@oisincoveney/pipeline 1.13.0 → 1.14.0

package/defaults/install-manifest.json

@@ -5,71 +5,5 @@
       "source": "oisincoveney/skills",
       "args": ["--agent", "codex", "--skill", "*", "--yes", "--copy"]
     }
-  ],
-  "mcps": [
-    {
-      "name": "oisin-pipeline-backlog",
-      "transport": "stdio",
-      "command": "backlog",
-      "args": ["mcp", "start"]
-    },
-    {
-      "name": "oisin-pipeline-context7",
-      "transport": "remote",
-      "catalog": "context7"
-    },
-    {
-      "name": "oisin-pipeline-github-readonly",
-      "transport": "stdio",
-      "command": "docker",
-      "args": [
-        "run",
-        "-i",
-        "--rm",
-        "-e",
-        "GITHUB_PERSONAL_ACCESS_TOKEN",
-        "ghcr.io/github/github-mcp-server",
-        "stdio",
-        "--read-only"
-      ],
-      "env": {
-        "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_PERSONAL_ACCESS_TOKEN}"
-      }
-    },
-    {
-      "name": "oisin-pipeline-playwright",
-      "transport": "stdio",
-      "catalog": "playwright"
-    },
-    {
-      "name": "oisin-pipeline-qdrant",
-      "transport": "remote",
-      "url": "https://memory-mcp.momokaya.ee/mcp/",
-      "optionalRegistration": true,
-      "headers": {
-        "Authorization": {
-          "sources": [{ "env": "MEMORY_MCP_BASIC_AUTH", "prefix": "Basic " }]
-        }
-      }
-    },
-    {
-      "name": "oisin-pipeline-semgrep",
-      "transport": "stdio",
-      "command": "docker",
-      "args": ["run", "-i", "--rm", "ghcr.io/semgrep/mcp", "-t", "stdio"]
-    },
-    {
-      "name": "oisin-pipeline-serena",
-      "transport": "stdio",
-      "command": "uvx",
-      "args": [
-        "--from",
-        "git+https://github.com/oraios/serena",
-        "serena",
-        "start-mcp-server",
-        "--project-from-cwd",
-        "--context=codex"
-      ]
-    }
   ]
 }

package/dist/config.d.ts

@@ -194,6 +194,16 @@ declare const configSchema: z.ZodObject<{
     timeout_ms: z.ZodOptional<z.ZodNumber>;
     trusted: z.ZodOptional<z.ZodBoolean>;
   }, z.core.$strict>>>;
+  mcp_gateway: z.ZodOptional<z.ZodObject<{
+    default_profile: z.ZodOptional<z.ZodString>;
+    mode: z.ZodEnum<{
+      hosted: "hosted";
+      local: "local";
+    }>;
+    provider: z.ZodLiteral<"toolhive">;
+    token_env: z.ZodDefault<z.ZodString>;
+    url_env: z.ZodDefault<z.ZodString>;
+  }, z.core.$strict>>;
   mcp_servers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
     args: z.ZodOptional<z.ZodArray<z.ZodString>>;
     bearer_token_env_var: z.ZodOptional<z.ZodString>;
@@ -247,6 +257,7 @@ declare const configSchema: z.ZodObject<{
     runner: z.ZodString;
     skills: z.ZodOptional<z.ZodArray<z.ZodString>>;
     tools: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+      task: "task";
       read: "read";
       list: "list";
       grep: "grep";
@@ -254,7 +265,6 @@ declare const configSchema: z.ZodObject<{
       bash: "bash";
       edit: "edit";
       write: "write";
-      task: "task";
     }>>>;
   }, z.core.$strict>>>;
   rules: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -282,6 +292,7 @@ declare const configSchema: z.ZodObject<{
       rules: z.ZodOptional<z.ZodBoolean>;
       skills: z.ZodOptional<z.ZodBoolean>;
       tools: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        task: "task";
         read: "read";
         list: "list";
         grep: "grep";
