@orchid-labs/pluxx 0.1.0 → 0.1.1

package/src/cli/index.ts

@@ -13,10 +13,12 @@ import {
   runAgentPlan,
   type AgentPromptKind,
   type AgentRunner,
+  type AgentRunnerModelSummary,
 } from './agent'
-import { doctorProject, printDoctorReport } from './doctor'
+import { doctorConsumer, doctorProject, printDoctorReport } from './doctor'
 import {
   ensureHookTrust,
+  getInstallFollowupNotes,
   installPlugin,
   listHookCommands,
   planInstallPlugin,
@@ -29,6 +31,7 @@ import {
   analyzeMcpQuality,
   applyMcpScaffoldPlan,
   buildToolExampleRequest,
+  deriveDisplayName,
   derivePluginName,
   MCP_HOOK_MODES,
   MCP_RUNTIME_AUTH_MODES,
@@ -42,18 +45,26 @@ import {
   writeMcpScaffold,
 } from './init-from-mcp'
 import { migrate } from './migrate'
+import { runMcpProxy } from './mcp-proxy'
 import { lintProject, printLintResult, runLint } from './lint'
-import { introspectMcpServer, McpIntrospectionError } from '../mcp/introspect'
+import {
+  discoverMcpAuthFromError,
+  introspectMcpServer,
+  McpIntrospectionError,
+  type IntrospectedMcpServer,
+} from '../mcp/introspect'
 import { promptText, promptYesNo, PromptCancelledError } from './prompt'
 import * as clack from '@clack/prompts'
 import type { McpAuth, McpServer, TargetPlatform } from '../schema'
-import { basename } from 'path'
+import { basename, resolve } from 'path'
 import { mkdir, mkdtemp, rm } from 'fs/promises'
 import { tmpdir } from 'os'
+import { spawn } from 'child_process'
 import { formatSyncSummary, planSyncFromMcp, syncFromMcp } from './sync-from-mcp'
 import { formatPublishPlan, planPublish, runPublish } from './publish'
-import { createCliRuntime, createSpinner, printJson, readMultiValueOption, readOption } from './runtime'
+import { createCliRuntime, createSpinner, printJson, readFlag, readMultiValueOption, readOption } from './runtime'
 import { printTestResult, runTestSuite, type TestRunResult } from './test'
+import { printEvalReport, runEvalSuite } from './eval'
 
 const args = process.argv.slice(2)
 const command = args[0]
@@ -86,6 +97,7 @@ export interface InitFromMcpOptions {
   authHeader?: string
   authTemplate?: string
   runtimeAuth?: string
+  oauthWrapper: boolean
   grouping?: string
   hooks?: string
   transport?: string
@@ -122,6 +134,7 @@ interface AutopilotSummary {
   source: string
   mode: AutopilotMode
   runner: AgentRunner
+  model: AgentRunnerModelSummary
   targets: TargetPlatform[]
   toolCount: number
   grouping: McpSkillGrouping
@@ -204,6 +217,9 @@ export async function main() {
     case 'agent':
       await runAgent()
       break
+    case 'mcp':
+      await runMcp()
+      break
     case 'autopilot':
       await runAutopilot()
       break
@@ -228,6 +244,9 @@ export async function main() {
     case 'test':
       await runTestCommand()
       break
+    case 'eval':
+      await runEvalCommand()
+      break
     case undefined:
     case 'help':
     case '--help':
@@ -349,6 +368,59 @@ function formatDuration(durationMs?: number): string | undefined {
   return `${(durationMs / 1000).toFixed(durationMs >= 10_000 ? 0 : 1)}s`
 }
 
+interface InstallActionSummary {
+  enabled: boolean
+  platforms: TargetPlatform[]
+  notes: string[]
+  installTargets: Array<{
+    platform: TargetPlatform
+    pluginDir: string
+    built: boolean
+    existing: boolean
+  }>
+}
+
+async function maybeInstallBuiltOutputs(
+  config: Awaited<ReturnType<typeof loadConfig>>,
+  platforms: TargetPlatform[],
+): Promise<InstallActionSummary | undefined> {
+  if (!args.includes('--install')) {
+    return undefined
+  }
+
+  const distDir = `${process.cwd()}/${config.outDir}`
+  const installPlan = planInstallPlugin(distDir, config.name, platforms)
+
+  if (!runtime.dryRun) {
+    await ensureHookTrust({
+      pluginName: config.name,
+      hooks: config.hooks,
+      trust: args.includes('--trust'),
+      isTTY: runtime.isInteractive,
+    })
+    const resolvedUserConfig = await resolveInstallUserConfig(config, platforms, {
+      isTTY: runtime.isInteractive,
+    })
+    await installPlugin(distDir, config.name, platforms, {
+      config,
+      quiet: true,
+      resolvedUserConfig,
+    })
+  }
+
+  return {
+    enabled: true,
+    platforms,
+    notes: getInstallFollowupNotes(platforms),
+    installTargets: installPlan.map((target) => ({
+      platform: target.platform,
+      pluginDir: target.description,
+      built: target.built,
+      existing: target.existing,
+    })),
+  }
+}
+
 function logAutopilotRunnerWait(step: number, totalSteps: number, label: string, runner: AgentRunner): void {
   if (runtime.jsonOutput || runtime.quiet || !runtime.isInteractive) {
     return
@@ -393,13 +465,17 @@ async function runBuild() {
   const targets = parseTargetFlagValues(args)
   const config = await loadConfig()
   const platforms = targets ?? config.targets
+  const cwd = process.cwd()
+  const shouldInstall = args.includes('--install')
 
   if (runtime.dryRun) {
+    const install = await maybeInstallBuiltOutputs(config, platforms)
     const summary = {
       dryRun: true,
       targets: platforms,
       outDir: config.outDir,
       outputPaths: platforms.map((platform) => `${config.outDir}/${platform}/`),
+      install,
     }
     if (runtime.jsonOutput) {
       printJson(summary)
@@ -414,7 +490,27 @@ async function runBuild() {
     console.log(`Building for: ${platforms.join(', ')}`)
   }
 
