waterbox 0.1.0-alpha.2 → 0.1.0-alpha.3

package/README.md

@@ -23,22 +23,24 @@ npx waterbox status
 npx waterbox logout
 ```
 
-Interactive setup stores only the provider credential in the native keyring.
-Non-secret settings are written atomically to `~/.waterbox/config.json` using
+Interactive setup stores only the provider credential in the native keyring on
+macOS and Windows. Linux uses `~/.waterbox/credentials.json` with a `0700`
+directory and `0600` file. Non-secret settings are written atomically to
+`~/.waterbox/config.json` using
 the exact official direct-provider endpoints `https://ascii.dev/api/box/v1` and
 `https://api.vercel.com/`; hosted Waterbox is pinned to `https://api.waterbox.ai/`.
 Interactive setup shows hosted Waterbox only when its public capability document
-advertises availability. Existing hosted keyring configuration and explicit
+advertises availability. Existing hosted persisted configuration and explicit
 `WATERBOX_PROVIDER=waterbox` environment configuration remain valid independently.
 `FORCE_DISPLAY_WATERBOX=1` is a development/debug override that shows it without
 fetching capabilities.
-Status never prints credentials. Logout removes local settings and all three
-keyring entries but does not alter remote resources or
+Status never prints credentials and identifies the active credential backend.
+Logout removes local settings and all three stored credentials but does not alter remote resources or
 the SQLite resource registry.
 
-For headless systems without a usable keyring, place a complete provider
-configuration in the MCP client's environment/secret facility. Do not put
-secrets in command arguments:
+For containers, automation, or systems where user-readable file storage is not
+appropriate, place a complete provider configuration in the MCP client's
+environment/secret facility. Do not put secrets in command arguments:
 
 ```text
 Waterbox: WATERBOX_PROVIDER=waterbox, WATERBOX_API_KEY=<client-managed secret>
@@ -54,6 +56,11 @@ endpoints are supported only when the complete provider
 selection and credentials come from process environment. Environment and
 persisted sources are never mixed. `.env` is never loaded implicitly.
 
+Linux credentials are plaintext at rest and protected by filesystem ownership
+and permissions. Same-user processes, root, and backups may read them. Linux
+users upgrading from alpha.2 should rerun `npx waterbox setup`; native-keyring
+entries are not migrated automatically.
+
 An unconfigured server remains connected and returns setup guidance from all
 tools before filesystem, SQLite, artifact, or provider I/O.
 

package/dist/waterbox.js

@@ -2007,11 +2007,11 @@ var require_codegen = __commonJS({
         const rhs = this.rhs === void 0 ? "" : ` = ${this.rhs}`;
         return `${varKind} ${this.name}${rhs};` + _n;
       }
-      optimizeNames(names, constants2) {
+      optimizeNames(names, constants3) {
         if (!names[this.name.str])
           return;
         if (this.rhs)
-          this.rhs = optimizeExpr(this.rhs, names, constants2);
+          this.rhs = optimizeExpr(this.rhs, names, constants3);
         return this;
       }
       get names() {
@@ -2028,10 +2028,10 @@ var require_codegen = __commonJS({
       render({ _n }) {
         return `${this.lhs} = ${this.rhs};` + _n;
       }
-      optimizeNames(names, constants2) {
+      optimizeNames(names, constants3) {
         if (this.lhs instanceof code_1.Name && !names[this.lhs.str] && !this.sideEffects)
           return;
-        this.rhs = optimizeExpr(this.rhs, names, constants2);
+        this.rhs = optimizeExpr(this.rhs, names, constants3);
         return this;
       }
       get names() {
@@ -2092,8 +2092,8 @@ var require_codegen = __commonJS({
       optimizeNodes() {
         return `${this.code}` ? this : void 0;
       }
-      optimizeNames(names, constants2) {
-        this.code = optimizeExpr(this.code, names, constants2);
