@creatornader/agent-bridge 0.6.4 → 0.7.0

package/dist/cli.js

@@ -17,7 +17,7 @@ import {
 } from "./chunk-UKFRCP6X.js";
 import {
   createClientRuntime
-} from "./chunk-DBQ5PNQW.js";
+} from "./chunk-FDDLNAOY.js";
 import {
   BridgeHttpError,
   HttpBridgeStore
@@ -27,7 +27,7 @@ import {
   SyncingBridgeStore,
   edgeScopeKey,
   inspectEdgeScopeReadOnly
-} from "./chunk-HIYXPNBE.js";
+} from "./chunk-J6GHXVHC.js";
 import {
   NativeDrBundleError,
   NativeDrBundleReader,
@@ -42,8 +42,8 @@ import {
   verifyNativeDrBundle,
   verifyPostgresNativeDrArtifacts,
   writeNativeDrBundle
-} from "./chunk-H2UAY6AV.js";
-import "./chunk-NSQE6YRP.js";
+} from "./chunk-SHJGICQ5.js";
+import "./chunk-SBVZVXGK.js";
 import {
   PrivatePathError,
   createPrivateDirectoryAccessCache,
@@ -1584,6 +1584,31 @@ var defaultExecutor = (command, args, context) => spawnSync2(command, args, {
   cwd: context?.cwd,
   env: context?.env
 });
+function validateLoopbackMcpUrl(value, field = "--mcp-url") {
+  const text4 = strictText(value, field, 2048);
+  let parsed;
+  try {
+    parsed = new URL(text4);
+  } catch {
+    throw new Error(`${field} must be a loopback HTTP MCP URL`);
+  }
+  if (parsed.protocol !== "http:" || parsed.username || parsed.password || parsed.search || parsed.hash || !["127.0.0.1", "localhost", "[::1]"].includes(parsed.hostname) || !parsed.port || parsed.pathname !== "/mcp") {
+    throw new Error(`${field} must be a loopback HTTP MCP URL ending in /mcp`);
+  }
+  return parsed.toString();
+}
+function managedClientTarget(metadata) {
+  return metadata.version === 2 ? metadata.target : {
+    version: 1,
+    transport: "stdio",
+    command: metadata.launch.command,
+    args: [...metadata.launch.args],
+    scope: metadata.launch.scope
+  };
+}
+function targetLaunchProjection(target) {
+  return target.transport === "stdio" ? { command: target.command, args: [...target.args], scope: target.scope } : { command: target.url, args: [], scope: target.scope };
+}
 function safeComponent2(value) {
   const readable = value.replace(/[^A-Za-z0-9._-]+/g, "_").slice(0, 48) || "client";
   const suffix = createHash3("sha256").update(value).digest("hex").slice(0, 12);
@@ -1632,8 +1657,8 @@ function expectedManagedClientMetadata(runtime2, identity2, options, env) {
     locator: clientRegistrationLocator(runtime2, scope, options, env)
   };
 }
-function exactObject(actual, expected) {
-  return isDeepStrictEqual(actual, expected);
+function exactManagedTarget(actual, expected) {
+  return actual != null && actual.schema === expected.schema && actual.runtime === expected.runtime && actual.identity === expected.identity && actual.instance === expected.instance && actual.backendConfigPath === expected.backendConfigPath && isDeepStrictEqual(actual.locator, expected.locator);
 }
 var REGISTRATION_ENV_KEYS = [
   "AGENT_BRIDGE_AGENT",
@@ -1685,6 +1710,10 @@ function safeEnvironment(value) {
   return environment;
 }
 function exactRegistration(expected, command, args, environment) {
+  const target = managedClientTarget(expected);
+  if (target.transport === "streamable-http") {
+    return command === target.url && args.length === 0 && Object.keys(environment).length === 0;
+  }
   return command === expected.launch.command && isDeepStrictEqual(args, expected.launch.args) && isDeepStrictEqual(environment, {
     AGENT_BRIDGE_AGENT: expected.identity,
     AGENT_BRIDGE_INSTANCE: expected.instance,
@@ -1776,14 +1805,29 @@ ${result.stderr}`.trim();
       "tool_timeout_sec",
       "status"
     ]);
-    const transportFields = /* @__PURE__ */ new Set(["type", "command", "args", "env", "env_vars", "cwd"]);
+    const target = managedClientTarget(expected);
+    const transportFields = transport?.type === "streamable_http" ? /* @__PURE__ */ new Set(["type", "url", "bearer_token_env_var", "http_headers", "env_http_headers"]) : /* @__PURE__ */ new Set(["type", "command", "args", "env", "env_vars", "cwd"]);
     const hasNonNullSetting = (field) => field in server && server[field] !== null;
-    if (!server || typeof server !== "object" || Array.isArray(server) || server.name !== "agent-bridge" || server.enabled !== true || !transport || typeof transport !== "object" || Array.isArray(transport) || transport.type !== "stdio") {
-      throw new Error("Codex MCP registration is not a supported stdio contract");
+    if (!server || typeof server !== "object" || Array.isArray(server) || server.name !== "agent-bridge" || server.enabled !== true || !transport || typeof transport !== "object" || Array.isArray(transport)) {
+      throw new Error("Codex MCP registration is not a supported contract");
     }
     if (Object.keys(server).some((field) => !serverFields.has(field)) || Object.keys(transport).some((field) => !transportFields.has(field)) || hasNonNullSetting("enabled_tools") || hasNonNullSetting("disabled_tools")) {
