@vibecodr/cli 1.0.0-rc.0 → 1.0.1

package/CHANGELOG.md

@@ -1,111 +1,58 @@
-# Changelog
-
-## 1.0.0-rc.0
-
-First release candidate of the unified Vibecodr CLI. Merges @vibecodr/vc-tools@0.1.4 and @vibecodr/cli@0.2.11 into a single coordinated release.
-
-### Added
-
-- Single package `@vibecodr/cli` with three bin entries that all resolve to the same install tree:
-  - `vibecodr` — canonical (MCP gateway commands + hosted Agent Computer cross-routed)
-  - `vibecodr-mcp` — compatibility alias preserved from 0.2.x
-  - `vc-tools` — compatibility alias for the legacy vc-tools surface, byte-equivalent output to vc-tools@0.1.4
-- Hosted Agent Computer commands (start, browser, computer, work, proof, usage, plans, dashboard, jobs, artifacts, agent, connect, try, etc.) now reachable from the `vibecodr` bin via legacy-dispatcher cross-routing.
-- New MCP install adapter `claude-code` (alongside codex, cursor, vscode, windsurf, claude-desktop).
-- Cloudflare worker source, wrangler config, D1 migrations, and Dockerfile vendored from vc-tools so a single repo owns the CLI and its hosted worker.
-
-### Preserved (frozen)
-
-- `vc-tools` binary, `vibecodr-mcp` binary, all existing env vars (`VC_TOOLS_*`, `VIBECDR_MCP_*`), keyring service IDs (`@vibecodr/vc-tools` and `@vibecodr/mcp`), config dirs, install-manifest schema, and hosted worker contracts (D1 binding, JWT claims, route paths, page slugs).
-- Output JSON shape for every command captured in test/fixtures/output-baseline/ as the §14 regression contract.
-
-### Migrated
-
-- From @vibecodr/cli@0.2.x (no behavior change): login, logout, status, whoami, tools, call, upload, doctor, install, uninstall, config, pulse-setup, pulse-publish, pulse.
-- From @vibecodr/vc-tools@0.1.x (no behavior change for vc-tools bin; new cross-routing from vibecodr bin): start, setup, try, agent, connect, computer, browser, work, proof, usage, limits, dashboard, jobs, artifacts, grants, retention, scheduled-qa, plans, inspect, auth.
-
-### Deprecated
-
-- `@vibecodr/vc-tools` npm package becomes a thin forwarder at 0.2.0. Plan: `npm deprecate` 90 days after this release.
-
-See MIGRATION.md for upgrade guidance.
-
-## 0.2.11
-
-- add `vibecodr call --timeout-sec <n>` as a local MCP transport timeout for long-running protected tool calls such as build-backed publish retries
-- keep `--timeout-sec` out of server tool arguments so hosted MCP schemas remain authoritative
-
-## 0.2.6
-
-- publish a fresh CLI version so GitHub and npm carry the same current release marker
-
-## 0.2.5
-
-- refresh release lockfile coverage before publishing the CLI
-
-## 0.2.4
-
-- clarify staged ZIP upload output so larger projects can move into Vibecodr's async heavy import lane automatically
-- keep worker-gateway integration fixtures aligned with pulse compute quota fields
-
-## 0.2.2
-
-- show command-specific help for nested `vibecodr pulse <command> --help|-h|-help` requests
-
-## 0.2.1
-
-- preserve encrypted offline sessions when refresh fails because the authorization server is temporarily unavailable
-- continue clearing stored auth on OAuth `invalid_grant` so revoked or expired refresh tokens fail closed
-
-## 0.2.0
-
-- rename the npm package to `@vibecodr/cli` while keeping `vibecodr` as the primary executable and `vibecodr-mcp` as a compatibility alias
-- add the hardened `pulse` lifecycle command group for list/get/status/run/archive/restore plus create/deploy aliases
-- redact source, descriptor, token, secret, and inline file-content fields from CLI-displayed MCP arguments and results
-- require explicit confirmation for known mutating MCP tools when invoked through the generic `call` command
-
-## 0.1.8
-
-- report the actual package version in MCP client metadata instead of a stale hardcoded value
-- publish the CLI after redeploying the hosted Vibecodr MCP gateway
-
-## 0.1.7
-
-- add the `pulse-setup` command for live Pulse setup guidance
-- align CLI Pulse setup docs with the gateway runtime contract for policy-bound secrets, Stripe-first webhook helper guidance, generic HMAC presets, and provider-scoped connections
-- refresh release-lock coverage for current in-range MCP SDK, keyring, and Node type packages before publishing
-
-## 0.1.6
-
-- make printed OAuth authorization URLs the default login behavior
-- keep automatic browser launch available behind `--browser open`
-- keep secret-store delete best-effort when keyring entry loading fails during cleanup
-
-## 0.1.5
-
-- replace the Windows browser launcher with `rundll32 url.dll,FileProtocolHandler` so OAuth URLs open in the default browser instead of File Explorer
-- make `doctor` use the same browser-launcher availability check as runtime auth
-
-## 0.1.4
-
-- replace the Windows browser launcher with `explorer.exe` so OAuth URLs are passed through intact
-
-## 0.1.3
-
-- fix Windows command detection by resolving `where.exe` from the real system path
-- make `status --show-installs` verify file-backed installs instead of blindly trusting the manifest
-
-## 0.1.2
-
-- fix Windows browser auto-open by launching the actual command shell instead of assuming `cmd` is on PATH
-- make `doctor` validate the real browser launcher path instead of hardcoding Windows success
-
-## 0.1.1
-
-- add `vibecodr` as a first-class executable alias
-- fix Windows login persistence by storing encrypted session blobs on disk with a small OS-keyring-backed encryption key
-- keep `vibecodr-mcp` as a compatibility alias
-
-## 0.1.0
-
-- Initial Phase 0 scaffold for the direct Vibecodr MCP CLI.
+# Changelog
+
+Pre-1.0.0 history for the `@vibecodr/cli@0.2.x` and `0.1.x` lines lives at [`docs/legacy/CHANGELOG-mcp-cli.md`](docs/legacy/CHANGELOG-mcp-cli.md). The `@vibecodr/vc-tools@0.1.x` line was the other half of the May 2026 merge; its source history is preserved in the archived [`BradenHartsell/vc-tools`](https://github.com/BradenHartsell/vc-tools) repository.
+
+## 1.0.1
+
+Fixes the global-install collision for users who already had `@vibecodr/vc-tools@0.1.x` installed globally. Both packages register a `vc-tools` bin under the same path; npm refuses to overwrite a bin owned by a different package, so the install fails with `EEXIST: file already exists`.
+
+- Adds a `preinstall` lifecycle script (`preinstall-check.mjs`) that runs `npm ls -g --depth 0 --json @vibecodr/vc-tools` before file copy. When a legacy `0.1.x` is detected, the install aborts with a clear actionable message listing the two-command fix (`npm uninstall -g @vibecodr/vc-tools` followed by `npm install -g @vibecodr/cli`). The check is purely read-only, opts itself out during local dev installs from the source repo, and honors `VIBECDR_SKIP_PREINSTALL_CHECK=1` for operators who want to bypass.
+- Documents the collision and the unblock recipe in MIGRATION.md under the "If you used `vc-tools`" section.
+
+No source or behavior changes to the dispatcher, the worker, or the published bins. The only delta in the tarball is the new `preinstall-check.mjs` at the package root.
+
+## 1.0.0
+
+Same source as 1.0.0-rc.0. Promoted to `latest` after the rc.0 release cleared smoke against the production endpoints (tools.vibecodr.space + openai.vibecodr.space/mcp) and the §14 output-baseline fixtures matched byte-for-byte.
+
+## 1.0.0-rc.0
+
+First release candidate of the unified Vibecodr CLI. Merges @vibecodr/vc-tools@0.1.4 and @vibecodr/cli@0.2.11 into a single coordinated release.
+
+### Added
+
+- Single package `@vibecodr/cli` with three bin entries that all resolve to the same install tree:
+  - `vibecodr` — canonical (MCP gateway commands + hosted Agent Computer cross-routed)
+  - `vibecodr-mcp` — compatibility alias preserved from 0.2.x
+  - `vc-tools` — compatibility alias for the legacy vc-tools surface, byte-equivalent output to vc-tools@0.1.4
+- Hosted Agent Computer commands (start, browser, computer, work, proof, usage, plans, dashboard, jobs, artifacts, agent, connect, try, etc.) now reachable from the `vibecodr` bin via legacy-dispatcher cross-routing.
+- New MCP install adapter `claude-code` (alongside codex, cursor, vscode, windsurf, claude-desktop).
+- Cloudflare worker source, wrangler config, D1 migrations, and Dockerfile vendored from vc-tools so a single repo owns the CLI and its hosted worker.
+- New canonical `VIBECDR_*` env var prefix (e.g. `VIBECDR_CONFIG_DIR`) backed by `src/core/env.ts`. Legacy `VC_TOOLS_*` and `VIBECDR_MCP_*` env vars stay readable as fallbacks; the CLI emits a one-time stderr deprecation note when a legacy var is hit. Set `VIBECDR_NO_DEPRECATION_NOTICE=1` to silence.
+
+### Behavior change on first 1.0.x run
+
+The first invocation of any v1.0.0+ bin entry runs a one-shot migration: the
+legacy `%APPDATA%\vc-tools\` and `%APPDATA%\Vibecodr\MCP\` (or platform
+equivalents) are **copied** into a unified `~/.vibecodr/{tools,mcp}/` tree,
+and the legacy roots are **renamed to `<root>.bak`**. The migration is
+idempotent (subsequent runs are no-ops) and preserves OS keychain entries
+(service IDs `@vibecodr/vc-tools` and `@vibecodr/mcp` are not touched). See
+[MIGRATION.md](MIGRATION.md#what-happens-on-first-10x-run) for the full
+breakdown and how to override the destination via `VIBECDR_CONFIG_DIR`.
+
+### Preserved (frozen)
+
+- `vc-tools` binary, `vibecodr-mcp` binary, all existing env vars (`VC_TOOLS_*`, `VIBECDR_MCP_*`), keyring service IDs (`@vibecodr/vc-tools` and `@vibecodr/mcp`), config dirs, install-manifest schema, and hosted worker contracts (D1 binding, JWT claims, route paths, page slugs).
+- Output JSON shape for every command captured in test/fixtures/output-baseline/ as the §14 regression contract.
+
+### Migrated
+
+- From @vibecodr/cli@0.2.x (no behavior change): login, logout, status, whoami, tools, call, upload, doctor, install, uninstall, config, pulse-setup, pulse-publish, pulse.
+- From @vibecodr/vc-tools@0.1.x (no behavior change for vc-tools bin; new cross-routing from vibecodr bin): start, setup, try, agent, connect, computer, browser, work, proof, usage, limits, dashboard, jobs, artifacts, grants, retention, scheduled-qa, plans, inspect, auth.
+
+### Deprecated
+
+- `@vibecodr/vc-tools` npm package becomes a thin forwarder at 0.2.0. Plan: `npm deprecate` 90 days after this release.
+
+See MIGRATION.md for upgrade guidance.

