@cruxy/cli 0.25.0 → 0.27.0

package/dist/approval/prompt.d.ts

@@ -29,6 +29,12 @@ export interface PromptIO {
     readLine(): Promise<string>;
     /** Whether to emit ANSI color. */
     color: boolean;
+    /**
+     * Terminal columns (U.12). Optional so every existing PromptIO literal is
+     * unchanged; when absent the render resolves the width itself. Threaded so a
+     * narrow prompt reflows the command and never truncates the risk marker.
+     */
+    columns?: number;
 }
 /**
  * Render the action, read one key, and map it to a {@link PromptChoice}. `n`/`t`
@@ -37,6 +43,6 @@ export interface PromptIO {
  */
 export declare function promptForApproval(request: ApprovalRequest, io: PromptIO): Promise<PromptChoice>;
 /** Render the full prompt block: header, detail (diff or command+cwd), choices. */
-export declare function render(request: ApprovalRequest, color: boolean): string;
+export declare function render(request: ApprovalRequest, color: boolean, columns?: number): string;
 /** Build the real PromptIO: prompt to stderr, read keys/lines from stdin. */
 export declare function defaultPromptIO(color: boolean): PromptIO;

package/dist/approval/prompt.js

@@ -1,6 +1,8 @@
 import path from "node:path";
 import { readSingleKey } from "../components/input.js";
 import { renderActionPreview } from "../render/diff.js";
+import { resolveColumns } from "../render/capabilities.js";
+import { fitMiddle, reflow, visibleWidth } from "../render/layout.js";
 import { themeForColor } from "../theme/index.js";
 /**
  * Render the action, read one key, and map it to a {@link PromptChoice}. `n`/`t`
@@ -8,7 +10,7 @@ import { themeForColor } from "../theme/index.js";
  * is a reject.
  */
 export async function promptForApproval(request, io) {
-    io.write(render(request, io.color));
+    io.write(render(request, io.color, io.columns ?? resolveColumns()));
     const key = (await io.readKey()).toLowerCase();
     io.write("\n");
     switch (key) {
@@ -34,21 +36,41 @@ export async function promptForApproval(request, io) {
     }
 }
 /** Render the full prompt block: header, detail (diff or command+cwd), choices. */
-export function render(request, color) {
+export function render(request, color, columns = resolveColumns()) {
     const t = themeForColor(color);
     const destructive = request.tier === "destructive";
-    // Risk survives all three degradations (U.11): the mark carries it by *shape*
-    // (`!` vs `?`) for NO_COLOR, and the label carries it by *word*
-    // (`(destructive)` / `(mutate)` / `(read)`) — never by hue alone, and legible
-    // to a screen reader that would otherwise read `!` as "exclamation mark".
+    // Risk survives all FOUR degradations now (U.11 color/unicode/reader + U.12
+    // width): the mark carries it by *shape* (`!` vs `?`) for NO_COLOR, the label
+    // by *word* (`(destructive)` / `(mutate)` / `(read)`) — never by hue alone —
+    // and under narrow width the header line that holds both is emitted WHOLE,
+    // never passed through a right-truncating fit that could drop the label.
     const mark = destructive ? t.danger(t.strong("!")) : t.warning("?");
     const label = tierLabel(request.tier, t);
     const lines = [];
-    lines.push(`${mark} cruxy wants to ${t.strong(request.summary)}${label}`);
-    lines.push(detail(request, t));
+    lines.push(...header(request.summary, mark, label, t, columns));
+    lines.push(detail(request, t, columns));
     lines.push(choices(request.scope, t));
     return lines.filter((l) => l !== "").join("\n") + " ";
 }
+/**
+ * The header, width-aware (U.12). Wide: the one inline line `! cruxy wants to
+ * <summary> (destructive)`. Narrow: the risk (mark + tier label) stands on its
+ * own line — emitted whole, never truncated — and the summary reflows beneath
+ * it, so the security-relevant part is always visible while the description