@@ -289,7 +300,6 @@ declare const configSchema: z.ZodObject<{
         bash: "bash";
         edit: "edit";
         write: "write";
-        task: "task";
       }>>>;
     }, z.core.$strict>;
     command: z.ZodOptional<z.ZodString>;

package/dist/config.js

@@ -1,5 +1,4 @@
 import { resolveFileReference } from "./path-refs.js";
-import { parseJson } from "./safe-json.js";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { parseDocument } from "yaml";
@@ -55,6 +54,7 @@ const RETRY_REASONS = [
 	"timeout"
 ];
 const SCHEDULE_BASELINES = ["epic", "pipe"];
+const PIPELINE_GATEWAY_SERVER_ID = "pipeline-gateway";
 var PipelineConfigError = class extends Error {
 	code;
 	issues;
@@ -126,21 +126,13 @@ const mcpServerSchema = z.object({
 		path: ["bearer_token_env_var"]
 	});
 });
-const mcpServerRefSchema = z.object({
-	format: z.literal("mcp-json").default("mcp-json"),
-	id: z.string().min(1).optional(),
-	path: z.string().min(1)
+const mcpGatewaySchema = z.object({
+	default_profile: z.string().min(1).optional(),
+	mode: z.enum(["hosted", "local"]),
+	provider: z.literal("toolhive"),
+	token_env: z.string().min(1).default("PIPELINE_MCP_GATEWAY_TOKEN"),
+	url_env: z.string().min(1).default("PIPELINE_MCP_GATEWAY_URL")
 }).strict();
-const mcpServerDefinitionSchema = z.union([mcpServerSchema, z.object({ ref: mcpServerRefSchema }).strict()]);
-const mcpJsonServerSchema = z.object({
-	args: z.array(z.string()).optional(),
-	bearer_token_env_var: z.string().min(1).optional(),
-	command: z.string().min(1).optional(),
-	env: z.record(z.string(), z.string()).optional(),
-	headers: z.record(z.string(), z.string()).optional(),
-	url: z.string().min(1).optional()
-}).passthrough();
-const mcpJsonFileSchema = z.object({ mcpServers: strictRecord(mcpJsonServerSchema) }).passthrough();
 const instructionsSchema = z.object({
 	inline: z.string().min(1).optional(),
 	path: z.string().min(1).optional()
@@ -327,7 +319,8 @@ const runnersFileSchema = z.object({
 	version: z.literal(1)
 }).strict();
 const profilesFileSchema = z.object({
-	mcp_servers: strictRecord(mcpServerDefinitionSchema).default({}),
+	mcp_gateway: mcpGatewaySchema.optional(),
+	mcp_servers: strictRecord(z.never()).default({}),
 	profiles: strictRecord(profileSchema).default({}),
 	rules: strictRecord(pathRefSchema).default({}),
 	skills: strictRecord(pathRefSchema).default({}),
@@ -347,6 +340,7 @@ const configSchema = z.object({
 	default_workflow: z.string(),
 	entrypoints: strictRecord(entrypointSchema).default({}),
 	hooks: strictRecord(hookSchema).default({}),
+	mcp_gateway: mcpGatewaySchema.optional(),
 	mcp_servers: strictRecord(mcpServerSchema).default({}),
 	orchestrator: orchestratorSchema,
 	profiles: strictRecord(profileSchema).default({}),
@@ -464,12 +458,12 @@ function parsePipelineConfigParts(sources, projectRoot, sourcePaths = {
 	const runners = parseYamlAs(sources.runners, sourcePaths.runners, runnersFileSchema);
 	const profiles = parseYamlAs(sources.profiles, sourcePaths.profiles, profilesFileSchema);
 	const pipeline = parseYamlAs(sources.pipeline, sourcePaths.pipeline, pipelineFileSchema);
-	const mcpServers = resolveMcpServerDefinitions(profiles.mcp_servers, projectRoot);
 	return validatePipelineConfig({
 		default_workflow: pipeline.default_workflow,
 		entrypoints: pipeline.entrypoints,
 		hooks: pipeline.hooks,
-		mcp_servers: mcpServers,
+		...profiles.mcp_gateway ? { mcp_gateway: profiles.mcp_gateway } : {},
