@newrelic/preflight 1.67.3 → 1.69.0

package/README.md

@@ -63,7 +63,7 @@ See cost breakdown, efficiency scoring, anti-patterns, and live session tracking
   - **Session Detail** — deep-dive into a single session's tool calls
   - **Team View** — aggregated cost and efficiency across developers
   - **Manager View** — high-level team metrics, no tool-call content
-  - **Adoption & Cost** — adoption momentum, spend, MCP usage, and per-developer outcomes for engineering managers
+  - **Adoption & Cost** — adoption momentum, spend, skill and MCP usage, and per-developer outcomes for engineering managers
   - **Platform Comparison** — Claude Code vs. Cursor vs. Windsurf, etc.
   - **Security Audit** — audit trail of sensitive file access
 
@@ -77,7 +77,7 @@ See cost breakdown, efficiency scoring, anti-patterns, and live session tracking
 npm install -g @newrelic/preflight
 ```
 
-> **Using [Smithery](https://smithery.ai)?** Installing Preflight from the Smithery MCP registry wires up the MCP server for you, but Smithery has no mechanism to write Claude Code hooks. After install, ask Claude Code to call the `nr_observe_install_hooks` MCP tool (it will offer to do this automatically once `nr_observe_health` reports `setup_required: true`), then restart Claude Code to activate monitoring.
+> **Using [Smithery](https://smithery.ai)?** Installing Preflight from the Smithery MCP registry wires up the MCP server for you, but Smithery has no mechanism to write Claude Code hooks. After install, either run `preflight install` in a terminal, or set `"allowHeadlessInstall": true` in your Preflight config (or `NEW_RELIC_AI_ALLOW_HEADLESS_INSTALL=true`) and ask Claude Code to call the `nr_observe_install_hooks` MCP tool. The tool refuses by default, because any connected MCP client can call it. With the flag on, it offers to do this automatically once `nr_observe_health` reports `setup_required: true`. Then restart Claude Code to activate monitoring.
 
 ### 2. Run setup
 

package/dist/config.d.ts

@@ -4,6 +4,8 @@ import type { CliOptions } from './types.js';
 import type { UpstreamConfig } from './proxy/types.js';
 import type { PersonalAlertThresholds } from './alerts/types.js';
 import type { ResolvedTier } from './transport/tier-types.js';
+import { SecretCommandError } from './secret-command.js';
+import type { SecretSources } from './secret-command.js';
 export declare const VALID_MODES: readonly ["cloud", "local", "both"];
 export type Mode = (typeof VALID_MODES)[number];
 export type CompanionModeSource = 'env NR_AI_COMPANION_MODE' | 'config file' | 'detected Claude Code OTel export' | 'default';
@@ -11,6 +13,16 @@ export interface ResolvedCompanionMode {
     readonly value: boolean;
     readonly source: CompanionModeSource;
 }
+/**
+ * Detects the setup where companion mode is off yet Claude Code's cost metrics
+ * reach New Relic through Preflight's receiver, so New Relic counts cost twice.
+ * Deliberately imprecise, and used only for a `preflight doctor` warning:
+ * auto-enabling companion mode on this signal would drop cost from New Relic
+ * whenever the proxy is not actually forwarding.
+ */
+export declare function findReceiverDoubleCount(env: NodeJS.ProcessEnv, config: Pick<McpServerConfig, 'otlp' | 'companionMode'>): {
+    readonly grpc: boolean;
+} | null;
 /**
  * Companion mode only prevents double-counting when Claude Code's own OTel
  * metrics also land in New Relic. Detection requires an nr-data.net endpoint:
@@ -43,6 +55,14 @@ export interface McpServerConfig {
      * (session_id === OTel's session.id). See docs/ADVANCED.md § Companion mode.
      */
     readonly companionMode: boolean;
+    /**
+     * Lets the `nr_observe_install_hooks` MCP tool rewrite ~/.claude/settings.json.
+     * Default false: any connected MCP client can call the tool, so it is opt-in.
+     * See docs/ADVANCED.md § allowHeadlessInstall.
