@carrierllc/mcp 0.13.28 → 0.13.30

package/dist/cli.js

@@ -22,6 +22,7 @@ import {
   lastNDaysPeriod,
   loadStorefrontBrand,
   mergeEnvLocal,
+  package_default,
   packagesScreen,
   probeAll,
   provisionClerk,
@@ -40,7 +41,7 @@ import {
   verifyStorefront,
   walletScreen,
   which
-} from "./chunk-RF3NNGZX.js";
+} from "./chunk-ZJY7H2QW.js";
 import {
   copyTree,
   exists,
@@ -54,7 +55,7 @@ import {
 import { Command } from "commander";
 import * as p3 from "@clack/prompts";
 import pc4 from "picocolors";
-import { resolve as resolve2 } from "path";
+import { resolve as resolve4 } from "path";
 
 // src/cli/lib/plugin.ts
 import { join as join2 } from "path";
@@ -66,7 +67,7 @@ import { existsSync } from "fs";
 import { homedir } from "os";
 function packageRoot() {
   const here = dirname(fileURLToPath(import.meta.url));
-  for (const candidate of [resolve(here, ".."), resolve(here, "..", "..")]) {
+  for (const candidate of [resolve(here, ".."), resolve(here, "..", ".."), resolve(here, "..", "..", "..")]) {
     if (existsSync(join(candidate, "plugin")) && existsSync(join(candidate, "templates"))) {
       return candidate;
     }
@@ -219,7 +220,7 @@ async function scaffoldStorefront(target, brand) {
   await patchBrandConfig(join3(target, "src", "brand.config.ts"), brand);
   const envBody = existingEnv ? preserveClerkFromEnv(existingEnv, renderEnv(brand)) : renderEnv(brand);
   await writeFile(envPath, envBody);
-  await writeFile(join3(target, ".npmrc"), "ignore-workspace-root-check=true\n");
+  await writeFile(join3(target, ".npmrc"), "# Standalone template installs use pnpm --ignore-workspace explicitly.\n");
 }
 async function patchBrandConfig(path, brand) {
   if (!await exists(path)) return;
@@ -277,13 +278,24 @@ async function writeStorefrontLogo(target, brand) {
 }
 
 // src/cli/lib/auth.ts
-import { createHash, randomBytes, timingSafeEqual } from "crypto";
+import { createHash as createHash2, randomBytes, timingSafeEqual } from "crypto";
 import { createServer } from "http";
 
+// src/cli/lib/mcp-oauth.ts
+import { createHash } from "crypto";
+import { open as open2, lstat, realpath } from "fs/promises";
+import { constants as constants2 } from "fs";
+import { join as join6, resolve as resolve2, dirname as dirname2 } from "path";
+import { homedir as homedir3, userInfo } from "os";
+import { spawn as spawn2, execFile } from "child_process";
+import { promisify } from "util";
+
 // src/cli/lib/credentials.ts
 import { homedir as homedir2 } from "os";
 import { join as join5 } from "path";
-import { chmod, mkdir as mkdir2, readFile as readFile2, rm, writeFile as writeFile3 } from "fs/promises";
+import { chmod, mkdir as mkdir2, rm, rename, open } from "fs/promises";
+import { constants, rmSync } from "fs";
+import { randomUUID } from "crypto";
 function carrierHome() {
   return process.env.CARRIER_HOME?.trim() || join5(homedir2(), ".carrier");
 }
@@ -292,7 +304,15 @@ function credentialsPath() {
 }
 async function readCredentials() {
   try {
-    const raw = await readFile2(credentialsPath(), "utf8");
+    const handle = await open(credentialsPath(), constants.O_RDONLY | constants.O_NOFOLLOW);
+    let raw;
+    try {
+      const stat = await handle.stat();
+      if (!stat.isFile() || stat.size > 1024 * 1024 || process.platform !== "win32" && stat.mode & 63 || process.getuid && stat.uid !== process.getuid()) return null;
+      raw = await handle.readFile("utf8");
+    } finally {
+      await handle.close();
+    }
     const parsed = JSON.parse(raw);
     if (!parsed?.accessToken || typeof parsed.accessToken !== "string") return null;
     return parsed;
@@ -305,9 +325,56 @@ async function writeCredentials(creds) {
   await mkdir2(dir, { recursive: true, mode: 448 });
   await chmod(dir, 448).catch(() => void 0);
   const file = credentialsPath();
-  await writeFile3(file, `${JSON.stringify(creds, null, 2)}
-`, { mode: 384 });
-  await chmod(file, 384).catch(() => void 0);
+  const temporary = join5(dir, `.credentials-${randomUUID()}.json`);
+  try {
+    const handle = await open(temporary, "wx", 384);
+    try {
+      await handle.writeFile(`${JSON.stringify({ ...creds, generation: randomUUID() }, null, 2)}
+`);
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    await rename(temporary, file);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+}
+async function withCredentialLock(action) {
+  const dir = carrierHome();
+  await mkdir2(dir, { recursive: true, mode: 448 });
+  await chmod(dir, 448);
+  const lock = join5(dir, "credentials.lock");
+  const deadline = Date.now() + 31e4;
+  while (true) {
+    try {
+      await mkdir2(lock, { mode: 448 });
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      if (Date.now() >= deadline) throw new Error("Carrier credential owner is busy; retry or recover its abandoned lock.");
+      await new Promise((resolve5) => setTimeout(resolve5, 25));
+    }
+  }
+  let released = false;
+  const release = () => {
+    if (released) return;
+    released = true;
+    rmSync(lock, { recursive: true, force: true });
+  };
+  const onSignal = () => {
+    release();
+    process.exit(1);
+  };
+  process.once("SIGINT", onSignal);
+  process.once("SIGTERM", onSignal);
+  try {
+    return await action();
+  } finally {
+    process.removeListener("SIGINT", onSignal);
+    process.removeListener("SIGTERM", onSignal);
+    if (!released) await rm(lock, { recursive: true });
+  }
 }
 async function clearCredentials() {
   await rm(credentialsPath(), { force: true });
@@ -316,11 +383,403 @@ function isExpired(creds, skewMs = 6e4) {
   if (!creds.expiresAt) return false;
   return Date.now() >= creds.expiresAt - skewMs;
 }
+function redactCredential(value, token) {
+  if (typeof value === "string") return value.split(token).join("***");
+  if (Array.isArray(value)) return value.map((item) => redactCredential(item, token));
+  if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([key, item]) => [key.split(token).join("***"), redactCredential(item, token)]));
+  return value;
+}
 function redact(text3) {
-  return text3.replace(/\b(ak_|sk_|rt_)[A-Za-z0-9._-]{6,}/g, "$1***").replace(/\bBearer\s+[A-Za-z0-9._-]{8,}/gi, "Bearer ***");
+  return text3.replace(/\bclerk_[^\s:"<>]+:[^\s:"<>]+:[^\s"<>]+/g, "clerk_***").replace(/\b(ak_|sk_|rt_)[A-Za-z0-9._-]{6,}/g, "$1***").replace(/\bBearer\s+[A-Za-z0-9._-]{8,}/gi, "Bearer ***");
+}
+
+// src/cli/lib/mcp-oauth.ts
+var CLAUDE_OWNER_VERSIONS = package_default.carrierCompatibility.claudeOAuthOwnerVersions;
+function usableOAuth(creds) {
+  if (creds.issuer !== MCP_HOME || !Number.isFinite(creds.expiresAt) || creds.expiresAt <= 0) return false;
+  if (Object.hasOwn(creds, "resource") && creds.resource !== MCP_URL) return false;
+  if (typeof creds.scope !== "string" || !creds.scope.split(/\s+/).includes("read")) return false;
+  if (typeof creds.accessToken !== "string" || !creds.accessToken || /[\s\0]/.test(creds.accessToken)) return false;
+  const account = process.env.CARRIER_OAUTH_ACCOUNT?.trim();
+  if (account && creds.accessToken.split(":")[0] !== `clerk_${account}`) return false;
+  return true;
+}
+async function privateText(file, privateMode = true) {
+  try {
+    const handle = await open2(file, constants2.O_RDONLY | constants2.O_NOFOLLOW);
+    try {
+      const stat = await handle.stat();
+      if (!stat.isFile() || stat.size > 1024 * 1024 || privateMode && process.platform !== "win32" && stat.mode & 63 || process.getuid && stat.uid !== process.getuid()) return null;
+      return await handle.readFile("utf8");
+    } finally {
+      await handle.close();
+    }
+  } catch {
+    return null;
+  }
+}
+async function privateJson(file) {
+  try {
+    const text3 = await privateText(file);
+    return text3 ? JSON.parse(text3) : null;
+  } catch {
+    return null;
+  }
+}
+function oauthBinding(creds, selection) {
+  const parts = creds.accessToken.split(":");
+  const subject = /^clerk_[^:\s]+:[^:\s]+:[^:\s]+$/.test(creds.accessToken) ? parts.slice(0, 2) : [createHash("sha256").update(creds.accessToken).digest("hex")];
+  return createHash("sha256").update(JSON.stringify([selection, creds.issuer, creds.resource, subject])).digest("hex");
+}
+function validImport(creds) {
+  if (!/^clerk_[^:\s]+:[^:\s]+:[^:\s]+$/.test(creds.accessToken ?? "")) return null;
+  return usableOAuth(creds) && !isExpired(creds) ? creds : null;
+}
+function hermesServerConfig(text3, server) {
+  try {
+    return JSON.parse(text3)?.mcp_servers?.[server] ?? null;
+  } catch {
+  }
+  let inside = false, selected = false;
+  let sectionIndent = -1, serverIndent = -1;
+  const entry = {};
+  for (const line of text3.split(/\r?\n/)) {
+    if (!line.trim() || line.trimStart().startsWith("#")) continue;
+    if (/\t/.test(line)) return null;
+    const match = /^( *)([^:]+):\s*(.*?)\s*$/.exec(line);
+    if (!match) {
+      if (inside) return null;
+      continue;
+    }
+    const indent = match[1].length, key = match[2], value = match[3];
+    if (!inside) {
