@kwonye/mcpx 0.1.100 → 0.1.101

package/dist/cli.js

@@ -4,15 +4,19 @@ import {
   applyAuthReference,
   buildStatusReport,
   checkForUpdates,
+  clearOAuthCredentials,
   defaultAuthSecretName,
   extractRequiredInputs,
   fetchRegistryServerDetail,
   getDaemonStatus,
+  getOAuthCredentialStatus,
   getStagedCliPath,
   getStagedUpdate,
+  isOAuthReference,
   listAuthBindings,
   mapRegistryToSpec,
   maybePrefixBearer,
+  oauthReferenceServerName,
   performRollback,
   performUpdate,
   probeHttpAuthRequirement,
@@ -29,8 +33,8 @@ import {
   startDaemon,
   stopDaemon,
   toSecretRef
-} from "./cli-etmrz2c4.js";
-import"./cli-ct7asw78.js";
+} from "./cli-qzzjkt0q.js";
+import"./cli-aawpvhhe.js";
 import {
   APP_VERSION,
   deleteSkill,
@@ -45,14 +49,14 @@ import {
   persistSyncState,
   saveSkill,
   syncAllClients
-} from "./cli-b0xrqsjc.js";
+} from "./cli-9k3wmag6.js";
 import {
   ConfigLoadError,
   loadConfig,
   loadMergedConfig,
   loadProjectConfig,
   resolveActiveConfig
-} from "./cli-dy7x0zrg.js";
+} from "./cli-6zq2fd6h.js";
 import {
   SecretsManager,
   addServer,
@@ -62,12 +66,12 @@ import {
   removeServer,
   rotateGatewayToken,
   setServerEnabled
-} from "./cli-1ewrsfj4.js";
+} from "./cli-hh7rthhx.js";
 import {
   getConfigPath,
   getManagedIndexPath,
   getSecretsStorePath
-} from "./cli-28g7x9rn.js";
+} from "./cli-6wh8qx2y.js";
 import {
   __require,
   isServerEnabled
@@ -77,7 +81,7 @@ import {
 import { Command } from "commander";
 import fs from "node:fs";
 import path from "node:path";
-import { execFileSync } from "node:child_process";
+import { execFileSync, spawn } from "node:child_process";
 import { pathToFileURL } from "node:url";
 import { emitKeypressEvents } from "node:readline";
 import { createInterface } from "node:readline/promises";
@@ -1195,7 +1199,13 @@ function parseAddServerSpec(values, options) {
     throw new Error("Usage: mcpx add [--transport auto|http|stdio] <name> <url|command> [args...]");
   }
   const name = values[0] ?? "";
+  if (!name.trim()) {
+    throw new Error("Server name must be non-empty.");
+  }
   const target = values[1] ?? "";
+  if (!target.trim()) {
+    throw new Error("Server target (URL or command) must be non-empty.");
+  }
   const trailing = values.slice(2);
   const requestedTransport = normalizeTransport(options.transport);
   const transport = requestedTransport === "auto" ? isHttpUrl(target) && trailing.length === 0 ? "http" : "stdio" : requestedTransport;
@@ -1229,6 +1239,9 @@ function parseAddServerSpec(values, options) {
     const [key, value] = parseEnvVar(item);
     env[key] = value;
   }
+  if (options.cwd !== undefined && options.cwd !== null && !options.cwd.trim()) {
+    throw new Error("--cwd must be non-empty when provided.");
+  }
   const spec = {
     transport: "stdio",
     command: target,
@@ -1249,6 +1262,9 @@ function redactAuthValue(value) {
   if (value.startsWith("secret://")) {
     return value;
   }
+  if (isOAuthReference(value)) {
+    return value;
+  }
   return "<inline>";
 }
 function parseClientList(values) {
@@ -1348,15 +1364,15 @@ function isNegativeChoice(value) {
 }
 async function maybeAutoConfigureAuthForAddedServer(serverName, spec, secrets) {
   if (spec.transport === "http") {
-    await maybeConfigureHttpAuth(serverName, spec, secrets);
-  } else {
-    await maybeConfigureStdioAuth(serverName, spec, secrets);
+    return maybeConfigureHttpAuth(serverName, spec, secrets);
   }
+  await maybeConfigureStdioAuth(serverName, spec, secrets);
+  return { deferredOAuthLogin: false };
 }
 async function maybeConfigureHttpAuth(serverName, spec, secrets) {
   const probe = await probeHttpAuthRequirement(spec, secrets);
   if (!probe.authRequired) {
-    return;
+    return { deferredOAuthLogin: false };
   }
   process.stdout.write(`Upstream "${serverName}" responded with ${probe.status ?? 401} and appears to require auth.
 `);
@@ -1367,31 +1383,46 @@ async function maybeConfigureHttpAuth(serverName, spec, secrets) {
   if (!process.stdin.isTTY || !process.stdout.isTTY) {
     process.stdout.write(`Run \`mcpx auth set ${serverName} --header Authorization --value "<token>"\` to configure auth.
 `);
-    return;
+    if (probe.oauthSupport === "supported") {
+      process.stdout.write(`This server supports OAuth -- run \`mcpx auth login ${serverName}\` to sign in with your browser instead.