+     */
+    readonly allowHeadlessInstall: boolean;
+    /** Source of the resolved companionMode value (env, config file, detected, or default). */
+    readonly companionModeSource: CompanionModeSource;
     readonly redactionPatterns: readonly RegExp[];
     readonly hookBufferPath: string;
     readonly storagePath: string;
@@ -58,6 +78,8 @@ export interface McpServerConfig {
     readonly collectorHost: string | null;
     readonly proxyUpstreams: readonly UpstreamConfig[];
     readonly nrApiKey: string | null;
+    /** Which source supplied each secret. Never the value. */
+    readonly secretSources: SecretSources;
     /** Path to a custom pricing JSON file, applied via `initPricing()`. See `NEW_RELIC_AI_CUSTOM_PRICING_FILE`. */
     readonly customPricingFile: string | null;
     /**
@@ -154,6 +176,7 @@ export interface McpServerConfig {
 }
 export declare const DEFAULT_STORAGE_PATH: string;
 export type PlatformTarget = 'native' | 'wsl-windows-cc' | 'wsl-linux-cc';
+export declare const SecretCommandSchema: z.ZodArray<z.ZodString>;
 export declare const ConfigFileSchema: z.ZodObject<{
     configVersion: z.ZodOptional<z.ZodNumber>;
     licenseKey: z.ZodOptional<z.ZodString>;
@@ -171,6 +194,7 @@ export declare const ConfigFileSchema: z.ZodObject<{
     recordContent: z.ZodOptional<z.ZodBoolean>;
     pricingRefresh: z.ZodOptional<z.ZodBoolean>;
     companionMode: z.ZodOptional<z.ZodBoolean>;
+    allowHeadlessInstall: z.ZodOptional<z.ZodBoolean>;
     storagePath: z.ZodOptional<z.ZodString>;
     hookBufferPath: z.ZodOptional<z.ZodString>;
     harvestEventsMs: z.ZodOptional<z.ZodNumber>;
@@ -189,6 +213,9 @@ export declare const ConfigFileSchema: z.ZodObject<{
     proxyUpstreams: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
     tiers: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
     nrApiKey: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    licenseKeyCommand: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    nrApiKeyCommand: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    digestWebhookUrlCommand: z.ZodOptional<z.ZodArray<z.ZodString>>;
     customPricingFile: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     costRateMultiplier: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
     dataResidencyPremium: z.ZodOptional<z.ZodBoolean>;
@@ -273,7 +300,40 @@ export declare class MissingCloudCredentialError extends Error {
     readonly mode: Mode;
     constructor(missingField: 'licenseKey' | 'accountId', mode: Mode, configFilePath: string);
 }
-export declare function loadMcpConfig(cliOptions?: Partial<CliOptions>): Readonly<McpServerConfig>;
+/**
+ * A `SecretCommandError` raised while resolving a secret that cloud export
+ * needs. It keeps the helper's own message for stdio users and adds the mode
+ * the config asked for, so `--local` can tell a failing helper from a missing
+ * credential and still fall back to local mode.
+ */
+export declare class CloudSecretCommandError extends SecretCommandError {
+    readonly mode: Mode;
+    constructor(original: SecretCommandError, mode: Mode);
+}
+/**
+ * The startup-resolved digest webhook URL when a source that outranks the
+ * file's `digestWebhookUrl` (env var or digestWebhookUrlCommand) supplied it.
+ * Undefined means "read the file at send time".
+ */
+export declare function digestWebhookUrlOverride(config: Pick<McpServerConfig, 'digestWebhookUrl' | 'secretSources'>): string | undefined;
+/** Which source is overriding the file's `digestWebhookUrl`, if any. */
+export declare function digestWebhookUrlOverrideSource(config: Pick<McpServerConfig, 'digestWebhookUrl' | 'secretSources'>): 'env' | 'command' | undefined;
+export interface LoadMcpConfigOptions {
+    /**
+     * Run the `*Command` secret helpers. Pass false from callers that poll or
+     * only read non-secret fields (dashboard diagnostics, host/port lookup):
+     * `secretSources` still reports `command`, but the secrets resolve to
+     * undefined/null and `tiers` stays empty unless explicit.
+     */
+    readonly resolveSecrets?: boolean;
+    /**
+     * Skip the `tiers` array entirely. The `--local` fallback sets this after a
+     * cloud credential failure: it reloads with `NR_AI_MODE=local`, and a
+     * `tiers` array under local mode is otherwise a config error.
