@wootsup/yt-builder-mcp 1.3.0 → 1.4.1

package/dist/setup-ca-env.d.ts

@@ -0,0 +1,40 @@
+/**
+ * `setup-ca-env` — translate a wizard/CLI CA choice into MCP-server env keys.
+ *
+ * G-D #7: corporate TLS-inspection has two trust strategies, and exactly which
+ * env the server entry needs depends on the running Node:
+ *
+ *   - **file mode** (`caCertPath`): write `NODE_EXTRA_CA_CERTS=<path>`. Works on
+ *     every supported Node; the only option below the system-CA floor.
+ *   - **system mode** (`caMode: 'system'`): write `NODE_OPTIONS=--use-system-ca`
+ *     so Node reads the OS trust store (Windows CryptoAPI / macOS Keychain) —
+ *     the zero-export path, but only on Node ≥ 22.15. Below that floor we emit
+ *     NOTHING and warn to supply a `.pem` instead, so we never write a flag the
+ *     target Node would reject at startup.
+ *
+ * Pure + Node-version-injectable so it is unit-testable offline. Never disables
+ * TLS verification.
+ *
+ * @license MIT
+ */
+/** The CA-trust portion of a {@link WizardAnswers}. */
+export interface CaChoice {
+    readonly caCertPath?: string;
+    readonly caMode?: 'system';
+}
+export interface CaEnvResult {
+    /** Env keys to merge into the MCP server entry's env block. */
+    readonly env: Record<string, string>;
+    /** Non-fatal warnings (e.g. system-CA requested on too-old a Node). */
+    readonly warnings: readonly string[];
+}
+/**
+ * Resolve the CA env-block keys for `choice` under `nodeVersion` (default
+ * `process.version`). `currentEnv` (default `process.env`) is only read to
+ * preserve a pre-existing `NODE_OPTIONS` when appending the system-CA flag.
+ *
+ * File mode wins deterministically if both are set (an explicit `.pem` is the
+ * stronger signal). Pure — returns a fresh object, mutates nothing.
+ */
+export declare function buildCaEnv(choice: CaChoice, nodeVersion?: string, currentEnv?: NodeJS.ProcessEnv): CaEnvResult;
+//# sourceMappingURL=setup-ca-env.d.ts.map

package/dist/setup-ca-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-ca-env.d.ts","sourceRoot":"","sources":["../src/setup-ca-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,uDAAuD;AACvD,MAAM,WAAW,QAAQ;IACrB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IACxB,+DAA+D;IAC/D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAYD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CACtB,MAAM,EAAE,QAAQ,EAChB,WAAW,GAAE,MAAwB,EACrC,UAAU,GAAE,MAAM,CAAC,UAAwB,GAC5C,WAAW,CAoBb"}

package/dist/setup-ca-env.js

@@ -0,0 +1,58 @@
+/**
+ * `setup-ca-env` — translate a wizard/CLI CA choice into MCP-server env keys.
+ *
+ * G-D #7: corporate TLS-inspection has two trust strategies, and exactly which
+ * env the server entry needs depends on the running Node:
+ *
+ *   - **file mode** (`caCertPath`): write `NODE_EXTRA_CA_CERTS=<path>`. Works on
+ *     every supported Node; the only option below the system-CA floor.
+ *   - **system mode** (`caMode: 'system'`): write `NODE_OPTIONS=--use-system-ca`
+ *     so Node reads the OS trust store (Windows CryptoAPI / macOS Keychain) —
+ *     the zero-export path, but only on Node ≥ 22.15. Below that floor we emit
+ *     NOTHING and warn to supply a `.pem` instead, so we never write a flag the
+ *     target Node would reject at startup.
+ *
+ * Pure + Node-version-injectable so it is unit-testable offline. Never disables
+ * TLS verification.
+ *
+ * @license MIT
+ */
+import { supportsSystemCa } from './diagnostics/ca-trust.js';
+const SYSTEM_CA_FLAG = '--use-system-ca';
+/** Append `--use-system-ca` to an existing NODE_OPTIONS without duplicating it. */
+function withSystemCaFlag(existing) {
+    const trimmed = (existing ?? '').trim();
+    if (trimmed === '')
+        return SYSTEM_CA_FLAG;
+    if (trimmed.split(/\s+/).includes(SYSTEM_CA_FLAG))
+        return trimmed;
+    return `${trimmed} ${SYSTEM_CA_FLAG}`;
+}
+/**
+ * Resolve the CA env-block keys for `choice` under `nodeVersion` (default
+ * `process.version`). `currentEnv` (default `process.env`) is only read to
+ * preserve a pre-existing `NODE_OPTIONS` when appending the system-CA flag.
+ *
+ * File mode wins deterministically if both are set (an explicit `.pem` is the
+ * stronger signal). Pure — returns a fresh object, mutates nothing.
+ */
+export function buildCaEnv(choice, nodeVersion = process.version, currentEnv = process.env) {
+    const path = choice.caCertPath?.trim();
+    if (path !== undefined && path !== '') {
+        return { env: { NODE_EXTRA_CA_CERTS: path }, warnings: [] };
+    }
+    if (choice.caMode === 'system') {
+        if (supportsSystemCa(nodeVersion)) {
+            return { env: { NODE_OPTIONS: withSystemCaFlag(currentEnv.NODE_OPTIONS) }, warnings: [] };
+        }
+        return {
+            env: {},
+            warnings: [
+                `OS trust store (--use-system-ca) needs Node ≥ 22.15 — this Node is ${nodeVersion}. ` +
+                    'Re-run setup with `--ca <path-to-corp-root-ca.pem>` (export your corporate root CA to a .pem) instead. Never disable TLS verification.',
+            ],
+        };
+    }
+    return { env: {}, warnings: [] };
+}
+//# sourceMappingURL=setup-ca-env.js.map

