@hue-run/sdk 0.11.0 → 0.11.1

package/CLI.md

@@ -42,7 +42,7 @@ project manifest are refused because managers can update ancestor locks; Python
 The generated `hue.setup.mjs` or `hue_setup.py` always selects `captureContent: false` /
 `capture_content=False`. For a supported application, setup installs the dependency and adds the
 managed import and middleware registration to the existing entrypoint; an unreferenced helper is
-not a completed integration. TypeScript uses `@hue-run/sdk@0.11.0`, `@opentelemetry/api@1.9.1` and
+not a completed integration. TypeScript uses `@hue-run/sdk@0.11.1`, `@opentelemetry/api@1.9.1` and
 `@opentelemetry/context-async-hooks@2.11.0`; Python setup uses its separately tested package pin.
 Content capture requires an ordinary account-managed key and a later explicit application decision.
 
@@ -187,7 +187,7 @@ for staging). Hue's Settings page does not show these snippets; this command kee
 - `key` (the default, except for `conductor`) references the `HUE_MCP_KEY` environment variable,
   which `hue login` stores in `.env.hue`. A key value is never written.
 - `oauth` configures the URL only. The client opens Hue in a browser, where you sign in and
-  approve the connection; no key or header is involved. A new sign-in connection has **Read and
+  approve the connection; no key is involved. A new sign-in connection has **Read and
   write** access to every active project in the organization you choose, within your role, so an
   agent first calls `list_projects` and passes the chosen project's id as `project_id`. It is available
   for `claude-code`, `codex` and `conductor`. Hue does not yet accept Cursor's sign-in callback, so
@@ -198,28 +198,34 @@ tools whatever the key allows. A project key, with or without it, keeps reaching
 With `--auth oauth` it is refused: a sign-in connection has **Read and write** access, so use a
 **Read** project key for read-only access.
 
-`--toolsets <names>` lists only the named tools, for clients with a tool-count limit or agents that
-only read production: `observe` (the production reads: projects, traces, spans and their recorded
-content, sessions, trace checks, intents and documentation), `all`, or the groups `project`, `traces`, `evals`, `environments`,
-`intents` and `docs`, comma-separated. A key configuration adds `?toolsets=<names>` to the URL. A
-sign-in configuration keeps the URL bare and sends the `X-Hue-MCP-Toolsets` header instead,
-because toolsets are not part of the connection's identity: Claude Code stores the header, and for
-Codex the command prints the `http_headers` line to add to `~/.codex/config.toml`, since
-`codex mcp add` stores none. `--toolsets` replaces a selection already in `--url`, and a selection in `--url` is kept without
-it; otherwise `cursor` selects `observe`. `--toolsets all` lists every tool. Unknown names are refused rather than passed on, because Hue
-ignores them and would list every tool. `get_project_context` is always listed and reports the
-selection.
+`--toolsets <names>` chooses the tools the connection lists: `all`, `observe` (the production
+reads: projects, traces, spans and their recorded content, sessions, trace checks, intents and
+documentation), or the groups `project`, `traces`, `evals`, `environments`, `intents` and `docs`,
+comma-separated. The selection is added to the URL as `?toolsets=<names>`, for a key or a sign-in
+configuration alike. Without `--toolsets`, `claude-code`, `codex` and `conductor` select `all`,
+because those agents defer MCP tools behind their own tool search; `cursor`, which caps the tools
+it loads, selects `observe`; the other clients list Hue's default. The default is the production
+reads plus `search_hue_tools`, which finds every other tool the connection can call, and
+`execute_hue_tool` and `execute_hue_write_tool`, which call one by name (the write executor only
+with write access), so nothing is out of reach. `--toolsets` replaces a selection already in
+`--url`, and a selection in `--url` is kept without it. Unknown names are refused rather than
+passed on, because Hue ignores them and would list its default. `get_project_context` is always
+listed and reports the selection.
