@gethmy/mcp 2.9.3 → 2.9.5

package/dist/cli.js

@@ -17,6 +17,199 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
+// src/config.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+function getConfigDir() {
+  return join(homedir(), ".harmony-mcp");
+}
+function getConfigPath() {
+  return join(getConfigDir(), "config.json");
+}
+function getLocalConfigPath(cwd) {
+  return join(cwd || process.cwd(), LOCAL_CONFIG_FILENAME);
+}
+function emptyConfig() {
+  return {
+    apiKey: null,
+    apiUrl: DEFAULT_API_URL,
+    activeWorkspaceId: null,
+    activeProjectId: null,
+    userEmail: null,
+    memoryDir: null,
+    oauthAccessToken: null,
+    oauthRefreshToken: null,
+    oauthExpiresAt: null,
+    oauthClientId: null
+  };
+}
+function loadConfig() {
+  const configPath = getConfigPath();
+  if (!existsSync(configPath)) {
+    return emptyConfig();
+  }
+  try {
+    const data = readFileSync(configPath, "utf-8");
+    const config = JSON.parse(data);
+    return {
+      apiKey: config.apiKey || null,
+      apiUrl: config.apiUrl || DEFAULT_API_URL,
+      activeWorkspaceId: config.activeWorkspaceId || null,
+      activeProjectId: config.activeProjectId || null,
+      userEmail: config.userEmail || null,
+      memoryDir: config.memoryDir || null,
+      oauthAccessToken: config.oauthAccessToken || null,
+      oauthRefreshToken: config.oauthRefreshToken || null,
+      oauthExpiresAt: typeof config.oauthExpiresAt === "number" ? config.oauthExpiresAt : null,
+      oauthClientId: config.oauthClientId || null
+    };
+  } catch {
+    return emptyConfig();
+  }
+}
+function saveConfig(config) {
+  const configDir = getConfigDir();
+  const configPath = getConfigPath();
+  if (!existsSync(configDir)) {
+    mkdirSync(configDir, { recursive: true, mode: 448 });
+  }
+  const existingConfig = loadConfig();
+  const newConfig = { ...existingConfig, ...config };
+  writeFileSync(configPath, JSON.stringify(newConfig, null, 2), {
+    mode: 384
+  });
+}
+function loadLocalConfig(cwd) {
+  const localConfigPath = getLocalConfigPath(cwd);
+  if (!existsSync(localConfigPath)) {
+    return null;
+  }
+  try {
+    const data = readFileSync(localConfigPath, "utf-8");
+    const config = JSON.parse(data);
+    return {
+      workspaceId: config.workspaceId || null,
+      projectId: config.projectId || null
+    };
+  } catch {
+    return null;
+  }
+}
+function saveLocalConfig(config, cwd) {
+  const localConfigPath = getLocalConfigPath(cwd);
+  const existingConfig = loadLocalConfig(cwd) || {
+    workspaceId: null,
+    projectId: null
+  };
+  const newConfig = { ...existingConfig, ...config };
+  const cleanConfig = {};
+  if (newConfig.workspaceId)
+    cleanConfig.workspaceId = newConfig.workspaceId;
+  if (newConfig.projectId)
+    cleanConfig.projectId = newConfig.projectId;
+  writeFileSync(localConfigPath, JSON.stringify(cleanConfig, null, 2));
+}
+function hasLocalConfig(cwd) {
+  return existsSync(getLocalConfigPath(cwd));
+}
+function getActiveCredential() {
+  const config = loadConfig();
+  if (config.oauthAccessToken)
+    return config.oauthAccessToken;
+  if (config.apiKey)
+    return config.apiKey;
+  throw new Error(`Not configured. Run "npx @gethmy/mcp setup" to connect Harmony.
+` + "Setup authorizes in your browser — no API key handling required.");
+}
+function getApiKey() {
+  return getActiveCredential();
+}
+function getApiUrl() {
+  const config = loadConfig();
+  return config.apiUrl;
+}
+function getUserEmail() {
+  const config = loadConfig();
+  return config.userEmail;
+}
+function setActiveWorkspace(workspaceId, options) {
+  if (options?.local) {
+    saveLocalConfig({ workspaceId }, options.cwd);
+  } else {
+    saveConfig({ activeWorkspaceId: workspaceId });
+  }
+}
+function setActiveProject(projectId, options) {
+  if (options?.local) {
+    saveLocalConfig({ projectId }, options.cwd);
+  } else {
+    saveConfig({ activeProjectId: projectId });
+  }
+}
+function getActiveWorkspaceId(cwd) {
+  const localConfig = loadLocalConfig(cwd);
+  if (localConfig?.workspaceId) {
+    return localConfig.workspaceId;
+  }
+  return loadConfig().activeWorkspaceId;
+}
+function getActiveProjectId(cwd) {
+  const localConfig = loadLocalConfig(cwd);
+  if (localConfig?.projectId) {
+    return localConfig.projectId;
+  }
+  return loadConfig().activeProjectId;
+}
+function isConfigured() {
+  const config = loadConfig();
+  return !!(config.apiKey || config.oauthAccessToken);
+}
+function areSkillsInstalled(cwd) {
+  const home = homedir();
+  const workingDir = cwd || process.cwd();
+  const foundPaths = [];
+  const globalSkillsDir = join(home, ".agents", "skills");
+  const globalSkillPath = join(globalSkillsDir, "hmy", "SKILL.md");
+  if (existsSync(globalSkillPath)) {
+    foundPaths.push(globalSkillPath);
+    return { installed: true, location: "global", paths: foundPaths };
+  }
+  const claudeGlobalSkill = join(home, ".claude", "skills", "hmy.md");
+  if (existsSync(claudeGlobalSkill)) {
+    foundPaths.push(claudeGlobalSkill);
+    return { installed: true, location: "global", paths: foundPaths };
+  }
+  const claudeGlobalSkillAlt = join(home, ".claude", "skills", "hmy", "SKILL.md");
+  if (existsSync(claudeGlobalSkillAlt)) {
+    foundPaths.push(claudeGlobalSkillAlt);
+    return { installed: true, location: "global", paths: foundPaths };
+  }
+  const localSkillPath = join(workingDir, ".claude", "skills", "hmy.md");
+  if (existsSync(localSkillPath)) {
+    foundPaths.push(localSkillPath);
+    return { installed: true, location: "local", paths: foundPaths };
+  }
+  const localSkillPathAlt = join(workingDir, ".claude", "skills", "hmy", "SKILL.md");
+  if (existsSync(localSkillPathAlt)) {
+    foundPaths.push(localSkillPathAlt);
+    return { installed: true, location: "local", paths: foundPaths };
+  }
+  return { installed: false, location: null, paths: [] };
+}
+function hasProjectContext(cwd) {
+  const localConfig = loadLocalConfig(cwd);
+  return !!(localConfig?.workspaceId || localConfig?.projectId);
+}
+function getMemoryDir() {
+  const config = loadConfig();
+  if (config.memoryDir)
+    return config.memoryDir;
+  return join(homedir(), ".harmony", "memory");
+}
+var DEFAULT_API_URL = "https://app.gethmy.com/api", LOCAL_CONFIG_FILENAME = ".harmony-mcp.json";
+var init_config = () => {};
+
 // src/prompt-builder.ts
 var exports_prompt_builder = {};
 __export(exports_prompt_builder, {
@@ -507,194 +700,294 @@ var init_prompt_builder = __esm(() => {
   };
 });
 
-// src/cli.ts
-import { createRequire as createRequire2 } from "node:module";
-import { program } from "commander";
-
-// src/config.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-var DEFAULT_API_URL = "https://app.gethmy.com/api";
-var LOCAL_CONFIG_FILENAME = ".harmony-mcp.json";
-function getConfigDir() {
-  return join(homedir(), ".harmony-mcp");
-}
-function getConfigPath() {
-  return join(getConfigDir(), "config.json");
-}
-function getLocalConfigPath(cwd) {
-  return join(cwd || process.cwd(), LOCAL_CONFIG_FILENAME);
-}
-function loadConfig() {
-  const configPath = getConfigPath();
-  if (!existsSync(configPath)) {
-    return {
-      apiKey: null,