+     */
+    readonly ignoreTiers?: boolean;
+}
+export declare function loadMcpConfig(cliOptions?: Partial<CliOptions>, loadOptions?: LoadMcpConfigOptions): Readonly<McpServerConfig>;
 export interface ConfigValidationResult {
     readonly filePath: string;
     readonly fileExists: boolean;
@@ -285,7 +345,7 @@ export interface ConfigValidationResult {
     readonly storagePath?: string;
     /** The `companionMode` field from the parsed config, if present and a boolean. */
     readonly companionMode?: boolean;
-    /** True when a non-blank licenseKey is present in the parsed config. Raw value is intentionally not exposed. */
+    /** True when a non-blank licenseKey or a licenseKeyCommand is present in the parsed config. Raw value is intentionally not exposed. */
     readonly hasLicenseKey: boolean;
     /** Fatal problems that will prevent the MCP server from starting. */
     readonly errors: readonly string[];
@@ -299,4 +359,17 @@ export interface ConfigValidationResult {
  */
 export declare function validateConfigFile(filePath: string): ConfigValidationResult;
 export declare function redactSensitive(value: string, patterns?: readonly RegExp[]): string;
+/**
+ * redactSensitive() for identifiers (project_id, repo_url, repo names), which
+ * carry a token only as a whole path segment or a segment's prefix. A match that
+ * starts right after a letter or digit is part of an ordinary name
+ * (`acme/risk-assessment-…` holds `sk-assessment-…`) and is left alone. The scan
+ * resumes one character later, so a token further into that span
+ * (`acme/risk-ghp_…`) is still caught.
+ *
+ * Free-form content keeps redactSensitive()'s plain matching: there a token
+ * routinely follows a letter or digit, after a JSON escape (`\nghp_…`), an ANSI
+ * colour code (`ESC[32m`) or `%3A`.
+ */
+export declare function redactIdentifier(value: string): string;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAMjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAI9D,eAAO,MAAM,WAAW,qCAAsC,CAAC;AAC/D,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhD,MAAM,MAAM,mBAAmB,GAC7B,0BAA0B,GAAG,aAAa,GAAG,kCAAkC,GAAG,SAAS,CAAC;AAE9F,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;CACtC;AAYD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,SAAS,EAAE,OAAO,GAAG,SAAS,GAC7B,qBAAqB,CAkBvB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,oFAAoF;IACpF,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,2GAA2G;IAC3G,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAClF,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,cAAc,EAAE,SAAS,cAAc,EAAE,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,+GAA+G;IAC/G,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,qGAAqG;IACrG,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,uBAAuB,EAAE,uBAAuB,CAAC;IAC1D,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACnD,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,GAAG,MAAM,CAAC;QACtD,2DAA2D;QAC3D,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;QAClC,4DAA4D;QAC5D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,2EAA2E;QAC3E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC;;;;WAIG;QACH,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QACxC;;;;WAIG;QACH,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;KAC3D,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;KAC/B,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;QAC3C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;QAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;CACH;AAED,eAAO,MAAM,oBAAoB,QAA4C,CAAC;AAgB9E,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,gBAAgB,GAAG,cAAc,CAAC;AAE1E,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+Gb,CAAC;AAGjB,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOrD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAe1D;AAuSD;;;;GAIG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,YAAY,EAAE,YAAY,GAAG,WAAW,CAAC;IAClD,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;gBAER,YAAY,EAAE,YAAY,GAAG,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM;CAYzF;AAED,wBAAgB,aAAa,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC,eAAe,CAAC,CA4xBzF;AAMD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,gHAAgH;IAChH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAyH3E;AAoCD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CASnF"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAMjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EACL,kBAAkB,EAInB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAkB,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIzE,eAAO,MAAM,WAAW,qCAAsC,CAAC;AAC/D,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhD,MAAM,MAAM,mBAAmB,GAC7B,0BAA0B,GAAG,aAAa,GAAG,kCAAkC,GAAG,SAAS,CAAC;AAE9F,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;CACtC;AA4BD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,GAAG,eAAe,CAAC,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CA6BnC;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,SAAS,EAAE,OAAO,GAAG,SAAS,GAC7B,qBAAqB,CAkBvB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,oFAAoF;IACpF,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,2GAA2G;IAC3G,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,2FAA2F;IAC3F,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAClD,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAClF,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,cAAc,EAAE,SAAS,cAAc,EAAE,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,0DAA0D;IAC1D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,+GAA+G