
-            const uid = typeof process.getuid === 'function' ? process.getuid() : null;
-            if (uid !== null && stat.uid !== uid) {
-                throw new Error(`--api-key-file: "${filePath}" is not owned by the current user.`);
-            }
-            if ((stat.mode & 0o077) !== 0) {
-                throw new Error(`--api-key-file: "${filePath}" must not be readable or writable by group or other ` +
-                    '(chmod 600 it).');
-            }
-        }
-        return (await handle.readFile({ encoding: 'utf-8' })).trim();
-    }
-    finally {
-        await handle.close();
-    }
+    return readPrivateValueFile(filePath, '--api-key-file');
 }
 /**
  * Async, credential-safe launch of `codex login --with-api-key` (#3062
@@ -320,17 +258,37 @@ function spawnCodexLoginWithApiKey(apiKey, env) {
     return new Promise((resolve) => {
         const child = spawn('codex', ['login', '--with-api-key'], {
             env,
-            stdio: ['pipe', 'inherit', 'inherit'],
+            stdio: ['pipe', 'pipe', 'pipe'],
         });
         let settled = false;
         let timer;
+        const stdout = [];
+        const stderr = [];
+        let outputBytes = 0;
+        // Buffer through close so a credential split between chunks cannot escape
+        // redaction. The combined cap bounds both memory and forwarded diagnostics.
+        const collect = (target, chunk) => {
+            if (settled)
+                return;
+            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            outputBytes += buffer.length;
+            if (outputBytes > 1024 * 1024) {
+                settle({ status: null, signal: 'SIGKILL', error: new Error('codex login output exceeded the 1 MiB limit.') });
+                return;
+            }
+            target.push(buffer);
+        };
+        const onStdout = (chunk) => collect(stdout, chunk);
+        const onStderr = (chunk) => collect(stderr, chunk);
+        child.stdout?.on('data', onStdout);
+        child.stderr?.on('data', onStderr);
         // #3062 go/no-go review, blocker 2: stdin error, write completion,
-        // child 'error', child 'exit', and the deadline all funnel through this
+        // child 'error', child 'close', and the deadline all funnel through this
         // one function, which settles exactly once, always clears the timer and
         // removes every listener this call added, and kills the child if it is
         // still alive on a failing settlement (a running process on the
         // timeout path; a process that may still be running on an unexpected
-        // stdin-write error). The 'exit' path never reaches the kill — by the
+        // stdin-write error). The 'close' path never reaches the kill — by the
         // time that event fires the child has already exited.
         const settle = (result) => {
             if (settled)
@@ -340,13 +298,23 @@ function spawnCodexLoginWithApiKey(apiKey, env) {
                 clearTimeout(timer);
             child.stdin?.removeListener('error', onStdinError);
             child.removeListener('error', onChildError);
-            child.removeListener('exit', onExit);
+            child.removeListener('close', onClose);
+            child.stdout?.removeListener('data', onStdout);
+            child.stderr?.removeListener('data', onStderr);
+            child.stdout?.destroy();
+            child.stderr?.destroy();
             if (result.error && child.exitCode === null && child.signalCode === null) {
                 try {
                     signalChild(child, 'SIGKILL');
                 }
                 catch { /* already gone */ }
             }
+            // On a failed/oversized stream, suppress buffered fragments entirely:
+            // the missing remainder might contain the rest of a credential.
+            if (!result.error) {
+                process.stdout.write(Buffer.concat(stdout).toString('utf8').split(apiKey).join('[redacted]'));
+                process.stderr.write(Buffer.concat(stderr).toString('utf8').split(apiKey).join('[redacted]'));
+            }
             resolve(result);
         };
         timer = setTimeout(() => {
@@ -358,15 +326,15 @@ function spawnCodexLoginWithApiKey(apiKey, env) {
         }, boundMs);
         const onChildError = (err) => settle({ status: null, signal: null, error: err });
         child.on('error', onChildError);
-        const onExit = (code, signal) => settle({ status: code, signal });
-        child.on('exit', onExit);
+        const onClose = (code, signal) => settle({ status: code, signal });
+        child.on('close', onClose);
         // A child that exits (or closes its read end) before reading stdin
         // raises EPIPE/ECONNRESET on the *stdin stream*, not on the child
         // object — `child.on('error', ...)` above never sees it, so without
         // this listener it is an unhandled 'error' event, which Node turns into
         // an uncaught exception. Installed before the write/end below, per the
         // review. EPIPE/ECONNRESET specifically mean "the child already went
-        // away"; the already-firing (or about-to-fire) 'exit' event carries the
+        // away"; the already-firing (or about-to-fire) 'close' event carries the
         // real, non-secret result, so this swallows exactly those two codes and
         // lets settle() happen there instead. Anything else is a genuine,
         // unexpected stdin failure and is itself the settling error.
@@ -413,7 +381,9 @@ export async function loginInProfile(profile, options = {}) {
     await ensureRuntimeHome(profile);
     const rtHome = runtimeHomePath(profile);
     const env = {
-        ...process.env,
+        ...helperEnvironment(process.env, [
+            ...HELPER_ENV_ALLOWLIST, ...DESKTOP_HELPER_ENV_ALLOWLIST, 'NODE_EXTRA_CA_CERTS',
+        ]),
         HOME: rtHome,
         CODEX_HOME: rtHome,
         AIWG_CONFIG: resolveUserConfigDir(),