+ * wraps rather than soft-wrapping into a torn line.
+ */
+function header(summary, mark, label, t, width) {
+    const inline = `${mark} cruxy wants to ${t.strong(summary)}${label}`;
+    if (visibleWidth(inline) <= width)
+        return [inline];
+    // The risk line (mark + tier word, e.g. `! (destructive)`) is short and is
+    // NEVER passed through fit(): if it overflows an absurdly narrow terminal it
+    // wraps (nothing dropped) rather than losing its tier. The action prose +
+    // summary reflow beneath it.
+    const riskLine = `${mark}${label}`;
+    const body = reflow(`cruxy wants to ${summary}`, Math.max(1, width - 2)).map((l) => `  ${t.strong(l)}`);
+    return [riskLine, ...body];
+}
 /** The worded risk tag, colored by tier — always present, so meaning never
  * rides on the `!`/`?` shape or its color alone. */
 function tierLabel(tier, t) {
@@ -62,17 +84,28 @@ function tierLabel(tier, t) {
     }
 }
 /** The action detail: a diff for file actions, the command + cwd for shell/test. */
-function detail(request, t) {
+function detail(request, t, width) {
     if (request.action.kind === "shell" || request.action.kind === "test") {
-        return [
-            `  ${t.muted("$")} ${request.action.command ?? ""}`,
-            `  ${t.muted(`in ${request.cwd}`)}`,
-        ].join("\n");
+        // The command is REFLOWED, never truncated (U.12): you always see the whole
+        // thing you are authorizing — it wraps across as many lines as it needs. The
+        // cwd (a path) middle-truncates so its leaf survives.
+        const command = request.action.command ?? "";
+        const wrapped = reflow(command, Math.max(1, width - 4));
+        const cmdLines = [
+            `  ${t.muted("$")} ${wrapped[0] ?? ""}`,
+            ...wrapped.slice(1).map((l) => `    ${l}`),
+        ];
+        const cwd = fitMiddle(request.cwd, Math.max(1, width - 5), t.glyph.ellipsis);
+        return [...cmdLines, `  ${t.muted(`in ${cwd}`)}`].join("\n");
     }
     if (request.action.kind === "mcp") {
         // The server runs UNSANDBOXED with the user's privileges — say so at the
-        // point of the call, not just at trust time.
-        return `  ${t.muted(`external MCP server "${request.action.server ?? ""}" — runs unsandboxed with your privileges`)}`;
+        // point of the call, not just at trust time. Reflowed so the whole warning
+        // survives narrow width (it must not be the part that gets clipped).
+        const note = `external MCP server "${request.action.server ?? ""}" — runs unsandboxed with your privileges`;
+        return reflow(note, Math.max(1, width - 2))
+            .map((l) => `  ${t.muted(l)}`)
+            .join("\n");
     }
     if (request.action.kind === "vcs" && request.action.root) {
         // C.26 Step 4 (⚖︎JC-4): name the acting root alongside the resolved owner/repo
@@ -80,12 +113,12 @@ function detail(request, t) {
         // PR acts in and the real API destination before approving.
         return [
             `  ${t.muted(`root ${request.action.root}`)}`,
-            renderActionPreview(request.action.preview, t),
+            renderActionPreview(request.action.preview, t, width),
         ]
             .filter((l) => l !== "")
             .join("\n");
     }
-    return renderActionPreview(request.action.preview, t);
+    return renderActionPreview(request.action.preview, t, width);
 }
 /** The choices line, including a short label of what an `a` grant would cover. */
 function choices(scope, t) {
@@ -117,6 +150,8 @@ export function defaultPromptIO(color) {
         readKey: () => readSingleKey(),
         readLine: readLineFromStdin,
         color,
+        // The prompt writes to stderr — width from stderr's own columns (U.12).
+        columns: resolveColumns(process.stderr),
     };
 }
 /** Read one line in cooked mode; "" on EOF. */