-      apiUrl: DEFAULT_API_URL,
-      activeWorkspaceId: null,
-      activeProjectId: null,
-      userEmail: null,
-      memoryDir: null
-    };
-  }
+// src/oauth-login.ts
+import { spawn } from "node:child_process";
+import { createHash as createHash3, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+function base64Url(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function generatePkce() {
+  const verifier = base64Url(randomBytes(32));
+  const challenge = base64Url(createHash3("sha256").update(verifier).digest());
+  return { verifier, challenge };
+}
+function oauthBaseFromApiUrl(apiUrl) {
+  return `${new URL(apiUrl).origin}/oauth`;
+}
+function openBrowser(url) {
+  const platform = process.platform;
+  const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+  const args = platform === "win32" ? ["/c", "start", "", url.replace(/&/g, "^&")] : [url];
   try {
-    const data = readFileSync(configPath, "utf-8");
-    const config = JSON.parse(data);
-    return {
-      apiKey: config.apiKey || null,
-      apiUrl: config.apiUrl || DEFAULT_API_URL,
-      activeWorkspaceId: config.activeWorkspaceId || null,
-      activeProjectId: config.activeProjectId || null,
-      userEmail: config.userEmail || null,
-      memoryDir: config.memoryDir || null
-    };
-  } catch {
-    return {
-      apiKey: null,
-      apiUrl: DEFAULT_API_URL,
-      activeWorkspaceId: null,
-      activeProjectId: null,
-      userEmail: null,
-      memoryDir: null
-    };
-  }
-}
-function saveConfig(config) {
-  const configDir = getConfigDir();
-  const configPath = getConfigPath();
-  if (!existsSync(configDir)) {
-    mkdirSync(configDir, { recursive: true, mode: 448 });
-  }
-  const existingConfig = loadConfig();
-  const newConfig = { ...existingConfig, ...config };
-  writeFileSync(configPath, JSON.stringify(newConfig, null, 2), {
-    mode: 384
-  });
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {});
+    child.unref();
+  } catch {}
 }
-function loadLocalConfig(cwd) {
-  const localConfigPath = getLocalConfigPath(cwd);
-  if (!existsSync(localConfigPath)) {
-    return null;
-  }
+async function loginWithBrowser(opts) {
+  const base = oauthBaseFromApiUrl(opts.apiUrl);
+  const { verifier, challenge } = generatePkce();
+  const state = base64Url(randomBytes(16));
+  const { server, port, waitForCode } = await startLoopbackServer(state);
+  const redirectUri = `http://127.0.0.1:${port}/callback`;
   try {
-    const data = readFileSync(localConfigPath, "utf-8");
-    const config = JSON.parse(data);
-    return {
-      workspaceId: config.workspaceId || null,
-      projectId: config.projectId || null
-    };
-  } catch {
-    return null;
-  }
-}
-function saveLocalConfig(config, cwd) {
-  const localConfigPath = getLocalConfigPath(cwd);
-  const existingConfig = loadLocalConfig(cwd) || {
-    workspaceId: null,
-    projectId: null
-  };
-  const newConfig = { ...existingConfig, ...config };
-  const cleanConfig = {};
-  if (newConfig.workspaceId)
-    cleanConfig.workspaceId = newConfig.workspaceId;
-  if (newConfig.projectId)
-    cleanConfig.projectId = newConfig.projectId;
-  writeFileSync(localConfigPath, JSON.stringify(cleanConfig, null, 2));
-}
-function hasLocalConfig(cwd) {
-  return existsSync(getLocalConfigPath(cwd));
-}
-function getApiKey() {
-  const config = loadConfig();
-  if (!config.apiKey) {
-    throw new Error(`Not configured. Run "npx @gethmy/mcp setup" to set your API key.
-` + "You can generate an API key at https://gethmy.com → Settings → API Keys.");
+    const clientId = await registerClient(base, redirectUri);
+    const authorizeUrl = new URL(`${base}/authorize`);
+    authorizeUrl.searchParams.set("response_type", "code");
+    authorizeUrl.searchParams.set("client_id", clientId);
+    authorizeUrl.searchParams.set("redirect_uri", redirectUri);
+    authorizeUrl.searchParams.set("code_challenge", challenge);
+    authorizeUrl.searchParams.set("code_challenge_method", "S256");
+    authorizeUrl.searchParams.set("state", state);
+    authorizeUrl.searchParams.set("scope", "mcp");
+    authorizeUrl.searchParams.set("resource", MCP_RESOURCE_URL);
+    if (opts.workspaceId) {
+      authorizeUrl.searchParams.set("workspace_id", opts.workspaceId);
+    }
+    const authUrlStr = authorizeUrl.toString();
+    opts.onUrl?.(authUrlStr);
+    openBrowser(authUrlStr);
+    const code = await waitForCode;
+    return await exchangeCode(base, {
+      code,
+      redirectUri,
+      clientId,
+      verifier
+    });
+  } finally {
+    server.close();
   }
-  return config.apiKey;
-}
-function getApiUrl() {
-  const config = loadConfig();
-  return config.apiUrl;
 }
-function getUserEmail() {
-  const config = loadConfig();
-  return config.userEmail;
-}
-function setActiveWorkspace(workspaceId, options) {
-  if (options?.local) {
-    saveLocalConfig({ workspaceId }, options.cwd);
-  } else {
-    saveConfig({ activeWorkspaceId: workspaceId });
+async function registerClient(base, redirectUri) {
+  const res = await fetch(`${base}/register`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      client_name: "Harmony CLI (setup)",
+      redirect_uris: [redirectUri],
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none"
+    })
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok || !body.client_id) {
+    throw new Error(body.error_description || `Could not register OAuth client (HTTP ${res.status})`);
   }
+  return body.client_id;
 }
-function setActiveProject(projectId, options) {
-  if (options?.local) {
-    saveLocalConfig({ projectId }, options.cwd);
-  } else {
-    saveConfig({ activeProjectId: projectId });
+async function exchangeCode(base, params) {
+  const res = await fetch(`${base}/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      code: params.code,
+      redirect_uri: params.redirectUri,
+      client_id: params.clientId,
+      code_verifier: params.verifier
+    }).toString()
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok || !body.access_token || !body.refresh_token) {
+    throw new Error(body.error_description || `Token exchange failed (HTTP ${res.status})`);
   }
+  return {
+    accessToken: body.access_token,
+    refreshToken: body.refresh_token,
+    expiresAt: Date.now() + (body.expires_in ?? 0) * 1000,
+    clientId: params.clientId
+  };
 }
-function getActiveWorkspaceId(cwd) {
-  const localConfig = loadLocalConfig(cwd);
-  if (localConfig?.workspaceId) {
-    return localConfig.workspaceId;
-  }
-  return loadConfig().activeWorkspaceId;
+function startLoopbackServer(expectedState) {
+  return new Promise((resolveOuter, rejectOuter) => {
+    let resolveCode;
+    let rejectCode;
+    const waitForCode = new Promise((res, rej) => {
+      resolveCode = res;
+      rejectCode = rej;
+    });
+    const timeout = setTimeout(() => {
+      rejectCode(new Error("Timed out waiting for browser authorization (5 min)."));
+    }, LOGIN_TIMEOUT_MS);
+    timeout.unref?.();
+    const server = createServer((req, res) => {
+      const url = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (url.pathname !== "/callback") {
+        res.writeHead(404).end();
+        return;
+      }
+      clearTimeout(timeout);