package/dist/setup-ca-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-ca-env.js","sourceRoot":"","sources":["../src/setup-ca-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAe7D,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEzC,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,QAA4B;IAClD,MAAM,OAAO,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,cAAc,CAAC;IAC1C,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,OAAO,CAAC;IAClE,OAAO,GAAG,OAAO,IAAI,cAAc,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CACtB,MAAgB,EAChB,cAAsB,OAAO,CAAC,OAAO,EACrC,aAAgC,OAAO,CAAC,GAAG;IAE3C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACpC,OAAO,EAAE,GAAG,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChE,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,GAAG,EAAE,EAAE,YAAY,EAAE,gBAAgB,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC9F,CAAC;QACD,OAAO;YACH,GAAG,EAAE,EAAE;YACP,QAAQ,EAAE;gBACN,sEAAsE,WAAW,IAAI;oBACjF,wIAAwI;aAC/I;SACJ,CAAC;IACN,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AACrC,CAAC"}

package/dist/setup-ca-reprobe.d.ts

@@ -0,0 +1,38 @@
+/**
+ * `setup-ca-reprobe` — default `WizardDeps.applyAndReProbe` (G-D #6/#8).
+ *
+ * After the user picks a corporate-CA strategy, RE-PROBE the connection so the
+ * wizard can print ✅/❌ now instead of leaving a silent first-tool-call
+ * timeout for after the restart:
+ *
+ *   - **file mode**: read the `.pem` and run the probes through an undici
+ *     `Agent` whose connector trusts that CA — this validates in-process,
+ *     immediately, without a restart.
+ *   - **system mode**: the OS trust store is only consulted when Node is
+ *     (re)started with `--use-system-ca`, which the written config now does —
+ *     so we re-run the ordinary probes (best-effort) and report the truthful
+ *     current state; the config is already correct for the next launch.
+ *
+ * Never disables TLS verification.
+ *
+ * @license MIT
+ */
+import type { AuthProbeResult, CaPromptChoice, HealthProbeResult } from './setup-wizard-types.js';
+/**
+ * Probe health + auth for `wpUrl`/`bearer` under the chosen CA. The probes are
+ * injected (default to the real handshake probes) so this stays testable; the
+ * file-mode CA wiring is the only real-I/O part and is exercised by an
+ * integration probe, never a unit mock.
+ */
+export declare function defaultApplyAndReProbe(input: {
+    readonly wpUrl: string;
+    readonly bearer: string;
+    readonly choice: CaPromptChoice;
+}, probes?: {
+    probeHealth?: (wpUrl: string, fetchImpl?: typeof fetch) => Promise<HealthProbeResult>;
+    probeAuth?: (wpUrl: string, bearer: string, fetchImpl?: typeof fetch) => Promise<AuthProbeResult>;
+}): Promise<{
+    health: HealthProbeResult;
+    auth: AuthProbeResult;
+}>;
+//# sourceMappingURL=setup-ca-reprobe.d.ts.map