package/dist/src/mcp/cli.mjs

@@ -29,7 +29,7 @@ import {
   prepareClaudePermissions,
   resolveToolFilters,
 } from './tool-filters.mjs';
-import { assertCredentialPolicy, CREDENTIAL_POLICIES, installPolicyCheckedServer, redactCredentialArgs, redactCredentialText, redactCredentialRecord, resolveCredentialPolicy } from './credentials.mjs';
+import { assertCredentialPolicy, CREDENTIAL_POLICIES, credentialReferenceInput, validateCredentialReferences, hasSecretLookingLiterals, installPolicyCheckedServer, redactCredentialArgs, redactCredentialText, redactCredentialRecord, resolveCredentialPolicy } from './credentials.mjs';
 import { getMcpInjectionDefinition } from '../providers/provider-definitions.mjs';
 import { manageOmpMcp } from './omp-config.mjs';
 import { claudeDesktopConfigPath, resolveClaudeInstallTarget, legacyClaudeMigration } from './claude-install.mjs';
@@ -176,13 +176,15 @@ Server Options (for add/update):
   --url <url>          Server URL (for http/sse types)
   --type <type>        Server type: http (default), stdio, sse
   --command <cmd>      Command to run (for stdio type)
-  --args <a1,a2,...>   Command arguments (comma-separated, for stdio)
+  --args <a1,a2,...>   Literal command arguments (visible on argv; prefer env/header references)
   --env <K=V,...>      Environment variables (comma-separated K=V pairs)
   --headers <K=V,...>  HTTP headers (comma-separated K=V pairs)
-  --header-env <K=ENV,...>
-                       Resolve HTTP header values from environment variables
-  --env-from <K=ENV,...>
-                       Resolve stdio server variables from environment variables
+  --header-env <K=SOURCE,...>
+                       HTTP header references: ENV_NAME, file:ABSOLUTE_PATH, store:NAME
+  --env-from <K=SOURCE,...>
+                       Stdio variable references (same sources; repeatable)
+                       File/store require the AIWG runtime client; native configs use ENV_NAME
+                       stdin:STORE_NAME / interactive:STORE_NAME save one value to the OS store
   --description <text> Optional description
 
 Inject Options:
@@ -701,6 +703,83 @@ function parseKVPairs(str) {
   return Object.keys(result).length > 0 ? result : undefined;
 }
 