+      const error = url.searchParams.get("error");
+      const code = url.searchParams.get("code");
+      const state = url.searchParams.get("state");
+      const fail = (msg) => {
+        res.writeHead(400, { "Content-Type": "text/html" }).end(FAILURE_HTML);
+        rejectCode(new Error(msg));
+      };
+      if (error) {
+        return fail(`Authorization denied: ${url.searchParams.get("error_description") || error}`);
+      }
+      if (!state || state !== expectedState) {
+        return fail("State mismatch — possible CSRF, aborting.");
+      }
+      if (!code) {
+        return fail("No authorization code returned.");
+      }
+      res.writeHead(200, { "Content-Type": "text/html" }).end(SUCCESS_HTML);
+      resolveCode(code);
+    });
+    server.on("error", (err) => {
+      clearTimeout(timeout);
+      rejectOuter(err);
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      resolveOuter({ server, port: addr.port, waitForCode });
+    });
+  });
 }
-function getActiveProjectId(cwd) {
-  const localConfig = loadLocalConfig(cwd);
-  if (localConfig?.projectId) {
-    return localConfig.projectId;
-  }
-  return loadConfig().activeProjectId;
+var MCP_RESOURCE_URL, LOGIN_TIMEOUT_MS, SUCCESS_HTML = `<!doctype html><html><head><meta charset="utf-8"><title>Harmony connected</title></head>
+<body style="font-family:system-ui,sans-serif;background:#0f1729;color:#dce4ef;display:flex;align-items:center;justify-content:center;height:100vh;margin:0">
+<div style="text-align:center"><h1 style="color:#57b8a5">✓ Connected to Harmony</h1>
+<p>You can close this tab and return to your terminal.</p></div></body></html>`, FAILURE_HTML = `<!doctype html><html><head><meta charset="utf-8"><title>Harmony</title></head>
+<body style="font-family:system-ui,sans-serif;background:#0f1729;color:#dce4ef;display:flex;align-items:center;justify-content:center;height:100vh;margin:0">
+<div style="text-align:center"><h1 style="color:#ff6b6b">Authorization failed</h1>
+<p>Return to your terminal for details.</p></div></body></html>`;
+var init_oauth_login = __esm(() => {
+  MCP_RESOURCE_URL = process.env.HARMONY_MCP_RESOURCE || "https://mcp.gethmy.com";
+  LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+});
+
+// src/oauth-refresh.ts
+var exports_oauth_refresh = {};
+__export(exports_oauth_refresh, {
+  refreshOAuthToken: () => refreshOAuthToken
+});
+import {
+  closeSync,
+  openSync,
+  renameSync,
+  rmSync as rmSync2,
+  statSync,
+  writeSync
+} from "node:fs";
+import { join as join3 } from "node:path";
+function lockPath() {
+  return join3(getConfigDir(), LOCK_FILENAME);
 }
-function isConfigured() {
-  const config = loadConfig();
-  return !!config.apiKey;
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
 }
-function areSkillsInstalled(cwd) {
-  const home = homedir();
-  const workingDir = cwd || process.cwd();
-  const foundPaths = [];
-  const globalSkillsDir = join(home, ".agents", "skills");
-  const globalSkillPath = join(globalSkillsDir, "hmy", "SKILL.md");
-  if (existsSync(globalSkillPath)) {
-    foundPaths.push(globalSkillPath);
-    return { installed: true, location: "global", paths: foundPaths };
-  }
-  const claudeGlobalSkill = join(home, ".claude", "skills", "hmy.md");
-  if (existsSync(claudeGlobalSkill)) {
-    foundPaths.push(claudeGlobalSkill);
-    return { installed: true, location: "global", paths: foundPaths };
-  }
-  const claudeGlobalSkillAlt = join(home, ".claude", "skills", "hmy", "SKILL.md");
-  if (existsSync(claudeGlobalSkillAlt)) {
-    foundPaths.push(claudeGlobalSkillAlt);
-    return { installed: true, location: "global", paths: foundPaths };
-  }
-  const localSkillPath = join(workingDir, ".claude", "skills", "hmy.md");
-  if (existsSync(localSkillPath)) {
-    foundPaths.push(localSkillPath);
-    return { installed: true, location: "local", paths: foundPaths };
+async function withRefreshLock(fn) {
+  const path = lockPath();
+  const deadline = Date.now() + LOCK_ACQUIRE_TIMEOUT_MS;
+  let held = false;
+  while (Date.now() < deadline) {
+    try {
+      const fd = openSync(path, "wx");
+      writeSync(fd, String(process.pid));
+      closeSync(fd);
+      held = true;
+      break;
+    } catch (err) {
+      if (err.code !== "EEXIST") {
+        break;
+      }
+      try {
+        const age = Date.now() - statSync(path).mtimeMs;
+        if (age > LOCK_STALE_MS) {
+          const claim = `${path}.stale.${process.pid}`;
+          try {
+            renameSync(path, claim);
+            rmSync2(claim, { force: true });
+          } catch {}
+          continue;
+        }
+      } catch {
+        continue;
+      }
+      await sleep(LOCK_RETRY_MS);
+    }
   }
-  const localSkillPathAlt = join(workingDir, ".claude", "skills", "hmy", "SKILL.md");
-  if (existsSync(localSkillPathAlt)) {
-    foundPaths.push(localSkillPathAlt);
-    return { installed: true, location: "local", paths: foundPaths };
+  try {
+    return await fn();
+  } finally {
+    if (held) {
+      try {
+        rmSync2(path, { force: true });
+      } catch {}
+    }
   }
-  return { installed: false, location: null, paths: [] };
 }
-function hasProjectContext(cwd) {
-  const localConfig = loadLocalConfig(cwd);
-  return !!(localConfig?.workspaceId || localConfig?.projectId);
+function refreshOAuthToken() {
+  if (inFlight)
+    return inFlight;
+  inFlight = doRefresh().finally(() => {
+    inFlight = null;
+  });
+  return inFlight;
 }
-function getMemoryDir() {
-  const config = loadConfig();
-  if (config.memoryDir)
-    return config.memoryDir;
-  return join(homedir(), ".harmony", "memory");
+async function doRefresh() {
+  const before = loadConfig();
+  if (!before.oauthRefreshToken || !before.oauthClientId)
+    return null;
+  return withRefreshLock(async () => {
+    const config = loadConfig();
+    if (config.oauthRefreshToken !== before.oauthRefreshToken && config.oauthAccessToken) {
+      return config.oauthAccessToken;
+    }
+    if (!config.oauthRefreshToken || !config.oauthClientId)
+      return null;
+    const base = oauthBaseFromApiUrl(config.apiUrl);
+    let res;
+    try {
+      res = await fetch(`${base}/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "refresh_token",
+          refresh_token: config.oauthRefreshToken,
+          client_id: config.oauthClientId
+        }).toString()
+      });
+    } catch {
+      return null;
+    }
+    if (!res.ok) {
+      const errorCode = await res.json().then((b) => b?.error ?? null).catch(() => null);
+      if (errorCode === "invalid_grant") {
+        saveConfig({
+          oauthAccessToken: null,
+          oauthRefreshToken: null,
+          oauthExpiresAt: null,
+          oauthClientId: null
+        });
+      }
+      return null;
+    }
+    const body = await res.json().catch(() => null);
+    if (!body?.access_token || !body.refresh_token)
+      return null;
+    saveConfig({
+      oauthAccessToken: body.access_token,
+      oauthRefreshToken: body.refresh_token,
+      oauthExpiresAt: Date.now() + (body.expires_in ?? 0) * 1000
+    });
+    return body.access_token;
+  });
 }
+var inFlight = null, LOCK_FILENAME = "refresh.lock", LOCK_STALE_MS = 30000, LOCK_ACQUIRE_TIMEOUT_MS = 35000, LOCK_RETRY_MS = 100;
