@dosu/cli 0.41.0 → 0.43.0-alpha.1

package/README.md

@@ -54,13 +54,16 @@ dosu setup
 brew install dosu-ai/dosu/dosu
 ```
 
-Or tap first:
+The fully qualified name works on every Homebrew version: it taps the repo if needed and, on Homebrew 6.0+, records trust for just the `dosu` formula. To use tapped short names instead:
 
 ```bash
 brew tap dosu-ai/dosu
+brew trust dosu-ai/dosu   # Homebrew 6.0+ only — skip on older versions
 brew install dosu
 ```
 
+**Homebrew 6.0+ only** ([tap trust](https://docs.brew.sh/Tap-Trust), since June 2026): third-party taps start untrusted, so short-name installs or upgrades — including on machines that tapped `dosu-ai/dosu` before upgrading Homebrew — fail with `Error: Refusing to load formula dosu-ai/dosu/dosu from untrusted tap dosu-ai/dosu` until a one-time `brew trust dosu-ai/dosu` (the tap also ships [decant](https://github.com/dosu-ai/decant)). Homebrew 5 and earlier has no trust step and needs none. Tap trust is Homebrew's own consent step, separate from the macOS Gatekeeper warning below — Homebrew installs never trigger Gatekeeper.
+
 ### Manual Download
 
 Download the appropriate archive from the [Releases](https://github.com/dosu-ai/dosu-cli/releases) page.

package/bin/dosu.js

@@ -4759,7 +4759,7 @@ var init_dist4 = __esm(() => {
 function getVersionString() {
   return `v${VERSION}`;
 }
-var VERSION = "0.41.0", INSTALL_CHANNEL = "npm";
+var VERSION = "0.43.0-alpha.1", INSTALL_CHANNEL = "npm";
 
 // src/debug/logger.ts
 import {
@@ -8744,6 +8744,25 @@ function mcpHeaders(apiKey) {
   }
   return { "X-Dosu-API-Key": apiKey };
 }
+function mcpRemoteServer(url, apiKey) {
+  const env = {};
+  const headerArgs = Object.entries(mcpHeaders(apiKey)).flatMap(([key, value]) => {
+    const envKey = key.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+    env[envKey] = value;
+    return ["--header", `${key}:\${${envKey}}`];
+  });
+  return {
+    args: [
+      "-y",
+      `mcp-remote@${MCP_REMOTE_VERSION}`,
+      url,
+      ...headerArgs,
+      "--transport",
+      "http-only"
+    ],
+    env
+  };
+}
 function loadJSONConfig(path3) {
   if (!existsSync6(path3))
     return {};
@@ -8845,7 +8864,7 @@ function removeJSONServer(configPath, topKey) {
   }
   saveJSONConfig(configPath, jsonCfg);
 }
-var import_write_file_atomic, writeFileAtomic;
+var import_write_file_atomic, writeFileAtomic, MCP_REMOTE_VERSION = "0.1.38";
 var init_config_helpers = __esm(() => {
   import_write_file_atomic = __toESM(require_lib(), 1);
   writeFileAtomic = import_write_file_atomic.default;
@@ -10610,7 +10629,7 @@ var MCP_PROVIDER_SLUG = "dosu_mcp";
 // src/mcp/detect.ts
 import { existsSync as existsSync13 } from "node:fs";
 import { homedir as homedir2, platform as platform2 } from "node:os";
-import { join as join12 } from "node:path";
+import { delimiter, dirname as dirname5, join as join12 } from "node:path";
 function isInstalled(paths) {
   return paths.some((p2) => existsSync13(expandHome(p2)));
 }
@@ -10635,6 +10654,20 @@ function appSupportDir() {
     }
   }
 }
+function findNpx() {
+  const bin = platform2() === "win32" ? "npx.cmd" : "npx";
+  for (const dir of (process.env.PATH ?? "").split(delimiter)) {
+    if (!dir)
+      continue;
+    const candidate = join12(dir, bin);
+    if (existsSync13(candidate))
+      return candidate;
+  }
+  throw new Error("npx not found on PATH — Node.js is required (the MCP entry runs `npx mcp-remote`).");
+}
+function npxPathEnv(npx) {
+  return [dirname5(npx), "/usr/bin", "/bin"].join(delimiter);
+}
 var init_detect = () => {};
 
 // src/mcp/providers/base.ts
@@ -10729,6 +10762,9 @@ var init_claude = __esm(() => {
 
 // src/mcp/providers/claude-desktop.ts
 import { join as join14 } from "node:path";
+function configPath() {
+  return join14(appSupportDir(), "Claude", "claude_desktop_config.json");
+}
 var ClaudeDesktopProvider = () => ({
   name: () => "Claude Desktop",
   id: () => "claude-desktop",
