@duckmind/dm-linux-x64 0.65.5 → 0.65.6

package/extensions/dm-mcp-adapter/bearer-command-resolver.js

@@ -0,0 +1,182 @@
+import { spawn } from "node:child_process";
+const DEFAULT_TTL_MS = 5 * 60000;
+const ENV_TTL_MS = "DM_MCP_ADAPTER_BEARER_COMMAND_TTL_MS";
+const COMMAND_TIMEOUT_MS = 1e4;
+const COMMAND_MAX_OUTPUT_BYTES = 1024 * 1024;
+const USE_PROCESS_GROUP = process.platform !== "win32";
+function resolveDefaultTtlMs() {
+  const parsed = Number(process.env[ENV_TTL_MS] || DEFAULT_TTL_MS);
+  return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : DEFAULT_TTL_MS;
+}
+function abortReason(signal) {
+  return signal.reason ?? new DOMException("The operation was aborted", "AbortError");
+}
+function runCommand(command, context, signal) {
+  return new Promise((resolve, reject) => {
+    let output = Buffer.alloc(0);
+    let settled = false;
+    let terminating = false;
+    const child = spawn(command.slice(1), {
+      shell: true,
+      stdio: ["ignore", "pipe", "ignore"],
+      windowsHide: true,
+      detached: USE_PROCESS_GROUP
+    });
+    const kill = async () => {
+      if (child.pid === undefined)
+        return;
+      if (!USE_PROCESS_GROUP) {
+        await new Promise((resolveKill, rejectKill) => {
+          const killer = spawn("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
+            stdio: "ignore",
+            windowsHide: true
+          });
+          killer.on("error", () => rejectKill(new Error("Failed to stop bearer token command")));
+          killer.on("close", (code) => {
+            if (code === 0 || code === 128)
+              resolveKill();
+            else
+              rejectKill(new Error(`Failed to stop bearer token command: taskkill exited with code ${code ?? "unknown"}`));
+          });
+        });
+        return;
+      }
+      try {
+        process.kill(-child.pid, "SIGKILL");
+      } catch (error) {
+        if (error.code !== "ESRCH")
+          throw error;
+      }
+    };
+    const finish = (error, token) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      signal.removeEventListener("abort", onAbort);
+      if (error !== undefined)
+        reject(error);
+      else
+        resolve(token);
+    };
+    const terminate = async (error) => {
+      if (settled || terminating)
+        return;
+      terminating = true;
+      clearTimeout(timer);
+      signal.removeEventListener("abort", onAbort);
+      try {
+        await kill();
+        finish(error);
+      } catch (cleanupError) {
+        finish(cleanupError);
+      }
+    };
+    const onAbort = () => {
+      terminate(abortReason(signal));
+    };
+    const timer = setTimeout(() => {
+      terminate(new Error(`Failed to resolve ${context}: command timed out after ${COMMAND_TIMEOUT_MS}ms`));
+    }, COMMAND_TIMEOUT_MS);
+    signal.addEventListener("abort", onAbort, { once: true });
+    if (signal.aborted) {
+      onAbort();
+      return;
+    }
+    child.on("error", () => {
+      if (!terminating)
+        finish(new Error(`Failed to resolve ${context}: command failed to start`));
+    });
+    child.stdout.on("data", (chunk) => {
+      if (settled || terminating)
+        return;
+      output = Buffer.concat([output, Buffer.from(chunk)]);
+      if (output.byteLength > COMMAND_MAX_OUTPUT_BYTES) {
+        terminate(new Error(`Failed to resolve ${context}: command output exceeded 1 MiB`));
+      }
+    });
+    child.on("close", (code) => {
+      if (settled || terminating)
+        return;
+      if (code !== 0) {
+        finish(new Error(`Failed to resolve ${context}: command exited with code ${code ?? "unknown"}`));
+        return;
+      }
+      const token = output.toString("utf8").trim();
+      if (!token) {
+        finish(new Error(`Failed to resolve ${context}: command returned empty output`));
