@michael-joseph-miller/ant-bot 0.3.0 → 0.4.0

package/dist/index.js

@@ -3,11 +3,11 @@ import { createRequire as __antbotCreateRequire } from 'node:module';
 const require = __antbotCreateRequire(import.meta.url);
 import {
   SettingsSchema
-} from "./chunk-I3GHIX3G.js";
+} from "./chunk-BKF7CUVN.js";
 
 // cli/src/index.ts
 import fs10 from "node:fs";
-import readline2 from "node:readline/promises";
+import readline3 from "node:readline/promises";
 import path11 from "node:path";
 
 // cli/src/args.ts
@@ -21,6 +21,7 @@ var KNOWN_COMMANDS = [
   "skill",
   "mcp",
   "connector",
+  "secret",
   "backup",
   "restore",
   "update"
@@ -43,6 +44,7 @@ var COMMAND_FLAGS = {
   skill: {},
   mcp: {},
   connector: {},
+  secret: {},
   backup: {
     out: { type: "string" }
   },
@@ -54,7 +56,7 @@ var COMMAND_FLAGS = {
     yes: { type: "boolean", default: false }
   }
 };
-var PASSTHROUGH_COMMANDS = /* @__PURE__ */ new Set(["mcp", "connector"]);
+var PASSTHROUGH_COMMANDS = /* @__PURE__ */ new Set(["mcp", "connector", "secret"]);
 function isKnownCommand(value) {
   return KNOWN_COMMANDS.includes(value);
 }
@@ -152,6 +154,7 @@ Daemon:
 Data:
   skill <subcommand>   Manage the skills your bots can use
   mcp <subcommand>     Manage the MCP servers your bots can use
+  secret <subcommand>  Credentials in your keychain (mcp add stores them for you)
   backup [--out PATH]  Archive the database, config, skills, and bot memory
   restore <path>       Restore from a backup archive
 
@@ -166,42 +169,40 @@ Environment:
   ANTBOT_HOME          Data directory (default: ~/.ant-bot)
 
 The UI lives at http://127.0.0.1:4780 and is served by the daemon itself.`;
-var MCP_HELP = `antbot mcp \u2014 manage the MCP servers your bots can use
+var MCP_HELP = `antbot mcp \u2014 the MCP servers your bots can use
 
 Usage: antbot mcp <subcommand>
 
-  list                    Show every server, with warnings for anything unusable
-  add <name> ...          Add one: --stdio "<cmd>" or --url <url>
-  login <name>            Sign in interactively (http/sse servers that need OAuth)
-  logout <name>           Forget a stored sign-in
-  enable|disable <name>   Turn one on or off for every bot at once
-  remove <name>           Delete it, and every bot's assignment to it
-  test <name>             Connect and list the tools it offers
-
-A server is registered once for the account and then assigned to individual bots in
-Bot settings \u2014 a bot with no assignment cannot see its tools at all. Its tools reach
-bots as \`mcp__<name>__<tool>\` and pass the permission gateway like any other tool,
-so the first call asks you for approval.
-
-Credentials, two ways. A static token goes in a header or an env var, written as
-{{secret:NAME}} so the value stays in your keychain:
-
-  antbot mcp add fs --stdio "npx -y @modelcontextprotocol/server-filesystem /tmp"
-  antbot mcp add gh --url https://api.example.com/mcp \\
-    --header "Authorization=Bearer {{secret:GH_TOKEN}}"
-
-A server that wants an interactive sign-in instead uses \`login\`, which discovers
-what it accepts and prints a URL to open:
+  add <name> [<command> | <url>]   Add one. No command or URL means a built-in (e.g. gmail).
+      --env VAR[=value]            stdio: an env var. Without =value you are prompted, and the
+                                   value goes to the keychain \u2014 it never appears in config.
+      --header K[=V]               http: a header, same rule.
+      --bots a,b | all | none      Which bots get it. Asked interactively if omitted.
+  check <name>                     One honest verdict: ready / needs sign-in / needs credential /
+                                   unreachable, plus the tools it offers.
+  login <name>                     Sign in (again). --client-id / --client-secret for providers
+                                   that will not register apps themselves (Google).
+  logout <name>                    Forget a stored sign-in.
+  enable|disable <name>            Turn one off for every bot at once, or back on.
+  remove <name>                    Delete it, and every bot's assignment to it.
+  list                             Everything, with state and which bots have each.
+
+Examples:
+  antbot mcp add gmail                                             built-in; guided setup
+  antbot mcp add github "npx -y @modelcontextprotocol/server-github" --env GITHUB_TOKEN
+  antbot mcp add vercel https://mcp.vercel.com                     signs in automatically
+
+A connector is registered once and assigned to bots in Bot settings \u2014 a bot with no assignment
+cannot see its tools at all. Tools reach bots as \`mcp__<name>__<tool>\` and pass the permission
+gateway like any other tool, so the first call asks you for approval.
 