package/dist/cli/commands/mcp.js

@@ -1,9 +1,11 @@
 import path from "node:path";
 import { Command } from "commander";
-import { loadConfig } from "../../config/index.js";
-import { shouldUseColor } from "../../errors/index.js";
+import { loadConfig, writeMcpCredential } from "../../config/index.js";
+import { defaultOnboardingIO } from "../../onboarding/index.js";
+import { interactiveRequired, shouldUseColor } from "../../errors/index.js";
 import { themeForColor } from "../../theme/index.js";
-import { fileMcpTrustStore, fingerprintMcpServers, isMcpTrusted, } from "../../mcp/index.js";
+import { fileMcpTrustStore, fingerprintMcpServers, isMcpTrusted, resolveMcpEndpoints, } from "../../mcp/index.js";
+import { BlockedHostError, defaultResolveHost, HostUnresolvedError, } from "../../net/ip-guard.js";
 import { logger } from "../../utils/logger.js";
 /**
  * `cruxy mcp` — inspect and control MCP server integration (C.27). `list` shows
@@ -36,11 +38,16 @@ export function mcpCommand() {
         for (const [name, cfg] of Object.entries(servers)) {
             logger.print(`  ${t.strong(name)} ${t.muted(describeServer(cfg))}`);
         }
+        if (trusted && Object.values(servers).some((c) => c.url)) {
+            // JC-D: url servers are also bound to their resolved IP set, re-checked at
+            // connect; a changed IP set re-gates even though the static status is "trusted".
+            logger.print(t.muted("\n  note: url servers are re-verified against their trusted IP set on connect"));
+        }
     });
     cmd
         .command("trust [path]")
         .description("trust this repo's MCP integrations (they run with your full privileges)")
-        .action((target) => {
+        .action(async (target) => {
         const t = themeForColor(shouldUseColor(process.stdout));
         const { config } = loadConfig();
         const servers = config.mcp.servers;
@@ -50,17 +57,91 @@ export function mcpCommand() {
             logger.print(t.muted(`no MCP servers configured under ${root}`));
             return;
         }
-        logger.print(t.danger(t.strong(`trusting ${names.length} MCP server${names.length === 1 ? "" : "s"} — these run their own code UNSANDBOXED with your privileges:`)));
+        const hasStdio = Object.values(servers).some((c) => c.command);
+        const hasUrl = Object.values(servers).some((c) => c.url);
+        logger.print(t.danger(t.strong(`trusting ${names.length} MCP server${names.length === 1 ? "" : "s"} for ${root}:`)));
         for (const [name, cfg] of Object.entries(servers)) {
             logger.print(`  ${t.strong(name)} ${t.muted(describeServer(cfg))}`);
         }
+        if (hasStdio) {
+            logger.print(t.muted("  stdio servers run their code UNSANDBOXED with your full privileges."));
+        }
+        if (hasUrl) {
+            logger.print(t.muted("  url servers receive your tool arguments over the network; trust binds\n" +
+                "  the URL + its current IP set (weaker than a local binary — see docs)."));
+            // C.27c: a server that also RECEIVES a credential is a bigger grant —
+            // name it so the grant is explicit at trust time.
+            for (const [name, cfg] of Object.entries(servers)) {
+                if (!cfg.credentialRef && !cfg.headers)
+                    continue;
+                const what = cfg.credentialRef
+                    ? `your "${cfg.credentialRef}" credential`
+                    : "your configured auth headers";
+                logger.print(t.danger(`  "${name}" will RECEIVE ${what} on every request.`));
+            }
+        }
+        // JC-D: capture + SSRF-validate each url server's endpoint set and bind it
+        // into the decision. A refused URL (SSRF/scheme) fails closed — no record.
+        let endpoints = {};
+        try {
+            endpoints = await resolveMcpEndpoints(servers, defaultResolveHost);