+      optimizeNames(names, constants3) {
+        this.code = optimizeExpr(this.code, names, constants3);
         return this;
       }
       get names() {
@@ -2122,12 +2122,12 @@ var require_codegen = __commonJS({
         }
         return nodes.length > 0 ? this : void 0;
       }
-      optimizeNames(names, constants2) {
+      optimizeNames(names, constants3) {
         const { nodes } = this;
         let i = nodes.length;
         while (i--) {
           const n = nodes[i];
-          if (n.optimizeNames(names, constants2))
+          if (n.optimizeNames(names, constants3))
             continue;
           subtractNames(names, n.names);
           nodes.splice(i, 1);
@@ -2180,12 +2180,12 @@ var require_codegen = __commonJS({
           return void 0;
         return this;
       }
-      optimizeNames(names, constants2) {
+      optimizeNames(names, constants3) {
         var _a;
-        this.else = (_a = this.else) === null || _a === void 0 ? void 0 : _a.optimizeNames(names, constants2);
-        if (!(super.optimizeNames(names, constants2) || this.else))
+        this.else = (_a = this.else) === null || _a === void 0 ? void 0 : _a.optimizeNames(names, constants3);
+        if (!(super.optimizeNames(names, constants3) || this.else))
           return;
-        this.condition = optimizeExpr(this.condition, names, constants2);
+        this.condition = optimizeExpr(this.condition, names, constants3);
         return this;
       }
       get names() {
@@ -2208,10 +2208,10 @@ var require_codegen = __commonJS({
       render(opts2) {
         return `for(${this.iteration})` + super.render(opts2);
       }
-      optimizeNames(names, constants2) {
-        if (!super.optimizeNames(names, constants2))
+      optimizeNames(names, constants3) {
+        if (!super.optimizeNames(names, constants3))
           return;
-        this.iteration = optimizeExpr(this.iteration, names, constants2);
+        this.iteration = optimizeExpr(this.iteration, names, constants3);
         return this;
       }
       get names() {
@@ -2247,10 +2247,10 @@ var require_codegen = __commonJS({
       render(opts2) {
         return `for(${this.varKind} ${this.name} ${this.loop} ${this.iterable})` + super.render(opts2);
       }
-      optimizeNames(names, constants2) {
-        if (!super.optimizeNames(names, constants2))
+      optimizeNames(names, constants3) {
+        if (!super.optimizeNames(names, constants3))
           return;
-        this.iterable = optimizeExpr(this.iterable, names, constants2);
+        this.iterable = optimizeExpr(this.iterable, names, constants3);
         return this;
       }
       get names() {
@@ -2292,11 +2292,11 @@ var require_codegen = __commonJS({
         (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNodes();
         return this;
       }
-      optimizeNames(names, constants2) {
+      optimizeNames(names, constants3) {
         var _a, _b;
-        super.optimizeNames(names, constants2);
-        (_a = this.catch) === null || _a === void 0 ? void 0 : _a.optimizeNames(names, constants2);
-        (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names, constants2);
+        super.optimizeNames(names, constants3);
+        (_a = this.catch) === null || _a === void 0 ? void 0 : _a.optimizeNames(names, constants3);
+        (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names, constants3);
         return this;
       }
       get names() {
@@ -2597,7 +2597,7 @@ var require_codegen = __commonJS({
     function addExprNames(names, from) {
       return from instanceof code_1._CodeOrName ? addNames(names, from.names) : names;
     }
-    function optimizeExpr(expr, names, constants2) {
+    function optimizeExpr(expr, names, constants3) {
       if (expr instanceof code_1.Name)
         return replaceName(expr);
       if (!canOptimize(expr))
@@ -2612,14 +2612,14 @@ var require_codegen = __commonJS({
         return items;