+        return;
+      }
+      finish(undefined, token);
+    });
+  });
+}
+
+export class BearerCommandResolver {
+  #command;
+  #context;
+  #ttlMs;
+  #cached;
+  #failure;
+  #inflight;
+  constructor(command, context, ttlMs = resolveDefaultTtlMs()) {
+    this.#command = command;
+    this.#context = context;
+    this.#ttlMs = ttlMs;
+  }
+  resolve(signal) {
+    if (signal?.aborted)
+      return Promise.reject(abortReason(signal));
+    const now = Date.now();
+    if (this.#cached !== undefined && now < this.#cached.expiresAt) {
+      return Promise.resolve(this.#cached.token);
+    }
+    if (this.#failure !== undefined && now < this.#failure.retryAt) {
+      return this.#cached !== undefined ? Promise.resolve(this.#cached.token) : Promise.reject(this.#failure.error);
+    }
+    let inflight = this.#inflight;
+    if (inflight === undefined) {
+      const controller = new AbortController;
+      let current;
+      const promise = runCommand(this.#command, this.#context, controller.signal).then((token) => {
+        this.#cached = { token, expiresAt: Date.now() + this.#ttlMs };
+        this.#failure = undefined;
+        return token;
+      }).catch((error) => {
+        if (!controller.signal.aborted) {
+          this.#failure = { error, retryAt: Date.now() + this.#ttlMs };
+        }
+        if (this.#cached !== undefined)
+          return this.#cached.token;
+        throw error;
+      }).finally(() => {
+        if (this.#inflight === current)
+          this.#inflight = undefined;
+      });
+      current = { controller, promise, waiters: 0 };
+      this.#inflight = current;
+      inflight = current;
+    }
+    return this.#wait(inflight, signal);
+  }
+  #wait(inflight, signal) {
+    inflight.waiters++;
+    let onAbort;
+    const result = signal === undefined ? inflight.promise : Promise.race([
+      inflight.promise,
+      new Promise((_resolve, reject) => {
+        onAbort = () => reject(abortReason(signal));
+        signal.addEventListener("abort", onAbort, { once: true });
+      })
+    ]);
+    return result.finally(() => {
+      if (onAbort)
+        signal.removeEventListener("abort", onAbort);
+      inflight.waiters--;
+      if (this.#inflight === inflight && inflight.waiters === 0) {
+        this.#inflight = undefined;
+        inflight.controller.abort(signal?.reason);
+      }
+    });
+  }
+}

package/extensions/dm-mcp-adapter/claude-plugin-loader.js

@@ -0,0 +1,350 @@
+import { closeSync, constants, existsSync, fstatSync, openSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
+import { basename, isAbsolute, relative, resolve, sep } from "node:path";
+import { formatServerNamespace } from "./types.js";
+import { parseJsonWithComments } from "./utils.js";
+export function loadClaudePluginBundles(plugins, cwd, validateConfig, components) {
+  const mcpServers = {};
+  const skillPaths = [];
+  const seenRoots = new Set;
+  const seenNames = new Map;
+  const serverSources = new Map;
+  const normalizedServerNames = new Map;
+  for (const plugin of plugins ?? []) {
+    const configuredPath = resolvePluginPath(plugin.path, cwd);
+    const pluginRoot = resolvePluginRoot(configuredPath);
+    if (!pluginRoot)
+      continue;
+    if (seenRoots.has(pluginRoot)) {
+      console.warn(`Claude plugin path is configured more than once: ${pluginRoot}`);
+      continue;
+    }
+    seenRoots.add(pluginRoot);
+    const manifest = readPluginManifest(pluginRoot);
+    if (manifest === false)
+      continue;
+    const pluginName = manifest?.name ?? basename(pluginRoot);
+    const previousPluginRoot = seenNames.get(pluginName);
+    if (previousPluginRoot && previousPluginRoot !== pluginRoot) {
+      console.warn(`Claude plugin name conflict for "${pluginName}": ${previousPluginRoot} and ${pluginRoot}`);