       throw new Error("Codex MCP registration contains an unsupported execution setting");
     }
+    if (transport.type === "streamable_http") {
+      if (transport.type !== "streamable_http" || transport.bearer_token_env_var !== null || transport.http_headers !== null || transport.env_http_headers !== null) {
+        throw new Error("Codex MCP registration contains an unsupported HTTP setting");
+      }
+      const url = validateLoopbackMcpUrl(transport.url, "Codex MCP URL");
+      return {
+        state: exactRegistration(expected, url, [], {}) ? "exact" : "inexact",
+        target: registrationTarget(expected),
+        observed: { state: "present", command: url, args: [], env: {} }
+      };
+    }
+    if (transport.type !== "stdio") {
+      throw new Error("Codex MCP registration is not a supported stdio contract");
+    }
     if ("cwd" in transport && transport.cwd !== null || "env_vars" in transport && (!Array.isArray(transport.env_vars) || transport.env_vars.length !== 0)) {
       throw new Error("Codex MCP registration contains an unsupported execution setting");
     }
@@ -1822,6 +1866,28 @@ ${result.stderr}`.trim();
   if (lines[0] !== "agent-bridge:" || lines[1] !== scope) {
     throw new Error("Claude Code MCP registration scope is not the recorded scope");
   }
+  const target = managedClientTarget(expected);
+  const httpTypeIndex = lines.indexOf("  Type: http", 2);
+  if (httpTypeIndex >= 0) {
+    const urlLine = lines[httpTypeIndex + 1];
+    if (!urlLine?.startsWith("  URL: ")) {
+      throw new Error("Claude Code MCP registration cannot be represented safely");
+    }
+    const url = validateLoopbackMcpUrl(urlLine.slice("  URL: ".length), "Claude Code MCP URL");
+    let index2 = httpTypeIndex + 2;
+    while (lines[index2] === "") index2 += 1;
+    if (lines[index2] !== `To remove this server, run: claude mcp remove agent-bridge -s ${expected.launch.scope}`) {
+      throw new Error("Claude Code MCP registration cannot be represented safely");
+    }
+    if (lines.slice(index2 + 1).some((line) => line !== "")) {
+      throw new Error("Claude Code MCP registration cannot be represented safely");
+    }
+    return {
+      state: target.transport === "streamable-http" && target.url === url ? "exact" : "inexact",
+      target: registrationTarget(expected),
+      observed: { state: "present", command: url, args: [], env: {} }
+    };
+  }
   const typeIndex = lines.indexOf("  Type: stdio", 2);
   if (typeIndex < 0 || lines[typeIndex + 1] !== `  Command: ${expected.launch.command}` || lines[typeIndex + 2] !== "  Args:" || lines[typeIndex + 3] !== "  Environment:") {
     if (typeIndex < 0 || lines[typeIndex + 2] !== "  Args:" || lines[typeIndex + 3] !== "  Environment:") {
@@ -1987,7 +2053,9 @@ function strictLocator(runtime2, value) {
 function strictManagedMetadata(value, runtime2, instance) {
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("managed metadata is invalid");
   const metadata = value;
-  if (Object.keys(metadata).sort().join(",") !== "backendConfigPath,identity,instance,launch,locator,runtime,schema,version" || metadata.schema !== "agent-bridge.client-management" || metadata.version !== 1 || metadata.runtime !== runtime2) throw new Error("managed metadata is invalid");
+  const version = metadata.version;
+  const expectedKeys = version === 2 ? "backendConfigPath,identity,instance,launch,locator,runtime,schema,target,version" : "backendConfigPath,identity,instance,launch,locator,runtime,schema,version";
+  if (Object.keys(metadata).sort().join(",") !== expectedKeys || metadata.schema !== "agent-bridge.client-management" || version !== 1 && version !== 2 || metadata.runtime !== runtime2) throw new Error("managed metadata is invalid");
   const identity2 = strictText(metadata.identity, "identity", 128);
   const recordedInstance = strictText(metadata.instance, "instance", 128);
   if (recordedInstance !== instance) throw new Error("managed metadata instance does not match its locator");
@@ -2008,7 +2076,7 @@ function strictManagedMetadata(value, runtime2, instance) {
   }
   const locator = strictLocator(runtime2, metadata.locator);
   const scope = launch.scope;
-  if (runtime2 !== "claude-code" && scope !== null || runtime2 === "claude-code" && scope !== locator.scope || (runtime2 === "codex" || runtime2 === "claude-code") && launch.args.length !== 0 || runtime2 === "claude-desktop" && !isAbsolute2(strictText(launch.command, "launch command", 4096)) || (runtime2 === "codex" || runtime2 === "claude-code") && (() => {
+  if (runtime2 !== "claude-code" && scope !== null || runtime2 === "claude-code" && scope !== locator.scope || (runtime2 === "codex" || runtime2 === "claude-code") && launch.args.length !== 0 || runtime2 === "claude-desktop" && !isAbsolute2(strictText(launch.command, "launch command", 4096)) || (runtime2 === "codex" || runtime2 === "claude-code") && !(version === 2 && metadata.target?.transport === "streamable-http") && (() => {