+`);
+    }
+    return { deferredOAuthLogin: false };
   }
   const rl = createInterface({
     input: process.stdin,
     output: process.stdout
   });
   try {
-    const shouldConfigure = await promptLine(rl, "Configure auth now? (Y/n): ");
-    if (isNegativeChoice(shouldConfigure)) {
-      process.stdout.write(`Skipping auth setup.
+    if (probe.oauthSupport === "supported") {
+      process.stdout.write(`This server supports OAuth.
 `);
-      return;
+      const useOAuth = await promptLine(rl, "Sign in with browser? (Y/n): ");
+      if (!isNegativeChoice(useOAuth)) {
+        process.stdout.write(`Will sign in with your browser once "${serverName}" is added.
+`);
+        return { deferredOAuthLogin: true };
+      }
+    } else {
+      const shouldConfigure = await promptLine(rl, "Configure auth now? (Y/n): ");
+      if (isNegativeChoice(shouldConfigure)) {
+        process.stdout.write(`Skipping auth setup.
+`);
+        return { deferredOAuthLogin: false };
+      }
     }
     const currentHeaderBinding = listAuthBindings(spec).find((binding) => binding.kind === "header");
     const headerName = await promptLineWithDefault(rl, "Header name", currentHeaderBinding?.key ?? "Authorization");
     if (!headerName) {
       process.stdout.write(`Skipping auth setup (empty header name).
 `);
-      return;
+      return { deferredOAuthLogin: false };
     }
     const authValueInput = await promptLine(rl, "Auth value/token (blank to skip): ");
     if (!authValueInput) {
       process.stdout.write(`Skipping auth setup.
 `);
-      return;
+      return { deferredOAuthLogin: false };
     }
     const target = resolveAuthTarget(spec, headerName, undefined);
     const authValue = maybePrefixBearer(target, authValueInput, false);
@@ -1401,7 +1432,7 @@ async function maybeConfigureHttpAuth(serverName, spec, secrets) {
     if (!secretName) {
       process.stdout.write(`Skipping auth setup (empty secret name).
 `);
-      return;
+      return { deferredOAuthLogin: false };
     }
     secrets.setSecret(secretName, authValue);
     applyAuthReference(spec, target, toSecretRef(secretName));
@@ -1410,7 +1441,7 @@ async function maybeConfigureHttpAuth(serverName, spec, secrets) {
   } catch (error) {
     process.stdout.write(`Auto auth setup skipped: ${error.message}
 `);
-    return;
+    return { deferredOAuthLogin: false };
   } finally {
     rl.close();
   }
@@ -1423,6 +1454,43 @@ async function maybeConfigureHttpAuth(serverName, spec, secrets) {
 `);
   } else {
     process.stdout.write(`Auth check passed.
+`);
+  }
+  return { deferredOAuthLogin: false };
+}
+async function performOAuthLogout(serverName, spec, secrets) {
+  const removedSecrets = clearOAuthCredentials(serverName, secrets);
+  let removedBinding = null;
+  if (spec.transport === "http" && spec.headers?.Authorization && isOAuthReference(spec.headers.Authorization) && oauthReferenceServerName(spec.headers.Authorization) === serverName) {
+    await mutateConfig((freshConfig) => {
+      const freshSpec = getServerSpecOrThrow(freshConfig, serverName);
+      removeAuthReference(freshSpec, { kind: "header", key: "Authorization" });
+    });
+    removedBinding = "Authorization";
+  }
+  let sync;
+  if (removedBinding) {
+    const syncSourceConfig = loadConfig();
+    sync = syncAllClients(syncSourceConfig, secrets);
+    await mutateConfig((freshConfig) => {
+      persistSyncState(sync, freshConfig);
+    });
+  }
+  return { removedSecrets, removedBinding, sync };
+}
+async function runDeferredOAuthLogin(serverName, spec, secrets, configPath) {
+  try {
+    await runOAuthLogin(serverName, spec, secrets, (url) => {
+      process.stdout.write(`Opening browser to sign in to "${serverName}"...
+`);
+      openInBrowser(url);
+    }, configPath);
+    process.stdout.write(`OAuth login complete for "${serverName}".
+`);
+  } catch (error) {
+    process.stdout.write(`OAuth sign-in failed: ${error instanceof Error ? error.message : String(error)}
+`);
+    process.stdout.write(`Run \`mcpx auth login ${serverName}\` to try again.
 `);
   }
 }
@@ -1444,9 +1512,9 @@ async function maybeConfigureStdioAuth(serverName, spec, secrets) {
     output: process.stdout
   });
   try {
-    const shouldMigrate = await promptLine(rl, "Store them in the system keychain instead? (Y/n): ");
+    const shouldMigrate = await promptLine(rl, "Store them in the encrypted secret store instead? (Y/n): ");
     if (isNegativeChoice(shouldMigrate)) {
-      process.stdout.write(`Skipping keychain migration.
+      process.stdout.write(`Skipping secret migration.