+function parseHeaderPairs(str) {
+  if (!str) return undefined;
+  const entries = str.split(',').flatMap(pair => {
+    const delimiter = pair.search(/[=:]/);
+    return delimiter < 0 ? [] : [[pair.slice(0, delimiter).trim(), pair.slice(delimiter + 1).trim()]];
+  });
+  return entries.length ? Object.fromEntries(entries) : undefined;
+}
+
+/** Validate every occurrence, retaining the existing comma-separated spelling. */
+function parseCredentialReferences(args, flag) {
+  let result;
+  for (let index = 0; index < args.length; index++) {
+    const token = args[index];
+    if (token === '--') break;
+    if (token !== flag && !token.startsWith(`${flag}=`)) continue;
+    const value = token === flag ? args[++index] : token.slice(flag.length + 1);
+    if (!value || value.startsWith('--')) throw new Error(`${flag} requires KEY=ENV_NAME, KEY=file:ABSOLUTE_PATH, or KEY=store:NAME.`);
+    for (const pair of value.split(',')) {
+      const equals = pair.indexOf('=');
+      const key = pair.slice(0, equals).trim();
+      if (equals < 1 || !key) throw new Error(`${flag} requires KEY=ENV_NAME, KEY=file:ABSOLUTE_PATH, or KEY=store:NAME.`);
+      const reference = pair.slice(equals + 1).trim();
+      credentialReferenceInput(reference.replace(/^(?:stdin|interactive):/, 'store:'), flag);
+      result = { ...result, [key]: reference };
+    }
+  }
+  return result;
+}
+
+/** Transient input is saved by the existing raw-value store; registry receives only its name. */
+export async function persistCredentialInputs(server, dependencies) {
+  const inputs = [];
+  for (const field of ['envFrom', 'headerEnv']) {
+    for (const [key, reference] of Object.entries(server[field] || {})) {
+      const match = /^(stdin|interactive):(.+)$/.exec(reference);
+      if (match) {
+        credentialReferenceInput(`store:${match[2]}`, field === 'envFrom' ? '--env-from' : '--header-env');
+        inputs.push({ field, key, source: match[1], name: match[2] });
+      }
+    }
+  }
+  if (inputs.filter(input => input.source === 'stdin').length > 1) {
+    throw new Error('Only one --env-from/--header-env value may use stdin:STORE_NAME per invocation; use file:PATH or store:NAME for additional values.');
+  }
+  const persistent = Object.fromEntries(['envFrom', 'headerEnv'].map(field => [field,
+    Object.fromEntries(Object.entries(server[field] || {}).map(([key, reference]) => [key, reference.replace(/^(?:stdin|interactive):/, 'store:')]))]));
+  validateCredentialReferences(persistent);
+  if (!inputs.length) return;
+  const { resolveSensitiveInput, namedSensitiveStore } = dependencies
+    ?? await import(pathToFileURL(path.join(findOwnPackageRoot(), 'dist', 'src', 'auth', 'sensitive-input.js')).href);
+  // Read/validate all requested inputs before changing the store.
+  const pending = [];
+  for (const input of inputs) {
+    try {
+      const value = await resolveSensitiveInput({ prefix: 'value', [input.source]: true });
+      pending.push({ ...input, value });
+    } catch (error) {
+      const flag = input.field === 'envFrom' ? '--env-from' : '--header-env';
+      const message = error instanceof Error ? error.message : 'MCP credential input failed';
+      throw new Error(message.replace(/--value-(interactive|stdin|file|store|env)(?: <(?:path|name)>)?/g, (_, source) =>
+        `${flag} KEY=${['interactive', 'stdin'].includes(source) ? `${source}:STORE_NAME` : source === 'env' ? 'ENV_NAME' : source === 'file' ? 'file:ABSOLUTE_PATH' : 'store:NAME'}`));
+    }
+  }
+  for (const { field, key, name, value } of pending) {
+    try { await namedSensitiveStore(name).saveSecret(value); }
+    catch { throw new Error('MCP credential input could not be saved to the native store; use --env-from/--header-env with file:PATH or ENV_NAME instead.'); }
+    server[field][key] = `store:${name}`;
+  }
+}
+
+function warnLiteralCredentials(server) {
+  if (hasSecretLookingLiterals(server)) {
+    console.error('Warning: secret-bearing --env/--headers literals are deprecated; argv and saved config expose their values. Use --env-from/--header-env references. See docs/cli/sensitive-values.md.');
+  }
+}
+
 /**
  * Handle `aiwg mcp add <name> [opts]`
  */
@@ -718,8 +797,8 @@ async function handleAdd(args) {
   const argsStr = parseFlag(args, '--args');
   const envStr = parseFlag(args, '--env');
   const headersStr = parseFlag(args, '--headers');
-  const headerEnvStr = parseFlag(args, '--header-env');
-  const envFromStr = parseFlag(args, '--env-from');
+  const headerEnv = parseCredentialReferences(args, '--header-env');
+  const envFrom = parseCredentialReferences(args, '--env-from');
   const description = parseFlag(args, '--description');
 