package/MIGRATION.md

@@ -4,6 +4,24 @@
 
 You should not need to change anything to keep working. This page documents the back-compat guarantees and the small set of *additions* you can opt into.
 
+## What happens on first 1.0.x run
+
+The first time you invoke any of `vibecodr`, `vibecodr-mcp`, or `vc-tools` from v1.0.0+, the CLI does a one-shot migration of your legacy config dirs into a unified `~/.vibecodr/` tree:
+
+- `%APPDATA%\vc-tools\` (Windows) / `$XDG_CONFIG_HOME/vc-tools/` (macOS/Linux) -> `~/.vibecodr/tools/`
+- `%APPDATA%\Vibecodr\MCP\` (Windows) / `~/Library/Application Support/Vibecodr MCP/` (macOS) / `$XDG_CONFIG_HOME/vibecodr-mcp/` (Linux) -> `~/.vibecodr/mcp/`
+
+The legacy roots are **renamed to `<root>.bak`** so the old code paths can't accidentally re-read stale state. The migration is idempotent — running the CLI again is a no-op once `~/.vibecodr/` exists.
+
+**What this means for you:**
+
+- All your existing credentials, profiles, and install manifests come along; no re-login is required. The OS keychain entries are not touched (service IDs `@vibecodr/vc-tools` and `@vibecodr/mcp` stay where they are).
+- Set `VIBECDR_CONFIG_DIR` to a custom path to override the new canonical location. Legacy `VC_TOOLS_CONFIG_DIR` and `VIBECDR_MCP_CONFIG_PATH` env vars still work too — they read as fallbacks and write to the canonical location going forward.
+- Any external script that reads the legacy paths directly (instead of going through the CLI) will stop seeing fresh data after the migration. Update those scripts to read `~/.vibecodr/{tools,mcp}/` or rely on the `<root>.bak` snapshots which preserve the pre-migration state.
+- If you absolutely don't want the migration to run, set `VIBECDR_CONFIG_DIR=<your-explicit-path>` before the first invocation; the CLI prefers explicit overrides over the auto-migration trigger.
+
+The migration is one-shot per machine. If you need to redo it (for example after rolling back to a 0.2.x line and back to 1.x), delete `~/.vibecodr/tools/` or `~/.vibecodr/mcp/` and the next 1.x invocation re-copies from the legacy roots (which now live at `<root>.bak`).
+
 ## If you used `vc-tools`
 