+        }
+        catch (err) {
+            if (err instanceof BlockedHostError ||
+                err instanceof HostUnresolvedError) {
+                logger.print(t.danger(`refused to trust — a url server could not be validated: ${err.message}`));
+                return;
+            }
+            throw err;
+        }
         fileMcpTrustStore().record({
             root,
             fingerprint: fingerprintMcpServers(servers),
             at: new Date().toISOString(),
+            endpoints,
         });
         logger.print(`${t.success("trusted")} — cruxy will connect these servers for ${root}. ` +
-            t.muted("changing the config will require re-trusting."));
+            t.muted("changing the config (or a url's IP set) requires re-trusting."));
+    });
+    cmd
+        .command("login <server>")
+        .description("set a bearer credential for a remote MCP integration (owner-only in ~/.cruxy)")
+        .action(async (server) => {
+        const t = themeForColor(shouldUseColor(process.stdout));
+        const { config } = loadConfig();
+        const cfg = config.mcp.servers[server];
+        if (!cfg) {
+            logger.print(t.danger(`no MCP server "${server}" is configured (mcp.servers)`));
+            process.exitCode = 1;
+            return;
+        }
+        if (!cfg.url) {
+            logger.print(t.danger(`server "${server}" is a stdio server — it has no bearer credential ` +
+                "(stdio servers take secrets via `env`)"));
+            process.exitCode = 1;
+            return;
+        }
+        // The store is keyed by the credential NAME the config references; default
+        // to the server id when the config names none.
+        const ref = cfg.credentialRef ?? server;
+        if (!process.stdin.isTTY) {
+            // Never read a secret from a pipe silently — same discipline as onboarding.
+            throw interactiveRequired(`a credential for MCP server "${server}"`, [
+                "run this in an interactive terminal",
+            ]);
+        }
+        const io = defaultOnboardingIO(shouldUseColor(process.stderr));
+        io.write(`${t.strong(`credential for "${server}"`)} ${t.muted(`(stored as "${ref}" in ~/.cruxy/credentials.json, 0600)`)}\n`);
+        io.write(`${t.muted("paste the bearer token (input hidden): ")}`);
+        const token = (await io.readSecret()).trim();
+        if (!token) {
+            logger.print(t.warning("no token entered — nothing was stored"));
+            process.exitCode = 1;
+            return;
+        }
+        writeMcpCredential(ref, token);
+        logger.print(`${t.success("stored")} — cruxy will send this credential to "${server}" over https only. ` +
+            t.muted("re-run to rotate; the value is never shown or logged."));
     });
     cmd
         .command("untrust [path]")
@@ -83,5 +164,23 @@ function describeServer(cfg) {
     if (cfg.command) {
         return `(stdio: ${[cfg.command, ...(cfg.args ?? [])].join(" ")})`;
     }
-    return cfg.url ? `(url: ${cfg.url})` : "(no transport)";
+    if (!cfg.url)
+        return "(no transport)";
+    return `(url: ${cfg.url}${describeAuth(cfg)})`;
+}
+/**
+ * A REDACTED auth descriptor for display (C.27c) — names the credential and
+ * counts raw headers, but NEVER prints a header value or a token. Display
+ * redaction is defense-in-depth; the load-bearing guard is that project config
+ * can't carry a value at all.
+ */
+function describeAuth(cfg) {
+    const parts = [];
+    if (cfg.credentialRef)
+        parts.push(`credential: ${cfg.credentialRef}`);
+    const headerCount = cfg.headers ? Object.keys(cfg.headers).length : 0;
+    if (headerCount > 0) {
+        parts.push(`${headerCount} header${headerCount === 1 ? "" : "s"} (redacted)`);
+    }
+    return parts.length ? `, ${parts.join(", ")}` : "";
 }