+      if (key === "mcp_servers" && value === "") {
+        inside = true;
+        sectionIndent = indent;
+      }
+      continue;
+    }
+    if (indent <= sectionIndent) break;
+    if (serverIndent < 0) serverIndent = indent;
+    if (indent === serverIndent) {
+      selected = key === server || key === JSON.stringify(server) || key === `'${server}'`;
+      if (selected && value) return null;
+      continue;
+    }
+    if (!selected) continue;
+    if (!value || /^[&*!>|\[{]/.test(value)) return null;
+    if (Object.hasOwn(entry, key)) return null;
+    let scalar = value;
+    if (value.startsWith('"')) {
+      try {
+        scalar = JSON.parse(value);
+      } catch {
+        return null;
+      }
+    } else if (value.startsWith("'")) {
+      if (!value.endsWith("'")) return null;
+      scalar = value.slice(1, -1).replace(/''/g, "'");
+    } else scalar = value.replace(/\s+#.*$/, "");
+    entry[key] = scalar;
+  }
+  return Object.keys(entry).length ? entry : null;
+}
+async function readHermesOAuth(server) {
+  if (!/^[\w-]{1,128}$/.test(server)) return null;
+  const home = process.env.HERMES_HOME?.trim() || join6(homedir3(), ".hermes");
+  const text3 = await privateText(join6(home, "config.yaml"), false);
+  const config = text3 && hermesServerConfig(text3, server);
+  if (!config || config.url !== MCP_URL || config.command || config.headers || config.type && config.type !== "http" && config.type !== "streamable-http") return null;
+  const dir = join6(home, "mcp-tokens");
+  const [token, client, meta] = await Promise.all([privateJson(join6(dir, `${server}.json`)), privateJson(join6(dir, `${server}.client.json`)), privateJson(join6(dir, `${server}.meta.json`))]);
+  if (!token || !client || !meta || token.hermes_issuer !== MCP_HOME || meta.issuer !== MCP_HOME) return null;
+  if (typeof client.client_id !== "string" || !client.client_id || token.client_id && token.client_id !== client.client_id) return null;
+  if (typeof token.token_type !== "string" || token.token_type.toLowerCase() !== "bearer") return null;
+  for (const field of ["authorization_endpoint", "token_endpoint"]) {
+    try {
+      if (new URL(String(meta[field])).origin !== MCP_HOME) return null;
+    } catch {
+      return null;
+    }
+  }
+  const hasResource = Object.hasOwn(token, "resource");
+  if (hasResource && token.resource !== MCP_URL) return null;
+  if (typeof token.expires_at !== "number") return null;
+  const creds = validImport({ issuer: MCP_HOME, ...hasResource ? { resource: token.resource } : {}, origin: "hermes-mcp", accessToken: token.access_token, expiresAt: token.expires_at * 1e3, scope: token.scope });
+  if (creds) creds.binding = oauthBinding(creds, [
+    "hermes",
+    resolve2(home),
+    server,
+    config,
+    client,
+    meta,
+    token.organization_id,
+    token.org_id,
+    token.account_id,
+    token.user_id
+  ]);
+  return creds;
+}
+function configuredClaudeDir() {
+  const value = process.env.CLAUDE_CONFIG_DIR;
+  return value && value.trim() ? value : void 0;
+}
+function claudeKeychainSelection() {
+  const custom = process.env.CLAUDE_CODE_CUSTOM_OAUTH_URL;
+  if (custom && !["https://beacon.claude-ai.staging.ant.dev", "https://claude.fedstart.com", "https://claude-staging.fedstart.com"].includes(custom.replace(/\/$/, ""))) return null;
+  const configured = (configuredClaudeDir() ?? join6(homedir3(), ".claude")).normalize("NFC");
+  const secure = process.env.CLAUDE_SECURESTORAGE_CONFIG_DIR;
+  const home = (secure !== void 0 ? secure || join6(homedir3(), ".claude") : configured).normalize("NFC");
+  const isDefault = secure !== void 0 ? !secure : !configuredClaudeDir();
+  const suffix = isDefault ? "" : `-${createHash("sha256").update(secure !== void 0 ? secure.normalize("NFC") : configured).digest("hex").slice(0, 8)}`;
+  let account;
+  try {
+    account = process.env.USER || userInfo().username;
+  } catch {
+    account = "claude-code-user";
+  }
+  if (!/^[a-zA-Z0-9._-]+$/.test(account)) account = "claude-code-user";
+  return { service: `Claude Code${custom ? "-custom-oauth" : ""}-credentials${suffix}`, account, home };
+}
+async function claudeResolvedConfig(server) {
+  const configDir = (configuredClaudeDir() ?? join6(homedir3(), ".claude")).normalize("NFC");
+  let file = join6(configuredClaudeDir() || homedir3(), `.claude${process.env.CLAUDE_CODE_CUSTOM_OAUTH_URL ? "-custom-oauth" : ""}.json`);
+  try {
+    await lstat(join6(configDir, ".config.json"));
+    file = join6(configDir, ".config.json");
+  } catch (e) {
+    if (e.code !== "ENOENT") return null;
+  }
+  const json = await privateJson(file);
+  if (!json) return null;
+  const object = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+  const readOptional = async (path) => {
+    try {
+      await lstat(path);
+      const text3 = await privateText(path, false);
+      if (text3 === null) return null;
+      const value = JSON.parse(text3);
+      return object(value) ? value : null;
+    } catch (e) {
+      return e.code === "ENOENT" ? void 0 : null;
+    }
+  };
+  let cwd;
+  try {
+    cwd = await realpath(process.cwd());
+  } catch {
+    return null;
+  }
+  let workspace = cwd;
+  for (let dir = cwd; ; ) {
+    try {
+      await lstat(join6(dir, ".git"));
+      const { stdout } = await promisify(execFile)("git", ["-C", cwd, "rev-parse", "--show-toplevel"], { timeout: 3e3, maxBuffer: 8192 });
+      workspace = await realpath(stdout.trim());
+      break;
+    } catch (e) {
+      if (e.code !== "ENOENT") return null;
+    }
+    const parent = dirname2(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  const managedDir = process.platform === "darwin" ? "/Library/Application Support/ClaudeCode" : "/etc/claude-code";
+  for (const path of [join6(managedDir, "managed-mcp.json"), join6(managedDir, "managed-settings.json"), join6(configDir, "managed-mcp.json"), join6(configDir, "managed-settings.json")]) {
+    try {
+      await lstat(path);
+      return null;
+    } catch (e) {
+      if (e.code !== "ENOENT") return null;
+    }
+  }
+  const policyFields = ["managedMcpServers", "allowedMcpServers", "deniedMcpServers", "mcpServers", "env", "enabledSettingsSources", "allowManagedMcpServersOnly"];
+  if (["managedMcpServers", "allowedMcpServers", "deniedMcpServers"].some((k) => Object.hasOwn(json, k))) return null;
+  for (const path of [join6(configDir, "settings.json"), join6(workspace, ".claude/settings.json"), join6(workspace, ".claude/settings.local.json")]) {
+    const settings = await readOptional(path);
+    if (settings === null || settings && policyFields.some((k) => Object.hasOwn(settings, k))) return null;
+  }
+  const projects = json.projects;
+  if (projects !== void 0 && !object(projects)) return null;
+  const local = object(projects) ? projects[workspace] : void 0;
+  if (local !== void 0 && !object(local)) return null;
+  const userServers = json.mcpServers;
+  const localServers = object(local) ? local.mcpServers : void 0;
+  if (userServers !== void 0 && !object(userServers) || localServers !== void 0 && !object(localServers)) return null;
+  let config = object(userServers) ? userServers[server] : void 0;
+  let scope = "user", selectedFile = file;
+  const hasLocal = object(localServers) && Object.hasOwn(localServers, server);
+  let project, projectFile;
+  const dirs = [];
+  for (let dir = cwd; ; ) {
+    const parent = dirname2(dir);
+    if (parent === dir) break;
+    dirs.push(dir);
+    dir = parent;
+  }
+  for (const dir of dirs.reverse()) {
+    const path = join6(dir, ".mcp.json"), value = await readOptional(path);
+    if (value === null) return null;
+    if (!value) continue;
+    if (!object(value.mcpServers)) return null;
+    if (Object.hasOwn(value.mcpServers, server)) {
+      project = value.mcpServers[server];
+      projectFile = path;
+    }
+  }
+  if (projectFile && !hasLocal) {
+    const settings = await readOptional(join6(configDir, "settings.json"));
+    if (settings === null || !object(local) || local.hasTrustDialogAccepted !== true) return null;
+    const disabled = settings?.disabledMcpjsonServers;
+    const enabled = settings?.enabledMcpjsonServers;
+    if (disabled !== void 0 && (!Array.isArray(disabled) || disabled.some((v) => typeof v !== "string"))) return null;
+    if (enabled !== void 0 && (!Array.isArray(enabled) || enabled.some((v) => typeof v !== "string"))) return null;
+    if (Array.isArray(disabled) && disabled.includes(server)) return null;
+    if (settings?.enableAllProjectMcpServers !== true && !(Array.isArray(enabled) && enabled.includes(server))) return null;
+    for (const path of [join6(workspace, ".claude/settings.json"), join6(workspace, ".claude/settings.local.json")]) {
+      const extra = await readOptional(path);
+      if (extra === null || extra && ["env", "enabledMcpjsonServers", "disabledMcpjsonServers", "enableAllProjectMcpServers"].some((k) => Object.hasOwn(extra, k))) return null;
+    }
+    config = project;
+    scope = "project";