-  await build(config, process.cwd(), { targets })
+  const lintResult = await lintProject(cwd, { targets: platforms })
+  if (lintResult.errors > 0) {
+    if (runtime.jsonOutput) {
+      printJson({
+        ok: false,
+        reason: 'lint-errors',
+        lint: lintResult,
+      })
+    } else {
+      printLintResult(lintResult, cwd)
+      console.error('Build aborted due to lint errors.')
+    }
+    process.exit(1)
+  }
+
+  if (!runtime.jsonOutput && !runtime.quiet && lintResult.warnings > 0) {
+    printLintResult(lintResult, cwd)
+  }
+
+  await build(config, cwd, { targets })
+  const install = await maybeInstallBuiltOutputs(config, platforms)
 
   if (runtime.jsonOutput) {
     printJson({
@@ -422,6 +518,8 @@ async function runBuild() {
       targets: platforms,
       outDir: config.outDir,
       outputPaths: platforms.map((platform) => `${config.outDir}/${platform}/`),
+      lint: lintResult,
+      install,
     })
     return
   }
@@ -431,6 +529,15 @@ async function runBuild() {
     for (const platform of platforms) {
       console.log(`  ${config.outDir}/${platform}/`)
     }
+    if (shouldInstall && install) {
+      console.log('Installed for local testing:')
+      for (const target of install.installTargets) {
+        console.log(`  ${target.platform} -> ${target.pluginDir}`)
+      }
+      for (const note of install.notes) {
+        console.log(note)
+      }
+    }
   }
 }
 
@@ -561,9 +668,120 @@ function defaultHookMode(source: { auth?: { type: string; envVar?: string }; tra
   return 'none'
 }
 
-export function resolveRemoteAuthType(options: Pick<InitFromMcpOptions, 'authType' | 'authHeader'>): 'bearer' | 'header' {
+interface McpAuthProviderHint {
+  id: 'linear' | 'generic-oauth'
+  label: string
+  envVar: string
+  tokenLabel: string
+  tokenAuthType: 'bearer' | 'header'
+  authHeader?: string
+  authTemplate?: string
+  wrapperCommand?: string
+  guidance?: string
+}
+
+function getSourceUrl(source: McpServer): string | undefined {
+  return source.transport === 'stdio' ? undefined : source.url
+}
+
+function collectAuthCandidateUrls(
+  source: McpServer,
+  discoveredAuth?: ReturnType<typeof discoverMcpAuthFromError> | null,
+): string[] {
+  return [
+    getSourceUrl(source),
+    discoveredAuth?.authorizationUrl,
+    discoveredAuth?.resourceMetadataUrl,
+  ].filter((value): value is string => Boolean(value))
+}
+
+function matchesHost(urlValue: string, suffix: string): boolean {
+  try {
+    return new URL(urlValue).hostname.endsWith(suffix)
+  } catch {
+    return false
+  }
+}
+
+export function buildOauthWrapperCommand(source: McpServer): string | undefined {
+  if (source.transport !== 'http') return undefined
+  return `npx -y mcp-remote ${source.url}`
+}
+
+export function buildOauthWrapperSource(source: McpServer): McpServer | undefined {
+  if (source.transport !== 'http') return undefined
+  return {
+    transport: 'stdio',
+    command: 'npx',
+    args: ['-y', 'mcp-remote', source.url],
+  }
+}
+
+export function inferMcpAuthProvider(
+  source: McpServer,
+  discoveredAuth?: ReturnType<typeof discoverMcpAuthFromError> | null,
+): McpAuthProviderHint | null {
+  const candidates = collectAuthCandidateUrls(source, discoveredAuth)
+  if (candidates.some((value) => matchesHost(value, 'linear.app'))) {
+    return {
+      id: 'linear',
+      label: 'Linear',
+      envVar: 'LINEAR_API_KEY',
+      tokenLabel: 'API key or OAuth token',
+      tokenAuthType: 'bearer',
+      authTemplate: 'Bearer ${value}',
+      wrapperCommand: buildOauthWrapperCommand(source),
+      guidance: 'Linear supports direct Authorization: Bearer tokens/API keys and the official mcp-remote wrapper for clients that do not support remote MCP.',
+    }
+  }
+
+  if (discoveredAuth?.kind === 'platform') {
+    return {
+      id: 'generic-oauth',
+      label: 'OAuth-first MCP',
+      envVar: 'OAUTH_ACCESS_TOKEN',
+      tokenLabel: 'access token or API key',
+      tokenAuthType: 'bearer',
+      authTemplate: 'Bearer ${value}',
+      wrapperCommand: buildOauthWrapperCommand(source),
+    }
+  }
+
+  return null
+}
+
+function defaultAuthEnvVar(
+  provider: McpAuthProviderHint | null,
+  discoveredAuth?: ReturnType<typeof discoverMcpAuthFromError> | null,
+): string {
+  if (provider?.envVar) return provider.envVar
+  if (discoveredAuth?.kind === 'header') return 'API_KEY'
+  if (discoveredAuth?.kind === 'platform') return 'OAUTH_ACCESS_TOKEN'
+  return ''
+}
+
+function tryOpenBrowser(url: string): boolean {
+  const launcher = process.platform === 'darwin'
+    ? { command: 'open', args: [url] }
+    : process.platform === 'win32'
+      ? { command: 'cmd', args: ['/c', 'start', '', url] }
+      : { command: 'xdg-open', args: [url] }
+
+  try {
+    const child = spawn(launcher.command, launcher.args, {
+      detached: true,
+      stdio: 'ignore',
+    })
+    child.unref()
+    return true
+  } catch {
+    return false
+  }
+}
+
+export function resolveRemoteAuthType(options: Pick<InitFromMcpOptions, 'authType' | 'authHeader'>): 'bearer' | 'header' | 'platform' {
   if (options.authType) {
-    return parseChoiceOption(options.authType, ['bearer', 'header'] as const, 'Auth type')
+    return parseChoiceOption(options.authType, ['bearer', 'header', 'platform'] as const, 'Auth type')
   }
 
   if (options.authHeader && options.authHeader.trim() && options.authHeader.trim().toLowerCase() !== 'authorization') {
@@ -574,11 +792,25 @@ export function resolveRemoteAuthType(options: Pick<InitFromMcpOptions, 'authTyp
 }
 
 export function buildRemoteAuthConfig(options: Pick<InitFromMcpOptions, 'authEnv' | 'authType' | 'authHeader' | 'authTemplate'>): McpAuth | undefined {
+  if (options.authType?.trim() === 'platform') {
+    return {
+      type: 'platform',
+      mode: 'oauth',
+    }
+  }
+
   const envVar = options.authEnv?.trim()
   if (!envVar) return undefined
 
   const authType = resolveRemoteAuthType(options)
 