@@ -10736,16 +10772,31 @@ var ClaudeDesktopProvider = () => ({
   priority: () => 2,
   detectPaths: () => [join14(appSupportDir(), "Claude")],
   isInstalled: () => isInstalled([join14(appSupportDir(), "Claude")]),
-  globalConfigPath: () => join14(appSupportDir(), "Claude", "claude_desktop_config.json"),
-  isConfigured: () => false,
-  install() {
-    throw new Error("this tool only supports local (stdio) servers and cannot be configured for remote MCP");
+  globalConfigPath: () => configPath(),
+  isConfigured: () => isJSONKeyConfigured(configPath(), "mcpServers"),
+  install(cfg, global) {
+    if (!global)
+      throw new Error("Claude Desktop does not support local installation");
+    if (cfg.mode !== MODE_OSS && !cfg.active_account?.target?.deployment_id)
+      throw new Error("deployment ID is required");
+    const url = cfg.mode === MODE_OSS ? mcpBaseURL() : mcpURL(cfg.active_account.target.deployment_id);
+    const npx = findNpx();
+    const remote = mcpRemoteServer(url, cfg.active_account?.target?.api_key);
+    installJSONServer(configPath(), "mcpServers", {
+      command: npx,
+      args: remote.args,
+      env: { PATH: npxPathEnv(npx), ...remote.env }
+    });
   },
-  remove() {
-    throw new Error("this tool only supports local (stdio) servers and cannot be configured for remote MCP");
+  remove(global) {
+    if (!global)
+      throw new Error("Claude Desktop does not support local removal");
+    removeJSONServer(configPath(), "mcpServers");
   }
 });
 var init_claude_desktop = __esm(() => {
+  init_config();
+  init_config_helpers();
   init_detect();
 });
 
@@ -10824,20 +10875,25 @@ function mcpEndpoint(cfg) {
     throw new Error("deployment ID is required");
   return mcpURL(cfg.active_account?.target?.deployment_id);
 }
+function tomlString(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
 function installDosuToTOML(path3, cfg) {
   let content = readTOML(path3);
   content = removeDosuFromTOML(content);
-  const url = mcpEndpoint(cfg);
-  const headers = mcpHeaders(cfg.active_account?.target?.api_key);
-  const headerEntries = Object.entries(headers).map(([k, v]) => `${k} = "${v}"`).join(`
+  const npx = findNpx();
+  const remote = mcpRemoteServer(mcpEndpoint(cfg), cfg.active_account?.target?.api_key);
+  const env = { PATH: npxPathEnv(npx), ...remote.env };
+  const envEntries = Object.entries(env).map(([key, value]) => `${key} = ${tomlString(value)}`).join(`
 `);
+  const args = remote.args.map(tomlString).join(", ");
   const section = `
 [mcp_servers.dosu]
-type = "http"
-url = "${url}"
-
-[mcp_servers.dosu.http_headers]
-${headerEntries}
+command = ${tomlString(npx)}
+args = [${args}]
+` + `
+[mcp_servers.dosu.env]
+${envEntries}
 `;
   content += section;
   writeTOML(path3, content);
@@ -10864,7 +10920,7 @@ function removeDosuFromTOML(content) {
 `);
 }
 var CodexProvider = () => ({
-  name: () => "Codex CLI",
+  name: () => "Codex (CLI + Desktop)",
   id: () => "codex",
   supportsLocal: () => true,
   priority: () => 8,
@@ -10928,21 +10984,21 @@ var CopilotProvider = () => ({
       };
       installJSONServer(globalPath(), "mcpServers", server);
     } else {
-      const configPath = join18(process.cwd(), ".vscode", "mcp.json");
+      const configPath2 = join18(process.cwd(), ".vscode", "mcp.json");
       const server = {
         type: "http",
         url,
         headers: mcpHeaders(cfg.active_account.target.api_key)
       };
-      installJSONServer(configPath, "servers", server);
+      installJSONServer(configPath2, "servers", server);
     }
   },
   remove(global) {
     if (global) {
       removeJSONServer(globalPath(), "mcpServers");
     } else {
-      const configPath = join18(process.cwd(), ".vscode", "mcp.json");
-      removeJSONServer(configPath, "servers");
+      const configPath2 = join18(process.cwd(), ".vscode", "mcp.json");
+      removeJSONServer(configPath2, "servers");
     }
   }