   if (type === 'stdio' && !command) {
@@ -732,24 +811,28 @@ async function handleAdd(args) {
   }
 
   const registry = new McpServerRegistry();
-  await registry.add({
+  const definition = {
     name,
     type,
     url,
     command,
     args: argsStr ? argsStr.split(',') : undefined,
     env: parseKVPairs(envStr),
-    headers: parseKVPairs(headersStr),
-    headerEnv: parseKVPairs(headerEnvStr),
-    envFrom: parseKVPairs(envFromStr),
+    headers: parseHeaderPairs(headersStr),
+    headerEnv,
+    envFrom,
     description,
-  });
+  };
+  warnLiteralCredentials(definition);
+  if ([...Object.values(definition.envFrom || {}), ...Object.values(definition.headerEnv || {})].some(ref => /^(?:stdin|interactive):/.test(ref)) && await registry.get(name)) throw new Error(`MCP server "${name}" already exists`);
+  await persistCredentialInputs(definition);
+  await registry.add(definition);
 
   console.log(`Added MCP server: ${name}`);
   if (url) console.log(`  URL: ${redactUrlUserinfo(url)}`);
   if (command) console.log(`  Command: ${redactCredentialText(command)}`);
   console.log(`  Type: ${type}`);
-  for (const [key, values] of [['env', parseKVPairs(envStr)], ['headers', parseKVPairs(headersStr)]]) {
+  for (const [key, values] of [['env', definition.env], ['headers', definition.headers]]) {
     if (values) console.log(`  ${key}: ${Object.keys(values).join(', ')}`);
   }
   console.log(`\nUse "aiwg mcp inject --provider <name>" to inject into a provider config.`);
@@ -790,8 +873,8 @@ async function handleUpdate(args) {
   const argsStr = parseFlag(args, '--args');
   const envStr = parseFlag(args, '--env');
   const headersStr = parseFlag(args, '--headers');
-  const headerEnvStr = parseFlag(args, '--header-env');
-  const envFromStr = parseFlag(args, '--env-from');
+  const headerEnv = parseCredentialReferences(args, '--header-env');
+  const envFrom = parseCredentialReferences(args, '--env-from');
   const description = parseFlag(args, '--description');
 
   if (url !== undefined) updates.url = url;
@@ -799,9 +882,9 @@ async function handleUpdate(args) {
   if (command !== undefined) updates.command = command;
   if (argsStr !== undefined) updates.args = argsStr.split(',');
   if (envStr !== undefined) updates.env = parseKVPairs(envStr);
-  if (headersStr !== undefined) updates.headers = parseKVPairs(headersStr);
-  if (headerEnvStr !== undefined) updates.headerEnv = parseKVPairs(headerEnvStr);
-  if (envFromStr !== undefined) updates.envFrom = parseKVPairs(envFromStr);
+  if (headersStr !== undefined) updates.headers = parseHeaderPairs(headersStr);
+  if (headerEnv !== undefined) updates.headerEnv = headerEnv;
+  if (envFrom !== undefined) updates.envFrom = envFrom;
   if (description !== undefined) updates.description = description;
 
   if (Object.keys(updates).length === 0) {
@@ -810,6 +893,9 @@ async function handleUpdate(args) {
   }
 
   const registry = new McpServerRegistry();
+  warnLiteralCredentials(updates);
+  if ([...Object.values(updates.envFrom || {}), ...Object.values(updates.headerEnv || {})].some(ref => /^(?:stdin|interactive):/.test(ref)) && !(await registry.get(name))) throw new Error(`MCP server "${name}" not found`);
+  await persistCredentialInputs(updates);
   await registry.update(name, updates);
   console.log(`Updated MCP server: ${name}`);
   for (const [key, value] of Object.entries(updates)) {
@@ -1124,7 +1210,7 @@ Usage:
   aiwg mcp profile import <file>
   aiwg mcp profile export <name> [--out <file>]
   aiwg mcp profile init-presets
-  aiwg mcp profile login <name> [--api-key-stdin | --api-key-file <path> | --api-key-env <ENV_VAR_NAME>]
+  aiwg mcp profile login <name> [--api-key-interactive | --api-key-stdin | --api-key-file <path> | --api-key-store <name> | --api-key-env <ENV_VAR_NAME>]
 