+var init_oauth_refresh = __esm(() => {
+  init_config();
+  init_oauth_login();
+});
+
+// src/cli.ts
+init_config();
+import { createRequire as createRequire2 } from "node:module";
+import { program } from "commander";
 
 // src/server.ts
 import { readFile } from "node:fs/promises";
@@ -1205,6 +1498,7 @@ var TIMINGS = {
   QUERY_GC_TIME: 1000 * 60 * 60 * 24
 };
 // src/api-client.ts
+init_config();
 var RETRY_CONFIG = {
   maxRetries: 3,
   baseDelayMs: 1000,
@@ -1224,7 +1518,7 @@ function getRetryDelay(attempt) {
   const delay = Math.min(RETRY_CONFIG.baseDelayMs * 2 ** attempt, RETRY_CONFIG.maxDelayMs);
   return Math.round(delay + delay * 0.25 * (Math.random() * 2 - 1));
 }
-var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var sleep2 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 
 class Semaphore {
   permits;
@@ -1289,10 +1583,12 @@ class HarmonyApiClient {
   apiKey;
   apiUrl;
   onUnauthorized;
+  refreshCredential;
   constructor(options) {
     this.apiKey = options?.apiKey ?? getApiKey();
     this.apiUrl = options?.apiUrl ?? getApiUrl();
     this.onUnauthorized = options?.onUnauthorized;
+    this.refreshCredential = options?.refreshCredential;
   }
   getApiUrl() {
     return this.apiUrl;
@@ -1322,6 +1618,7 @@ class HarmonyApiClient {
   async requestWithRetry(method, path, body, options) {
     const url = `${this.apiUrl}/v1${path}`;
     let lastError = null;
+    let refreshed = false;
     const contentType = options?.contentType || "application/json";
     const accept = options?.accept || "application/json";
     for (let attempt = 0;attempt <= RETRY_CONFIG.maxRetries; attempt++) {
@@ -1350,6 +1647,15 @@ class HarmonyApiClient {
         if (!response.ok) {
           const errorMsg = data?.error || (looksLikeJson ? null : `API error: ${response.status} (non-JSON response)`) || `API error: ${response.status}`;
           if (response.status === 401) {
+            if (this.refreshCredential && !refreshed) {
+              refreshed = true;
+              const fresh = await this.refreshCredential();
+              if (fresh) {
+                this.apiKey = fresh;
+                attempt--;
+                continue;
+              }
+            }
             this.onUnauthorized?.();
             throw new HarmonyUnauthorizedError(errorMsg);
           }
@@ -1358,7 +1664,7 @@ class HarmonyApiClient {
           }
           lastError = new Error(errorMsg);
           if (attempt < RETRY_CONFIG.maxRetries) {
-            await sleep(getRetryDelay(attempt));
+            await sleep2(getRetryDelay(attempt));
             continue;
           }
           throw lastError;
@@ -1372,7 +1678,7 @@ class HarmonyApiClient {
         if (!isRetryableError(error))
           throw lastError;
         if (attempt < RETRY_CONFIG.maxRetries) {
-          await sleep(getRetryDelay(attempt));
+          await sleep2(getRetryDelay(attempt));
         }
       }
     }
@@ -1381,6 +1687,7 @@ class HarmonyApiClient {
   async requestRawWithRetry(method, path, body, options) {
     const url = `${this.apiUrl}/v1${path}`;
     let lastError = null;
+    let refreshed = false;
     const contentType = options?.contentType || "application/json";
     const accept = options?.accept || "text/markdown";
     for (let attempt = 0;attempt <= RETRY_CONFIG.maxRetries; attempt++) {
@@ -1403,6 +1710,15 @@ class HarmonyApiClient {
             errorMsg = text || `API error: ${response.status}`;
           }
           if (response.status === 401) {
+            if (this.refreshCredential && !refreshed) {
+              refreshed = true;
+              const fresh = await this.refreshCredential();
+              if (fresh) {
+                this.apiKey = fresh;
+                attempt--;
+                continue;
+              }
+            }
             this.onUnauthorized?.();
             throw new HarmonyUnauthorizedError(errorMsg);
           }
@@ -1411,7 +1727,7 @@ class HarmonyApiClient {
           }
           lastError = new Error(errorMsg);
           if (attempt < RETRY_CONFIG.maxRetries) {
-            await sleep(getRetryDelay(attempt));
+            await sleep2(getRetryDelay(attempt));
             continue;
           }
           throw lastError;
@@ -1422,7 +1738,7 @@ class HarmonyApiClient {
         if (!isRetryableError(error))
           throw lastError;
         if (attempt < RETRY_CONFIG.maxRetries) {
-          await sleep(getRetryDelay(attempt));
+          await sleep2(getRetryDelay(attempt));
         }
       }
     }
@@ -2004,7 +2320,12 @@ async function loadPromptModules() {
 var client2 = null;
 function getClient() {
   if (!client2) {
-    client2 = new HarmonyApiClient;
+    client2 = new HarmonyApiClient({
+      refreshCredential: async () => {
+        const { refreshOAuthToken: refreshOAuthToken2 } = await Promise.resolve().then(() => (init_oauth_refresh(), exports_oauth_refresh));
+        return refreshOAuthToken2();
+      }
+    });
   }
   return client2;
 }
@@ -2183,6 +2504,9 @@ async function autoEndSession(scope, client3, cardId, status) {
   } catch {}
 }
 
+// src/server.ts
+init_config();
+
 // src/graph-expansion.ts
 async function autoExpandGraph(client3, entityId, title, content, _tags, workspaceId, projectId, maxRelations = 5) {
   try {
@@ -2193,14 +2517,14 @@ async function autoExpandGraph(client3, entityId, title, content, _tags, workspa
       project_id: projectId,
       limit: 20
     });
-    candidates = entities.filter((e) => e.id !== entityId).slice(0, maxRelations);
+    candidates = entities.filter((e) => e.id !== entityId && (e.confidence ?? 1) >= 0.4).slice(0, maxRelations);
     if (candidates.length === 0) {
       await new Promise((resolve) => setTimeout(resolve, 2000));
       const retry = await client3.searchMemoryEntities(workspaceId, query, {
         project_id: projectId,
         limit: 20
       });
-      candidates = retry.entities.filter((e) => e.id !== entityId).slice(0, maxRelations);
+      candidates = retry.entities.filter((e) => e.id !== entityId && (e.confidence ?? 1) >= 0.4).slice(0, maxRelations);
     }
     let relationsCreated = 0;
     for (const candidate of candidates) {
@@ -2737,6 +3061,7 @@ function lintTags(tags) {
 }
 
 // src/onboard.ts
+init_config();
 async function onboardNewUser(params) {
   const {
     email,
@@ -2782,19 +3107,20 @@ import {
   existsSync as existsSync4,
   mkdirSync as mkdirSync3,
   readFileSync as readFileSync4,
-  renameSync,
+  renameSync as renameSync2,
   writeFileSync as writeFileSync3
 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { dirname, join as join4 } from "node:path";
+import { dirname, join as join5 } from "node:path";
+init_config();
 
 // src/hmy-config.ts
 import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 var DEFAULTS = { updateCheck: true, pin: null };
 function getHmyConfigPath() {
-  return join3(homedir2(), ".hmy", "config.yaml");
+  return join4(homedir2(), ".hmy", "config.yaml");
 }
 function loadHmyConfig() {
   const path = getHmyConfigPath();
@@ -2937,7 +3263,7 @@ function atomicWrite(filePath, content) {
     mkdirSync3(dir, { recursive: true });