package/dist/cli/commands/skills.js

@@ -1,6 +1,7 @@
 import { Command } from "commander";
 import { getSkillService, resetSkillServices } from "../../skills/index.js";
 import { shouldUseColor } from "../../errors/index.js";
+import { kvStack, resolveColumns } from "../../render/index.js";
 import { themeForColor } from "../../theme/index.js";
 import { logger } from "../../utils/logger.js";
 /**
@@ -34,8 +35,15 @@ export function skillsCommand() {
             return;
         }
         logger.print(`\n${t.heading("sources")} ${t.muted("(precedence, high to low)")}`);
-        for (const { source, dir } of status.sources) {
-            logger.print(`  ${t.kv(source, t.muted(dir), 8)}`);
+        // Aligned `source  dir` columns when there's room; at narrow width the
+        // dir paths would collide with the key column, so kvStack stacks each
+        // pair instead (U.12) — the paths stay readable rather than truncating.
+        const rows = status.sources.map((s) => ({
+            key: s.source,
+            value: t.muted(s.dir),
+        }));
+        for (const line of kvStack(rows, resolveColumns(process.stdout) - 2, t)) {
+            logger.print(`  ${line}`);
         }
         logger.print("");
         if (status.errors.length === 0) {

package/dist/cli/repl.js

@@ -5,10 +5,14 @@ import { runGatedShell } from "../tools/shell/exec.js";
 import { addRootToWorkspace } from "../workspace/index.js";
 import { themeForColor } from "../theme/index.js";
 import { formatError, fromUnknown, isVerbose, shouldUseColor, } from "../errors/index.js";
-import { createRenderer } from "../render/index.js";
+import { createRenderer, fit, resolveColumns, } from "../render/index.js";
 import { logger } from "../utils/logger.js";
 /** The REPL prompts on stdout; its chrome resolves against stdout's color. */
 const theme = themeForColor(shouldUseColor(process.stdout));
+/** Fit a committed REPL line to stdout's current width (U.12), id/status-first. */
+function fitOut(line) {
+    return fit(line, resolveColumns(process.stdout), theme.glyph.ellipsis);
+}
 const PROMPT = `${theme.accent("cruxy")} ${theme.muted(theme.glyph.caret)} `;
 /**
  * The REPL's slash commands — the autocomplete candidate set (U.7). Keep in
@@ -185,7 +189,9 @@ function handleJobsList(session) {
             ? theme.muted(` — needs approval: ${j.pendingApproval}`)
             : "";
         const err = j.error ? theme.muted(` (${j.error})`) : "";
-        logger.print(`${theme.strong(j.id)}  ${status}  ${j.label}${pending}${err}`);
+        // Fit id-first so the job id + status always survive; the label/notes tail
+        // truncates with an honest ellipsis at narrow width (U.12).
+        logger.print(fitOut(`${theme.strong(j.id)}  ${status}  ${j.label}${pending}${err}`));
     }
 }
 /** Print one job's log (`/logs <id>`). */
@@ -207,7 +213,7 @@ function handleJobLogs(input, session) {
         }
         for (const line of log.lines) {
             const text = line.stream === "err" ? theme.danger(line.text) : line.text;
-            logger.print(text);
+            logger.print(fitOut(text));
         }
         logger.print(theme.muted(`(${log.status})`));
     }

package/dist/components/frame.d.ts

@@ -1,6 +1,7 @@
+import { stripAnsi } from "../render/layout.js";
 import type { RenderCapabilities } from "../render/index.js";
-/** The visible text of a possibly-styled row. */
-export declare function stripAnsi(text: string): string;
+/** The visible text of a possibly-styled row (re-exported from the U.12 home). */
+export { stripAnsi };
 /**
  * The transient multi-line region interactive components draw into (U.7) —
  * the multi-row analog of the TTY renderer's single managed status line, with
@@ -12,6 +13,8 @@ export declare function stripAnsi(text: string): string;
  *   soft-wrap; wrapped rows would break erasure and leave artifacts.
  * - `clear()` removes the frame entirely — after a component resolves, the
  *   screen holds zero leftover bytes from the interaction.
+ * - On resize (U.12) the frame reflows its current rows in place at the new
+ *   width; committed output above is untouched. `clear()` also unsubscribes.
  *
  * Requires cursor control (`caps.cursor`); components guard on that before
  * constructing one.
@@ -19,7 +22,7 @@ export declare function stripAnsi(text: string): string;
 export interface Frame {
     /** Repaint the frame with these rows (erases the previous paint first). */
     render(lines: string[]): void;
-    /** Erase the frame completely. Idempotent. */
+    /** Erase the frame completely and release the resize subscription. Idempotent. */
     clear(): void;
 }
 export declare function createFrame(write: (text: string) => void, caps: RenderCapabilities): Frame;

package/dist/components/frame.js

@@ -1,32 +1,22 @@
+import { fit, stripAnsi } from "../render/layout.js";
 import { resolveTheme } from "../theme/index.js";
 /** Erase the current line and return the cursor to column 0 (same as U.2). */
 const CLEAR_LINE = "\r\x1b[2K";
 /** Move the cursor up one row. */
 const CURSOR_UP = "\x1b[1A";
-/** SGR escape sequences (the only ANSI the components emit — via picocolors). */
-// eslint-disable-next-line no-control-regex
-const SGR = /\x1b\[[0-9;]*m/g;
-/** The visible text of a possibly-styled row. */
-export function stripAnsi(text) {
-    return text.replace(SGR, "");
-}
+/** The visible text of a possibly-styled row (re-exported from the U.12 home). */
+export { stripAnsi };
 export function createFrame(write, caps) {
     let drawn = 0;
+    let lastLines = [];
     const ellipsis = resolveTheme(caps).glyph.ellipsis;
     /**
      * Truncate to width-1 (cursor rests after the last cell; a full-width row
      * would auto-wrap on some terminals). Width is measured on VISIBLE
-     * characters — rows may carry ANSI color. A row that fits passes through
-     * styled; an overflowing row is truncated on its stripped text (style is
-     * dropped rather than risking a cut escape sequence).
+     * characters (U.12 {@link fit}) — rows may carry ANSI color; a row that fits
+     * passes through styled, an overflowing row is truncated on its visible text.
      */
-    const fit = (line) => {
-        const room = Math.max(1, caps.width - 1);
-        const plain = stripAnsi(line);
-        if (plain.length <= room)
-            return line;
-        return plain.slice(0, room - 1) + ellipsis;
-    };
+    const fitRow = (line) => fit(line, Math.max(1, caps.width - 1), ellipsis);
     const erase = () => {
         if (drawn === 0)
             return;
@@ -38,14 +28,22 @@ export function createFrame(write, caps) {
         write(out);
         drawn = 0;
     };
+    const paint = (lines) => {
+        erase();
+        lastLines = lines;
+        if (lines.length === 0)
+            return;
+        write(lines.map(fitRow).join("\n"));
+        drawn = lines.length;
+    };
+    // Reflow the live frame at the new width; committed output above is immutable.
+    const unsubscribe = caps.onResize?.(() => paint(lastLines)) ?? null;
     return {
-        render(lines) {
+        render: paint,
+        clear() {
             erase();
-            if (lines.length === 0)
-                return;
-            write(lines.map(fit).join("\n"));
-            drawn = lines.length;
+            lastLines = [];
+            unsubscribe?.();
         },
-        clear: erase,
     };
 }

