@finchtech/cli 0.1.0 → 0.2.0

package/README.md

@@ -4,11 +4,11 @@ Install the public npm package with `npm install -g @finchtech/cli`, then run `f
 
 The Finch Agent CLI stores wallet keys, AgentCLI Session bearers, and MCP grant bearers only in an owner-only `FINCHTECH_HOME`, which defaults to `~/.finchtech`; secrets are never accepted as command arguments or emitted to stdout.
 
-The command groups are `wallet`, `login/status/logout`, `site`, `mcp doctor`, `mcp launch`, `mcp grant`, `creator`, `credentials`, `intent`, `operation show`, `purchase`, `task`, and `skill`. Run `finch --help` for the exact command list as one JSON value.
+The command groups are `wallet`, `login/status/logout`, `site`, `mcp doctor`, `mcp authorize`, `mcp grant`, `creator`, `credentials`, `intent`, `operation show`, `purchase`, `task`, and `skill`. Run `finch --help` for the exact command list as one JSON value.
 
 `finch site open` creates a sixty-second one-use handoff from the active AgentCLI Session and opens the exact configured Finch origin in the local default Browser. `finch site login <REQUEST_URL>` binds a website-created five-minute request once, then opens the same confirmation page. Both commands require the wallet, CLI, and graphical Browser on the user's machine. A launch failure returns `BROWSER_OPEN_FAILED` without printing the secret completion URL. The Browser receives only a normal seven-day Finch Web Session; wallet signing, broadcast, and market confirmation remain local CLI actions.
 
-`finch mcp doctor` is read-only. It verifies that the active CLI authority, AgentCLI Session, local wallet, MCP challenge, and source-controlled handoff manifest agree. `finch mcp launch codex` then reuses or creates an ordinary Finch MCP grant parented to that Session and starts a new Codex process. The grant bearer exists only in that child process environment; it is never printed, put in argv, or written to Codex credential files. No separate browser OAuth step is required. A new Codex process is required because an already-running Harness cannot inherit a newly created child environment.
+`finch mcp doctor` is read-only. It verifies that the active CLI authority, AgentCLI Session, local wallet, MCP challenge, OAuth metadata, and source-controlled persistent-Harness manifest agree. The Agent Harness owns Remote MCP configuration, OAuth credentials, and refresh; the CLI does not configure or launch Codex and never reads Harness OAuth material. During the Harness's native OAuth flow, the authorization page supplies the exact `finch mcp authorize <REQUEST_URL>` command. That command uses only the active local AgentCLI Session, verifies the callback against the registered redirect and state, and opens it without returning its one-use code. It never uses a Browser Session, Social account, or extension wallet as Agent authority. Configure `https://www.finchtech.ai/mcp` once through the Harness, then use MCP `identity_actor_get` together with `finch status` to verify exact Account, wallet, and environment alignment before custody.
 
 Ordinary installs require no profile file or environment selection. Network commands use the reviewed built-in PROD authority at `https://www.finchtech.ai` and its source-controlled mainnet deployments. The public command tree has no profile, environment, origin, or chain selector, and conflicting local deployment state fails closed. `intent approve` signs only the shared publication-v2 or Local-purchase-v1 EIP-712 authorization; it cannot sign arbitrary transaction calldata.