   const tmp = `${filePath}.tmp-${process.pid}-${Date.now()}`;
   writeFileSync3(tmp, content);
-  renameSync(tmp, filePath);
+  renameSync2(tmp, filePath);
 }
 function hasMetadataVersion(content) {
   return parseSkillVersion(content) !== null;
@@ -2977,9 +3303,9 @@ function findSkillFiles(paths, knownNames) {
   }
   return results;
 }
-var HMY_DIR = join4(homedir3(), ".hmy");
-var HMY_VERSION_FILE = join4(HMY_DIR, "VERSION");
-var LAST_CHECK_FILE = join4(HMY_DIR, "last-update-check");
+var HMY_DIR = join5(homedir3(), ".hmy");
+var HMY_VERSION_FILE = join5(HMY_DIR, "VERSION");
+var LAST_CHECK_FILE = join5(HMY_DIR, "last-update-check");
 var CHECK_TTL_MS = 24 * 60 * 60 * 1000;
 function checkedRecently(now = Date.now()) {
   try {
@@ -3012,7 +3338,7 @@ async function refreshSkills(opts = {}) {
     const status = areSkillsInstalled();
     if (!status.installed)
       return { updated: false };
-    const client3 = new HarmonyApiClient;
+    const client3 = getClient();
     const versionInfo = await client3.fetchSkillsVersion();
     recordCheck();
     const skillFiles = findSkillFiles(status.paths, versionInfo.skills);
@@ -4875,7 +5201,7 @@ async function handleToolCall(name, args, deps) {
     case "harmony_delete_label": {
       const labelId = z.string().uuid().parse(args.labelId);
       const result = await client3.deleteLabel(labelId);
-      return { success: true, ...result };
+      return { ...result };
     }
     case "harmony_add_label_to_card": {
       const cardId = z.string().uuid().parse(args.cardId);
@@ -5832,8 +6158,8 @@ async function handleToolCall(name, args, deps) {
             content: summary,
             type: "lesson",
             scope: "project",
-            workspaceId,
-            projectId: plan.project_id,
+            workspace_id: workspaceId,
+            project_id: plan.project_id,
             tags: ["plan", "archived"],
             confidence: 0.8
           });
@@ -6015,7 +6341,7 @@ class HarmonyMCPServer {
 }
 
 // src/tui/setup.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import {
   existsSync as existsSync8,
   lstatSync,
@@ -6024,20 +6350,22 @@ import {
   unlinkSync
 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { dirname as dirname3, join as join7 } from "node:path";
+import { dirname as dirname3, join as join8 } from "node:path";
 import * as p3 from "@clack/prompts";
+init_config();
+init_oauth_login();
 
 // src/tui/agents.ts
 import { existsSync as existsSync5 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 var AGENT_DEFINITIONS = [
   {
     id: "claude",
     name: "Claude Code",
     description: "Anthropic CLI agent",
     hint: "/hmy <card>",
-    globalPaths: [join5(homedir4(), ".claude")],
+    globalPaths: [join6(homedir4(), ".claude")],
     localPaths: [".claude"]
   },
   {
@@ -6045,7 +6373,7 @@ var AGENT_DEFINITIONS = [
     name: "Codex",
     description: "OpenAI coding agent",
     hint: "/prompts:hmy <card>",
-    globalPaths: [join5(homedir4(), ".codex")],
+    globalPaths: [join6(homedir4(), ".codex")],
     localPaths: ["AGENTS.md"]
   },
   {
@@ -6061,20 +6389,20 @@ var AGENT_DEFINITIONS = [
     name: "Windsurf",
     description: "Codeium AI IDE",
     hint: "MCP tools available automatically",
-    globalPaths: [join5(homedir4(), ".codeium", "windsurf")],
+    globalPaths: [join6(homedir4(), ".codeium", "windsurf")],
     localPaths: [".windsurf", ".windsurfrules"]
   }
 ];
 function detectAgents(cwd = process.cwd()) {
   return AGENT_DEFINITIONS.map((def) => {
     const globalPath = def.globalPaths.find((p) => existsSync5(p)) || null;
-    const localPath = def.localPaths.find((p) => existsSync5(join5(cwd, p))) || null;
+    const localPath = def.localPaths.find((p) => existsSync5(join6(cwd, p))) || null;
     return {
       id: def.id,
       name: def.name,
       detected: !!(globalPath || localPath),
       globalPath,
-      localPath: localPath ? join5(cwd, localPath) : null,
+      localPath: localPath ? join6(cwd, localPath) : null,
       description: def.description,
       hint: def.hint
     };
@@ -6082,8 +6410,8 @@ function detectAgents(cwd = process.cwd()) {
 }
 
 // src/tui/docs.ts
-import { existsSync as existsSync6, readdirSync as readdirSync2, readFileSync as readFileSync5, statSync } from "node:fs";
-import { isAbsolute, join as join6, resolve, sep as sep2 } from "node:path";
+import { existsSync as existsSync6, readdirSync as readdirSync2, readFileSync as readFileSync5, statSync as statSync2 } from "node:fs";
+import { isAbsolute, join as join7, resolve, sep as sep2 } from "node:path";
 import * as p from "@clack/prompts";
 
 // src/tui/theme.ts
@@ -6188,7 +6516,7 @@ function listDirs(dirPath) {
       if (IGNORED_DIRS.has(entry) || entry.startsWith("."))
         return false;
       try {
-        return statSync(join6(dirPath, entry)).isDirectory();
+        return statSync2(join7(dirPath, entry)).isDirectory();
       } catch {
         return false;
       }
@@ -6236,25 +6564,25 @@ function describeDir(name) {
 }
 function scanProject(cwd) {
   let packageManager = null;
-  if (existsSync6(join6(cwd, "bun.lock")) || existsSync6(join6(cwd, "bun.lockb"))) {
+  if (existsSync6(join7(cwd, "bun.lock")) || existsSync6(join7(cwd, "bun.lockb"))) {
     packageManager = "bun";
-  } else if (existsSync6(join6(cwd, "pnpm-lock.yaml"))) {
+  } else if (existsSync6(join7(cwd, "pnpm-lock.yaml"))) {
     packageManager = "pnpm";
-  } else if (existsSync6(join6(cwd, "yarn.lock"))) {
+  } else if (existsSync6(join7(cwd, "yarn.lock"))) {
     packageManager = "yarn";
-  } else if (existsSync6(join6(cwd, "package.json"))) {
+  } else if (existsSync6(join7(cwd, "package.json"))) {
     packageManager = "npm";
   }
-  const pkg = readJson(join6(cwd, "package.json"));
+  const pkg = readJson(join7(cwd, "package.json"));
   const scripts = pkg && typeof pkg.scripts === "object" && pkg.scripts !== null ? pkg.scripts : {};
   let language = "unknown";
-  if (existsSync6(join6(cwd, "tsconfig.json"))) {
+  if (existsSync6(join7(cwd, "tsconfig.json"))) {
     language = "typescript";
-  } else if (existsSync6(join6(cwd, "go.mod"))) {
+  } else if (existsSync6(join7(cwd, "go.mod"))) {
     language = "go";
-  } else if (existsSync6(join6(cwd, "Cargo.toml"))) {
+  } else if (existsSync6(join7(cwd, "Cargo.toml"))) {
     language = "rust";
-  } else if (existsSync6(join6(cwd, "setup.py")) || existsSync6(join6(cwd, "pyproject.toml"))) {
+  } else if (existsSync6(join7(cwd, "setup.py")) || existsSync6(join7(cwd, "pyproject.toml"))) {
     language = "python";
   } else if (pkg) {
     language = "javascript";
@@ -6290,7 +6618,7 @@ function scanProject(cwd) {
     }
   }
   let linter = null;
-  if (existsSync6(join6(cwd, "biome.json")) || existsSync6(join6(cwd, "biome.jsonc"))) {
+  if (existsSync6(join7(cwd, "biome.json")) || existsSync6(join7(cwd, "biome.jsonc"))) {
     linter = "biome";
   } else {
     const eslintFiles = [
@@ -6305,7 +6633,7 @@ function scanProject(cwd) {
       "eslint.config.cjs",
       "eslint.config.ts"
     ];
-    if (eslintFiles.some((f) => existsSync6(join6(cwd, f)))) {
+    if (eslintFiles.some((f) => existsSync6(join7(cwd, f)))) {
       linter = "eslint";
