modelfunction-cli 0.4.4 → 0.5.1

package/README.md

@@ -5,7 +5,7 @@
 ## 安装
 
 ```bash
-npx -y modelfunction-cli@0.4.4 --version
+npx -y modelfunction-cli@0.5.0 --version
 # 或
 npm i -D modelfunction-cli
 npx mf --version
@@ -26,6 +26,7 @@ mf scan --root . --probe              # 连 stdio MCP server 拉 tools/list
 mf coverage --suite mf.suite.json     # 看每个工具还缺多少用例
 mf eval --suite mf.suite.json --models deepseek,qwen --show-cases
 mf compare before.json after.json     # 跨版本比较（内容指纹判定可比性）
+mf audit --suite mf.suite.json --out audit.md  # 一次静态体检：lint + 边界 + 覆盖 + 挂载
 ```
 
 被测模型用环境变量提供 Key：
@@ -38,9 +39,19 @@ SILICONFLOW_API_KEY=... mf eval --models dsv4-flash
 OPENAI_API_KEY=... mf eval --models openai
 ```
 
+也可以把 Key 存进用户级凭证文件，输入时隐藏、不进 shell history：
+
+```bash
+mf config set-key DEEPSEEK_API_KEY   # 粘贴 Key，回车；只显示掩码
+mf config list                       # DEEPSEEK_API_KEY  sk-…abcd
+mf config path                       # ~/.modelfunction/credentials.json（0600）
+```
+
+加载优先级：**进程环境变量 > 凭证文件**（只补缺失项，不覆盖）。CI 与企业环境继续用环境变量或密钥管理，不要落盘。
+
 ### 自建 / 内网网关
 
-企业内网基本都是 OpenAI 兼容协议，写一个 models-file 即可，Key 只走环境变量、不落盘：
+企业内网基本都是 OpenAI 兼容协议，写一个 models-file 即可（Key 用环境变量，或用 `mf config set-key` 存在本机）：
 
 ```json
 {
@@ -64,10 +75,11 @@ INTERNAL_LLM_KEY=... mf eval --suite mf.suite.json \
 
 | 命令 | 作用 |
 | --- | --- |
-| `mf scan` | 扫描工具定义（function.json / OpenAPI / MCP 配置 / Python `@tool` / JS·TS 声明与 TypeBox·zod schema）；`--probe` 连 MCP server（运行时结果覆盖静态推断）；`--from` 导入运行时工具数组；草稿按来源分组（`profiles`）并列出未覆盖的 skill |
-| `mf eval` | 跑评分卡；`--repeat` 多次取多数并报不稳定用例；`--fail-under` 阈值；`--baseline` + `--fail-on-regression` 回归门禁；`--profile` 按挂载组分别评分 |
+| `mf scan` | 扫描工具定义（function.json / OpenAPI / MCP 配置 / Python `@tool` / JS·TS 声明与 TypeBox·zod schema）；`--probe` 连 stdio 或 streamable-HTTP MCP server（运行时结果覆盖静态推断；headers/query 不写入报告）；`--from` 导入运行时工具数组；草稿按来源分组（`profiles`）并列出未覆盖的 skill |
+| `mf eval` | 跑评分卡；`--repeat` 多次取多数并报不稳定用例；`--fail-under` 阈值；`--baseline` + `--fail-on-regression` 回归门禁；`--profile` 按挂载组分别评分；`--max-cost` 按累计成本停机（退出 2）；`--progress` 逐用例进度（stderr） |
 | `mf case add` | 写入用例（默认 `source=agent`、`reviewed=false`） |
 | `mf coverage` | 每工具用例数、参数覆盖、负例比例、疑似混淆对；有 `profiles` 时按组统计 |
+| `mf audit` | 一次静态审计：lint + 混淆族边界 + 用例覆盖 + 挂载检查，输出可转发的 Markdown/JSON；不调用模型 |
 | `mf lint` | 静态检查工具描述与参数 schema，以及 skills 的 name/description（不调用模型）；重复规则自动合并成一条；有 `profiles` 时给出「这些组不要合并挂载」 |