 
 | Client | Key (`--auth key`) | Sign-in (`--auth oauth`) |
 | --- | --- | --- |
 | `claude-code` | Merges `mcpServers.hue` into `./.mcp.json`. `--scope user` runs `claude mcp add --transport http --scope user hue URL --header 'Authorization: Bearer ${HUE_MCP_KEY}'` when `claude` is on `PATH`, otherwise prints it. | Merges `mcpServers.hue` with only `type` and `url` into `./.mcp.json`; `--scope user` runs `claude mcp add --transport http --scope user hue URL`. Then run `/mcp` in Claude Code, select `hue` and choose **Authenticate**. |
-| `codex` | Runs `codex mcp add hue --url URL --bearer-token-env-var HUE_MCP_KEY`, or prints the `[mcp_servers.hue]` TOML block for `~/.codex/config.toml`. | Runs `codex mcp add hue --url URL`, which can start sign-in right away; `codex mcp login hue` starts or repeats it. |
+| `codex` | Runs `codex mcp add hue --url URL --bearer-token-env-var HUE_MCP_KEY`, or prints the `[mcp_servers.hue]` TOML block for `~/.codex/config.toml`. | Runs `codex mcp add hue --url URL`, which can start sign-in right away; `codex mcp login hue` starts or repeats it. The printed TOML block keeps its URL bare and sends the selection as the `X-Hue-MCP-Toolsets` header. |
 | `conductor` | Runs the Claude Code user-scope and Codex key commands above. | The default: runs `claude mcp add --transport http --scope user hue URL` and `codex mcp add hue --url URL`. Then use `hue`'s authentication action in Conductor's MCP status (the plug icon or `/mcp-status`). |
 | `cursor` | Merges `mcpServers.hue` into `./.cursor/mcp.json` with `${env:HUE_MCP_KEY}`. | Refused. |
 | `vscode` | Merges `servers.hue` and the `hue-mcp-key` password input into `./.vscode/mcp.json`. | Refused. |
 | `windsurf` | Prints the `serverUrl` snippet for `~/.codeium/windsurf/mcp_config.json`; nothing is written to the home directory. | Refused. |
 | `gemini` | Runs `gemini mcp add --scope user --transport http hue URL --header 'Authorization: Bearer ${HUE_MCP_KEY}'`, or prints it. | Refused. |
 
+Every Codex TOML block sets `supports_parallel_tool_calls = true`, so Codex runs Hue's independent
+calls in parallel rather than one at a time. `codex mcp add` has no option for it, so after
+registering with Codex the command names the line to add under `[mcp_servers.hue]`.
+
 Conductor has no MCP configuration of its own: its Claude Code and Codex agents read their user
 configuration in every workspace, so `conductor` registers the server at user scope with each CLI
 on `PATH` and prints the command for a CLI that is missing. A failing CLI does not stop the other;
@@ -406,7 +412,7 @@ node packages/sdk-typescript/scripts/verify-package.mjs --artifacts-dir .artifac
 # Set project to an existing supported fixture; use the same directory on resume.
 project=/absolute/path/to/supported-fixture
 node packages/sdk-typescript/scripts/verify-setup-live.mjs \
-  --archive .artifacts/typescript/hue-run-sdk-0.11.0.tgz \
+  --archive .artifacts/typescript/hue-run-sdk-0.11.1.tgz \
   --origin https://STAGING_ORIGIN \
   --project "$project" --command setup \
   --evidence .context/setup-staging-before-claim.json
@@ -417,7 +423,7 @@ the private local handoff and finish the real browser claim, then reconcile the
 
 ```sh
 node packages/sdk-typescript/scripts/verify-setup-live.mjs \
-  --archive .artifacts/typescript/hue-run-sdk-0.11.0.tgz \
+  --archive .artifacts/typescript/hue-run-sdk-0.11.1.tgz \
   --origin https://STAGING_ORIGIN \
   --project "$project" --command claim \
   --evidence .context/setup-staging-after-claim.json

package/dist/cli/mcp.d.ts

@@ -2,8 +2,8 @@
  * `hue mcp install`: writes or prints the coding-agent configuration for Hue's MCP server. The
  * shapes are those of Hue's published connection guide (https://docs.hue.run/agents/mcp-server),
  * kept as a separate copy here. Key configurations reference the `HUE_MCP_KEY` environment
- * variable (or a VS Code password input); sign-in configurations hold only the URL. A key value is
- * never written.