package/dist/setup-ca-reprobe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-ca-reprobe.d.ts","sourceRoot":"","sources":["../src/setup-ca-reprobe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAElG;;;;;GAKG;AACH,wBAAsB,sBAAsB,CACxC,KAAK,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;CAAE,EAC3F,MAAM,GAAE;IACJ,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACtF,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CAChG,GACP,OAAO,CAAC;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC,CAkB/D"}

package/dist/setup-ca-reprobe.js

@@ -0,0 +1,68 @@
+/**
+ * `setup-ca-reprobe` — default `WizardDeps.applyAndReProbe` (G-D #6/#8).
+ *
+ * After the user picks a corporate-CA strategy, RE-PROBE the connection so the
+ * wizard can print ✅/❌ now instead of leaving a silent first-tool-call
+ * timeout for after the restart:
+ *
+ *   - **file mode**: read the `.pem` and run the probes through an undici
+ *     `Agent` whose connector trusts that CA — this validates in-process,
+ *     immediately, without a restart.
+ *   - **system mode**: the OS trust store is only consulted when Node is
+ *     (re)started with `--use-system-ca`, which the written config now does —
+ *     so we re-run the ordinary probes (best-effort) and report the truthful
+ *     current state; the config is already correct for the next launch.
+ *
+ * Never disables TLS verification.
+ *
+ * @license MIT
+ */
+import { readFile } from 'node:fs/promises';
+import { Agent, fetch as undiciFetch } from 'undici';
+import { defaultProbeAuth, defaultProbeHealth } from './setup-wizard-handshake.js';
+/**
+ * Probe health + auth for `wpUrl`/`bearer` under the chosen CA. The probes are
+ * injected (default to the real handshake probes) so this stays testable; the
+ * file-mode CA wiring is the only real-I/O part and is exercised by an
+ * integration probe, never a unit mock.
+ */
+export async function defaultApplyAndReProbe(input, probes = {}) {
+    const probeHealth = probes.probeHealth ?? defaultProbeHealth;
+    const probeAuth = probes.probeAuth ?? defaultProbeAuth;
+    if (input.choice.choice === 'file') {
+        const fetchImpl = await caBoundFetch(input.choice.path);
+        if (fetchImpl !== null) {
+            const health = await probeHealth(input.wpUrl, fetchImpl);
+            const auth = await probeAuth(input.wpUrl, input.bearer, fetchImpl);
+            return { health, auth };
+        }
+        // Could not read the .pem — fall through to a plain re-probe so the
+        // operator still gets a (failing) verdict + the file warning above.
+    }
+    const health = await probeHealth(input.wpUrl);
+    const auth = await probeAuth(input.wpUrl, input.bearer);
+    return { health, auth };
+}
+/**
+ * A `fetch` whose TLS connector additionally trusts the PEM at `caPath`, or
+ * `null` when the file cannot be read. The CA is ADDED to the default trust
+ * set (undici merges it with the system roots) — verification stays on.
+ */
+async function caBoundFetch(caPath) {
+    let ca;
+    try {
+        ca = await readFile(caPath, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    const agent = new Agent({ connect: { ca } });
+    // undici's fetch accepts a per-call `dispatcher`; wrap it to match the
+    // global `fetch` signature the RestClient expects.
+    const bound = ((input, init) => undiciFetch(input, {
+        ...init,
+        dispatcher: agent,
+    }));
+    return bound;
+}
+//# sourceMappingURL=setup-ca-reprobe.js.map

package/dist/setup-ca-reprobe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-ca-reprobe.js","sourceRoot":"","sources":["../src/setup-ca-reprobe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,QAAQ,CAAC;AAErD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAGnF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CACxC,KAA2F,EAC3F,SAGI,EAAE;IAEN,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,gBAAgB,CAAC;IAEvD,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACzD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACnE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QACD,oEAAoE;QACpE,oEAAoE;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,MAAc;IACtC,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACD,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7C,uEAAuE;IACvE,mDAAmD;IACnD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAkC,EAAE,IAAkC,EAAE,EAAE,CACtF,WAAW,CAAC,KAA0C,EAAE;QACpD,GAAI,IAA0C;QAC9C,UAAU,EAAE,KAAK;KACpB,CAAwC,CAAiB,CAAC;IAC/D,OAAO,KAAK,CAAC;AACjB,CAAC"}