 });
@@ -11077,17 +11133,17 @@ var MCPorterProvider = () => ({
   globalConfigPath: () => resolveGlobalConfigPath(),
   isConfigured: () => isJSONKeyConfigured(resolveGlobalConfigPath(), "mcpServers"),
   install(cfg, global) {
-    const configPath = global ? resolveGlobalConfigPath() : join22(process.cwd(), "config", "mcporter.json");
+    const configPath2 = global ? resolveGlobalConfigPath() : join22(process.cwd(), "config", "mcporter.json");
     const server = {
       type: "http",
       url: mcpEndpoint4(cfg),
       headers: mcpHeaders(cfg.active_account.target.api_key)
     };
-    installJSONServer(configPath, "mcpServers", server);
+    installJSONServer(configPath2, "mcpServers", server);
   },
   remove(global) {
-    const configPath = global ? resolveGlobalConfigPath() : join22(process.cwd(), "config", "mcporter.json");
-    removeJSONServer(configPath, "mcpServers");
+    const configPath2 = global ? resolveGlobalConfigPath() : join22(process.cwd(), "config", "mcporter.json");
+    removeJSONServer(configPath2, "mcpServers");
   }
 });
 var init_mcporter = __esm(() => {
@@ -11236,7 +11292,7 @@ var init_providers = __esm(() => {
 // src/rules/installer.ts
 import { existsSync as existsSync16, mkdirSync as mkdirSync8, readFileSync as readFileSync14, unlinkSync, writeFileSync as writeFileSync7 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname5, join as join27 } from "node:path";
+import { dirname as dirname6, join as join27 } from "node:path";
 function claudeConfigDir() {
   return process.env.CLAUDE_CONFIG_DIR || join27(homedir4(), ".claude");
 }
@@ -11267,7 +11323,7 @@ async function fetchDosuRule(fetchImpl = globalThis.fetch) {
   return normalizeRule(FALLBACK_DOSU_RULE);
 }
 function ensureParent(path3) {
-  mkdirSync8(dirname5(path3), { recursive: true });
+  mkdirSync8(dirname6(path3), { recursive: true });
 }
 function writeIfChanged(path3, content) {
   if (!existsSync16(path3)) {
@@ -11802,46 +11858,9 @@ code { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; background:
 </body>
 </html>`;
 }
-function buildNextPollScript(settleMsg) {
-  return `<script>
-(function () {
-  var tries = 0;
-  var misses = 0;
-  var setCopy = function (heading, msg) {
-    var h = document.getElementById('heading');
-    var m = document.getElementById('close-msg');
-    if (h && heading) h.textContent = heading;
-    if (m && msg) m.textContent = msg;
-  };
-  var settle = function () { setCopy(null, ${JSON.stringify(settleMsg)}); };
-  var timer = setInterval(function () {
-    tries += 1;
-    if (tries > 720) { clearInterval(timer); settle(); return; }
-    fetch('/next').then(function (res) {
-      misses = 0;
-      if (res.status === 200) {
-        clearInterval(timer);
-        res.json().then(function (body) {
-          if (body && body.url) {
-            setCopy("You're ready to connect your data sources", 'Redirecting...');
-            window.location.replace(body.url);
-          }
-        });
-      } else if (res.status === 410) {
-        clearInterval(timer);
-        settle();
-      }
-    }).catch(function () {
-      misses += 1;
-      if (misses >= 8) { clearInterval(timer); settle(); }
-    });
-  }, 250);
-})();
-</script>`;
-}
-function buildSuccessHtml(email, variant = "auth", withNextPoll = false) {
+function buildSuccessHtml(email, variant = "auth") {
   const copy2 = SUCCESS_COPY[variant];
-  const closeMsg = withNextPoll ? "Hang tight — this tab will continue automatically." : copy2.close;
+  const closeMsg = copy2.close;
   const emailLine = email ? `<p class="email">Signed in as <strong>${email.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;")}</strong></p>` : "";
   return `<!DOCTYPE html>
 <html lang="en">
@@ -11959,7 +11978,6 @@ h1 {
     <span class="tip-label">Did you know?</span>
     You can use Dosu to make your coding agents faster and cheaper. Just ask your agent to use Dosu to update your AGENTS.md.