     try {
       safeNativeExecutableContract(launch.command, "launch command");
       return false;
@@ -2018,14 +2086,69 @@ function strictManagedMetadata(value, runtime2, instance) {
   })()) {
     throw new Error("managed metadata launch is invalid");
   }
+  let target;
+  if (version === 2) {
+    if (!metadata.target || typeof metadata.target !== "object" || Array.isArray(metadata.target)) {
+      throw new Error("managed metadata target is invalid");
+    }
+    const candidate = metadata.target;
+    const targetScope = candidate.scope;
+    if (candidate.version !== 1 || ![null, "local", "user", "project"].includes(targetScope)) {
+      throw new Error("managed metadata target is invalid");
+    }
+    if (candidate.transport === "streamable-http") {
+      if (Object.keys(candidate).sort().join(",") !== "scope,transport,url,version" || runtime2 === "claude-desktop" || targetScope !== scope) {
+        throw new Error("managed metadata target is invalid");
+      }
+      target = {
+        version: 1,
+        transport: "streamable-http",
+        url: validateLoopbackMcpUrl(candidate.url, "managed metadata target URL"),
+        scope: targetScope
+      };
+    } else if (candidate.transport === "stdio") {
+      if (Object.keys(candidate).sort().join(",") !== "args,command,scope,transport,version" || !Array.isArray(candidate.args) || candidate.args.length > 16 || candidate.args.some((arg) => {
+        try {
+          strictText(arg, "target argument", 1024);
+          return false;
+        } catch {
+          return true;
+        }
+      })) {
+        throw new Error("managed metadata target is invalid");
+      }
+      target = {
+        version: 1,
+        transport: "stdio",
+        command: strictText(candidate.command, "target command", 4096),
+        args: [...candidate.args],
+        scope: targetScope
+      };
+      if (runtime2 === "claude-desktop") {
+        if (!isAbsolute2(target.command)) throw new Error("managed metadata target is invalid");
+      } else {
+        safeNativeExecutableContract(target.command, "managed metadata target command");
+      }
+    } else {
+      throw new Error("managed metadata target is invalid");
+    }
+    if (!isDeepStrictEqual(targetLaunchProjection(target), {
+      command: strictText(launch.command, "launch command", 4096),
+      args: [...launch.args],
+      scope
+    })) {
+      throw new Error("managed metadata target does not match its launch projection");
+    }
+  }
   return {
     schema: "agent-bridge.client-management",
-    version: 1,
+    version,
     runtime: runtime2,
     identity: identity2,
     instance: recordedInstance,
     backendConfigPath,
     launch: { command: strictText(launch.command, "launch command", 4096), args: [...launch.args], scope },
+    ...target ? { target } : {},
     locator
   };
 }
@@ -2134,8 +2257,8 @@ function inspectClient(runtime2, identity2, options, execute = defaultExecutor)
   const normalizedIdentity = identity2.trim();
   const expected = expectedManagedClientMetadata(runtime2, normalizedIdentity, options, env);
   const path = managedClientMetadataPath(runtime2, expected.instance, env);
-  const registration = inspectManagedRegistration(expected, execute, env);
   const metadata = readMetadata(path, runtime2, expected.instance);
+  const registration = inspectManagedRegistration(metadata ?? expected, execute, env);
   const backend = backendState(expected.backendConfigPath);
   let state;
   let reason;
@@ -2145,7 +2268,7 @@ function inspectClient(runtime2, identity2, options, execute = defaultExecutor)
   } else if (registration === "exact" && backend === "private-file" && metadata === void 0) {
     state = "unmanaged";
     reason = "exact registration has no managed metadata";
-  } else if (registration === "exact" && backend === "private-file" && exactObject(metadata, expected)) {
+  } else if (registration === "exact" && backend === "private-file" && exactManagedTarget(metadata, expected)) {
     state = "managed";
     reason = "registration and managed metadata are exact";
   } else {
@@ -2496,7 +2619,9 @@ function validateOperationLocator(runtime2, value) {
 function validateOperationMetadata(value, runtime2, instance) {
   if (!value || typeof value !== "object" || Array.isArray(value)) fail("CORRUPT_OPERATION", "operation manifest is corrupt");
   const metadata = value;
-  if (Object.keys(metadata).sort().join(",") !== "backendConfigPath,identity,instance,launch,locator,runtime,schema,version" || metadata.schema !== "agent-bridge.client-management" || metadata.version !== 1 || !RUNTIMES.includes(metadata.runtime) || runtime2 !== void 0 && metadata.runtime !== runtime2) {