       }, []));
       function replaceName(n) {
-        const c = constants2[n.str];
+        const c = constants3[n.str];
         if (c === void 0 || names[n.str] !== 1)
           return n;
         delete names[n.str];
         return c;
       }
       function canOptimize(e) {
-        return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants2[c.str] !== void 0);
+        return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants3[c.str] !== void 0);
       }
     }
     function subtractNames(names, from) {
@@ -49971,7 +49971,7 @@ function snapshotName(accountId, snapshotId) {
   const digest2 = createHash2("sha256").update(accountId).update("\0").update(snapshotId).digest("hex").slice(0, 32);
   return `waterbox-${hint}-${digest2}`;
 }
-var PACKAGE_VERSION = "0.1.0-alpha.1";
+var PACKAGE_VERSION = "0.1.0-alpha.2";
 var SystemBoxProviderClock = class {
   now() {
     return /* @__PURE__ */ new Date();
@@ -51913,7 +51913,7 @@ async function createEmbeddedApiBackend(config3, overrides = {}) {
 }
 async function createConfiguredEmbeddedApiBackend(configuration, artifactLocation, diagnostic) {
   validateConfiguredMcpBackend(configuration);
-  const artifact = await loadSandboxRuntimeArtifact(artifactLocation, "0.1.0-alpha.2");
+  const artifact = await loadSandboxRuntimeArtifact(artifactLocation, "0.1.0-alpha.3");
   return createEmbeddedApiBackend({ sqlitePath: configuration.sqlitePath, accountId: "local", provider: { ...configuration.provider, runtimeArtifact: artifact }, ...diagnostic === void 0 ? {} : { diagnostic } });
 }
 function validateBaseConfiguration(config3, identityResolver) {
@@ -52026,7 +52026,8 @@ function positiveNumber(value) {
 }
 
 // packages/mcp/src/onboarding.ts
-import { chmod, lstat, mkdir as mkdir2, readFile as readFile2, rename, rm, writeFile } from "node:fs/promises";
+import { constants } from "node:fs";
+import { chmod, lstat, mkdir as mkdir2, open, readFile as readFile2, rename, rm, writeFile } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
 import { dirname as dirname2, join as join3 } from "node:path";
 var KEYRING_SERVICE = "waterbox";
@@ -52038,6 +52039,7 @@ var CAPABILITY_TIMEOUT_MS = 2e3;
 var MAX_CAPABILITY_BYTES = 16 * 1024;
 var accounts = { waterbox: "api-key", box: "box-api-key", vercel: "vercel-token" };
 var MAX_CONFIG_BYTES = 64 * 1024;
+var MAX_CREDENTIAL_BYTES = 64 * 1024;
 var setupGuidance = "Waterbox MCP is not configured. Run npx waterbox setup, then restart the MCP client. Environment-only setup is also supported: set WATERBOX_PROVIDER and the selected provider's variables (Waterbox: WATERBOX_API_KEY; Box: BOX_API_KEY, WATERBOX_AUTO_STOP; Vercel: VERCEL_TOKEN, VERCEL_TEAM_ID, VERCEL_PROJECT_ID, WATERBOX_AUTO_STOP). Do not provide credentials in chat or tool arguments.";
 var OnboardingError = class extends Error {
   constructor(message = setupGuidance) {
@@ -52096,6 +52098,7 @@ function configStorage(home = homedir2()) {
 }
 function nativeCredentialStore() {
   return {
+    backend: "keyring",
     async get(provider) {
       const { AsyncEntry } = await import("@napi-rs/keyring");
       const value = await new AsyncEntry(KEYRING_SERVICE, accounts[provider]).getPassword();
@@ -52112,6 +52115,145 @@ function nativeCredentialStore() {
     }
   };
 }
+var credentialDocumentSchema = external_exports.object({ version: external_exports.literal(1), credentials: external_exports.object({ waterbox: external_exports.string().optional(), box: external_exports.string().optional(), vercel: external_exports.string().optional() }).strict() }).strict();
+var credentialQueues = /* @__PURE__ */ new Map();
+function fileCredentialStore(home = homedir2()) {
+  const path = join3(home, ".waterbox", "credentials.json");
+  const unavailable = () => new OnboardingError("Waterbox credential storage is unavailable. Run npx waterbox setup or use environment-only configuration.");
+  const queued = async (operation) => {