;IAC/G,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,qGAAqG;IACrG,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,uBAAuB,EAAE,uBAAuB,CAAC;IAC1D,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACnD,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,GAAG,MAAM,CAAC;QACtD,2DAA2D;QAC3D,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;QAClC,4DAA4D;QAC5D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,2EAA2E;QAC3E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC;;;;WAIG;QACH,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QACxC;;;;WAIG;QACH,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;KAC3D,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;KAC/B,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;QAC3C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;QAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;CACH;AAED,eAAO,MAAM,oBAAoB,QAA4C,CAAC;AAgB9E,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,gBAAgB,GAAG,cAAc,CAAC;AAI1E,eAAO,MAAM,mBAAmB,yBAAoC,CAAC;AAErE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmHb,CAAC;AAGjB,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOrD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAe1D;AAuSD;;;;GAIG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,YAAY,EAAE,YAAY,GAAG,WAAW,CAAC;IAClD,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;gBAER,YAAY,EAAE,YAAY,GAAG,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM;CAYzF;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,kBAAkB;IAC7D,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;gBAER,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI;CAMrD;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,kBAAkB,GAAG,eAAe,CAAC,GAClE,MAAM,GAAG,SAAS,CAIpB;AAED,wEAAwE;AACxE,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,kBAAkB,GAAG,eAAe,CAAC,GAClE,KAAK,GAAG,SAAS,GAAG,SAAS,CAK/B;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,wBAAgB,aAAa,CAC3B,UAAU,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,EAChC,WAAW,GAAE,oBAAyB,GACrC,QAAQ,CAAC,eAAe,CAAC,CAm2B3B;AAMD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,uIAAuI;IACvI,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CA2H3E;AAoCD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CASnF;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAyBtD"}

package/dist/config.js

@@ -9,6 +9,7 @@ import { REDACTION_PATTERNS as DEFAULT_REDACTION_PATTERNS } from './redaction-pa
 import { resolveRecordContent } from './record-content-gate.js';
 import { projectIdFromRemote, stripRemoteCredentials } from './lib/git-remote.js';
 import { validateTiers, DEFAULT_TIER_NAME, WILDCARD_EVENT_TYPE } from './transport/tier-types.js';
+import { SecretCommandError, isSecretConfigured, resolveSecret, resolveSecretCommand, } from './secret-command.js';
 const logger = createLogger('mcp-config');
 export const VALID_MODES = ['cloud', 'local', 'both'];
 function otlpEndpointIsNewRelic(endpoint) {
@@ -22,6 +23,55 @@ function otlpEndpointIsNewRelic(endpoint) {
         return false;
     }
 }
+const SDK_DEFAULT_OTLP_HTTP_ENDPOINT = 'http://localhost:4318';
+const SDK_DEFAULT_OTLP_GRPC_ENDPOINT = 'http://localhost:4317';
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '::1']);
+const WILDCARD_HOSTS = new Set(['0.0.0.0', '::']);
+function bareHost(host) {
+    return host.replace(/^\[|\]$/g, '');
+}
+function reachesReceiverHost(clientHost, bindAddress) {
+    const client = bareHost(clientHost);
+    const bind = bareHost(bindAddress);
+    if (client === bind)
+        return true;
+    return LOOPBACK_HOSTS.has(client) && (LOOPBACK_HOSTS.has(bind) || WILDCARD_HOSTS.has(bind));
+}
+/**
+ * Detects the setup where companion mode is off yet Claude Code's cost metrics
+ * reach New Relic through Preflight's receiver, so New Relic counts cost twice.
+ * Deliberately imprecise, and used only for a `preflight doctor` warning:
+ * auto-enabling companion mode on this signal would drop cost from New Relic
+ * whenever the proxy is not actually forwarding.
+ */
+export function findReceiverDoubleCount(env, config) {
+    const { receiverEnabled, receiverPort, receiverBindAddress, forwardEndpoint } = config.otlp;
+    if (config.companionMode ||
+        !receiverEnabled ||
+        !otlpEndpointIsNewRelic(forwardEndpoint ?? undefined)) {
+        return null;
+    }
+    const exporters = (env.OTEL_METRICS_EXPORTER ?? '').split(',').map((e) => e.trim());
+    if (parseEnvBool(env.CLAUDE_CODE_ENABLE_TELEMETRY) !== true || !exporters.includes('otlp')) {
+        return null;
+    }
+    const protocol = env.OTEL_EXPORTER_OTLP_METRICS_PROTOCOL || env.OTEL_EXPORTER_OTLP_PROTOCOL;
+    const grpc = protocol === 'grpc';
+    const endpoint = env.OTEL_EXPORTER_OTLP_METRICS_ENDPOINT ||
+        env.OTEL_EXPORTER_OTLP_ENDPOINT ||
+        (grpc ? SDK_DEFAULT_OTLP_GRPC_ENDPOINT : SDK_DEFAULT_OTLP_HTTP_ENDPOINT);
+    try {
+        const url = new URL(endpoint.includes('://') ? endpoint : `http://${endpoint}`);
+        const port = Number(url.port || (url.protocol === 'https:' ? 443 : 80));
+        if (port !== receiverPort || !reachesReceiverHost(url.hostname, receiverBindAddress)) {
+            return null;
+        }
+    }
+    catch {
+        return null;
+    }
+    return { grpc };
+}
 /**
  * Companion mode only prevents double-counting when Claude Code's own OTel
  * metrics also land in New Relic. Detection requires an nr-data.net endpoint:
@@ -59,6 +109,9 @@ const DEFAULT_RETAIN_SESSIONS_DAYS = 90;
  * rather than a breaking rename — so this has never moved past 1.