 </div>
-${withNextPoll ? buildNextPollScript(copy2.close) : ""}
 </body>
 </html>`;
 }
@@ -11970,27 +11988,12 @@ async function startCallbackServer(opts = {}) {
     resolveToken = resolve;
     rejectToken = reject;
   });
-  let nextTarget;
   const http = __require("node:http");
   const httpServer = http.createServer((req, res) => {
     const url = new URL(req.url ?? "/", `http://localhost`);
     const cookieLen = (req.headers.cookie ?? "").length;
     const ua = req.headers["user-agent"] ?? "none";
     logger.debug("auth.server", `Request: ${req.method} ${url.pathname} cookie-len=${cookieLen} ua=${ua} has-token=${url.searchParams.has("access_token")}`);
-    if (opts.nextHold && url.pathname === "/next") {
-      if (nextTarget === undefined) {
-        res.writeHead(204);
-        res.end();
-      } else if (nextTarget === null) {
-        res.writeHead(410);
-        res.end();
-      } else {
-        logger.info("auth.server", "Handing tab onward via /next");
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ url: nextTarget }));
-      }
-      return;
-    }
     if (url.pathname !== "/callback") {
       logger.debug("auth.server", `404: ${url.pathname}`);
       res.writeHead(404, { "Content-Type": "text/plain" });
@@ -12038,7 +12041,7 @@ async function startCallbackServer(opts = {}) {
     });
     logger.info("auth.server", "Served success HTML");
     res.writeHead(200, { "Content-Type": "text/html" });
-    res.end(buildSuccessHtml(email ?? undefined, opts.successVariant ?? "auth", Boolean(opts.nextHold)));
+    res.end(buildSuccessHtml(email ?? undefined, opts.successVariant ?? "auth"));
   });
   await new Promise((resolve) => {
     httpServer.listen(0, "localhost", () => resolve());
@@ -12052,9 +12055,6 @@ async function startCallbackServer(opts = {}) {
       close: () => {
         httpServer.close();
         httpServer.closeAllConnections?.();
-      },
-      setNext: (url) => {
-        nextTarget = url;
       }
     },
     tokenPromise
@@ -12149,11 +12149,9 @@ __export(exports_flow, {
 });
 async function startOAuthFlow(signal, path3 = "/cli/auth", params = {}, onAuthURL, options = {}) {
   const { server, tokenPromise } = await startCallbackServer({
-    nextHold: options.holdNext,
     successVariant: options.successVariant
   });
   let timeoutId;
-  let handedOver = false;
   try {
     const callbackURL = `http://localhost:${server.port}/callback`;
     logger.debug("auth.flow", `Callback URL: ${callbackURL}`);
@@ -12161,29 +12159,26 @@ async function startOAuthFlow(signal, path3 = "/cli/auth", params = {}, onAuthUR
     logger.info("auth.flow", `Auth URL: ${authURL}`);
     options.onAuthURL?.(authURL);
     let browserOpened = false;
-    if (options.suppressBrowserOpen) {
+    const open2 = await Promise.resolve().then(() => (init_open(), exports_open));
+    try {
+      await open2.default(authURL);
       browserOpened = true;
-      logger.info("auth.flow", "Browser open suppressed — caller steers an existing tab");
-    } else {
-      const open2 = await Promise.resolve().then(() => (init_open(), exports_open));
-      try {
-        await open2.default(authURL);
-        browserOpened = true;
-        logger.info("auth.flow", "Browser open command executed");
-        onAuthURL?.(authURL);
-      } catch (openErr) {
-        logger.warn("auth.flow", `Could not open browser automatically: ${openErr instanceof Error ? openErr.message : String(openErr)}`);
-      }
+      logger.info("auth.flow", "Browser open command executed");
+      onAuthURL?.(authURL);
+    } catch (openErr) {
+      logger.warn("auth.flow", `Could not open browser automatically: ${openErr instanceof Error ? openErr.message : String(openErr)}`);
     }
     if (!browserOpened && !options.waitWithoutBrowser) {
       logger.debug("auth.flow", "Browser unavailable — returning to caller for fallback");
       return { browserOpened: false };
     }
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const timeoutMinutes = Math.round(timeoutMs / 60000);
     const timeout = new Promise((_2, reject) => {
       timeoutId = setTimeout(() => {
-        logger.warn("auth.flow", "Authentication timed out (8min)");
-        reject(new Error("Authentication did not complete within 8 minutes. The OAuth state may have expired — please run `dosu login` again."));
-      }, 480000);