+		mcp_servers: profiles.mcp_servers,
 		orchestrator: pipeline.orchestrator,
 		profiles: profiles.profiles,
 		rules: profiles.rules,
@@ -497,61 +491,6 @@ function parseYamlAs(source, sourcePath, schema) {
 	})));
 	return parsed.data;
 }
-function resolveMcpServerDefinitions(registry, projectRoot) {
-	return Object.fromEntries(Object.entries(registry).map(([id, definition]) => [id, "ref" in definition ? resolveMcpServerRef(id, definition.ref, projectRoot) : definition]));
-}
-function resolveMcpServerRef(id, ref, projectRoot) {
-	if (!projectRoot) throw validationError([{
-		path: `mcp_servers.${id}.ref.path`,
-		message: "MCP server refs require a project root"
-	}]);
-	const filePath = resolveFileReference(projectRoot, ref.path);
-	if (!existsSync(filePath)) throw validationError([{
-		path: `mcp_servers.${id}.ref.path`,
-		message: `referenced MCP config file '${ref.path}' does not exist`
-	}]);
-	const parsed = parseMcpJsonFile(id, ref, filePath);
-	const importedId = ref.id ?? id;
-	const imported = parsed.mcpServers[importedId];
-	if (!imported) throw validationError([{
-		path: `mcp_servers.${id}.ref.id`,
-		message: `MCP config '${ref.path}' does not declare server '${importedId}'`
-	}]);
-	const normalized = normalizeMcpJsonServer(imported);
-	const result = mcpServerSchema.safeParse(normalized);
-	if (!result.success) throw validationError(result.error.issues.map((issue) => ({
-		path: [`mcp_servers.${id}.ref`, ...issue.path].join("."),
-		message: issue.message
-	})));
-	return result.data;
-}
-function parseMcpJsonFile(id, ref, filePath) {
-	let raw;
-	try {
-		raw = parseJson(readFileSync(filePath, "utf8"), `MCP config ${ref.path}`);
-	} catch (err) {
-		throw new PipelineConfigError("PIPELINE_CONFIG_PARSE_ERROR", `Failed to parse MCP config ${ref.path}`, [{
-			path: `mcp_servers.${id}.ref.path`,
-			message: err instanceof Error ? err.message : String(err)
-		}]);
-	}
-	const parsed = mcpJsonFileSchema.safeParse(raw);
-	if (!parsed.success) throw validationError(parsed.error.issues.map((issue) => ({
-		path: [`mcp_servers.${id}.ref`, ...issue.path].join("."),
-		message: issue.message
-	})));
-	return parsed.data;
-}
-function normalizeMcpJsonServer(server) {
-	return {
-		...server.command ? { command: server.command } : {},
-		...server.args ? { args: server.args } : {},
-		...server.env ? { env: server.env } : {},
-		...server.url ? { url: server.url } : {},
-		...server.headers ? { headers: server.headers } : {},
-		...server.bearer_token_env_var ? { bearer_token_env_var: server.bearer_token_env_var } : {}
-	};
-}
 function validatePipelineConfig(rawConfig, projectRoot, options = {}) {
 	const parsed = configSchema.safeParse(rawConfig);
 	if (!parsed.success) throw validationError(parsed.error.issues.map((issue) => ({
@@ -629,7 +568,10 @@ function validateActor(label, path, actor, runner, config, issues, projectRoot,
 	validatePath(`${path}.instructions.path`, actor.instructions.path, projectRoot, issues, options);
 	validateReferences(`${path}.rules`, actor.rules, config.rules, "rule", issues);
 	validateReferences(`${path}.skills`, actor.skills, config.skills, "skill", issues);
-	validateReferences(`${path}.mcp_servers`, actor.mcp_servers, config.mcp_servers, "MCP server", issues);
+	validateReferences(`${path}.mcp_servers`, actor.mcp_servers, config.mcp_gateway ? {
+		...config.mcp_servers,
+		[PIPELINE_GATEWAY_SERVER_ID]: {}