-  antbot mcp login gmail
-
-Providers that support dynamic client registration need nothing else. Some \u2014 Google
-among them \u2014 do not, and want a client ID you create in their console, with
-http://127.0.0.1:4780/api/connectors/oauth/callback as an authorised redirect URI:
+\`connector\` is the older name for this command and still works.`;
+var SECRET_HELP = `antbot secret \u2014 credentials in your keychain
 
-  antbot mcp login gmail --client-id YOUR_ID.apps.googleusercontent.com
+Usage: antbot secret list | set <NAME> | remove <NAME>
 
-\`connector\` is the older name for this command and still works.`;
+Values are prompted for, never passed on the command line, and never shown again. Most people
+never need this directly: \`antbot mcp add \u2026 --env VAR\` stores what a connector needs for you.`;
 var COMMAND_HELP = {
   start: `antbot start \u2014 start the daemon in the background
 
@@ -304,6 +305,7 @@ In a git checkout there is nothing for a package manager to update \u2014 use
 \`git pull && pnpm install\` instead.`,
   connector: MCP_HELP,
   mcp: MCP_HELP,
+  secret: SECRET_HELP,
   restore: `antbot restore \u2014 restore from a backup archive
 
 Usage: antbot restore <path> [--yes]
@@ -1218,22 +1220,9 @@ async function lintSkills(args) {
   return 0;
 }
 