package/dist/setup-cli.d.ts

@@ -29,7 +29,7 @@ import { type ListSitesDeps } from './sites/cli/list-sites.js';
 import { type RemoveSiteDeps } from './sites/cli/remove-site.js';
 import { type SetDefaultDeps } from './sites/cli/set-default.js';
 import { type TestSiteDeps } from './sites/cli/test-site.js';
-export { DEFAULT_WIZARD_DEPS, majorMinor, runWizard, type AuthProbeResult, type HandshakeResult, type HealthProbeResult, type WizardAnswers, type WizardDeps, type WriteResult, } from './setup-wizard.js';
+export { DEFAULT_WIZARD_DEPS, majorMinor, runWizard, type AuthProbeResult, type CaPromptChoice, type HandshakeResult, type HealthProbeResult, type WizardAnswers, type WizardDeps, type WriteResult, } from './setup-wizard.js';
 export interface ParsedSetupArgs {
     /** True when `--non-interactive` was passed. Always boolean. */
     readonly nonInteractive: boolean;
@@ -58,14 +58,41 @@ export interface ParsedSetupArgs {
      * pickup mode"). These do NOT block the wizard from running.
      */
     readonly warnings: readonly string[];
+    /**
+     * Path to a corporate/proxy root CA `.pem` from `--ca <path>`. When set,
+     * the generated server entry's env block gets `NODE_EXTRA_CA_CERTS=<path>`
+     * so the MCP server trusts a TLS-inspection chain (never `strict-ssl
+     * false`). Mutually exclusive with {@link caMode}.
+     */
+    readonly caCertPath?: string;
+    /**
+     * Corporate-CA trust strategy from `--ca=system` / `--use-system-ca`.
+     * `'system'` writes `NODE_OPTIONS=--use-system-ca` into the env block so
+     * Node reads the OS trust store (Windows CryptoAPI / macOS Keychain) — the
+     * zero-export path on Node ≥ 22.15. Mutually exclusive with
+     * {@link caCertPath}. Undefined = no system-CA request.
+     */
+    readonly caMode?: 'system';
+    /**
+     * Glöckle gap #15 — version pin from `--pin <version>`. When set, the
+     * generated client config runs `npx -y @wootsup/yt-builder-mcp@<version>`
+     * (reproducible / air-gapped) instead of the default floating `@latest`.
+     * Falls back to the `YTB_MCP_VERSION` env var when the flag is absent
+     * (resolved by the dispatcher, which holds process.env). Undefined = float.
+     */
+    readonly versionPin?: string;
 }
 /**
  * Parse the `setup` subcommand argv tail. Pure function; does no I/O.
  *
  * Accepts both `--key value` and `--key=value` styles. Unknown flags
  * are reported as errors so typos don't silently disable validation.
+ *
+ * `env` (default `{}`, kept empty so the function stays pure) supplies the
+ * `YTB_MCP_VERSION` fallback for the `--pin` version-pin (Glöckle gap #15):
+ * an explicit `--pin` always wins; otherwise `YTB_MCP_VERSION` is used.
  */
-export declare function parseSetupArgs(argv: readonly string[]): ParsedSetupArgs;
+export declare function parseSetupArgs(argv: readonly string[], env?: NodeJS.ProcessEnv): ParsedSetupArgs;
 /**
  * Build a `WizardDeps` bag that answers prompts from CLI flags instead
  * of asking a human. Reuses every other dependency (probes, writes,
@@ -138,6 +165,14 @@ export interface RunCliDeps {
      * nothing and the wizard uses `DEFAULT_WIZARD_DEPS`.
      */
     runWizard: (deps?: WizardDeps) => Promise<number>;
+    /**
+     * Base `WizardDeps` the INTERACTIVE setup path folds (withCa / withPin /
+     * withPersist) over. Defaults to {@link DEFAULT_WIZARD_DEPS}. Tests inject a
+     * bag with a synthetic `prompt` + capturing `writeClient` so the folds can
+     * be asserted on the default interactive run without driving real clack
+     * prompts. Production callers never set this.
+     */
+    interactiveWizardDeps?: WizardDeps;
     installSkill: typeof defaultInstallSkill;
     log?: (line: string) => void;
     error?: (line: string) => void;