+  if (authType === 'platform') {
+    return {
+      type: 'platform',
+      mode: 'oauth',
+    }
+  }
+
   if (authType === 'header') {
     const headerName = options.authHeader?.trim()
     if (!headerName) {
@@ -657,40 +889,82 @@ function isAuthRequiredError(error: unknown): error is McpIntrospectionError {
 }
 
 function isLikelyOAuthFirstError(error: McpIntrospectionError): boolean {
-  const message = error.message.toLowerCase()
-  const wwwAuthenticate = error.context?.responseHeaders?.['www-authenticate']?.toLowerCase() ?? ''
-  const location = error.context?.responseHeaders?.location?.toLowerCase() ?? ''
-  const body = error.context?.responseBodySnippet?.toLowerCase() ?? ''
-  const responseUrl = error.context?.responseUrl?.toLowerCase() ?? ''
-
-  return message.includes('oauth')
-    || wwwAuthenticate.includes('oauth')
-    || wwwAuthenticate.includes('authorization_uri=')
-    || location.includes('oauth')
-    || location.includes('authorize')
-    || location.includes('login')
-    || responseUrl.includes('oauth')
-    || responseUrl.includes('authorize')
-    || responseUrl.includes('login')
-    || body.includes('oauth')
-    || body.includes('authorize')
-}
-
-function formatAuthRequiredMessage(commandName: 'init' | 'autopilot', error?: McpIntrospectionError): string {
-  const rerun = `Re-run ${commandName} with --auth-env YOUR_ENV_VAR and either:
+  return discoverMcpAuthFromError(error)?.kind === 'platform'
+}
+
+function formatAuthRequiredMessage(
+  commandName: 'init' | 'autopilot',
+  error?: McpIntrospectionError,
+  source?: McpServer,
+): string {
+  const discoveredAuth = error ? discoverMcpAuthFromError(error) : null
+  const provider = source ? inferMcpAuthProvider(source, discoveredAuth) : null
+  const rerun = discoveredAuth?.kind === 'header' && discoveredAuth.headerName
+    ? `Re-run ${commandName} with --auth-env YOUR_ENV_VAR --auth-type header --auth-header ${discoveredAuth.headerName} [--auth-template '\${value}']`
+    : `Re-run ${commandName} with --auth-env YOUR_ENV_VAR and either:
 - Bearer auth: --auth-type bearer
 - Custom header auth: --auth-type header --auth-header HEADER_NAME [--auth-template '\${value}']`
-  const oauthNote = error && isLikelyOAuthFirstError(error)
+  const providerNote = provider?.guidance ? `\n\n${provider.guidance}` : ''
+  const wrapperNote = provider?.wrapperCommand
+    ? `\nLocal wrapper/proxy helper: ${provider.wrapperCommand}`
+    : ''
+  const oauthNote = discoveredAuth?.kind === 'platform'
     ? `
 
-This server appears OAuth-first. Complete the provider's OAuth flow first, export the resulting token/API key to YOUR_ENV_VAR, then rerun.
-If it requires browser-interactive OAuth during handshake, run a local stdio MCP wrapper/proxy and import that command instead.`
+This server appears OAuth-first${discoveredAuth.authorizationUrl ? ` (${discoveredAuth.authorizationUrl})` : ''}. Complete the provider's OAuth flow first, export the resulting token/API key to YOUR_ENV_VAR, then rerun.
+If the server supports public discovery and only needs OAuth at runtime, you can scaffold it with --auth-type platform --runtime-auth platform.
+If it requires browser-interactive OAuth during handshake, run a local stdio MCP wrapper/proxy and import that command instead.${wrapperNote}${providerNote}`
     : ''
 
   return `This MCP server requires authentication.
 ${rerun}${oauthNote}`
 }
 
+type OAuthImportStrategy = 'token' | 'wrapper'
+
+async function chooseOAuthImportStrategy(
+  provider: McpAuthProviderHint | null,
+): Promise<OAuthImportStrategy> {
+  const options: Array<{ value: OAuthImportStrategy; label: string; hint?: string }> = [
+    {
+      value: 'token',
+      label: 'token',
+      hint: `Complete auth in the browser, then continue with a ${provider?.tokenLabel ?? 'token or API key'}`,
+    },
+  ]
+
+  if (provider?.wrapperCommand) {
+    options.push({
+      value: 'wrapper',
+      label: 'wrapper',
+      hint: `Import through ${provider.wrapperCommand}`,
+    })
+  }
+
+  return await clackSelect('OAuth import path', options, provider?.wrapperCommand ? 'wrapper' : 'token')
+}
+
+async function maybeCaptureOAuthCredential(
+  provider: McpAuthProviderHint | null,
+  authorizationUrl?: string,
+): Promise<string | undefined> {
+  if (authorizationUrl) {
+    const opened = tryOpenBrowser(authorizationUrl)
+    const message = opened
+      ? `Opened ${authorizationUrl} in your browser. Finish the auth flow, then paste the resulting ${provider?.tokenLabel ?? 'token or API key'} below if you want Pluxx to retry immediately.`
+      : `Open ${authorizationUrl} in your browser. Finish the auth flow, then paste the resulting ${provider?.tokenLabel ?? 'token or API key'} below if you want Pluxx to retry immediately.`
+    clack.note(message, 'OAuth flow')
+  }
+
+  const credential = (await clackPassword(`Paste ${provider?.tokenLabel ?? 'token or API key'} for this session (optional)`)).trim()
+  return credential || undefined
+}
+
+function applySessionCredential(envVar: string | undefined, credential: string | undefined) {
+  if (!envVar || !credential) return
+  process.env[envVar] = credential
+}
+
 function buildInitSummary(input: {
   pluginName: string
   displayName: string
@@ -765,6 +1039,21 @@ function formatMcpQualityLines(report: McpQualityReport): string[] {
   return lines
 }
 