+	} : config.mcp_servers, "MCP server", issues);
 	validateBooleanCapability(`${path}.rules`, actor.rules, runner.capabilities.rules, "rules", issues);
 	validateBooleanCapability(`${path}.skills`, actor.skills, runner.capabilities.skills, "skills", issues);
 	validateBooleanCapability(`${path}.mcp_servers`, actor.mcp_servers, runner.capabilities.mcp_servers, "MCP servers", issues);

package/dist/index.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { PipelineConfigError, loadPipelineConfig, tryLoadPipelineConfig } from "./config.js";
+import { configureGatewayHosts, localGatewayStatus, renderGatewayConfig, runGatewayDoctor, startLocalGateway } from "./mcp/gateway.js";
 import { compileWorkflowPlan } from "./workflow-planner.js";
 import { formatInstallCommandsResult, installCommands, parseCommandHost } from "./install-commands.js";
 import { createOrchestratorLaunchPlan, createRunnerLaunchPlan } from "./runner.js";
 import { formatConfigError, runPipelineFromConfig } from "./pipeline-runtime.js";
 import { runKubernetesRunnerJob } from "./kubernetes-runner.js";
-import { DEFAULT_MCPM_ARGS } from "./mcp/bootstrap.js";
 import { formatPipelineInitResult, initPipelineProject } from "./pipeline-init.js";
 import { compileScheduleArtifact, generateScheduleArtifact, parseScheduleArtifact } from "./schedule-planner.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
@@ -191,6 +191,7 @@ const BUILTIN_PIPE_COMMANDS = new Set([
 	"doctor",
 	"init",
 	"install-commands",
+	"mcp",
 	"runner-job"
 ]);
 function createCliProgram() {
@@ -225,6 +226,39 @@ function createCliProgram() {
 		console.log(formatDoctorResult(result));
 		if (!result.passed) throw new Error("Doctor checks failed.");
 	});
+	const gatewayCommand = program.command("mcp").description("Manage the hosted-first MCP gateway").command("gateway").description("Inspect and configure the pipeline MCP gateway");
+	gatewayCommand.command("doctor").description("Check MCP gateway configuration and legacy direct MCP entries").action(async () => {
+		const cwd = process.env.PIPELINE_TARGET_PATH ?? process.cwd();
+		const result = await runGatewayDoctor(loadPipelineConfig(cwd, { allowMissingLintFileReferences: true }), cwd);
+		console.log(formatDoctorResult(result));
+		if (!result.passed) throw new Error("MCP gateway doctor checks failed.");
+	});
+	gatewayCommand.command("config").description("Print resolved MCP gateway client configuration").action(() => {
+		const config = loadPipelineConfig(process.env.PIPELINE_TARGET_PATH ?? process.cwd(), { allowMissingLintFileReferences: true });
+		console.log(renderGatewayConfig(config));
+	});
+	gatewayCommand.command("configure-host").description("Rewrite host MCP config to the singleton pipeline gateway").addOption(new Option("--host <host>", "host config to update").choices([
+		"all",
+		"opencode",
+		"codex"
+	]).default("all").argParser(parseCommandHost)).addOption(new Option("--scope <scope>", "config scope to update").choices(["project", "global"]).default("project").argParser(parseGatewayHostScope)).action((flags) => {
+		const cwd = process.env.PIPELINE_TARGET_PATH ?? process.cwd();
+		const result = configureGatewayHosts(loadPipelineConfig(cwd, { allowMissingLintFileReferences: true }), {
+			cwd,
+			host: flags.host ?? "all",
+			scope: flags.scope ?? "project"
+		});
+		console.log(result.map((item) => [`${item.host}: ${item.path}`, item.backupPath ? `backup=${item.backupPath}` : "backup=none"].join(" ")).join("\n"));