 | `mf check` | 安装门禁：一个新能力 × 已装能力（`--manifest` + `--installed`），纯静态、返回 pass/warn、不阻断；也可 `import { check } from "modelfunction-cli"` |
 | `mf compare` | 跨版本比较、干扰归因、混淆矩阵；两份报告都有分组时按组对比 |
@@ -76,6 +88,9 @@ INTERNAL_LLM_KEY=... mf eval --suite mf.suite.json \
 | `mf exec` | 单工具执行 + 指标（Node / Python），支持 `--allow-read/write/net`、超时、sideEffects 准入 |
 | `mf eval --execute` | 一次跑完选择 + 参数 + 运行断言（`toolInput` / `expect`） |
 | `mf sandbox check` | 探测本机可用隔离引擎与降级建议 |
+| `mf config set-key` | 把模型 Key 写入 `~/.modelfunction/credentials.json`（隐藏输入）；`remove-key` 删除；`list` 只显示掩码，`path` 打印路径 |
+| `mf stats` | 本地使用摘要（命令次数、本地/CI 区分、模型、通过率区间、lint 规则命中）；不联网 |
+| `mf feedback` | 导出脱敏反馈包（仅计数与比率），发不发由你决定 |
 | `mf mcp` | stdio MCP server，供 Claude Code / Cursor / Kimi Code 调用 |
 
 ## 单次结果会抖：用 `--repeat` 看稳定性
@@ -111,7 +126,7 @@ mf eval --suite mf.suite.json --models internal-ds \
   "mcpServers": {
     "modelfunction": {
       "command": "npx",
-      "args": ["-y", "modelfunction-cli@0.4.4", "mcp"]
+      "args": ["-y", "modelfunction-cli@0.5.0", "mcp"]
     }
   }
 }
@@ -123,12 +138,27 @@ mf eval --suite mf.suite.json --models internal-ds \
 
 对外 JSON 字段、`check()` 返回结构、MCP 参数与退出码见 [SCHEMA.md](SCHEMA.md)，自 0.4.3 起冻结为 v1：v1 内只做加法，重命名或删除字段需 major 并提前两个 minor 或 90 天弃用。`check()` 的类型声明随包发布。
 
+npm 已发布 `0.5.0`（凭证与本地反馈渠道）；`0.5.1` 待发布，合并开发改动：usage `ci` 标记与 local/ci 统计、eval `--progress`/`--max-cost`、`mf audit` 组合审计、`scan --probe` 支持 streamable HTTP。示例固定 `@0.5.0`，发布后统一升级。
+
 ## 数据边界
 
 - 本地运行，无遥测、无服务端地址
 - 唯一出站：你配置的模型端点，以及你自己的 MCP server（`--probe` 时）
 - 评测会把用例输入与工具描述发给被测模型供应商——敏感数据请选境内供应商或本地模型
 
+## 本地使用记录与反馈（默认不上传）
+
+每条命令会在 `~/.modelfunction/usage/YYYY-MM.jsonl` 追加一行**计数记录**：命令名、退出码、耗时、mf/Node/OS 版本、模型 id、用例/工具数量、通过率区间、lint 规则命中数、是否 CI。**不记录**用例原文、工具描述、源码、文件路径或密钥。`mf stats` 会把本地运行与 CI 运行分开统计。
+
+```bash
+mf stats                    # 看本机记录；--json 给脚本
+mf feedback --out out.json  # 导出脱敏反馈包（聚合值，不含原始事件）
+```
+
+- 默认无网络、无遥测；`MF_NO_USAGE=1` 关闭记录；直接删除 `~/.modelfunction/usage/` 即清空。
+- 反馈包发不发由你决定；我们想知道的是「哪些命令在用、评测通过率大概什么水平、lint 命中哪些规则」，不需要项目细节。
+- `MF_CONFIG_DIR` 可改整个配置目录位置（CI/容器里常用）。
+
 ## 用例从哪来
 
 由你或你的编码 Agent 撰写，规则模板见包内 `skills/mf-cases/SKILL.md`。未复核用例（`reviewed:false`）不计入正式分数。
@@ -137,7 +167,7 @@ mf eval --suite mf.suite.json --models internal-ds \
 
 ```bash
 # 1. 把 mf 挂成 MCP server
-claude mcp add modelfunction -- npx -y modelfunction-cli@0.4.4 mcp
+claude mcp add modelfunction -- npx -y modelfunction-cli@0.5.0 mcp