 

package/dist/finch.js

@@ -3738,7 +3738,7 @@ var init_testnet_purchase_v1 = __esm({
     });
     testnetPurchaseTransactionResponseSchema = strictObjectSchema({
       operationId: canonicalUuidSchema,
-      chainId: { const: "84532" },
+      chainId: { type: "string", enum: ["84532", "8453"] },
       deploymentHash: hex32Schema,
       paymentTokenAddress: evmAddressSchema,
       totalPaidAtomic: positiveIntegerStringSchema,
@@ -28380,6 +28380,7 @@ function getAgentServiceDeployment(environment3) {
   );
   return Object.freeze({
     chainId: value.network.chainId,
+    networkName: value.network.name,
     protocolAddress: value.contracts.protocol,
     protocolImplementationAddress: value.contracts.protocolImplementation ?? null,
     protocolProxyAdminAddress: value.contracts.protocolProxyAdmin ?? null,
@@ -36387,7 +36388,7 @@ function parseRemoteError(response, value) {
   }
   return envelope;
 }
-var import_ajv, CLI_MERCHANT_OPERATION_IDS, CliHttpError, ajv, validatorCache, AgentCliHttpClient;
+var import_ajv, CLI_MERCHANT_OPERATION_IDS, CliHttpError, ajv, validatorCache, oauthAuthorizationResponseSchema, oauthErrorResponseSchema, AgentCliHttpClient;
 var init_api2 = __esm({
   "src/api.ts"() {
     "use strict";
@@ -36433,6 +36434,29 @@ var init_api2 = __esm({
     ajv.addFormat("date-time", (value) => Number.isFinite(Date.parse(value)));
     ajv.addFormat("uri", (value) => URL.canParse(value));
     validatorCache = /* @__PURE__ */ new WeakMap();
+    oauthAuthorizationResponseSchema = {
+      type: "object",
+      additionalProperties: false,
+      required: ["authorized", "accountId", "walletAddress", "clientName", "scopes", "callbackUrl"],
+      properties: {
+        authorized: { const: true },
+        accountId: { type: "string", format: "uuid" },
+        walletAddress: { type: "string", pattern: "^0x[0-9a-f]{40}$" },
+        clientName: { type: "string", minLength: 1, maxLength: 128 },
+        scopes: { type: "array", minItems: 1, uniqueItems: true, items: { type: "string", minLength: 1 } },
+        callbackUrl: { type: "string", format: "uri" }
+      }
+    };
+    oauthErrorResponseSchema = {
+      type: "object",
+      additionalProperties: false,
+      required: ["error", "error_description"],
+      properties: {
+        error: { type: "string", minLength: 1 },
+        error_description: { type: "string", minLength: 1 },
+        trace_id: { type: "string", format: "uuid" }
+      }
+    };
     AgentCliHttpClient = class {
       origin;
       fetchImplementation;
@@ -36527,6 +36551,24 @@ var init_api2 = __esm({
           throw new CliHttpError("CLI_RESPONSE_INVALID", challenge2.status);
         }
         await challenge2.body?.cancel().catch(() => void 0);
+        const resourceResponse = await this.publicFetch("/.well-known/oauth-protected-resource");
+        if (resourceResponse.status !== 200) {
+          await resourceResponse.body?.cancel().catch(() => void 0);
+          throw new CliHttpError("CLI_REMOTE_UNAVAILABLE", resourceResponse.status);
+        }
+        const resource = jsonObject(await readBoundedJson(resourceResponse));
+        if (resource.resource !== `${this.origin}/` || JSON.stringify(resource.authorization_servers) !== JSON.stringify([this.origin])) {
+          throw new CliHttpError("CLI_RESPONSE_INVALID", resourceResponse.status);
+        }
+        const authorizationResponse = await this.publicFetch("/.well-known/oauth-authorization-server");
+        if (authorizationResponse.status !== 200) {
+          await authorizationResponse.body?.cancel().catch(() => void 0);
+          throw new CliHttpError("CLI_REMOTE_UNAVAILABLE", authorizationResponse.status);
+        }
+        const authorization = jsonObject(await readBoundedJson(authorizationResponse));
+        if (authorization.issuer !== this.origin || authorization.authorization_endpoint !== `${this.origin}/oauth/authorize` || authorization.token_endpoint !== `${this.origin}/oauth/token` || authorization.registration_endpoint !== `${this.origin}/oauth/register` || JSON.stringify(authorization.response_types_supported) !== JSON.stringify(["code"]) || JSON.stringify(authorization.grant_types_supported) !== JSON.stringify(["authorization_code", "refresh_token"]) || JSON.stringify(authorization.token_endpoint_auth_methods_supported) !== JSON.stringify(["none"]) || JSON.stringify(authorization.code_challenge_methods_supported) !== JSON.stringify(["S256"])) {
