@aiwg/cli 2026.10.7 → 2026.10.9

package/dist/src/mcp/cli.mjs

@@ -29,7 +29,7 @@ import {
   prepareClaudePermissions,
   resolveToolFilters,
 } from './tool-filters.mjs';
-import { assertCredentialPolicy, CREDENTIAL_POLICIES, installPolicyCheckedServer, redactCredentialArgs, redactCredentialText, redactCredentialRecord, resolveCredentialPolicy } from './credentials.mjs';
+import { assertCredentialPolicy, CREDENTIAL_POLICIES, credentialReferenceInput, validateCredentialReferences, hasSecretLookingLiterals, installPolicyCheckedServer, redactCredentialArgs, redactCredentialText, redactCredentialRecord, resolveCredentialPolicy } from './credentials.mjs';
 import { getMcpInjectionDefinition } from '../providers/provider-definitions.mjs';
 import { manageOmpMcp } from './omp-config.mjs';
 import { claudeDesktopConfigPath, resolveClaudeInstallTarget, legacyClaudeMigration } from './claude-install.mjs';
@@ -176,13 +176,15 @@ Server Options (for add/update):
   --url <url>          Server URL (for http/sse types)
   --type <type>        Server type: http (default), stdio, sse
   --command <cmd>      Command to run (for stdio type)
-  --args <a1,a2,...>   Command arguments (comma-separated, for stdio)
+  --args <a1,a2,...>   Literal command arguments (visible on argv; prefer env/header references)
   --env <K=V,...>      Environment variables (comma-separated K=V pairs)
   --headers <K=V,...>  HTTP headers (comma-separated K=V pairs)
-  --header-env <K=ENV,...>
-                       Resolve HTTP header values from environment variables
-  --env-from <K=ENV,...>
-                       Resolve stdio server variables from environment variables
+  --header-env <K=SOURCE,...>
+                       HTTP header references: ENV_NAME, file:ABSOLUTE_PATH, store:NAME
+  --env-from <K=SOURCE,...>
+                       Stdio variable references (same sources; repeatable)
+                       File/store require the AIWG runtime client; native configs use ENV_NAME
+                       stdin:STORE_NAME / interactive:STORE_NAME save one value to the OS store
   --description <text> Optional description
 
 Inject Options:
@@ -701,6 +703,83 @@ function parseKVPairs(str) {
   return Object.keys(result).length > 0 ? result : undefined;
 }
 