+ * variable (or a VS Code password input); sign-in configurations hold no credential. A key value
+ * is never written.
  */
 /** Streams, environment and working directory for {@link runMcpCommand}; tests inject these. */
 export interface McpCommandIo {
@@ -23,9 +23,12 @@ export declare const DEFAULT_MCP_URL = "https://mcp.hue.run/mcp";
 export declare const MCP_VERIFY_PROMPT = "Use the Hue MCP: call list_projects and confirm which project to inspect. Then call get_project_context and show that project's traces from the last 24 hours that need attention or have errors, with links; if there are none, show its 5 most recent traces. For an organization connection, pass the project's id as project_id on each call after list_projects.";
 /** Toolset names Hue's MCP server accepts: `all`, its catalog groups and the `observe` profile. */
 export declare const MCP_TOOLSETS: readonly ["all", "observe", "project", "traces", "evals", "environments", "intents", "docs"];
-/** The header that selects toolsets for a sign-in connection, whose URL must stay bare. */
+/**
+ * The header form of `?toolsets=`. Only the sign-in Codex TOML uses it, as Hue's guide does, to
+ * keep that URL bare; every other configuration carries the selection in its URL.
+ */
 export declare const TOOLSETS_HEADER = "X-Hue-MCP-Toolsets";
-export declare const MCP_USAGE = "Usage: hue mcp install --client <claude-code|codex|conductor|cursor|vscode|windsurf|gemini>\n                       [--auth key|oauth] [--read-only] [--toolsets NAMES] [--url URL]\n                       [--scope project|user] [--dry-run] [--print]\n\nConfigure a coding agent to use the Hue MCP server. A key configuration references the\nHUE_MCP_KEY environment variable; a key value is never written. A sign-in configuration holds\nonly the URL: the client opens Hue in a browser, where you approve access to the projects of\none organization.\n\nOptions:\n  --client NAME   Coding agent to configure (required)\n  --auth MODE     key: reference HUE_MCP_KEY (the default, except for conductor)\n                  oauth: URL only, sign in with Hue in the client (claude-code, codex and\n                  conductor; the default for conductor)\n  --read-only     key only: add ?read_only=true to the URL so write tools are hidden. A\n                  sign-in connection has Read and write access; use a Read key for read-only\n  --toolsets NAMES\n                  List only these tools, comma-separated: observe (production reads),\n                  all, project, traces, evals, environments, intents or docs. A key\n                  configuration adds ?toolsets= to the URL; a sign-in one sends the\n                  X-Hue-MCP-Toolsets header. cursor defaults to observe; others to all\n  --url URL       Hue MCP endpoint (default https://mcp.hue.run/mcp)\n  --scope SCOPE   claude-code only: project writes .mcp.json (default); user runs\n                  `claude mcp add --scope user`\n  --dry-run       Print the resulting file content or commands without writing or running\n  --print         Print the configuration snippet only\n  -h, --help      Show this help\n\nFiles: claude-code .mcp.json, cursor .cursor/mcp.json, vscode .vscode/mcp.json (relative to the\ncurrent directory). codex and gemini use their own CLI when it is on PATH; windsurf prints the\nsnippet for its user configuration file. conductor registers the server for its Claude Code\n(user scope) and Codex agents with their CLIs, printing the command for a CLI not on PATH.";
+export declare const MCP_USAGE = "Usage: hue mcp install --client <claude-code|codex|conductor|cursor|vscode|windsurf|gemini>\n                       [--auth key|oauth] [--read-only] [--toolsets NAMES] [--url URL]\n                       [--scope project|user] [--dry-run] [--print]\n\nConfigure a coding agent to use the Hue MCP server. A key configuration references the\nHUE_MCP_KEY environment variable; a key value is never written. A sign-in configuration holds\nonly the URL: the client opens Hue in a browser, where you approve access to the projects of\none organization.