+    selectedFile = projectFile;
+  }
+  if (hasLocal) {
+    config = localServers[server];
+    scope = "local";
+  }
+  if (!object(config) || config.url !== MCP_URL || config.command || config.type !== void 0 && config.type !== "http" && config.type !== "sse") return null;
+  if (config.headers !== void 0 && !object(config.headers)) return null;
+  for (const [key, value] of Object.entries(config.headers ?? {})) {
+    if (typeof value !== "string" || /authorization|api[-_]?key|token|cookie/i.test(key) || /\$\{|[\r\n\0]/.test(value)) return null;
+  }
+  return { config, file: selectedFile, scope, cwd: workspace };
+}
+async function readClaudeKeychain(request) {
+  return new Promise((resolveResult) => {
+    const child = spawn2(
+      "/usr/bin/osascript",
+      ["-l", "JavaScript", join6(packageRoot(), "native/claude-keychain.js")],
+      { stdio: ["pipe", "ignore", "ignore", "pipe"], env: { PATH: "/usr/bin:/bin" } }
+    );
+    let text3 = "", failed = false;
+    const pipe = child.stdio[3];
+    if (!pipe || !("on" in pipe)) {
+      child.kill();
+      resolveResult({ status: "unavailable" });
+      return;
+    }
+    const timer = setTimeout(() => {
+      failed = true;
+      child.kill();
+    }, 5e3);
+    pipe.on("data", (data) => {
+      if (text3.length + data.length > 65536) {
+        failed = true;
+        child.kill();
+      } else text3 += data.toString("utf8");
+    });
+    child.once("error", () => {
+      failed = true;
+    });
+    child.stdin?.on("error", () => {
+      failed = true;
+    });
+    child.once("close", (code) => {
+      clearTimeout(timer);
+      if (failed || code !== 0) {
+        resolveResult({ status: "unavailable" });
+        return;
+      }
+      try {
+        const result = JSON.parse(text3);
+        if (!["ok", "absent", "absent-entry", "locked", "denied", "malformed", "unavailable"].includes(result.status)) throw new Error();
+        resolveResult(result);
+      } catch {
+        resolveResult({ status: "malformed" });
+      }
+    });
+    child.stdin?.end(JSON.stringify(request));
+  });
+}
+async function claudeVersion() {
+  try {
+    const { stdout } = await promisify(execFile)("claude", ["--version"], { timeout: 3e3, maxBuffer: 1024 });
+    const version = stdout.trim().replace(/ \(Claude Code\)$/, "");
+    return CLAUDE_OWNER_VERSIONS.includes(version) ? version : null;
+  } catch {
+    return null;
+  }
+}
+async function readClaudeOwner(server, options = {}) {
+  if (!/^[a-zA-Z0-9_-]{1,128}$/.test(server)) return { status: "unsupported-config" };
+  const selection = claudeKeychainSelection(), resolved = await claudeResolvedConfig(server);
+  if (!selection || !resolved) return { status: "unsupported-config" };
+  const hash = createHash("sha256").update(JSON.stringify({ type: resolved.config.type, url: resolved.config.url, headers: resolved.config.headers || {} })).digest("hex").slice(0, 16);
+  const key = `${server}|${hash}`, explicitFile = process.env.CARRIER_MCP_OAUTH_FILE;
+  let entry;
+  let source;
+  if ((options.platform ?? process.platform) === "darwin" && !explicitFile) {
+    if (!CLAUDE_OWNER_VERSIONS.includes(await (options.version ?? claudeVersion)() ?? "")) return { status: "unsupported-version" };
+    const result = await (options.native ?? readClaudeKeychain)({ ...selection, key });
+    if (result.status === "ok") {
+      if (!result.entry) return { status: "malformed" };
+      entry = result.entry;
+      source = ["keychain", selection.service, selection.account, selection.home];
+    } else if (result.status !== "absent") return { status: result.status };
+  }
+  if (!entry) {
+    const file = explicitFile || join6(selection.home, ".credentials.json");
+    const json = await privateJson(file);
+    entry = json?.mcpOAuth?.[key];
+    source = ["file", resolve2(file)];
+  }
+  if (!entry || entry.serverName !== server || entry.serverUrl !== MCP_URL) return { status: "absent-entry" };
+  const discovery = entry.discoveryState;
+  const issuer = entry.issuer ?? discovery?.authorizationServerUrl;
+  if (entry.issuer !== void 0 && discovery?.authorizationServerUrl !== void 0 && entry.issuer !== discovery.authorizationServerUrl || entry.resource !== void 0 && entry.resource !== MCP_URL || discovery?.resourceMetadataUrl !== void 0 && discovery.resourceMetadataUrl !== `${MCP_HOME}/.well-known/oauth-protected-resource/mcp`) return { status: "malformed" };
+  const creds = validImport({ issuer, resource: MCP_URL, origin: "claude-mcp", accessToken: entry.accessToken, expiresAt: entry.expiresAt, scope: entry.scope });
+  if (!creds) return { status: "malformed" };
+  creds.binding = oauthBinding(creds, [
+    "claude",
+    source,
+    resolve2(resolved.file),
+    resolved.scope,
+    resolved.cwd,
+    server,
+    hash,
+    entry.clientId,
+    entry.organizationId,
+    entry.organization_id,
+    entry.orgId,
+    entry.accountId,
+    discovery?.authorizationServerUrl,
+    discovery?.resourceMetadataUrl
+  ]);
+  return { status: "ok", credentials: creds };
+}
+async function readClaudeOAuth(server) {
+  return (await readClaudeOwner(server)).credentials ?? null;
+}
+async function readMcpOAuth(selectedOwner) {
+  const server = process.env.CARRIER_MCP_OAUTH_SERVER?.trim() || "carrier";
+  const owner = process.env.CARRIER_MCP_OAUTH_OWNER?.trim();
+  if (owner && owner !== "hermes" && owner !== "claude") return null;
+  if (selectedOwner) {
+    if (owner && owner !== selectedOwner || selectedOwner === "hermes" && process.env.CARRIER_MCP_OAUTH_FILE) return null;
+    return selectedOwner === "hermes" ? readHermesOAuth(server) : readClaudeOAuth(server);
+  }
+  if (owner === "hermes") return readHermesOAuth(server);
+  if (owner === "claude" || process.env.CARRIER_MCP_OAUTH_FILE) return readClaudeOAuth(server);
+  const claude = await readClaudeOwner(server);
+  if (["locked", "denied", "malformed", "unavailable", "unsupported-version"].includes(claude.status)) return null;
+  const owners = [await readHermesOAuth(server), claude.credentials ?? null].filter((c) => c !== null);
+  return owners.length === 1 ? owners[0] : null;
 }
 
 // src/cli/lib/auth.ts
+import { access, writeFile as writeFile3, rm as rm2 } from "fs/promises";
+import { join as join7, resolve as resolve3 } from "path";
 var DISCOVERY_PATH = "/.well-known/oauth-authorization-server";
 var CLIENT_NAME = "Carrier CLI";
 var DEFAULT_SCOPE = "read write";
@@ -334,6 +793,11 @@ async function discover(base = MCP_HOME) {
   if (!meta.authorization_endpoint || !meta.token_endpoint) {
     throw new Error("OAuth discovery returned no authorization or token endpoint");
   }
+  if (meta.issuer !== MCP_HOME) throw new Error("OAuth issuer does not match Carrier");
+  for (const endpoint of [meta.authorization_endpoint, meta.token_endpoint, meta.registration_endpoint].filter(Boolean)) {
+    const url = new URL(endpoint);
+    if (url.origin !== MCP_HOME || url.username || url.password) throw new Error("OAuth endpoint does not match Carrier");
+  }
   return meta;
 }
 function base64url(buf) {
@@ -341,7 +805,7 @@ function base64url(buf) {
 }
 function pkcePair() {
   const verifier = base64url(randomBytes(32));
-  const challenge = base64url(createHash("sha256").update(verifier).digest());
+  const challenge = base64url(createHash2("sha256").update(verifier).digest());
   return { verifier, challenge };
 }
 function sameState(a, b) {
@@ -368,8 +832,7 @@ async function registerClient(meta, redirectUri) {
     })
   });
   if (!res.ok) {
-    const body = (await res.text().catch(() => "")).slice(0, 200);
-    throw new Error(`Client registration failed (${res.status}). ${body}`);
+    throw new Error(`Client registration failed (${res.status}).`);
   }
   const json = await res.json();
   if (!json.client_id) throw new Error("Client registration returned no client_id");
@@ -400,8 +863,8 @@ async function startCallbackServer() {
     const state = url.searchParams.get("state") ?? "";
     if (err) {
       res.writeHead(400, { "Content-Type": "text/html" });
-      res.end(page("Sign-in failed", err));
-      rejectCode?.(new Error(`Authorization server returned "${err}"`));
+      res.end(page("Sign-in failed", "Authorization was rejected."));
+      rejectCode?.(new Error("Authorization server rejected sign-in."));
       return;
     }
     if (!code || !expected || !sameState(state, expected)) {
@@ -418,11 +881,11 @@ async function startCallbackServer() {
   let lastErr;
   for (const port2 of CALLBACK_PORTS) {
     try {
-      await new Promise((resolve3, reject) => {
+      await new Promise((resolve5, reject) => {
         server.once("error", reject);
         server.listen(port2, "127.0.0.1", () => {
           server.removeListener("error", reject);
-          resolve3();
+          resolve5();
         });
       });
       bound = true;
@@ -443,14 +906,14 @@ async function startCallbackServer() {
     // browser would hold the event loop open and the CLI would never exit.