-// cli/src/connector.ts
-function collectPairs(argv, flag) {
-  const out = {};
-  for (let i = 0; i < argv.length; i++) {
-    if (argv[i] !== flag) continue;
-    const raw = argv[i + 1] ?? "";
-    const eq = raw.indexOf("=");
-    if (eq > 0) out[raw.slice(0, eq)] = raw.slice(eq + 1);
-    i++;
-  }
-  return out;
-}
-function flagValue(argv, flag) {
-  const i = argv.indexOf(flag);
-  return i >= 0 ? argv[i + 1] : void 0;
-}
+// cli/src/mcp.ts
+import readline from "node:readline/promises";
+import { spawn as spawn3 } from "node:child_process";
 function splitCommand(input) {
   const parts = input.match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
   const clean = parts.map(
@@ -1241,131 +1230,258 @@ function splitCommand(input) {
   );
   return { command: clean[0] ?? "", args: clean.slice(1) };
 }
-function buildConfigFromFlags(argv) {
-  const stdio = flagValue(argv, "--stdio");
-  const url = flagValue(argv, "--url");
-  if (stdio && url) return { error: "Use either --stdio or --url, not both." };
-  if (stdio) {
-    const { command, args } = splitCommand(stdio);
-    if (!command) return { error: '--stdio needs a command, e.g. --stdio "npx -y @scope/server"' };
-    return { config: { transport: "stdio", command, args, env: collectPairs(argv, "--env") } };
-  }
-  if (url) {
-    const transport = flagValue(argv, "--transport") ?? "http";
-    if (transport !== "http" && transport !== "sse") return { error: "--transport must be http or sse" };
-    const tools = flagValue(argv, "--tools");
-    return {
-      config: {
-        transport,
-        url,
-        headers: collectPairs(argv, "--header"),
-        ...tools ? { tools: tools.split(",").map((t) => t.trim()).filter(Boolean) } : {}
-      }
-    };
+var looksLikeUrl = (s) => /^https?:\/\//i.test(s.trim());
+function collectFlag(argv, flag) {
+  const out = [];
+  for (let i = 0; i < argv.length; i++) if (argv[i] === flag && argv[i + 1] !== void 0) out.push(argv[++i]);
+  return out;
+}
+function flagValue(argv, flag) {
+  const i = argv.indexOf(flag);
+  return i >= 0 ? argv[i + 1] : void 0;
+}
+var secretNameFor = (connector, key) => `mcp/${connector}/${key}`;
+function planPairs(raw) {
+  return raw.map((r) => {
+    const eq = r.indexOf("=");
+    if (eq > 0) return { key: r.slice(0, eq), value: r.slice(eq + 1), secret: false };
+    return { key: r, value: "", secret: true };
+  });
+}
+function resolveBots(spec, roster) {
+  if (spec === void 0) return "ask";
+  if (spec === "none" || spec === "") return null;
+  if (spec === "all") return roster.map((r) => r.bot.id);
+  const wanted = spec.split(",").map((x) => x.trim().toLowerCase()).filter(Boolean);
+  return roster.filter((r) => wanted.includes(r.bot.slug) || wanted.includes(r.bot.name.toLowerCase())).map((r) => r.bot.id);
+}
+function describeVerdict(name, check) {
+  const n = check.tools.length;
+  switch (check.status) {
+    case "ready":
+      return green(`\u2713 ${name}: ready, ${n} tool${n === 1 ? "" : "s"}`);
+    case "needs-sign-in":
+      return yellow(`! ${name}: needs sign-in${check.provider ? ` (${check.provider})` : ""}${n ? `, ${n} tools` : ""}`);
+    case "needs-credential":
+      return yellow(`! ${name}: ${check.detail ?? "needs a credential"}`);
+    case "unreachable":
+      return red(`\u2717 ${name}: unreachable${check.detail ? ` \u2014 ${check.detail}` : ""}`);
+  }
+}
+async function ask(question, hidden = false) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+  if (hidden) {
+    const out = process.stdout;
+    const orig = out.write.bind(out);
+    process.stdout.write(question);
+    let muted = true;
+    out.write = ((s) => muted ? true : orig(s));
+    try {
+      const v = await rl.question("");
+      return v.trim();
+    } finally {
+      muted = false;
+      out.write = orig;
+      process.stdout.write("\n");
+      rl.close();
+    }
+  }
+  try {
+    return (await rl.question(question)).trim();
+  } finally {
+    rl.close();
   }
-  return { error: 'Give either --stdio "<command>" or --url <url>.' };
 }
-var transportOf = (c) => String(c.config.transport ?? "?");
-async function findByName(port, name) {
-  return (await getJson(port, "/api/connectors")).find((c) => c.name === name);
+function openBrowser(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  try {
+    const child = spawn3(cmd, [url], { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+  console.log(dim("  If a browser did not open, use this link:"));
+  console.log(`  ${url}`);
+}
+async function load(port) {
