fix(install): always run auth-login, drop stale already_authed check (#50)

## Summary

The installer's "is AgentKey already configured?" heuristic went stale
after #47 / v1.7.0 switched `--auth-login` from a stdio MCP block to a
remote-HTTP one. The check still greps for `\"AGENTKEY_API_KEY\":
\"ak_...\"` (the old env-shaped field) — but the new config writes
`\"Authorization\": \"Bearer ak_...\"` inside `headers` instead.

**Observed symptom**: a user with a residual stdio config from an
earlier release sees

> ✓ AgentKey is already configured in an MCP client config — skipping
auth.

…the installer exits successfully, but calling any AgentKey MCP tool
errors out because the stdio runtime `@agentkey/mcp` is no longer used.

The mirror failure also exists: users who **have** successfully
re-authed into the new HTTP shape no longer match the regex and would
get re-prompted on every installer run.

## Fix

Delete the heuristic. `@agentkey/cli --auth-login` already knows whether
the local token can be reused or a fresh device-code round-trip is
needed — let the CLI decide instead of having the installer second-guess
from on-disk shape.

**Removed**

- \`already_authed()\` in \`scripts/install.sh\`
- \`Test-AlreadyAuthed\` in \`scripts/install.ps1\`
- \`--force-mcp\` / \`-ForceMcp\` flags (no longer meaningful — auth
always runs unless \`--skip-mcp\`)
- \`--force-mcp\` documentation in README.md / docs/README_zh.md

Net: **-57 / +10 lines** across the four files.

## Test plan

- [ ] On a machine with a stale stdio-shaped \`~/.claude.json\` from a
pre-1.7 install: \`curl -fsSL https://agentkey.app/install.sh | bash\`
now actually re-runs auth-login and the MCP block becomes a working HTTP
entry
- [ ] On a fresh machine: install still completes auth in one
device-code flow (no behavior change)
- [ ] On a machine already on the new HTTP shape: re-running the
installer still works and the CLI either reuses the token or prompts
(CLI's call, not the installer's)
- [ ] \`--skip-mcp\` continues to skip the auth step
- [ ] \`bash -n scripts/install.sh\` passes (verified)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: lxcong <lxcong@chainbase.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -285,12 +285,9 @@ curl -fsSL https://agentkey.app/install.sh | bash -s -- --all-agents
 # Only the skill, or only the MCP auth
 curl -fsSL https://agentkey.app/install.sh | bash -s -- --skip-mcp
 curl -fsSL https://agentkey.app/install.sh | bash -s -- --skip-skill
-
-# Re-authenticate even if AgentKey is already configured locally
-curl -fsSL https://agentkey.app/install.sh | bash -s -- --force-mcp
 ```
 
-PowerShell equivalents: `-Yes`, `-ListAgents`, `-Only`, `-AllAgents`, `-SkipMcp`, `-SkipSkill`, `-ForceMcp`.
+PowerShell equivalents: `-Yes`, `-ListAgents`, `-Only`, `-AllAgents`, `-SkipMcp`, `-SkipSkill`.
 
 **Manual two-step install** (if you'd rather run the two underlying commands yourself, or the one-line installer can't reach your machine):
 

docs/README_zh.md

@@ -285,12 +285,9 @@ curl -fsSL https://agentkey.app/install.sh | bash -s -- --all-agents
 # 只装 Skill 或只做 MCP 授权
 curl -fsSL https://agentkey.app/install.sh | bash -s -- --skip-mcp
 curl -fsSL https://agentkey.app/install.sh | bash -s -- --skip-skill
-
-# 即使本机已经配置过 AgentKey 也强制重新走一次授权
-curl -fsSL https://agentkey.app/install.sh | bash -s -- --force-mcp
 ```
 
-PowerShell 对应参数：`-Yes`、`-ListAgents`、`-Only`、`-AllAgents`、`-SkipMcp`、`-SkipSkill`、`-ForceMcp`。
+PowerShell 对应参数：`-Yes`、`-ListAgents`、`-Only`、`-AllAgents`、`-SkipMcp`、`-SkipSkill`。
 