+	});
+	gatewayCommand.command("local-start").description("Start a local ToolHive vMCP gateway for local mode").option("--detach", "reserved for future background startup", false).action(async (flags) => {
+		if (flags.detach) throw new Error("Detached local gateway startup is not implemented.");
+		const cwd = process.env.PIPELINE_TARGET_PATH ?? process.cwd();
+		await startLocalGateway(loadPipelineConfig(cwd, { allowMissingLintFileReferences: true }), cwd);
+	});
+	gatewayCommand.command("local-status").description("Show local ToolHive MCP server status").action(async () => {
+		const cwd = process.env.PIPELINE_TARGET_PATH ?? process.cwd();
+		console.log(await localGatewayStatus(cwd));
+	});
 	program.command("init").description("Scaffold the default .pipeline/pipeline.yaml workflow").option("--overwrite", "replace existing pipeline scaffold files", false).action(async (flags) => {
 		const result = await initPipelineProject({
 			cwd: process.env.PIPELINE_TARGET_PATH ?? process.cwd(),
@@ -276,6 +310,10 @@ function registerConfiguredEntrypointCommands(program, config) {
 	}
 	return registered;
 }
+function parseGatewayHostScope(value) {
+	if (value === "project" || value === "global") return value;
+	throw new Error("scope must be project or global");
+}
 function lintPipelineConfig(config, projectRoot) {
 	return [
 		...lintShadowedEntrypoints(config),
@@ -364,10 +402,8 @@ function shouldParsePipeArgsDirectly(program, firstArg) {
 async function runDoctor(cwd) {
 	const commandChecks = await Promise.all([
 		checkCommand("npx", ["--version"], cwd),
-		checkCommand("backlog", ["--version"], cwd),
-		checkCommand("uvx", ["--version"], cwd),
-		checkCommandWithRunner("mcpm-cli", "uvx", [...DEFAULT_MCPM_ARGS, "--version"], cwd),
-		checkCommand("codex", ["--version"], cwd)
+		checkCommand("codex", ["--version"], cwd),
+		checkCommand("opencode", ["--version"], cwd)
 	]);
 	const configCheck = checkPipelineConfig(cwd);
 	const checks = [...commandChecks, configCheck];

package/dist/mcp/bootstrap.js

@@ -1,97 +1,15 @@
 import { parseJson } from "../safe-json.js";
 import { readFileSync } from "node:fs";
 import { z } from "zod";
-import { execa } from "execa";
 //#region src/mcp/bootstrap.ts
-var PipelineMcpInstallError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "PipelineMcpInstallError";
-	}
-};
-var PipelineMcpMissingCredentialError = class extends PipelineMcpInstallError {
-	headerName;
-	missingEnv;
-	serverName;
-	constructor(serverName, headerName, missingEnv) {
-		super([`MCP server ${serverName} requires ${headerName} credentials before it can be registered.`, `Set ${missingEnv.join(" or ")} and re-run pipeline init.`].join("\n"));
-		this.name = "PipelineMcpMissingCredentialError";
-		this.serverName = serverName;
-		this.headerName = headerName;
-		this.missingEnv = missingEnv;
-	}
-};
 var PipelineDefaultManifestError = class extends Error {
 	constructor(message) {
 		super(message);
 		this.name = "PipelineDefaultManifestError";
 	}
 };
-const DEFAULT_MCPM_ARGS = [
-	"--python",
-	"3.12",
-	"mcpm"
-];
 const DEFAULT_INSTALL_MANIFEST_URL = new URL("../../defaults/install-manifest.json", import.meta.url);
-const pipelineMcpHeaderSourceSchema = z.object({
-	env: z.string().min(1),
-	prefix: z.string().optional(),
-	suffix: z.string().optional()
-}).strict();