+function parseHeaderPairs(str) {
+  if (!str) return undefined;
+  const entries = str.split(',').flatMap(pair => {
+    const delimiter = pair.search(/[=:]/);
+    return delimiter < 0 ? [] : [[pair.slice(0, delimiter).trim(), pair.slice(delimiter + 1).trim()]];
+  });
+  return entries.length ? Object.fromEntries(entries) : undefined;
+}
+
+/** Validate every occurrence, retaining the existing comma-separated spelling. */
+function parseCredentialReferences(args, flag) {
+  let result;
+  for (let index = 0; index < args.length; index++) {
+    const token = args[index];
+    if (token === '--') break;
+    if (token !== flag && !token.startsWith(`${flag}=`)) continue;
+    const value = token === flag ? args[++index] : token.slice(flag.length + 1);
+    if (!value || value.startsWith('--')) throw new Error(`${flag} requires KEY=ENV_NAME, KEY=file:ABSOLUTE_PATH, or KEY=store:NAME.`);
+    for (const pair of value.split(',')) {
+      const equals = pair.indexOf('=');
+      const key = pair.slice(0, equals).trim();
+      if (equals < 1 || !key) throw new Error(`${flag} requires KEY=ENV_NAME, KEY=file:ABSOLUTE_PATH, or KEY=store:NAME.`);
+      const reference = pair.slice(equals + 1).trim();
+      credentialReferenceInput(reference.replace(/^(?:stdin|interactive):/, 'store:'), flag);
+      result = { ...result, [key]: reference };
+    }
+  }
+  return result;
+}
+
+/** Transient input is saved by the existing raw-value store; registry receives only its name. */
+export async function persistCredentialInputs(server, dependencies) {
+  const inputs = [];
+  for (const field of ['envFrom', 'headerEnv']) {
+    for (const [key, reference] of Object.entries(server[field] || {})) {
+      const match = /^(stdin|interactive):(.+)$/.exec(reference);
+      if (match) {
+        credentialReferenceInput(`store:${match[2]}`, field === 'envFrom' ? '--env-from' : '--header-env');
+        inputs.push({ field, key, source: match[1], name: match[2] });
+      }
+    }
+  }
+  if (inputs.filter(input => input.source === 'stdin').length > 1) {
+    throw new Error('Only one --env-from/--header-env value may use stdin:STORE_NAME per invocation; use file:PATH or store:NAME for additional values.');
+  }
+  const persistent = Object.fromEntries(['envFrom', 'headerEnv'].map(field => [field,
+    Object.fromEntries(Object.entries(server[field] || {}).map(([key, reference]) => [key, reference.replace(/^(?:stdin|interactive):/, 'store:')]))]));
+  validateCredentialReferences(persistent);
+  if (!inputs.length) return;
+  const { resolveSensitiveInput, namedSensitiveStore } = dependencies
+    ?? await import(pathToFileURL(path.join(findOwnPackageRoot(), 'dist', 'src', 'auth', 'sensitive-input.js')).href);
+  // Read/validate all requested inputs before changing the store.
+  const pending = [];
+  for (const input of inputs) {
+    try {
+      const value = await resolveSensitiveInput({ prefix: 'value', [input.source]: true });
+      pending.push({ ...input, value });
+    } catch (error) {
+      const flag = input.field === 'envFrom' ? '--env-from' : '--header-env';
+      const message = error instanceof Error ? error.message : 'MCP credential input failed';
+      throw new Error(message.replace(/--value-(interactive|stdin|file|store|env)(?: <(?:path|name)>)?/g, (_, source) =>
+        `${flag} KEY=${['interactive', 'stdin'].includes(source) ? `${source}:STORE_NAME` : source === 'env' ? 'ENV_NAME' : source === 'file' ? 'file:ABSOLUTE_PATH' : 'store:NAME'}`));
+    }
+  }
+  for (const { field, key, name, value } of pending) {
+    try { await namedSensitiveStore(name).saveSecret(value); }
+    catch { throw new Error('MCP credential input could not be saved to the native store; use --env-from/--header-env with file:PATH or ENV_NAME instead.'); }
+    server[field][key] = `store:${name}`;
+  }
+}
+
+function warnLiteralCredentials(server) {
+  if (hasSecretLookingLiterals(server)) {
+    console.error('Warning: secret-bearing --env/--headers literals are deprecated; argv and saved config expose their values. Use --env-from/--header-env references. See docs/cli/sensitive-values.md.');
+  }
+}
+
 /**
  * Handle `aiwg mcp add <name> [opts]`
  */
@@ -718,8 +797,8 @@ async function handleAdd(args) {
   const argsStr = parseFlag(args, '--args');
   const envStr = parseFlag(args, '--env');
   const headersStr = parseFlag(args, '--headers');
-  const headerEnvStr = parseFlag(args, '--header-env');
-  const envFromStr = parseFlag(args, '--env-from');
+  const headerEnv = parseCredentialReferences(args, '--header-env');
+  const envFrom = parseCredentialReferences(args, '--env-from');
   const description = parseFlag(args, '--description');
 
   if (type === 'stdio' && !command) {
@@ -732,24 +811,28 @@ async function handleAdd(args) {
   }
 
   const registry = new McpServerRegistry();
-  await registry.add({
+  const definition = {
     name,
     type,
     url,
     command,
     args: argsStr ? argsStr.split(',') : undefined,
     env: parseKVPairs(envStr),
-    headers: parseKVPairs(headersStr),
-    headerEnv: parseKVPairs(headerEnvStr),
-    envFrom: parseKVPairs(envFromStr),
+    headers: parseHeaderPairs(headersStr),
+    headerEnv,
+    envFrom,
     description,
-  });
+  };
+  warnLiteralCredentials(definition);
+  if ([...Object.values(definition.envFrom || {}), ...Object.values(definition.headerEnv || {})].some(ref => /^(?:stdin|interactive):/.test(ref)) && await registry.get(name)) throw new Error(`MCP server "${name}" already exists`);
+  await persistCredentialInputs(definition);
+  await registry.add(definition);
 