+    const prior = credentialQueues.get(path) ?? Promise.resolve();
+    let release;
+    const current = new Promise((resolve) => {
+      release = resolve;
+    });
+    const waiting = prior.then(() => current, () => current);
+    credentialQueues.set(path, waiting);
+    await prior.catch(() => {
+    });
+    try {
+      return await operation();
+    } finally {
+      release();
+      if (credentialQueues.get(path) === waiting) credentialQueues.delete(path);
+    }
+  };
+  const readDocument = async () => {
+    try {
+      const directory = await lstat(dirname2(path));
+      if (directory.isSymbolicLink() || !directory.isDirectory() || (directory.mode & 511) !== 448 || !ownedByCurrentUser(directory.uid)) throw unavailable();
+      const file3 = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+      let value;
+      try {
+        const metadata = await file3.stat();
+        if (!metadata.isFile() || metadata.nlink !== 1 || metadata.size > MAX_CREDENTIAL_BYTES || (metadata.mode & 511) !== 384 || !ownedByCurrentUser(metadata.uid)) throw unavailable();
+        const bytes = Buffer.alloc(metadata.size + 1);
+        let size = 0;
+        while (size < bytes.length) {
+          const result = await file3.read(bytes, size, bytes.length - size, size);
+          if (result.bytesRead === 0) break;
+          size += result.bytesRead;
+        }
+        if (size !== metadata.size) throw unavailable();
+        value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, size)));
+      } catch {
+        throw unavailable();
+      } finally {
+        await file3.close();
+      }
+      const parsed = credentialDocumentSchema.safeParse(value);
+      if (!parsed.success) throw unavailable();
+      for (const secret of Object.values(parsed.data.credentials)) try {
+        providerCredential(secret);
+      } catch {
+        throw unavailable();
+      }
+      return parsed.data;
+    } catch (error47) {
+      if (error47.code === "ENOENT") return void 0;
+      if (error47 instanceof OnboardingError) throw error47;
+      throw unavailable();
+    }
+  };
+  const syncDirectory = async () => {
+    try {
+      const directory = await open(dirname2(path), "r");
+      try {
+        await directory.sync();
+      } finally {
+        await directory.close();
+      }
+    } catch (error47) {
+      if (!["EINVAL", "ENOTSUP", "EPERM", "EISDIR"].includes(error47.code ?? "")) throw error47;
+    }
+  };
+  const writeDocument = async (document) => {
+    const directoryPath = dirname2(path);
+    try {
+      await mkdir2(directoryPath, { recursive: true, mode: 448 });
+      const directory = await lstat(directoryPath);
+      if (directory.isSymbolicLink() || !directory.isDirectory() || !ownedByCurrentUser(directory.uid)) throw unavailable();
+      await chmod(directoryPath, 448);
+      try {
+        const existing = await lstat(path);
+        if (existing.isSymbolicLink() || !existing.isFile()) throw unavailable();
+      } catch (error47) {
+        if (error47.code !== "ENOENT") throw error47;
+      }
+      const temporary = `${path}.${process.pid}.${crypto.randomUUID()}.tmp`;
+      try {
+        await writeFile(temporary, JSON.stringify(document), { encoding: "utf8", mode: 384, flag: "wx" });
+        await chmod(temporary, 384);
+        const file3 = await open(temporary, "r");
+        try {
+          await file3.sync();
+        } finally {
+          await file3.close();
+        }
+        await rename(temporary, path);
+        await syncDirectory();
+      } catch (error47) {
+        await rm(temporary, { force: true }).catch(() => {
+        });
+        throw error47;
+      }
+    } catch (error47) {
+      if (error47 instanceof OnboardingError) throw error47;
+      throw unavailable();
+    }
+  };
+  return {
+    backend: "file",
+    async get(provider) {
+      return queued(async () => (await readDocument())?.credentials[provider]);