\n\nOptions:\n  --client NAME   Coding agent to configure (required)\n  --auth MODE     key: reference HUE_MCP_KEY (the default, except for conductor)\n                  oauth: URL only, sign in with Hue in the client (claude-code, codex and\n                  conductor; the default for conductor)\n  --read-only     key only: add ?read_only=true to the URL so write tools are hidden. A\n                  sign-in connection has Read and write access; use a Read key for read-only\n  --toolsets NAMES\n                  Tools to list, comma-separated: all, observe (production reads),\n                  project, traces, evals, environments, intents or docs, added to the\n                  URL as ?toolsets=. Defaults: all for claude-code, codex and conductor,\n                  which search their own tools; observe for cursor. Without a selection\n                  Hue lists the production reads and search_hue_tools, which reaches\n                  every other tool\n  --url URL       Hue MCP endpoint (default https://mcp.hue.run/mcp)\n  --scope SCOPE   claude-code only: project writes .mcp.json (default); user runs\n                  `claude mcp add --scope user`\n  --dry-run       Print the resulting file content or commands without writing or running\n  --print         Print the configuration snippet only\n  -h, --help      Show this help\n\nFiles: claude-code .mcp.json, cursor .cursor/mcp.json, vscode .vscode/mcp.json (relative to the\ncurrent directory). codex and gemini use their own CLI when it is on PATH; windsurf prints the\nsnippet for its user configuration file. conductor registers the server for its Claude Code\n(user scope) and Codex agents with their CLIs, printing the command for a CLI not on PATH.";
 /**
  * A URL as a POSIX shell word for printed commands: `?` is a zsh glob and `&` ends a command, so a
  * URL with a query (such as `?read_only=true`) is single-quoted. Executed commands pass argv.
@@ -87,16 +90,14 @@ export declare function renderMcpSnippets(url: string): {
     };
 };
 /**
- * Sign-in snippets: the bare server URL, which the client uses to discover Hue's OAuth metadata,
- * and, when toolsets are selected, the header that carries them.
+ * Sign-in snippets: the server URL and nothing secret. The client discovers Hue's OAuth metadata
+ * from it and sends it, query included, on every request; the token's resource ignores the query,
+ * so `?toolsets=` selects tools here as it does for a key.
  */
-export declare function renderMcpSignInSnippets(url: string, toolsets?: string): {
+export declare function renderMcpSignInSnippets(url: string): {
     claudeCodeServer: {
         type: string;
         url: string;
-        headers?: {
-            "X-Hue-MCP-Toolsets": string;
-        } | undefined;
     };
     claudeCodeProjectJson: string;
     claudeCodeCli: {
@@ -111,7 +112,7 @@ export declare function renderMcpSignInSnippets(url: string, toolsets?: string):
 };
 /**
  * Parses a comma-separated `--toolsets` value into Hue's canonical form, or returns an error.
- * Unknown names are refused: Hue ignores them and would list the whole catalog, hiding a typo.
+ * Unknown names are refused: Hue ignores them and would list its default, hiding a typo.
  */
 export declare function parseToolsets(value: string): {
     toolsets: string;
@@ -119,8 +120,8 @@ export declare function parseToolsets(value: string): {
     error: string;
 };
 /**
- * `?toolsets=` lists only the selected tools for a key configuration; commas stay readable.
- * Without a selection the parameter is removed, so the URL lists every tool.
+ * `?toolsets=` lists only the selected tools; commas stay readable. Without a selection the
+ * parameter is removed, so the connection lists Hue's default.
  */
 export declare function toolsetsMcpUrl(url: string, toolsets: string | undefined): string;
 /** `?read_only=true` hides and rejects Hue's write tools for any key. */

package/dist/cli/mcp.js

@@ -48,10 +48,26 @@ export const MCP_TOOLSETS = [
     "intents",
     "docs",
 ];
-/** The header that selects toolsets for a sign-in connection, whose URL must stay bare. */
+/**
+ * The header form of `?toolsets=`. Only the sign-in Codex TOML uses it, as Hue's guide does, to
+ * keep that URL bare; every other configuration carries the selection in its URL.