   console.log(`Added MCP server: ${name}`);
   if (url) console.log(`  URL: ${redactUrlUserinfo(url)}`);
   if (command) console.log(`  Command: ${redactCredentialText(command)}`);
   console.log(`  Type: ${type}`);
-  for (const [key, values] of [['env', parseKVPairs(envStr)], ['headers', parseKVPairs(headersStr)]]) {
+  for (const [key, values] of [['env', definition.env], ['headers', definition.headers]]) {
     if (values) console.log(`  ${key}: ${Object.keys(values).join(', ')}`);
   }
   console.log(`\nUse "aiwg mcp inject --provider <name>" to inject into a provider config.`);
@@ -790,8 +873,8 @@ async function handleUpdate(args) {
   const argsStr = parseFlag(args, '--args');
   const envStr = parseFlag(args, '--env');
   const headersStr = parseFlag(args, '--headers');
-  const headerEnvStr = parseFlag(args, '--header-env');
-  const envFromStr = parseFlag(args, '--env-from');
+  const headerEnv = parseCredentialReferences(args, '--header-env');
+  const envFrom = parseCredentialReferences(args, '--env-from');
   const description = parseFlag(args, '--description');
 
   if (url !== undefined) updates.url = url;
@@ -799,9 +882,9 @@ async function handleUpdate(args) {
   if (command !== undefined) updates.command = command;
   if (argsStr !== undefined) updates.args = argsStr.split(',');
   if (envStr !== undefined) updates.env = parseKVPairs(envStr);
-  if (headersStr !== undefined) updates.headers = parseKVPairs(headersStr);
-  if (headerEnvStr !== undefined) updates.headerEnv = parseKVPairs(headerEnvStr);
-  if (envFromStr !== undefined) updates.envFrom = parseKVPairs(envFromStr);
+  if (headersStr !== undefined) updates.headers = parseHeaderPairs(headersStr);
+  if (headerEnv !== undefined) updates.headerEnv = headerEnv;
+  if (envFrom !== undefined) updates.envFrom = envFrom;
   if (description !== undefined) updates.description = description;
 
   if (Object.keys(updates).length === 0) {
@@ -810,6 +893,9 @@ async function handleUpdate(args) {
   }
 
   const registry = new McpServerRegistry();
+  warnLiteralCredentials(updates);
+  if ([...Object.values(updates.envFrom || {}), ...Object.values(updates.headerEnv || {})].some(ref => /^(?:stdin|interactive):/.test(ref)) && !(await registry.get(name))) throw new Error(`MCP server "${name}" not found`);
+  await persistCredentialInputs(updates);
   await registry.update(name, updates);
   console.log(`Updated MCP server: ${name}`);
   for (const [key, value] of Object.entries(updates)) {

package/dist/src/mcp/credentials.d.mts

@@ -21,6 +21,10 @@ export function isCredentialReferenceValue(value: unknown): boolean;
 export function credentialLikeArgs(args?: string[], options?: { includeReferences?: boolean }): string[];
 export function redactCredentialArgs(args?: string[]): string[] | undefined;
 export function validateEnvReferenceName(name: string): void;
+export function credentialReferenceInput(reference: string, flag?: string): { env?: string; file?: string; store?: string };
+export function validateCredentialReferences(server: Pick<CredentialBearingServer, 'headerEnv' | 'envFrom'>): void;
+export function assertEnvironmentCredentialReferences(server: CredentialBearingServer, provider: string): void;
+export function hasSecretLookingLiterals(server: CredentialBearingServer): boolean;
 export function renderCredentialMaps(
   server: CredentialBearingServer,
   provider: string,

