* fix(mcp): auth-aware gateway MCP, stderr for Execute, login reauth

- Skip requireGatewayProject for gateway mcp when no API key; enforce when key present
- Route gateway mcp errors and login-required messages to stderr; no interactive login
- argvContainsGatewayMCP skips global flags (e.g. --profile, -p)
- Always register hookdeck_login with optional reauth; clear credentials then device login
- Hedged list-projects failure hint suggesting reauth for 401/403-style errors
- ClearMCPProfileCredentials for memory-only or persisted config
- Acceptance: subprocess gateway mcp with stdin pipe; stdout JSON-RPC hygiene

Made-with: Cursor

* refactor(config): centralize silent credential clear for logout and MCP

- Rename ClearMCPProfileCredentials to ClearActiveProfileCredentials; document disk vs memory paths
- Logout uses the same helper as MCP reauth; zeroProfileCredentialFields helper
- RemoveAllProfiles clears in-memory credential fields after wiping the file (parity with logout -a)
- Rename config test to match new API

Made-with: Cursor

* Tighten error matching, improve login context handling, and tests (#281)

* fix(review): tighten error matching, add safety comments, revert noise

- tool_projects_errors.go: match "status code: 4xx" instead of bare
  "401"/"403" to avoid false positives on IDs or timestamps
- tool_login.go: remove `_ = ctx` suppression, add TODO for context
  propagation to polling goroutine, document happens-before on
  loginState.err via channel close
- root.go: add maintenance comment linking flagNeedsNextArg to init()
- helpers.go: revert unrelated Attempt struct alignment change

https://claude.ai/code/session_01EpXZqTmgybtjgmSALukH8d

* fix(review): ListProjects returns *APIError, add reauth + argv tests

- projects.go: use checkAndPrintError instead of manual status check so
  ListProjects errors are structured *APIError — the errors.As path in
  shouldSuggestReauthAfterListProjectsFailure now matches directly
- tool_projects_errors_test.go: unit tests for reauth hint logic covering
  APIError 401/403, plain error fallback, and false-positive resistance
- root_argv_test.go: document boolean-flag-between-subcommands limitation

https://claude.ai/code/session_01EpXZqTmgybtjgmSALukH8d

* fix(mcp): cancel login polling goroutine on MCP session close

Thread the request context into the login polling goroutine so it
stops promptly when the MCP transport closes, instead of running for
up to ~4 minutes after the client disconnects.

WaitForAPIKey blocks with time.Sleep and doesn't accept a context, so
we run it in an inner goroutine and select on both its result channel
and ctx.Done(). The inner goroutine is bounded by loginMaxAttempts.

https://claude.ai/code/session_01EpXZqTmgybtjgmSALukH8d

---------

Co-authored-by: Claude <noreply@anthropic.com>

* fix(mcp): review fixes for auth-aware gateway MCP (#282)

* fix(review): tighten error matching, add safety comments, revert noise

- tool_projects_errors.go: match "status code: 4xx" instead of bare
  "401"/"403" to avoid false positives on IDs or timestamps
- tool_login.go: remove `_ = ctx` suppression, add TODO for context
  propagation to polling goroutine, document happens-before on
  loginState.err via channel close
- root.go: add maintenance comment linking flagNeedsNextArg to init()
- helpers.go: revert unrelated Attempt struct alignment change

https://claude.ai/code/session_01EpXZqTmgybtjgmSALukH8d

* fix(mcp): cancel login polling goroutine on MCP session close

Thread the request context into the login polling goroutine so it
stops promptly when the MCP transport closes, instead of running for
up to ~4 minutes after the client disconnects.

WaitForAPIKey blocks with time.Sleep and doesn't accept a context, so
we run it in an inner goroutine and select on both its result channel
and ctx.Done(). The inner goroutine is bounded by loginMaxAttempts.

https://claude.ai/code/session_01EpXZqTmgybtjgmSALukH8d

* fix(mcp): use session-level context for login polling, not per-request

The per-request ctx passed to MCP tool handlers is cancelled when the
handler returns. The previous commit selected on that ctx in the login
polling goroutine, which killed the poll immediately after returning
the browser URL — breaking in-MCP authentication.

Fix: add a sessionCtx field to Server, set it in Run() (called by
RunStdio and tests), and select on that instead. The session context
is only cancelled when the MCP transport closes (stdin EOF), which is
the correct signal to abandon login polling.

Also adds TestLoginTool_PollSurvivesAcrossToolCalls: a regression test
that starts a login flow, lets the mock auth complete between tool
calls, and verifies the client is authenticated on the second call.
This would have caught the per-request ctx bug.

https://claude.ai/code/session_01EpXZqTmgybtjgmSALukH8d

---------

Co-authored-by: Claude <noreply@anthropic.com>

* fix(test): MCP login poll timing, profile save guard, retry API 500

- Wait loginPollInterval before second hookdeck_login in PollSurvives test
- SaveActiveProfileAfterLogin: skip disk persist when viper nil (tests)
- CLIRunner: retry transient HTTP 500 like 502 for acceptance flakes

Made-with: Cursor

* fix(cli): validate without stale project headers; sync profile from API

Omit X-Team-ID/X-Project-ID on GET /cli-auth/validate via clientForCLIAuthValidate
so a valid CLI key is not rejected when config.toml has a stale project_id.

After successful validate on the existing-key login path, persist project_id,
project_mode, and project_type from the response.

Add Profile Apply* helpers for validate, poll, and CI responses; use them from
login, interactive login, and MCP hookdeck_login. requireGatewayProject now
applies the full validate response (including project_id) without clearing
guest_url.

Tests: auth validate headers, profile apply helpers, LoadConfigFromFile,
gateway resolve-from-validate integration.

Made-with: Cursor

* docs(agents): go test in Cursor, module cache, out-of-sandbox runs

Document GOMODCACHE for agent shells, prompt-first elevated execution, and
point CLAUDE.md at AGENTS.md as the single source for agent instructions.

Made-with: Cursor

* chore: send command flag names in CLI telemetry

Include changed flag names (not values) as command_flags in
X-Hookdeck-CLI-Telemetry JSON. Wire CollectChangedFlagNames from root
initTelemetry. Add unit tests and acceptance test for login --api-key
and --cli-key over the recording proxy.

Made-with: Cursor

---------

Co-authored-by: Claude <noreply@anthropic.com>