package/dist/components/fuzzy.js

@@ -1,3 +1,4 @@
+import { fitMiddle } from "../render/layout.js";
 import { resolveTheme } from "../theme/index.js";
 import { createFrame } from "./frame.js";
 import { defaultComponentIO, resolveNonInteractive, } from "./input.js";
@@ -117,7 +118,10 @@ export async function fuzzyFind(items, opts, io = defaultComponentIO()) {
             for (const [i, row] of visible.entries()) {
                 const selected = top + i === cursor;
                 const marker = selected ? t.accent(g.pointer) : " ";
-                const label = highlightMatch(row.label, row.match.positions, t);
+                // Middle-truncate so a long hit keeps its basename at narrow width
+                // (U.12); the match highlight survives when the label fits and is
+                // dropped (plain text) only when it must truncate — identity over decor.
+                const label = fitMiddle(highlightMatch(row.label, row.match.positions, t), Math.max(1, io.caps.width - 2), g.ellipsis);
                 lines.push(`${marker} ${selected ? label : t.muted(label)}`);
             }
             const hidden = ranked.length - visible.length;

package/dist/components/select.js

@@ -1,3 +1,4 @@
+import { fitMiddle } from "../render/layout.js";
 import { resolveTheme } from "../theme/index.js";
 import { createFrame } from "./frame.js";
 import { defaultComponentIO, resolveNonInteractive, } from "./input.js";
@@ -29,7 +30,9 @@ export async function selectList(items, opts = {}, io = defaultComponentIO()) {
         for (const [i, item] of visible.entries()) {
             const selected = top + i === cursor;
             const marker = selected ? t.accent(g.pointer) : " ";
-            const label = toLabel(item);
+            // Middle-truncate the label so a long path keeps its basename (identity)
+            // at narrow width (U.12); reserve the marker + space.
+            const label = fitMiddle(toLabel(item), Math.max(1, io.caps.width - 2), g.ellipsis);
             lines.push(`${marker} ${selected ? label : t.muted(label)}`);
         }
         const hidden = items.length - visible.length;

package/dist/config/credentials.d.ts

@@ -2,6 +2,15 @@
 export declare function credentialsPath(): string;
 /** The stored key for `provider`, or `undefined`. Never throws. */
 export declare function readCredential(provider: string, file?: string): string | undefined;
+/**
+ * The stored MCP bearer token for credential name `ref`, or `undefined` (C.27c).
+ * Reads ONLY this owner-only store — never the environment, never any config file
+ * — so a project config that merely NAMES a credential can never widen where the
+ * secret is sourced from. Never throws.
+ */
+export declare function readMcpCredential(ref: string, file?: string): string | undefined;
+/** Persist MCP bearer token for credential name `ref`. Same 0600/0700 as keys. */
+export declare function writeMcpCredential(ref: string, token: string, file?: string): void;
 /**
  * Persist `key` for `provider`, merging into any existing store. The file is
  * written `0600` and its directory `0700` so the secret is owner-only — enforced