     waitForCode: (expectedState, timeoutMs) => {
       expected = expectedState;
-      return new Promise((resolve3, reject) => {
+      return new Promise((resolve5, reject) => {
         const timer = setTimeout(
           () => reject(new Error(`Timed out after ${Math.round(timeoutMs / 1e3)}s waiting for the browser`)),
           timeoutMs
         );
         resolveCode = (code) => {
           clearTimeout(timer);
-          resolve3(code);
+          resolve5(code);
         };
         rejectCode = (err) => {
           clearTimeout(timer);
@@ -475,14 +938,20 @@ async function postToken(meta, body) {
   });
   const json = await res.json().catch(() => ({}));
   if (!res.ok || json.error) {
-    throw new Error(json.error_description || json.error || `Token endpoint returned ${res.status}`);
+    throw new Error(`OAuth token exchange rejected (${res.status}).`);
   }
   if (!json.access_token) throw new Error("Token endpoint returned no access_token");
+  if (Object.hasOwn(json, "resource")) {
+    const resources = Array.isArray(json.resource) ? json.resource : [json.resource];
+    if (resources.length !== 1 || resources[0] !== MCP_URL) throw new Error("OAuth token resource does not match Carrier.");
+    json.resource = MCP_URL;
+  }
   return json;
 }
 function store(meta, token, clientId) {
   return {
     issuer: meta.issuer,
+    ...Object.hasOwn(token, "resource") ? { resource: token.resource } : {},
     accessToken: token.access_token,
     refreshToken: token.refresh_token,
     expiresAt: Date.now() + (token.expires_in ?? 900) * 1e3,
@@ -492,65 +961,140 @@ function store(meta, token, clientId) {
 }
 async function login(opts) {
   const meta = await discover();
-  const server = await startCallbackServer();
-  try {
-    const existing = await readCredentials();
-    const clientId = existing?.clientId && existing.issuer === meta.issuer ? existing.clientId : await registerClient(meta, server.redirectUri);
-    const { verifier, challenge } = pkcePair();
-    const state = base64url(randomBytes(16));
-    const authUrl = new URL(meta.authorization_endpoint);
-    authUrl.searchParams.set("response_type", "code");
-    authUrl.searchParams.set("client_id", clientId);
-    authUrl.searchParams.set("redirect_uri", server.redirectUri);
-    authUrl.searchParams.set("scope", pickScope(meta));
-    authUrl.searchParams.set("state", state);
-    authUrl.searchParams.set("code_challenge", challenge);
-    authUrl.searchParams.set("code_challenge_method", "S256");
-    const pendingCode = server.waitForCode(state, opts.timeoutMs ?? 3e5);
-    pendingCode.catch(() => void 0);
-    opts.onUrl?.(authUrl.toString());
-    await opts.openBrowser(authUrl.toString());
-    const code = await pendingCode;
-    const token = await postToken(meta, {
-      grant_type: "authorization_code",
-      code,
-      redirect_uri: server.redirectUri,
-      client_id: clientId,
-      code_verifier: verifier
-    });
-    await writeCredentials(store(meta, token, clientId));
-    return { ok: true, message: "Signed in.", scope: token.scope };
-  } finally {
-    server.close();
-  }
+  return withCredentialLock(async () => {
+    const server = await startCallbackServer();
+    try {
+      const existing = await readCredentials();
+      const clientId = existing?.clientId && existing.issuer === meta.issuer && existing.redirectUri === server.redirectUri ? existing.clientId : await registerClient(meta, server.redirectUri);
+      const { verifier, challenge } = pkcePair();
+      const state = base64url(randomBytes(16));
+      const authUrl = new URL(meta.authorization_endpoint);
+      authUrl.searchParams.set("response_type", "code");
+      authUrl.searchParams.set("resource", MCP_URL);
+      authUrl.searchParams.set("client_id", clientId);
+      authUrl.searchParams.set("redirect_uri", server.redirectUri);
+      authUrl.searchParams.set("scope", pickScope(meta));
+      authUrl.searchParams.set("state", state);
+      authUrl.searchParams.set("code_challenge", challenge);
+      authUrl.searchParams.set("code_challenge_method", "S256");
+      const pendingCode = server.waitForCode(state, opts.timeoutMs ?? 3e5);
+      pendingCode.catch(() => void 0);
+      opts.onUrl?.(authUrl.toString());
+      await opts.openBrowser(authUrl.toString());
+      const code = await pendingCode;
+      const token = await postToken(meta, {
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: server.redirectUri,
+        client_id: clientId,
+        code_verifier: verifier,
+        resource: MCP_URL
+      });
+      const next = { ...store(meta, token, clientId), redirectUri: server.redirectUri };
+      if (!usableOAuth(next)) throw new Error("OAuth endpoint returned an unusable Carrier session.");
+      await writeCredentials(next);
+      await rm2(join7(carrierHome(), "mcp-oauth-disabled"), { force: true });
+      return { ok: true, message: "Signed in.", scope: token.scope };
+    } finally {
+      server.close();
+    }
+  });
 }
 function pickScope(meta) {
   const supported = meta.scopes_supported ?? [];
   if (!supported.length) return DEFAULT_SCOPE;
   return DEFAULT_SCOPE.split(" ").filter((s) => supported.includes(s)).join(" ") || supported[0];
 }
-async function getAccessToken() {
+function inheritedOAuth() {
+  const api = process.env.CARRIER_API_KEY?.trim();
+  if (!api || process.env.CARRIER_OAUTH_HANDOFF !== createHash2("sha256").update(api).digest("hex")) return null;
+  const origin = process.env.CARRIER_OAUTH_ORIGIN, binding = process.env.CARRIER_OAUTH_BINDING;
+  if (!origin || !["native-cli", "hermes-mcp", "claude-mcp"].includes(origin) || !/^[a-f0-9]{64}$/.test(binding ?? "")) return false;
+  return { origin, binding };
+}
+function nativeBinding(creds) {
+  return oauthBinding(creds, ["native-cli", resolve3(carrierHome()), creds.clientId]);
+}
+async function selectedMcpOAuth(handoff) {
+  if (handoff === false || handoff && handoff.origin === "native-cli") return null;
+  const owner = await readMcpOAuth(handoff ? handoff.origin === "hermes-mcp" ? "hermes" : "claude" : void 0);
+  return owner && (!handoff || owner.binding === handoff.binding) ? owner : null;
+}
+async function getAccessTokenLocked() {
+  const handoff = inheritedOAuth();
+  if (handoff === false) return null;
   const creds = await readCredentials();
-  if (!creds) return null;
+  if (creds && handoff && (handoff.origin !== "native-cli" || nativeBinding(creds) !== handoff.binding)) return null;
+  if (!creds) {
+    try {
+      await access(join7(carrierHome(), "credentials.json"));
+      return null;
+    } catch (error) {
+      if (error.code !== "ENOENT") return null;
+    }
+    try {
+      await access(join7(carrierHome(), "mcp-oauth-disabled"));
+      return null;
+    } catch (error) {
+      if (error.code !== "ENOENT") return null;
+    }
+    return (await selectedMcpOAuth(handoff))?.accessToken ?? null;
+  }
+  if (!usableOAuth(creds)) return null;
   if (!isExpired(creds)) return creds.accessToken;
   if (!creds.refreshToken || !creds.clientId) return null;
   try {
     const meta = await discover();
+    if (meta.issuer !== creds.issuer) return null;
     const token = await postToken(meta, {
       grant_type: "refresh_token",
+      resource: MCP_URL,
       refresh_token: creds.refreshToken,
       client_id: creds.clientId
     });
     const next = store(meta, token, creds.clientId);
     if (!next.refreshToken) next.refreshToken = creds.refreshToken;
+    if (!next.scope) next.scope = creds.scope;
+    if (!Object.hasOwn(next, "resource") && Object.hasOwn(creds, "resource")) next.resource = creds.resource;
+    if (!usableOAuth(next) || handoff && nativeBinding(next) !== handoff.binding) return null;
+    next.redirectUri = creds.redirectUri;
+    const latest = await readCredentials();
+    if (latest?.generation !== creds.generation || latest?.accessToken !== creds.accessToken) return null;
     await writeCredentials(next);
     return next.accessToken;
   } catch {
     return null;
   }
 }
+function resolveExplicitCredential(opts = {}) {
+  const api = process.env.CARRIER_API_KEY?.trim();
+  const handedOff = api && process.env.CARRIER_OAUTH_HANDOFF === createHash2("sha256").update(api).digest("hex");
+  if (api && !handedOff) return { token: api, kind: "api-key" };
+  const org = process.env.CARRIER_ORG_API_KEY?.trim();
+  if (org) return { token: org, kind: "api-key" };
+  if (opts.allowOcs) {
+    const ocs = process.env.ESIMVAULT_API_TOKEN?.trim() || process.env.CARRIER_OCS_API_TOKEN?.trim();
+    if (ocs) return { token: ocs, kind: "ocs-token" };
+  }
+  return null;
+}
+async function resolveCredential(opts = {}) {
+  const explicit = resolveExplicitCredential(opts);
+  if (explicit) return explicit;
+  return withCredentialLock(async () => {
+    const token = await getAccessTokenLocked();
+    if (!token) return null;
+    const native = await readCredentials();
+    const owner = native ?? await selectedMcpOAuth(inheritedOAuth());
+    if (!owner || owner.accessToken !== token) return null;
+    return { token, kind: "oauth", origin: native ? "native-cli" : owner.origin, expiresAt: owner.expiresAt, binding: native ? nativeBinding(native) : owner.binding };
