fix(cli): restore authenticated MCP launch flow

[hmishra2250]

Summary

Fixes the MCP launch regression introduced by credential hardening: firecrawl init -k <key> stored a credential that firecrawl launch <agent> subsequently refused because the MCP installer only recognized process.env.

• pass a stored key only in the environment of the agent launched by firecrawl launch
• keep MCP configuration indirect (${FIRECRAWL_API_KEY} or the client-native equivalent)
• never pass the stored key to npx, client setup argv, or client config
• preserve the fail-closed behavior for persistent --install / --config / --setup
• consolidate Hermes and OpenClaw through the common MCP installer
• expose explicit --keyless setup and launch flags
• fix Hermes and OpenClaw ignoring explicit keyless setup
• warn when VS Code or Codex App may reuse a GUI process that cannot inherit a launch-scoped key
• bump the CLI to 1.19.30

Authentication behavior

Flow	Behavior
launch <agent> with stored key	configures /v2/mcp with an env reference and gives the key only to the launched agent
exported FIRECRAWL_API_KEY	preserves the existing environment-backed bearer flow
no key or explicit --keyless	configures /v2/mcp without an Authorization header
install-only with stored key	fails with actionable export / launch / keyless remedies

Security verification

Executed the original reproduction with isolated credentials and instrumented client shims:

• installer argv contained Bearer ${FIRECRAWL_API_KEY}, never the literal key
• the npx installer did not receive FIRECRAWL_API_KEY
• the client existence probe did not receive it
• only the final launched agent process received the stored key
• the literal key appeared only in the CLI credentials store

Also exercised the built CLI across Claude Code, VS Code, Codex, Codex App, OpenCode, Hermes, and OpenClaw, plus keyless --agent all.

Verification

• pnpm run format:check
• pnpm run type-check
• pnpm run build
• pnpm run test (417/417)
• built-CLI authenticated launch matrix across all launch targets
• built-CLI keyless setup matrix across all launch integrations

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Restores authenticated MCP launch by keeping configs env-referenced and scoping a stored API key to the launched agent’s environment. Adds explicit --keyless setup/launch and unifies Hermes/OpenClaw under a shared installMcp.

• Bug Fixes

  • Fixed regression where firecrawl init -k created a key that firecrawl launch rejected; the key now goes only to the child process env.
  • MCP configs stay indirect (${FIRECRAWL_API_KEY} or client-native); the literal key is never written to config, npx, or setup argv.
  • Preserved fail-closed behavior for install-only paths with clearer guidance (export key, launch via CLI, or use keyless); reject --keyless with --skip-mcp.
  • Warn when VS Code or Codex App may reuse a GUI process that can’t inherit a launch-scoped key.
  • Bumped CLI to 1.19.30.

• New Features

  • Added --keyless to setup and launch for explicit anonymous MCP.
  • Consolidated Hermes and OpenClaw via shared installMcp; both honor keyless and env indirection.

^{Written for commit 4a79128. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 7 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>