+        logger.warn("auth.flow", `Authentication timed out (${timeoutMinutes}min)`);
+        reject(new Error(`Authentication did not complete within ${timeoutMinutes} minutes. If you finished in the browser after the timeout, just re-run the command.`));
+      }, timeoutMs);
     });
     const abort = signal ? new Promise((_2, reject) => {
       signal.addEventListener("abort", () => {
@@ -12193,17 +12188,11 @@ async function startOAuthFlow(signal, path3 = "/cli/auth", params = {}, onAuthUR
     }) : new Promise(() => {});
     const token = await Promise.race([tokenPromise, timeout, abort]);
     logger.info("auth.flow", "Token received");
-    if (options.holdNext) {
-      handedOver = true;
-      return { browserOpened: true, token, server };
-    }
     return { browserOpened: true, token };
   } finally {
     clearTimeout(timeoutId);
-    if (!handedOver) {
-      server.close();
-      logger.debug("auth.flow", "Cleaning up: timeout cleared, server closed");
-    }
+    server.close();
+    logger.debug("auth.flow", "Cleaning up: timeout cleared, server closed");
   }
 }
 function buildAuthURL(callbackURL, path3, extraParams) {
@@ -12211,9 +12200,11 @@ function buildAuthURL(callbackURL, path3, extraParams) {
   const params = new URLSearchParams({ callback: callbackURL, ...extraParams });
   return `${webAppURL}${path3}?${params}`;
 }
+var DEFAULT_TIMEOUT_MS;
 var init_flow = __esm(() => {
   init_logger();
   init_server();
+  DEFAULT_TIMEOUT_MS = 8 * 60 * 1000;
 });
 
 // src/setup/flow.ts
@@ -12223,8 +12214,7 @@ __export(exports_flow2, {
   stepDetectTools: () => stepDetectTools,
   stepConfigureTools: () => stepConfigureTools,
   runSetup: () => runSetup,
-  runInstallSkill: () => runInstallSkill,
-  isStdioOnly: () => isStdioOnly
+  runInstallSkill: () => runInstallSkill
 });
 import { randomUUID } from "node:crypto";
 async function runSetup(opts = {}) {
@@ -12245,11 +12235,6 @@ async function runSetup(opts = {}) {
   if (!authed)
     return;
   cfg = authed.cfg;
-  const authTab = authed.authTab;
-  const releaseAuthTab = () => {
-    authTab?.setNext(null);
-    authTab?.close();
-  };
   await trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_auth_completed");
   let apiClient = new Client(cfg);
   let cloudSetupContext = null;
@@ -12262,36 +12247,41 @@ async function runSetup(opts = {}) {
         reason: "cloud_setup_context_failed"
       });
       s.stop("Workspace load failed");
-      releaseAuthTab();
       return;
     }
     s.stop("Workspace loaded");
   }
   await trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_started", {
-    flow_kind: cloudSetupContext?.kind ?? "oss"
+    flow_kind: cloudSetupContext ? cloudSetupContext.finishedOnboarding ? "setup" : "onboarding" : "oss"
   });
-  const firstRunOnboarding = cfg.mode !== MODE_OSS && cloudSetupContext?.kind === "onboarding" && !opts.deploymentID;
-  if (!firstRunOnboarding) {
-    releaseAuthTab();
-  }
-  if (firstRunOnboarding && cloudSetupContext) {
-    const onboarded = await stepWebOnboarding(cfg, onboardingRunID, authTab);
-    if (!onboarded) {
+  const needsHandshake = cfg.mode !== MODE_OSS && cloudSetupContext !== null && !cloudSetupContext.finishedOnboarding && !opts.deploymentID;
+  if (needsHandshake) {
+    const handshook = await stepSetupHandshake(cfg, onboardingRunID);
+    if (!handshook) {
       await trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_failed", {
         reason: "web_onboarding_incomplete"
       });
       return;
     }
     apiClient = new Client(cfg);
-    const targetOrg = await resolveCurrentOnboardingTargetOrg(cfg);
-    const ok = await bindOnboardingDeployment(apiClient, cfg, targetOrg);
-    if (!ok) {
+    const refreshed = await resolveCloudSetupContext(cfg);
+    if (refreshed === null) {
       await trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_failed", {
-        reason: "onboarding_deployment_failed"
+        reason: "cloud_setup_context_failed"
       });
       return;
     }
-  } else if (!cfg.active_account?.target?.deployment_id || opts.deploymentID) {
+    if (!refreshed.finishedOnboarding) {
+      log.warn("Your account still needs onboarding. Finish it in the browser at the Dosu app, then re-run `dosu setup`.");
+      await trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_failed", {
+        reason: "onboarding_incomplete_after_handshake"