 Profiles let you define named subsets of your registered MCP servers:
   aiwg mcp profile add dev --servers git-gitea,memory-fortemi --description "Dev work"
@@ -1162,10 +1248,10 @@ Logging in to a Codex profile's isolated runtime home (#3062):
                                                      $OPENAI_KEY; visible to every other
                                                      child process this shell starts
   In every case the key reaches codex over stdin only; it never appears on
-  argv, in logs, or in error messages. Exactly one of the three may be
-  given. Without a terminal and without any of the three, this errors
-  naming all three. See "Supplying credentials safely" in the docs:
-  docs/mcp/codex-profiles.md#supplying-credentials-safely
+  argv, in logs, or in error messages. Use --api-key-store <name> for a named
+  OS-store entry, or --api-key-interactive for hidden terminal entry. Give
+  sources in preference order; a missing source without a terminal errors naming the options.
+  See docs/cli/sensitive-values.md for exposure details and manager examples.
 `);
 }
 
@@ -1419,59 +1505,18 @@ async function handleProfileInitPresets() {
   }
 }
 
-/**
- * Read all of stdin and return it as one trimmed string (go/no-go review,
- * blocker 1C's `--api-key-stdin`). Mirrors `src/cli/handlers/decision.ts`'s
- * own private `readStdin()` + `.trim()` for `--token-stdin` — duplicated
- * rather than imported for the same source/dist reason documented on
- * `requireFlagValue` above (this file runs both compiled and directly from
- * source). Input is expected to be a single line; a value containing
- * additional lines is not specially rejected, matching that precedent.
- */
-async function readStdinAll() {
-  const chunks = [];
-  for await (const chunk of process.stdin) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
-  return Buffer.concat(chunks).toString('utf8');
-}
-
-/**
- * Handle `aiwg mcp profile login <name> [--api-key-env <ENV_VAR_NAME> |
- * --api-key-stdin | --api-key-file <path>]` (#3062, #3069, go/no-go review
- * blocker 1C).
- *
- * Wires `loginInProfile()` (src/mcp/adapters/codex-runtime.ts), which
- * already implements the full headless-safe behavior this command needs:
- * with a terminal attached and none of the three given, it runs the
- * interactive `codex login` OAuth flow. Exactly one credential source may
- * be given; more than one is a usage error naming the flags given. In
- * every case the key reaches `loginInProfile()` only as an in-memory value
- * (or, for `--api-key-env`, a variable *name*) — never on argv, in logs, or
- * in an error message — and travels to `codex` only on its stdin (see
- * `spawnCodexLoginWithApiKey()`'s own doc comment). Without a terminal and
- * without any of the three, `loginInProfile()` itself refuses, naming all
- * three flags.
- *
- * `--api-key-env` reads the key from that named environment variable, as
- * before. `--api-key-stdin` reads one line from this process's own stdin
- * (refusing if stdin is a terminal, or if it is empty) — the least
- * observable source, since the key then never exists in any environment or
- * on any command line. `--api-key-file <path>` reads the key from a file
- * that `readApiKeyFromFile()` requires to be a non-symlink, single-hard-
- * link, regular file owned by the current user with no group/other
- * permission bits on POSIX — refused otherwise, without ever printing the
- * path's contents. `--api-key-env` remains the least preferred of the
- * three (see "Supplying credentials safely" in the docs): the named
- * variable is visible to every other child process this shell starts.
- */
+/** Standard sensitive input; the Codex adapter still receives only an in-memory key. */
 async function handleProfileLogin(args) {
   let apiKeyEnv;
   let apiKeyFilePath;
+  let apiKeyStore;
   try {
     // rejectEmpty: an explicitly-given-but-empty variable name/path can
     // never name a real environment variable or file (#3062 second review,
     // finding 4; go/no-go review blocker 1C).
     apiKeyEnv = requireFlagValue(args, { rejectEmpty: true }, '--api-key-env');
     apiKeyFilePath = requireFlagValue(args, { rejectEmpty: true }, '--api-key-file');
+    apiKeyStore = requireFlagValue(args, { rejectEmpty: true }, '--api-key-store');
   } catch (err) {
     if (err instanceof MissingFlagValueError) {
       console.error(`${err.message}.`);
@@ -1481,16 +1526,6 @@ async function handleProfileLogin(args) {
   }
   const useStdin = args.includes('--api-key-stdin');
 