 You installed `npm install -g @vibecodr/vc-tools` and your scripts run `vc-tools start`, `vc-tools browser screenshot ...`, `vc-tools computer run ...`, etc.
@@ -12,7 +30,7 @@ You installed `npm install -g @vibecodr/vc-tools` and your scripts run `vc-tools
 
 - Every `vc-tools <command> [...]` invocation continues to work, byte-equivalent JSON output, byte-equivalent exit codes. The §14 output-baseline regression contract checks this on every release.
 - Your durable API key in the OS keychain remains under the service ID `@vibecodr/vc-tools` (username `agent-computer`). No re-login is required after upgrade.
-- Your config dir continues to be `%APPDATA%\vc-tools\` on Windows and `$XDG_CONFIG_HOME/vc-tools/` on macOS/Linux. `VC_TOOLS_CONFIG_DIR` and `VC_TOOLS_CREDENTIAL_STORE` env vars work unchanged.
+- Your config dir moves from `%APPDATA%\vc-tools\` (Windows) / `$XDG_CONFIG_HOME/vc-tools/` (macOS/Linux) to `~/.vibecodr/tools/` on first 1.0.x invocation. The legacy root is renamed to `<root>.bak` and preserved. `VC_TOOLS_CONFIG_DIR` and `VC_TOOLS_CREDENTIAL_STORE` env vars still work; the canonical name is `VIBECDR_CONFIG_DIR` and either set wins. See "What happens on first 1.0.x run" above.
 - The hosted worker endpoint `tools.vibecodr.space` is unchanged. All HTTP routes (`/auth/vc-tools/device/*`, `/me/api-keys/vc-tools/*`) are frozen. JWT claims (`grant_profile="vc_tools"`, `aud="vibecodr:vc-tools"`) are frozen. The Clerk-managed API key is still labeled `"vc-tools Agent Computer"`.
 
 **What's new (opt-in):**
@@ -20,6 +38,17 @@ You installed `npm install -g @vibecodr/vc-tools` and your scripts run `vc-tools
 - You can install the same package as `npm install -g @vibecodr/cli` instead of `@vibecodr/vc-tools`. The bin name `vc-tools` still resolves; the help banner adds a one-line "this is now part of @vibecodr/cli" footnote.
 - `@vibecodr/vc-tools` itself becomes a thin forwarder at version 0.2.0 that depends on `@vibecodr/cli`. Existing pinned installs (`@vibecodr/vc-tools@0.1.4`) continue to work; the 0.2.0 forwarder lets `npm i @vibecodr/vc-tools` (no version) drag in the merged CLI for users who type the legacy package name from memory.
 
+**If `npm install -g @vibecodr/cli` fails with `EEXIST: file already exists` pointing at `<npm-bin>/vc-tools`:**
+
+That's the global-bin collision: both `@vibecodr/cli` and the legacy `@vibecodr/vc-tools` register a `vc-tools` bin under the same path, and npm refuses to overwrite a bin owned by a different package. The fix is one command:
+
+```bash
+npm uninstall -g @vibecodr/vc-tools
+npm install -g @vibecodr/cli
+```
+
+This is safe: the uninstall removes only the npm package and its bin shim. Your OS keychain entry (service `@vibecodr/vc-tools`, the durable Clerk API key) and your config dir are untouched; the merged CLI reads both on first run. From `@vibecodr/cli@1.0.1` onwards, the package ships a `preinstall` script that detects this collision and prints the same instructions instead of letting npm surface a bare `EEXIST`.
+
 **What you can update in CI (no rush):**
 
 - Switch your install command to `npm install -g @vibecodr/cli`. The bin entry `vc-tools` is still mapped, so no script changes are required.
@@ -32,7 +61,7 @@ You installed `npm install -g @vibecodr/cli` and your scripts run `vibecodr-mcp
 **What stays the same:**
 
 - Every `vibecodr-mcp <command>` invocation continues to work unchanged.
-- Your encrypted OAuth session continues to live in the same secret-store location (`%APPDATA%\Vibecodr\MCP\secrets\` on Windows, `~/Library/Application Support/Vibecodr MCP/secrets/` on macOS, `$XDG_CONFIG_HOME/vibecodr-mcp/secrets/` on Linux). Keyring service ID stays `@vibecodr/mcp`. No re-login is required after upgrade.
+- Your encrypted OAuth session moves with the rest of the MCP-CLI config dir on first 1.0.x invocation: from `%APPDATA%\Vibecodr\MCP\secrets\` (Windows) / `~/Library/Application Support/Vibecodr MCP/secrets/` (macOS) / `$XDG_CONFIG_HOME/vibecodr-mcp/secrets/` (Linux) to `~/.vibecodr/mcp/secrets/`. Keyring service ID stays `@vibecodr/mcp` (untouched). No re-login is required. See "What happens on first 1.0.x run" above.
 - The hosted MCP gateway endpoint `openai.vibecodr.space/mcp` is unchanged.
 - `VIBECDR_MCP_*` env vars (`VIBECDR_MCP_CONFIG_PATH`, `VIBECDR_MCP_CIMD_CLIENT_ID`, `VIBECDR_MCP_MANUAL_CLIENT_ID`, `VIBECDR_MCP_INSTALL_MANIFEST_PATH`, etc.) work unchanged.
 