 ```
 
 ```text

package/SCHEMA.md

@@ -1,6 +1,6 @@
 # Schemas v1
 
-Frozen at `modelfunction-cli@0.4.3`。这里描述 CLI 与库对外的稳定契约。人类可读文本（表格、提示语）不属于契约；**JSON 字段**属于。
+自 `modelfunction-cli@0.4.3` 起冻结为 v1；`0.4.4` 是同一 v1 的补丁；`0.5.0` 增加 §9 本地文件、`0.5.1` 增加 §10 审计 JSON，仍属 v1。这里描述 CLI 与库对外的稳定契约。人类可读文本（表格、提示语）不属于契约；**JSON 字段**属于。
 
 ## 兼容政策
 
@@ -110,7 +110,7 @@ skills 只做静态检查，不参与模型评测。
 
 `--json` 输出 `{ "report": {...}, "draft": {...} }`；默认写 `mf.suite.json`（draft）与 `mf.scan.json`（report）。
 
-report：`root`、`tools[]`（`name` / `description` / `parameters` / `origin` / `confidence` / `source` / `note?` / `descriptionSource?`）、`skills[]`、`mcpServers[]`（env 只保留 `envKeys`）、`probes[]`、`sources[]`、`warnings[]`。
+report：`root`、`tools[]`（`name` / `description` / `parameters` / `origin` / `confidence` / `source` / `note?` / `descriptionSource?`）、`skills[]`、`mcpServers[]`（env 只保留 `envKeys`，headers 只保留 `headerKeys`；URL 去掉 userinfo / query / hash）、`probes[]`（`server` / `ok` / `toolCount?` / `tools?` / `error?`）、`sources[]`、`warnings[]`。`--probe` 支持 stdio 与 streamable HTTP 两种传输。
 
 `scan --json` 在未找到任何工具时退出码为 3。
 
@@ -184,8 +184,9 @@ import { check } from "modelfunction-cli";
 | `scan_tools` | `root?`、`probe?`、`timeoutMs?`、`writeSuite?` |
 | `list_suite` | `suite?` |
 | `coverage` | `suite?` |
+| `audit` | `suite?` |
 | `add_cases` | `suite?`、`cases[]`、`source?`、`reviewed?`、`dryRun?` |
-| `run_eval` | `suite?`、`models?`、`cases?`、`profile?`、`repeat?`、`failUnder?` |
+| `run_eval` | `suite?`、`models?`、`cases?`、`profile?`、`repeat?`、`failUnder?`、`maxCost?`、`progress?` |
 
 返回值均为 JSON 文本。
 
@@ -195,6 +196,113 @@ import { check } from "modelfunction-cli";
 | --- | --- |
 | 0 | 成功（`mf check` 的 warn 也是 0） |
 | 1 | 输入/用法错误；`mf compare` 判定不可直接比较 |
-| 2 | `mf eval --fail-under` 未达标，或 `--fail-on-regression` 发现回退 |
+| 2 | `mf eval --fail-under` 未达标、`--fail-on-regression` 发现回退，或 `--max-cost` 超限 |
 | 3 | `mf exec` 被权限策略拒绝；`mf scan --json` 未找到工具 |
 | 4 | `mf exec` 超时 |
+
+## 9. 本地文件（0.5.0 起）
+
+### `~/.modelfunction/credentials.json`
+
+`MF_CONFIG_DIR` 可覆盖目录。扁平 JSON 对象，键为环境变量名、值为字符串：
+
+```json
+{ "DEEPSEEK_API_KEY": "sk-…" }
+```
+
+权限 0600（Windows 尽力）。加载规则：进程环境变量优先；凭证文件只补模型 registry 中声明的 `apiKeyEnv` 缺失项，不会向进程注入任意变量。不要提交到仓库；CI/企业用环境变量或密钥管理。
+
+### `~/.modelfunction/usage/YYYY-MM.jsonl`
+
+每行一个 JSON 事件（UTF-8，按 UTC 月份分文件；`ts` 为 ISO 8601）：
+
+```json
+{
+  "schema": 1,
+  "ts": "2026-11-01T01:26:33.000Z",