  */
 const CURRENT_CONFIG_VERSION = 1;
+// argv array only: a single string would invite shell-style quoting that
+// Preflight never interprets, since the command runs without a shell.
+export const SecretCommandSchema = z.array(z.string().min(1)).min(1);
 export const ConfigFileSchema = z
     .object({
     configVersion: z.number().int().optional(),
@@ -77,6 +130,7 @@ export const ConfigFileSchema = z
     recordContent: z.boolean().optional(),
     pricingRefresh: z.boolean().optional(),
     companionMode: z.boolean().optional(),
+    allowHeadlessInstall: z.boolean().optional(),
     storagePath: z.string().optional(),
     hookBufferPath: z.string().optional(),
     harvestEventsMs: z.number().optional(),
@@ -94,6 +148,9 @@ export const ConfigFileSchema = z
     // generic union-mismatch issue.
     tiers: z.array(z.unknown()).optional(),
     nrApiKey: z.string().nullable().optional(),
+    licenseKeyCommand: SecretCommandSchema.optional(),
+    nrApiKeyCommand: SecretCommandSchema.optional(),
+    digestWebhookUrlCommand: SecretCommandSchema.optional(),
     customPricingFile: z.string().nullable().optional(),
     costRateMultiplier: z.number().nullable().optional(),
     dataResidencyPremium: z.boolean().optional(),
@@ -494,7 +551,40 @@ export class MissingCloudCredentialError extends Error {
         this.mode = mode;
     }
 }
-export function loadMcpConfig(cliOptions) {
+/**
+ * A `SecretCommandError` raised while resolving a secret that cloud export
+ * needs. It keeps the helper's own message for stdio users and adds the mode
+ * the config asked for, so `--local` can tell a failing helper from a missing
+ * credential and still fall back to local mode.
+ */
+export class CloudSecretCommandError extends SecretCommandError {
+    mode;
+    constructor(original, mode) {
+        super(original.field, original.failure);
+        this.message = original.message;
+        this.cause = original;
+        this.mode = mode;
+    }
+}
+/**
+ * The startup-resolved digest webhook URL when a source that outranks the
+ * file's `digestWebhookUrl` (env var or digestWebhookUrlCommand) supplied it.
+ * Undefined means "read the file at send time".
+ */
+export function digestWebhookUrlOverride(config) {
+    return digestWebhookUrlOverrideSource(config)
+        ? (config.digestWebhookUrl ?? undefined)
+        : undefined;
+}
+/** Which source is overriding the file's `digestWebhookUrl`, if any. */
+export function digestWebhookUrlOverrideSource(config) {
+    const source = config.secretSources.digestWebhookUrl;
+    return (source === 'env' || source === 'command') && config.digestWebhookUrl !== null
+        ? source
+        : undefined;
+}
+export function loadMcpConfig(cliOptions, loadOptions = {}) {
+    const skipCommand = loadOptions.resolveSecrets === false;
     const configFilePath = cliOptions?.config ?? resolve(DEFAULT_STORAGE_PATH, 'config.json');
     const file = loadConfigFile(configFilePath);
     // Warn (don't crash) when the user's config file contains keys we don't
@@ -578,11 +668,17 @@ export function loadMcpConfig(cliOptions) {
             });
         }
     }
-    // --- licenseKey: CLI has no flag for this, so env > file ---
-    // Hoisted ahead of mode resolution: an ambiguous licenseKey-without-mode
-    // config must fail closed instead of silently defaulting to 'cloud'.
-    const licenseKeyRaw = process.env.NEW_RELIC_LICENSE_KEY ??