+  const metadataVersion = metadata.version;
+  const metadataKeys = metadataVersion === 2 ? "backendConfigPath,identity,instance,launch,locator,runtime,schema,target,version" : "backendConfigPath,identity,instance,launch,locator,runtime,schema,version";
+  if (Object.keys(metadata).sort().join(",") !== metadataKeys || metadata.schema !== "agent-bridge.client-management" || metadataVersion !== 1 && metadataVersion !== 2 || !RUNTIMES.includes(metadata.runtime) || runtime2 !== void 0 && metadata.runtime !== runtime2) {
     fail("CORRUPT_OPERATION", "operation manifest is corrupt");
   }
   const recordedRuntime = metadata.runtime;
@@ -2521,19 +2646,52 @@ function validateOperationMetadata(value, runtime2, instance) {
   const locator = validateOperationLocator(recordedRuntime, metadata.locator);
   const command = safeText(launch.command, "launch command", 4096);
   const scope = launch.scope;
+  const httpTarget = metadataVersion === 2 && metadata.target?.transport === "streamable-http";
   if (recordedRuntime !== "claude-code" && scope !== null || recordedRuntime === "claude-code" && scope !== locator.scope || (recordedRuntime === "codex" || recordedRuntime === "claude-code") && launch.args.length !== 0) {
     fail("CORRUPT_OPERATION", "operation manifest is corrupt");
   }
-  if (recordedRuntime === "codex" || recordedRuntime === "claude-code") safeNativeLaunchCommand(command);
+  if ((recordedRuntime === "codex" || recordedRuntime === "claude-code") && !httpTarget) {
+    safeNativeLaunchCommand(command);
+  }
   if (recordedRuntime === "claude-desktop" && !isAbsolute3(command)) fail("CORRUPT_OPERATION", "operation manifest is corrupt");
+  let target;
+  if (metadataVersion === 2) {
+    if (!metadata.target || typeof metadata.target !== "object" || Array.isArray(metadata.target)) {
+      fail("CORRUPT_OPERATION", "operation manifest is corrupt");
+    }
+    const candidate = metadata.target;
+    if (candidate.version !== 1 || candidate.scope !== scope) fail("CORRUPT_OPERATION", "operation manifest is corrupt");
+    if (candidate.transport === "streamable-http") {
+      if (recordedRuntime === "claude-desktop" || Object.keys(candidate).sort().join(",") !== "scope,transport,url,version") {
+        fail("CORRUPT_OPERATION", "operation manifest is corrupt");
+      }
+      const url = validateLoopbackMcpUrl(candidate.url, "managed operation target URL");
+      if (command !== url || launch.args.length !== 0) fail("CORRUPT_OPERATION", "operation manifest is corrupt");
+      target = { version: 1, transport: "streamable-http", url, scope };
+    } else if (candidate.transport === "stdio") {
+      if (Object.keys(candidate).sort().join(",") !== "args,command,scope,transport,version" || candidate.command !== command || !sameCanonicalValue(candidate.args, launch.args)) {
+        fail("CORRUPT_OPERATION", "operation manifest is corrupt");
+      }
+      target = {
+        version: 1,
+        transport: "stdio",
+        command,
+        args: [...launch.args],
+        scope
+      };
+    } else {
+      fail("CORRUPT_OPERATION", "operation manifest is corrupt");
+    }
+  }
   return {
     schema: "agent-bridge.client-management",
-    version: 1,
+    version: metadataVersion,
     runtime: recordedRuntime,
     identity: identity2,
     instance: recordedInstance,
     backendConfigPath,
     launch: { command, args: [...launch.args], scope },
+    ...target ? { target } : {},
     locator
   };
 }
@@ -2549,6 +2707,7 @@ function canonicalDigest(value) {
   return createHash4("sha256").update(canonical(value)).digest("hex");
 }
 function exactRegistrationProof(metadata) {
+  const http = metadata.version === 2 && metadata.target?.transport === "streamable-http";
   return {
     state: "exact",
     target: {
@@ -2563,7 +2722,7 @@ function exactRegistrationProof(metadata) {
       state: "present",
       command: metadata.launch.command,
       args: [...metadata.launch.args],
-      env: {
+      env: http ? {} : {
         AGENT_BRIDGE_AGENT: metadata.identity,
         AGENT_BRIDGE_INSTANCE: metadata.instance,
         AGENT_BRIDGE_CONFIG: metadata.backendConfigPath
@@ -2572,9 +2731,23 @@ function exactRegistrationProof(metadata) {
   };
 }
 function forwardMetadataFromUpdate(prior, launch) {
+  const target = prior.runtime !== "claude-desktop" && launch.command.startsWith("http://") ? {
+    version: 1,
+    transport: "streamable-http",
+    url: validateLoopbackMcpUrl(launch.command, "managed operation target URL"),
+    scope: launch.scope
+  } : {
+    version: 1,
+    transport: "stdio",
+    command: launch.command,
+    args: [...launch.args],
+    scope: launch.scope
+  };
   return {
     ...prior,
-    launch: { command: launch.command, args: [...launch.args], scope: launch.scope }
+    version: 2,