+  "command": "eval",
+  "exitCode": 0,
+  "durationMs": 1200,
+  "mf": "0.5.0",
+  "platform": "win32",
+  "arch": "x64",
+  "node": "24.6.0",
+  "ci": false,
+  "models": ["mock"],
+  "caseCount": 13,
+  "toolCount": 4,
+  "reviewedCount": 13,
+  "repeat": 1,
+  "profileGroups": 0,
+  "selectionAccuracy": 0.92,
+  "argAccuracy": 1,
+  "passRate": 0.92,
+  "unstableCases": 0,
+  "failedThreshold": false,
+  "regressions": false
+}
+```
+
+字段为白名单，只含计数、比率与 id；**不含**用例原文、工具描述、源码、文件路径或密钥。`ci` 表示检测到 CI 环境（`CI=true/1` 或 `GITHUB_ACTIONS` / `GITLAB_CI` / `CIRCLECI` / `TRAVIS` / `BUILDKITE` / `TF_BUILD` / `JENKINS_URL` / `CNB_BUILD_ID`），用于把机器运行与本地运行分开；`mf stats` 分别统计。新增字段属于 v1 加法，消费方可忽略未知字段。`MF_NO_USAGE=1` 关闭写入；删除 `usage/` 即清空。
+
+### `mf feedback` 包
+
+默认写到 `MF_CONFIG_DIR/feedback/mf-feedback-YYYYMMDD-HHmmss.json`（UTC）：
+
+```json
+{
+  "schema": 1,
+  "kind": "modelfunction-feedback",
+  "generatedAt": "2026-11-01T01:26:33.000Z",
+  "mf": { "version": "0.5.0", "node": "24.6.0", "platform": "win32", "arch": "x64" },
+  "usage": { "runs": 1, "commands": { "eval": 1 } },
+  "privacy": "…",
+  "request": "…"
+}
+```
+
+`usage` 是 `mf stats` 的聚合结果，不含原始事件、路径或密钥。是否发送由用户决定。
+
+## 10. 工具集审计（`mf audit --json`，0.5.1 起）
+
+```json
+{
+  "suite": { "name": "…", "path": "…", "tools": 4, "skills": 0, "cases": 13, "reviewed": 13 },
+  "lint": {
+    "tools": 4,
+    "skills": 0,
+    "counts": { "error": 0, "warn": 6, "info": 0 },
+    "findings": [],
+    "profilePairs": []
+  },
+  "clusters": {
+    "threshold": 0.5,
+    "total": 4,
+    "clusters": [],
+    "riskyPairs": [],
+    "familyHints": [],
+    "boundaries": []
+  },
+  "coverage": {
+    "total": 13,
+    "negative": 1,
+    "negativeRatio": 0.08,
+    "unreviewed": 0,
+    "tools": [],
+    "pairs": [],
+    "profiles": [],
+    "warnings": []
+  },
+  "profiles": { "groups": [], "warnings": [], "unmounted": [] },
+  "actions": [
+    {
+      "kind": "boundary|param-source|cases|args|review|mount",
+      "subject": "…",
+      "message": "…",
+      "detail": "…"
+    }
+  ]
+}
+```
+
+`profiles` 为 `null` 表示套件未定义分组。`clusters`/`coverage` 的明细与 §5/§4 同源；`actions` 是给人看的优先级列表。`mf audit` 恒退出 0（advisory），不阻断流程。

package/lib/audit.js

@@ -0,0 +1,149 @@
+// One static pass over a whole tool set: lint + cluster boundaries + case
+// coverage + mount checks. No model calls, no execution, no network.