     } else {
       const prettierFiles = [
@@ -6317,13 +6645,13 @@ function scanProject(cwd) {
         "prettier.config.js",
         "prettier.config.mjs"
       ];
-      if (prettierFiles.some((f) => existsSync6(join6(cwd, f)))) {
+      if (prettierFiles.some((f) => existsSync6(join7(cwd, f)))) {
         linter = "prettier";
       }
     }
   }
   let indentStyle = null;
-  const biome = readJson(join6(cwd, "biome.json")) ?? readJson(join6(cwd, "biome.jsonc"));
+  const biome = readJson(join7(cwd, "biome.json")) ?? readJson(join7(cwd, "biome.jsonc"));
   if (biome) {
     const formatter = biome.formatter;
     if (formatter) {
@@ -6333,7 +6661,7 @@ function scanProject(cwd) {
     }
   }
   if (!indentStyle) {
-    const editorConfig = readText(join6(cwd, ".editorconfig"));
+    const editorConfig = readText(join7(cwd, ".editorconfig"));
     if (editorConfig) {
       const styleMatch = editorConfig.match(/indent_style\s*=\s*(space|tab)/);
       const sizeMatch = editorConfig.match(/indent_size\s*=\s*(\d+)/);
@@ -6346,13 +6674,13 @@ function scanProject(cwd) {
     }
   }
   const dirs = listDirs(cwd);
-  const srcDirs = existsSync6(join6(cwd, "src")) ? listDirs(join6(cwd, "src")) : [];
-  const monorepo = existsSync6(join6(cwd, "packages")) || existsSync6(join6(cwd, "apps"));
+  const srcDirs = existsSync6(join7(cwd, "src")) ? listDirs(join7(cwd, "src")) : [];
+  const monorepo = existsSync6(join7(cwd, "packages")) || existsSync6(join7(cwd, "apps"));
   const existingDocs = {
-    agentsMd: existsSync6(join6(cwd, "AGENTS.md")),
-    claudeMd: existsSync6(join6(cwd, "CLAUDE.md")),
-    docsDir: existsSync6(join6(cwd, "docs")),
-    architectureMd: existsSync6(join6(cwd, "docs", "architecture.md"))
+    agentsMd: existsSync6(join7(cwd, "AGENTS.md")),
+    claudeMd: existsSync6(join7(cwd, "CLAUDE.md")),
+    docsDir: existsSync6(join7(cwd, "docs")),
+    architectureMd: existsSync6(join7(cwd, "docs", "architecture.md"))
   };
   return {
     packageManager,
@@ -6503,9 +6831,9 @@ var VAGUE_STANDARDS = [
 ];
 function verifyDocs(cwd) {
   const issues = [];
-  const claudeMd = readText(join6(cwd, "CLAUDE.md"));
-  const agentsMd = readText(join6(cwd, "AGENTS.md"));
-  const pkg = readJson(join6(cwd, "package.json"));
+  const claudeMd = readText(join7(cwd, "CLAUDE.md"));
+  const agentsMd = readText(join7(cwd, "AGENTS.md"));
+  const pkg = readJson(join7(cwd, "package.json"));
   const pkgScripts = pkg && typeof pkg.scripts === "object" && pkg.scripts !== null ? pkg.scripts : {};
   const projectRoot = resolve(cwd);
   if (claudeMd) {
@@ -6671,7 +6999,7 @@ function verifyDocs(cwd) {
     }
     checkBacktickPaths(agentsMd, "AGENTS.md", cwd, issues);
   }
-  const archMd = readText(join6(cwd, "docs", "architecture.md"));
+  const archMd = readText(join7(cwd, "docs", "architecture.md"));
   if (archMd) {
     checkBacktickPaths(archMd, "docs/architecture.md", cwd, issues);
   }
@@ -6741,18 +7069,18 @@ async function runDocsStep(cwd) {
     }
     const files = [];
     files.push({
-      path: join6(cwd, "AGENTS.md"),
+      path: join7(cwd, "AGENTS.md"),
       content: generateAgentsMd(info, cwd),
       type: "text"
     });
     files.push({
-      path: join6(cwd, "CLAUDE.md"),
+      path: join7(cwd, "CLAUDE.md"),
       content: generateClaudeMd(info),
       type: "text"
     });
     if (info.dirs.includes("docs") || info.srcDirs.length > 0) {
       files.push({
-        path: join6(cwd, "docs", "architecture.md"),
+        path: join7(cwd, "docs", "architecture.md"),
         content: generateArchitectureMd(info, cwd),
         type: "text"
       });
@@ -7016,7 +7344,7 @@ var SAFE_HARMONY_TOOLS = [
   "harmony_process_command",
   "harmony_sync"
 ];
-var GLOBAL_SKILLS_DIR = join7(homedir6(), ".agents", "skills");
+var GLOBAL_SKILLS_DIR = join8(homedir6(), ".agents", "skills");
 var API_URL = "https://app.gethmy.com/api";
 async function registerMcpServer() {
   try {
@@ -7031,7 +7359,7 @@ async function registerMcpServer() {
 }
 async function writeMcpConfigFallback(home) {
   const { readFileSync: readFileSync7, writeFileSync: writeFileSync5, mkdirSync: mkdirSync6, existsSync: existsSync9 } = await import("node:fs");
-  const settingsPath = join7(home, ".claude", "settings.json");
+  const settingsPath = join8(home, ".claude", "settings.json");
   const settingsDir = dirname3(settingsPath);
   if (!existsSync9(settingsDir)) {
     mkdirSync6(settingsDir, { recursive: true });
@@ -7050,7 +7378,7 @@ async function writeMcpConfigFallback(home) {
 }
 async function allowlistHarmonyTools(home, allowAll) {
   const { readFileSync: readFileSync7, writeFileSync: writeFileSync5, mkdirSync: mkdirSync6, existsSync: existsSync9 } = await import("node:fs");
-  const settingsPath = join7(home, ".claude", "settings.json");
+  const settingsPath = join8(home, ".claude", "settings.json");
   const settingsDir = dirname3(settingsPath);
   if (!existsSync9(settingsDir)) {
     mkdirSync6(settingsDir, { recursive: true });
@@ -7168,17 +7496,17 @@ async function getAgentFiles(agentId, cwd, installMode = "global") {
           const content = buildSkillFile(fetched);
           if (installMode === "global") {
             files.push({
-              path: join7(GLOBAL_SKILLS_DIR, name, "SKILL.md"),
+              path: join8(GLOBAL_SKILLS_DIR, name, "SKILL.md"),
               content,
               type: "text"
             });
             symlinks.push({
-              target: join7(GLOBAL_SKILLS_DIR, name),
-              link: join7(home, ".claude", "skills", name)
+              target: join8(GLOBAL_SKILLS_DIR, name),
+              link: join8(home, ".claude", "skills", name)
             });
           } else {
             files.push({
-              path: join7(cwd, ".claude", "skills", name, "SKILL.md"),
+              path: join8(cwd, ".claude", "skills", name, "SKILL.md"),
               content,
               type: "text"
             });
@@ -7196,18 +7524,18 @@ ${summary}`);
       }
       try {
         const updateCheckFetched = await client3.fetchSkill("hmy-update-check");
-        const actualHash = createHash3("sha256").update(updateCheckFetched.content).digest("hex");
+        const actualHash = createHash4("sha256").update(updateCheckFetched.content).digest("hex");
         if (actualHash !== updateCheckFetched.sha256) {
           throw new Error(`hmy-update-check integrity check failed: expected ${updateCheckFetched.sha256}, got ${actualHash}`);
         }
         files.push({
-          path: join7(home, ".hmy", "bin", "hmy-update-check"),
+          path: join8(home, ".hmy", "bin", "hmy-update-check"),
           content: updateCheckFetched.content,
           type: "text",
           mode: 493
         });
         files.push({
-          path: join7(home, ".hmy", "VERSION"),
+          path: join8(home, ".hmy", "VERSION"),
           content: versionInfo.version,
           type: "text"
         });
@@ -7253,7 +7581,7 @@ Skip if: work was already started with a card reference, or no matching card exi
 - \`harmony_generate_prompt\` - Get role-based guidance and focus areas for the card
 `;
       files.push({
-        path: join7(cwd, "AGENTS.md"),