+ */
 export const TOOLSETS_HEADER = "X-Hue-MCP-Toolsets";
-/** Clients whose configuration selects a toolset unless `--toolsets` says otherwise. */
-const DEFAULT_TOOLSETS = { cursor: "observe" };
+/**
+ * Toolsets a client's configuration selects unless `--toolsets` says otherwise. Claude Code,
+ * Codex and Conductor's agents defer MCP tools behind their own tool search, so listing every tool
+ * costs them little. Cursor caps the tools it loads, so it names the production reads. The other
+ * clients list Hue's default: the production reads, and `search_hue_tools` with its executors,
+ * which reach every other tool.
+ */
+const DEFAULT_TOOLSETS = {
+    "claude-code": "all",
+    codex: "all",
+    conductor: "all",
+    cursor: "observe",
+};
+/** Codex runs a server's tool calls one at a time without it; each Hue call is independent. */
+const CODEX_PARALLEL = "supports_parallel_tool_calls = true";
 export const MCP_USAGE = `Usage: hue mcp install --client <claude-code|codex|conductor|cursor|vscode|windsurf|gemini>
                        [--auth key|oauth] [--read-only] [--toolsets NAMES] [--url URL]
                        [--scope project|user] [--dry-run] [--print]
@@ -69,10 +85,12 @@ Options:
   --read-only     key only: add ?read_only=true to the URL so write tools are hidden. A
                   sign-in connection has Read and write access; use a Read key for read-only
   --toolsets NAMES
-                  List only these tools, comma-separated: observe (production reads),
-                  all, project, traces, evals, environments, intents or docs. A key
-                  configuration adds ?toolsets= to the URL; a sign-in one sends the
-                  ${TOOLSETS_HEADER} header. cursor defaults to observe; others to all
+                  Tools to list, comma-separated: all, observe (production reads),
+                  project, traces, evals, environments, intents or docs, added to the
+                  URL as ?toolsets=. Defaults: all for claude-code, codex and conductor,
+                  which search their own tools; observe for cursor. Without a selection
+                  Hue lists the production reads and search_hue_tools, which reaches
+                  every other tool
   --url URL       Hue MCP endpoint (default ${DEFAULT_MCP_URL})
   --scope SCOPE   claude-code only: project writes .mcp.json (default); user runs
                   \`claude mcp add --scope user\`
@@ -143,7 +161,7 @@ export function renderMcpSnippets(url) {
             args: ["mcp", "add", SERVER_NAME, "--url", url, "--bearer-token-env-var", ENV_VAR],
             display: `codex mcp add ${SERVER_NAME} --url ${shellWord(url)} --bearer-token-env-var ${ENV_VAR}`,
         },
-        codexToml: `[mcp_servers.${SERVER_NAME}]\nurl = "${url}"\nbearer_token_env_var = "${ENV_VAR}"\n`,
+        codexToml: `[mcp_servers.${SERVER_NAME}]\nurl = "${url}"\nbearer_token_env_var = "${ENV_VAR}"\n${CODEX_PARALLEL}\n`,
         vscodeServer,
         vscodeInput,
         vscodeJson: json({ servers: { [SERVER_NAME]: vscodeServer }, inputs: [vscodeInput] }),
@@ -169,41 +187,31 @@ export function renderMcpSnippets(url) {
     };
 }
 /**
- * Sign-in snippets: the bare server URL, which the client uses to discover Hue's OAuth metadata,
- * and, when toolsets are selected, the header that carries them.
+ * Sign-in snippets: the server URL and nothing secret. The client discovers Hue's OAuth metadata
+ * from it and sends it, query included, on every request; the token's resource ignores the query,
+ * so `?toolsets=` selects tools here as it does for a key.