+          throw new CliHttpError("CLI_RESPONSE_INVALID", authorizationResponse.status);
+        }
         const manifestResponse = await this.publicFetch("/mcp/client-compatibility.json");
         if (manifestResponse.status !== 200) {
           await manifestResponse.body?.cancel().catch(() => void 0);
@@ -36539,15 +36581,16 @@ var init_api2 = __esm({
           throw new CliHttpError("CLI_RESPONSE_INVALID", manifestResponse.status);
         }
         const client = jsonObject(manifest.clients[0]);
-        const handoff = jsonObject(client.handoff);
+        const install = jsonObject(client.install);
+        const authorize = jsonObject(client.authorize);
         const verify = jsonObject(client.verify);
-        if (manifest.schemaVersion !== 2 || manifest.manifestId !== "finch.remote-mcp-clients" || mcp.serverName !== "finch" || mcp.url !== mcpUrl || mcp.transport !== "streamable_http" || mcp.authorization !== "agent_cli_session_handoff" || source.repository !== "https://github.com/FinchipAI/Finch-Site" || source.path !== "apps/mcp/src/client-compatibility.ts" || client.id !== "codex" || client.supportLevel !== "verified" || handoff.kind !== "finch_cli" || handoff.executable !== "finch" || JSON.stringify(handoff.arguments) !== JSON.stringify(["mcp", "launch", "codex"]) || verify.kind !== "harness_ui" || verify.surface !== "mcp_tools" || client.reload !== "new_session") {
+        if (manifest.schemaVersion !== 3 || manifest.manifestId !== "finch.remote-mcp-clients" || mcp.serverName !== "finch" || mcp.url !== mcpUrl || mcp.transport !== "streamable_http" || mcp.authorization !== "oauth" || source.repository !== "https://github.com/FinchipAI/Finch-Site" || source.path !== "apps/mcp/src/client-compatibility.ts" || client.id !== "codex" || client.supportLevel !== "verified" || install.kind !== "native_cli" || install.executable !== "codex" || JSON.stringify(install.arguments) !== JSON.stringify(["mcp", "add", "finch", "--url", mcpUrl]) || authorize.kind !== "native_cli" || authorize.executable !== "codex" || JSON.stringify(authorize.arguments) !== JSON.stringify(["mcp", "login", "finch"]) || verify.kind !== "harness_ui" || verify.surface !== "mcp_tools" || client.reload !== "new_session") {
           throw new CliHttpError("CLI_RESPONSE_INVALID", manifestResponse.status);
         }
         return Object.freeze({
           url: mcpUrl,
           transport: "streamable_http",
-          authorization: "agent_cli_session_handoff",
+          authorization: "oauth",
           compatibilityManifestUrl,
           supportedClients: Object.freeze(["codex"])
         });
@@ -36680,6 +36723,26 @@ var init_api2 = __esm({
           bearer
         });
       }
+      authorizeMcp(requestPath, bearer) {
+        let parsed;
+        try {
+          parsed = new URL(requestPath, this.origin);
+        } catch {
+          throw new TypeError("MCP authorization request path is invalid.");
+        }
+        if (parsed.origin !== this.origin || parsed.pathname !== "/oauth/authorize" || parsed.hash !== "" || requestPath !== `${parsed.pathname}${parsed.search}` || parsed.search === "") {
+          throw new TypeError("MCP authorization request path is invalid.");
+        }
+        return this.request({
+          method: "post",
+          path: requestPath,
+          successStatus: 200,
+          responseSchema: oauthAuthorizationResponseSchema,
+          statusOnlyErrorSchema: oauthErrorResponseSchema,
+          bearer,
+          body: {}
+        });
+      }
       createChallenge(input) {
         const operation4 = IDENTITY_V1_OPERATIONS.challenge;
         return this.request({
@@ -38857,7 +38920,6 @@ var init_application = __esm({
       taskProtocolSender;
       skillIntentSender;
       skillLocalFlow;
-      mcpHarness;
       browserLauncher;
       constructor(dependencies) {
         this.api = dependencies.api;
@@ -38872,7 +38934,6 @@ var init_application = __esm({
         this.taskProtocolSender = dependencies.taskProtocolSender;
         this.skillIntentSender = dependencies.skillIntentSender;
         this.skillLocalFlow = dependencies.skillLocalFlow;
-        this.mcpHarness = dependencies.mcpHarness;
         this.browserLauncher = dependencies.browserLauncher;
       }
       async authorizedProfile() {
@@ -39052,11 +39113,11 @@ var init_application = __esm({
         await required4(this.state.activateSession, "state.activateSession").call(this.state, response);