package/dist/auth/credential-broker.d.ts

@@ -0,0 +1,28 @@
+import { ConfigStore as McpConfigStore } from "../storage/config-store.js";
+import { SecretStore } from "../storage/secret-store.js";
+import { ConfigStore as VcToolsConfigStore } from "../legacy/config/store.js";
+export type CredentialEndpoint = "tools.vibecodr.space" | "openai.vibecodr.space/mcp";
+export type CredentialKind = "api_key" | "oauth" | "token";
+export interface BrokeredCredential {
+    endpoint: CredentialEndpoint;
+    kind: CredentialKind;
+    value: string;
+    serviceId: "@vibecodr/vc-tools" | "@vibecodr/mcp";
+    expiresAt?: number;
+}
+export interface CredentialBroker {
+    getCredentialForEndpoint(endpoint: CredentialEndpoint): Promise<BrokeredCredential | undefined>;
+}
+export interface BrokerConstruction {
+    vcToolsStore: VcToolsConfigStore;
+    mcpSecretStore: SecretStore;
+    mcpConfigStore: McpConfigStore;
+}
+export declare class DefaultCredentialBroker implements CredentialBroker {
+    private readonly stores;
+    constructor(stores: BrokerConstruction);
+    getCredentialForEndpoint(endpoint: CredentialEndpoint): Promise<BrokeredCredential | undefined>;
+    private readVcToolsCredential;
+    private readMcpCredential;
+}
+//# sourceMappingURL=credential-broker.d.ts.map

package/dist/auth/credential-broker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-broker.d.ts","sourceRoot":"","sources":["../../src/auth/credential-broker.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,WAAW,IAAI,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,WAAW,IAAI,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE9E,MAAM,MAAM,kBAAkB,GAAG,sBAAsB,GAAG,2BAA2B,CAAC;AAEtF,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;AAE3D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,IAAI,EAAE,cAAc,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IAId,SAAS,EAAE,oBAAoB,GAAG,eAAe,CAAC;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,wBAAwB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;CACjG;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,kBAAkB,CAAC;IACjC,cAAc,EAAE,WAAW,CAAC;IAC5B,cAAc,EAAE,cAAc,CAAC;CAChC;AAED,qBAAa,uBAAwB,YAAW,gBAAgB;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,kBAAkB;IAEjD,wBAAwB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;YAOvF,qBAAqB;YA4BrB,iBAAiB;CAgBhC"}

package/dist/auth/credential-broker.js

@@ -0,0 +1,80 @@
+// Unified credential broker. Routes "give me a credential for endpoint X"
+// requests to the correct underlying store and surface, without callers
+// having to know whether the credential is a durable Clerk API key (the
+// vc-tools hosted Agent Computer surface) or an OAuth access token cached
+// inside an encrypted session blob (the MCP gateway surface).
+//
+// Two underlying slots:
+//   - "device-grant": durable API key stored by the legacy vc-tools
+//     ConfigStore (src/legacy/config/store.ts), backed by @napi-rs/keyring
+//     under service "@vibecodr/vc-tools". Used by the tools.vibecodr.space
+//     endpoint family.
+//   - "oauth": refreshable OAuth session stored by SecretStore
+//     (src/storage/secret-store.ts), backed by @napi-rs/keyring under
+//     service "@vibecodr/mcp" plus an AES-256-GCM encrypted file. Used by
+//     the openai.vibecodr.space/mcp endpoint.
+//
+// The two service IDs are intentionally kept verbatim across the v1
+// merger so existing keychain entries written by @vibecodr/vc-tools@0.1.x
+// and @vibecodr/cli@0.2.x stay readable.
+export class DefaultCredentialBroker {
+    stores;
+    constructor(stores) {
+        this.stores = stores;
+    }
+    async getCredentialForEndpoint(endpoint) {
+        if (endpoint === "tools.vibecodr.space") {
+            return await this.readVcToolsCredential();
+        }
+        return await this.readMcpCredential();
+    }
+    async readVcToolsCredential() {
+        const state = await this.stores.vcToolsStore.readAuthState();
+        const credential = state.credential;
+        if (credential) {
+            const result = {
+                endpoint: "tools.vibecodr.space",
+                kind: credential.mode,
+                value: credential.value,
+                serviceId: "@vibecodr/vc-tools"
+            };
+            if (credential.expiresAt !== undefined)
+                result.expiresAt = credential.expiresAt;
+            return result;
+        }
+        // Fall back to the short-lived exchange grant if a durable credential isn't
+        // present yet (the vc-tools start flow can leave only a grant after the
+        // device approval step before the durable Clerk API key is minted).
+        const grant = state.grant;
+        if (!grant)
+            return undefined;
+        const result = {
+            endpoint: "tools.vibecodr.space",
+            kind: "token",
+            value: grant.token,
+            serviceId: "@vibecodr/vc-tools"
+        };
+        if (grant.expiresAt !== undefined)
+            result.expiresAt = grant.expiresAt;
+        return result;
+    }
+    async readMcpCredential() {
+        const { name } = await this.stores.mcpConfigStore.getProfile();
+        const session = await this.stores.mcpSecretStore.get(name);
+        if (!session)
+            return undefined;
+        const result = {
+            endpoint: "openai.vibecodr.space/mcp",
+            kind: "oauth",
+            value: session.accessToken,
+            serviceId: "@vibecodr/mcp"
+        };
+        if (session.expiresAt) {
+            const ts = Date.parse(session.expiresAt);
+            if (!Number.isNaN(ts))
+                result.expiresAt = ts;
+        }
+        return result;
+    }
+}
+//# sourceMappingURL=credential-broker.js.map