package/dist/config/credentials.js

@@ -39,12 +39,40 @@ export function readCredential(provider, file = credentialsPath()) {
     const key = store?.keys[provider];
     return typeof key === "string" && key !== "" ? key : undefined;
 }
+/**
+ * The stored MCP bearer token for credential name `ref`, or `undefined` (C.27c).
+ * Reads ONLY this owner-only store — never the environment, never any config file
+ * — so a project config that merely NAMES a credential can never widen where the
+ * secret is sourced from. Never throws.
+ */
+export function readMcpCredential(ref, file = credentialsPath()) {
+    const store = readStore(file);
+    const token = store?.mcp?.[ref];
+    return typeof token === "string" && token !== "" ? token : undefined;
+}
+/** Persist MCP bearer token for credential name `ref`. Same 0600/0700 as keys. */
+export function writeMcpCredential(ref, token, file = credentialsPath()) {
+    writeInto(file, (store) => {
+        store.mcp ??= {};
+        store.mcp[ref] = token;
+    });
+}
 /**
  * Persist `key` for `provider`, merging into any existing store. The file is
  * written `0600` and its directory `0700` so the secret is owner-only — enforced
  * with an explicit `chmod` after write (mkdir/write modes are umask-masked).
  */
 export function writeCredential(provider, key, file = credentialsPath()) {
+    writeInto(file, (store) => {
+        store.keys[provider] = key;
+    });
+}
+/**
+ * Merge `mutate` into the store and persist it owner-only: dir `0700`, file
+ * `0600`, enforced with an explicit `chmod` after write (mkdir/write modes are
+ * umask-masked). The one write path shared by every credential namespace.
+ */
+function writeInto(file, mutate) {
     const dir = dirname(file);
     mkdirSync(dir, { recursive: true, mode: 0o700 });
     try {
@@ -55,7 +83,7 @@ export function writeCredential(provider, key, file = credentialsPath()) {
     }
     const store = readStore(file) ?? { version: CREDENTIALS_VERSION, keys: {} };
     store.version = CREDENTIALS_VERSION;
-    store.keys[provider] = key;
+    mutate(store);
     writeFileSync(file, JSON.stringify(store, null, 2) + "\n", {
         encoding: "utf8",
         mode: 0o600,

package/dist/config/manager.js

@@ -1,6 +1,6 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
-import { configInvalid, configParse } from "../errors/index.js";
+import { configInvalid, configParse, mcpProjectHeaders, } from "../errors/index.js";
 import { CruxyConfigSchema } from "./schema.js";
 import { globalConfigPath, findProjectConfig } from "./paths.js";
 import { readCredential } from "./credentials.js";
@@ -36,6 +36,29 @@ function readJsonFile(path) {
         throw err;
     }
 }
+/**
+ * §0 credential-safety gate (C.27c): a project-scope config file must not set raw
+ * `mcp.servers.<id>.headers`. A live header value is a secret, and this file is a
+ * possibly-cloned repo, so a raw header here is REFUSED — loudly, naming the
+ * server — never merged and never silently dropped (a silent drop would let the
+ * repo believe auth is wired up when it is not). Only user-scope config
+ * (`~/.cruxy/config.json`) may carry raw headers; every other file (a discovered
+ * project config, or an explicit `--config` that may point into a repo) is
+ * project scope. A project config may still NAME a credential via `credentialRef`.
+ */
+function rejectProjectScopeHeaders(obj, file) {
+    const mcp = obj.mcp;
+    if (!isPlainObject(mcp))
+        return;
+    const servers = mcp.servers;
+    if (!isPlainObject(servers))
+        return;
+    for (const [id, server] of Object.entries(servers)) {
+        if (isPlainObject(server) && "headers" in server) {
+            throw mcpProjectHeaders(id, file);
+        }
+    }
+}
 /** Overrides sourced from environment variables. */
 function envOverrides() {
     const out = {};
@@ -67,13 +90,17 @@ export function loadConfig(opts = {}) {
         sources.global = gPath;
     }
     if (opts.configPath) {
-        merged = deepMerge(merged, readJsonFile(opts.configPath));
+        const obj = readJsonFile(opts.configPath);
+        rejectProjectScopeHeaders(obj, opts.configPath);
+        merged = deepMerge(merged, obj);
         sources.explicit = opts.configPath;
     }
     else {
         const pPath = findProjectConfig(opts.cwd);
         if (pPath) {
-            merged = deepMerge(merged, readJsonFile(pPath));
+            const obj = readJsonFile(pPath);
+            rejectProjectScopeHeaders(obj, pPath);
+            merged = deepMerge(merged, obj);
             sources.project = pPath;
         }
     }