         return response;
       }
-      async browserHandoffAuthority() {
+      async verifiedAgentCliAuthority() {
         const profile = await this.authorizedProfile();
         const session = await this.networkSession(profile);
         const wallet = await required4(this.state.readWalletAddress, "state.readWalletAddress").call(this.state);
-        const remote = asObject(await required4(this.api.getSession, "api.getSession").call(this.api, session.rawBearer), "Browser handoff Session");
+        const remote = asObject(await required4(this.api.getSession, "api.getSession").call(this.api, session.rawBearer), "AgentCLI Session");
         if (session.walletAddress.toLowerCase() !== wallet.walletAddress.toLowerCase() || remote.accountId !== session.accountId || String(remote.walletAddress).toLowerCase() !== wallet.walletAddress.toLowerCase() || remote.environment !== profile.environment || remote.audience !== "agent_cli") {
           throw new CliAuthorityError();
         }
@@ -39081,7 +39142,7 @@ var init_application = __esm({
         });
       }
       async openSite() {
-        const authority = await this.browserHandoffAuthority();
+        const authority = await this.verifiedAgentCliAuthority();
         return this.openBrowserHandoff(authority);
       }
       async loginSite(requestUrl) {
@@ -39096,9 +39157,67 @@ var init_application = __esm({
         if (parsed.origin !== profile.origin || requestUrl !== `${profile.origin}${parsed.pathname}` || parsed.search !== "" || parsed.hash !== "" || match === null) {
           throw new TypeError("Browser login request origin or path does not match the active profile origin.");
         }
-        const authority = await this.browserHandoffAuthority();
+        const authority = await this.verifiedAgentCliAuthority();
         return this.openBrowserHandoff({ ...authority, requestId: match[1] });
       }
+      async authorizeMcp(requestUrl) {
+        const profile = await this.authorizedProfile();
+        let request;
+        try {
+          request = new URL(requestUrl);
+        } catch {
+          throw new TypeError("MCP OAuth request URL is invalid.");
+        }
+        const redirectValues = request.searchParams.getAll("redirect_uri");
+        const stateValues = request.searchParams.getAll("state");
+        const scopeValues = request.searchParams.getAll("scope");
+        if (request.origin !== profile.origin || request.pathname !== "/oauth/authorize" || request.username !== "" || request.password !== "" || request.hash !== "" || requestUrl !== `${profile.origin}${request.pathname}${request.search}` || redirectValues.length !== 1 || stateValues.length > 1 || scopeValues.length !== 1) {
+          throw new TypeError("MCP OAuth request URL does not match the active profile authority.");
+        }
+        let registeredRedirect;
+        try {
+          registeredRedirect = new URL(redirectValues[0]);
+        } catch {
+          throw new TypeError("MCP OAuth redirect URI is invalid.");
+        }
+        if (registeredRedirect.username !== "" || registeredRedirect.password !== "" || registeredRedirect.hash !== "") {
+          throw new TypeError("MCP OAuth redirect URI is invalid.");
+        }
+        const authority = await this.verifiedAgentCliAuthority();
+        const response = asObject(await required4(this.api.authorizeMcp, "api.authorizeMcp").call(this.api, `${request.pathname}${request.search}`, authority.session.rawBearer), "MCP authorization");
+        if (response.authorized !== true || response.accountId !== authority.session.accountId || String(response.walletAddress).toLowerCase() !== authority.walletAddress || typeof response.clientName !== "string" || response.clientName.length < 1 || response.clientName.length > 128 || !Array.isArray(response.scopes) || response.scopes.some((scope) => typeof scope !== "string" || scope.length < 1) || typeof response.callbackUrl !== "string") {
+          throw new CliAuthorityError();
+        }
+        const requestedScopes = scopeValues[0].split(" ").filter(Boolean).sort();
+        const returnedScopes = [...response.scopes].sort();
+        if (requestedScopes.length < 1 || requestedScopes.length !== returnedScopes.length || requestedScopes.some((scope, index2) => scope !== returnedScopes[index2])) {
+          throw new CliAuthorityError();
+        }
+        let callback;
+        try {
+          callback = new URL(response.callbackUrl);
+        } catch {