+    },
+    async set(provider, secret) {
+      const accepted = providerCredential(secret);
+      await queued(async () => {
+        const document = await readDocument() ?? { version: 1, credentials: {} };
+        document.credentials[provider] = accepted;
+        await writeDocument(document);
+      });
+    },
+    async delete(provider) {
+      return queued(async () => {
+        const document = await readDocument();
+        if (!document || document.credentials[provider] === void 0) return false;
+        delete document.credentials[provider];
+        if (Object.keys(document.credentials).length === 0) {
+          await rm(path);
+          await syncDirectory();
+        } else await writeDocument(document);
+        return true;
+      });
+    }
+  };
+}
+function defaultCredentialStore(home, platform = process.platform) {
+  return platform === "linux" ? fileCredentialStore(home) : nativeCredentialStore();
+}
+function ownedByCurrentUser(uid) {
+  return process.getuid === void 0 || uid === process.getuid();
+}
 async function loadPersisted(storage) {
   let raw2;
   try {
@@ -52162,7 +52304,7 @@ async function resolvedEnvironment(environment, storage, credentials) {
     const settings = config3.vercel;
     Object.assign(resolved, { VERCEL_TOKEN: secret, VERCEL_API_ORIGIN: settings.apiOrigin, VERCEL_TEAM_ID: settings.teamId, VERCEL_PROJECT_ID: settings.projectId, VERCEL_POLL_INTERVAL_MS: String(settings.pollIntervalMs), VERCEL_POLL_TIMEOUT_MS: String(settings.pollTimeoutMs), VERCEL_REQUEST_TIMEOUT_MS: String(settings.requestTimeoutMs), WATERBOX_AUTO_STOP: automaticStopEnvironmentValue(settings.automaticStopMs) });
   }
-  return { environment: resolved, source: "keyring", provider: config3.provider };
+  return { environment: resolved, source: credentials.backend ?? "keyring", provider: config3.provider };
 }
 var automaticStopGuidance = "How often should a sandbox be automatically stopped?\n\nImportant: a stopped sandbox is automatically resumed by the next coding operation. This is not a limit on total sandbox runtime or spending.\n\nThis is a safety mechanism that limits wasted compute if the agent does not stop a sandbox when finished. Agents are instructed to stop unused sandboxes, but this is not enforced.\n\nA short duration, such as 40m, minimizes wasted compute but may interrupt long-running commands. For long workflows, consider 6h or more. Provider limits apply, so check your plan's maximum execution time.";
 async function setup(storage, credentials, prompts, dependencies = {}) {
@@ -52324,8 +52466,16 @@ async function logout(storage, credentials) {
   } catch {
     throw new OnboardingError("Waterbox logout could not read local configuration or credentials; no changes were made.");
   }
-  const removed = await Promise.allSettled(Object.keys(prior).map(async (provider) => ({ provider, deleted: await credentials.delete(provider) })));
-  const deletionFailed = removed.some((result) => result.status === "rejected" || !result.value.deleted && prior[result.value.provider] !== void 0);
+  let deletionFailed = false;
+  for (const provider of Object.keys(prior)) {
+    try {
+      const deleted = await credentials.delete(provider);
+      if (!deleted && prior[provider] !== void 0) deletionFailed = true;
+    } catch {
+      deletionFailed = true;
+      break;
+    }
+  }
   if (deletionFailed) {
     const restored = await restore(credentials, prior);
     throw new OnboardingError(`Waterbox logout could not remove all credentials${restored ? "; rollback was confirmed" : "; rollback could not be confirmed"}.`);
@@ -52387,12 +52537,17 @@ async function credentialSnapshot(credentials) {
   return { waterbox: await credentials.get("waterbox") ?? void 0, box: await credentials.get("box") ?? void 0, vercel: await credentials.get("vercel") ?? void 0 };
 }
 async function restore(credentials, prior, providers = Object.keys(prior), requireDeletionConfirmation = []) {