-  const sourcesGiven = [
-    apiKeyEnv !== undefined ? '--api-key-env' : null,
-    useStdin ? '--api-key-stdin' : null,
-    apiKeyFilePath !== undefined ? '--api-key-file' : null,
-  ].filter(Boolean);
-  if (sourcesGiven.length > 1) {
-    console.error(`Only one credential source may be given; got ${sourcesGiven.join(', ')}.`);
-    process.exit(2);
-  }
-
   // Skip --api-key-env's/--api-key-file's own value when hunting for the
   // positional profile name, so e.g. `login --api-key-env FOO` (missing
   // name) never misreads FOO as the name (mirrors this file's own
@@ -1500,46 +1535,24 @@ async function handleProfileLogin(args) {
   for (let i = 0; i < args.length; i += 1) {
     const token = args[i];
     if (token === '--') break;
-    if (token === '--api-key-env' || token === '--api-key-file') { i += 1; continue; }
+    if (token === '--api-key-env' || token === '--api-key-file' || token === '--api-key-store') { i += 1; continue; }
     if (!token.startsWith('--')) positional.push(token);
   }
   const name = positional[0];
   if (!name) {
-    console.error('Usage: aiwg mcp profile login <name> [--api-key-env <ENV_VAR_NAME> | --api-key-stdin | --api-key-file <path>]');
+    console.error('Usage: aiwg mcp profile login <name> [--api-key-interactive | --api-key-stdin | --api-key-file <path> | --api-key-store <name> | --api-key-env <ENV_VAR_NAME>]');
     process.exit(1);
   }
 
-  let apiKey;
-  if (useStdin) {
-    if (process.stdin.isTTY) {
-      console.error(
-        '--api-key-stdin requires piped input, not a terminal; run ' +
-        `\`aiwg mcp profile login ${name}\` with no credential flag for the interactive login instead.`,
-      );
-      process.exit(2);
-    }
-    apiKey = (await readStdinAll()).trim();
-    if (!apiKey) {
-      console.error('--api-key-stdin received no key (stdin was empty).');
-      process.exit(2);
-    }
-  } else if (apiKeyFilePath !== undefined) {
-    const { readApiKeyFromFile } = await loadCodexRuntimeAdapter();
-    try {
-      apiKey = await readApiKeyFromFile(apiKeyFilePath);
-    } catch (err) {
-      console.error(err instanceof Error ? err.message : String(err));
-      process.exit(2);
-    }
-    if (!apiKey) {
-      console.error(`--api-key-file "${apiKeyFilePath}" is empty.`);
-      process.exit(2);
-    }
-  }
-
   try {
+    await loadCodexRuntimeAdapter();
+    const { resolveSensitiveInput } = await import(pathToFileURL(path.join(findOwnPackageRoot(), 'dist', 'src', 'auth', 'sensitive-input.js')).href);
+    const apiKey = await resolveSensitiveInput({
+      prefix: 'api-key', stdin: useStdin, file: apiKeyFilePath, store: apiKeyStore,
+      env: apiKeyEnv, interactive: args.includes('--api-key-interactive'),
+    });
     const { loginInProfile } = await loadCodexRuntimeAdapter();
-    const loginOptions = apiKey !== undefined ? { apiKey } : apiKeyEnv ? { apiKeyEnv } : {};
+    const loginOptions = { apiKey };
     await loginInProfile(name, loginOptions);
     console.log(`\nLogged in to profile "${name}".`);
   } catch (err) {

package/dist/src/mcp/credentials.d.mts

@@ -21,6 +21,10 @@ export function isCredentialReferenceValue(value: unknown): boolean;
 export function credentialLikeArgs(args?: string[], options?: { includeReferences?: boolean }): string[];
 export function redactCredentialArgs(args?: string[]): string[] | undefined;
 export function validateEnvReferenceName(name: string): void;
+export function credentialReferenceInput(reference: string, flag?: string): { env?: string; file?: string; store?: string };
+export function validateCredentialReferences(server: Pick<CredentialBearingServer, 'headerEnv' | 'envFrom'>): void;
+export function assertEnvironmentCredentialReferences(server: CredentialBearingServer, provider: string): void;
+export function hasSecretLookingLiterals(server: CredentialBearingServer): boolean;
 export function renderCredentialMaps(
   server: CredentialBearingServer,
   provider: string,