+          throw new TypeError("MCP OAuth callback is invalid.");
+        }
+        const codes = callback.searchParams.getAll("code");
+        if (codes.length !== 1 || !/^[A-Za-z0-9_-]{43}$/u.test(codes[0])) {
+          throw new TypeError("MCP OAuth callback is invalid.");
+        }
+        const expectedCallback = new URL(registeredRedirect.href);
+        expectedCallback.searchParams.set("code", codes[0]);
+        if (stateValues.length === 1) expectedCallback.searchParams.set("state", stateValues[0]);
+        if (callback.href !== expectedCallback.href) {
+          throw new TypeError("MCP OAuth callback does not match the registered redirect and state.");
+        }
+        await required4(this.browserLauncher, "browser launcher").open(callback.href);
+        return Object.freeze({
+          authorized: true,
+          clientName: response.clientName,
+          walletAddress: authority.walletAddress,
+          environment: profile.environment,
+          scopes: Object.freeze([...returnedScopes])
+        });
+      }
       async createWallet() {
         const privateKey3 = generatePrivateKey();
         const walletAddress2 = privateKeyToAccount(privateKey3).address.toLowerCase();
@@ -39255,7 +39374,7 @@ var init_application = __esm({
           throw new TypeError("MCP doctor Session authority does not match the active wallet and profile.");
         }
         const mcp = await required4(this.api.inspectRemoteMcp, "api.inspectRemoteMcp").call(this.api);
-        if (mcp.url !== `${profile.origin}/mcp` || mcp.authorization !== "agent_cli_session_handoff" || JSON.stringify(mcp.supportedClients) !== JSON.stringify(["codex"])) {
+        if (mcp.url !== `${profile.origin}/mcp` || mcp.authorization !== "oauth" || JSON.stringify(mcp.supportedClients) !== JSON.stringify(["codex"])) {
           throw new TypeError("MCP doctor discovery does not match the authoritative profile.");
         }
         return Object.freeze({
@@ -39270,64 +39389,6 @@ var init_application = __esm({
           mcp
         });
       }
-      async launchMcpHarness(client) {
-        if (client !== "codex") throw new TypeError("Only the verified Codex MCP handoff is supported.");
-        const profile = await this.authorizedProfile();
-        const session = await this.networkSession(profile);
-        const wallet = await required4(this.state.readWalletAddress, "state.readWalletAddress").call(this.state);
-        const remoteSession = asObject(await required4(this.api.getSession, "api.getSession").call(this.api, session.rawBearer), "MCP handoff Session");
-        if (remoteSession.sessionId !== session.sessionId || remoteSession.accountId !== session.accountId || remoteSession.walletAddress !== session.walletAddress || wallet.walletAddress !== session.walletAddress || remoteSession.environment !== session.environment || remoteSession.audience !== "agent_cli" || typeof remoteSession.sessionExpiresAt !== "string" || Date.parse(remoteSession.sessionExpiresAt) <= Date.now()) {
-          throw new TypeError("MCP handoff Session authority does not match the active wallet and profile.");
-        }
-        const mcp = await required4(this.api.inspectRemoteMcp, "api.inspectRemoteMcp").call(this.api);
-        if (mcp.url !== `${profile.origin}/mcp` || mcp.authorization !== "agent_cli_session_handoff" || !mcp.supportedClients.includes(client)) {
-          throw new TypeError("MCP handoff manifest does not match the authoritative profile.");
-        }
-        const readGrant = required4(this.state.readMcpGrantForScopes, "state.readMcpGrantForScopes");
-        let grant = await readGrant.call(this.state, {
-          scopes: identityScopeValues,
-          accountId: session.accountId,
-          environment: session.environment
-        });
-        if (grant === null) {
-          const parentExpiry = Date.parse(remoteSession.sessionExpiresAt);
-          const expiry = Math.min(Date.now() + 12 * 60 * 60 * 1e3, parentExpiry - 1e3);
-          if (expiry <= Date.now() + 6e4) {
-            throw new TypeError("The AgentCLI Session expires too soon to launch Finch MCP. Log in again.");
-          }
-          await this.createMcpGrant(identityScopeValues, new Date(expiry).toISOString());
-          grant = await readGrant.call(this.state, {
-            scopes: identityScopeValues,
-            accountId: session.accountId,
-            environment: session.environment
-          });