+// The markdown output is meant to be forwarded as a trial deliverable.
+import { lintSuite, formatLint } from "./lint.js";
+import { clusterTools, formatClusters } from "./cluster.js";
+import { computeCoverage, formatCoverage } from "./cases.js";
+import { normalizeProfiles, profileWarnings, profileCaseCoverage } from "./profile.js";
+
+export function auditSuite(suite) {
+  const lint = lintSuite(suite);
+  const clusters = clusterTools(suite.tools);
+  const coverage = computeCoverage(suite);
+  const profiles = normalizeProfiles(suite.profiles, suite.tools.map((tool) => tool.name));
+  const mounted = profiles ? new Set(profiles.flatMap((profile) => profile.tools)) : null;
+  const profile = profiles
+    ? {
+        groups: profileCaseCoverage(profiles, suite.cases),
+        warnings: profileWarnings(profiles, suite),
+        unmounted: suite.tools.map((tool) => tool.name).filter((name) => !mounted.has(name))
+      }
+    : null;
+
+  return {
+    suite: {
+      name: suite.name,
+      path: suite.path ?? null,
+      tools: suite.tools.length,
+      skills: suite.skills?.length ?? 0,
+      cases: suite.cases.length,
+      reviewed: suite.cases.filter((testCase) => testCase.reviewed !== false).length
+    },
+    lint: {
+      tools: lint.tools,
+      skills: lint.skills,
+      counts: lint.counts,
+      findings: lint.findings,
+      profilePairs: lint.profilePairs ?? []
+    },
+    clusters,
+    coverage,
+    profiles: profile,
+    actions: buildActions({ lint, clusters, coverage, profile })
+  };
+}
+
+function buildActions({ lint, clusters, coverage, profile }) {
+  const actions = [];
+
+  const families = (clusters.boundaries ?? [])
+    .filter((family) => family.size > 1)
+    .sort((a, b) => b.pairs.length - a.pairs.length)
+    .slice(0, 3);
+  for (const family of families) {
+    actions.push({
+      kind: "boundary",
+      subject: family.label,
+      message: `为「${family.label}」补选择边界（${family.pairs.length} 对互抢）`,
+      detail: family.suggestion
+    });
+  }
+
+  const unsourced = lint.findings.filter((finding) => finding.code === "required-unsourced");
+  for (const finding of unsourced.slice(0, 5)) {
+    actions.push({
+      kind: "param-source",
+      subject: `${finding.tool}.${finding.param}`,
+      message: `补参数来源：${finding.tool}.${finding.param}`,
+      detail: finding.message
+    });
+  }
+
+  const empty = coverage.tools.filter((tool) => tool.total === 0);
+  if (empty.length > 0) {
+    actions.push({
+      kind: "cases",
+      subject: `${empty.length} tools`,
+      message: `为 ${empty.length} 个工具补用例`,
+      detail: empty.map((tool) => tool.name).join(", ")
+    });
+  }
+  const noArgs = coverage.tools.filter((tool) => tool.total > 0 && tool.withArgs === 0);
+  if (noArgs.length > 0) {
+    actions.push({
+      kind: "args",
+      subject: `${noArgs.length} tools`,
+      message: `为 ${noArgs.length} 个工具补带参数的用例`,
+      detail: noArgs.map((tool) => tool.name).join(", ")
+    });
+  }
+  if (coverage.unreviewed > 0) {
+    actions.push({
+      kind: "review",
+      subject: `${coverage.unreviewed} cases`,
+      message: `复核 ${coverage.unreviewed} 条未复核用例（复核后才计入正式分数）`,
+      detail: "把认可的用例 reviewed 改为 true"
+    });
+  }
+  if (profile && profile.unmounted.length > 0) {
+    actions.push({
+      kind: "mount",
+      subject: `${profile.unmounted.length} tools`,
+      message: `${profile.unmounted.length} 个工具不在任何挂载组`,
+      detail: profile.unmounted.join(", ")
+    });
+  }
+
+  return actions;
+}
+
+export function formatAudit(report) {