+    } else {
+      seenNames.set(pluginName, pluginRoot);
+    }
+    if (components.mcp && plugin.mcp === true) {
+      const configPath = resolveContainedComponent(pluginRoot, ".mcp.json", "file", pluginName);
+      if (configPath) {
+        const config = readPluginMcpConfig(configPath, pluginName, pluginRoot, validateConfig);
+        for (const [serverName, server] of Object.entries(config.mcpServers)) {
+          const normalizedName = formatServerNamespace(serverName);
+          const previousName = normalizedServerNames.get(normalizedName);
+          const previousSource = previousName ? serverSources.get(previousName) : undefined;
+          if (previousName && previousSource) {
+            console.warn(`Claude plugin MCP server name conflict for "${serverName}": normalized name collides with "${previousName}" from ${previousSource}; the first plugin wins over ${configPath}`);
+            continue;
+          }
+          normalizedServerNames.set(normalizedName, serverName);
+          serverSources.set(serverName, configPath);
+          mcpServers[serverName] = server;
+        }
+      }
+    }
+    if (components.skills && plugin.skills === true) {
+      const skillsPath = resolveContainedComponent(pluginRoot, "skills", "directory", pluginName);
+      if (skillsPath) {
+        try {
+          for (const skillPath of discoverContainedSkillFiles(skillsPath, pluginName)) {
+            if (!skillPaths.includes(skillPath))
+              skillPaths.push(skillPath);
+          }
+        } catch (error) {
+          console.warn(`Claude plugin "${pluginName}" skills could not be read at ${skillsPath}: ${formatError(error)}`);
+        }
+      }
+    }
+  }
+  return { mcpServers, skillPaths };
+}
+function resolvePluginPath(path, cwd) {
+  if (path === "~")
+    return resolve(process.env.HOME ?? "", ".");
+  if (path.startsWith("~/"))
+    return resolve(process.env.HOME ?? "", path.slice(2));
+  return isAbsolute(path) ? resolve(path) : resolve(cwd, path);
+}
+function resolvePluginRoot(path) {
+  if (!existsSync(path)) {
+    console.warn(`Claude plugin path does not exist: ${path}`);
+    return null;
+  }
+  const stats = safeStat(path, "Claude plugin path");
+  if (!stats)
+    return null;
+  if (!stats.isDirectory()) {
+    console.warn(`Claude plugin path is not a directory: ${path}`);
+    return null;
+  }
+  return safeRealpath(path, "Claude plugin path");
+}
+function readPluginManifest(pluginRoot) {
+  const configuredManifestPath = resolve(pluginRoot, ".claude-plugin", "plugin.json");
+  if (!existsSync(configuredManifestPath))
+    return null;
+  const stats = safeStat(configuredManifestPath, "Claude plugin manifest");
+  if (!stats)
+    return null;
+  if (!stats.isFile()) {
+    console.warn(`Claude plugin manifest is not a regular file: ${configuredManifestPath}`);
+    return false;
+  }
+  const manifestPath = safeRealpath(configuredManifestPath, "Claude plugin manifest");
+  if (!manifestPath)
+    return null;
+  if (!isContainedPath(pluginRoot, manifestPath)) {
+    console.warn(`Claude plugin manifest resolves outside the configured plugin directory: ${manifestPath}`);
+    return false;
+  }
+  const manifestText = safeReadFile(manifestPath, "Claude plugin manifest", pluginRoot);
+  if (manifestText === null)
+    return null;
+  let raw;
+  try {
+    raw = parseJsonWithComments(manifestText);
+  } catch (error) {
+    console.warn(`Claude plugin manifest contains invalid JSON at ${manifestPath}: ${formatError(error)}`);
+    return false;
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    console.warn(`Claude plugin manifest must be a JSON object: ${manifestPath}`);
+    return false;
+  }
+  const manifest = raw;