package/dist/src/mcp/credentials.mjs

@@ -3,9 +3,9 @@
  *
  * A registry entry carries credentials in two ways:
  *   - literal values in `env` / `headers` (and OMP `auth` / `oauth` secrets)
- *   - references: `headerEnv` (header -> variable) and `envFrom`
- *     (server variable -> variable), which name a variable the harness
- *     resolves when it starts the server. Only the variable name is written.
+ *   - references: `headerEnv` and `envFrom` name a variable the harness
+ *     resolves, or a file:/store: locator resolved only by AIWG's runtime
+ *     client. Only the locator is written.
  *
  * Each harness spells a reference differently; ENV_REFERENCE_SYNTAX holds the
  * documented form. `null` means the harness documents no interpolation in its
@@ -48,6 +48,39 @@ export function validateEnvReferenceName(name) {
   }
 }
 
+/** Durable locators only: the CLI saves ephemeral stdin/terminal input to the named store. */
+export function credentialReferenceInput(reference, flag = '--env-from/--header-env') {
+  if (typeof reference === 'string') {
+    if (ENV_REFERENCE_NAME.test(reference)) return { env: reference };
+    if (/^store:[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(reference)) return { store: reference.slice(6) };
+    // Absolute paths keep resolution independent of the consuming process's cwd.
+    if (/^file:(?:\/|[A-Za-z]:[\\/])[^\u0000-\u001f\u007f]+$/.test(reference)) return { file: reference.slice(5) };
+  }
+  throw new Error(`${flag} requires KEY=ENV_NAME, KEY=file:ABSOLUTE_PATH, or KEY=store:NAME.`);
+}
+
+export function validateCredentialReferences(server) {
+  for (const [field, flag] of [['headerEnv', '--header-env'], ['envFrom', '--env-from']]) {
+    for (const [key, reference] of Object.entries(server[field] || {})) {
+      if (field === 'headerEnv' ? !key.trim() : !ENV_REFERENCE_NAME.test(key)) {
+        throw new Error(`${flag} requires a valid ${field === 'headerEnv' ? 'header' : 'variable'} name.`);
+      }
+      credentialReferenceInput(reference, flag);
+    }
+  }
+}
+
+/** Native provider configs cannot call AIWG's private-file/native-store resolver. */
+export function assertEnvironmentCredentialReferences(server, provider) {
+  for (const [field, flag] of [['envFrom', '--env-from'], ['headerEnv', '--header-env']]) {
+    for (const reference of Object.values(server[field] || {})) {
+      if (!credentialReferenceInput(reference, flag).env) {
+        throw new Error(`${provider} cannot resolve MCP file/store references. Use ${flag} KEY=ENV_NAME for provider configs; file/store references require the AIWG runtime client.`);
+      }
+    }
+  }
+}
+
 function hasEntries(value) {
   return value !== null && typeof value === 'object' && Object.keys(value).length > 0;
 }
@@ -62,6 +95,7 @@ function hasReferences(server) {
  * harness has no documented syntax for them.
  */
 export function renderCredentialMaps(server, provider) {
+  assertEnvironmentCredentialReferences(server, provider);
   const env = server.env ? { ...server.env } : undefined;
   const headers = server.headers ? { ...server.headers } : undefined;
   if (!hasReferences(server)) return { env, headers };
@@ -116,6 +150,13 @@ function credentialName(key) {
       || CREDENTIAL_QUERY_NAME.test(part.replace(/[_\s]+/g, '-'))));
 }
 
+/** Reuse policy scanner/name rules for the compatibility CLI warning. Never returns values. */
+export function hasSecretLookingLiterals(server) {
+  return ['env', 'headers'].some(field => Object.entries(server[field] || {}).some(([key, value]) =>
+    typeof value === 'string' && literalValue(value, false)
+      && (credentialName(key) || /^(?:cookie|set-cookie)$/i.test(key) || scanCredentialText(value).some(hit => hit.credential))));
+}
+
 function literalValue(value, includeReferences) {
   return value !== '' && (includeReferences || !isCredentialReferenceValue(value));
 }

package/dist/src/mcp/grok-build-config.mjs

@@ -1,3 +1,4 @@
+import { assertEnvironmentCredentialReferences } from './credentials.mjs';
 import { writeConfigAtomic } from './config-file.mjs';
 import { constants } from 'node:fs';
 import { access, lstat, readFile } from 'node:fs/promises';
@@ -20,6 +21,7 @@ function inline(values = {}) {
 }
 