-const pipelineMcpHeaderValueSchema = z.union([z.string(), z.object({ sources: z.array(pipelineMcpHeaderSourceSchema).min(1) }).strict()]);
-const pipelineMcpInstallSpecSchema = z.object({
-	args: z.array(z.string()).optional(),
-	catalog: z.string().min(1).optional(),
-	command: z.string().min(1).optional(),
-	env: z.record(z.string(), z.string()).optional(),
-	headers: z.record(z.string(), pipelineMcpHeaderValueSchema).optional(),
-	name: z.string().min(1),
-	optionalRegistration: z.boolean().optional(),
-	transport: z.enum(["remote", "stdio"]),
-	url: z.string().url().optional()
-}).strict().superRefine((spec, ctx) => {
-	if (spec.catalog) return;
-	if (spec.transport === "remote") {
-		if (!spec.url) ctx.addIssue({
-			code: "custom",
-			message: "remote MCP install spec must declare url or catalog",
-			path: ["url"]
-		});
-		if (spec.command) ctx.addIssue({
-			code: "custom",
-			message: "remote MCP install spec cannot declare command",
-			path: ["command"]
-		});
-		if (spec.args) ctx.addIssue({
-			code: "custom",
-			message: "remote MCP install spec cannot declare args",
-			path: ["args"]
-		});
-		if (spec.env) ctx.addIssue({
-			code: "custom",
-			message: "remote MCP install spec cannot declare env",
-			path: ["env"]
-		});
-		return;
-	}
-	if (!spec.command) ctx.addIssue({
-		code: "custom",
-		message: "stdio MCP install spec must declare command or catalog",
-		path: ["command"]
-	});
-	if (spec.headers) ctx.addIssue({
-		code: "custom",
-		message: "stdio MCP install spec cannot declare headers",
-		path: ["headers"]
-	});
-	if (spec.url) ctx.addIssue({
-		code: "custom",
-		message: "stdio MCP install spec cannot declare url",
-		path: ["url"]
-	});
-});
 const defaultInstallManifestSchema = z.object({
-	mcps: z.array(pipelineMcpInstallSpecSchema),
 	skills: z.array(z.object({
 		args: z.array(z.string()).optional(),
 		source: z.string().min(1)
@@ -104,135 +22,6 @@ function loadDefaultInstallManifest() {
 	if (!parsed.success) throw new PipelineDefaultManifestError(["Invalid defaults/install-manifest.json.", ...parsed.error.issues.map((issue) => [issue.path.join("."), issue.message].filter(Boolean).join(": "))].join("\n"));
 	return parsed.data;
 }
-const DEFAULT_INSTALL_MANIFEST = loadDefaultInstallManifest();
-const DEFAULT_MCP_INSTALLS = DEFAULT_INSTALL_MANIFEST.mcps;
-const DEFAULT_SKILL_INSTALLS = DEFAULT_INSTALL_MANIFEST.skills;
-function defaultMcpJson() {
-	return `${JSON.stringify({ mcpServers: Object.fromEntries([
-		["backlog", "oisin-pipeline-backlog"],
-		["context7", "oisin-pipeline-context7"],
-		["github-readonly", "oisin-pipeline-github-readonly"],
-		["playwright", "oisin-pipeline-playwright"],
-		["qdrant", "oisin-pipeline-qdrant"],
-		["semgrep", "oisin-pipeline-semgrep"],
-		["serena", "oisin-pipeline-serena"]
-	].map(([server, installName]) => [server, {
-		args: [
-			...DEFAULT_MCPM_ARGS,
-			"run",
-			installName
-		],
-		command: "uvx"
-	}])) }, null, 2)}\n`;
-}
-async function installDefaultMcpsWithCli(specs, cwd) {
-	const skipped = [];
-	for (const spec of specs) {
-		const install = mcpInstallArgs(spec);
-		if ("skipped" in install) {
-			skipped.push(install.skipped);
-			continue;
-		}
-		try {
-			await execa("uvx", [...DEFAULT_MCPM_ARGS, ...install.args], {
-				cwd,
-				env: {
-					MCPM_FORCE: "true",
-					MCPM_JSON_OUTPUT: "true",
-					MCPM_NON_INTERACTIVE: "true"
-				},
-				stdin: "ignore"
-			});
-		} catch (err) {
-			const error = err;