+function formatMcpDiscoverySummary(introspection: IntrospectedMcpServer): string {
+  const parts = [`${introspection.tools.length} tools`]
+  const resourceCount = (introspection.resources?.length ?? 0) + (introspection.resourceTemplates?.length ?? 0)
+  const promptCount = introspection.prompts?.length ?? 0
+
+  if (resourceCount > 0) {
+    parts.push(`${resourceCount} resources`)
+  }
+  if (promptCount > 0) {
+    parts.push(`${promptCount} prompts`)
+  }
+
+  return `${parts.join(', ')} discovered`
+}
+
 export function parseInitFromMcpOptions(rawArgs: string[], initialName?: string, initialSource?: string): InitFromMcpOptions {
   return {
     source: initialSource ?? readOption(rawArgs, '--from-mcp'),
@@ -778,6 +1067,7 @@ export function parseInitFromMcpOptions(rawArgs: string[], initialName?: string,
     authHeader: readOption(rawArgs, '--auth-header'),
     authTemplate: readOption(rawArgs, '--auth-template'),
     runtimeAuth: readOption(rawArgs, '--runtime-auth'),
+    oauthWrapper: rawArgs.includes('--oauth-wrapper'),
     grouping: readOption(rawArgs, '--grouping'),
     hooks: readOption(rawArgs, '--hooks'),
     transport: readOption(rawArgs, '--transport'),
@@ -978,6 +1268,7 @@ async function runInitFromMcp(initialName?: string, initialSource?: string) {
     }
 
     let source = parseMcpSourceInput(rawSource, options.transport)
+    let introspectionSource = source
     const configuredRemoteAuth = source.transport === 'stdio'
       ? undefined
       : buildRemoteAuthConfig(options)
@@ -993,55 +1284,114 @@ async function runInitFromMcp(initialName?: string, initialSource?: string) {
 
     let introspection
     try {
-      introspection = await introspectMcpServer(source)
+      introspection = await introspectMcpServer(introspectionSource)
     } catch (error) {
       if (source.transport !== 'stdio' && isAuthRequiredError(error)) {
+        const discoveredAuth = error instanceof McpIntrospectionError ? discoverMcpAuthFromError(error) : null
+        const provider = inferMcpAuthProvider(source, discoveredAuth)
         s?.stop('Server requires authentication')
-        const envVar = options.authEnv ?? (interactive
-          ? await clackText('Auth env var for this MCP server')
-          : '')
-        if (!envVar) {
-          throw new Error(formatAuthRequiredMessage('init', error))
-        }
-
+        let envVar = options.authEnv
         let authType = options.authType
         let authHeader = options.authHeader
         let authTemplate = options.authTemplate
+        let usedOauthWrapper = false
+
+        if (!usedOauthWrapper && discoveredAuth?.kind === 'platform' && (interactive || options.oauthWrapper)) {
+          const strategy = options.oauthWrapper
+            ? 'wrapper'
+            : interactive
+              ? await chooseOAuthImportStrategy(provider)
+              : 'token'
+
+          if (strategy === 'wrapper') {
+            const wrapperSource = buildOauthWrapperSource(source)
+            if (!wrapperSource) {
+              throw new Error(formatAuthRequiredMessage('init', error, source))
+            }
+            introspectionSource = wrapperSource
+            runtimeAuthMode = 'platform'
+            s?.start('Step 1/4 · Reconnecting via local wrapper...')
+            try {
+              introspection = await introspectMcpServer(introspectionSource)
+              usedOauthWrapper = true
+            } catch (wrapperError) {
+              if (isAuthRequiredError(wrapperError)) {
+                throw new Error(`Wrapper-based OAuth import failed.
+${formatAuthRequiredMessage('init', wrapperError, source)}`)
+              }
+              throw new Error(`MCP introspection failed via local wrapper: ${wrapperError instanceof Error ? wrapperError.message : String(wrapperError)}`)
+            }
+          }
+        }
 
-        if (interactive && !authType) {
-          authType = await clackSelect<'bearer' | 'header'>('Auth type', [
-            { value: 'bearer', label: 'bearer', hint: 'Authorization: Bearer <token>' },
-            { value: 'header', label: 'header', hint: 'Custom header such as X-API-Key' },
-          ], 'bearer')
+        if (!options.runtimeAuth && (discoveredAuth?.kind === 'platform' || usedOauthWrapper)) {
+          runtimeAuthMode = 'platform'
         }
 
-        if (resolveRemoteAuthType({ authType, authHeader }) === 'header') {
-          if (interactive && !authHeader) {
-            authHeader = await clackText('Auth header name', 'X-API-Key')
+        if (usedOauthWrapper) {
+          envVar = envVar ?? (interactive
+            ? await clackText('Auth env var for generated non-platform targets (optional)', defaultAuthEnvVar(provider, discoveredAuth))
+            : undefined)
+          source = {
+            ...source,
+            auth: envVar
+              ? buildRemoteAuthConfig({
+                  authEnv: envVar,
+                  authType: provider?.tokenAuthType ?? 'bearer',
+                  authHeader: provider?.authHeader,
+                  authTemplate: provider?.authTemplate,
+                })
+              : { type: 'platform', mode: 'oauth' },
           }
-          if (interactive && !authTemplate) {
-            authTemplate = await clackText('Auth header template', '${value}')
+        } else {
+          envVar = envVar ?? (interactive
+            ? await clackText('Auth env var for this MCP server', defaultAuthEnvVar(provider, discoveredAuth))
+            : '')
+          if (!envVar) {
+            throw new Error(formatAuthRequiredMessage('init', error, source))
           }
-        }
 
-        source = {
-          ...source,
-          auth: buildRemoteAuthConfig({
-            authEnv: envVar,
-            authType,
-            authHeader,
-            authTemplate,
-          }),
-        }
-        s?.start('Step 1/4 \u00b7 Reconnecting with auth...')
-        try {
-          introspection = await introspectMcpServer(source)
-        } catch (retryError) {
-          if (isAuthRequiredError(retryError)) {
-            throw new Error(`Authentication failed after retry.
-${formatAuthRequiredMessage('init', retryError)}`)
+          if (interactive && discoveredAuth?.kind === 'platform') {
+            const credential = await maybeCaptureOAuthCredential(provider, discoveredAuth.authorizationUrl)
+            applySessionCredential(envVar, credential)
+          }
+
+          if (interactive && !authType) {
+            authType = await clackSelect<'bearer' | 'header'>('Auth type', [
+              { value: 'bearer', label: 'bearer', hint: 'Authorization: Bearer <token>' },
+              { value: 'header', label: 'header', hint: 'Custom header such as X-API-Key' },
+            ], discoveredAuth?.kind === 'header' ? 'header' : (provider?.tokenAuthType ?? 'bearer'))
+          }
+
+          if (resolveRemoteAuthType({ authType, authHeader }) === 'header') {
+            if (interactive && !authHeader) {
+              authHeader = await clackText('Auth header name', discoveredAuth?.headerName ?? provider?.authHeader ?? 'X-API-Key')
+            }
+            if (interactive && !authTemplate) {
+              authTemplate = await clackText('Auth header template', provider?.authTemplate ?? '${value}')
+            }
+          }
+
+          source = {
+            ...source,
+            auth: buildRemoteAuthConfig({
+              authEnv: envVar,
+              authType,
+              authHeader,
+              authTemplate,
+            }),
+          }
+          introspectionSource = source
+          s?.start('Step 1/4 · Reconnecting with auth...')
+          try {
+            introspection = await introspectMcpServer(introspectionSource)
+          } catch (retryError) {
+            if (isAuthRequiredError(retryError)) {
+              throw new Error(`Authentication failed after retry.
+${formatAuthRequiredMessage('init', retryError, source)}`)
+            }
+            throw new Error(`MCP introspection failed after auth retry: ${retryError instanceof Error ? retryError.message : String(retryError)}`)
           }
-          throw new Error(`MCP introspection failed after auth retry: ${retryError instanceof Error ? retryError.message : String(retryError)}`)
         }
       } else {
         s?.stop('Connection failed')
@@ -1049,8 +1399,12 @@ ${formatAuthRequiredMessage('init', retryError)}`)
       }
     }
 