+  const { suite, lint, clusters, coverage, profiles, actions } = report;
+  const lines = [
+    `# ${suite.name} — 工具集审计`,
+    "",
+    `- 工具 ${suite.tools} · skills ${suite.skills} · 用例 ${suite.cases}（已复核 ${suite.reviewed}）`,
+    `- 文件：${suite.path ?? "(内存)"}`,
+    `- 纯静态：不调用模型、不执行工具、无网络`,
+    "",
+    "## 建议动作"
+  ];
+  if (actions.length === 0) {
+    lines.push("暂无必须处理项。");
+  } else {
+    actions.forEach((action, index) => {
+      lines.push(`${index + 1}. ${action.message}`);
+      if (action.detail) lines.push(`   ${action.detail}`);
+    });
+  }
+
+  lines.push("", "## 描述与参数（lint）", "", formatLint(lint));
+  lines.push("", "## 混淆与分组（cluster）", "", formatClusters(clusters));
+  lines.push("", "## 用例覆盖（coverage）", "", formatCoverage(coverage));
+  lines.push("", "## 挂载分组（profiles）", "");
+  if (!profiles) {
+    lines.push("未定义 profiles（平台可先用 `mf cluster --out <suite>` 生成候选分组）。");
+  } else {
+    lines.push("group                   tools  cases  negatives  tools-without-cases");
+    lines.push("----------------------  -----  -----  ---------  -------------------");
+    for (const row of profiles.groups) {
+      lines.push(
+        `${row.name.padEnd(22)}  ${String(row.tools).padStart(5)}  ${String(row.cases).padStart(5)}  ${String(row.negatives).padStart(9)}  ${row.missing.length ? row.missing.join(", ") : "-"}`
+      );
+    }
+    if (profiles.unmounted.length > 0) lines.push("", `未挂载工具：${profiles.unmounted.join(", ")}`);
+    for (const warning of profiles.warnings) lines.push(`- ${warning}`);
+  }
+
+  return lines.join("\n");
+}

package/lib/budget.js

@@ -0,0 +1,30 @@
+// Running cost guard for evaluations. Pricing is known per model, but token
+// usage is only known after a call returns, so the limit is enforced after
+// each call: the run stops as soon as the budget is crossed.
+export class CostLimitError extends Error {
+  constructor({ limit, spent, calls }) {
+    super(`cost limit reached: spent ¥${spent.toFixed(4)} of ¥${limit} after ${calls} call(s)`);
+    this.name = "CostLimitError";
+    this.limit = limit;
+    this.spent = spent;
+    this.calls = calls;
+  }
+}
+
+export function createBudget(limit = null) {
+  let spent = 0;
+  let calls = 0;
+  return {
+    get spent() {
+      return spent;
+    },
+    get calls() {
+      return calls;
+    },
+    spend(cost) {
+      calls += 1;
+      if (Number.isFinite(cost) && cost > 0) spent += cost;
+      if (limit !== null && spent > limit) throw new CostLimitError({ limit, spent, calls });
+    }
+  };
+}

package/lib/credentials.js

@@ -0,0 +1,121 @@
+import { mkdir, readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { writeFileAtomic } from "./fsutil.js";
+
+const ENV_NAME = /^[A-Z][A-Z0-9_]*$/;
+const FILE_MODE = 0o600;
+const DIR_MODE = 0o700;
+const SECRET_PATTERNS = [
+  { pattern: /(Bearer\s+)[A-Za-z0-9._~+/-]+=*/gi, replacement: "$1***" },
+  { pattern: /\bsk-[A-Za-z0-9_-]{8,}/g, replacement: "***" }
+];
+
+const registeredSecrets = new Set();
+
+export function configDir() {
+  const override = process.env.MF_CONFIG_DIR;
+  return override && override.trim() ? resolve(override.trim()) : join(homedir(), ".modelfunction");
+}
+
+export function credentialsPath() {
+  return join(configDir(), "credentials.json");
+}
+
+export async function readCredentials() {
+  let raw;
+  try {
+    raw = await readFile(credentialsPath(), "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return {};
+    throw error;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    // Never echo the file content: it holds secrets.