package/dist/auth/credential-broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-broker.js","sourceRoot":"","sources":["../../src/auth/credential-broker.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,wEAAwE;AACxE,wEAAwE;AACxE,0EAA0E;AAC1E,8DAA8D;AAC9D,EAAE;AACF,wBAAwB;AACxB,oEAAoE;AACpE,2EAA2E;AAC3E,2EAA2E;AAC3E,uBAAuB;AACvB,+DAA+D;AAC/D,sEAAsE;AACtE,0EAA0E;AAC1E,8CAA8C;AAC9C,EAAE;AACF,oEAAoE;AACpE,0EAA0E;AAC1E,yCAAyC;AA+BzC,MAAM,OAAO,uBAAuB;IACL;IAA7B,YAA6B,MAA0B;QAA1B,WAAM,GAAN,MAAM,CAAoB;IAAG,CAAC;IAE3D,KAAK,CAAC,wBAAwB,CAAC,QAA4B;QACzD,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;YACxC,OAAO,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC5C,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,qBAAqB;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC;QAC7D,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACpC,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,MAAM,GAAuB;gBACjC,QAAQ,EAAE,sBAAsB;gBAChC,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,SAAS,EAAE,oBAAoB;aAChC,CAAC;YACF,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS;gBAAE,MAAM,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;YAChF,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,4EAA4E;QAC5E,wEAAwE;QACxE,oEAAoE;QACpE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,MAAM,GAAuB;YACjC,QAAQ,EAAE,sBAAsB;YAChC,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,oBAAoB;SAChC,CAAC;QACF,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACtE,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,CAAC;QAC/D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,MAAM,GAAuB;YACjC,QAAQ,EAAE,2BAA2B;YACrC,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,OAAO,CAAC,WAAW;YAC1B,SAAS,EAAE,eAAe;SAC3B,CAAC;QACF,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAAE,MAAM,CAAC,SAAS,GAAG,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/bin/vc-tools.js

@@ -1,5 +1,9 @@
 #!/usr/bin/env node
 process.env["__VCR_INVOKED_AS"] = "vc-tools";
+const { reconcileEnv } = await import("../core/env.js");
+reconcileEnv();
+const { migrateLegacyDirsOnce } = await import("../storage/migrate.js");
+await migrateLegacyDirsOnce();
 const { runCli } = await import("../legacy/cli/run.js");
 const code = await runCli(process.argv.slice(2));
 process.exitCode = code;

package/dist/bin/vc-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"vc-tools.js","sourceRoot":"","sources":["../../src/bin/vc-tools.ts"],"names":[],"mappings":";AACA,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,GAAG,UAAU,CAAC;AAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;AACxD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACjD,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC"}
+{"version":3,"file":"vc-tools.js","sourceRoot":"","sources":["../../src/bin/vc-tools.ts"],"names":[],"mappings":";AACA,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,GAAG,UAAU,CAAC;AAC7C,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;AACxD,YAAY,EAAE,CAAC;AACf,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;AACxE,MAAM,qBAAqB,EAAE,CAAC;AAC9B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;AACxD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACjD,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC"}

package/dist/bin/vibecodr-mcp.js

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+import { reconcileEnv } from "../core/env.js";
+import { migrateLegacyDirsOnce } from "../storage/migrate.js";
 import { ConfigStore } from "../storage/config-store.js";
 import { SecretStore } from "../storage/secret-store.js";
 import { TokenManager } from "../auth/token-manager.js";
@@ -20,6 +22,8 @@ import { runPulseSetupCommand } from "../commands/pulse-setup.js";
 import { runPulsePublishCommand } from "../commands/pulse-publish.js";
 import { runPulseCommand } from "../commands/pulse.js";
 import { runUploadCommand } from "../commands/upload.js";
+reconcileEnv();
+await migrateLegacyDirsOnce();
 function helpText() {
     return [
         "vibecodr <command> [options]",

package/dist/bin/vibecodr-mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"vibecodr-mcp.js","sourceRoot":"","sources":["../../src/bin/vibecodr-mcp.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,SAAS,QAAQ;IACf,OAAO;QACL,8BAA8B;QAC9B,uDAAuD;QACvD,EAAE;QACF,WAAW;QACX,SAAS;QACT,UAAU;QACV,UAAU;QACV,UAAU;QACV,qBAAqB;QACrB,oBAAoB;QACpB,uBAAuB;QACvB,2DAA2D;QAC3D,UAAU;QACV,oBAAoB;QACpB,sBAAsB;QACtB,UAAU;QACV,iFAAiF;QACjF,gFAAgF;QAChF,6DAA6D;QAC7D,sFAAsF;QACtF,iFAAiF;QACjF,EAAE;QACF,eAAe;QACf,oBAAoB;QACpB,UAAU;QACV,aAAa;QACb,qBAAqB;KACtB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IACD,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;IACtC,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAChE,MAAM,aAAa,GAAG,IAAI,gBAAgB,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG;QACd,aAAa;QACb,MAAM;QACN,WAAW;QACX,WAAW;QACX,YAAY;QACZ,aAAa;KACd,CAAC;IAEF,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,MAAM,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC5C,OAAO;QACT,KAAK,QAAQ;YACX,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO;QACT,KAAK,QAAQ;YACX,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO;QACT,KAAK,QAAQ;YACX,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO;QACT,KAAK,OAAO;YACV,MAAM,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC5C,OAAO;QACT,KAAK,MAAM;YACT,MAAM,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC3C,OAAO;QACT,KAAK,QAAQ;YACX,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO;QACT,KAAK,QAAQ;YACX,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO;QACT,KAAK,SAAS;YACZ,MAAM,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO;QACT,KAAK,WAAW;YACd,MAAM,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAChD,OAAO;QACT,KAAK,QAAQ;YACX,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO;QACT,KAAK,aAAa;YAChB,MAAM,oBAAoB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACjD,OAAO;QACT,KAAK,eAAe;YAClB,MAAM,sBAAsB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACnD,OAAO;QACT,KAAK,OAAO;YACV,MAAM,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC5C,OAAO;QACT;YACE,IAAI,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxC,8EAA8E;gBAC9E,2EAA2E;gBAC3E,0EAA0E;gBAC1E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;gBACxD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjD,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,oBAAoB,OAAO,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAS;IAC7C,OAAO;IACP,OAAO;IACP,KAAK;IACL,OAAO;IACP,MAAM;IACN,SAAS;IACT,UAAU;IACV,SAAS;IACT,MAAM;IACN,OAAO;IACP,OAAO;IACP,QAAQ;IACR,WAAW;IACX,MAAM;IACN,WAAW;IACX,QAAQ;IACR,WAAW;IACX,cAAc;IACd,OAAO;IACP,SAAS;CACV,CAAC,CAAC;AAEH,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,MAAM,EAAE,aAAa,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC"}
+{"version":3,"file":"vibecodr-mcp.js","sourceRoot":"","sources":["../../src/bin/vibecodr-mcp.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,YAAY,EAAE,CAAC;AACf,MAAM,qBAAqB,EAAE,CAAC;AAE9B,SAAS,QAAQ;IACf,OAAO;QACL,8BAA8B;QAC9B,uDAAuD;QACvD,EAAE;QACF,WAAW;QACX,SAAS;QACT,UAAU;QACV,UAAU;QACV,UAAU;QACV,qBAAqB;QACrB,oBAAoB;QACpB,uBAAuB;QACvB,2DAA2D;QAC3D,UAAU;QACV,oBAAoB;QACpB,sBAAsB;QACtB,UAAU;QACV,iFAAiF;QACjF,gFAAgF;QAChF,6DAA6D;QAC7D,sFAAsF;QACtF,iFAAiF;QACjF,EAAE;QACF,eAAe;QACf,oBAAoB;QACpB,UAAU;QACV,aAAa;QACb,qBAAqB;KACtB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IACD,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;IACtC,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAChE,MAAM,aAAa,GAAG,IAAI,gBAAgB,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG;QACd,aAAa;QACb,MAAM;QACN,WAAW;QACX,WAAW;QACX,YAAY;QACZ,aAAa;KACd,CAAC;IAEF,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,MAAM,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC5C,OAAO;QACT,KAAK,QAAQ;YACX,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO;QACT,KAAK,QAAQ;YACX,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO;QACT,KAAK,QAAQ;YACX,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO;QACT,KAAK,OAAO;YACV,MAAM,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC5C,OAAO;QACT,KAAK,MAAM;YACT,MAAM,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC3C,OAAO;QACT,KAAK,QAAQ;YACX,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO;QACT,KAAK,QAAQ;YACX,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO;QACT,KAAK,SAAS;YACZ,MAAM,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO;QACT,KAAK,WAAW;YACd,MAAM,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAChD,OAAO;QACT,KAAK,QAAQ;YACX,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO;QACT,KAAK,aAAa;YAChB,MAAM,oBAAoB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACjD,OAAO;QACT,KAAK,eAAe;YAClB,MAAM,sBAAsB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACnD,OAAO;QACT,KAAK,OAAO;YACV,MAAM,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC5C,OAAO;QACT;YACE,IAAI,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxC,8EAA8E;gBAC9E,2EAA2E;gBAC3E,0EAA0E;gBAC1E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;gBACxD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjD,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,oBAAoB,OAAO,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAS;IAC7C,OAAO;IACP,OAAO;IACP,KAAK;IACL,OAAO;IACP,MAAM;IACN,SAAS;IACT,UAAU;IACV,SAAS;IACT,MAAM;IACN,OAAO;IACP,OAAO;IACP,QAAQ;IACR,WAAW;IACX,MAAM;IACN,WAAW;IACX,QAAQ;IACR,WAAW;IACX,cAAc;IACd,OAAO;IACP,SAAS;CACV,CAAC,CAAC;AAEH,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,MAAM,EAAE,aAAa,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC"}