package/dist/src/mcp/credentials.mjs

@@ -3,9 +3,9 @@
  *
  * A registry entry carries credentials in two ways:
  *   - literal values in `env` / `headers` (and OMP `auth` / `oauth` secrets)
- *   - references: `headerEnv` (header -> variable) and `envFrom`
- *     (server variable -> variable), which name a variable the harness
- *     resolves when it starts the server. Only the variable name is written.
+ *   - references: `headerEnv` and `envFrom` name a variable the harness
+ *     resolves, or a file:/store: locator resolved only by AIWG's runtime
+ *     client. Only the locator is written.
  *
  * Each harness spells a reference differently; ENV_REFERENCE_SYNTAX holds the
  * documented form. `null` means the harness documents no interpolation in its
@@ -48,6 +48,39 @@ export function validateEnvReferenceName(name) {
   }
 }
 
+/** Durable locators only: the CLI saves ephemeral stdin/terminal input to the named store. */
+export function credentialReferenceInput(reference, flag = '--env-from/--header-env') {
+  if (typeof reference === 'string') {
+    if (ENV_REFERENCE_NAME.test(reference)) return { env: reference };
+    if (/^store:[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(reference)) return { store: reference.slice(6) };
+    // Absolute paths keep resolution independent of the consuming process's cwd.
+    if (/^file:(?:\/|[A-Za-z]:[\\/])[^\u0000-\u001f\u007f]+$/.test(reference)) return { file: reference.slice(5) };
+  }
+  throw new Error(`${flag} requires KEY=ENV_NAME, KEY=file:ABSOLUTE_PATH, or KEY=store:NAME.`);
+}
+
+export function validateCredentialReferences(server) {
+  for (const [field, flag] of [['headerEnv', '--header-env'], ['envFrom', '--env-from']]) {
+    for (const [key, reference] of Object.entries(server[field] || {})) {
+      if (field === 'headerEnv' ? !key.trim() : !ENV_REFERENCE_NAME.test(key)) {
+        throw new Error(`${flag} requires a valid ${field === 'headerEnv' ? 'header' : 'variable'} name.`);
+      }
+      credentialReferenceInput(reference, flag);
+    }
+  }
+}
+
+/** Native provider configs cannot call AIWG's private-file/native-store resolver. */
+export function assertEnvironmentCredentialReferences(server, provider) {
+  for (const [field, flag] of [['envFrom', '--env-from'], ['headerEnv', '--header-env']]) {
+    for (const reference of Object.values(server[field] || {})) {
+      if (!credentialReferenceInput(reference, flag).env) {
+        throw new Error(`${provider} cannot resolve MCP file/store references. Use ${flag} KEY=ENV_NAME for provider configs; file/store references require the AIWG runtime client.`);
+      }
+    }
+  }
+}
+
 function hasEntries(value) {
   return value !== null && typeof value === 'object' && Object.keys(value).length > 0;
 }
@@ -62,6 +95,7 @@ function hasReferences(server) {
  * harness has no documented syntax for them.
  */
 export function renderCredentialMaps(server, provider) {
+  assertEnvironmentCredentialReferences(server, provider);
   const env = server.env ? { ...server.env } : undefined;
   const headers = server.headers ? { ...server.headers } : undefined;
   if (!hasReferences(server)) return { env, headers };
@@ -116,6 +150,13 @@ function credentialName(key) {
       || CREDENTIAL_QUERY_NAME.test(part.replace(/[_\s]+/g, '-'))));
 }
 
+/** Reuse policy scanner/name rules for the compatibility CLI warning. Never returns values. */
+export function hasSecretLookingLiterals(server) {
+  return ['env', 'headers'].some(field => Object.entries(server[field] || {}).some(([key, value]) =>
+    typeof value === 'string' && literalValue(value, false)
+      && (credentialName(key) || /^(?:cookie|set-cookie)$/i.test(key) || scanCredentialText(value).some(hit => hit.credential))));
+}
+
 function literalValue(value, includeReferences) {
   return value !== '' && (includeReferences || !isCredentialReferenceValue(value));
 }