+    throw new Error(`credentials file is not valid JSON: ${credentialsPath()}`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`credentials file must be a JSON object: ${credentialsPath()}`);
+  }
+  const out = {};
+  for (const [name, value] of Object.entries(parsed)) {
+    if (typeof value === "string" && value.length > 0) out[name] = value;
+  }
+  registerSecrets(Object.values(out));
+  return out;
+}
+
+export async function setCredential(name, value) {
+  if (!ENV_NAME.test(name)) {
+    throw new Error(`invalid environment variable name "${name}" (expected e.g. DEEPSEEK_API_KEY)`);
+  }
+  const trimmed = String(value ?? "").trim();
+  if (!trimmed) throw new Error("empty value; nothing written");
+  if (/[\r\n]/.test(trimmed)) throw new Error("value must be a single line");
+  const existing = await readCredentials();
+  existing[name] = trimmed;
+  await mkdir(configDir(), { recursive: true, mode: DIR_MODE });
+  await writeFileAtomic(credentialsPath(), `${JSON.stringify(existing, null, 2)}\n`, { mode: FILE_MODE });
+  registerSecrets([trimmed]);
+  return { name, path: credentialsPath() };
+}
+
+export async function removeCredential(name) {
+  if (!ENV_NAME.test(name)) {
+    throw new Error(`invalid environment variable name "${name}" (expected e.g. DEEPSEEK_API_KEY)`);
+  }
+  const existing = await readCredentials();
+  if (!(name in existing)) return { name, removed: false, path: credentialsPath() };
+  delete existing[name];
+  await mkdir(configDir(), { recursive: true, mode: DIR_MODE });
+  await writeFileAtomic(credentialsPath(), `${JSON.stringify(existing, null, 2)}\n`, { mode: FILE_MODE });
+  return { name, removed: true, path: credentialsPath() };
+}
+
+export async function listCredentials() {
+  const stored = await readCredentials();
+  return Object.entries(stored)
+    .map(([name, value]) => ({ name, masked: maskSecret(value) }))
+    .sort((a, b) => a.name.localeCompare(b.name));
+}
+
+// Only fill keys the model registry actually reads; a credentials file must
+// not be able to inject arbitrary environment variables into the process.
+export async function applyModelCredentials(registry) {
+  const stored = await readCredentials();
+  const names = new Set(
+    Object.values(registry)
+      .map((config) => config?.apiKeyEnv)
+      .filter((name) => typeof name === "string" && name.length > 0)
+  );
+  const filled = [];
+  for (const name of names) {
+    if (!process.env[name] && stored[name]) {
+      process.env[name] = stored[name];
+      filled.push(name);
+    }
+  }
+  return filled;
+}
+
+export function maskSecret(value) {
+  const text = String(value ?? "");
+  if (text.length <= 8) return "********";
+  return `${text.slice(0, 3)}…${text.slice(-4)}`;
+}
+
+export function registerSecrets(values) {
+  for (const value of values ?? []) {
+    if (typeof value === "string" && value.length >= 8) registeredSecrets.add(value);
+  }
+}
+
+export function redactText(text) {
+  let out = String(text ?? "");
+  for (const secret of registeredSecrets) out = out.split(secret).join("***");
+  for (const { pattern, replacement } of SECRET_PATTERNS) out = out.replace(pattern, replacement);
+  return out;
+}

package/lib/fsutil.js

@@ -1,7 +1,9 @@
-import { rename, writeFile } from "node:fs/promises";
+import { chmod, rename, writeFile } from "node:fs/promises";
 
-export async function writeFileAtomic(path, data) {
+export async function writeFileAtomic(path, data, { mode } = {}) {
   const temp = `${path}.${process.pid}.tmp`;
-  await writeFile(temp, data, "utf8");
+  await writeFile(temp, data, { encoding: "utf8", ...(mode ? { mode } : {}) });
   await rename(temp, path);
+  // Windows maps chmod to the read-only bit only; this is best-effort there.