+  try {
+    return await getJson(port, "/api/connectors");
+  } catch (err) {
+    console.error(red(`Could not reach the daemon on port ${port}: ${err.message}`));
+    console.error(dim("Start it with `antbot start`."));
+    return null;
+  }
+}
+async function storePairs(port, connector, pairs) {
+  const out = {};
+  for (const p of pairs) {
+    if (!p.secret) {
+      out[p.key] = p.value;
+      continue;
+    }
+    const value = await ask(`  ${p.key}: `, true);
+    if (!value) throw new Error(`${p.key} needs a value.`);
+    const name = secretNameFor(connector, p.key);
+    await postJson(port, "/api/secrets", { name, value });
+    out[p.key] = `{{secret:${name}}}`;
+  }
+  return out;
 }
-async function runConnectorCommand(argv, port) {
+async function signIn(port, row, opts) {
+  let res;
+  try {
+    res = await postJson(port, `/api/connectors/${row.id}/login`, opts);
+  } catch (err) {
+    console.error(yellow(`  ${err.message}`));
+    return false;
+  }
+  console.log(dim("  Opening your browser to sign in\u2026"));
+  openBrowser(res.authorizeUrl);
+  const deadline = Date.now() + 5 * 6e4;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, 2e3));
+    const rows = await getJson(port, "/api/connectors").catch(() => []);
+    const cur = rows.find((r) => r.id === row.id);
+    if (cur?.signedIn) return true;
+  }
+  console.log(yellow("  Still waiting for the sign-in. Finish it in the browser, then run: antbot mcp check " + row.name));
+  return false;
+}
+async function collectClientCredentials(entry, provider) {
+  console.log(yellow(`  ${provider ?? "This provider"} needs an OAuth client you create yourself \u2014 a one-time setup:`));
+  for (const [i, step] of (entry?.setupSteps ?? []).entries()) console.log(`    ${i + 1}. ${step}`);
+  const clientId = await ask("  Client ID (blank to do this later): ");
+  if (!clientId) return null;
+  const clientSecret = await ask("  Client secret (blank if none): ", true);
+  return { clientId, ...clientSecret ? { clientSecret } : {} };
+}
+async function runMcpCommand(argv, port) {
   const sub = argv[0];
   const hint = () => {
-    console.error(dim("Subcommands: list, add, login, logout, enable, disable, remove, test."));
+    console.error(dim("Subcommands: list, add, check, login, logout, enable, disable, remove."));
     console.error(dim("Run `antbot mcp --help` for the full usage."));
   };
   if (!sub) {
-    console.error(red("antbot connector needs a subcommand."));
+    console.error(red("antbot mcp needs a subcommand."));
     hint();
     return 2;
   }
-  let rows;
-  const load = async () => {
-    try {
-      rows = await getJson(port, "/api/connectors");
-      return true;
-    } catch (err) {
-      console.error(red(`Could not reach the daemon on port ${port}: ${err.message}`));
-      console.error(dim("Start it with `antbot start`."));
-      return false;
-    }
+  const byName = async (name) => {
+    const rows = await load(port);
+    if (!rows) return null;
+    const m = rows.find((c) => c.name === name);
+    if (!m) console.error(red(`No connector named "${name}".`));
+    return m ?? null;
   };
   switch (sub) {
     case "list": {
-      if (!await load()) return 1;
+      const rows = await load(port);
+      if (!rows) return 1;
       if (!rows.length) {
-        console.log(dim("No connectors yet. Add one with `antbot connector add`."));
+        console.log(dim("No connectors yet. Add one with `antbot mcp add`."));
         return 0;
       }
+      const roster = await getJson(port, "/api/bots").catch(() => []);
+      const assigned = /* @__PURE__ */ new Map();
+      for (const r of roster) {
+        const cs = await getJson(port, `/api/bots/${r.bot.id}/connectors`).catch(() => []);
+        for (const c of cs) assigned.set(c.name, [...assigned.get(c.name) ?? [], r.bot.name]);
+      }
       for (const c of rows) {
-        const state = c.enabled ? "" : dim(" (disabled)");
-        const signed = c.signedIn ? green(" signed in") : "";
-        console.log(`${bold(c.name)}  ${dim(transportOf(c))}${state}${signed}`);
-        if (c.description) console.log(`  ${c.description}`);
-        if (c.missingSecrets.length) {
-          console.log(yellow(`  missing secret(s): ${c.missingSecrets.join(", ")} \u2014 this connector will not mount`));
-        }
+        const kind = c.kind === "builtin" ? "built-in" : String(c.config.transport ?? "?");