+      });
+      process.exitCode = 1;
+      return;
+    }
+    cloudSetupContext = refreshed;
+  }
+  if (!cfg.active_account?.target?.deployment_id || opts.deploymentID) {
     const ok = await resolveDeployment(apiClient, cfg, opts);
     if (!ok) {
       await trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_failed", {
@@ -12466,9 +12456,13 @@ async function openBrowserForSetup(cfg, onboardingRunID) {
   try {
     const { startOAuthFlow: startOAuthFlow2 } = await Promise.resolve().then(() => (init_flow(), exports_flow));
     const s = spinner();
-    const result = await startOAuthFlow2(undefined, "/cli/auth", onboardingRunID ? { onboarding_run_id: onboardingRunID } : {}, undefined, {
+    const isCloud = cfg.mode !== MODE_OSS;
+    const result = await startOAuthFlow2(undefined, "/cli/auth", {
+      ...isCloud ? { intent: "setup" } : {},
+      ...onboardingRunID ? { onboarding_run_id: onboardingRunID } : {}
+    }, undefined, {
       waitWithoutBrowser: true,
-      holdNext: true,
+      ...isCloud ? { timeoutMs: SETUP_HANDSHAKE_TIMEOUT_MS } : {},
       onAuthURL: (url) => {
         log.message(browserFallbackHint(url));
         s.start("Waiting for authentication...");
@@ -12479,7 +12473,7 @@ async function openBrowserForSetup(cfg, onboardingRunID) {
       return null;
     }
     const token = result.token;
-    s.stop("Authenticated");
+    s.stop(token.email ? `Authenticated as ${token.email}` : "Authenticated");
     logger.info("setup", "Browser auth completed");
     replaceLoginSession(cfg, {
       access_token: token.access_token,
@@ -12487,7 +12481,7 @@ async function openBrowserForSetup(cfg, onboardingRunID) {
       expires_at: Math.floor(Date.now() / 1000) + token.expires_in
     });
     saveConfig(cfg);
-    return { cfg, authTab: result.server };
+    return { cfg };
   } catch (err) {
     const msg = err instanceof Error ? err.stack ?? err.message : String(err);
     logger.error("setup", `Auth failed: ${msg}`);
@@ -12510,20 +12504,19 @@ async function openBrowserForSetup(cfg, onboardingRunID) {
     return null;
   }
 }
-async function stepWebOnboarding(cfg, onboardingRunID, authTab) {
-  logger.info("setup", "Step: web onboarding handoff");
-  log.info("Almost there — connect your repos in the browser and we'll pick up from here.");
+async function stepSetupHandshake(cfg, onboardingRunID) {
+  logger.info("setup", "Step: setup handshake");
+  log.info("Almost there — finish setting up in the browser and we'll pick up from here.");
   const s = spinner();
   try {
     const { startOAuthFlow: startOAuthFlow2 } = await Promise.resolve().then(() => (init_flow(), exports_flow));
-    const result = await startOAuthFlow2(undefined, "/onboarding/connections", { source: "cli", onboarding_run_id: onboardingRunID }, undefined, {
+    const result = await startOAuthFlow2(undefined, "/cli/auth", { intent: "setup", onboarding_run_id: onboardingRunID }, undefined, {
       waitWithoutBrowser: true,
-      suppressBrowserOpen: Boolean(authTab),
       successVariant: "onboarding",
+      timeoutMs: SETUP_HANDSHAKE_TIMEOUT_MS,
       onAuthURL: (url) => {
-        authTab?.setNext(url);
         log.message(browserFallbackHint(url));
-        s.start("Waiting for onboarding to finish in the browser...");
+        s.start("Waiting for the browser...");
       }
     });
     if (!result.browserOpened) {
@@ -12536,17 +12529,20 @@ async function stepWebOnboarding(cfg, onboardingRunID, authTab) {
       expires_at: Math.floor(Date.now() / 1000) + result.token.expires_in
     });
     saveConfig(cfg);
-    s.stop("Onboarding finished in the browser");
-    logger.info("setup", "Web onboarding handoff completed");
+    s.stop(result.token.email ? `Authenticated as ${result.token.email}` : "Browser setup finished");
+    logger.info("setup", "Setup handshake completed");
     return true;
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    logger.warn("setup", `Web onboarding handoff did not complete: ${msg}`);
-    s.stop("Onboarding not completed");
-    log.warn("Didn't hear back from the browser. Finish onboarding there, then re-run `dosu setup`.");
+    logger.warn("setup", `Setup handshake did not complete: ${msg}`);
+    s.stop("Setup not completed");
+    const { OAuthCallbackError: OAuthCallbackError2 } = await Promise.resolve().then(() => (init_errors(), exports_errors));