+    launch: { command: launch.command, args: [...launch.args], scope: launch.scope },
+    target
   };
 }
 function validateRegistrationProof(value, metadata) {
@@ -2589,12 +2762,13 @@ function validateRegistrationProof(value, metadata) {
   }
   const targetMetadata = validateOperationMetadata({
     schema: "agent-bridge.client-management",
-    version: 1,
+    version: metadata.version,
     runtime: target.runtime,
     identity: target.identity,
     instance: target.instance,
     backendConfigPath: target.backendConfigPath,
     launch: target.launch,
+    ...metadata.version === 2 ? { target: metadata.target } : {},
     locator: target.locator
   }, metadata.runtime, metadata.instance);
   if (!sameCanonicalValue(targetMetadata, metadata)) fail("CORRUPT_OPERATION", "operation manifest is corrupt");
@@ -2603,7 +2777,8 @@ function validateRegistrationProof(value, metadata) {
     fail("CORRUPT_OPERATION", "operation manifest is corrupt");
   }
   const env = observed.env;
-  if (Object.keys(env).sort().join(",") !== "AGENT_BRIDGE_AGENT,AGENT_BRIDGE_CONFIG,AGENT_BRIDGE_INSTANCE" || env.AGENT_BRIDGE_AGENT !== metadata.identity || env.AGENT_BRIDGE_CONFIG !== metadata.backendConfigPath || env.AGENT_BRIDGE_INSTANCE !== metadata.instance) {
+  const http = metadata.version === 2 && metadata.target?.transport === "streamable-http";
+  if (http ? Object.keys(env).length !== 0 : Object.keys(env).sort().join(",") !== "AGENT_BRIDGE_AGENT,AGENT_BRIDGE_CONFIG,AGENT_BRIDGE_INSTANCE" || env.AGENT_BRIDGE_AGENT !== metadata.identity || env.AGENT_BRIDGE_CONFIG !== metadata.backendConfigPath || env.AGENT_BRIDGE_INSTANCE !== metadata.instance) {
     fail("CORRUPT_OPERATION", "operation manifest is corrupt");
   }
   return {
@@ -2620,7 +2795,7 @@ function validateRegistrationProof(value, metadata) {
       state: "present",
       command: metadata.launch.command,
       args: [...metadata.launch.args],
-      env: {
+      env: http ? {} : {
         AGENT_BRIDGE_AGENT: metadata.identity,
         AGENT_BRIDGE_CONFIG: metadata.backendConfigPath,
         AGENT_BRIDGE_INSTANCE: metadata.instance
@@ -2720,7 +2895,10 @@ function validateRequest2(value, runtime2, version = CLIENT_OPERATION_VERSION, i
     if ((runtime2 === "codex" || runtime2 === "claude-code") && (launch.args.length !== 0 || (runtime2 === "claude-code" ? !["local", "user", "project"].includes(launch.scope) : launch.scope !== null))) {
       fail("CORRUPT_OPERATION", "operation manifest is corrupt");
     }
-    if (runtime2 === "codex" || runtime2 === "claude-code") safeNativeLaunchCommand(command);
+    if (runtime2 === "codex" || runtime2 === "claude-code") {
+      if (command.startsWith("http://")) validateLoopbackMcpUrl(command, "managed operation target URL");
+      else safeNativeLaunchCommand(command);
+    }
     if (runtime2 === "claude-desktop" && (launch.scope !== null || !isAbsolute3(command))) {
       fail("CORRUPT_OPERATION", "operation manifest is corrupt");
     }
@@ -3826,6 +4004,13 @@ function assertIdentity(metadata, assertion) {
 function registrationProof(observation) {
   return canonical2({ role: "registration", observation });
 }
+function registrationEnvironment(metadata) {
+  return managedClientTarget(metadata).transport === "streamable-http" ? {} : {
+    AGENT_BRIDGE_AGENT: metadata.identity,
+    AGENT_BRIDGE_INSTANCE: metadata.instance,
+    AGENT_BRIDGE_CONFIG: metadata.backendConfigPath
+  };
+}
 function exactRegistrationObservation(metadata) {
   return {
     state: "exact",
@@ -3841,11 +4026,7 @@ function exactRegistrationObservation(metadata) {
       state: "present",
       command: metadata.launch.command,
       args: [...metadata.launch.args],
-      env: {
-        AGENT_BRIDGE_AGENT: metadata.identity,
-        AGENT_BRIDGE_INSTANCE: metadata.instance,
-        AGENT_BRIDGE_CONFIG: metadata.backendConfigPath
-      }
+      env: registrationEnvironment(metadata)
     }
   };
 }
@@ -3887,24 +4068,88 @@ function operationLaunch(metadata) {
     envKeys: fixedEnvKeys()
   };
 }
-function updateMetadata(metadata, launch) {
+function updateMetadata(metadata, launch, target) {
   return {
     ...metadata,
-    launch: { command: launch.command, args: [...launch.args], scope: launch.scope }
+    version: 2,
+    launch: { command: launch.command, args: [...launch.args], scope: launch.scope },
+    target
   };
 }
-function resolveUpdateLaunch(metadata, command, env) {
+function safeProxyArgs(args, endpoint) {
+  if (args.length === 0 || args.length > 16 || args.some((arg) => !arg || arg.length > 1024 || arg.trim() !== arg || /[\u0000-\u001f\u007f]/.test(arg)) || !args.includes(endpoint)) {
+    throw new Error("--proxy-args-json must include the exact --mcp-url value");
+  }
+  if (args.some((arg, index) => {
+    const previous = index > 0 ? args[index - 1] : "";