 export function renderGrokMcpServer(server) {
+  assertEnvironmentCredentialReferences(server, 'grok-build');
   if (!server?.name) throw new Error('Grok MCP server name is required');
   const lines = [`[mcp_servers.${key(server.name)}]`];
   if (server.type === 'stdio') {

package/dist/src/mcp/omp-config.mjs

@@ -1,3 +1,4 @@
+import { assertEnvironmentCredentialReferences } from './credentials.mjs';
 import { assertConfigDestination, assertNoSymlinkParents, writeConfigAtomic } from './config-file.mjs';
 import { readFile, mkdir, lstat, unlink, open } from 'node:fs/promises';
 import { dirname, parse, resolve } from 'node:path';
@@ -50,6 +51,7 @@ async function atomic(file, data, options) {
 }
 
 export function ompServerConfig(server) {
+  assertEnvironmentCredentialReferences(server, 'omp');
   const config = {};
   for (const field of ['command', 'args', 'env', 'cwd', 'url', 'headers', 'enabled', 'timeout', 'requestIdFormat', 'auth', 'oauth', 'type']) {
     if (server[field] !== undefined) config[field] = server[field];

package/dist/src/mcp/registry.js

@@ -7,7 +7,7 @@ import { manageGrokBuildMcp } from './grok-build-config.mjs';
 import { replaceServer } from './toml-editor.mjs';
 import { resolveOmpPaths } from '../providers/omp-paths.mjs';
 import { applyJsonToolFilterPlan, claudeSettingsPath, prepareClaudePermissions, planToolFilters } from './tool-filters.mjs';
-import { assertCredentialPolicy, resolveCredentialPolicy, validateEnvReferenceName } from './credentials.mjs';
+import { assertCredentialPolicy, resolveCredentialPolicy, validateEnvReferenceName, credentialReferenceInput, validateCredentialReferences, assertEnvironmentCredentialReferences } from './credentials.mjs';
 /**
  * MCP Server Registry
  *
@@ -23,6 +23,7 @@ import { qualifyWorkerInvocationProfile, requiredWorkerControls } from '../model
 import { dirname, isAbsolute, resolve } from 'path';
 import { homedir } from 'os';
 import { resolveConfigDir } from '../config/user-config.js';
+import { resolveSensitiveInput } from '../auth/sensitive-input.js';
 // ============================================
 // Registry
 // ============================================
@@ -32,22 +33,24 @@ const DEFAULT_REGISTRY = {
     kind: 'McpServerRegistry',
     servers: {},
 };
-const ENV_REFERENCE_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
-function validateCredentialReferences(def) {
-    for (const [header, envName] of Object.entries(def.headerEnv ?? {})) {
-        if (!header.trim())
-            throw new Error('MCP header-env header name must not be empty');
-        if (!ENV_REFERENCE_NAME.test(envName)) {
-            throw new Error(`Invalid MCP header environment variable reference "${envName}"`);
-        }
-    }
-    for (const [key, envName] of Object.entries(def.envFrom ?? {})) {
-        if (!ENV_REFERENCE_NAME.test(key))
-            throw new Error(`Invalid MCP env-from variable name "${key}"`);
-        if (!ENV_REFERENCE_NAME.test(envName)) {
-            throw new Error(`Invalid MCP env-from environment variable reference "${envName}"`);
+/** Resolve references only for AIWG's in-memory transport, never for a config writer. */
+export async function resolveMcpCredentialMaps(server, dependencies = {}) {
+    const result = { env: server.env ? { ...server.env } : undefined, headers: server.headers ? { ...server.headers } : undefined };
+    for (const [field, target, flag] of [['envFrom', 'env', '--env-from'], ['headerEnv', 'headers', '--header-env']]) {
+        for (const [key, reference] of Object.entries(server[field] ?? {})) {
+            const input = credentialReferenceInput(reference, flag);
+            // Explicit locators prevent terminal prompts and implicit stdin consumption.
+            try {
+                const value = await resolveSensitiveInput({ ...input, prefix: 'value' }, dependencies);
+                result[target] = { ...result[target], [key]: value };
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : 'MCP credential input failed';
+                throw new Error(message.replace(/--value-(file|store|env)/g, (_, source) => `${flag} KEY=${source === 'env' ? 'ENV_NAME' : source === 'file' ? 'file:ABSOLUTE_PATH' : 'store:NAME'}`));
+            }
         }
     }
+    return result;
 }
 export function workerServerDigest(server) {
     const { workerQualification, description, injectedProviders, addedAt, updatedAt, ...execution } = server;
@@ -300,6 +303,7 @@ function tomlInlineTable(values) {
     return `{ ${Object.entries(values).map(([name, value]) => `${tomlKey(name)} = ${tomlString(value)}`).join(', ')} }`;
 }
 export function buildServerToml(server) {
+    assertEnvironmentCredentialReferences(server, 'codex');
     const lines = [];
     lines.push(`[mcp_servers.${tomlKey(server.name)}]`);
     if (server.type === 'stdio') {