package/dist/setup-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-cli.d.ts","sourceRoot":"","sources":["../src/setup-cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,YAAY,IAAI,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAKzE,OAAO,KAAK,EAAiB,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAIH,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAIH,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAGH,KAAK,aAAa,EACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAIH,KAAK,cAAc,EACtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAIH,KAAK,cAAc,EACtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAKH,KAAK,YAAY,EACpB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EACH,mBAAmB,EACnB,UAAU,EACV,SAAS,EACT,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,WAAW,GACnB,MAAM,mBAAmB,CAAC;AA+F3B,MAAM,WAAW,eAAe;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,0FAA0F;IAC1F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,CAyGvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACnC,MAAM,EAAE,eAAe,EACvB,IAAI,GAAE,UAAgC,GACvC,UAAU,CAWZ;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC3B,MAAM,EAAE,eAAe,EACvB,IAAI,GAAE,UAAgC,GACvC,UAAU,CA+BZ;AAID;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,iBAAiB,CAuH3E;AA8ED,0EAA0E;AAC1E,MAAM,WAAW,mBAAmB;IAChC,mDAAmD;IACnD,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,mDAAmD;IACnD,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,iCAAiC;IACjC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,mBAAmB,CAkC/E;AA4ED,MAAM,WAAW,UAAU;IACvB;;;;OAIG;IACH,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,YAAY,EAAE,OAAO,mBAAmB,CAAC;IACzC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAC;IAChC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAChB,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,MAAM,KACX,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5B;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,eAAe,CAAC,EAAE,CACd,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,KAChC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAChC;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE;QACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;QAC9C,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;QACjC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;KACvC,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;CAC5C;AAED,wBAAsB,MAAM,CACxB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,GAC3B,OAAO,CAAC,MAAM,CAAC,CAgbjB"}
+{"version":3,"file":"setup-cli.d.ts","sourceRoot":"","sources":["../src/setup-cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,YAAY,IAAI,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAKzE,OAAO,KAAK,EAAiB,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAIH,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAIH,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAGH,KAAK,aAAa,EACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAIH,KAAK,cAAc,EACtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAIH,KAAK,cAAc,EACtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAKH,KAAK,YAAY,EACpB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EACH,mBAAmB,EACnB,UAAU,EACV,SAAS,EACT,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,WAAW,GACnB,MAAM,mBAAmB,CAAC;AAoJ3B,MAAM,WAAW,eAAe;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,0FAA0F;IAC1F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC1B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,GAAE,MAAM,CAAC,UAAe,GAC5B,eAAe,CAgKjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACnC,MAAM,EAAE,eAAe,EACvB,IAAI,GAAE,UAAgC,GACvC,UAAU,CAmBZ;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC3B,MAAM,EAAE,eAAe,EACvB,IAAI,GAAE,UAAgC,GACvC,UAAU,CAkCZ;AAID;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,iBAAiB,CAuH3E;AA8ED,0EAA0E;AAC1E,MAAM,WAAW,mBAAmB;IAChC,mDAAmD;IACnD,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,mDAAmD;IACnD,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,iCAAiC;IACjC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,mBAAmB,CAkC/E;AA4ED,MAAM,WAAW,UAAU;IACvB;;;;OAIG;IACH,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,UAAU,CAAC;IACnC,YAAY,EAAE,OAAO,mBAAmB,CAAC;IACzC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAC;IAChC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAChB,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,MAAM,KACX,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5B;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,eAAe,CAAC,EAAE,CACd,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,KAChC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAChC;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE;QACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;QAC9C,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;QACjC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;KACvC,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;CAC5C;AAED,wBAAsB,MAAM,CACxB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,GAC3B,OAAO,CAAC,MAAM,CAAC,CAkejB"}

package/dist/setup-cli.js

@@ -41,6 +41,12 @@ const HELP_TEXT = `Usage: yt-builder-mcp <command> [flags]
 
 Commands:
   setup            Interactive first-run wizard (default if no command)
+  doctor           Diagnose connectivity: Node version, corporate proxy,
+                   TLS chain (detects a TLS-inspection CA), site
+                   reachability, bearer validity, and update status — each
+                   with an actionable fix. Flags: --url <site> --token
+                   <key> (else falls back to YTB_MCP_SITE_URL /
+                   YTB_MCP_BEARER_TOKEN). Run this first when setup "hangs".
   install-skill    Copy the bundled YOOtheme Builder skill into
                    ~/.claude/skills/ and register it in ~/AGENTS.md.
                    Note: ~/.claude/skills/ is the universal-marker path
@@ -75,6 +81,28 @@ Setup flags (for non-interactive / CI usage):
                           claude-desktop, claude-code, cursor, zed, continue,
                           cline, roo-code, codex-cli, gemini-cli.
 