  */
-export function renderMcpSignInSnippets(url, toolsets) {
-    const headers = toolsets ? { [TOOLSETS_HEADER]: toolsets } : undefined;
-    const claudeCodeServer = { type: "http", url, ...(headers ? { headers } : {}) };
-    const headerArgs = toolsets ? ["--header", `${TOOLSETS_HEADER}: ${toolsets}`] : [];
+export function renderMcpSignInSnippets(url) {
+    const toolsets = new URL(url).searchParams.get("toolsets");
+    const claudeCodeServer = { type: "http", url };
     return {
         claudeCodeServer,
         claudeCodeProjectJson: json({ mcpServers: { [SERVER_NAME]: claudeCodeServer } }),
         claudeCodeCli: {
-            args: [
-                "mcp",
-                "add",
-                "--transport",
-                "http",
-                "--scope",
-                "user",
-                SERVER_NAME,
-                url,
-                ...headerArgs,
-            ],
-            display: `claude mcp add --transport http --scope user ${SERVER_NAME} ${shellWord(url)}${toolsets ? ` --header '${TOOLSETS_HEADER}: ${toolsets}'` : ""}`,
+            args: ["mcp", "add", "--transport", "http", "--scope", "user", SERVER_NAME, url],
+            display: `claude mcp add --transport http --scope user ${SERVER_NAME} ${shellWord(url)}`,
         },
-        // `codex mcp add` cannot store a header; the TOML carries it and the next steps say so.
         codexCli: {
             args: ["mcp", "add", SERVER_NAME, "--url", url],
             display: `codex mcp add ${SERVER_NAME} --url ${shellWord(url)}`,
         },
-        codexToml: `[mcp_servers.${SERVER_NAME}]\nurl = "${url}"\n${toolsets ? `http_headers = { "${TOOLSETS_HEADER}" = "${toolsets}" }\n` : ""}`,
+        // The header form of the same selection, for a TOML entry that keeps its URL bare.
+        codexToml: `[mcp_servers.${SERVER_NAME}]\nurl = "${toolsetsMcpUrl(url, undefined)}"\n${toolsets ? `http_headers = { "${TOOLSETS_HEADER}" = "${toolsets}" }\n` : ""}${CODEX_PARALLEL}\n`,
     };
 }
 /**
  * Parses a comma-separated `--toolsets` value into Hue's canonical form, or returns an error.
- * Unknown names are refused: Hue ignores them and would list the whole catalog, hiding a typo.
+ * Unknown names are refused: Hue ignores them and would list its default, hiding a typo.
  */
 export function parseToolsets(value) {
     const names = [...new Set(value.split(",").map((name) => name.trim()))];
@@ -217,8 +225,8 @@ export function parseToolsets(value) {
     return { toolsets: names.join(",") };
 }
 /**
- * `?toolsets=` lists only the selected tools for a key configuration; commas stay readable.
- * Without a selection the parameter is removed, so the URL lists every tool.
+ * `?toolsets=` lists only the selected tools; commas stay readable. Without a selection the
+ * parameter is removed, so the connection lists Hue's default.
  */
 export function toolsetsMcpUrl(url, toolsets) {
     const parsed = new URL(url);
@@ -405,10 +413,10 @@ function displayPath(cwd, path) {
 }
 const notOnPath = (executable, label) => `${executable} is not on PATH. Run this where ${label} is installed:`;
 /** `auth: "oauth"` is only planned for {@link OAUTH_CLIENTS}; the caller refuses the others. */
-function planFor(client, auth, scope, url, toolsets) {
+function planFor(client, auth, scope, url) {
     const snippets = renderMcpSnippets(url);
     // Claude Code and Codex take the same plan shape with or without a key.