-  const results = await Promise.allSettled(providers.map(async (provider) => {
-    if (prior[provider] !== void 0) return credentials.set(provider, prior[provider]);
-    const deleted = await credentials.delete(provider);
-    if (!deleted && requireDeletionConfirmation.includes(provider)) throw new Error("credential deletion was not confirmed");
-  }));
-  return results.every((result) => result.status === "fulfilled");
+  let restored = true;
+  for (const provider of providers) try {
+    if (prior[provider] !== void 0) await credentials.set(provider, prior[provider]);
+    else {
+      const deleted = await credentials.delete(provider);
+      if (!deleted && requireDeletionConfirmation.includes(provider)) throw new Error("credential deletion was not confirmed");
+    }
+  } catch {
+    restored = false;
+  }
+  return restored;
 }
 async function restoreRawConfig(storage, raw2) {
   try {
@@ -52413,7 +52568,7 @@ var McpConfigurationError = class extends Error {
 };
 async function parseMcpConfig(environment = process.env, homeDirectory, dependencies = {}) {
   try {
-    const resolved = await resolvedEnvironment(environment, dependencies.storage ?? configStorage(homeDirectory), dependencies.credentials ?? nativeCredentialStore());
+    const resolved = await resolvedEnvironment(environment, dependencies.storage ?? configStorage(homeDirectory), dependencies.credentials ?? defaultCredentialStore(homeDirectory));
     if (resolved.provider === "waterbox") {
       try {
         return { provider: { type: "waterbox", apiKey: providerCredential(resolved.environment.WATERBOX_API_KEY) } };
@@ -57913,8 +58068,8 @@ var Server = class extends Protocol {
 var instructions = "Waterbox gives agents the ability to create, manage, and command isolated sandboxes.\n\nUse Waterbox when instructed by the user or when additional isolated compute would be useful, such as avoiding pressure on the local machine or running parallel work without workspace conflicts.\n\nWaterbox tools fall into two groups:\n\n- **Daily workflow:** create a sandbox, operate on it, then stop it.\n- **Reusable setup utilities:** list and create snapshots to avoid repeating environment setup.\n\n**Core workflow**\n\n1. Create a sandbox as the execution environment for your work.\n2. Use the filesystem and command tools to work inside the sandbox.\n3. When the task is complete and all material outcomes expected outside the sandbox have been exported or otherwise preserved, stop the sandbox to avoid unnecessary compute costs. Do not stop it merely because a conversational turn has ended while work remains active.\n\nSandbox filesystem state is resumable, but retention is provider-dependent. Neither sandboxes nor snapshots are definitive storage. Export material outcomes when the task is complete.\n\n**Reusable setup pattern**\n\nWhen you detect repeated setup work or dependencies, consider creating a snapshot so future sandboxes can start from a prepared environment. Give snapshots clear names and descriptions, and preserve reusable dependencies, tools, CLIs, and other environment preparation. Keep task-specific work in source control or another definitive external store so snapshots do not seed future work with stale project state.";
 
 // packages/mcp/src/secure-transfer.ts
-import { constants } from "node:fs";
-import { open, stat } from "node:fs/promises";
+import { constants as constants2 } from "node:fs";
+import { open as open2, stat } from "node:fs/promises";
 async function sendFileSecurely(client, input, context) {
   context.signal.throwIfAborted();
   const plaintext = await readLocalFile(input.sourcePath, context.signal);
@@ -57927,10 +58082,10 @@ async function sendFileSecurely(client, input, context) {
 async function readLocalFile(path, signal, overrides = {}) {
   signal.throwIfAborted();
   const statFile = overrides.stat ?? stat;
-  const openFile = overrides.open ?? open;