-        (typeof file.licenseKey === 'string' ? file.licenseKey : undefined);
+    // --- licenseKey: CLI has no flag for this, so env > licenseKeyCommand > file ---
+    // Presence is checked ahead of mode resolution: an ambiguous
+    // licenseKey-without-mode config must fail closed instead of silently
+    // defaulting to 'cloud'. The command itself runs only after mode resolves,
+    // so a local-mode process never runs it.
+    const licenseKeySources = {
+        env: process.env.NEW_RELIC_LICENSE_KEY,
+        command: file.licenseKeyCommand,
+        file: typeof file.licenseKey === 'string' ? file.licenseKey : undefined,
+    };
+    const licenseKeyConfigured = isSecretConfigured(licenseKeySources);
     // --- Resolve mode early so we can gate licenseKey/accountId requirements ---
     // File mode is already validated by the zod schema in loadConfigFile.
     const isValidMode = (v) => v !== undefined && VALID_MODES.includes(v);
@@ -598,7 +694,7 @@ export function loadMcpConfig(cliOptions) {
     else if (fileMode !== undefined) {
         mode = fileMode;
     }
-    else if (licenseKeyRaw) {
+    else if (licenseKeyConfigured) {
         // Local-first default (README): telemetry export is opt-in, so a config
         // with credentials but no explicit mode must not silently export.
         throw new Error('Config has a licenseKey but no explicit mode. Telemetry export is opt-in: set "mode": "cloud" (or "both") in the config file, set NR_AI_MODE, or remove the credentials for local-only use. Previous versions implicitly defaulted to cloud.');
@@ -606,7 +702,19 @@ export function loadMcpConfig(cliOptions) {
     else {
         mode = 'local';
     }
-    if (mode !== 'local' && !licenseKeyRaw) {
+    let licenseKeySecret;
+    try {
+        licenseKeySecret = resolveSecret('licenseKey', mode === 'local' ? { ...licenseKeySources, command: undefined } : licenseKeySources, { skipCommand });
+    }
+    catch (err) {
+        if (err instanceof SecretCommandError)
+            throw new CloudSecretCommandError(err, mode);
+        throw err;
+    }
+    const licenseKeyRaw = licenseKeySecret.value;
+    if (mode !== 'local' &&
+        !licenseKeyRaw &&
+        !(skipCommand && licenseKeySecret.source === 'command')) {
         throw new MissingCloudCredentialError('licenseKey', mode, configFilePath);
     }
     // Reject the literal string "null" — it's truthy but not a valid key
@@ -617,8 +725,8 @@ export function loadMcpConfig(cliOptions) {
     }
     // In local mode, undefined if licenseKey is missing (NR transport won't be used)
     const licenseKey = licenseKeyRaw;
-    // --- accountId: env > file ---
-    const accountIdRaw = process.env.NEW_RELIC_ACCOUNT_ID ??
+    // --- accountId: env > file; a blank env var counts as unset, as for the secrets ---
+    const accountIdRaw = (process.env.NEW_RELIC_ACCOUNT_ID?.trim() ? process.env.NEW_RELIC_ACCOUNT_ID : undefined) ??
         (typeof file.accountId === 'string' ? file.accountId : undefined);
     if (mode !== 'local' && !accountIdRaw) {
         throw new MissingCloudCredentialError('accountId', mode, configFilePath);
@@ -632,9 +740,7 @@ export function loadMcpConfig(cliOptions) {
     // --- tiers: config file only (no env var / CLI flag equivalent exists) ---
     // Fail closed on tiers-under-local BEFORE validating tier shape, so the
     // mode conflict is always the reported error even for a malformed array.
-    const rawTiers = Array.isArray(file.tiers)
-        ? file.tiers
-        : undefined;
+    const rawTiers = Array.isArray(file.tiers) && !loadOptions.ignoreTiers ? file.tiers : undefined;
     let resolvedTiers;
     if (rawTiers !== undefined) {
         if (mode === 'local') {
@@ -642,7 +748,24 @@ export function loadMcpConfig(cliOptions) {
                 'Multi-tier telemetry routing fans out the cloud export path, so it requires ' +
                 "mode='cloud' or mode='both'. Remove the tiers array for local-only use, or set the mode.");
         }
-        resolvedTiers = validateTiers(rawTiers);
+        try {
+            resolvedTiers = validateTiers(rawTiers, {
+                resolveLicenseKey: skipCommand
+                    ? undefined
+                    : (tier, argv) => resolveSecretCommand('licenseKey', argv, undefined, tier),
+            });
+        }
+        catch (err) {
+            if (err instanceof SecretCommandError)
+                throw new CloudSecretCommandError(err, mode);
+            throw err;
+        }
+        // A tier whose key was never read has no usable destination, so none are
+        // reported; the caller asked not to run helpers.