+    const sensitive = /^--?(?:token|key|secret|password|authorization|credential)(?:=.*)?$/i;
+    return sensitive.test(arg) || sensitive.test(previous) || /\bBearer\s+\S+/i.test(arg) || /^https?:\/\/\S*[?#]\S+/i.test(arg);
+  })) {
+    throw new Error("--proxy-args-json cannot contain credential-like values");
+  }
+  return [...args];
+}
+function resolveUpdateTarget(metadata, options, env) {
+  if (options.mcpUrl !== void 0) {
+    const url = validateLoopbackMcpUrl(options.mcpUrl);
+    if (metadata.runtime !== "claude-desktop") {
+      if (options.command !== void 0 || options.proxyCommand !== void 0 || options.proxyArgs?.length) {
+        throw new Error("--command, --proxy-command, and --proxy-args-json are not valid for a native HTTP target");
+      }
+      const scope2 = metadata.runtime === "claude-code" ? metadata.launch.scope : null;
+      return {
+        launch: { command: url, args: [], scope: scope2, envKeys: fixedEnvKeys() },
+        target: { version: 1, transport: "streamable-http", url, scope: scope2 }
+      };
+    }
+    if (options.command !== void 0) throw new Error("--command cannot be combined with --mcp-url");
+    if (!options.proxyCommand) throw new Error("--proxy-command is required for a Desktop HTTP target");
+    const command = newNativeExecutableContract(options.proxyCommand, "--proxy-command");
+    const args = safeProxyArgs(options.proxyArgs ?? [], url);
+    return {
+      launch: { command, args, scope: null, envKeys: fixedEnvKeys() },
+      target: { version: 1, transport: "stdio", command, args, scope: null }
+    };
+  }
+  if (options.proxyCommand !== void 0 || options.proxyArgs?.length) {
+    throw new Error("--proxy-command and --proxy-args-json require --mcp-url");
+  }
   if (metadata.runtime === "claude-desktop") {
-    const launch = resolveDesktopLaunchContract(command, env);
-    return { command: launch.command, args: [...launch.args], scope: null, envKeys: fixedEnvKeys() };
+    const launch = resolveDesktopLaunchContract(options.command, env);
+    return {
+      launch: { command: launch.command, args: [...launch.args], scope: null, envKeys: fixedEnvKeys() },
+      target: {
+        version: 1,
+        transport: "stdio",
+        command: launch.command,
+        args: [...launch.args],
+        scope: null
+      }
+    };
   }
-  const requested = command === void 0 ? "agent-bridge-mcp" : command;
+  const requested = options.command === void 0 ? "agent-bridge-mcp" : options.command;
   newNativeExecutableContract(requested, "--command");
+  const scope = metadata.runtime === "claude-code" ? metadata.launch.scope : null;
   return {
-    command: requested,
-    args: [],
-    scope: metadata.runtime === "claude-code" ? metadata.launch.scope : null,
-    envKeys: fixedEnvKeys()
+    launch: { command: requested, args: [], scope, envKeys: fixedEnvKeys() },
+    target: { version: 1, transport: "stdio", command: requested, args: [], scope }
+  };
+}
+function targetFromRecordedLaunch(metadata, launch) {
+  if (metadata.runtime !== "claude-desktop" && launch.command.startsWith("http://")) {
+    return {
+      version: 1,
+      transport: "streamable-http",
+      url: validateLoopbackMcpUrl(launch.command, "recorded MCP URL"),
+      scope: launch.scope
+    };
+  }
+  return {
+    version: 1,
+    transport: "stdio",
+    command: launch.command,
+    args: [...launch.args],
+    scope: launch.scope
   };
 }
 function backendPolicy(path) {
@@ -4122,7 +4367,17 @@ function nativeContext(metadata, env) {
 function nativeExecute(metadata, action, execute, env) {
   const context = nativeContext(metadata, env);
   const executable = metadata.runtime === "codex" ? "codex" : "claude";
-  const args = action === "remove" ? metadata.runtime === "codex" ? ["mcp", "remove", "agent-bridge"] : ["mcp", "remove", "agent-bridge", "-s", metadata.launch.scope] : metadata.runtime === "codex" ? [
+  const target = managedClientTarget(metadata);
+  const args = action === "remove" ? metadata.runtime === "codex" ? ["mcp", "remove", "agent-bridge"] : ["mcp", "remove", "agent-bridge", "-s", metadata.launch.scope] : target.transport === "streamable-http" ? metadata.runtime === "codex" ? ["mcp", "add", "agent-bridge", "--url", target.url] : [
+    "mcp",
+    "add",
+    "--scope",
+    metadata.launch.scope,
+    "--transport",
+    "http",
+    "agent-bridge",
+    target.url
+  ] : metadata.runtime === "codex" ? [
     "mcp",
     "add",
     "agent-bridge",
@@ -4348,11 +4603,7 @@ function buildPlan(metadata, target, execute, env) {
       state: "present",
       command: target.launch.command,
       args: [...target.launch.args],
-      env: {
-        AGENT_BRIDGE_AGENT: target.identity,
-        AGENT_BRIDGE_INSTANCE: target.instance,
-        AGENT_BRIDGE_CONFIG: target.backendConfigPath
-      }
+      env: registrationEnvironment(target)