+Corporate TLS-inspection (Zscaler / Netskope etc.) — pick ONE:
+  --use-system-ca         Trust your OS store (Windows cert store / macOS
+   (or --ca=system)       Keychain). Zero-export — needs Node ≥ 22.15. Writes
+                          NODE_OPTIONS=--use-system-ca into the server entry.
+  --ca <path>             Path to an exported corporate root CA .pem. Writes
+                          NODE_EXTRA_CA_CERTS=<path>. Works on any Node.
+                          (The interactive wizard auto-offers these when a
+                          probe fails with a TLS-inspection certificate error.)
+
+Air-gapped / locked-down corporate environments (version pinning):
+  --pin <version>         Pin the generated client config to an exact version
+                          instead of the floating @latest. Writes
+                          \`npx -y @wootsup/yt-builder-mcp@<version>\` so a
+                          locked-down environment that forbids floating installs
+                          has a reproducible path. Accepts an exact semver
+                          (1.4.0), an optional leading v (v1.4.0), or a dist-tag
+                          (next). \`--pin latest\` is the same as omitting it
+                          (floats; the startup notifier nudges new versions).
+                          Falls back to the YTB_MCP_VERSION env var when unset.
+                          Fully npx-free alternative: install the .dxt Desktop
+                          build (bundles a fixed version; no network at launch).
+
 Example (non-interactive):
   npx -y @wootsup/yt-builder-mcp setup \\
     --non-interactive \\
@@ -82,6 +110,12 @@ Example (non-interactive):
     --url https://example.com \\
     --token "$YTB_TOKEN"
 
+Example (pinned, air-gapped):
+  npx -y @wootsup/yt-builder-mcp setup \\
+    --non-interactive --client cursor \\
+    --url https://example.com --token "$YTB_TOKEN" \\
+    --pin 1.4.0
+
 Pickup mode (one-click setup from the admin "Setup wizard" flow):
   --pickup <url>          Pickup URL revealed by the host CMS admin (WordPress:
                           wp-admin → Tools → "YT Builder MCP"; Joomla:
@@ -124,6 +158,25 @@ Environment (when launched by an AI client):
                          Defaults to URL-shape auto-detection.
   YTB_MCP_TEST_MODE=1    Print the registered tool list to stderr and exit 0
                          without starting the stdio loop (smoke-test probe).
+  YTB_MCP_EXTRA_HEADERS  Extra HTTP headers merged into EVERY outbound request
+                         (corporate edge: HTTP Basic-Auth, a WAF cookie, a
+                         required gateway header). Two accepted formats:
+                           JSON object: {"X-WAF-Token":"abc","Cookie":"sid=42"}
+                           Name: value lines (one per line, first ":" splits):
+                             X-WAF-Token: abc
+                             Cookie: sid=42
+                         The Bearer token is set automatically and ALWAYS wins —
+                         an "Authorization" entry here is ignored. Applies on
+                         both fat mode and proxy mode.
+  YTB_MCP_VERSION        Version pin fallback for --pin (see above). When set to
+                         an exact version, the server runs that version instead
+                         of floating @latest. Air-gapped alternative: .dxt build.
+  NO_PROXY / HTTPS_PROXY Standard proxy env. When HTTP(S)_PROXY is set and
+                         YTB_MCP_SITE_URL points at an INTERNAL host (private IP,
+                         .local/.internal, a bare hostname, or loopback), that
+                         host is auto-added to NO_PROXY so intranet traffic
+                         bypasses the corporate proxy. A public host is never
+                         touched; an operator-set NO_PROXY is preserved verbatim.
 