+        if (skipCommand &&
+            resolvedTiers.some((t) => t.destination.type === 'nr' && t.destination.licenseKey === '')) {
+            resolvedTiers = [];
+        }
     }
     else if (mode !== 'local' && licenseKey !== undefined && accountId !== undefined) {
         // Implicit single tier — byte-identical to the existing single-tier default.
@@ -662,8 +785,9 @@ export function loadMcpConfig(cliOptions) {
         (typeof file.storagePath === 'string' ? file.storagePath : DEFAULT_STORAGE_PATH);
     // highSecurity must be resolved before recordContent so it can override it
     const highSecurity = envBool('NEW_RELIC_AI_HIGH_SECURITY', typeof file.highSecurity === 'boolean' ? file.highSecurity : false);
-    const resolvedProjectId = sanitizeOrgField(process.env.NEW_RELIC_AI_PROJECT_ID ??
-        (typeof file.projectId === 'string' ? file.projectId : inferProjectId()));
+    const rawProjectId = process.env.NEW_RELIC_AI_PROJECT_ID ??
+        (typeof file.projectId === 'string' ? file.projectId : inferProjectId());
+    const resolvedProjectId = sanitizeOrgField(rawProjectId === null ? null : redactIdentifier(rawProjectId));
     // Dedicated opt-out, independent of projectId's — repo_url can carry an
     // internal git host that org/repo alone doesn't, so it gets its own toggle
     // rather than riding along on projectId's. Defaults on; the setup wizard
@@ -677,17 +801,32 @@ export function loadMcpConfig(cliOptions) {
     const rawRepoUrl = process.env.NEW_RELIC_AI_REPO_URL ??
         (typeof file.repoUrl === 'string' ? file.repoUrl : getGitRemoteUrl());
     // stripRemoteCredentials drops URL userinfo and query strings;
-    // redactSensitive then catches any token elsewhere in the value.
+    // redactIdentifier then catches any token elsewhere in the value.
     const strippedRepoUrl = stripRemoteCredentials(rawRepoUrl);
-    const resolvedRepoUrl = sanitizeOrgField(strippedRepoUrl === null ? null : redactSensitive(strippedRepoUrl));
+    const resolvedRepoUrl = sanitizeOrgField(strippedRepoUrl === null ? null : redactIdentifier(strippedRepoUrl));
     const resolvedCompanionMode = resolveCompanionMode(process.env, typeof file.companionMode === 'boolean' ? file.companionMode : undefined);
     logger.info('Companion mode resolved', {
         value: resolvedCompanionMode.value,
         source: resolvedCompanionMode.source,
     });
+    const nrApiKeySecret = resolveSecret('nrApiKey', {
+        env: process.env.NEW_RELIC_API_KEY,
+        command: mode === 'local' ? undefined : file.nrApiKeyCommand,
+        file: typeof file.nrApiKey === 'string' ? file.nrApiKey : undefined,
+    }, { optional: true, skipCommand });
+    const digestWebhookUrlSecret = resolveSecret('digestWebhookUrl', {
+        env: process.env.NEW_RELIC_AI_DIGEST_WEBHOOK_URL,
+        command: file.digestWebhookUrlCommand,
+        file: typeof file.digestWebhookUrl === 'string' ? file.digestWebhookUrl : undefined,
+    }, { optional: true, skipCommand });
     const config = {
         licenseKey,
         accountId,
+        secretSources: {
+            licenseKey: licenseKeySecret.source,
+            nrApiKey: nrApiKeySecret.source,
+            digestWebhookUrl: digestWebhookUrlSecret.source,
+        },
         configVersion: typeof file.configVersion === 'number' ? file.configVersion : CURRENT_CONFIG_VERSION,
         appName: process.env.NEW_RELIC_AI_MCP_APP_NAME ??
             (typeof file.appName === 'string' ? file.appName : 'preflight'),
@@ -707,6 +846,10 @@ export function loadMcpConfig(cliOptions) {
             ? false
             : envBool('NEW_RELIC_AI_PRICING_REFRESH', typeof file.pricingRefresh === 'boolean' ? file.pricingRefresh : true),
         companionMode: resolvedCompanionMode.value,
+        companionModeSource: resolvedCompanionMode.source,
+        allowHeadlessInstall: highSecurity
+            ? false
+            : envBool('NEW_RELIC_AI_ALLOW_HEADLESS_INSTALL', typeof file.allowHeadlessInstall === 'boolean' ? file.allowHeadlessInstall : false),
         redactionPatterns: DEFAULT_REDACTION_PATTERNS,
         hookBufferPath: process.env.NEW_RELIC_AI_MCP_BUFFER_PATH ??