+        path: join8(cwd, "AGENTS.md"),
         content: agentsContent,
         type: "text"
       });
@@ -7270,17 +7598,17 @@ ${HARMONY_WORKFLOW_PROMPT.replace("$ARGUMENTS", "{{card}}").replace("Your agent
 `;
       if (installMode === "global") {
         files.push({
-          path: join7(GLOBAL_SKILLS_DIR, "codex", "hmy.md"),
+          path: join8(GLOBAL_SKILLS_DIR, "codex", "hmy.md"),
           content: promptContent,
           type: "text"
         });
         symlinks.push({
-          target: join7(GLOBAL_SKILLS_DIR, "codex", "hmy.md"),
-          link: join7(home, ".codex", "prompts", "hmy.md")
+          target: join8(GLOBAL_SKILLS_DIR, "codex", "hmy.md"),
+          link: join8(home, ".codex", "prompts", "hmy.md")
         });
       } else {
         files.push({
-          path: join7(home, ".codex", "prompts", "hmy.md"),
+          path: join8(home, ".codex", "prompts", "hmy.md"),
           content: promptContent,
           type: "text"
         });
@@ -7292,7 +7620,7 @@ command = "npx"
 args = ["-y", "@gethmy/mcp@latest", "serve"]
 `;
       files.push({
-        path: join7(home, ".codex", "config.toml"),
+        path: join8(home, ".codex", "config.toml"),
         content: tomlContent,
         type: "toml",
         tomlSection: "mcp_servers.harmony"
@@ -7301,7 +7629,7 @@ args = ["-y", "@gethmy/mcp@latest", "serve"]
     }
     case "cursor": {
       files.push({
-        path: join7(cwd, ".cursor", "mcp.json"),
+        path: join8(cwd, ".cursor", "mcp.json"),
         content: JSON.stringify({
           mcpServers: {
             harmony: {
@@ -7327,17 +7655,17 @@ ${HARMONY_WORKFLOW_PROMPT.replace("$ARGUMENTS", "the card reference").replace("Y
 `;
       if (installMode === "global") {
         files.push({
-          path: join7(GLOBAL_SKILLS_DIR, "cursor", "harmony.mdc"),
+          path: join8(GLOBAL_SKILLS_DIR, "cursor", "harmony.mdc"),
           content: ruleContent,
           type: "text"
         });
         symlinks.push({
-          target: join7(GLOBAL_SKILLS_DIR, "cursor", "harmony.mdc"),
-          link: join7(home, ".cursor", "rules", "harmony.mdc")
+          target: join8(GLOBAL_SKILLS_DIR, "cursor", "harmony.mdc"),
+          link: join8(home, ".cursor", "rules", "harmony.mdc")
         });
       } else {
         files.push({
-          path: join7(cwd, ".cursor", "rules", "harmony.mdc"),
+          path: join8(cwd, ".cursor", "rules", "harmony.mdc"),
           content: ruleContent,
           type: "text"
         });
@@ -7346,7 +7674,7 @@ ${HARMONY_WORKFLOW_PROMPT.replace("$ARGUMENTS", "the card reference").replace("Y
     }
     case "windsurf": {
       files.push({
-        path: join7(home, ".codeium", "windsurf", "mcp_config.json"),
+        path: join8(home, ".codeium", "windsurf", "mcp_config.json"),
         content: JSON.stringify({
           mcpServers: {
             harmony: {
@@ -7372,17 +7700,17 @@ ${HARMONY_WORKFLOW_PROMPT.replace("$ARGUMENTS", "the card reference").replace("Y
 `;
       if (installMode === "global") {
         files.push({
-          path: join7(GLOBAL_SKILLS_DIR, "windsurf", "harmony.md"),
+          path: join8(GLOBAL_SKILLS_DIR, "windsurf", "harmony.md"),
           content: ruleContent,
           type: "text"
         });
         symlinks.push({
-          target: join7(GLOBAL_SKILLS_DIR, "windsurf", "harmony.md"),
-          link: join7(home, ".codeium", "windsurf", "rules", "harmony.md")
+          target: join8(GLOBAL_SKILLS_DIR, "windsurf", "harmony.md"),
+          link: join8(home, ".codeium", "windsurf", "rules", "harmony.md")
         });
       } else {
         files.push({
-          path: join7(cwd, ".windsurf", "rules", "harmony.md"),
+          path: join8(cwd, ".windsurf", "rules", "harmony.md"),
           content: ruleContent,
           type: "text"
         });
@@ -7407,39 +7735,84 @@ async function runSetup(options = {}) {
   if (options.workspaceId || options.projectId || options.projectSlug) {
     needsContext = true;
   }
-  let apiKey = options.apiKey || existingConfig.apiKey;
+  let apiKey = options.apiKey || existingConfig.oauthAccessToken || existingConfig.apiKey;
   let userEmail = options.userEmail || existingConfig.userEmail || undefined;
   let selectedWorkspaceIdFromSignup;
   let selectedProjectIdFromSignup;
   let selectedWorkspaceNameFromSignup;
   let selectedProjectNameFromSignup;
   let createdNewAccount = false;
+  let oauthTokens;
+  if (options.apiKey) {
+    p3.log.warn(colors.warning(`--api-key is deprecated and insecure: the key is exposed in your shell
+history, terminal scrollback, and the process list. Prefer the browser
+sign-in (run \`npx @gethmy/mcp setup\` with no --api-key). Use --api-key
+only for unattended CI where you accept that risk.`));
+  }
   if (needsApiKey || !apiKey || !apiKey.startsWith("hmy_")) {
     let useNewAccount = options.newAccount === true;
+    let useBrowserAuth = false;
     if (!useNewAccount && options.apiKey) {
       useNewAccount = false;
     } else if (!useNewAccount && !options.apiKey) {
       const getStarted = await p3.select({
-        message: "How would you like to get started?",
+        message: "How would you like to connect?",
         options: [
+          {
+            value: "browser",
+            label: "Sign in with your browser",
+            hint: "recommended — secure, no key handling"
+          },
           {
             value: "create",
-            label: "Create a free account",
-            hint: "recommended for new users"
+            label: "Create a free account"
           },
           {
             value: "apikey",
-            label: "I already have an API key"
+            label: "Paste an API key",
+            hint: "advanced / CI"
           }
-        ]
+        ],
+        initialValue: "browser"
       });
       if (p3.isCancel(getStarted)) {
         p3.cancel("Setup cancelled");
         process.exit(0);
       }
       useNewAccount = getStarted === "create";
+      useBrowserAuth = getStarted === "browser";
     }
-    if (useNewAccount) {
+    if (useBrowserAuth) {
+      const spinner4 = p3.spinner();
+      spinner4.start("Opening your browser to authorize…");
+      try {
+        oauthTokens = await loginWithBrowser({
+          apiUrl: API_URL,
+          workspaceId: options.workspaceId,
+          onUrl: (url) => {
+            spinner4.message(`Authorize in your browser. If it didn't open:
+${colors.dim(url)}`);
+          }
+        });
+        apiKey = oauthTokens.accessToken;
+        needsApiKey = true;
+        saveConfig({
+          apiKey: null,
+          oauthAccessToken: oauthTokens.accessToken,
+          oauthRefreshToken: oauthTokens.refreshToken,
+          oauthExpiresAt: oauthTokens.expiresAt,
+          oauthClientId: oauthTokens.clientId,
+          apiUrl: API_URL
+        });
+        spinner4.stop(colors.success("Authorized"));
+      } catch (error) {
+        spinner4.stop(colors.error("Browser authorization failed"));
+        const msg = error instanceof Error ? error.message : "Unknown error";
+        p3.log.error(msg);
+        p3.log.info("You can retry, or run with --api-key for unattended setup.");
+        process.exit(1);