+  });
+}
 async function logout() {
-  await clearCredentials();
+  await withCredentialLock(async () => {
+    await writeFile3(join7(carrierHome(), "mcp-oauth-disabled"), "disabled\n", { mode: 384 });
+    await clearCredentials();
+  });
 }
 
 // src/cli/lib/guidance.ts
@@ -571,264 +1115,42 @@ function oauthFirstUseNote() {
     "  Auth:     OAuth on first use (Clerk \u2014 Google, GitHub, or email)",
     "  Token:    none required in Claude / Cursor / Windsurf",
     "",
-    "When you first talk to Carrier in your MCP client, the browser opens",
-    "sign-in/sign-up. After authorize, tools work. Headless? Use an org API key",
-    `(ak_\u2026) from ${CONSOLE_URL} \u2192 Settings \u2192 API Keys.`
-  ].join("\n");
-}
-function formatStatusBlock(st) {
-  const yn = (ok2, yes = "yes", no = "no") => ok2 ? pc.green(yes) : pc.yellow(no);
-  const authLabel = st.authMode === "oauth-first-use" ? pc.cyan("OAuth on first use (no token needed)") : st.authMode === "api-key" ? pc.green("org API key in env (CARRIER_API_KEY)") : st.authMode === "ocs-token" ? pc.green("OCS token in env") : pc.yellow("not ready \u2014 install MCP or open sign-up");
-  return [
-    `Claude Code:   ${yn(st.claudeFound, "found", "not on PATH")}`,
-    `Plugin:        ${st.pluginInstalled ? pc.green(`installed v${st.pluginVersion ?? "?"}`) : pc.yellow("not installed")}`,
-    `MCP registered:${st.mcpRegistered ? pc.green(" yes") : pc.yellow(" no")}${st.mcpDetail ? pc.dim(`  (${st.mcpDetail})`) : ""}`,
-    `MCP URL:       ${st.mcpUrlMatches ? pc.green(MCP_URL) : pc.yellow("not production / missing")}`,
-    `Auth path:     ${authLabel}`,
-    `Headless token:${st.tokenPresent ? pc.green(` ${st.tokenKind}`) : pc.dim(" none (optional)")}`
-  ].join("\n");
-}
-function formatNextSteps(st) {
-  return st.nextSteps.map((s, i) => `  ${i + 1}. ${s}`).join("\n");
-}
-function formatNlExamples() {
-  return FLEET_NL_EXAMPLES.map((e) => `  \u2022 ${pc.bold(e.label)}: "${e.prompt}"`).join("\n");
-}
-function accountLinksNote() {
-  return [
-    `Sign up:     ${SIGN_UP_URL}`,
-    `Sign in:     ${SIGN_IN_URL}`,
-    `Console:     ${CONSOLE_URL}`,
-    `Onboarding:  ${ONBOARDING_URL}`,
-    `MCP home:    https://mcp.carrier.llc`
-  ].join("\n");
-}
-function withNextStep(errorMsg, next) {
-  return [errorMsg, "", "What to do next:", ...next.map((s) => `  \u2192 ${s}`)].join("\n");
-}
-
-// src/cli/lib/status.ts
-import { homedir as homedir3 } from "os";
-import { join as join6 } from "path";
-
-// src/cli/lib/mcp-url.ts
-var PRODUCTION_MCP_URL = "https://mcp.carrier.llc/mcp";
-var PRODUCTION_HOST = "mcp.carrier.llc";
-var URL_TOKEN = /https?:\/\/[^\s"'<>)]+/g;
-function pathWithoutTrailingSlash(pathname) {
-  let end = pathname.length;
-  while (end > 1 && pathname.charCodeAt(end - 1) === 47) end -= 1;
-  return pathname.slice(0, end);
-}
-function parseHttpUrl(value) {
-  try {
-    const parsed = new URL(value);
-    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-function isProductionMcpUrl(value) {
-  if (value === PRODUCTION_MCP_URL) return true;
-  const parsed = parseHttpUrl(value);
-  if (!parsed || parsed.protocol !== "https:" || parsed.hostname !== PRODUCTION_HOST) return false;
-  return pathWithoutTrailingSlash(parsed.pathname) === "/mcp";
-}
-function isCarrierMcpHost(value) {
-  const parsed = parseHttpUrl(value);
-  return parsed?.protocol === "https:" && parsed.hostname === PRODUCTION_HOST;
-}
-function trimTrailingPunctuation(token) {
-  let end = token.length;
-  while (end > 0) {
-    const code = token.charCodeAt(end - 1);
-    if (code !== 46 && code !== 44 && code !== 59 && code !== 58) break;
-    end -= 1;
-  }
-  return token.slice(0, end);
-}
-function lineMentionsProductionMcp(line) {
-  const tokens = line.match(URL_TOKEN);
-  if (!tokens) return false;
-  for (const token of tokens) {
-    if (isProductionMcpUrl(trimTrailingPunctuation(token))) return true;
-  }
-  return false;
-}
-
-// src/cli/lib/status.ts
-function detectEnvToken() {
-  const api = process.env.CARRIER_API_KEY?.trim() || process.env.CARRIER_ORG_API_KEY?.trim() || "";
-  if (api.startsWith("ak_") || api.length > 0) {
-    return { present: true, kind: "api-key" };
-  }
-  const ocs = process.env.ESIMVAULT_API_TOKEN?.trim() || process.env.CARRIER_OCS_API_TOKEN?.trim() || "";
-  if (ocs) return { present: true, kind: "ocs-token" };
-  return { present: false, kind: "none" };
-}
-function rankHit(name, url) {
-  let rank = 0;
-  if (name.toLowerCase() === MCP_NAME) rank += 100;
-  else if (/^carrier[-_]?/i.test(name) && !/test|staging|stg|dev|local/i.test(name)) rank += 40;
-  else if (/carrier/i.test(name) && !/test|staging|stg|dev|local/i.test(name)) rank += 20;
-  else if (/carrier/i.test(name)) rank += 5;
-  if (isProductionMcpUrl(url)) rank += 50;
-  else if (isCarrierMcpHost(url)) rank += 25;
-  return rank;
-}
-function scanMcpServers(servers) {
-  if (!servers || typeof servers !== "object") return null;
-  let best = null;
-  for (const [name, entry] of Object.entries(servers)) {
-    if (!/carrier/i.test(name) && !(typeof entry?.url === "string" && /carrier\.llc/i.test(entry.url))) {
-      continue;
-    }
-    const url = typeof entry?.url === "string" ? entry.url : "";
-    const rank = rankHit(name, url);
-    if (rank < 20 && !isCarrierMcpHost(url)) {
-      continue;
-    }
-    const urlMatches = isProductionMcpUrl(url);
-    const hit = {
-      registered: true,
-      urlMatches,
-      detail: url ? `${name}: ${url}` : `${name}: ${entry?.command ?? "configured"}`,
-      rank
-    };
-    if (!best || hit.rank > best.rank) best = hit;
-  }
-  return best;
-}
-async function probeMcpFromConfig() {
-  const candidates = [
-    join6(homedir3(), ".claude.json"),
-    join6(claudeHome(), "settings.json"),
-    join6(claudeHome(), ".mcp.json"),
-    join6(process.cwd(), ".mcp.json")
-  ];
-  let best = null;
-  let configSeen = false;
-  for (const file of candidates) {
-    if (!await exists(file)) continue;
-    try {
-      const json = JSON.parse(await readFile(file, "utf8"));
-      configSeen = true;
-      const direct = scanMcpServers(json.mcpServers);
-      if (direct && (!best || direct.rank > best.rank)) best = direct;
-      if (json.projects) {
-        for (const proj of Object.values(json.projects)) {
-          const hit = scanMcpServers(proj?.mcpServers);
-          if (hit && (!best || hit.rank > best.rank)) best = hit;
-        }
-      }
-    } catch {
-    }
-  }
-  if (!best) return { hit: null, configSeen };
-  return {
-    hit: { registered: best.registered, urlMatches: best.urlMatches, detail: best.detail },
-    configSeen
-  };
-}
-async function probeMcpRegistration() {
-  const { hit, configSeen } = await probeMcpFromConfig();
-  if (hit) return hit;
-  if (configSeen) {
-    return {
-      registered: false,
-      urlMatches: false,
-      detail: "carrier not registered (no production MCP URL in Claude config)"
-    };
-  }
-  const claudeFound = await which("claude");
-  if (!claudeFound) {
-    return {
-      registered: false,
-      urlMatches: false,
-      detail: "claude CLI not on PATH"
-    };
-  }
-  const r = await run("claude", ["mcp", "list"], { timeoutMs: 5e3 });
-  const out = `${r.stdout}
-${r.stderr}`;
-  if (!r.ok && !out.trim()) {
-    return { registered: false, urlMatches: false, detail: "claude mcp list failed or timed out" };
-  }
-  if (/timeout after/i.test(r.stderr) && !/carrier/i.test(out)) {
-    return {
-      registered: false,
-      urlMatches: false,
-      detail: "claude mcp list timed out \u2014 run `claude mcp list` manually"
-    };
-  }
-  const lines = out.split("\n").map((l) => l.trim()).filter(Boolean);
-  const carrierLine = lines.find((l) => new RegExp(`^${MCP_NAME}\\s*:`, "i").test(l)) ?? lines.find((l) => /carrier/i.test(l) && /mcp\.carrier\.llc/i.test(l));
-  if (!carrierLine) {
-    return { registered: false, urlMatches: false, detail: "carrier not in claude mcp list" };
-  }
-  const urlMatches = lineMentionsProductionMcp(carrierLine);
-  return { registered: true, urlMatches, detail: carrierLine.slice(0, 200) };
-}
-function buildNextSteps(s) {
-  const steps = [];
-  if (!s.claudeFound) {
-    steps.push("Install Claude Code (https://claude.ai/code), then re-run: carrier plugin install");
-  } else if (!s.pluginInstalled) {
-    steps.push("Install the Carrier plugin: carrier plugin install");
-  } else if (!s.mcpRegistered) {
-    steps.push(`Register the zero-cred MCP URL: claude mcp add --transport http ${MCP_NAME} ${MCP_URL}`);
-  } else if (!s.mcpUrlMatches) {
-    steps.push(`Update MCP to production URL: claude mcp add --transport http ${MCP_NAME} ${MCP_URL}`);
-  }
-  if (s.mcpRegistered || s.pluginInstalled) {
-    steps.push(
-      "Talk to your fleet in Claude \u2014 first tool call opens Clerk OAuth (Google / GitHub / email). No API token needed."
-    );
-  } else {
-    steps.push("Create a free account (browser): carrier open signup");
-    steps.push("Or sign in: carrier open signin");
-  }
-  if (!s.tokenPresent) {
-    steps.push(
-      "Optional headless key: Console \u2192 Settings \u2192 API Keys (ak_\u2026) then export CARRIER_API_KEY=ak_\u2026 for `carrier ask`."