package/dist/clients/claude-code.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claude-code.d.ts","sourceRoot":"","sources":["../../src/clients/claude-code.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,cAAc,EAAE,KAAK,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAazD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CA8CvF;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA8CtH"}
+{"version":3,"file":"claude-code.d.ts","sourceRoot":"","sources":["../../src/clients/claude-code.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,cAAc,EAAE,KAAK,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAazD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAkDvF;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA8CtH"}

package/dist/clients/claude-code.js

@@ -20,7 +20,11 @@ export async function installClaudeCode(request) {
             changed: false,
             location: spawnLocation(),
             managed: true,
-            nextStep: "Dry run: would call `claude mcp add --transport http <name> <serverUrl>` to register the Agent Computer."
+            nextStep: "Dry run: would call `claude mcp add --transport http <name> <serverUrl>` to register the Agent Computer.",
+            spawn: {
+                command: CLAUDE_BINARY,
+                args: ["mcp", "add", "--transport", "http", request.name, request.serverUrl]
+            }
         };
     }
     if (!commandExists(CLAUDE_BINARY)) {

package/dist/clients/claude-code.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../src/clients/claude-code.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,YAAY,EAA8C,MAAM,WAAW,CAAC;AAGrF,0FAA0F;AAC1F,wFAAwF;AACxF,sFAAsF;AACtF,4DAA4D;AAE5D,MAAM,aAAa,GAAG,QAAQ,CAAC;AAE/B,SAAS,aAAa;IACpB,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAuB;IAC7D,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,aAAa,EAAE;YACzB,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,0GAA0G;SACrH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,QAAQ,CAChB,iCAAiC,EACjC,qIAAqI,EACrI,UAAU,CAAC,eAAe,EAC1B;YACE,QAAQ,EAAE,oFAAoF;SAC/F,CACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1G,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAChB,gCAAgC,EAChC,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EACnF,UAAU,CAAC,eAAe,EAC1B;YACE,QAAQ,EAAE,uEAAuE;SAClF,CACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,aAAa;QACrB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,aAAa,EAAE;QACzB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,sFAAsF;KACjG,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAyB,EAAE,gBAAyB;IAC5F,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,aAAa,EAAE;YACzB,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,kFAAkF;SAC7F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,QAAQ,CAChB,iCAAiC,EACjC,+DAA+D,EAC/D,UAAU,CAAC,eAAe,EAC1B;YACE,QAAQ,EAAE,sCAAsC;SACjD,CACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAChB,gCAAgC,EAChC,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EACtF,UAAU,CAAC,eAAe,EAC1B;YACE,QAAQ,EAAE,0CAA0C;SACrD,CACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,aAAa;QACrB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,mBAAmB;QAC7B,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,2CAA2C;KACtD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../src/clients/claude-code.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,YAAY,EAA8C,MAAM,WAAW,CAAC;AAGrF,0FAA0F;AAC1F,wFAAwF;AACxF,sFAAsF;AACtF,4DAA4D;AAE5D,MAAM,aAAa,GAAG,QAAQ,CAAC;AAE/B,SAAS,aAAa;IACpB,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAuB;IAC7D,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,aAAa,EAAE;YACzB,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,0GAA0G;YACpH,KAAK,EAAE;gBACL,OAAO,EAAE,aAAa;gBACtB,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;aAC7E;SACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,QAAQ,CAChB,iCAAiC,EACjC,qIAAqI,EACrI,UAAU,CAAC,eAAe,EAC1B;YACE,QAAQ,EAAE,oFAAoF;SAC/F,CACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1G,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAChB,gCAAgC,EAChC,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EACnF,UAAU,CAAC,eAAe,EAC1B;YACE,QAAQ,EAAE,uEAAuE;SAClF,CACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,aAAa;QACrB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,aAAa,EAAE;QACzB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,sFAAsF;KACjG,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAyB,EAAE,gBAAyB;IAC5F,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,aAAa,EAAE;YACzB,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,kFAAkF;SAC7F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,QAAQ,CAChB,iCAAiC,EACjC,+DAA+D,EAC/D,UAAU,CAAC,eAAe,EAC1B;YACE,QAAQ,EAAE,sCAAsC;SACjD,CACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAChB,gCAAgC,EAChC,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EACtF,UAAU,CAAC,eAAe,EAC1B;YACE,QAAQ,EAAE,0CAA0C;SACrD,CACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,aAAa;QACrB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,mBAAmB;QAC7B,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,2CAA2C;KACtD,CAAC;AACJ,CAAC"}