-    const shared = auth === "oauth" ? renderMcpSignInSnippets(url, toolsets) : snippets;
+    const shared = auth === "oauth" ? renderMcpSignInSnippets(url) : snippets;
     const claudeUser = {
         executable: "claude",
         label: "Claude Code",
@@ -479,7 +487,7 @@ function planFor(client, auth, scope, url, toolsets) {
         }
     }
 }
-function nextSteps(client, auth, toolsets) {
+function nextSteps(client, auth) {
     const label = CLIENT_LABELS[client];
     const approve = "Sign in to Hue and approve the connection. It can read and write every active project in the organization you choose, within your role; for read-only access, use a Read project key with --auth key.";
     let lines;
@@ -510,9 +518,9 @@ function nextSteps(client, auth, toolsets) {
             "  set -a; . ./.env.hue; set +a",
             `An app started from the Dock or a launcher does not see that shell's variables; start ${label} from the shell${OAUTH_CLIENTS.includes(client) ? ", or sign in instead with --auth oauth" : ""}.`,
         ];
-    // `codex mcp add` stores no headers, so a sign-in toolset selection is added by hand.
-    if (auth === "oauth" && toolsets && (client === "codex" || client === "conductor"))
-        lines.push(`To list only the ${toolsets} tools in Codex, add this line under [mcp_servers.${SERVER_NAME}] in ~/.codex/config.toml:`, `  http_headers = { "${TOOLSETS_HEADER}" = "${toolsets}" }`);
+    // `codex mcp add` has no option for it, so a registered server gets the line by hand.
+    if (client === "codex" || client === "conductor")
+        lines.push(`If codex mcp add registered ${SERVER_NAME}, add this line under [mcp_servers.${SERVER_NAME}] in ~/.codex/config.toml so Codex runs Hue's tool calls in parallel:`, `  ${CODEX_PARALLEL}`);
     return [...lines, "Then ask your agent:", `  ${MCP_VERIFY_PROMPT}`];
 }
 /**
@@ -570,11 +578,8 @@ export async function runMcpCommand(argv, io = {}) {
         return fail("A sign-in connection has Read and write access and cannot be made read-only by its URL. For read-only access, use a Read project key (--auth key), or add --read-only to a key configuration.", 2);
     if (parsed.values["read-only"])
         url = readOnlyMcpUrl(url);
-    // Toolsets are not part of the protected resource either: a sign-in URL stays bare.
-    if (auth === "oauth" && new URL(url).searchParams.has("toolsets"))
-        return fail("Leave toolsets off a sign-in URL; --toolsets sends them in a header instead.", 2);
     // --toolsets wins over a selection already in --url, which wins over the client's default.
-    // Both sources are validated: Hue ignores an unknown name and would list every tool.
+    // Both sources are validated: Hue ignores an unknown name and would list its default.
     const requested = parsed.values.toolsets ?? new URL(url).searchParams.get("toolsets");
     let toolsets = DEFAULT_TOOLSETS[clientId];
     if (requested !== null) {
@@ -583,17 +588,13 @@ export async function runMcpCommand(argv, io = {}) {
             return fail(`${parsed.values.toolsets === undefined ? "In --url: " : ""}${selected.error}\n\n${MCP_USAGE}`, 2);
         toolsets = selected.toolsets;
     }
-    // `all` is Hue's default, so it needs no selection.
-    if (toolsets === "all")
-        toolsets = undefined;
-    if (auth === "key")
-        url = toolsetsMcpUrl(url, toolsets);
-    const plan = planFor(clientId, auth, scope, url, auth === "oauth" ? toolsets : undefined);
+    url = toolsetsMcpUrl(url, toolsets);
+    const plan = planFor(clientId, auth, scope, url);
     if (parsed.values.print) {
         stdout.write(plan.snippet);
         return 0;
     }
-    const steps = nextSteps(clientId, auth, toolsets);
+    const steps = nextSteps(clientId, auth);
     if (plan.kind === "manual") {
         out(plan.hint);
         stdout.write(plan.snippet);

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** Package version shared by the instrumentation scope and the export User-Agent. */
-export declare const sdkVersion = "0.11.0";
+export declare const sdkVersion = "0.11.1";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Generated by scripts/write-version.mjs from package.json; do not edit by hand.
 /** Package version shared by the instrumentation scope and the export User-Agent. */
-export const sdkVersion = "0.11.0";
+export const sdkVersion = "0.11.1";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hue-run/sdk",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "private": false,
   "license": "MIT",
   "publishConfig": {