+        const state = !c.enabled ? dim("disabled") : c.signedIn ? green("signed in") : c.missingSecrets.length ? yellow(`missing secret: ${c.missingSecrets.join(", ")}`) : c.lastStatus === "ready" || c.lastStatus === "connected" ? green("ready") : c.lastStatus ? yellow(c.lastStatus) : dim("unchecked");
+        const bots = assigned.get(c.name)?.length ? dim(`\u2192 ${assigned.get(c.name).join(", ")}`) : dim("\u2192 no bots");
+        console.log(`${bold(c.name.padEnd(14))} ${kind.padEnd(9)} ${state}  ${bots}`);
+        if (c.description) console.log(`  ${dim(c.description)}`);
+        if (c.lastError && c.lastStatus !== "ready") console.log(`  ${dim(c.lastError)}`);
       }
       return 0;
     }
     case "add": {
       const name = argv[1];
+      const target = argv[2] && !argv[2].startsWith("--") ? argv[2] : void 0;
       if (!name || name.startsWith("--")) {
-        console.error(red('Usage: antbot connector add <name> (--stdio "<cmd>" | --url <url>)'));
+        console.error(red("Usage: antbot mcp add <name> [<command> | <url>] [--env VAR[=value]]... [--header K=V]... [--bots a,b|all]"));
         return 2;
       }
-      const built = buildConfigFromFlags(argv);
-      if ("error" in built) {
-        console.error(red(built.error));
-        return 2;
+      const catalog = await getJson(port, "/api/connectors/catalog").catch(() => []);
+      const entry = catalog.find((e) => e.name === name) ?? null;
+      let body;
+      if (!target) {
+        if (!entry) {
+          console.error(red(`"${name}" is not a built-in connector. Give a command or a URL:`));
+          console.error(dim(`  antbot mcp add ${name} "npx -y some-server"    or    antbot mcp add ${name} https://\u2026/mcp`));
+          if (catalog.length) console.error(dim(`  Built-in: ${catalog.map((e) => e.name).join(", ")}`));
+          return 2;
+        }
+        console.log(`${bold(entry.displayName)} is built into ant-bot. ${entry.description}`);
+        body = { name, builtin: name };
+      } else if (looksLikeUrl(target)) {
+        const headers = await storePairs(port, name, planPairs(collectFlag(argv, "--header")));
+        const transport = flagValue(argv, "--transport") === "sse" ? "sse" : "http";
+        body = { name, config: { transport, url: target.trim(), headers } };
+      } else {
+        const { command, args } = splitCommand(target);
+        if (!command) {
+          console.error(red("The command is empty."));
+          return 2;
+        }
+        const env = await storePairs(port, name, planPairs(collectFlag(argv, "--env")));
+        body = { name, config: { transport: "stdio", command, args, env } };
+      }
+      if (flagValue(argv, "--desc")) body.description = flagValue(argv, "--desc");
+      const roster = await getJson(port, "/api/bots").catch(() => []);
+      let botIds = resolveBots(flagValue(argv, "--bots"), roster);
+      if (botIds === "ask") {
+        if (roster.length) {
+          const names = roster.map((r) => r.bot.name).join(", ");
+          const ans = await ask(`  Give it to which bots? [${names}, all, none] `);
+          botIds = resolveBots(ans || "none", roster);
+        } else botIds = null;
       }
+      if (botIds && botIds.length) body.botIds = botIds;
+      let created;
       try {
-        const created = await postJson(port, "/api/connectors", {
-          name,
-          description: flagValue(argv, "--desc") ?? "",
-          config: built.config
-        });
-        console.log(green(`Added connector "${created.name}".`));
-        console.log(dim("Assign it to a bot in Bot settings, then `antbot connector test` to check it."));
-        return 0;
+        created = await postJson(port, "/api/connectors", body);
       } catch (err) {
         console.error(red(err.message));
         return 1;
       }
-    }
-    case "enable":
-    case "disable": {
-      const name = argv[1];
-      if (!name) {
-        console.error(red(`Usage: antbot connector ${sub} <name>`));
-        return 2;
-      }
-      if (!await load()) return 1;
-      const match = rows.find((c) => c.name === name);
-      if (!match) {
-        console.error(red(`No connector named "${name}".`));
-        return 1;
+      console.log(describeVerdict(name, created.check));
+      if (created.check.status === "needs-sign-in") {
+        let creds = {};
+        if (!created.check.selfRegistration) {
+          const c = await collectClientCredentials(entry, created.check.provider);
+          if (!c) {
+            console.log(dim(`  Later: antbot mcp login ${name} --client-id ID --client-secret SECRET`));
+            return 0;