+    if (!introspection) {
+      throw new Error('MCP introspection did not return server metadata.')
+    }
+
     const serverLabel = introspection.serverInfo.title ?? introspection.serverInfo.name
-    s?.stop(`Connected: ${serverLabel} (${introspection.tools.length} tools discovered)`)
+    s?.stop(`Connected: ${serverLabel} (${formatMcpDiscoverySummary(introspection)})`)
     const quality = analyzeMcpQuality(introspection.tools)
 
     if (!options.jsonOutput && !runtime.quiet && quality.issues.length > 0) {
@@ -1081,6 +1435,7 @@ ${formatAuthRequiredMessage('init', retryError)}`)
       && source.auth.type !== 'none'
       && !options.runtimeAuth
     ) {
+      runtimeAuthMode = source.auth.type === 'platform' ? 'platform' : runtimeAuthMode
       runtimeAuthMode = await clackSelect<McpRuntimeAuthMode>('Claude/Cursor runtime auth', [
         { value: 'inline', label: 'inline', hint: 'Generate env/header auth directly into plugin output' },
         { value: 'platform', label: 'platform', hint: 'Use native platform-managed auth (for example OAuth/custom connector flows)' },
@@ -1099,7 +1454,7 @@ ${formatAuthRequiredMessage('init', retryError)}`)
         ? await clackText('Plugin name', defaultPluginName)
         : defaultPluginName),
     )
-    const defaultDisplayName = options.displayName ?? introspection.serverInfo.title ?? pluginName
+    const defaultDisplayName = options.displayName ?? deriveDisplayName(introspection, pluginName)
     const displayName = options.displayName ?? (interactive
       ? await clackText('Display name', defaultDisplayName)
       : defaultDisplayName)
@@ -1294,6 +1649,18 @@ async function clackText(message: string, defaultValue?: string): Promise<string
   return result
 }
 
+/** Wrapper for clack.password that handles cancellation. */
+async function clackPassword(message: string): Promise<string> {
+  const result = await clack.password({
+    message,
+    mask: '*',
+  })
+  if (clack.isCancel(result)) {
+    throw new PromptCancelledError()
+  }
+  return result
+}
+
 /** Wrapper for clack.select that handles cancellation. */
 async function clackSelect<T extends string>(
   message: string,
@@ -1347,7 +1714,12 @@ async function runSync() {
 }
 
 async function runDoctor() {
-  const report = await doctorProject(process.cwd())
+  const consumerMode = readFlag(args, '--consumer')
+  const doctorPath = args.slice(1).find((value) => !value.startsWith('-'))
+  const rootDir = doctorPath ? resolve(process.cwd(), doctorPath) : process.cwd()
+  const report = consumerMode
+    ? await doctorConsumer(rootDir)
+    : await doctorProject(rootDir)
 
   if (runtime.jsonOutput) {
     printJson(report)
@@ -1483,6 +1855,7 @@ async function runAgent() {
       pluginName: plan.pluginName,
       kind: plan.kind,
       runner: plan.runner,
+      model: plan.model,
       verify: plan.verify,
       command: plan.command,
       commandDisplay: plan.commandDisplay,
@@ -1500,6 +1873,7 @@ async function runAgent() {
       } else if (!runtime.quiet) {
         console.log(`Planned ${plan.kind} run for ${plan.pluginName}`)
         console.log(`  Runner: ${plan.runner}`)
+        console.log(`  Model: ${plan.model.display}`)
         console.log(`  Command: ${plan.commandDisplay}`)
       }
       return
@@ -1519,6 +1893,7 @@ async function runAgent() {
 
     if (!runtime.quiet) {
       console.log(`Completed ${result.kind} run for ${result.pluginName} via ${result.runner}`)
+      console.log(`  Model: ${result.model.display}`)
       if (!verboseRunner) {
         console.log('  Runner logs: suppressed (use --verbose-runner to stream)')
       }
@@ -1557,12 +1932,12 @@ async function runAutopilot() {
   let runtimeAuthMode = resolveRuntimeAuthMode(initOptions.runtimeAuth)
 
   if (!initOptions.source && !interactive) {
-    console.error(`Usage: pluxx autopilot --from-mcp <source> --runner <${AGENT_RUNNERS.join('|')}> [--mode <${AUTOPILOT_MODES.join('|')}>] [--name NAME] [--display-name NAME] [--author NAME] [--targets <platforms>] [--grouping workflow|tool] [--hooks none|safe] [--auth-env ENV] [--auth-type bearer|header] [--auth-header NAME] [--auth-template TEMPLATE] [--runtime-auth inline|platform] [--website URL] [--docs URL] [--context <files...>] [--review] [--no-verify] [--verbose-runner] [--json] [--dry-run] [--quiet]`)
+    console.error(`Usage: pluxx autopilot --from-mcp <source> --runner <${AGENT_RUNNERS.join('|')}> [--mode <${AUTOPILOT_MODES.join('|')}>] [--name NAME] [--display-name NAME] [--author NAME] [--targets <platforms>] [--grouping workflow|tool] [--hooks none|safe] [--auth-env ENV] [--auth-type bearer|header|platform] [--auth-header NAME] [--auth-template TEMPLATE] [--runtime-auth inline|platform] [--oauth-wrapper] [--website URL] [--docs URL] [--context <files...>] [--review] [--no-verify] [--verbose-runner] [--json] [--dry-run] [--quiet]`)
     process.exit(1)
   }
 