 `);
       return;
     }
@@ -1459,7 +1527,7 @@ async function maybeConfigureStdioAuth(serverName, spec, secrets) {
 `);
     }
   } catch (error) {
-    process.stdout.write(`Keychain migration skipped: ${error.message}
+    process.stdout.write(`Secret migration skipped: ${error.message}
 `);
   } finally {
     rl.close();
@@ -1803,7 +1871,7 @@ async function clearServerAuthInteractively(rl, serverName) {
   }
   let shouldDeleteSecret = false;
   if (selected.secretName) {
-    const shouldDelete = (await promptLine(rl, `Delete keychain secret "${selected.secretName}" too? (y/N): `)).toLowerCase();
+    const shouldDelete = (await promptLine(rl, `Delete stored secret "${selected.secretName}" too? (y/N): `)).toLowerCase();
     shouldDeleteSecret = shouldDelete === "y" || shouldDelete === "yes";
   }
   const removed = await mutateConfig((freshConfig) => {
@@ -1830,6 +1898,38 @@ async function clearServerAuthInteractively(rl, serverName) {
 `);
   }
 }
+async function signInWithBrowserInteractively(serverName) {
+  const config = loadConfig();
+  const spec = getServerSpecOrThrow(config, serverName);
+  if (spec.transport !== "http") {
+    process.stdout.write(`OAuth login only supports HTTP servers.
+`);
+    return;
+  }
+  const secrets = new SecretsManager;
+  await runOAuthLogin(serverName, spec, secrets, (url) => {
+    process.stdout.write(`Opening browser to sign in to "${serverName}"...
+`);
+    openInBrowser(url);
+  });
+  process.stdout.write(`OAuth login complete for "${serverName}".
+`);
+}
+async function signOutInteractively(rl, serverName) {
+  const confirmation = await promptLine(rl, `Sign out of "${serverName}"? (y/N): `);
+  if (!["y", "yes"].includes(confirmation.trim().toLowerCase())) {
+    process.stdout.write(`Cancelled.
+`);
+    return;
+  }
+  const config = loadConfig();
+  const spec = getServerSpecOrThrow(config, serverName);
+  const secrets = new SecretsManager;
+  const { removedSecrets, removedBinding } = await performOAuthLogout(serverName, spec, secrets);
+  const bindingNote = removedBinding ? ` and the ${removedBinding} binding` : "";
+  process.stdout.write(`Signed out of "${serverName}". Removed ${removedSecrets.length} stored credential${removedSecrets.length === 1 ? "" : "s"}${bindingNote}.
+`);
+}
 async function reconnectGatewayAndSync(cliPath) {
   const config = loadConfig();
   const secrets = new SecretsManager;
@@ -1930,31 +2030,55 @@ async function runServerActionsMenu(rl, serverName, cliPath) {
 `);
       return;
     }
-    const action = await promptMenuSelection(rl, buildServerActionTitle(server), [
-      { label: "\uD83D\uDD10 Configure auth", detail: "Set or update auth binding for this MCP." },
-      { label: "♻️ Re-authenticate", detail: "Replace token for an existing auth binding." },
-      { label: "\uD83E\uDDF9 Clear authentication", detail: "Remove a specific auth binding." },
-      { label: server.enabled ? "⏸️ Disable" : "▶️ Enable", detail: "Toggle this MCP across mcpx and all synced clients." },
-      { label: "\uD83D\uDD04 Reconnect", detail: "Restart daemon and sync all managed client entries." },
-      { label: "← Back", detail: "Return to MCP list." }
-    ], "q");
-    if (action === null || action === 5) {
+    const isOAuthBound = server.authBindings.some((binding) => binding.kind === "header" && binding.key === "Authorization" && isOAuthReference(binding.value));
+    const actions = [
+      {
+        label: "\uD83D\uDD10 Configure auth",
+        detail: "Set or update auth binding for this MCP.",
+        run: () => configureServerAuthInteractively(rl, serverName, false)
+      }
+    ];
+    if (server.transport === "http" && !isOAuthBound) {
+      actions.push({
+        label: "\uD83C\uDF10 Sign in with browser",
+        detail: "Run OAuth login for this MCP.",
+        run: () => signInWithBrowserInteractively(serverName)
+      });
+    }
+    actions.push({
+      label: "♻️ Re-authenticate",
+      detail: "Replace token for an existing auth binding.",
+      run: () => configureServerAuthInteractively(rl, serverName, true)
+    });
+    if (isOAuthBound) {
+      actions.push({
+        label: "\uD83D\uDEAA Sign out",
+        detail: "Clear stored OAuth credentials for this MCP.",
+        run: () => signOutInteractively(rl, serverName)
+      });
+    }
+    actions.push({
+      label: "\uD83E\uDDF9 Clear authentication",
+      detail: "Remove a specific auth binding.",
+      run: () => clearServerAuthInteractively(rl, serverName)
+    }, {
+      label: server.enabled ? "⏸️ Disable" : "▶️ Enable",
+      detail: "Toggle this MCP across mcpx and all synced clients.",
+      run: () => setServerEnabledInteractively(rl, serverName, !server.enabled, cliPath)
+    }, {
+      label: "\uD83D\uDD04 Reconnect",
+      detail: "Restart daemon and sync all managed client entries.",
+      run: () => reconnectGatewayAndSync(cliPath)
+    });
+    const backIndex = actions.length;
+    const selection = await promptMenuSelection(rl, buildServerActionTitle(server), [...actions.map(({ label, detail }) => ({ label, detail })), { label: "← Back", detail: "Return to MCP list." }], "q");
+    if (selection === null || selection === backIndex) {
       return;
     }
     try {
-      if (action === 0) {
-        await configureServerAuthInteractively(rl, serverName, false);
-      } else if (action === 1) {
-        await configureServerAuthInteractively(rl, serverName, true);
-      } else if (action === 2) {
-        await clearServerAuthInteractively(rl, serverName);
-      } else if (action === 3) {