 Documentation: https://github.com/wootsup/yt-builder-mcp
 `;
@@ -132,13 +185,20 @@ Documentation: https://github.com/wootsup/yt-builder-mcp
  *
  * Accepts both `--key value` and `--key=value` styles. Unknown flags
  * are reported as errors so typos don't silently disable validation.
+ *
+ * `env` (default `{}`, kept empty so the function stays pure) supplies the
+ * `YTB_MCP_VERSION` fallback for the `--pin` version-pin (Glöckle gap #15):
+ * an explicit `--pin` always wins; otherwise `YTB_MCP_VERSION` is used.
  */
-export function parseSetupArgs(argv) {
+export function parseSetupArgs(argv, env = {}) {
     let nonInteractive = false;
     let url = '';
     let token = '';
     let pickup = '';
     let nonce = '';
+    let caCertPath = '';
+    let caSystem = false;
+    let versionPin = '';
     const clients = [];
     const errors = [];
     const warnings = [];
@@ -197,6 +257,37 @@ export function parseSetupArgs(argv) {
                 i = nextIndex;
                 break;
             }
+            case '--ca': {
+                // Corporate TLS-inspection root CA. Two strategies:
+                //   --ca=system / --ca system → OS trust store (NODE_OPTIONS=--use-system-ca)
+                //   --ca <path>               → .pem file (NODE_EXTRA_CA_CERTS=<path>)
+                const { value, nextIndex } = consumeValue('--ca', inline, i);
+                const v = value.trim();
+                if (v.toLowerCase() === 'system') {
+                    caSystem = true;
+                }
+                else {
+                    caCertPath = v;
+                }
+                i = nextIndex;
+                break;
+            }
+            case '--use-system-ca': {
+                // Alias for `--ca=system`: trust the OS store natively (no .pem).
+                caSystem = true;
+                if (inline !== undefined) {
+                    errors.push('Flag --use-system-ca does not take a value.');
+                }
+                break;
+            }
+            case '--pin': {
+                // Glöckle gap #15 — pin the npx version (air-gapped / locked-down
+                // corp envs that forbid floating @latest installs).
+                const { value, nextIndex } = consumeValue('--pin', inline, i);
+                versionPin = value.trim();
+                i = nextIndex;
+                break;
+            }
             default: {
                 errors.push(`Unknown setup flag: ${flag}`);
             }
@@ -239,7 +330,27 @@ export function parseSetupArgs(argv) {
             }
         }
     }
-    return { nonInteractive, url, token, pickup, nonce, clients, errors, warnings };
+    // A .pem path and the OS-trust-store are two mutually-exclusive ways to
+    // trust the same CA — refuse the ambiguous combination rather than silently
+    // pick one.
+    if (caSystem && caCertPath !== '') {
+        errors.push('Pass either a CA .pem path (--ca <path>) or the OS trust store (--ca=system / --use-system-ca), not both.');
+    }
+    // #15 — an explicit `--pin` wins; otherwise fall back to YTB_MCP_VERSION.
+    const resolvedPin = versionPin !== '' ? versionPin : (env.YTB_MCP_VERSION ?? '').trim();
+    return {
+        nonInteractive,
+        url,
+        token,
+        pickup,
+        nonce,
+        clients,
+        errors,
+        warnings,
+        ...(caCertPath !== '' ? { caCertPath } : {}),
+        ...(caSystem ? { caMode: 'system' } : {}),
+        ...(resolvedPin !== '' ? { versionPin: resolvedPin } : {}),
+    };
 }
 /**
  * Build a `WizardDeps` bag that answers prompts from CLI flags instead
@@ -255,11 +366,19 @@ export function buildNonInteractiveDeps(parsed, base = DEFAULT_WIZARD_DEPS) {
         wpUrl: parsed.url,
         bearer: parsed.token,
         selectedClients: parsed.clients,
+        ...(parsed.caCertPath !== undefined ? { caCertPath: parsed.caCertPath } : {}),
+        ...(parsed.caMode !== undefined ? { caMode: parsed.caMode } : {}),
+        ...(parsed.versionPin !== undefined ? { versionPin: parsed.versionPin } : {}),
     };
     return {
         ...base,
         prompt: async () => answers,
         confirmContinue: async () => false,
+        // No human to answer the interactive CA prompt — the CA comes from
+        // `--ca` / `--ca=system` flags (already in `answers`). Stripping the
+        // prompt keeps a CA-trust probe failure on the documented exit-code
+        // path instead of hanging on a prompt with no TTY.
+        promptCa: undefined,
     };
 }
 /**
@@ -298,6 +417,7 @@ export function buildPickupDeps(parsed, base = DEFAULT_WIZARD_DEPS) {
                     wpUrl: result.siteurl,