package/dist/core/env.d.ts

@@ -0,0 +1,13 @@
+export declare const ENV_ALIAS_MAP: Readonly<Record<string, readonly string[]>>;
+export declare const DEPRECATION_OPT_OUT_ENV = "VIBECDR_NO_DEPRECATION_NOTICE";
+interface ReconcileOptions {
+    env?: NodeJS.ProcessEnv;
+    stream?: {
+        write(chunk: string): unknown;
+    };
+    warned?: Set<string>;
+}
+export declare function reconcileEnv(options?: ReconcileOptions): void;
+export declare function __resetDeprecationStateForTests(): void;
+export {};
+//# sourceMappingURL=env.d.ts.map

package/dist/core/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/core/env.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CASrE,CAAC;AAEF,eAAO,MAAM,uBAAuB,kCAAkC,CAAC;AAEvE,UAAU,gBAAgB;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAG3C,MAAM,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACtB;AAID,wBAAgB,YAAY,CAAC,OAAO,GAAE,gBAAqB,GAAG,IAAI,CA+BjE;AAID,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD"}

package/dist/core/env.js

@@ -0,0 +1,62 @@
+// VIBECDR_* canonical names with back-compat aliases for VC_TOOLS_* (formerly the
+// @vibecodr/vc-tools surface) and VIBECDR_MCP_* (formerly the @vibecodr/cli@0.2.x
+// surface). reconcileEnv() runs once per bin invocation and synchronizes the
+// canonical and legacy names so both old and new code paths see the same value,
+// then emits a one-time stderr deprecation notice for each legacy name that was
+// actually used. Set VIBECDR_NO_DEPRECATION_NOTICE=1 to suppress the notice
+// (useful in scripts / CI logs that already understand the migration).
+//
+// The legacy code paths under src/legacy/ continue to read VC_TOOLS_* directly,
+// and the MCP-CLI code paths continue to read VIBECDR_MCP_* directly. reconcileEnv
+// does not change which env names the consumers read; it only makes both names
+// addressable so users can migrate their scripts to VIBECDR_* without breaking
+// existing setups.
+export const ENV_ALIAS_MAP = {
+    VIBECDR_CONFIG_DIR: ["VC_TOOLS_CONFIG_DIR", "VIBECDR_MCP_CONFIG_PATH"],
+    VIBECDR_CREDENTIAL_STORE: ["VC_TOOLS_CREDENTIAL_STORE"],
+    VIBECDR_CIMD_CLIENT_ID: ["VIBECDR_MCP_CIMD_CLIENT_ID"],
+    VIBECDR_MANUAL_CLIENT_ID: ["VIBECDR_MCP_MANUAL_CLIENT_ID"],
+    VIBECDR_INSTALL_MANIFEST_PATH: ["VIBECDR_MCP_INSTALL_MANIFEST_PATH"],
+    VIBECDR_INSECURE_SECRET_STORE_PATH: ["VIBECDR_MCP_INSECURE_SECRET_STORE_PATH"],
+    VIBECDR_ENABLE_INSECURE_SECRET_STORE: ["VIBECDR_MCP_ENABLE_INSECURE_SECRET_STORE"],
+    VIBECDR_TEST_AUTH_URL_FILE: ["VIBECDR_MCP_TEST_AUTH_URL_FILE"]
+};
+export const DEPRECATION_OPT_OUT_ENV = "VIBECDR_NO_DEPRECATION_NOTICE";
+const moduleWarned = new Set();
+export function reconcileEnv(options = {}) {
+    const env = options.env ?? process.env;
+    const stream = options.stream ?? process.stderr;
+    const warned = options.warned ?? moduleWarned;
+    const suppressNotice = env[DEPRECATION_OPT_OUT_ENV] === "1";
+    for (const [canonical, legacyNames] of Object.entries(ENV_ALIAS_MAP)) {
+        const canonicalValue = env[canonical];
+        if (canonicalValue !== undefined && canonicalValue !== "") {
+            // Canonical set; propagate to any legacy name that isn't set so legacy
+            // code paths see the canonical value.
+            for (const legacy of legacyNames) {
+                if (env[legacy] === undefined) {
+                    env[legacy] = canonicalValue;
+                }
+            }
+            continue;
+        }
+        // Canonical not set; find the first legacy name present.
+        for (const legacy of legacyNames) {
+            const legacyValue = env[legacy];
+            if (legacyValue !== undefined && legacyValue !== "") {
+                env[canonical] = legacyValue;
+                if (!warned.has(legacy) && !suppressNotice) {
+                    warned.add(legacy);
+                    stream.write(`Notice: ${legacy} is accepted for back-compat; future releases will prefer ${canonical}. Set ${DEPRECATION_OPT_OUT_ENV}=1 to silence.\n`);
+                }
+                break;
+            }
+        }
+    }
+}
+// Test-only helper. Production code never needs to reset the warned set; bin
+// entries call reconcileEnv exactly once.
+export function __resetDeprecationStateForTests() {
+    moduleWarned.clear();
+}
+//# sourceMappingURL=env.js.map