package/dist/src/mcp/registry.mjs

@@ -8,7 +8,7 @@ import { manageGrokBuildMcp } from './grok-build-config.mjs';
 import { replaceServer } from './toml-editor.mjs';
 import { resolveOmpPaths } from '../providers/omp-paths.mjs';
 import { applyJsonToolFilterPlan, claudeSettingsPath, prepareClaudePermissions, planToolFilters } from './tool-filters.mjs';
-import { assertCredentialPolicy, resolveCredentialPolicy, validateEnvReferenceName } from './credentials.mjs';
+import { assertCredentialPolicy, resolveCredentialPolicy, validateEnvReferenceName, validateCredentialReferences, assertEnvironmentCredentialReferences } from './credentials.mjs';
 /**
  * MCP Server Registry (Runtime ESM)
  *
@@ -72,23 +72,6 @@ const DEFAULT_REGISTRY = {
   servers: {},
 };
 
-const ENV_REFERENCE_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
-
-function validateCredentialReferences(def) {
-  for (const [header, envName] of Object.entries(def.headerEnv || {})) {
-    if (!header.trim()) throw new Error('MCP header-env header name must not be empty');
-    if (!ENV_REFERENCE_NAME.test(envName)) {
-      throw new Error(`Invalid MCP header environment variable reference "${envName}"`);
-    }
-  }
-  for (const [key, envName] of Object.entries(def.envFrom || {})) {
-    if (!ENV_REFERENCE_NAME.test(key)) throw new Error(`Invalid MCP env-from variable name "${key}"`);
-    if (!ENV_REFERENCE_NAME.test(envName)) {
-      throw new Error(`Invalid MCP env-from environment variable reference "${envName}"`);
-    }
-  }
-}
-
 // The typed worker dispatch boundary owns qualification. Legacy runtime edits
 // invalidate its binding without importing the TypeScript policy owner.
 export function workerServerDigest(server) {
@@ -280,6 +263,7 @@ function tomlInlineTable(values) {
 }
 
 export function buildServerToml(server) {
+  assertEnvironmentCredentialReferences(server, 'codex');
   const lines = [];
   lines.push(`[mcp_servers.${tomlKey(server.name)}]`);
 

package/dist/src/mcp/tools/agentic-sandbox.mjs

@@ -1,14 +1,14 @@
 /**
  * Governed Agentic Sandbox fleet and activity MCP surface.
  *
- * Credentials are file-backed server configuration, never tool arguments.
+ * Credentials are private-file or native-store configuration, never tool arguments.
  * Every tool in this module uses the management bearer domain; executor-plane
  * credentials are deliberately out of scope and cannot be substituted.
  *
  * @implements #2015
  */
 
-import { readFile, stat } from 'node:fs/promises';
+import { access } from 'node:fs/promises';
 import { z } from 'zod';
 import { integer, dateTime } from '../../schema/zod-validation.mjs';
 import { assertNoWorkerBinding, mcpError, mcpJson } from '../helpers.mjs';
@@ -36,17 +36,27 @@ function configuredBaseUrl(env = process.env) {
   return url.toString().replace(/\/$/, '');
 }
 