     }
   };
   if (target.runtime === "claude-desktop") {
@@ -4389,7 +4640,7 @@ function buildPlan(metadata, target, execute, env) {
       after: registrationProof(exactRegistration2)
     });
   }
-  if (!isDeepStrictEqual2(metadata.launch, target.launch)) {
+  if (metadata.version !== target.version || !isDeepStrictEqual2(metadata.launch, target.launch) || !isDeepStrictEqual2(metadata.target, target.target)) {
     steps.push({
       kind: "metadata",
       target: "metadata",
@@ -4592,6 +4843,13 @@ function assertForwardRollbackMetadataState(forward, contract) {
     throw new Error("managed client no longer matches the forward update metadata state");
   }
 }
+function loadForwardRollbackMetadata(runtime2, instance, env) {
+  try {
+    return loadManagedClientMetadata(runtime2, instance, env);
+  } catch {
+    throw new Error("managed client no longer matches the forward update metadata state");
+  }
+}
 function assertForwardRollbackRegistrationState(forward, contract, execute, env) {
   const registration = observeManagedRegistration(forward, execute, env);
   if (digest(registrationProof(registration)) !== contract.forwardRegistrationSha256) {
@@ -4729,7 +4987,7 @@ function switchManagedClientMetadata(before, after, env = process.env) {
     throw new Error("managed metadata switch was not verified");
   }
 }
-function resumeAction(metadata, manifest, command, env, action) {
+function resumeAction(metadata, manifest, options, env, action) {
   if (manifest.runtime !== metadata.runtime || manifest.instance !== metadata.instance) {
     throw new Error("--resume does not match this client action, runtime, or instance");
   }
@@ -4740,14 +4998,18 @@ function resumeAction(metadata, manifest, command, env, action) {
     if (manifest.version !== 3 || !manifest.request || manifest.request.kind !== "repair" || !("identity" in manifest.request) || manifest.request.identity !== metadata.identity) {
       throw new Error("--resume does not match this client action, runtime, or instance");
     }
-    if (command !== void 0) throw new Error("--command is not valid for clients repair");
+    if (options.command !== void 0 || options.mcpUrl !== void 0 || options.proxyCommand !== void 0 || options.proxyArgs?.length) {
+      throw new Error("target options are not valid for clients repair");
+    }
     return metadata;
   }
   if (action === "uninstall") {
     if (manifest.version !== 3 || !manifest.request || manifest.request.kind !== "uninstall" || !("identity" in manifest.request) || manifest.request.identity !== metadata.identity) {
       throw new Error("--resume does not match this client action, runtime, or instance");
     }
-    if (command !== void 0) throw new Error("--command is not valid for clients uninstall");
+    if (options.command !== void 0 || options.mcpUrl !== void 0 || options.proxyCommand !== void 0 || options.proxyArgs?.length) {
+      throw new Error("target options are not valid for clients uninstall");
+    }
     return metadata;
   }
   if (!manifest.request || manifest.request.kind !== "update" || !("identity" in manifest.request) || !("launch" in manifest.request) || manifest.request.identity !== metadata.identity) {
@@ -4761,13 +5023,13 @@ function resumeAction(metadata, manifest, command, env, action) {
       throw new Error("recorded Desktop update launch is invalid");
     }
   }
-  if (command !== void 0) {
-    const supplied = resolveUpdateLaunch(metadata, command, env);
-    if (!isDeepStrictEqual2(supplied, recorded)) {
-      throw new Error("--command does not match the recorded update request");
+  if (options.command !== void 0 || options.mcpUrl !== void 0 || options.proxyCommand !== void 0 || options.proxyArgs?.length) {
+    const supplied = resolveUpdateTarget(metadata, options, env);
+    if (!isDeepStrictEqual2(supplied.launch, recorded)) {
+      throw new Error("target options do not match the recorded update request");
     }
   }
-  return updateMetadata(metadata, recorded);
+  return updateMetadata(metadata, recorded, targetFromRecordedLaunch(metadata, recorded));
 }
 function planResult(action, applied, metadata, steps, env, operationId) {
   return {
@@ -4796,7 +5058,10 @@ function maintainManagedClient(options) {
   const requestedAction = options.action;
   if (requestedAction === "uninstall") assertUninstallPathIsolation(metadata, env);
   const manifest = options.resume ? readClientOperation(options.resume, env) : void 0;
-  const target = manifest ? resumeAction(metadata, manifest, options.command, env, requestedAction) : requestedAction === "update" ? updateMetadata(metadata, resolveUpdateLaunch(metadata, options.command, env)) : metadata;
+  const target = manifest ? resumeAction(metadata, manifest, options, env, requestedAction) : requestedAction === "update" ? (() => {