package/dist/core/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/core/env.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,kFAAkF;AAClF,6EAA6E;AAC7E,gFAAgF;AAChF,gFAAgF;AAChF,4EAA4E;AAC5E,uEAAuE;AACvE,EAAE;AACF,gFAAgF;AAChF,mFAAmF;AACnF,+EAA+E;AAC/E,+EAA+E;AAC/E,mBAAmB;AAEnB,MAAM,CAAC,MAAM,aAAa,GAAgD;IACxE,kBAAkB,EAAE,CAAC,qBAAqB,EAAE,yBAAyB,CAAC;IACtE,wBAAwB,EAAE,CAAC,2BAA2B,CAAC;IACvD,sBAAsB,EAAE,CAAC,4BAA4B,CAAC;IACtD,wBAAwB,EAAE,CAAC,8BAA8B,CAAC;IAC1D,6BAA6B,EAAE,CAAC,mCAAmC,CAAC;IACpE,kCAAkC,EAAE,CAAC,wCAAwC,CAAC;IAC9E,oCAAoC,EAAE,CAAC,0CAA0C,CAAC;IAClF,0BAA0B,EAAE,CAAC,gCAAgC,CAAC;CAC/D,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,+BAA+B,CAAC;AAUvE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;AAEvC,MAAM,UAAU,YAAY,CAAC,UAA4B,EAAE;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC;IAC9C,MAAM,cAAc,GAAG,GAAG,CAAC,uBAAuB,CAAC,KAAK,GAAG,CAAC;IAE5D,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACrE,MAAM,cAAc,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,EAAE,EAAE,CAAC;YAC1D,uEAAuE;YACvE,sCAAsC;YACtC,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;gBACjC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;oBAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,cAAc,CAAC;gBAC/B,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QACD,yDAAyD;QACzD,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;YACjC,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;YAChC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;gBACpD,GAAG,CAAC,SAAS,CAAC,GAAG,WAAW,CAAC;gBAC7B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;oBAC3C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBACnB,MAAM,CAAC,KAAK,CAAC,WAAW,MAAM,6DAA6D,SAAS,SAAS,uBAAuB,kBAAkB,CAAC,CAAC;gBAC1J,CAAC;gBACD,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,0CAA0C;AAC1C,MAAM,UAAU,+BAA+B;IAC7C,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC"}

package/dist/legacy/config/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/legacy/config/store.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,eAAe,iCAAiC,CAAC;AAE9D,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,CAAC,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CACzC;AAED,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;AAEjE,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,gBAAgB,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IACjF,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,OAAO,CAAC;IAChD,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC/C,KAAK,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CACjC;AAYD,qBAAa,WAAW;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,cAAc,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkB;gBAElC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU;IAM/C,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,WAAW;IAIhE,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC;IAcnC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAStF,UAAU,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,aAAa,CAAA;KAAE,CAAC;IAUnF,aAAa,IAAI,OAAO,CAAC,eAAe,CAAC;IAKzC,aAAa,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD,qBAAqB,CAAC,UAAU,EAAE,qBAAqB,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAU5F,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAS5C,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAI5D,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7D,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIlD,OAAO,IAAI,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,OAAO,CAAC;QAAC,gBAAgB,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,QAAQ,GAAG,MAAM,CAAA;KAAE,CAAC;IAQ/H,UAAU,IAAI,MAAM;IAIpB,eAAe,IAAI,MAAM;YAIX,gBAAgB;IAYxB,sCAAsC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;YAI3E,yBAAyB;CAUxC;AA8CD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAclF"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/legacy/config/store.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,eAAe,iCAAiC,CAAC;AAE9D,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,CAAC,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CACzC;AAED,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;AAEjE,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,gBAAgB,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IACjF,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,OAAO,CAAC;IAChD,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC/C,KAAK,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CACjC;AAYD,qBAAa,WAAW;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,cAAc,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkB;gBAElC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU;IAM/C,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,WAAW;IAIhE,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC;IAcnC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAStF,UAAU,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,aAAa,CAAA;KAAE,CAAC;IAUnF,aAAa,IAAI,OAAO,CAAC,eAAe,CAAC;IAKzC,aAAa,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD,qBAAqB,CAAC,UAAU,EAAE,qBAAqB,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAU5F,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAS5C,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAI5D,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7D,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIlD,OAAO,IAAI,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,OAAO,CAAC;QAAC,gBAAgB,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,QAAQ,GAAG,MAAM,CAAA;KAAE,CAAC;IAQ/H,UAAU,IAAI,MAAM;IAIpB,eAAe,IAAI,MAAM;YAIX,gBAAgB;IAYxB,sCAAsC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;YAI3E,yBAAyB;CAUxC;AAqDD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAmBlF"}

package/dist/legacy/config/store.js

@@ -1,4 +1,4 @@
-import { promises as fs } from "node:fs";
+import { existsSync, promises as fs } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { CliError } from "../cli/errors.js";
@@ -170,6 +170,12 @@ class FileCredentialStore {
         await this.store.writeJsonPrivateForCredentialStoreOnly(this.store.credentialsPath(), credentials);
     }
 }
+function legacyVcToolsConfigDir(env) {
+    if (process.platform === "win32") {
+        return path.join(env.APPDATA ?? path.join(os.homedir(), "AppData", "Roaming"), "vc-tools");
+    }
+    return path.join(env.XDG_CONFIG_HOME ?? path.join(os.homedir(), ".config"), "vc-tools");
+}
 export function resolveConfigDir(env, override) {
     if (override) {
         return path.resolve(override);
@@ -177,10 +183,18 @@ export function resolveConfigDir(env, override) {
     if (env.VC_TOOLS_CONFIG_DIR) {
         return path.resolve(env.VC_TOOLS_CONFIG_DIR);
     }
-    if (process.platform === "win32") {
-        return path.join(env.APPDATA ?? path.join(os.homedir(), "AppData", "Roaming"), "vc-tools");
-    }
-    return path.join(env.XDG_CONFIG_HOME ?? path.join(os.homedir(), ".config"), "vc-tools");
+    // Prefer the post-merge canonical ~/.vibecodr/tools/ tree (populated by
+    // src/storage/migrate.ts) so the legacy code path stops reading from
+    // %APPDATA%\vc-tools after migration runs. Fall back to the legacy
+    // location for un-migrated users; if neither exists yet, return canonical
+    // so first-write lands there.
+    const canonical = path.join(os.homedir(), ".vibecodr", "tools");
+    if (existsSync(canonical))
+        return canonical;
+    const legacy = legacyVcToolsConfigDir(env);
+    if (existsSync(legacy))
+        return legacy;
+    return canonical;
 }
 function normalizeConfig(value) {
     if (!isRecord(value) || value.version !== 1 || typeof value.selectedProfile !== "string" || !isRecord(value.profiles)) {