-        const updated = await setServerEnabledInteractively(rl, serverName, !server.enabled, cliPath);
-        if (updated) {
-          return;
-        }
-      } else if (action === 4) {
-        await reconnectGatewayAndSync(cliPath);
+      const shouldClose = await actions[selection].run();
+      if (shouldClose === true) {
+        return;
       }
     } catch (error) {
       process.stdout.write(`${error.message}
@@ -2079,8 +2203,8 @@ Value: ` : `${input.name} (${input.kind}): `;
           spec.env = Object.keys(env).length > 0 ? env : undefined;
         }
       }
-      await maybeAutoConfigureAuthForAddedServer(shortName, spec, secrets);
-      const { type, projectPath } = await mutateActiveConfig({ global: options.global, local: options.local }, (config) => {
+      const authSetup = await maybeAutoConfigureAuthForAddedServer(shortName, spec, secrets);
+      const { type, projectPath, configPath } = await mutateActiveConfig({ global: options.global, local: options.local }, (config) => {
         addServer(config, shortName, spec, options.force ?? false);
       });
       if (type === "project" && projectPath) {
@@ -2090,10 +2214,13 @@ Value: ` : `${input.name} (${input.kind}): `;
       }
       process.stdout.write(`Added server: ${shortName} (${spec.transport}) from registry "${registryName}"${type === "project" ? ` (project: ${projectPath})` : ""}
 `);
+      if (authSetup.deferredOAuthLogin && spec.transport === "http") {
+        await runDeferredOAuthLogin(shortName, spec, secrets, configPath);
+      }
     } else {
       const parsed = parseAddServerSpec(safeValues, options);
-      await maybeAutoConfigureAuthForAddedServer(parsed.name, parsed.spec, secrets);
-      const { type, projectPath } = await mutateActiveConfig({ global: options.global, local: options.local }, (config) => {
+      const authSetup = await maybeAutoConfigureAuthForAddedServer(parsed.name, parsed.spec, secrets);
+      const { type, projectPath, configPath } = await mutateActiveConfig({ global: options.global, local: options.local }, (config) => {
         addServer(config, parsed.name, parsed.spec, options.force ?? false);
       });
       if (type === "project" && projectPath) {
@@ -2103,6 +2230,9 @@ Value: ` : `${input.name} (${input.kind}): `;
       }
       process.stdout.write(`Added server: ${parsed.name} (${parsed.spec.transport})${type === "project" ? ` (project: ${projectPath})` : ""}
 `);
+      if (authSetup.deferredOAuthLogin && parsed.spec.transport === "http") {
+        await runDeferredOAuthLogin(parsed.name, parsed.spec, secrets, configPath);
+      }
     }
     process.stdout.write(`Auto-syncing managed gateway entries across all supported clients...
 `);
@@ -2114,6 +2244,9 @@ function registerRemoveCommand(parent, cliPath) {
     const { type, projectPath } = await mutateActiveConfig({ global: options.global, local: options.local }, (config) => {
       removeServer(config, name, options.force ?? false);
     });
+    if (type === "global") {
+      clearOAuthCredentials(name, new SecretsManager);
+    }
     process.stdout.write(`Removed server: ${name} ${type === "project" ? `from project: ${projectPath}` : "globally"}
 `);
     process.stdout.write(`Auto-syncing managed gateway entries across all supported clients...
@@ -2321,14 +2454,14 @@ function registerDaemonCommands(program) {
   });
 }
 function registerSecretsCommands(program) {
-  const secret = program.command("secret").description("Manage keychain-backed secrets");
-  secret.command("set <name>").option("--value <value>", "Secret value").description("Set secret in OS keychain").action((name, options) => {
+  const secret = program.command("secret").description("Manage encrypted secrets");
+  secret.command("set <name>").option("--value <value>", "Secret value").description("Set an encrypted secret").action((name, options) => {
     const value = options.value ?? readSecretValueFromStdin();
     new SecretsManager().setSecret(name, value);
     process.stdout.write(`Secret set: ${name}
 `);
   });
-  secret.command("rm <name>").description("Remove secret from OS keychain").action((name) => {
+  secret.command("rm <name>").description("Remove an encrypted secret").action((name) => {
     new SecretsManager().removeSecret(name);
     process.stdout.write(`Secret removed: ${name}
 `);
@@ -2346,6 +2479,21 @@ function registerSecretsCommands(program) {
     }
   });
 }
+function openInBrowser(url) {
+  const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  const printFallback = () => {
+    process.stdout.write(`Could not open a browser automatically. Open this URL to continue:
+${url}
+`);
+  };
+  try {
+    const child = spawn(command, args, { detached: true, stdio: "ignore" });
+    child.on("error", printFallback);
+    child.unref();
+  } catch {
+    printFallback();
+  }
+}
 function registerAuthCommands(program) {
   const auth = program.command("auth").description("Auth utilities");
   auth.command("login <server>").description("Run browser OAuth login for an HTTP upstream server").action(async (server) => {
@@ -2356,20 +2504,49 @@ function registerAuthCommands(program) {
     }
     const secrets = new SecretsManager;
     await runOAuthLogin(server, spec, secrets, (url) => {
-      if (process.platform === "darwin") {
-        execFileSync("open", [url], { stdio: "ignore" });
-        return;
-      }
-      if (process.platform === "win32") {
-        execFileSync("cmd", ["/c", "start", "", url], { stdio: "ignore" });
-        return;
-      }
-      execFileSync("xdg-open", [url], { stdio: "ignore" });
+      process.stdout.write(`Opening browser to sign in to "${server}"...