+  if (typeof manifest.name !== "string" || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(manifest.name)) {
+    console.warn(`Claude plugin manifest has an invalid name at ${manifestPath}: expected kebab-case`);
+    return false;
+  }
+  if (!hasValidManifestFieldTypes(manifest)) {
+    console.warn(`Claude plugin manifest has invalid field types at ${manifestPath}`);
+    return false;
+  }
+  return { name: manifest.name };
+}
+function hasValidManifestFieldTypes(manifest) {
+  for (const field of ["$schema", "displayName", "version", "description", "homepage", "repository", "license"]) {
+    if (manifest[field] !== undefined && typeof manifest[field] !== "string")
+      return false;
+  }
+  for (const field of ["commands", "agents", "skills", "hooks", "mcpServers", "lspServers", "outputStyles"]) {
+    const value = manifest[field];
+    if (value !== undefined && typeof value !== "string" && (!Array.isArray(value) || value.some((item) => typeof item !== "string")))
+      return false;
+  }
+  if (manifest.defaultEnabled !== undefined && typeof manifest.defaultEnabled !== "boolean")
+    return false;
+  if (manifest.keywords !== undefined && (!Array.isArray(manifest.keywords) || manifest.keywords.some((value) => typeof value !== "string")))
+    return false;
+  if (manifest.author !== undefined) {
+    if (!manifest.author || typeof manifest.author !== "object" || Array.isArray(manifest.author))
+      return false;
+    const author = manifest.author;
+    if (typeof author.name !== "string")
+      return false;
+    if (author.email !== undefined && typeof author.email !== "string")
+      return false;
+    if (author.url !== undefined && typeof author.url !== "string")
+      return false;
+  }
+  if (manifest.metadata !== undefined && (!manifest.metadata || typeof manifest.metadata !== "object" || Array.isArray(manifest.metadata)))
+    return false;
+  return true;
+}
+function resolveContainedComponent(pluginRoot, component, expected, pluginName) {
+  const path = resolve(pluginRoot, component);
+  if (!existsSync(path)) {
+    console.warn(`Claude plugin "${pluginName}" is missing ${component}: ${path}`);
+    return null;
+  }
+  const stats = safeStat(path, `Claude plugin "${pluginName}" ${component}`);
+  if (!stats)
+    return null;
+  if (expected === "file" ? !stats.isFile() : !stats.isDirectory()) {
+    console.warn(`Claude plugin "${pluginName}" ${component} is not a ${expected}: ${path}`);
+    return null;
+  }
+  const realPath = safeRealpath(path, `Claude plugin "${pluginName}" ${component}`);
+  if (!realPath)
+    return null;
+  if (!isContainedPath(pluginRoot, realPath)) {
+    console.warn(`Claude plugin "${pluginName}" ${component} resolves outside the configured plugin directory: ${realPath}`);
+    return null;
+  }
+  return realPath;
+}
+function discoverContainedSkillFiles(skillsRoot, pluginName) {
+  const skillFiles = [];
+  const visitedDirectories = new Set;
+  const visit = (directory) => {
+    const realDirectory = safeRealpath(directory, `Claude plugin "${pluginName}" skill directory`);
+    if (!realDirectory)
+      return;
+    if (!isContainedPath(skillsRoot, realDirectory)) {
+      console.warn(`Claude plugin "${pluginName}" skill path resolves outside its skills directory: ${directory} -> ${realDirectory}`);
+      return;
+    }
+    if (visitedDirectories.has(realDirectory))
+      return;
+    visitedDirectories.add(realDirectory);
+    const entries = safeReadDir(realDirectory, `Claude plugin "${pluginName}" skill directory`);
+    if (!entries)
+      return;
+    for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+      const path = resolve(realDirectory, entry.name);
+      if (entry.isSymbolicLink()) {
+        const target = safeRealpath(path, `Claude plugin "${pluginName}" skill path`);