-    );
-  } else {
-    steps.push('Try a natural-language fleet query: carrier ask "show fleet health"');
-  }
-  steps.push("Scaffold a white-label storefront anytime: carrier site create");
-  return steps;
-}
-async function gatherStatus() {
-  const [plugin2, mcp, claudeFound] = await Promise.all([
-    pluginStatus(),
-    probeMcpRegistration(),
-    which("claude")
-  ]);
-  const token = detectEnvToken();
-  let authMode = "none";
-  if (token.kind === "api-key") authMode = "api-key";
-  else if (token.kind === "ocs-token") authMode = "ocs-token";
-  else if (mcp.registered || plugin2.installed) authMode = "oauth-first-use";
-  const base = {
-    pluginInstalled: plugin2.installed,
-    pluginVersion: plugin2.version,
-    pluginDir: plugin2.dir,
-    claudeFound,
-    mcpRegistered: mcp.registered,
-    mcpUrlMatches: mcp.urlMatches,
-    mcpDetail: mcp.detail,
-    tokenPresent: token.present,
-    tokenKind: token.kind,
-    authMode
-  };
-  return { ...base, nextSteps: buildNextSteps(base) };
+    "When you first talk to Carrier in your MCP client, the browser opens",
+    "sign-in/sign-up. After authorize, tools work. Headless: carrier login,",
+    "or reuse compatible Claude Code Carrier OAuth. No manual key export needed.",
+    "To export CARRIER_API_KEY into a child terminal: carrier exec -- bash.",
+    `For unattended CI use an org key from ${CONSOLE_URL} \u2192 Settings \u2192 API Keys.`
+  ].join("\n");
+}
+function formatStatusBlock(st) {
+  const yn = (ok2, yes = "yes", no = "no") => ok2 ? pc.green(yes) : pc.yellow(no);
+  const authLabel = st.authMode === "oauth" ? pc.green("OAuth session ready for CLI / Ask the fleet") : st.authMode === "oauth-first-use" ? pc.cyan("OAuth on first use (no token needed)") : st.authMode === "api-key" ? pc.green("org API key in env (CARRIER_API_KEY)") : st.authMode === "ocs-token" ? pc.green("OCS token in env") : pc.yellow("not ready \u2014 install MCP or open sign-up");
+  return [
+    `Claude Code:   ${yn(st.claudeFound, "found", "not on PATH")}`,
+    `Plugin:        ${st.pluginInstalled ? pc.green(`installed v${st.pluginVersion ?? "?"}`) : pc.yellow("not installed")}`,
+    `MCP registered:${st.mcpRegistered ? pc.green(" yes") : pc.yellow(" no")}${st.mcpDetail ? pc.dim(`  (${st.mcpDetail})`) : ""}`,
+    `MCP URL:       ${st.mcpUrlMatches ? pc.green(MCP_URL) : pc.yellow("not production / missing")}`,
+    `Auth path:     ${authLabel}`,
+    `Headless token:${st.tokenPresent ? pc.green(` ${st.tokenKind}`) : pc.dim(" none (optional)")}`
+  ].join("\n");
+}
+function formatNextSteps(st) {
+  return st.nextSteps.map((s, i) => `  ${i + 1}. ${s}`).join("\n");
 }
-function resolveCliToken() {
-  const api = process.env.CARRIER_API_KEY?.trim() || process.env.CARRIER_ORG_API_KEY?.trim() || "";
-  if (api) return api;
-  const ocs = process.env.ESIMVAULT_API_TOKEN?.trim() || process.env.CARRIER_OCS_API_TOKEN?.trim() || "";
-  return ocs || null;
+function formatNlExamples() {
+  return FLEET_NL_EXAMPLES.map((e) => `  \u2022 ${pc.bold(e.label)}: "${e.prompt}"`).join("\n");
+}
+function accountLinksNote() {
+  return [
+    `Sign up:     ${SIGN_UP_URL}`,
+    `Sign in:     ${SIGN_IN_URL}`,
+    `Console:     ${CONSOLE_URL}`,
+    `Onboarding:  ${ONBOARDING_URL}`,
+    `MCP home:    https://mcp.carrier.llc`
+  ].join("\n");
+}
+function withNextStep(errorMsg, next) {
+  return [errorMsg, "", "What to do next:", ...next.map((s) => `  \u2192 ${s}`)].join("\n");
 }
 
 // src/cli/lib/ask.ts
@@ -863,7 +1185,7 @@ function parseRpcBody(raw) {
   return JSON.parse(dataLine.slice(5).trim());
 }
 async function callMcpTool(tool, args, opts = {}) {
-  const token = resolveCliToken() ?? await getAccessToken();
+  const token = (resolveExplicitCredential({ allowOcs: true }) ?? await resolveCredential({ allowOcs: true }))?.token;
   if (!token) {
     return {
       ok: false,
@@ -890,7 +1212,7 @@ async function callMcpTool(tool, args, opts = {}) {
   });
   const signal = controller.signal;
   try {
-    return await Promise.race([
+    const result = await Promise.race([
       (async () => {
         const initRes = await fetch(MCP_URL, {
           method: "POST",
@@ -973,6 +1295,7 @@ async function callMcpTool(tool, args, opts = {}) {
       })(),
       deadline
     ]);
+    return redactCredential(result, token);
   } catch (e) {
     if (isTimeoutish(e)) {
       const secs = Math.round(timeoutMs / 1e3);
@@ -990,7 +1313,7 @@ async function callMcpTool(tool, args, opts = {}) {
         )
       };
     }
-    const msg = e instanceof Error ? e.message : String(e);
+    const msg = redact((e instanceof Error ? e.message : String(e)).split(token).join("***"));
     return {
       ok: false,
       text: withNextStep(`Could not reach MCP: ${msg}`, [
@@ -1063,9 +1386,6 @@ var DEFAULT_ERROR_HINTS2 = [
   "Re-check the arguments: carrier <domain> <command> --help",
   "Or open Claude and ask there with full tool routing"
 ];
-function resolveApiKey() {
-  return process.env.CARRIER_API_KEY?.trim() || process.env.CARRIER_ORG_API_KEY?.trim() || null;
-}
 function ocsTokenOnly() {
   return Boolean(
     process.env.ESIMVAULT_API_TOKEN?.trim() || process.env.CARRIER_OCS_API_TOKEN?.trim()
@@ -1106,8 +1426,15 @@ function bodyText(raw) {
     return trimmed;
   }
 }
+function orgNotConnected(raw) {
+  try {
+    return JSON.parse(raw).error_code === "org_not_connected";
+  } catch {
+    return false;
+  }
+}
 async function callRestEndpoint(method, path, args, opts = {}) {
-  const token = resolveApiKey() ?? await getAccessToken();
+  const token = (await resolveCredential())?.token;
   if (!token) {
     return {
       ok: false,
@@ -1151,7 +1478,7 @@ async function callRestEndpoint(method, path, args, opts = {}) {
       signal: controller.signal,
       body: sendsBody ? JSON.stringify(rest) : void 0
     });
-    const raw = await res.text();
+    const raw = (await res.text()).split(token).join("***");
     if (res.status === 202) {
       let confirmToken;
       let expires;
@@ -1187,6 +1514,15 @@ async function callRestEndpoint(method, path, args, opts = {}) {
         )
       };
     }
+    if (res.status === 409 && orgNotConnected(raw)) {
+      return {
+        ok: false,
+        text: withNextStep(redact(bodyText(raw).slice(0, 500)), [
+          "Switch back: sign in again with `carrier login` and pick your connected organization",
+          "Or use an org API key (ak_\u2026) from that organization: export CARRIER_API_KEY=\u2026"
+        ])
+      };
+    }
     if (!res.ok) {
       return {
         ok: false,
@@ -1209,7 +1545,7 @@ async function callRestEndpoint(method, path, args, opts = {}) {
         ])
       };
     }
-    const msg = e instanceof Error ? e.message : String(e);
+    const msg = (e instanceof Error ? e.message : String(e)).split(token).join("***");
     return {
       ok: false,
       text: withNextStep(redact(`Could not reach the Carrier API: ${msg}`), [
@@ -1718,7 +2054,7 @@ function record(value) {
 }
 
 // src/cli/lib/resend.ts
-import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
+import { createHash as createHash3, randomBytes as randomBytes2 } from "crypto";
 import { createServer as createServer2 } from "http";
 var RESEND_API = "https://api.resend.com";
 var RESEND_API_KEYS_URL = "https://resend.com/api-keys";
@@ -1736,7 +2072,7 @@ function base64url2(input) {
 }
 function pkcePair2() {
   const verifier = base64url2(randomBytes2(64));
-  return { verifier, challenge: base64url2(createHash2("sha256").update(verifier).digest()) };
+  return { verifier, challenge: base64url2(createHash3("sha256").update(verifier).digest()) };
 }
 function buildAuthorizeUrl(opts) {
   const url = new URL(`${RESEND_API}/oauth/authorize`);
@@ -1884,9 +2220,9 @@ async function startLoopbackServer() {
       error ? { ok: false, reason: `Resend returned "${error}".` } : code ? { ok: true, code, reason: state ?? void 0 } : { ok: false, reason: "Resend sent no authorization code." }
     );
   });
-  await new Promise((resolve3, reject) => {
+  await new Promise((resolve5, reject) => {
     server.once("error", reject);
-    server.listen(0, REDIRECT_HOST, resolve3);
+    server.listen(0, REDIRECT_HOST, resolve5);
   });
   const port = server.address().port;
   const redirectUri = `http://${REDIRECT_HOST}:${port}${REDIRECT_PATH}`;
@@ -1894,12 +2230,12 @@ async function startLoopbackServer() {
     redirectUri,
     close: () => server.close(),
     waitForCode(state, timeoutMs) {
-      return new Promise((resolve3) => {
+      return new Promise((resolve5) => {
         const done = (r) => {
           clearTimeout(timer);
           resolveCode = null;
           server.close();
-          resolve3(r);
+          resolve5(r);
         };
         const timer = setTimeout(
           () => done({ ok: false, reason: "Timed out waiting for the browser." }),
@@ -2173,6 +2509,217 @@ function buildDashScreen(domain, payload) {
   }
 }
 
+// src/cli/lib/status.ts
+import { homedir as homedir4 } from "os";
+import { join as join8 } from "path";
+
+// src/cli/lib/mcp-url.ts
+var PRODUCTION_MCP_URL = "https://mcp.carrier.llc/mcp";
+var PRODUCTION_HOST = "mcp.carrier.llc";
+var URL_TOKEN = /https?:\/\/[^\s"'<>)]+/g;
+function pathWithoutTrailingSlash(pathname) {
+  let end = pathname.length;
+  while (end > 1 && pathname.charCodeAt(end - 1) === 47) end -= 1;
+  return pathname.slice(0, end);
+}
+function parseHttpUrl(value) {
+  try {
+    const parsed = new URL(value);
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function isProductionMcpUrl(value) {
+  if (value === PRODUCTION_MCP_URL) return true;
+  const parsed = parseHttpUrl(value);