+`);
+      openInBrowser(url);
     });
     process.stdout.write(`OAuth login complete for "${server}".
 `);
   });
-  auth.command("set <server>").option("--header <name>", "HTTP header name (default for HTTP servers: Authorization)").option("--env <name>", "Env var name (required for stdio servers)").option("--value <value>", "Auth value/token (if omitted, read from stdin)").option("--secret-name <name>", "Override keychain secret name").option("--raw", "Do not auto-prefix Authorization values with Bearer").description("Store auth in keychain and bind it to an upstream server").action(async (server, options) => {
+  auth.command("logout <server>").option("-y, --yes", "Skip confirmation prompt").option("--json", "Output JSON").description("Sign out of OAuth for a server and clear stored credentials").action(async (server, options) => {
+    const config = loadConfig();
+    const spec = getServerSpecOrThrow(config, server);
+    if (!options.yes) {
+      if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        throw new Error("Sign-out requires --yes in non-interactive mode.");
+      }
+      const rl = createInterface({ input: process.stdin, output: process.stdout });
+      try {
+        const answer = await promptLine(rl, `Sign out of "${server}"? (y/N): `);
+        if (!["y", "yes"].includes(answer.trim().toLowerCase())) {
+          return;
+        }
+      } finally {
+        rl.close();
+      }
+    }
+    const secrets = new SecretsManager;
+    const { removedSecrets, removedBinding, sync } = await performOAuthLogout(server, spec, secrets);
+    if (options.json) {
+      process.stdout.write(`${JSON.stringify({ server, removedSecrets, removedBinding, sync }, null, 2)}
+`);
+      return;
+    }
+    if (removedSecrets.length === 0 && !removedBinding) {
+      process.stdout.write(`"${server}" was not signed in with OAuth. Nothing to do.
+`);
+      return;
+    }
+    const bindingNote = removedBinding ? ` and the ${removedBinding} binding` : "";
+    process.stdout.write(`Signed out of "${server}". Removed ${removedSecrets.length} stored credential${removedSecrets.length === 1 ? "" : "s"}${bindingNote}.
+`);
+    process.stdout.write(`Re-run \`mcpx auth login ${server}\` to sign back in.
+`);
+  });
+  auth.command("set <server>").option("--header <name>", "HTTP header name (default for HTTP servers: Authorization)").option("--env <name>", "Env var name (required for stdio servers)").option("--value <value>", "Auth value/token (if omitted, read from stdin)").option("--secret-name <name>", "Override stored secret name").option("--raw", "Do not auto-prefix Authorization values with Bearer").description("Store auth as an encrypted secret and bind it to an upstream server").action(async (server, options) => {
     const config = loadConfig();
     const spec = getServerSpecOrThrow(config, server);
     const target = resolveAuthTarget(spec, options.header, options.env);
@@ -2387,7 +2564,7 @@ function registerAuthCommands(program) {
     process.stdout.write(`Stored secret: ${secretName}
 `);
   });
-  auth.command("rm <server>").option("--header <name>", "HTTP header name (default for HTTP servers: Authorization)").option("--env <name>", "Env var name (required for stdio servers)").option("--delete-secret", "Delete referenced keychain secret when removing binding").description("Remove auth binding from an upstream server").action(async (server, options) => {
+  auth.command("rm <server>").option("--header <name>", "HTTP header name (default for HTTP servers: Authorization)").option("--env <name>", "Env var name (required for stdio servers)").option("--delete-secret", "Delete the referenced stored secret when removing binding").description("Remove auth binding from an upstream server").action(async (server, options) => {
     const config = loadConfig();
     const spec = getServerSpecOrThrow(config, server);
     const target = resolveAuthTarget(spec, options.header, options.env);
@@ -2405,9 +2582,15 @@ function registerAuthCommands(program) {
       if (secretName) {
         new SecretsManager().removeSecret(secretName);
         process.stdout.write(`Removed binding and deleted secret: ${secretName}
+`);
+      } else if (isOAuthReference(removedValue)) {
+        const removed = clearOAuthCredentials(oauthReferenceServerName(removedValue), new SecretsManager);
+        process.stdout.write(`Removed binding and deleted ${removed.length} OAuth credential${removed.length === 1 ? "" : "s"}.
+`);
+        process.stdout.write(`(Equivalent to \`mcpx auth logout ${server}\`.)
 `);
       } else {
-        process.stdout.write(`Removed binding. Value was inline (no keychain secret deleted).