+  if (mode) await chmod(path, mode).catch(() => {});
 }

package/lib/mcp-probe.js

@@ -1,10 +1,67 @@
 import { spawn } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 
 const MAX_BYTES = 1_000_000;
 const MAX_STDERR = 4_000;
-const CLIENT_INFO = { name: "mf", version: "0.1.0" };
+const PACKAGE = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+const CLIENT_INFO = { name: "mf", version: PACKAGE.version };
 const PROTOCOL_VERSION = "2025-06-18";
 
+// Streamable HTTP is the current remote MCP transport. Headers come from the
+// user's own config and are never copied into reports or logs.
+export async function probeHttpServer(server, { timeoutMs = 5_000 } = {}) {
+  if (!server?.url) return { ok: false, error: "missing url" };
+  let url;
+  try {
+    url = new URL(server.url);
+  } catch {
+    return { ok: false, error: "invalid url" };
+  }
+
+  const client = new Client(CLIENT_INFO);
+  const headers = server.headers && Object.keys(server.headers).length > 0 ? server.headers : null;
+  const transport = new StreamableHTTPClientTransport(url, {
+    requestInit: headers ? { headers } : undefined
+  });
+
+  try {
+    await withTimeout(client.connect(transport), timeoutMs, "connect");
+    const result = await withTimeout(client.listTools(), timeoutMs, "tools/list");
+    return { ok: true, tools: normalizeTools(result?.tools ?? []) };
+  } catch (error) {
+    return { ok: false, error: `http: ${scrubUrl(error?.message ?? error, url)}` };
+  } finally {
+    await client.close().catch(() => {});
+  }
+}
+
+function withTimeout(promise, ms, label) {
+  let id;
+  const timeout = new Promise((_, reject) => {
+    id = setTimeout(() => reject(new Error(`${label} timeout after ${ms}ms`)), ms);
+  });
+  return Promise.race([promise, timeout]).finally(() => clearTimeout(id));
+}
+
+function scrubUrl(message, url) {
+  let text = String(message ?? "");
+  text = text.split(url.href).join(`${url.origin}${url.pathname}`);
+  if (url.search) text = text.split(url.search).join("");
+  return text;
+}
+
+function normalizeTools(tools) {
+  return tools
+    .filter((tool) => typeof tool?.name === "string" && tool.name.trim() !== "")
+    .map((tool) => ({
+      name: tool.name.trim(),
+      description: tool.description ?? "",
+      parameters: tool.inputSchema ?? { type: "object", properties: {} }
+    }));
+}
+
 export async function probeStdioServer(server, { timeoutMs = 5_000, cwd } = {}) {
   if (!server?.command) {
     return { ok: false, error: "missing command" };
@@ -129,14 +186,7 @@ export async function probeStdioServer(server, { timeoutMs = 5_000, cwd } = {})
     });
     send({ jsonrpc: "2.0", method: "notifications/initialized" });
     const result = await request("tools/list", {});
-    const tools = (result?.tools ?? [])
-      .filter((tool) => typeof tool?.name === "string" && tool.name.trim() !== "")
-      .map((tool) => ({
-        name: tool.name.trim(),
-        description: tool.description ?? "",
-        parameters: tool.inputSchema ?? { type: "object", properties: {} }
-      }));
-    return { ok: true, tools };
+    return { ok: true, tools: normalizeTools(result?.tools ?? []) };
   } catch (error) {
     return {
       ok: false,