+        if (!target)
+          continue;
+        if (!isContainedPath(skillsRoot, target)) {
+          console.warn(`Claude plugin "${pluginName}" skill path resolves outside its skills directory: ${path} -> ${target}`);
+          continue;
+        }
+        const targetStats = safeStat(target, `Claude plugin "${pluginName}" skill path`);
+        if (!targetStats)
+          continue;
+        if (targetStats.isDirectory())
+          visit(target);
+        else if (targetStats.isFile() && entry.name === "SKILL.md")
+          skillFiles.push(target);
+      } else if (entry.isDirectory()) {
+        visit(path);
+      } else if (entry.isFile() && entry.name === "SKILL.md") {
+        const realPath = safeRealpath(path, `Claude plugin "${pluginName}" skill path`);
+        if (!realPath)
+          continue;
+        if (!isContainedPath(skillsRoot, realPath)) {
+          console.warn(`Claude plugin "${pluginName}" skill path resolves outside its skills directory: ${path} -> ${realPath}`);
+          continue;
+        }
+        skillFiles.push(realPath);
+      }
+    }
+  };
+  visit(skillsRoot);
+  return skillFiles;
+}
+function readPluginMcpConfig(configPath, pluginName, pluginRoot, validateConfig) {
+  let raw;
+  try {
+    const configText = safeReadFile(configPath, `Claude plugin "${pluginName}" MCP config`, pluginRoot);
+    if (configText === null)
+      return { mcpServers: {} };
+    raw = parseJsonWithComments(configText);
+  } catch (error) {
+    console.warn(`Claude plugin "${pluginName}" has invalid MCP config at ${configPath}: ${formatError(error)}`);
+    return { mcpServers: {} };
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    console.warn(`Claude plugin "${pluginName}" MCP config must be a JSON object: ${configPath}`);
+    return { mcpServers: {} };
+  }
+  const servers = raw.mcpServers;
+  if (!servers || typeof servers !== "object" || Array.isArray(servers)) {
+    console.warn(`Claude plugin "${pluginName}" MCP config must contain an mcpServers object: ${configPath}`);
+    return { mcpServers: {} };
+  }
+  const config = validateConfig(raw);
+  const validated = {};
+  for (const serverName of Object.keys(servers)) {
+    if (serverName.trim().length === 0) {
+      console.warn(`Claude plugin "${pluginName}" has an empty MCP server name at ${configPath}`);
+      continue;
+    }
+    const parsed = config.mcpServers[serverName];
+    if (!parsed || !hasValidServerTransport(parsed)) {
+      console.warn(`Claude plugin "${pluginName}" has invalid MCP server "${serverName}" at ${configPath}: expected exactly one non-empty command, url, or socket transport`);
+      continue;
+    }
+    validated[serverName] = replacePluginRoot(parsed, pluginRoot);
+  }
+  return { mcpServers: validated };
+}
+function hasValidServerTransport(entry) {
+  return [entry.command, entry.url, entry.socket].filter((value) => typeof value === "string" && value.trim().length > 0).length === 1;
+}
+function replacePluginRoot(entry, pluginRoot) {
+  const replace = (value) => value.replaceAll("${CLAUDE_PLUGIN_ROOT}", pluginRoot);
+  const replaced = replaceStrings(entry, replace);
+  if (typeof replaced.command === "string") {
+    replaced.env = { ...replaced.env, CLAUDE_PLUGIN_ROOT: pluginRoot };
+  }
+  return replaced;
+}
+function replaceStrings(value, replace) {
+  if (typeof value === "string")
+    return replace(value);
+  if (Array.isArray(value))
+    return value.map((item) => replaceStrings(item, replace));
+  if (!value || typeof value !== "object")
+    return value;
+  return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, replaceStrings(entry, replace)]));
+}
+function isContainedPath(root, path) {
+  const rel = relative(root, path);