+        process.stdout.write(`Removed binding. Value was inline (no stored secret deleted).
 `);
       }
     } else {
@@ -2455,6 +2638,78 @@ function registerAuthCommands(program) {
       }
     }
   });
+  auth.command("status [server]").option("--json", "Output JSON").description("Show OAuth sign-in and token/secret auth status (offline, no network calls)").action((server, options) => {
+    const config = loadConfig();
+    const names = server ? [server] : Object.keys(config.servers);
+    const secrets = new SecretsManager;
+    const entries = names.map((name) => {
+      const spec = getServerSpecOrThrow(config, name);
+      const oauth = getOAuthCredentialStatus(name, spec, secrets);
+      const bindings = listAuthBindings(spec).map((binding) => {
+        if (isOAuthReference(binding.value)) {
+          return { kind: binding.kind, key: binding.key, source: "oauth", secretName: null, secretPresent: null };
+        }
+        const secretName = secretRefName(binding.value);
+        if (secretName) {
+          return { kind: binding.kind, key: binding.key, source: "secret", secretName, secretPresent: secrets.getSecret(secretName) !== null };
+        }
+        return { kind: binding.kind, key: binding.key, source: "inline", secretName: null, secretPresent: null };
+      });
+      return { server: name, transport: spec.transport, oauth, bindings };
+    });
+    if (options.json) {
+      process.stdout.write(`${JSON.stringify({ servers: entries }, null, 2)}
+`);
+      return;
+    }
+    if (entries.length === 0) {
+      process.stdout.write(`No upstream servers configured.
+`);
+      return;
+    }
+    const oauthEntries = entries.filter((e) => e.oauth.bound || e.oauth.signedIn);
+    const secretRows = entries.flatMap((e) => e.bindings.filter((b) => b.source !== "oauth").map((b) => ({ entry: e, binding: b })));
+    if (oauthEntries.length > 0) {
+      process.stdout.write(`OAuth sign-ins
+`);
+      for (const entry of oauthEntries) {
+        process.stdout.write(`- ${entry.server} (${entry.transport})
+`);
+        if (!entry.oauth.signedIn) {
+          process.stdout.write(`    status     bound but not signed in — run \`mcpx auth login ${entry.server}\`
+`);
+          continue;
+        }
+        process.stdout.write(`    status     ${entry.oauth.expired ? "expired" : "signed in"}
+`);
+        if (entry.oauth.expiresAt) {
+          process.stdout.write(`    expires    ${new Date(entry.oauth.expiresAt).toLocaleString()}
+`);
+        }
+        process.stdout.write(`    refresh    ${entry.oauth.hasRefreshToken ? "available" : `none — run \`mcpx auth login ${entry.server}\` to re-authenticate`}
+`);
+        process.stdout.write(`    client     ${entry.oauth.clientRegistered ? "registered" : "not registered"}
+`);
+      }
+      process.stdout.write(`
+`);
+    }
+    if (secretRows.length > 0) {
+      process.stdout.write(`Token / secret auth
+`);
+      for (const { entry, binding } of secretRows) {
+        const label = binding.source === "secret" ? `secret://${binding.secretName}${binding.secretPresent ? "" : "  MISSING"}` : "<inline>";
+        process.stdout.write(`- ${entry.server} (${entry.transport})  ${binding.kind}:${binding.key}  ${label}
+`);
+      }
+      process.stdout.write(`
+`);
+    }
+    if (oauthEntries.length === 0 && secretRows.length === 0) {
+      process.stdout.write(`No auth configured for any server.
+`);
+    }
+  });
   auth.command("rotate-local-token").description("Rotate bearer token used for local client->mcpx auth").action(async () => {
     const config = loadConfig();
     const secrets = new SecretsManager;
@@ -2491,11 +2746,20 @@ function registerSkillsCommands(program) {
     saveSkill(id, `# ${id}
 
 Add your instructions here.`);
+    const summary = syncAllClients(loadConfig(), new SecretsManager);
+    await mutateConfig((config) => persistSyncState(summary, config));
     process.stdout.write(`Skill "${id}" created.
 `);
   });
-  skill.command("rm <id>").description("Remove a skill").action((id) => {
+  skill.command("rm <id>").description("Remove a skill").action(async (id) => {
+    if (!getSkill(id)) {
+      process.stderr.write(`Skill "${id}" not found.
+`);
+      process.exit(1);
+    }
     deleteSkill(id);
+    const summary = syncAllClients(loadConfig(), new SecretsManager);
+    await mutateConfig((config) => persistSyncState(summary, config));
     process.stdout.write(`Skill "${id}" removed.