+      }
+    } else if (useNewAccount) {
       const fullName = options.name || await p3.text({
         message: "Full name",
         placeholder: "Jane Smith",
@@ -7520,6 +7893,9 @@ async function runSetup(options = {}) {
         }
         process.exit(1);
       }
+    } else if (options.apiKey) {
+      apiKey = options.apiKey;
+      needsApiKey = true;
     } else {
       const keyInput = await p3.text({
         message: "Enter your Harmony API key",
@@ -7703,15 +8079,26 @@ async function runSetup(options = {}) {
   const allFiles = [];
   const allSymlinks = [];
   if (needsApiKey || !alreadyConfigured) {
+    const configToWrite = oauthTokens ? {
+      apiKey: null,
+      apiUrl: API_URL,
+      userEmail: userEmail || null,
+      activeWorkspaceId: null,
+      activeProjectId: null,
+      oauthAccessToken: oauthTokens.accessToken,
+      oauthRefreshToken: oauthTokens.refreshToken,
+      oauthExpiresAt: oauthTokens.expiresAt,
+      oauthClientId: oauthTokens.clientId
+    } : {
+      apiKey,
+      apiUrl: API_URL,
+      userEmail: userEmail || null,
+      activeWorkspaceId: null,
+      activeProjectId: null
+    };
     allFiles.push({
       path: getConfigPath(),
-      content: JSON.stringify({
-        apiKey,
-        apiUrl: API_URL,
-        userEmail: userEmail || null,
-        activeWorkspaceId: null,
-        activeProjectId: null
-      }, null, 2),
+      content: JSON.stringify(configToWrite, null, 2),
       type: "text"
     });
   }
@@ -7734,7 +8121,11 @@ async function runSetup(options = {}) {
   console.log("");
   p3.log.step("Summary");
   console.log("");
-  console.log(`  ${colors.bold("API Key:")} ${apiKey.slice(0, 8)}...`);
+  if (oauthTokens) {
+    console.log(`  ${colors.bold("Credential:")} Browser sign-in (OAuth, workspace-scoped)`);
+  } else {
+    console.log(`  ${colors.bold("API Key:")} ${apiKey.slice(0, 8)}...`);
+  }
   if (userEmail) {
     console.log(`  ${colors.bold("Email:")} ${userEmail}`);
   }
@@ -7831,7 +8222,7 @@ async function runSetup(options = {}) {
     } else {
       try {
         await writeMcpConfigFallback(home);
-        console.log(`  ${colors.success("✓")} ${colors.dim(formatPath(join7(home, ".claude", "settings.json"), home))} ${colors.dim("(updated)")}`);
+        console.log(`  ${colors.success("✓")} ${colors.dim(formatPath(join8(home, ".claude", "settings.json"), home))} ${colors.dim("(updated)")}`);
       } catch {
         p3.log.warning("Could not register MCP server. Run manually: claude mcp add --transport stdio harmony -- npx -y @gethmy/mcp@latest serve");
       }
@@ -7849,7 +8240,7 @@ async function runSetup(options = {}) {
       try {
         const result = await allowlistHarmonyTools(home, allowAll);
         const scope = allowAll ? "all tools" : "safe tools";
-        console.log(`  ${colors.success("✓")} ${colors.dim(formatPath(join7(home, ".claude", "settings.json"), home))} ${colors.dim(result === "added" ? `(${scope} allowlisted)` : `(${scope} already allowlisted)`)}`);
+        console.log(`  ${colors.success("✓")} ${colors.dim(formatPath(join8(home, ".claude", "settings.json"), home))} ${colors.dim(result === "added" ? `(${scope} allowlisted)` : `(${scope} already allowlisted)`)}`);
       } catch {
         p3.log.warning("Could not allowlist Harmony tools. Run /permissions in Claude Code and choose “always allow” for Harmony, or add mcp__harmony to permissions.allow in ~/.claude/settings.json.");
       }
@@ -7941,7 +8332,11 @@ program.command("status").description("Show configuration status").action(() =>
     console.log(`Status: Configured
 `);
     console.log("API:");
-    console.log(`  Key: ${globalConfig.apiKey?.slice(0, 8)}...`);
+    if (globalConfig.oauthAccessToken) {
+      console.log("  Credential: Browser sign-in (OAuth, workspace-scoped)");
+    } else {
+      console.log(`  Key: ${globalConfig.apiKey?.slice(0, 8)}...`);
+    }
     console.log(`  URL: ${globalConfig.apiUrl}`);
     console.log(`  Email: ${globalConfig.userEmail ? maskEmail(globalConfig.userEmail) : "(not set)"}`);
     console.log(`
@@ -7985,13 +8380,17 @@ program.command("reset").description("Remove stored configuration").action(() =>
     apiKey: null,
     activeWorkspaceId: null,
     activeProjectId: null,
-    userEmail: null
+    userEmail: null,
+    oauthAccessToken: null,
+    oauthRefreshToken: null,
+    oauthExpiresAt: null,
+    oauthClientId: null
   });
   console.log("Configuration reset successfully");
   console.log(`
 To reconfigure, run: npx @gethmy/mcp setup`);
 });
-program.command("setup").description("Smart setup wizard for Harmony MCP (recommended)").argument("[slug]", "Project slug — resolves to workspace + project in one step (e.g. harmony-6590761b)").option("-f, --force", "Overwrite existing configuration files").option("-k, --api-key <key>", "API key (skips prompt)").option("-e, --email <email>", "Your email for auto-assignment").option("-a, --agents <agents...>", "Agents to configure: claude, codex, cursor, windsurf").option("-l, --local", "Install skills locally in project directory").option("-g, --global", "Install skills globally (recommended)").option("-w, --workspace <id>", "Set workspace context (UUID)").option("-p, --project <id>", "Set project context (UUID)").option("--skip-context", "Skip workspace/project selection").option("--skip-docs", "Skip project docs scaffold/verification").option("--new", "Create a new account (skip the choice prompt)").option("-n, --name <name>", "Full name (for account creation)").option("--allow-all-tools", "Allowlist every Harmony tool (incl. destructive: delete/archive/api-key/invite) without confirmation. Default allowlists only read + routine-write tools; destructive tools keep prompting.").action(async (slug, options) => {
+program.command("setup").description("Smart setup wizard for Harmony MCP (recommended)").argument("[slug]", "Project slug — resolves to workspace + project in one step (e.g. harmony-6590761b)").option("-f, --force", "Overwrite existing configuration files").option("-k, --api-key <key>", "DEPRECATED (insecure: key leaks via argv/shell history). For unattended CI only — interactive setup uses browser sign-in.").option("-e, --email <email>", "Your email for auto-assignment").option("-a, --agents <agents...>", "Agents to configure: claude, codex, cursor, windsurf").option("-l, --local", "Install skills locally in project directory").option("-g, --global", "Install skills globally (recommended)").option("-w, --workspace <id>", "Set workspace context (UUID)").option("-p, --project <id>", "Set project context (UUID)").option("--skip-context", "Skip workspace/project selection").option("--skip-docs", "Skip project docs scaffold/verification").option("--new", "Create a new account (skip the choice prompt)").option("-n, --name <name>", "Full name (for account creation)").option("--allow-all-tools", "Allowlist every Harmony tool (incl. destructive: delete/archive/api-key/invite) without confirmation. Default allowlists only read + routine-write tools; destructive tools keep prompting.").action(async (slug, options) => {
   await runSetup({
     force: options.force,
     apiKey: options.apiKey,