-          if (grant === null) throw new TypeError("The new MCP handoff grant is unavailable in protected local state.");
-        }
-        parseCanonicalUuid(grant.grantId, "MCP handoff grantId");
-        if (!/^[A-Za-z0-9_-]{43}$/u.test(grant.rawBearer)) {
-          throw new TypeError("The selected MCP handoff grant is invalid.");
-        }
-        const remoteGrant = asObject(await required4(this.api.showGrant, "api.showGrant").call(this.api, grant.grantId, session.rawBearer), "MCP handoff grant");
-        if (remoteGrant.grantId !== grant.grantId || remoteGrant.audience !== "finch_mcp" || remoteGrant.environment !== session.environment || remoteGrant.status !== "active" || remoteGrant.revokedAt !== null || remoteGrant.expiresAt !== grant.expiresAt || remoteGrant.parentSessionExpiresAt !== remoteSession.sessionExpiresAt || JSON.stringify(remoteGrant.scopes) !== JSON.stringify(identityScopeValues) || Date.parse(grant.expiresAt) <= Date.now()) {
-          throw new TypeError("MCP handoff grant does not inherit the active parent Session authority.");
-        }
-        const launched = await required4(this.mcpHarness, "MCP Harness").launch({
-          client,
-          mcpUrl: mcp.url,
-          bearer: grant.rawBearer
-        });
-        return Object.freeze({
-          client,
-          launched: true,
-          browserAuthorization: false,
-          exitCode: launched.exitCode,
-          environment: session.environment,
-          accountId: session.accountId,
-          walletAddress: session.walletAddress,
-          grantId: grant.grantId,
-          grantExpiresAt: grant.expiresAt
-        });
-      }
       async assertNoBlockingRecoveries() {
         const recoveries = await this.state.listBlockingRecoveries?.call(this.state) ?? [];
         if (recoveries.length > 0) {
@@ -40109,7 +40170,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@finchtech/cli",
-      version: "0.1.0",
+      version: "0.2.0",
       description: "Finch Agent CLI for wallet-owned marketplace and MCP workflows.",
       type: "module",
       bin: {
@@ -40273,8 +40334,8 @@ async function routeCommand(arguments_, application) {
   if (first === "mcp" && second === "doctor" && arguments_.length === 2) {
     return result("mcp.doctor", await method(application.doctorMcp, "mcp doctor").call(application));
   }
-  if (first === "mcp" && second === "launch" && third === "codex" && arguments_.length === 3) {
-    return result("mcp.launch.codex", await method(application.launchMcpHarness, "mcp launch codex").call(application, "codex"));
+  if (first === "mcp" && second === "authorize" && arguments_.length === 3 && third !== void 0) {
+    return result("mcp.authorize", await method(application.authorizeMcp, "mcp authorize").call(application, third));
   }
   if (first === "mcp" && second === "grant" && third === "create") {
     const scopes = exactOption(arguments_, "--scopes").split(",");
@@ -40595,7 +40656,7 @@ var init_command_router = __esm({
       "site open",
       "site login",
       "mcp doctor",
-      "mcp launch codex",
+      "mcp authorize",
       "mcp grant create",
       "mcp grant show",
       "mcp grant revoke",
@@ -40661,7 +40722,7 @@ var init_command_router = __esm({
       "site open": "finch site open",
       "site login": "finch site login <REQUEST_URL>",
       "mcp doctor": "finch mcp doctor",
-      "mcp launch codex": "finch mcp launch codex",
+      "mcp authorize": "finch mcp authorize <REQUEST_URL>",
       "mcp grant create": "finch mcp grant create --scopes <CSV> --expires-at <ISO-8601>",
       "mcp grant show": "finch mcp grant show <GRANT_ID>",
       "mcp grant revoke": "finch mcp grant revoke <GRANT_ID>",
@@ -56346,81 +56407,14 @@ var init_skill_intent_sender = __esm({
   }
 });
 
-// src/mcp-handoff.ts
-import { spawn } from "node:child_process";
-function canonicalMcpUrl(value) {
-  const url2 = new URL(value);
-  const localHttp = url2.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url2.hostname);
-  if (url2.protocol !== "https:" && !localHttp || url2.username !== "" || url2.password !== "" || url2.pathname !== "/mcp" || url2.search !== "" || url2.hash !== "") {
-    throw new TypeError("Finch MCP handoff URL is invalid.");
-  }
-  return url2.toString();
-}
-var MCP_HANDOFF_TOKEN_ENV, runInteractiveProcess, InstalledCodexMcpHarness;
-var init_mcp_handoff = __esm({
-  "src/mcp-handoff.ts"() {
-    "use strict";
-    MCP_HANDOFF_TOKEN_ENV = "FINCHTECH_MCP_HANDOFF_TOKEN";