 `);
   });
@@ -2591,11 +2855,11 @@ function registerProjectCommands(program, cliPath) {
       name: projectName,
       servers: {}
     };
-    const { saveProjectConfig } = await import("./config-yx5m60fv.js");
+    const { saveProjectConfig } = await import("./config-fbgyqmv1.js");
     saveProjectConfig(localConfig, targetPath);
     process.stdout.write(`Initialized project configuration at: ${targetPath}
 `);
-    const { registerProject: registerProject2 } = await import("./registry-yvbxcaq6.js");
+    const { registerProject: registerProject2 } = await import("./registry-04kfpjh0.js");
     await mutateConfig((globalConfig) => {
       registerProject2(globalConfig, process.cwd(), projectName);
     });
@@ -2626,7 +2890,7 @@ function registerProjectCommands(program, cliPath) {
       process.exit(1);
     }
     const entry = globalConfig.projects[resolvedPath];
-    const { unregisterProject: unregisterProject2 } = await import("./registry-yvbxcaq6.js");
+    const { unregisterProject: unregisterProject2 } = await import("./registry-04kfpjh0.js");
     await mutateConfig((freshConfig) => {
       unregisterProject2(freshConfig, resolvedPath);
     });
@@ -2640,7 +2904,7 @@ function registerProjectCommands(program, cliPath) {
 function registerPluginCommands(program, _cliPath) {
   const plugin = program.command("plugin").description("Manage plugins");
   plugin.command("inspect <source>").description("Inspect plugin manifest and components").action(async (source) => {
-    const { inspectPlugin } = await import("./plugin-manager-19q55n69.js");
+    const { inspectPlugin } = await import("./plugin-manager-rw05c2x3.js");
     try {
       const info = await inspectPlugin(source);
       process.stdout.write(JSON.stringify(info, null, 2) + `
@@ -2657,7 +2921,7 @@ function registerPluginCommands(program, _cliPath) {
       const marketplaceName = source.includes("@") ? source.slice(source.lastIndexOf("@") + 1) : "";
       let p;
       if (config.marketplaces?.[marketplaceName]) {
-        const { inspectMarketplacePlugin, installMarketplacePlugin } = await import("./marketplace-pwabb3ea.js");
+        const { inspectMarketplacePlugin, installMarketplacePlugin } = await import("./marketplace-zem0m4mw.js");
         const detail = await inspectMarketplacePlugin(source);
         process.stdout.write(`${detail.displayName} (${source})
 `);
@@ -2685,7 +2949,7 @@ function registerPluginCommands(program, _cliPath) {
         }
         p = await installMarketplacePlugin(source);
       } else {
-        const { installPlugin } = await import("./plugin-manager-19q55n69.js");
+        const { installPlugin } = await import("./plugin-manager-rw05c2x3.js");
         p = await installPlugin(source, { name: options.name, enabled: options.enable !== false });
       }
       process.stdout.write(`Plugin installed: ${p.id}
@@ -2698,13 +2962,13 @@ function registerPluginCommands(program, _cliPath) {
   });
   const marketplace = plugin.command("marketplace").description("Manage plugin marketplaces");
   marketplace.command("list").description("List configured plugin marketplaces").action(async () => {
-    const { listMarketplaces } = await import("./marketplace-pwabb3ea.js");
+    const { listMarketplaces } = await import("./marketplace-zem0m4mw.js");
     process.stdout.write(JSON.stringify(await listMarketplaces(), null, 2) + `
 `);
   });
   marketplace.command("add <source>").option("--manifest <path>", "Marketplace manifest path inside the source").description("Add a Claude or Codex plugin marketplace").action(async (source, options) => {
     try {
-      const { addMarketplace } = await import("./marketplace-pwabb3ea.js");
+      const { addMarketplace } = await import("./marketplace-zem0m4mw.js");
       const added = await addMarketplace(source, options.manifest);
       process.stdout.write(`Marketplace added: ${added.name}
 `);
@@ -2716,7 +2980,7 @@ function registerPluginCommands(program, _cliPath) {
   });
   marketplace.command("update [name]").description("Refresh one marketplace, or every configured marketplace").action(async (name) => {
     try {
-      const { listMarketplaces, refreshMarketplaceWithPlugins } = await import("./marketplace-pwabb3ea.js");
+      const { listMarketplaces, refreshMarketplaceWithPlugins } = await import("./marketplace-zem0m4mw.js");
       const names = name ? [name] : (await listMarketplaces()).map((entry) => entry.name);
       for (const marketplaceName of names) {
         const result = await refreshMarketplaceWithPlugins(marketplaceName);
@@ -2746,7 +3010,7 @@ function registerPluginCommands(program, _cliPath) {
           rl.close();
         }
       }
-      const { removeMarketplace } = await import("./marketplace-pwabb3ea.js");
+      const { removeMarketplace } = await import("./marketplace-zem0m4mw.js");
       await removeMarketplace(name);
       process.stdout.write(`Marketplace removed: ${name}
 `);
@@ -2757,7 +3021,7 @@ function registerPluginCommands(program, _cliPath) {
     }
   });
   plugin.command("discover [query]").option("--marketplace <name>", "Filter by marketplace").option("--category <category>", "Filter by category").description("Browse available marketplace plugins").action(async (query, options) => {
-    const { listMarketplacePlugins } = await import("./marketplace-pwabb3ea.js");
+    const { listMarketplacePlugins } = await import("./marketplace-zem0m4mw.js");
     let listings = await listMarketplacePlugins(query);
     if (options.marketplace)