+  return rel === "" || !rel.startsWith("..") && !rel.startsWith(sep) && !isAbsolute(rel);
+}
+function safeStat(path, description) {
+  try {
+    return statSync(path);
+  } catch (error) {
+    console.warn(`${description} could not be read: ${path}: ${formatError(error)}`);
+    return null;
+  }
+}
+function safeRealpath(path, description) {
+  try {
+    return realpathSync(path);
+  } catch (error) {
+    console.warn(`${description} could not be read: ${path}: ${formatError(error)}`);
+    return null;
+  }
+}
+function safeReadFile(path, description, containmentRoot) {
+  let fd;
+  try {
+    fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const openedStats = fstatSync(fd);
+    if (!openedStats.isFile()) {
+      console.warn(`${description} is not a regular file: ${path}`);
+      return null;
+    }
+    const resolvedPath = safeRealpath(path, description);
+    if (!resolvedPath)
+      return null;
+    if (!isContainedPath(containmentRoot, resolvedPath)) {
+      console.warn(`${description} resolves outside the configured plugin directory: ${resolvedPath}`);
+      return null;
+    }
+    const currentStats = safeStat(resolvedPath, description);
+    if (!currentStats)
+      return null;
+    if (openedStats.dev !== currentStats.dev || openedStats.ino !== currentStats.ino) {
+      console.warn(`${description} changed while being read: ${path}`);
+      return null;
+    }
+    return readFileSync(fd, "utf8");
+  } catch (error) {
+    console.warn(`${description} could not be read: ${path}: ${formatError(error)}`);
+    return null;
+  } finally {
+    if (fd !== undefined)
+      closeSync(fd);
+  }
+}
+function safeReadDir(path, description) {
+  try {
+    return readdirSync(path, { withFileTypes: true });
+  } catch (error) {
+    console.warn(`${description} could not be read: ${path}: ${formatError(error)}`);
+    return null;
+  }
+}
+function formatError(error) {
+  return error instanceof Error ? error.message : String(error);
+}

package/extensions/dm-mcp-adapter/cli.js

@@ -75,6 +75,11 @@ function printHelp(log = console.log) {
   log("  dm-mcp-adapter token set <server>     Store a token read from stdin (masked prompt or pipe; never argv)");
   log("  dm-mcp-adapter token status <server>  Report whether a stored token matches the configured URL");
   log("  dm-mcp-adapter token remove <server>  Remove the stored token");
+  log("");
+  log("Jev API key storage (SYSTEMONE_ENDPOINT selects the provider endpoint):");
+  log("  dm-mcp-adapter key set systemone     Store a key read from stdin (masked prompt or pipe; never argv)");
+  log("  dm-mcp-adapter key status systemone  Report the effective credential source without revealing it");
+  log("  dm-mcp-adapter key remove systemone  Remove the stored key");
 }
 function readJsonFile(filePath) {
   return JSON.parse(stripJsonComments(fs.readFileSync(filePath, "utf-8"), { trailingCommas: true }));
@@ -192,9 +197,9 @@ async function importTokenModules(error) {
     return;
   }
 }
-function readTokenFromStdin(stdin) {
+function readSecretFromStdin(stdin, prompt = "Enter bearer token (input hidden): ") {
   if (stdin.isTTY)
-    return readTokenMasked(stdin);
+    return readSecretMasked(stdin, prompt);
   return new Promise((resolve, reject) => {
     let data = "";
     stdin.setEncoding("utf8");
@@ -205,9 +210,9 @@ function readTokenFromStdin(stdin) {
     stdin.on("error", reject);
   });
 }
-function readTokenMasked(stdin) {
+function readSecretMasked(stdin, prompt) {
   return new Promise((resolve, reject) => {
-    process.stderr.write("Enter bearer token (input hidden): ");
+    process.stderr.write(prompt);
     stdin.setRawMode(true);
     stdin.resume();
     stdin.setEncoding("utf8");
@@ -278,7 +283,7 @@ async function runToken(argv, log, error, stdin) {
     return 1;
   }