-    runInteractiveProcess = async (input) => new Promise((resolve4, reject5) => {
-      const child = spawn(input.executable, [...input.arguments], {
-        env: input.environment,
-        shell: false,
-        stdio: "inherit"
-      });
-      child.once("error", reject5);
-      child.once("exit", (code, signal) => {
-        if (signal !== null || code === null) {
-          reject5(new TypeError("Codex MCP handoff terminated without an exit code."));
-          return;
-        }
-        resolve4(Object.freeze({ exitCode: code }));
-      });
-    });
-    InstalledCodexMcpHarness = class {
-      baseEnvironment;
-      run;
-      platform;
-      constructor(baseEnvironment = process.env, run = runInteractiveProcess, platform = process.platform) {
-        this.baseEnvironment = { ...baseEnvironment };
-        this.run = run;
-        this.platform = platform;
-      }
-      async launch(input) {
-        if (input.client !== "codex" || !/^[A-Za-z0-9_-]{43}$/u.test(input.bearer)) {
-          throw new TypeError("Codex MCP handoff authority is invalid.");
-        }
-        const mcpUrl = canonicalMcpUrl(input.mcpUrl);
-        const codexArguments = Object.freeze([
-          "-c",
-          `mcp_servers.finch.url="${mcpUrl}"`,
-          "-c",
-          `mcp_servers.finch.bearer_token_env_var="${MCP_HANDOFF_TOKEN_ENV}"`,
-          "-c",
-          "mcp_servers.finch.enabled=true"
-        ]);
-        const windows = this.platform === "win32";
-        const result2 = await this.run(Object.freeze({
-          executable: windows ? this.baseEnvironment.ComSpec ?? "cmd.exe" : "codex",
-          arguments: windows ? Object.freeze(["/d", "/s", "/c", "codex", ...codexArguments]) : codexArguments,
-          environment: Object.freeze({ ...this.baseEnvironment, [MCP_HANDOFF_TOKEN_ENV]: input.bearer })
-        }));
-        if (!Number.isInteger(result2.exitCode) || result2.exitCode !== 0) {
-          throw new TypeError(`Codex exited with status ${String(result2.exitCode)}.`);
-        }
-        return Object.freeze({ exitCode: result2.exitCode });
-      }
-    };
-  }
-});
-
 // src/browser-launcher.ts
-import { spawn as spawn2 } from "node:child_process";
+import { spawn } from "node:child_process";
 var launchBrowserCommand, InstalledBrowserLauncher;
 var init_browser_launcher = __esm({
   "src/browser-launcher.ts"() {
     "use strict";
     init_cli_error();
-    launchBrowserCommand = (command, arguments_) => spawn2(
+    launchBrowserCommand = (command, arguments_) => spawn(
       command,
       [...arguments_],
       { stdio: "ignore", windowsHide: true }
@@ -56432,8 +56426,8 @@ var init_browser_launcher = __esm({
       launch;
       async open(url2) {
         await new Promise((resolve4, reject5) => {
-          const command = process.platform === "win32" ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open";
-          const args = process.platform === "win32" ? ["/d", "/s", "/c", "start", "", url2] : [url2];
+          const command = process.platform === "win32" ? "rundll32.exe" : process.platform === "darwin" ? "open" : "xdg-open";
+          const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url2] : [url2];
           const child = this.launch(command, args);
           child.once("error", () => reject5(new BrowserOpenError()));
           child.once("close", (code) => code === 0 ? resolve4() : reject5(new BrowserOpenError()));
@@ -56560,7 +56554,6 @@ async function runInstalledCli(arguments_, environment3 = process.env, authoriti
     taskProtocolSender: rpcUrls.task === void 0 ? void 0 : new InstalledTaskProtocolSender(rpcUrls.task),
     skillIntentSender,
     skillLocalFlow: profile === void 0 || skillIntentSender === void 0 ? void 0 : new SkillLocalFlow(api, skillIntentSender, signer, void 0, void 0, state),
-    mcpHarness: authorities.mcpHarness ?? new InstalledCodexMcpHarness(environment3),
     browserLauncher: new InstalledBrowserLauncher()
   });
   return routeCommand(arguments_, application);
@@ -56580,7 +56573,6 @@ var init_main = __esm({
     init_task_protocol_sender();
     init_skill_intent_sender();
     init_skill_local_flow();
-    init_mcp_handoff();
     init_browser_launcher();
   }
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finchtech/cli",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Finch Agent CLI for wallet-owned marketplace and MCP workflows.",
   "type": "module",
   "bin": {