       listings = listings.filter((entry) => entry.marketplace === options.marketplace);
@@ -2768,7 +3032,7 @@ function registerPluginCommands(program, _cliPath) {
   });
   plugin.command("details <plugin>").description("Inspect a plugin@marketplace listing").action(async (qualified) => {
     try {
-      const { inspectMarketplacePlugin } = await import("./marketplace-pwabb3ea.js");
+      const { inspectMarketplacePlugin } = await import("./marketplace-zem0m4mw.js");
       process.stdout.write(JSON.stringify(await inspectMarketplacePlugin(qualified), null, 2) + `
 `);
     } catch (error) {
@@ -2778,7 +3042,7 @@ function registerPluginCommands(program, _cliPath) {
     }
   });
   plugin.command("approve <name> <component>").description("Approve a plugin component (hooks, mcpServers)").action(async (name, component) => {
-    const { approvePluginComponent } = await import("./plugin-manager-19q55n69.js");
+    const { approvePluginComponent } = await import("./plugin-manager-rw05c2x3.js");
     try {
       await approvePluginComponent(name, component);
       process.stdout.write(`Approved ${component} for plugin ${name}
@@ -2790,7 +3054,7 @@ function registerPluginCommands(program, _cliPath) {
     }
   });
   plugin.command("prepare <name>").description("Install plugin dependencies").action(async (name) => {
-    const { preparePlugin } = await import("./plugin-manager-19q55n69.js");
+    const { preparePlugin } = await import("./plugin-manager-rw05c2x3.js");
     try {
       await preparePlugin(name);
       process.stdout.write(`Plugin ${name} prepared
@@ -2802,7 +3066,7 @@ function registerPluginCommands(program, _cliPath) {
     }
   });
   plugin.command("update <name>").description("Update plugin to latest version").action(async (name) => {
-    const { updatePlugin } = await import("./plugin-manager-19q55n69.js");
+    const { updatePlugin } = await import("./plugin-manager-rw05c2x3.js");
     try {
       const p = await updatePlugin(name);
       process.stdout.write(`Plugin ${name} updated to ${p.version}
@@ -2814,7 +3078,7 @@ function registerPluginCommands(program, _cliPath) {
     }
   });
   plugin.command("uninstall <name>").option("--keep-data", "Keep plugin data after uninstall").description("Uninstall plugin").action(async (name, options) => {
-    const { uninstallPlugin } = await import("./plugin-manager-19q55n69.js");
+    const { uninstallPlugin } = await import("./plugin-manager-rw05c2x3.js");
     try {
       await uninstallPlugin(name, options.keepData || false);
       process.stdout.write(`Plugin ${name} uninstalled
@@ -2828,13 +3092,13 @@ function registerPluginCommands(program, _cliPath) {
   plugin.command("enable <name>").option("--project <path>", "Scope this enable to a single registered project instead of globally").description("Enable plugin (globally, or for one project with --project)").action(async (name, options) => {
     try {
       if (options.project) {
-        const { setPluginProjectOverride } = await import("./plugin-manager-19q55n69.js");
+        const { setPluginProjectOverride } = await import("./plugin-manager-rw05c2x3.js");
         const resolvedPath = path.resolve(options.project);
         await setPluginProjectOverride(name, resolvedPath, { enabled: true });
         process.stdout.write(`Plugin ${name} enabled for project: ${resolvedPath}
 `);
       } else {
-        const { enablePlugin } = await import("./plugin-manager-19q55n69.js");
+        const { enablePlugin } = await import("./plugin-manager-rw05c2x3.js");
         await enablePlugin(name);
         process.stdout.write(`Plugin ${name} enabled
 `);
@@ -2848,13 +3112,13 @@ function registerPluginCommands(program, _cliPath) {
   plugin.command("disable <name>").option("--project <path>", "Scope this disable to a single registered project instead of globally").description("Disable plugin (globally, or for one project with --project)").action(async (name, options) => {
     try {
       if (options.project) {
-        const { setPluginProjectOverride } = await import("./plugin-manager-19q55n69.js");
+        const { setPluginProjectOverride } = await import("./plugin-manager-rw05c2x3.js");
         const resolvedPath = path.resolve(options.project);
         await setPluginProjectOverride(name, resolvedPath, { enabled: false });
         process.stdout.write(`Plugin ${name} disabled for project: ${resolvedPath}
 `);
       } else {
-        const { disablePlugin } = await import("./plugin-manager-19q55n69.js");
+        const { disablePlugin } = await import("./plugin-manager-rw05c2x3.js");
         await disablePlugin(name);
         process.stdout.write(`Plugin ${name} disabled
 `);
@@ -2866,7 +3130,7 @@ function registerPluginCommands(program, _cliPath) {
     }
   });
   plugin.command("status [name]").description("Show plugin status").action(async (name) => {
-    const { getPluginStatus, listPlugins } = await import("./plugin-manager-19q55n69.js");
+    const { getPluginStatus, listPlugins } = await import("./plugin-manager-rw05c2x3.js");
     try {
       if (name) {
         const p = await getPluginStatus(name);
@@ -2891,7 +3155,7 @@ function registerPluginCommands(program, _cliPath) {
 }
 function registerPluginHostCommand(program) {
   program.command("plugin-host <plugin> <server>").description("Run a plugin MCP server under mcpx policy enforcement").action(async (plugin, server) => {
-    const { runPluginHost } = await import("./plugin-host-9xcpnehq.js");
+    const { runPluginHost } = await import("./plugin-host-5jmyt0td.js");
     runPluginHost(plugin, server);
   });
 }