-async function managementBearer(env = process.env) {
+async function sensitiveInputModule() {
+  // Source MCP modules and the published dist tree share the compiled owner.
+  for (const location of [new URL('../../auth/sensitive-input.js', import.meta.url), new URL('../../../dist/src/auth/sensitive-input.js', import.meta.url)]) {
+    try { await access(location); } catch { continue; }
+    return import(location.href);
+  }
+  throw new Error('Sandbox credentials require the compiled AIWG auth module, which this installation is missing. Run `aiwg doctor` to repair the installation.');
+}
+
+async function managementBearer(env = process.env, readStore) {
   const tokenFile = String(env.AIWG_SANDBOX_MANAGEMENT_TOKEN_FILE ?? '').trim();
-  if (!tokenFile) throw new Error('AIWG_SANDBOX_MANAGEMENT_TOKEN_FILE is required for the sandbox toolset');
-  const metadata = await stat(tokenFile);
-  if (!metadata.isFile()) throw new Error('sandbox management token path is not a regular file');
-  if (process.platform !== 'win32' && (metadata.mode & 0o077) !== 0) {
-    throw new Error('sandbox management token file must not be accessible by group or other users');
+  const tokenStore = String(env.AIWG_SANDBOX_MANAGEMENT_TOKEN_STORE ?? '').trim();
+  if (!tokenFile && !tokenStore) {
+    throw new Error('Sandbox management bearer requires AIWG_SANDBOX_MANAGEMENT_TOKEN_FILE or AIWG_SANDBOX_MANAGEMENT_TOKEN_STORE.');
   }
-  const token = String(await readFile(tokenFile, 'utf8')).trim();
-  if (!token || /[\r\n]/.test(token)) throw new Error('sandbox management token file must contain one non-empty bearer token');
-  return token;
+  const { readPrivateValueFile, resolveSensitiveInput } = await sensitiveInputModule();
+  return resolveSensitiveInput(tokenFile ? { prefix: 'token', file: tokenFile } : { prefix: 'token', store: tokenStore }, {
+    isTTY: false,
+    readFile: (pathname) => readPrivateValueFile(pathname, 'AIWG_SANDBOX_MANAGEMENT_TOKEN_FILE'),
+    ...(readStore ? { readStore } : {}),
+  });
 }
 
 function containsRestricted(value) {
@@ -138,32 +148,40 @@ function typedResult(body, status, validate) {
 }
 
 export class AgenticSandboxMcpClient {
-  constructor({ env = process.env, fetch = globalThis.fetch.bind(globalThis) } = {}) {
+  constructor({ env = process.env, fetch = globalThis.fetch.bind(globalThis), readStore } = {}) {
     this.env = env;
     this.fetch = fetch;
+    this.readStore = readStore;
   }
 
   async request(path, { method = 'GET', body, headers = {}, validate = (value) => safeResponse(value) } = {}) {
     assertNoWorkerBinding(body, 'mcp');
     const baseUrl = configuredBaseUrl(this.env);
-    const token = await managementBearer(this.env);
-    const response = await this.fetch(`${baseUrl}${path}`, {
-      method,
-      headers: { accept: 'application/json', authorization: `Bearer ${token}`, ...(body === undefined ? {} : { 'content-type': 'application/json' }), ...headers },
-      ...(body === undefined ? {} : { body: JSON.stringify(body) }),
-    });
-    let parsed;
-    try {
-      parsed = await response.json();
-    } catch {
-      if (response.status === 404 || response.status === 405) parsed = {};
-      else return mcpError(`sandbox returned non-JSON HTTP ${response.status}`);
-    }
+    const token = await managementBearer(this.env, this.readStore);
+    const redact = (text) => String(text).split(token).join('[REDACTED]');
     try {
-      assertNoWorkerBinding(parsed, 'mcp');
-      return typedResult(parsed, response.status, validate);
+      const response = await this.fetch(`${baseUrl}${path}`, {
+        method,
+        headers: { accept: 'application/json', authorization: `Bearer ${token}`, ...(body === undefined ? {} : { 'content-type': 'application/json' }), ...headers },
+        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+      });
+      let parsed;
+      try {
+        const value = await response.json();
+        // Upstream errors and metadata can reflect the authorization header.
+        parsed = JSON.parse(JSON.stringify(value).split(JSON.stringify(token).slice(1, -1)).join('[REDACTED]'));
+      } catch {
+        if (response.status === 404 || response.status === 405) parsed = {};
+        else return mcpError(`sandbox returned non-JSON HTTP ${response.status}`);
+      }
+      try {
+        assertNoWorkerBinding(parsed, 'mcp');
+        return typedResult(parsed, response.status, validate);
+      } catch (error) {
+        return mcpError(`${error.code ?? 'sandbox_malformed_response'}: ${error.message}`);
+      }
     } catch (error) {
-      return mcpError(`${error.code ?? 'sandbox_malformed_response'}: ${error.message}`);
+      throw new Error(redact(error instanceof Error ? error.message : 'Sandbox management request failed'));
     }
   }
 }