   if ((!runnerRaw || !AGENT_RUNNERS.includes(runnerRaw as AgentRunner)) && !interactive) {
-    console.error(`Usage: pluxx autopilot --from-mcp <source> --runner <${AGENT_RUNNERS.join('|')}> [--mode <${AUTOPILOT_MODES.join('|')}>] [--name NAME] [--display-name NAME] [--author NAME] [--targets <platforms>] [--grouping workflow|tool] [--hooks none|safe] [--auth-env ENV] [--auth-type bearer|header] [--auth-header NAME] [--auth-template TEMPLATE] [--runtime-auth inline|platform] [--website URL] [--docs URL] [--context <files...>] [--review] [--no-verify] [--verbose-runner] [--json] [--dry-run] [--quiet]`)
+    console.error(`Usage: pluxx autopilot --from-mcp <source> --runner <${AGENT_RUNNERS.join('|')}> [--mode <${AUTOPILOT_MODES.join('|')}>] [--name NAME] [--display-name NAME] [--author NAME] [--targets <platforms>] [--grouping workflow|tool] [--hooks none|safe] [--auth-env ENV] [--auth-type bearer|header|platform] [--auth-header NAME] [--auth-template TEMPLATE] [--runtime-auth inline|platform] [--oauth-wrapper] [--website URL] [--docs URL] [--context <files...>] [--review] [--no-verify] [--verbose-runner] [--json] [--dry-run] [--quiet]`)
     process.exit(1)
   }
 
@@ -1610,6 +1985,7 @@ async function runAutopilot() {
     }
 
     let source = parseMcpSourceInput(rawSource, initOptions.transport)
+    let introspectionSource = source
     const configuredRemoteAuth = source.transport === 'stdio'
       ? undefined
       : buildRemoteAuthConfig({
@@ -1631,51 +2007,110 @@ async function runAutopilot() {
 
     let introspection
     try {
-      introspection = await introspectMcpServer(source)
+      introspection = await introspectMcpServer(introspectionSource)
     } catch (error) {
       if (source.transport !== 'stdio' && isAuthRequiredError(error)) {
+        const discoveredAuth = error instanceof McpIntrospectionError ? discoverMcpAuthFromError(error) : null
+        const provider = inferMcpAuthProvider(source, discoveredAuth)
         connectSpinner?.stop('Server requires authentication')
-        authEnv = authEnv ?? (interactive
-          ? await clackText('Auth env var for this MCP server')
-          : '')
-        if (!authEnv) {
-          throw new Error(formatAuthRequiredMessage('autopilot', error))
+        let usedOauthWrapper = false
+
+        if (!usedOauthWrapper && discoveredAuth?.kind === 'platform' && (interactive || initOptions.oauthWrapper)) {
+          const strategy = initOptions.oauthWrapper
+            ? 'wrapper'
+            : interactive
+              ? await chooseOAuthImportStrategy(provider)
+              : 'token'
+
+          if (strategy === 'wrapper') {
+            const wrapperSource = buildOauthWrapperSource(source)
+            if (!wrapperSource) {
+              throw new Error(formatAuthRequiredMessage('autopilot', error, source))
+            }
+            introspectionSource = wrapperSource
+            runtimeAuthMode = 'platform'
+            connectSpinner?.start('Autopilot · Reconnecting via local wrapper...')
+            try {
+              introspection = await introspectMcpServer(introspectionSource)
+              usedOauthWrapper = true
+            } catch (wrapperError) {
+              if (isAuthRequiredError(wrapperError)) {
+                throw new Error(`Wrapper-based OAuth import failed.
+${formatAuthRequiredMessage('autopilot', wrapperError, source)}`)
+              }
+              throw new Error(`MCP introspection failed via local wrapper: ${wrapperError instanceof Error ? wrapperError.message : String(wrapperError)}`)
+            }
+          }
         }
 
-        if (interactive && !authType) {
-          authType = await clackSelect<'bearer' | 'header'>('Auth type', [
-            { value: 'bearer', label: 'bearer', hint: 'Authorization: Bearer <token>' },
-            { value: 'header', label: 'header', hint: 'Custom header such as X-API-Key' },
-          ], 'bearer')
+        if (!initOptions.runtimeAuth && (discoveredAuth?.kind === 'platform' || usedOauthWrapper)) {
+          runtimeAuthMode = 'platform'
         }
 
-        if (resolveRemoteAuthType({ authType, authHeader }) === 'header') {
-          if (interactive && !authHeader) {
-            authHeader = await clackText('Auth header name', 'X-API-Key')
+        if (usedOauthWrapper) {
+          authEnv = authEnv ?? (interactive
+            ? await clackText('Auth env var for generated non-platform targets (optional)', defaultAuthEnvVar(provider, discoveredAuth))
+            : undefined)
+          source = {
+            ...source,
+            auth: authEnv
+              ? buildRemoteAuthConfig({
+                  authEnv,
+                  authType: provider?.tokenAuthType ?? 'bearer',
+                  authHeader: provider?.authHeader,
+                  authTemplate: provider?.authTemplate,
+                })
+              : { type: 'platform', mode: 'oauth' },
           }
-          if (interactive && !authTemplate) {
-            authTemplate = await clackText('Auth header template', '${value}')
+        } else {
+          authEnv = authEnv ?? (interactive
+            ? await clackText('Auth env var for this MCP server', defaultAuthEnvVar(provider, discoveredAuth))
+            : '')
+          if (!authEnv) {
+            throw new Error(formatAuthRequiredMessage('autopilot', error, source))
           }
-        }
 