             (typeof file.hookBufferPath === 'string'
@@ -772,7 +915,7 @@ export function loadMcpConfig(cliOptions) {
         collectorHost: resolveCollectorHost(licenseKey, process.env.NEW_RELIC_HOST ??
             (typeof file.collectorHost === 'string' ? file.collectorHost : null)),
         proxyUpstreams: parseProxyUpstreams(process.env.NEW_RELIC_AI_MCP_PROXY_UPSTREAMS, file.proxyUpstreams),
-        nrApiKey: process.env.NEW_RELIC_API_KEY ?? (typeof file.nrApiKey === 'string' ? file.nrApiKey : null),
+        nrApiKey: nrApiKeySecret.value ?? null,
         customPricingFile: process.env.NEW_RELIC_AI_CUSTOM_PRICING_FILE ??
             (typeof file.customPricingFile === 'string' ? file.customPricingFile : null),
         costRateMultiplier: (() => {
@@ -789,8 +932,7 @@ export function loadMcpConfig(cliOptions) {
                 : null;
         })(),
         dataResidencyPremium: envBool('NEW_RELIC_AI_DATA_RESIDENCY_PREMIUM', typeof file.dataResidencyPremium === 'boolean' ? file.dataResidencyPremium : false),
-        digestWebhookUrl: process.env.NEW_RELIC_AI_DIGEST_WEBHOOK_URL ??
-            (typeof file.digestWebhookUrl === 'string' ? file.digestWebhookUrl : null),
+        digestWebhookUrl: digestWebhookUrlSecret.value ?? null,
         digestSchedule: process.env.NEW_RELIC_AI_DIGEST_SCHEDULE ??
             (typeof file.digestSchedule === 'string' ? file.digestSchedule : '0 9 * * 1'),
         retainSessionsDays: (() => {
@@ -1177,7 +1319,8 @@ export function validateConfigFile(filePath) {
         mode: typeof file.mode === 'string' ? file.mode : undefined,
         storagePath: typeof file.storagePath === 'string' ? file.storagePath : undefined,
         companionMode: typeof file.companionMode === 'boolean' ? file.companionMode : undefined,
-        hasLicenseKey: typeof file.licenseKey === 'string' && file.licenseKey.trim().length > 0,
+        hasLicenseKey: (typeof file.licenseKey === 'string' && file.licenseKey.trim().length > 0) ||
+            Array.isArray(file.licenseKeyCommand),
         errors,
         warnings,
     };
@@ -1224,4 +1367,40 @@ export function redactSensitive(value, patterns) {
     }
     return result;
 }
+const WORD_CHAR_RE = /[A-Za-z0-9]/;
+/**
+ * redactSensitive() for identifiers (project_id, repo_url, repo names), which
+ * carry a token only as a whole path segment or a segment's prefix. A match that
+ * starts right after a letter or digit is part of an ordinary name
+ * (`acme/risk-assessment-…` holds `sk-assessment-…`) and is left alone. The scan
+ * resumes one character later, so a token further into that span
+ * (`acme/risk-ghp_…`) is still caught.
+ *
+ * Free-form content keeps redactSensitive()'s plain matching: there a token
+ * routinely follows a letter or digit, after a JSON escape (`\nghp_…`), an ANSI
+ * colour code (`ESC[32m`) or `%3A`.
+ */
+export function redactIdentifier(value) {
+    let result = value;
+    for (const pattern of DEFAULT_REDACTION_PATTERNS) {
+        const re = new RegExp(pattern.source, pattern.flags.includes('g') ? pattern.flags : `${pattern.flags}g`);
+        let out = '';
+        let last = 0;
+        let match;
+        while ((match = re.exec(result)) !== null) {
+            if (match[0] === '') {
+                re.lastIndex++;
+                continue;
+            }
+            if (match.index > 0 && WORD_CHAR_RE.test(result[match.index - 1])) {
+                re.lastIndex = match.index + 1;
+                continue;
+            }
+            out += `${result.slice(last, match.index)}[REDACTED]`;
+            last = re.lastIndex;
+        }
+        result = out + result.slice(last);
+    }
+    return result;
+}
 //# sourceMappingURL=config.js.map