+  if (!parsed || parsed.protocol !== "https:" || parsed.hostname !== PRODUCTION_HOST) return false;
+  return pathWithoutTrailingSlash(parsed.pathname) === "/mcp";
+}
+function isCarrierMcpHost(value) {
+  const parsed = parseHttpUrl(value);
+  return parsed?.protocol === "https:" && parsed.hostname === PRODUCTION_HOST;
+}
+function trimTrailingPunctuation(token) {
+  let end = token.length;
+  while (end > 0) {
+    const code = token.charCodeAt(end - 1);
+    if (code !== 46 && code !== 44 && code !== 59 && code !== 58) break;
+    end -= 1;
+  }
+  return token.slice(0, end);
+}
+function lineMentionsProductionMcp(line) {
+  const tokens = line.match(URL_TOKEN);
+  if (!tokens) return false;
+  for (const token of tokens) {
+    if (isProductionMcpUrl(trimTrailingPunctuation(token))) return true;
+  }
+  return false;
+}
+
+// src/cli/lib/status.ts
+function rankHit(name, url) {
+  let rank = 0;
+  if (name.toLowerCase() === MCP_NAME) rank += 100;
+  else if (/^carrier[-_]?/i.test(name) && !/test|staging|stg|dev|local/i.test(name)) rank += 40;
+  else if (/carrier/i.test(name) && !/test|staging|stg|dev|local/i.test(name)) rank += 20;
+  else if (/carrier/i.test(name)) rank += 5;
+  if (isProductionMcpUrl(url)) rank += 50;
+  else if (isCarrierMcpHost(url)) rank += 25;
+  return rank;
+}
+function scanMcpServers(servers) {
+  if (!servers || typeof servers !== "object") return null;
+  let best = null;
+  for (const [name, entry] of Object.entries(servers)) {
+    if (!/carrier/i.test(name) && !(typeof entry?.url === "string" && /carrier\.llc/i.test(entry.url))) {
+      continue;
+    }
+    const url = typeof entry?.url === "string" ? entry.url : "";
+    const rank = rankHit(name, url);
+    if (rank < 20 && !isCarrierMcpHost(url)) {
+      continue;
+    }
+    const urlMatches = isProductionMcpUrl(url);
+    const hit = {
+      registered: true,
+      urlMatches,
+      detail: url ? `${name}: ${url}` : `${name}: ${entry?.command ?? "configured"}`,
+      rank
+    };
+    if (!best || hit.rank > best.rank) best = hit;
+  }
+  return best;
+}
+async function probeMcpFromConfig() {
+  const candidates = [
+    join8(homedir4(), ".claude.json"),
+    join8(claudeHome(), "settings.json"),
+    join8(claudeHome(), ".mcp.json"),
+    join8(process.cwd(), ".mcp.json")
+  ];
+  let best = null;
+  let configSeen = false;
+  for (const file of candidates) {
+    if (!await exists(file)) continue;
+    try {
+      const json = JSON.parse(await readFile(file, "utf8"));
+      configSeen = true;
+      const direct = scanMcpServers(json.mcpServers);
+      if (direct && (!best || direct.rank > best.rank)) best = direct;
+      if (json.projects) {
+        for (const proj of Object.values(json.projects)) {
+          const hit = scanMcpServers(proj?.mcpServers);
+          if (hit && (!best || hit.rank > best.rank)) best = hit;
+        }
+      }
+    } catch {
+    }
+  }
+  if (!best) return { hit: null, configSeen };
+  return {
+    hit: { registered: best.registered, urlMatches: best.urlMatches, detail: best.detail },
+    configSeen
+  };
+}
+async function probeMcpRegistration() {
+  const { hit, configSeen } = await probeMcpFromConfig();
+  if (hit) return hit;
+  if (configSeen) {
+    return {
+      registered: false,
+      urlMatches: false,
+      detail: "carrier not registered (no production MCP URL in Claude config)"
+    };
+  }
+  const claudeFound = await which("claude");
+  if (!claudeFound) {
+    return {
+      registered: false,
+      urlMatches: false,
+      detail: "claude CLI not on PATH"
+    };
+  }
+  const r = await run("claude", ["mcp", "list"], { timeoutMs: 5e3 });
+  const out = `${r.stdout}
+${r.stderr}`;
+  if (!r.ok && !out.trim()) {
+    return { registered: false, urlMatches: false, detail: "claude mcp list failed or timed out" };
+  }
+  if (/timeout after/i.test(r.stderr) && !/carrier/i.test(out)) {
+    return {
+      registered: false,
+      urlMatches: false,
+      detail: "claude mcp list timed out \u2014 run `claude mcp list` manually"
+    };
+  }
+  const lines = out.split("\n").map((l) => l.trim()).filter(Boolean);
+  const carrierLine = lines.find((l) => new RegExp(`^${MCP_NAME}\\s*:`, "i").test(l)) ?? lines.find((l) => /carrier/i.test(l) && /mcp\.carrier\.llc/i.test(l));
+  if (!carrierLine) {
+    return { registered: false, urlMatches: false, detail: "carrier not in claude mcp list" };
+  }
+  const urlMatches = lineMentionsProductionMcp(carrierLine);
+  return { registered: true, urlMatches, detail: carrierLine.slice(0, 200) };
+}
+function buildNextSteps(s) {
+  const steps = [];
+  if (!s.claudeFound) {
+    steps.push("Install Claude Code (https://claude.ai/code), then re-run: carrier plugin install");
+  } else if (!s.pluginInstalled) {
+    steps.push("Install the Carrier plugin: carrier plugin install");
+  } else if (!s.mcpRegistered) {
+    steps.push(`Register the zero-cred MCP URL: claude mcp add --transport http ${MCP_NAME} ${MCP_URL}`);
+  } else if (!s.mcpUrlMatches) {
+    steps.push(`Update MCP to production URL: claude mcp add --transport http ${MCP_NAME} ${MCP_URL}`);
+  }
+  if (s.mcpRegistered || s.pluginInstalled) {
+    steps.push(
+      "Talk to your fleet in Claude \u2014 first tool call opens Clerk OAuth (Google / GitHub / email). No API token needed."
+    );
+  } else {
+    steps.push("Create a free account (browser): carrier open signup");
+    steps.push("Or sign in: carrier open signin");
+  }
+  if (!s.tokenPresent) {
+    steps.push(
+      "Headless: carrier login, or refresh compatible Carrier OAuth in Claude. Export to a child terminal: carrier exec -- bash."
+    );
+  } else {
+    steps.push('Try a natural-language fleet query: carrier ask "show fleet health"');
+  }
+  steps.push("Scaffold a white-label storefront anytime: carrier site create");
+  return steps;
+}
+async function gatherStatus() {
+  const [plugin2, mcp, claudeFound] = await Promise.all([
+    pluginStatus(),
+    probeMcpRegistration(),
+    which("claude")
+  ]);
+  const credential = await resolveCredential({ allowOcs: true });
+  const token = { present: !!credential, kind: credential?.kind ?? "none" };
+  let authMode = "none";
+  if (token.kind === "oauth") authMode = "oauth";
+  else if (token.kind === "api-key") authMode = "api-key";
+  else if (token.kind === "ocs-token") authMode = "ocs-token";
+  else if (mcp.registered || plugin2.installed) authMode = "oauth-first-use";
+  const base = {
+    pluginInstalled: plugin2.installed,
+    pluginVersion: plugin2.version,
+    pluginDir: plugin2.dir,
+    claudeFound,
+    mcpRegistered: mcp.registered,
+    mcpUrlMatches: mcp.urlMatches,
+    mcpDetail: mcp.detail,
+    tokenPresent: token.present,
+    tokenKind: token.kind,
+    authMode
+  };
+  return { ...base, nextSteps: buildNextSteps(base) };
+}
+
 // src/cli/lib/home.ts
 import * as p from "@clack/prompts";
 import pc2 from "picocolors";
@@ -2203,7 +2750,7 @@ async function runHome(opts) {
   let st = await showHomeStatus();
   p.note(oauthFirstUseNote(), "How auth works");
   for (; ; ) {
-    const hasToken = !!resolveCliToken();
+    const hasToken = !!await resolveCredential({ allowOcs: true });
     const choice = await p.select({
       message: "What do you want to do?",
       options: [
@@ -2239,8 +2786,8 @@ async function runHome(opts) {
         },
         {
           value: "ask",
-          label: hasToken ? "Ask the fleet (carrier ask)" : "Ask the fleet (needs CARRIER_API_KEY)",
-          hint: hasToken ? "Uses env token" : "Optional headless path"
+          label: hasToken ? "Ask the fleet (carrier ask)" : "Ask the fleet (sign-in needed)",
+          hint: hasToken ? "Uses Carrier credential" : "Run carrier login"
         },
         {
           value: "site",
@@ -2278,8 +2825,8 @@ async function runHome(opts) {
         p.log.info("Link OCS credentials (BYO) or finish managed setup, then use Claude MCP.");
         break;
       case "ask": {
-        if (!resolveCliToken()) {
-          p.log.warn("No CARRIER_API_KEY / OCS token in env.");
+        if (!await resolveCredential({ allowOcs: true })) {
+          p.log.warn("No usable Carrier credential. Run carrier login or refresh Carrier OAuth in Claude.");
           p.note(
             [
               "Interactive (recommended): install MCP, open Claude, ask in plain English.",
@@ -2314,6 +2861,68 @@ async function runHome(opts) {
   }
 }
 
+// src/cli/lib/credential-exec.ts
+import { spawn as spawn3 } from "child_process";
+import { createHash as createHash4 } from "crypto";
+import { constants as constants3 } from "os";
+import { writeSync, fstatSync } from "fs";
+async function credentialHandoff() {
+  try {
+    const stat = fstatSync(3);
+    if (!stat.isFIFO() && !stat.isSocket()) throw new Error("unsafe fd");
+    const credential = await resolveCredential();
+    if (!credential) throw new Error("no credential");
+    const fields = [credential.token, credential.origin ?? "explicit", String(credential.expiresAt ?? 0), credential.kind === "oauth" ? createHash4("sha256").update(credential.token).digest("hex") : "-", credential.binding ?? "-"];
+    if (fields.some((field) => /[\r\n\0]/.test(field))) throw new Error("unsafe field");
+    const data = Buffer.from(`${fields.join("\n")}
+`);
+    let offset = 0;
+    while (offset < data.length) offset += writeSync(3, data, offset, data.length - offset);
+    return 0;
+  } catch {
+    console.error("Carrier credential handoff unavailable; use the static shell integration with a usable owner session.");
+    return 1;
+  }
+}
+async function credentialExec(command, args) {