   if (action === "set") {
-    const token = await readTokenFromStdin(stdin);
+    const token = await readSecretFromStdin(stdin);
     if (!token) {
       error("No token provided on stdin.");
       return 1;
@@ -321,6 +326,75 @@ async function runToken(argv, log, error, stdin) {
   log(`Bearer token removed for "${safeName}".`);
   return 0;
 }
+async function runKey(argv, log, error, stdin) {
+  const [action, provider, ...extra] = argv;
+  if (!["set", "status", "remove"].includes(action) || provider !== "systemone" && provider !== "typesafe") {
+    error("Usage: dm-mcp-adapter key <set|status|remove> systemone");
+    error("`key set` reads the API key from stdin only. Never pass the key as an argument.");
+    return 1;
+  }
+  if (extra.length > 0) {
+    error("Unexpected extra arguments. The API key must not be passed on the command line; pipe it on stdin or use the interactive prompt.");
+    return 1;
+  }
+  let store;
+  try {
+    store = await import("./dist/jev-key-store.js");
+  } catch (err) {
+    error("Unable to load Jev key command module.");
+    error(`Import failed: ${err instanceof Error ? err.message : String(err)}`);
+    return 1;
+  }
+  const resolution = store.resolveJevEndpoint();
+  if (resolution.status === "unavailable") {
+    error("SYSTEMONE_ENDPOINT is set but invalid, so no key can be stored or read for it.");
+    error(resolution.message);
+    return 1;
+  }
+  const endpoint = resolution.endpoint;
+  if (action === "status") {
+    const status = store.resolveJevCredential(process.env, endpoint);
+    if (status.status === "present") {
+      log(`source=${status.source}`);
+      log(`endpoint=${endpoint.href}`);
+      return 0;
+    }
+    if (status.status === "unavailable") {
+      error(`unavailable: ${status.message}`);
+      return 1;
+    }
+    log("missing");
+    return 1;
+  }
+  if (action === "set") {
+    const apiKey = await readSecretFromStdin(stdin, `Enter Jev API key for ${endpoint.href} (input hidden): `);
+    if (!apiKey) {
+      error("No API key provided on stdin.");
+      return 1;
+    }
+    try {
+      store.saveJevApiKey(apiKey, endpoint);
+    } catch (err) {
+      error(err instanceof Error ? err.message : "Jev API key could not be stored.");
+      return 1;
+    }
+    log("Jev API key stored in the OS secure credential store.");
+    log(`endpoint=${endpoint.href}`);
+  } else {
+    try {
+      store.removeJevApiKey(endpoint);
+    } catch (err) {
+      error(err instanceof Error ? err.message : "Jev API key could not be removed.");
+      return 1;
+    }
+    log("Jev API key removed from the OS secure credential store.");
+  }
+  if (Object.hasOwn(process.env, "SYSTEMONE_API_KEY"))
+    log("Note: SYSTEMONE_API_KEY is present and overrides the stored key.");
+  else if (Object.hasOwn(process.env, "TYPESAFE_API_KEY"))
+    log(endpoint.href === store.JEV_DEFAULT_ENDPOINT ? "Note: TYPESAFE_API_KEY is present and overrides the stored key." : `Note: TYPESAFE_API_KEY is ignored for ${endpoint.href}; it is a TypeSafe credential and is never sent there.`);
+  return 0;
+}
 export async function main(argv = process.argv.slice(2), log = console.log, error = console.error, stdin = process.stdin) {
   const [command, ...rest] = argv;
   if (!command || command === "help" || command === "--help" || command === "-h") {
@@ -330,6 +404,9 @@ export async function main(argv = process.argv.slice(2), log = console.log, erro
   if (command === "token") {
     return runToken(rest, log, error, stdin);
   }
+  if (command === "key") {
+    return runKey(rest, log, error, stdin);
+  }
   if (command === "install") {
     error("The custom downloader has been retired.");
     error("Use `dm install npm:dm-mcp-adapter` instead, then optionally run `dm-mcp-adapter init`.");