+    const resolved = resolveUpdateTarget(metadata, options, env);
+    return updateMetadata(metadata, resolved.launch, resolved.target);
+  })() : metadata;
   const steps = options.resume && options.apply ? [] : requestedAction === "uninstall" ? buildUninstallPlan(metadata, execute, env) : buildPlan(metadata, target, execute, env);
   if (!options.apply) {
     if (options.resume || options.recoverLock) throw new Error("--resume and --recover-lock require --apply");
@@ -5012,7 +5277,7 @@ function runManagedClientRollback(options, resumeOperationId) {
     throw new Error("rollback request no longer matches its committed source");
   }
   const metadataStepApplied = rollbackMetadataReachedAfterState(reverse, prior, env);
-  const forward = metadataStepApplied ? prior : loadManagedClientMetadata(source.runtime, source.instance, env);
+  const forward = metadataStepApplied ? prior : loadForwardRollbackMetadata(source.runtime, source.instance, env);
   const registrationHasProgress = rollbackRegistrationHasProgress(reverse);
   if (!metadataStepApplied) {
     assertForwardRollbackMetadataState(forward, contract);
@@ -5049,7 +5314,7 @@ function runManagedClientRollback(options, resumeOperationId) {
       throw new Error("rollback source changed while acquiring the client lock");
     }
     const metadataApplied = rollbackMetadataReachedAfterState(current, prior, env);
-    const currentForward = metadataApplied ? prior : loadManagedClientMetadata(source.runtime, source.instance, env);
+    const currentForward = metadataApplied ? prior : loadForwardRollbackMetadata(source.runtime, source.instance, env);
     const currentRegistrationHasProgress = rollbackRegistrationHasProgress(current);
     if (!metadataApplied) {
       assertForwardRollbackMetadataState(currentForward, contract);
@@ -8598,6 +8863,9 @@ var SUPPORTED_OPTIONS = /* @__PURE__ */ new Set([
   "scope",
   "backend-config",
   "config-path",
+  "mcp-url",
+  "proxy-command",
+  "proxy-args-json",
   "recipient",
   "retry-base-ms",
   "retry-jitter",
@@ -8770,7 +9038,7 @@ Commands:
   clients inspect <codex|claude-code|claude-desktop> --identity <name> --instance <key> --backend-config <path>
   clients adopt <codex|claude-code|claude-desktop> --identity <name> --instance <key> --backend-config <path> [--apply]
   clients repair <codex|claude-code|claude-desktop> --identity <name> --instance <key> [--apply] [--resume <uuid>] [--recover-lock]
-  clients update <codex|claude-code|claude-desktop> --identity <name> --instance <key> [--command <command>] [--apply] [--resume <uuid>] [--recover-lock]
+  clients update <codex|claude-code|claude-desktop> --identity <name> --instance <key> [--command <command> | --mcp-url <loopback-url>] [--proxy-command <command> --proxy-args-json <json-array>] [--apply] [--resume <uuid>] [--recover-lock]
   clients uninstall <codex|claude-code|claude-desktop> --identity <name> --instance <key> [--apply] [--resume <uuid>] [--recover-lock]
   clients rollback <source-operation-id> --identity <name> [--apply] [--recover-lock]
   clients migrate stage <codex|claude-code|claude-desktop> --identity <name> --instance <key> --enrollment-file <path> [--apply] [--recover-lock]
@@ -9086,12 +9354,15 @@ async function runCli(argv = process.argv.slice(2)) {
         "identity",
         "instance",
         "command",
+        "mcp-url",
+        "proxy-command",
+        "proxy-args-json",
         "apply",
         "resume",
         "recover-lock"
       ]), `clients ${action}`);
-      if (action !== "update" && options.command !== void 0) {
-        throw new Error(`--command is not valid for clients ${action}`);
+      if (action !== "update" && (options.command !== void 0 || options["mcp-url"] !== void 0 || options["proxy-command"] !== void 0 || options["proxy-args-json"] !== void 0)) {
+        throw new Error(`target options are not valid for clients ${action}`);
       }
       if (!boolean(options, "apply") && (options.resume !== void 0 || options["recover-lock"] !== void 0)) {
         throw new Error("--resume and --recover-lock require --apply");
@@ -9102,6 +9373,16 @@ async function runCli(argv = process.argv.slice(2)) {
         instance: one(options, "instance") ?? "",
         command: one(options, "command"),
         apply: boolean(options, "apply"),
+        mcpUrl: one(options, "mcp-url"),
+        proxyCommand: one(options, "proxy-command"),
+        proxyArgs: (() => {
+          const value = json(options, "proxy-args-json");
+          if (value === void 0) return [];
+          if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) {
+            throw new Error("--proxy-args-json must be a JSON array of strings");
+          }
+          return value;
+        })(),
         resume: one(options, "resume"),
         recoverLock: boolean(options, "recover-lock"),
         env: process.env