+  const credential = await resolveCredential();
+  if (!credential) {
+    console.error("No usable Carrier credential. Run carrier login, or refresh Carrier OAuth in Claude. See carrier exec --help.");
+    return 1;
+  }
+  const env = { ...process.env, CARRIER_API_KEY: credential.token };
+  if (credential.kind === "oauth") {
+    env.CARRIER_OAUTH_HANDOFF = createHash4("sha256").update(credential.token).digest("hex");
+    env.CARRIER_OAUTH_ORIGIN = credential.origin;
+    env.CARRIER_OAUTH_BINDING = credential.binding;
+    env.CARRIER_OAUTH_EXPIRES_AT = String(credential.expiresAt);
+  } else {
+    delete env.CARRIER_OAUTH_HANDOFF;
+    delete env.CARRIER_OAUTH_BINDING;
+    delete env.CARRIER_OAUTH_ORIGIN;
+    delete env.CARRIER_OAUTH_EXPIRES_AT;
+  }
+  return new Promise((resolve5) => {
+    const child = spawn3(command, args, { env, stdio: "inherit", shell: false });
+    const forward = (signal) => {
+      child.kill(signal);
+    };
+    const signals = ["SIGINT", "SIGTERM", "SIGHUP"];
+    const handlers = signals.map((signal) => () => forward(signal));
+    signals.forEach((signal, i) => process.on(signal, handlers[i]));
+    const cleanup = () => signals.forEach((signal, i) => process.removeListener(signal, handlers[i]));
+    child.once("error", () => {
+      cleanup();
+      console.error("Could not start the requested command.");
+      resolve5(1);
+    });
+    child.once("close", (code, signal) => {
+      cleanup();
+      resolve5(code ?? (signal ? 128 + (constants3.signals[signal] ?? 1) : 1));
+    });
+  });
+}
+
 // src/cli/lib/signup.ts
 var DEFAULT_MAX_CODE_ATTEMPTS = 3;
 function parseEnvironment(raw) {
@@ -5577,7 +6186,7 @@ async function interactiveSiteCreate() {
     defaultValue: "./storefront"
   });
   if (p3.isCancel(dir)) return;
-  const target = resolve2(dir);
+  const target = resolve4(dir);
   if (await exists(target)) {
     const go = await p3.confirm({ message: `${target} exists \u2014 write into it anyway?`, initialValue: false });
     if (p3.isCancel(go) || !go) {
@@ -5589,6 +6198,20 @@ async function interactiveSiteCreate() {
   p3.outro(pc4.green(`Scaffolded. cd ${dir} && pnpm install && pnpm dev`));
 }
 var program = new Command();
+program.command("credential-handoff").description("Private FD protocol for the explicitly sourced static shell integration; never stdout.").action(async () => {
+  process.exitCode = await credentialHandoff();
+});
+program.command("shell-path").description("Print the static integration file path, without credentials or startup edits.").argument("<shell>", "bash or zsh").action((shell) => {
+  if (shell !== "bash" && shell !== "zsh") {
+    console.error("Supported shells: bash, zsh.");
+    process.exitCode = 1;
+    return;
+  }
+  console.log(resolve4(packageRoot(), "shell", `carrier.${shell}`));
+});
+program.command("exec").description("Run a command/child shell with CARRIER_API_KEY securely in its environment.").argument("<command>", "Executable to start (use -- before the command)").argument("[args...]", "Arguments passed without shell interpolation").addHelpText("after", "\nExamples: carrier exec -- bash\n          carrier exec -- your-headless-job\nOAuth snapshots expire; Carrier commands refresh their owner per call. Exit the child shell after logout. This never changes the existing parent shell or prints a token.").action(async (command, args) => {
+  process.exitCode = await credentialExec(command, args);
+});
 program.name("carrier").description(
   [
     "Carrier CLI \u2014 status, OAuth-ready MCP install, storefront scaffold, and fleet control.",
@@ -5608,7 +6231,7 @@ program.command("init").description("Interactive home: status, install plugin+MC
   if (o.yes) {
     await doPluginInstall();
     const brand = CARRIER_BRAND;
-    const target = resolve2(o.dir);
+    const target = resolve4(o.dir);
     if (await exists(target)) {
       info(pc4.yellow(`${target} exists \u2014 writing into it (--yes).`));
     }
@@ -5633,7 +6256,7 @@ program.command("init").description("Interactive home: status, install plugin+MC
     printStatus(st);
     await doPluginInstall();
     const brand = await promptBrand(CARRIER_BRAND);
-    const target = resolve2(o.dir);
+    const target = resolve4(o.dir);
     if (await exists(target)) {
       const go = await p3.confirm({ message: `${target} exists \u2014 write into it anyway?`, initialValue: false });
       if (p3.isCancel(go) || !go) {
@@ -5674,7 +6297,7 @@ program.command("init").description("Interactive home: status, install plugin+MC
     onInstall: doPluginInstall,
     onSiteCreate: async () => {
       const brand = await promptBrand(CARRIER_BRAND);
-      const target = resolve2(o.dir);
+      const target = resolve4(o.dir);
       if (await exists(target)) {
         const go = await p3.confirm({ message: `${target} exists \u2014 write into it anyway?`, initialValue: false });
         if (p3.isCancel(go) || !go) {
@@ -5749,7 +6372,7 @@ program.command("login").description("Sign in from this terminal. Opens a browse
       return;
     }
     p3.note(
-      [`Scope: ${r.scope ?? "read write"}`, "", "Try it: carrier intelligence fleet-health"].join("\n"),
+      [`Scope: ${r.scope ?? "read write"}`, "", "Try it: carrier intelligence fleet-health", 'Existing shell: source "$(carrier shell-path bash)"; carrier_auth_export', "Child terminal: carrier exec -- bash"].join("\n"),
       "Signed in"
     );
   } catch (e) {
@@ -6117,7 +6740,7 @@ site.command("create [dir]").description("Scaffold a white-labeled storefront fr
   } else if (!o.yes) {
     brand = await promptBrand(CARRIER_BRAND);
   }
-  const target = resolve2(dir ?? "./storefront");
+  const target = resolve4(dir ?? "./storefront");
   if (await exists(target)) {
     const go = await p3.confirm({ message: `${target} exists \u2014 write into it anyway?`, initialValue: false });
     if (p3.isCancel(go) || !go) {
@@ -6142,7 +6765,7 @@ site.command("create [dir]").description("Scaffold a white-labeled storefront fr
 site.command("deploy [dir]").description("Build + deploy a storefront to whichever host is available on this box.").option("--name <name>", "Project/worker name (defaults from brand)").option("--force", "Deploy under the scaffold default name anyway (acknowledges the overwrite risk)").option(`--target <target>`, `Force a host: ${TARGET_IDS.join(" | ")}`).option("--no-secrets", "Skip staging runtime secrets on the host").option("--clerk", "Provision and configure Clerk before building").option("--no-verify", "Skip the post-deploy check that the site actually serves").option("--autofix-agent", "On an unrecognised failure, print an agent-ready diagnosis bundle").option("--domain", "Route the brand domain to the deployment (Cloudflare provisions DNS + cert)").action(
   async (dir, o) => {
     header();
-    const target = resolve2(dir ?? "./storefront");
+    const target = resolve4(dir ?? "./storefront");
     if (o.target && !isTargetId(o.target)) {
       fail(`Unknown target "${o.target}".`, [`Supported: ${TARGET_IDS.join(", ")}`]);
       process.exitCode = 1;
@@ -6192,7 +6815,7 @@ site.command("publish").description("Publish a Carrier-hosted storefront. Does n
 });
 site.command("targets [dir]").description("Show which deploy hosts are installed, logged in, and ready.").action(async (dir) => {
   header();
-  const storefront = resolve2(dir ?? "./storefront");
+  const storefront = resolve4(dir ?? "./storefront");
   const statuses = await probeAll(storefront);
   const ranked = rankTargets(statuses);
   const rows2 = statuses.map((s) => {
@@ -6209,7 +6832,7 @@ site.command("targets [dir]").description("Show which deploy hosts are installed
 site.command("clerk [dir]").description("Create or discover a Clerk instance and configure it for the storefront.").option("--name <name>", "Application name (defaults from brand)").option("--production", "Also create a production instance (Platform API only)").option("--no-create", "Never create a new application; only reuse existing keys").option("--url <url>", "Deployed URL to whitelist as an origin/redirect").action(
   async (dir, o) => {
     header();
-    const storefront = resolve2(dir ?? "./storefront");
+    const storefront = resolve4(dir ?? "./storefront");
     try {
       const brand = await loadStorefrontBrand(storefront, o.name ? { name: o.name } : void 0);
       const result = await provisionClerk({
@@ -6255,7 +6878,7 @@ site.command("clerk [dir]").description("Create or discover a Clerk instance and
 site.command("email [dir]").description("Connect Resend in the browser so the storefront can email QR codes.").option("--no-browser", "Never open a browser; print the manual steps instead").option("--yes", "Non-interactive: skip rather than wait for a human").option("--timeout <seconds>", "How long to wait for the browser approval", "180").action(
   async (dir, o) => {
     header();
-    const storefront = resolve2(dir ?? "./storefront");
+    const storefront = resolve4(dir ?? "./storefront");
     const interactive = process.stdin.isTTY === true && o.yes !== true;
     try {
       const brand = await loadStorefrontBrand(storefront);
@@ -6313,7 +6936,7 @@ site.command("email [dir]").description("Connect Resend in the browser so the st
 );
 site.command("logo [dir]").description("Generate a storefront logo (SVG always; PNG if an image key is on this box or Carrier).").action(async (dir) => {
   header();
-  const target = resolve2(dir ?? "./storefront");
+  const target = resolve4(dir ?? "./storefront");
   try {
     const brand = await loadStorefrontBrand(target);
     const logo = await writeStorefrontLogo(target, brand);