package/dist/src/models/grok-build-models.js

@@ -83,6 +83,13 @@ export function parseGrokBuildModelConfig(text, scope) {
                 parsed.projectModelFields = true;
             continue;
         }
+        // Presence only: never retain the command or endpoint in discovery output.
+        if ((table === 'auth' || table === 'grok_com_config') && key === 'auth_provider_command') {
+            parsed.hasExternalAuthProvider = Boolean(unquote(value)?.trim());
+        }
+        if (table === 'endpoints' && ['models_base_url', 'models_list_url', 'models_endpoint'].includes(key)) {
+            parsed.hasCustomModelsEndpoint ||= Boolean(unquote(value)?.trim());
+        }
         if (table === 'models') {
             if (key === 'default')
                 parsed.defaultModel = unquote(value);
@@ -299,6 +306,19 @@ export async function discoverGrokBuildModels(options = {}) {
     const discovered = inspectModels(report, validationDiagnostics);
     const parsedByLayer = await Promise.all(layers.map(layer => layer.role === 'env_overlay'
         && layer.path.includes('(inline)') ? parseEnvOverlay(env) : readLayer(layer)));
+    // Reviewed upstream 2bdd1d6a: external auth plus a custom models endpoint
+    // discards [model.*] and ordinary allowed_models. Inspect has no effective
+    // catalog, so config reconstruction cannot establish selectable aliases.
+    // Conservatively withhold discovery when any active layer names this setup;
+    // do not execute the auth provider or fetch its endpoint to fill the gap.
+    const externalAuth = Boolean(env.GROK_AUTH_PROVIDER_COMMAND?.trim())
+        || parsedByLayer.some(layer => layer?.hasExternalAuthProvider);
+    const customEndpoint = Boolean(env.GROK_MODELS_BASE_URL?.trim() || env.GROK_MODELS_LIST_URL?.trim())
+        || parsedByLayer.some(layer => layer?.hasCustomModelsEndpoint);
+    if (externalAuth && customEndpoint) {
+        return { ...base, ...(runtimeVersion ? { runtimeVersion } : {}), errorKind: 'invalid-output',
+            error: 'Grok Build external auth with a custom models endpoint requires its runtime catalog; config model aliases and ordinary allowed_models are ignored upstream. Automatic discovery is deferred for this configuration.' };
+    }
     let requirementsDefault;
     let requirementsAllowed;
     for (let i = 0; i < layers.length; i++) {

package/dist/src/providers/provider-definitions.js

@@ -687,9 +687,9 @@ const BUILT_IN_SEEDS = [
             source: 'https://github.com/xai-org/grok-build',
             version: '1.0.38',
             // Reviewed public tree (docs + inspect schema), not an all-zero placeholder.
-            revision: '4247f661689354b831191f11eeeac8424993fe3d',
+            revision: '2bdd1d6a6369de0e8c68132ea4539e9abd9e14a8',
             runtime: 'Grok Build CLI',
-            lastVerified: '2026-09-20',
+            lastVerified: '2026-10-26',
         },
         surfaces: {
             primary: 'grok-build',