-			throw new PipelineMcpInstallError([
-				`Failed to register MCP server ${spec.name} with MCPM.`,
-				"Pipeline init runs MCPM through `uvx --python 3.12 mcpm`.",
-				"Install uv/uvx from https://docs.astral.sh/uv/ and re-run pipeline init.",
-				redactMcpInstallOutput(error.shortMessage, install.redactions),
-				redactMcpInstallOutput(error.stderr, install.redactions),
-				redactMcpInstallOutput(error.stdout, install.redactions)
-			].filter(Boolean).join("\n"));
-		}
-	}
-	return { skipped };
-}
-function mcpInstallArgs(spec) {
-	if (spec.catalog) return {
-		args: [
-			"install",
-			spec.catalog,
-			"--force",
-			"--alias",
-			spec.name
-		],
-		redactions: []
-	};
-	const args = [
-		"new",
-		spec.name,
-		"--type",
-		spec.transport,
-		"--force"
-	];
-	if (spec.transport === "remote") {
-		if (!spec.url) throw new PipelineMcpInstallError(`MCP server ${spec.name} is remote but has no url.`);
-		const redactions = [];
-		try {
-			const headers = Object.entries(spec.headers ?? {}).flatMap(([key, value]) => {
-				const headerValue = resolveMcpHeaderValue(spec.name, key, value);
-				redactions.push(headerValue);
-				return ["--headers", `${key}=${headerValue}`];
-			});
-			return {
-				args: [
-					...args,
-					"--url",
-					spec.url,
-					...headers
-				],
-				redactions
-			};
-		} catch (err) {
-			if (spec.optionalRegistration && err instanceof PipelineMcpMissingCredentialError) return { skipped: {
-				missingEnv: err.missingEnv,
-				name: spec.name,
-				reason: `missing ${err.headerName} credentials`
-			} };
-			throw err;
-		}
-	}
-	if (!spec.command) throw new PipelineMcpInstallError(`MCP server ${spec.name} is stdio but has no command.`);
-	return {
-		args: [
-			...args,
-			"--command",
-			spec.command,
-			...spec.args?.length ? ["--args", spec.args.join(" ")] : [],
-			...Object.entries(spec.env ?? {}).flatMap(([key, value]) => ["--env", `${key}=${value}`])
-		],
-		redactions: []
-	};
-}
-const MCP_CREDENTIAL_PATTERN = /^\S+\s+(.+)$/;
-function redactMcpInstallOutput(value, redactions) {
-	if (!value) return value;
-	const sensitiveValues = redactions.flatMap((item) => {
-		const trimmed = item.trim();
-		const credential = trimmed.match(MCP_CREDENTIAL_PATTERN)?.[1]?.trim();
-		return credential ? [trimmed, credential] : [trimmed];
-	}).filter((item) => item.length > 0);
-	const escaped = [...new Set(sensitiveValues)].sort((a, b) => b.length - a.length).map((item) => item.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
-	const sensitivePattern = escaped.length > 0 ? new RegExp(escaped.join("|"), "g") : null;
-	return (sensitivePattern ? value.replace(sensitivePattern, "[REDACTED]") : value).replace(/Authorization=[^\r\n'"]+/gi, "Authorization=[REDACTED]");
-}
-function resolveMcpHeaderValue(serverName, headerName, header) {
-	if (typeof header === "string") return header;
-	for (const source of header.sources ?? []) {
-		const rawValue = process.env[source.env];
-		if (rawValue && rawValue.trim().length > 0) return `${source.prefix ?? ""}${rawValue}${source.suffix ?? ""}`;
-	}
-	throw new PipelineMcpMissingCredentialError(serverName, headerName, header.sources.map((source) => source.env));
-}
+const DEFAULT_SKILL_INSTALLS = loadDefaultInstallManifest().skills;
 //#endregion
-export { DEFAULT_MCPM_ARGS, DEFAULT_MCP_INSTALLS, DEFAULT_SKILL_INSTALLS, defaultMcpJson, installDefaultMcpsWithCli };
+export { DEFAULT_SKILL_INSTALLS };