                     bearer: result.token,
                     selectedClients: parsed.clients,
+                    ...(parsed.versionPin !== undefined ? { versionPin: parsed.versionPin } : {}),
                 };
             }
             catch (e) {
@@ -310,6 +430,8 @@ export function buildPickupDeps(parsed, base = DEFAULT_WIZARD_DEPS) {
             }
         },
         confirmContinue: async () => false,
+        // Pickup is non-interactive too — no TTY for the CA prompt.
+        promptCa: undefined,
     };
 }
 /**
@@ -595,6 +717,7 @@ export async function runCli(argv, deps) {
     const out = deps?.log ?? ((s) => process.stdout.write(`${s}\n`));
     const err = deps?.error ?? ((s) => process.stderr.write(`${s}\n`));
     const wizard = deps?.runWizard ?? ((wizDeps) => runWizardImpl(wizDeps));
+    const interactiveBase = deps?.interactiveWizardDeps ?? DEFAULT_WIZARD_DEPS;
     const install = deps?.installSkill ?? defaultInstallSkill;
     const resolveSitesPath = deps?.resolveSitesPath ?? (() => defaultSitesFilePath());
     const addSiteDeps = deps?.addSiteDeps ?? DEFAULT_ADD_SITE_DEPS;
@@ -639,7 +762,7 @@ export async function runCli(argv, deps) {
     };
     if (subcommand === undefined || subcommand === 'setup') {
         const setupArgs = argv[0] === 'setup' ? argv.slice(1) : argv;
-        const parsed = parseSetupArgs(setupArgs);
+        const parsed = parseSetupArgs(setupArgs, process.env);
         // Surface non-fatal warnings (e.g. "--url ignored in pickup mode").
         for (const line of parsed.warnings)
             err(`yt-builder-mcp: warning: ${line}`);
@@ -648,6 +771,53 @@ export async function runCli(argv, deps) {
         function withPersist(base) {
             return { ...base, persistSite };
         }
+        // #15 — when `--pin` / YTB_MCP_VERSION is set on the INTERACTIVE path,
+        // the prompt collects its own answers, so fold the pin into them after
+        // the prompt resolves. Non-interactive / pickup paths already inject the
+        // pin via their answers builders.
+        function withPin(base) {
+            if (parsed.versionPin === undefined)
+                return base;
+            const pin = parsed.versionPin;
+            const innerPrompt = base.prompt;
+            return {
+                ...base,
+                prompt: async (input) => {
+                    const answers = await innerPrompt(input);
+                    if (answers === null)
+                        return null;
+                    return { ...answers, versionPin: pin };
+                },
+            };
+        }
+        // G-D #6 — when `--use-system-ca` / `--ca=system` / `--ca <path>` is
+        // passed on the INTERACTIVE path, the prompt collects its own answers,
+        // so fold the CA choice into them after the prompt resolves (mirrors
+        // withPin). Without this fold an explicit CA flag on the default
+        // interactive run was a SILENT NO-OP: it was parsed then dropped before
+        // reaching the env block (only buildNonInteractiveDeps threaded it). The
+        // non-interactive / pickup paths already inject the CA via their answers
+        // builders, so this fold is the interactive-path counterpart.
+        function withCa(base) {
+            if (parsed.caMode === undefined && parsed.caCertPath === undefined)
+                return base;
+            const caMode = parsed.caMode;
+            const caCertPath = parsed.caCertPath;
+            const innerPrompt = base.prompt;
+            return {
+                ...base,
+                prompt: async (input) => {
+                    const answers = await innerPrompt(input);
+                    if (answers === null)
+                        return null;
+                    return {
+                        ...answers,
+                        ...(caMode !== undefined ? { caMode } : {}),
+                        ...(caCertPath !== undefined ? { caCertPath } : {}),
+                    };
+                },
+            };
+        }
         if (pickupMode) {
             if (parsed.errors.length > 0) {
                 for (const line of parsed.errors)
@@ -672,9 +842,13 @@ export async function runCli(argv, deps) {
             err(HELP_TEXT);
             return 1;
         }
-        return wizard(withPersist(DEFAULT_WIZARD_DEPS));
+        return wizard(withCa(withPin(withPersist(interactiveBase))));
     }
     switch (subcommand) {
+        case 'doctor': {
+            const { doctorCommand } = await import('./cli/doctor-command.js');
+            return doctorCommand(argv.slice(1), { log: out });
+        }
         case 'install-skill':
         case 'install': {
             try {