+          }
+          creds = c;
+        }
+        const ok = await signIn(port, created, creds);
+        if (ok) {
+          const check = await postJson(port, `/api/connectors/${created.id}/check`, {});
+          console.log(describeVerdict(name, check));
+        }
       }
-      await patchJson(port, `/api/connectors/${match.id}`, { enabled: sub === "enable" });
-      console.log(green(`Connector "${name}" ${sub}d.`));
+      if (botIds && botIds.length) console.log(dim(`  Assigned to ${botIds.length} bot${botIds.length === 1 ? "" : "s"}.`));
+      else console.log(dim("  Not assigned to any bot yet \u2014 tick it in Bot settings when you want a bot to have it."));
       return 0;
     }
-    case "remove": {
+    case "check": {
       const name = argv[1];
       if (!name) {
-        console.error(red("Usage: antbot connector remove <name>"));
+        console.error(red("Usage: antbot mcp check <name>"));
         return 2;
       }
-      if (!await load()) return 1;
-      const match = rows.find((c) => c.name === name);
-      if (!match) {
-        console.error(red(`No connector named "${name}".`));
-        return 1;
-      }
-      await deleteJson(port, `/api/connectors/${match.id}`);
-      console.log(green(`Removed connector "${name}". Bot assignments for it are gone too.`));
-      return 0;
+      const row = await byName(name);
+      if (!row) return 1;
+      const check = await postJson(port, `/api/connectors/${row.id}/check`, {});
+      console.log(describeVerdict(name, check));
+      for (const t of check.tools) console.log(`  ${bold(`mcp__${name}__${t.name}`)}${t.description ? dim(`  ${t.description.slice(0, 90)}`) : ""}`);
+      if (check.status === "needs-sign-in") console.log(dim(`  Sign in with: antbot mcp login ${name}`));
+      return check.status === "ready" ? 0 : 1;
     }
     case "login": {
       const name = argv[1];
@@ -1373,29 +1489,20 @@ async function runConnectorCommand(argv, port) {
         console.error(red("Usage: antbot mcp login <name> [--client-id ID] [--client-secret SECRET]"));
         return 2;
       }
-      if (!await load()) return 1;
-      const match = rows.find((c) => c.name === name);
-      if (!match) {
-        console.error(red(`No connector named "${name}".`));
-        return 1;
-      }
-      const body = {};
+      const row = await byName(name);
+      if (!row) return 1;
+      const creds = {};
       const cid = flagValue(argv, "--client-id");
       const csec = flagValue(argv, "--client-secret");
-      const scopes = flagValue(argv, "--scopes");
-      if (cid) body.clientId = cid;
-      if (csec) body.clientSecret = csec;
-      if (scopes) body.scopes = scopes.split(",").map((x) => x.trim()).filter(Boolean);
-      try {
-        const res = await postJson(port, `/api/connectors/${match.id}/login`, body);
-        console.log(bold("Open this URL to sign in:"));
-        console.log(`  ${res.authorizeUrl}`);
-        console.log(dim("The browser returns to ant-bot when you are done. Then: antbot mcp test " + name));
+      if (cid) creds.clientId = cid;
+      if (csec) creds.clientSecret = csec;
+      const ok = await signIn(port, row, creds);
+      if (ok) {
+        const check = await postJson(port, `/api/connectors/${row.id}/check`, {});
+        console.log(describeVerdict(name, check));
         return 0;
-      } catch (err) {
-        console.error(red(err.message));
-        return 1;
       }
+      return 1;
     }
     case "logout": {
       const name = argv[1];
@@ -1403,49 +1510,89 @@ async function runConnectorCommand(argv, port) {
         console.error(red("Usage: antbot mcp logout <name>"));
         return 2;
       }
-      if (!await load()) return 1;
-      const match = rows.find((c) => c.name === name);
-      if (!match) {
-        console.error(red(`No connector named "${name}".`));
-        return 1;
-      }
-      await deleteJson(port, `/api/connectors/${match.id}/login`);
+      const row = await byName(name);
+      if (!row) return 1;
+      await deleteJson(port, `/api/connectors/${row.id}/login`);
       console.log(green(`Signed out of "${name}".`));
       return 0;
     }
-    case "test": {
+    case "enable":
+    case "disable": {
+      const name = argv[1];
+      if (!name) {
+        console.error(red(`Usage: antbot mcp ${sub} <name>`));
+        return 2;
+      }
+      const row = await byName(name);
+      if (!row) return 1;
+      await patchJson(port, `/api/connectors/${row.id}`, { enabled: sub === "enable" });