+    if (err instanceof OAuthCallbackError2) {
+      log.error(err.userMessage);
+      return false;
+    }
+    log.warn("Didn't hear back from the browser. If it opened the Dosu app instead of the setup " + "wizard, your CLI and browser may be signed in to different accounts — run " + "`dosu logout`, then retry. Otherwise finish in the browser and re-run `dosu setup`.");
     return false;
-  } finally {
-    authTab?.close();
   }
 }
 async function resolveCloudSetupContext(cfg) {
@@ -12560,22 +12556,9 @@ async function resolveCloudSetupContext(cfg) {
     }
     bindAccountIdentity(cfg, profile.user_id);
     saveConfig(cfg);
-    if (profile.finished_onboarding === true) {
-      return {
-        kind: "setup",
-        profileUserID: profile.user_id
-      };
-    }
-    const targetOrg = await resolveOnboardingTargetOrg(trpc);
-    if (!targetOrg) {
-      log.error("Could not determine your onboarding organization.");
-      return null;
-    }
-    logger.info("setup", `First-run onboarding detected for org ${targetOrg.org_id}`);
     return {
-      kind: "onboarding",
       profileUserID: profile.user_id,
-      targetOrg
+      finishedOnboarding: profile.finished_onboarding === true
     };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -12584,53 +12567,6 @@ async function resolveCloudSetupContext(cfg) {
     return null;
   }
 }
-async function resolveOnboardingTargetOrg(trpc) {
-  const accessibleOrgs = await trpc.organization.getOrganizations.query();
-  const ownerOrg = accessibleOrgs.find((org) => org.user_role === "OWNER");
-  if (ownerOrg) {
-    return ownerOrg;
-  }
-  return accessibleOrgs[0] ?? null;
-}
-async function resolveCurrentOnboardingTargetOrg(cfg) {
-  try {
-    const { createTypedClient: createTypedClient2 } = await Promise.resolve().then(() => (init_trpc(), exports_trpc));
-    const trpc = createTypedClient2(cfg);
-    const profile = await trpc.user.getCliOnboardingContext.query();
-    if (!profile?.user_id)
-      return null;
-    bindAccountIdentity(cfg, profile.user_id);
-    saveConfig(cfg);
-    return await resolveOnboardingTargetOrg(trpc);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    logger.error("setup", `Failed to resolve post-onboarding organization: ${msg}`);
-    log.error(`Could not determine your onboarding organization: ${msg}`);
-    return null;
-  }
-}
-async function bindOnboardingDeployment(apiClient, cfg, targetOrg) {
-  if (!targetOrg) {
-    log.error("Could not determine your onboarding organization.");
-    return false;
-  }
-  const deployment = await resolveOnboardingDeployment(apiClient, targetOrg);
-  if (!deployment) {
-    log.error(`No MCP found for ${targetOrg.name}.`);
-    return false;
-  }
-  cfg.mode = undefined;
-  applyDeployment(cfg, deployment);
-  logger.info("setup", `Bound onboarding context org=${targetOrg.org_id} deployment=${deployment.deployment_id}`);
-  log.success(`Organization
-${dim(targetOrg.name)}`);
-  return true;
-}
-async function resolveOnboardingDeployment(apiClient, targetOrg) {
-  const deployments = await fetchDeployments(apiClient);
-  const orgDeployments = deployments.filter((deployment) => deployment.org_id === targetOrg.org_id);
-  return orgDeployments.find((deployment) => deployment.provider_slug === MCP_PROVIDER_SLUG) ?? orgDeployments[0] ?? null;
-}
 async function resolveDeployment(apiClient, cfg, opts) {
   if (opts.deploymentID) {
     const d2 = await stepResolveDeployment(apiClient, opts.deploymentID);
@@ -12728,6 +12664,13 @@ async function stepSelectDeployment(apiClient, org) {
 ${dim(deployments[0].name)}`);
       return deployments[0];
     }
+    const mcpDeployments = deployments.filter((d2) => d2.provider_slug === MCP_PROVIDER_SLUG);
+    if (mcpDeployments.length === 1) {
+      logger.info("setup", `Selected deployment: ${mcpDeployments[0].name} (auto, single MCP)`);
+      log.success(`Using MCP
+${dim(mcpDeployments[0].name)}`);
+      return mcpDeployments[0];
+    }
     const selected = await select({
       message: "Select an MCP",
       options: deployments.map((d2) => ({ label: d2.name, value: d2.deployment_id }))
@@ -12771,11 +12714,8 @@ ${dim("created")}`);
     return null;
   }
 }
-function isStdioOnly(p2) {
-  return p2.id() === "claude-desktop";
-}
 function stepDetectTools() {