+  const openFile = overrides.open ?? open2;
   const initial = await statFile(path);
   if (!initial.isFile()) throw new Error("Local source must be a regular file");
-  let handle = await openFile(path, constants.O_RDONLY);
+  let handle = await openFile(path, constants2.O_RDONLY);
   let bytes;
   let transferred = false;
   try {
@@ -57990,7 +58145,7 @@ var tools = [
   tool("bash", "Runs unrestricted bash as root in the specified Waterbox sandbox, never on the local machine. The default working directory is the sandbox workspace.", ARGUMENT_SCHEMAS.bash, BashToolResultSchema)
 ];
 function createWaterboxMcpServer(client, options = {}) {
-  const server = new Server({ name: "waterbox", version: "0.1.0-alpha.2" }, { capabilities: { tools: {} }, instructions });
+  const server = new Server({ name: "waterbox", version: "0.1.0-alpha.3" }, { capabilities: { tools: {} }, instructions });
   server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools }));
   server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
     try {
@@ -58139,7 +58294,7 @@ var standardPrompts = {
 };
 async function runCli(arguments_, dependencies = {}) {
   const write = dependencies.write ?? ((line) => console.log(line)), error47 = dependencies.error ?? ((line) => console.error(line));
-  const storage = dependencies.storage ?? configStorage(), credentials = dependencies.credentials ?? nativeCredentialStore();
+  const storage = dependencies.storage ?? configStorage(dependencies.homeDirectory), credentials = dependencies.credentials ?? defaultCredentialStore(dependencies.homeDirectory, dependencies.platform);
   if (arguments_.length !== 1 || !["setup", "status", "logout"].includes(arguments_[0] ?? "")) {
     error47("Usage: waterbox [setup|status|logout]. Run without arguments to start the MCP server.");
     return 2;
@@ -58165,15 +58320,15 @@ async function runCli(arguments_, dependencies = {}) {
       }
       const state3 = await credentialState(config3.provider, credentials);
       if (state3 === "available") await parseMcpConfig(environment, void 0, { storage, credentials });
-      write(`Waterbox status: provider ${config3.provider}; local configuration keyring; credential ${state3}.${state3 === "available" ? "" : ` Environment fallback: WATERBOX_PROVIDER=${config3.provider} and ${credentialVariable(config3.provider)}.`}`);
+      write(`Waterbox status: provider ${config3.provider}; configuration file; credential ${credentials.backend ?? "keyring"} ${state3}.${state3 === "available" ? "" : ` Environment fallback: WATERBOX_PROVIDER=${config3.provider} and ${credentialVariable(config3.provider)}.`}`);
       if (state3 !== "available") return 1;
       return 0;
     }
-    const parsed = await parseMcpConfig(environment, void 0, { storage, credentials });
+    const parsed = await parseMcpConfig(environment, dependencies.homeDirectory, { storage, credentials });
     const provider = parsed.provider.type === "waterbox" ? "waterbox" : parsed.provider.configuration.provider.kind;
     const source = environment.WATERBOX_PROVIDER === void 0 ? "keyring" : "environment";
     const state2 = source === "keyring" ? await credentialState(provider, credentials) : "available";
-    write(`Waterbox status: provider ${provider}; configuration ${source}; credential ${state2}.`);
+    write(`Waterbox status: provider ${provider}; configuration ${source}; credential ${source === "environment" ? "environment" : credentials.backend ?? "keyring"} ${state2}.`);
     return 0;
   } catch (caught) {
     error47(caught instanceof OnboardingError || caught instanceof McpConfigurationError ? caught.message : "Waterbox command failed");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "waterbox",
-  "version": "0.1.0-alpha.2",
+  "version": "0.1.0-alpha.3",
   "private": false,
   "type": "module",
   "description": "Run coding tools in isolated, stateful sandboxes through MCP.",