+      console.log(green(`Connector "${name}" ${sub}d.`));
+      return 0;
+    }
+    case "remove": {
       const name = argv[1];
       if (!name) {
-        console.error(red("Usage: antbot connector test <name>"));
+        console.error(red("Usage: antbot mcp remove <name>"));
         return 2;
       }
-      let match;
+      const row = await byName(name);
+      if (!row) return 1;
+      await deleteJson(port, `/api/connectors/${row.id}`);
+      console.log(green(`Removed "${name}". Bot assignments for it are gone too.`));
+      return 0;
+    }
+    default:
+      console.error(red(`Unknown subcommand "${sub}".`));
+      hint();
+      return 2;
+  }
+}
+async function runSecretCommand(argv, port) {
+  const sub = argv[0];
+  switch (sub) {
+    case "list": {
       try {
-        match = await findByName(port, name);
+        const r = await getJson(port, "/api/secrets");
+        if (!r.names.length) console.log(dim(`No secrets stored (backend: ${r.backend}).`));
+        for (const n of r.names) console.log(n);
+        return 0;
       } catch (err) {
-        console.error(red(`Could not reach the daemon on port ${port}: ${err.message}`));
+        console.error(red(err.message));
         return 1;
       }
-      if (!match) {
-        console.error(red(`No connector named "${name}".`));
-        return 1;
+    }
+    case "set": {
+      const name = argv[1];
+      if (!name) {
+        console.error(red("Usage: antbot secret set <NAME>"));
+        return 2;
+      }
+      const value = await ask(`  Value for ${name}: `, true);
+      if (!value) {
+        console.error(red("A value is required."));
+        return 2;
       }
-      const result = await postJson(port, `/api/connectors/${match.id}/test`, {});
-      if (!result.ok) {
-        console.error(red(`${name}: ${result.error ?? "could not connect"}`));
+      try {
+        await postJson(port, "/api/secrets", { name, value });
+        console.log(green(`Stored ${name} in the keychain.`));
+        return 0;
+      } catch (err) {
+        console.error(red(err.message));
         return 1;
       }
-      console.log(green(`${name}: connected, ${result.tools.length} tool(s)`));
-      if (result.authHint) console.log(yellow(`  ${result.authHint}`));
-      for (const t of result.tools) {
-        console.log(`  ${bold(`mcp__${name}__${t.name}`)}`);
-        if (t.description) console.log(`    ${dim(t.description)}`);
+    }
+    case "remove": {
+      const name = argv[1];
+      if (!name) {
+        console.error(red("Usage: antbot secret remove <NAME>"));
+        return 2;
       }
+      await deleteJson(port, `/api/secrets/${encodeURIComponent(name)}`);
+      console.log(green(`Removed ${name}.`));
       return 0;
     }
     default:
-      console.error(red(`Unknown subcommand "${sub}".`));
-      hint();
+      console.error(red("Usage: antbot secret list | set <NAME> | remove <NAME>"));
       return 2;
   }
 }
@@ -1453,7 +1600,7 @@ async function runConnectorCommand(argv, port) {
 // cli/src/updateCommand.ts
 import fs9 from "node:fs";
 import path10 from "node:path";
-import readline from "node:readline/promises";
+import readline2 from "node:readline/promises";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // cli/src/update.ts
@@ -1628,7 +1775,7 @@ async function runUpdateCommand(opts) {
   const pm = detectPackageManager(here);
   const { cmd, args } = updateCommand(pm);
   if (!opts.yes) {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
     const answer = await rl.question(`Run \`${cmd} ${args.join(" ")}\`? [y/N] `);
     rl.close();
     if (!/^y(es)?$/i.test(answer.trim())) {
@@ -1744,7 +1891,7 @@ async function runRestoreCommand(archivePath, skipConfirm) {
   }
   const paths = loadPaths();
   if (!skipConfirm) {
-    const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
+    const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
     const answer = await rl.question(
       `This will overwrite files under ${paths.root} with the contents of ${archivePath}. Continue? [y/N] `
     );
@@ -1829,7 +1976,12 @@ async function main() {
     case "mcp":
     case "connector": {
       const cfg = loadConfig();
-      process.exit(await runConnectorCommand(parsed.positionals, cfg.port));
+      process.exit(await runMcpCommand(parsed.positionals, cfg.port));
+      return;
+    }
+    case "secret": {
+      const cfg = loadConfig();
+      process.exit(await runSecretCommand(parsed.positionals, cfg.port));
       return;
     }
     case "backup":