-  return allSetupProviders().filter((p2) => p2.isInstalled() && !isStdioOnly(p2));
+  return allSetupProviders().filter((p2) => p2.isInstalled());
 }
 async function stepSelectTools(detected) {
   const configuredMap = new Map;
@@ -12861,6 +12801,7 @@ function stepShowSummary(results) {
     log.success("All agents already configured. No changes needed.");
   }
 }
+var SETUP_HANDSHAKE_TIMEOUT_MS = 1800000;
 var init_flow2 = __esm(() => {
   init_dist8();
   init_client();
@@ -12877,7 +12818,7 @@ var init_flow2 = __esm(() => {
 
 // src/commands/insights.ts
 import { existsSync as existsSync18, mkdirSync as mkdirSync9, readdirSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "node:fs";
-import { dirname as dirname6, join as join29 } from "node:path";
+import { dirname as dirname7, join as join29 } from "node:path";
 function shuffled(arr) {
   const copy2 = [...arr];
   for (let i2 = copy2.length - 1;i2 > 0; i2--) {
@@ -13075,7 +13016,7 @@ function defaultRunner(cfg) {
     build: buildInsights,
     render: renderHTML,
     writeFile: (path3, content) => {
-      const dir = dirname6(path3);
+      const dir = dirname7(path3);
       if (!existsSync18(dir))
         mkdirSync9(dir, { recursive: true, mode: 448 });
       writeFileSync9(path3, content, { mode: 384 });
@@ -13519,7 +13460,7 @@ __export(exports_flow3, {
 async function runAgentSetup(opts) {
   const provider = allSetupProviders().find((p2) => p2.id() === opts.tool.toLowerCase());
   if (!provider) {
-    const available = allSetupProviders().filter((p2) => !isStdioOnly(p2)).map((p2) => p2.id()).join(", ");
+    const available = allSetupProviders().map((p2) => p2.id()).join(", ");
     emitError({
       step: "setup",
       reason: "unknown_tool",
@@ -13527,14 +13468,6 @@ async function runAgentSetup(opts) {
     });
     return 2;
   }
-  if (isStdioOnly(provider)) {
-    emitError({
-      step: "setup",
-      reason: "tool_unsupported_in_agent_mode",
-      agent_next_steps: `${provider.name()} is not supported by agent setup. Tell the user to run 'dosu mcp add ${provider.id()}' manually after signing in.`
-    });
-    return 2;
-  }
   let cfg = loadConfig();
   if (opts.loginTicket) {
     const redeemed = await redeemTicket(opts.loginTicket, cfg);
@@ -13764,7 +13697,7 @@ async function resolveDeployment2(client, cfg, opts) {
       emitError({
         step: "deployment",
         reason: "no_deployments",
-        agent_next_steps: "No Dosu deployments are accessible to this account. Tell the user to create one at https://app.dosu.dev before retrying."
+        agent_next_steps: "No Dosu deployments are accessible to this account. The CLI may be signed in to a " + "different account than the user expects — have them run 'dosu logout' and retry, or " + "create a deployment at https://app.dosu.dev before retrying."
       });
       return { code: 1, cfg };
     }
@@ -13773,7 +13706,7 @@ async function resolveDeployment2(client, cfg, opts) {
       emitError({
         step: "deployment",
         reason: "no_mcp_deployment",
-        agent_next_steps: "Account has deployments but none of them back an MCP server. Tell the user to create an MCP deployment at https://app.dosu.dev, or pass --deployment <id> to target a specific deployment."
+        agent_next_steps: "Account has deployments but none of them back an MCP server. The CLI may be signed in " + "to a different account than the user expects — have them run 'dosu logout' and retry, " + "create an MCP deployment at https://app.dosu.dev, or pass --deployment <id> to target " + "a specific deployment."
       });
       return { code: 1, cfg };
     }
@@ -13862,7 +13795,7 @@ function buildResumeCommand(tool, ticket, deploymentID) {
   return parts.join(" ");
 }
 function listAgentSupportedToolIDs() {
-  return allSetupProviders().filter((p2) => !isStdioOnly(p2)).map((p2) => p2.id());
+  return allSetupProviders().map((p2) => p2.id());
 }
 var NPX_INVOCATION = "npx @dosu/cli@latest";
 var init_flow3 = __esm(() => {
@@ -13874,7 +13807,6 @@ var init_flow3 = __esm(() => {
   init_providers();
   init_installer();
   init_agents_md_step();
-  init_flow2();
 });
 
 // src/cli/cli.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dosu/cli",
-  "version": "0.41.0",
+  "version": "0.43.0-alpha.1",
   "type": "module",
   "description": "Dosu CLI - Manage MCP servers for AI tools",
   "license": "MIT",