-        source = {
-          ...source,
-          auth: buildRemoteAuthConfig({
-            authEnv,
-            authType,
-            authHeader,
-            authTemplate,
-          }),
-        }
-        connectSpinner?.start('Autopilot · Reconnecting with auth...')
-        try {
-          introspection = await introspectMcpServer(source)
-        } catch (retryError) {
-          if (isAuthRequiredError(retryError)) {
-            throw new Error(`Authentication failed after retry.
-${formatAuthRequiredMessage('autopilot', retryError)}`)
+          if (interactive && discoveredAuth?.kind === 'platform') {
+            const credential = await maybeCaptureOAuthCredential(provider, discoveredAuth.authorizationUrl)
+            applySessionCredential(authEnv, credential)
+          }
+
+          if (interactive && !authType) {
+            authType = await clackSelect<'bearer' | 'header'>('Auth type', [
+              { value: 'bearer', label: 'bearer', hint: 'Authorization: Bearer <token>' },
+              { value: 'header', label: 'header', hint: 'Custom header such as X-API-Key' },
+            ], discoveredAuth?.kind === 'header' ? 'header' : (provider?.tokenAuthType ?? 'bearer'))
+          }
+
+          if (resolveRemoteAuthType({ authType, authHeader }) === 'header') {
+            if (interactive && !authHeader) {
+              authHeader = await clackText('Auth header name', discoveredAuth?.headerName ?? provider?.authHeader ?? 'X-API-Key')
+            }
+            if (interactive && !authTemplate) {
+              authTemplate = await clackText('Auth header template', provider?.authTemplate ?? '${value}')
+            }
+          }
+
+          source = {
+            ...source,
+            auth: buildRemoteAuthConfig({
+              authEnv,
+              authType,
+              authHeader,
+              authTemplate,
+            }),
+          }
+          introspectionSource = source
+          connectSpinner?.start('Autopilot · Reconnecting with auth...')
+          try {
+            introspection = await introspectMcpServer(introspectionSource)
+          } catch (retryError) {
+            if (isAuthRequiredError(retryError)) {
+              throw new Error(`Authentication failed after retry.
+${formatAuthRequiredMessage('autopilot', retryError, source)}`)
+            }
+            throw new Error(`MCP introspection failed after auth retry: ${retryError instanceof Error ? retryError.message : String(retryError)}`)
           }
-          throw new Error(`MCP introspection failed after auth retry: ${retryError instanceof Error ? retryError.message : String(retryError)}`)
         }
       } else {
         connectSpinner?.stop('Connection failed')
@@ -1683,6 +2118,10 @@ ${formatAuthRequiredMessage('autopilot', retryError)}`)
       }
     }
 
+    if (!introspection) {
+      throw new Error('MCP introspection did not return server metadata.')
+    }
+
     const stdioHasEnv = source.transport === 'stdio'
       && source.env
       && Object.keys(source.env).length > 0
@@ -1703,12 +2142,13 @@ ${formatAuthRequiredMessage('autopilot', retryError)}`)
       && source.auth.type !== 'none'
       && !initOptions.runtimeAuth
     ) {
+      runtimeAuthMode = source.auth.type === 'platform' ? 'platform' : runtimeAuthMode
       runtimeAuthMode = await clackSelect<McpRuntimeAuthMode>('Claude/Cursor runtime auth', [
         { value: 'inline', label: 'inline', hint: 'Generate env/header auth directly into plugin output' },
         { value: 'platform', label: 'platform', hint: 'Use native platform-managed auth (for example OAuth/custom connector flows)' },
       ], runtimeAuthMode)
     }
-    connectSpinner?.stop(`Connected: ${introspection.serverInfo.title ?? introspection.serverInfo.name} (${introspection.tools.length} tools discovered)`)
+    connectSpinner?.stop(`Connected: ${introspection.serverInfo.title ?? introspection.serverInfo.name} (${formatMcpDiscoverySummary(introspection)})`)
     const quality = analyzeMcpQuality(introspection.tools)
 
     if (!runtime.jsonOutput && !runtime.quiet && quality.issues.length > 0) {
@@ -1721,7 +2161,7 @@ ${formatAuthRequiredMessage('autopilot', retryError)}`)
         ? await clackText('Plugin name', defaultPluginName)
         : defaultPluginName),
     )
-    const defaultDisplayName = initOptions.displayName ?? introspection.serverInfo.title ?? pluginName
+    const defaultDisplayName = initOptions.displayName ?? deriveDisplayName(introspection, pluginName)
     const displayName = initOptions.displayName ?? (interactive
       ? await clackText('Display name', defaultDisplayName)
       : defaultDisplayName)
@@ -1859,6 +2299,10 @@ ${formatAuthRequiredMessage('autopilot', retryError)}`)
         source: rawSource,
         mode,
         runner,
+        model: taxonomyPlan?.model ?? instructionsPlan?.model ?? reviewPlan?.model ?? {
+          source: 'unknown',
+          display: 'local default (CLI-managed)',
+        },
         targets,
         toolCount: introspection.tools.length,
         grouping,
@@ -1911,6 +2355,7 @@ ${formatAuthRequiredMessage('autopilot', retryError)}`)
         console.log(`  Mode: ${mode}`)
         console.log(`  Import: ${introspection.tools.length} tools -> ${targets.join(', ')}`)
         console.log(`  Runner: ${runner}`)
+        console.log(`  Model: ${summary.model.display}`)
         console.log(`  Workload: ${summarizeAutopilotWorkload({
           taxonomy: passDecisions.taxonomy,
           instructions: passDecisions.instructions,
@@ -2056,6 +2501,10 @@ ${formatAuthRequiredMessage('autopilot', retryError)}`)
       source: rawSource,
       mode,
       runner,
+      model: taxonomyPlan?.model ?? instructionsPlan?.model ?? reviewPlan?.model ?? {
+        source: 'unknown',
+        display: 'local default (CLI-managed)',
+      },
       targets,
       toolCount: introspection.tools.length,
       grouping,
@@ -2117,6 +2566,7 @@ ${formatAuthRequiredMessage('autopilot', retryError)}`)
       console.log(`  Mode: ${mode}`)
       console.log(`  Import: ${introspection.tools.length} tools -> ${targets.join(', ')}`)
       console.log(`  Runner: ${runner}`)
+      console.log(`  Model: ${summary.model.display}`)
       console.log(`  Workload: ${summarizeAutopilotWorkload({
         taxonomy: passDecisions.taxonomy,
         instructions: passDecisions.instructions,
@@ -2170,14 +2620,31 @@ async function runTestCommand() {
     rootDir: process.cwd(),
     targets,
   })
+  const config = result.config.ok ? await loadConfig() : null
+  const platforms = targets ?? config?.targets ?? []
+  const install = result.ok && config
+    ? await maybeInstallBuiltOutputs(config, platforms)
+    : undefined
 
   if (runtime.jsonOutput) {
-    printJson(result)
+    printJson({
+      ...result,
+      install,
+    })
     return
   }
 
   if (!runtime.quiet) {
     printTestResult(result)
+    if (install) {
+      console.log('Installed for local testing:')
+      for (const target of install.installTargets) {
+        console.log(`  ${target.platform} -> ${target.pluginDir}`)
+      }
+      for (const note of install.notes) {
+        console.log(note)
+      }
+    }
   }
 
   if (!result.ok) {
@@ -2185,6 +2652,25 @@ async function runTestCommand() {
   }
 }
 
+async function runEvalCommand() {
+  const report = await runEvalSuite({
+    rootDir: process.cwd(),
+  })
+
+  if (runtime.jsonOutput) {
+    printJson(report)
+    return
+  }
+
+  if (!runtime.quiet) {
+    printEvalReport(report)
+  }
+
+  if (!report.ok) {
+    process.exit(1)
+  }
+}
+
 async function runInstall() {
   const trust = args.includes('--trust')
   const targets = parseTargetFlagValues(args)
@@ -2201,6 +2687,7 @@ async function runInstall() {
       dryRun: true,
       pluginName: config.name,
       platforms,
+      notes: getInstallFollowupNotes(platforms),
       trustRequired: hookCommands.length > 0,
       userConfig: plannedUserConfig.map((entry) => ({
         key: entry.field.key,
@@ -2234,6 +2721,9 @@ async function runInstall() {
       if (listHookCommands(config.hooks).length > 0) {
         console.log('  trust reminder: this plugin defines local hook commands; install requires review or --trust')
       }
+      for (const note of getInstallFollowupNotes(platforms)) {
+        console.log(`  note: ${note}`)
+      }
     }
     return
   }
@@ -2338,25 +2828,45 @@ async function runMigrate() {
   await migrate(inputPath)
 }
 
+async function runMcp() {
+  const subcommand = args[1]
+  if (subcommand !== 'proxy') {
+    console.error('Usage: pluxx mcp proxy --from-mcp <source> [--record <tape.json>]')
+    console.error('       pluxx mcp proxy --replay <tape.json>')
+    process.exit(1)
+  }
+
+  try {
+    await runMcpProxy(args.slice(2))
+  } catch (error) {
+    if (error instanceof Error && error.message === 'Invalid MCP proxy arguments.') {
+      process.exit(1)
+    }
+    throw error
+  }
+}
+
 function printHelp() {
   console.log(`
 pluxx — Cross-platform AI agent plugin SDK
 
 Usage:
-  pluxx build [--target <platforms...>]   Generate platform-specific plugin files
+  pluxx build [--target <platforms...>] [--install]   Generate platform-specific plugin files
   pluxx dev [--target <platforms...>]     Watch for changes and auto-rebuild
   pluxx validate                          Validate your config
   pluxx lint                              Lint skills and cross-platform metadata
-  pluxx doctor                            Check runtime, config, paths, MCP, and trust advisories
+  pluxx doctor [path] [--consumer]       Check source-project or installed-bundle health
   pluxx agent prepare                     Generate agent context + boundary files for host agents
   pluxx agent prompt <kind>               Generate a prompt pack (taxonomy, instructions, review)
   pluxx agent run <kind> --runner <id>    Execute a prompt pack via Claude, Cursor, Codex, or OpenCode headlessly
+  pluxx mcp proxy ...                     Run a local MCP proxy with optional record/replay tapes
   pluxx autopilot --from-mcp ...          Run import + agent refinement + verification in one command
   pluxx init [name] [--from-mcp <source>] Create a new pluxx.config.ts
   pluxx sync [--from-mcp <source>]        Refresh MCP-derived scaffold files
   pluxx migrate <path>                    Import an existing plugin into pluxx
-  pluxx test [--target <platforms...>]    Run config, lint, build, and smoke checks
-  pluxx install [--target <platforms>] [--trust]  Symlink built plugins for local testing
+  pluxx test [--target <platforms...>] [--install]    Run config, lint, eval, build, and smoke checks
+  pluxx eval                              Evaluate scaffold and prompt-pack quality
+  pluxx install [--target <platforms>] [--trust]  Install built plugins for local testing
   pluxx publish [--npm] [--github-release] [--dry-run] [--json] [--tag latest] [--version x.y.z]
   pluxx uninstall [--target <platforms>]  Remove symlinked plugins
   pluxx help                              Show this help
@@ -2374,12 +2884,15 @@ Targets:
 
 Examples:
   pluxx build                             Build for all configured targets
+  pluxx build --install                   Build and install all configured targets locally
   pluxx build --target claude-code cursor  Build for specific platforms
   pluxx init my-plugin                    Scaffold a new plugin config
   pluxx init --from-mcp https://example.com/mcp  Scaffold from a remote MCP server
   pluxx init --from-mcp "npx -y @acme/mcp"       Scaffold from a local MCP command
   pluxx init --from-mcp https://example.com/mcp --yes --name acme --display-name "Acme" --author "Acme" --targets claude-code,codex --grouping workflow --hooks safe --json
   pluxx init --from-mcp https://example.com/mcp --yes --auth-env API_KEY --auth-type header --auth-header X-API-Key --auth-template "\${value}"
+  pluxx init --from-mcp https://example.com/mcp --yes --auth-type platform --runtime-auth platform
+  pluxx init --from-mcp https://mcp.linear.app/mcp --yes --oauth-wrapper --runtime-auth platform
   pluxx init --from-mcp https://example.com/sse --transport sse   Scaffold from an SSE-transport MCP server
   pluxx init --from-mcp https://example.com/mcp --yes --dry-run   Preview scaffold files without writing
   pluxx sync                              Refresh a scaffold using .pluxx/mcp.json metadata
@@ -2392,13 +2905,19 @@ Examples:
   pluxx agent run taxonomy --runner codex
   pluxx agent run taxonomy --runner codex --verbose-runner
   pluxx agent run review --runner opencode --attach http://localhost:4096 --no-verify
+  pluxx mcp proxy --from-mcp "bun ./server.js" --record .pluxx/tapes/dev.json
+  pluxx mcp proxy --replay .pluxx/tapes/dev.json
   --attach is only supported for the opencode runner
   pluxx autopilot --from-mcp https://example.com/mcp --runner codex --mode quick --yes
   pluxx autopilot --from-mcp https://example.com/mcp --runner codex --mode standard --yes --name acme --display-name "Acme"
   pluxx autopilot --from-mcp https://example.com/mcp --runner codex --mode thorough --yes --verbose-runner
+  pluxx autopilot --from-mcp https://mcp.linear.app/mcp --runner codex --yes --oauth-wrapper
   pluxx autopilot --from-mcp "npx -y @acme/mcp" --runner claude --targets claude-code,codex --website https://example.com --docs https://docs.example.com
-  pluxx doctor --json                     Inspect project health as JSON
+  pluxx doctor --json                     Inspect source-project health as JSON
+  pluxx doctor --consumer ./dist/cursor   Inspect a built or installed platform bundle
+  pluxx eval --json                       Inspect scaffold/prompt-pack quality as JSON
   pluxx test --target claude-code codex  Verify selected target outputs
+  pluxx test --install                    Verify and install all configured targets locally
   pluxx install                           Install to all configured targets
   pluxx install --target claude-code      Install to Claude Code only
   pluxx install --dry-run                 Preview local install paths and trust implications