 **手动两步安装**（想自己跑两条底层命令，或一键脚本在你的环境里跑不起来）：
 

scripts/install.ps1

@@ -26,7 +26,6 @@ param(
     [switch]$ListAgents,
     [switch]$Remote,
     [switch]$Local,
-    [switch]$ForceMcp,
     [switch]$SkipSkill,
     [switch]$SkipMcp,
     [switch]$NoTelemetry,
@@ -120,24 +119,6 @@ function Test-RemoteInstall {
     return $false
 }
 
-# Cheap "is AgentKey already configured?" check across known MCP config files.
-function Test-AlreadyAuthed {
-    $configs = @(
-        "$env:USERPROFILE\.claude.json",
-        "$env:USERPROFILE\.cursor\mcp.json",
-        "$env:APPDATA\Claude\claude_desktop_config.json"
-    )
-    foreach ($cfg in $configs) {
-        if (-not (Test-Path -LiteralPath $cfg)) { continue }
-        $content = Get-Content -Raw -LiteralPath $cfg -ErrorAction SilentlyContinue
-        if (-not $content) { continue }
-        if ($content -match '"agentkey"' -and $content -match '"AGENTKEY_API_KEY"\s*:\s*"ak_[A-Za-z0-9_-]+"') {
-            return $true
-        }
-    }
-    return $false
-}
-
 # ── Help ──────────────────────────────────────────────────────────────────
 if ($Help) {
     @'
@@ -158,7 +139,6 @@ Parameters:
                     SSH, in WinRM, in a container, or via OpenClaw / Claude Code
                     remote channels.
   -Local            Force local mode (auto-open browser) and bypass remote heuristics
-  -ForceMcp         Re-run MCP auth even if AgentKey is already configured
   -SkipSkill        Skip the skill install step (only run MCP auth)
   -SkipMcp          Skip the MCP auth step (only install the skill)
   -NoTelemetry      Disable anonymous usage telemetry (writes
@@ -347,13 +327,13 @@ if (-not $SkipSkill) {
 }
 
 # ── 3. MCP authentication ────────────────────────────────────────────────
+# Always run auth-login. The CLI itself decides whether the existing token
+# can be reused or a fresh device-code flow is needed — the installer no
+# longer second-guesses by sniffing config files (which produced false
+# positives across the stdio → HTTP schema change).
 if ($SkipMcp) {
     Write-Step '3. Register the MCP server'
     Write-Muted 'Skipped (-SkipMcp)'
-} elseif ((Test-AlreadyAuthed) -and -not $ForceMcp) {
-    Write-Step '3. Register the MCP server'
-    Write-Ok 'AgentKey is already configured in an MCP client config — skipping auth.'
-    Write-Muted 'Re-run with -ForceMcp to authenticate again.'
 } else {
     $isRemote = Test-RemoteInstall
     $authArgs = @('--auth-login')

scripts/install.sh

@@ -108,7 +108,6 @@ Options:
                       do NOT auto-open a local browser. Use this when running over
                       SSH, in Docker, or via OpenClaw / Claude Code remote channels.
   --local             Force local mode (auto-open browser) and bypass remote heuristics
-  --force-mcp         Re-run MCP auth even if AgentKey is already configured
   --skip-skill        Skip the skill install step (only run MCP auth)
   --skip-mcp          Skip the MCP auth step (only install the skill)
   --no-telemetry      Disable anonymous usage telemetry (writes
@@ -193,24 +192,6 @@ detect_remote() {
     return 1
 }
 
-# Cheap "is AgentKey already configured?" check across known MCP config files.
-# Greps for an agentkey block + a non-empty AGENTKEY_API_KEY of the expected
-# shape. Returns 0 if at least one config has both.
-already_authed() {
-    local cfg
-    for cfg in "$HOME/.claude.json" \
-               "$HOME/.cursor/mcp.json" \
-               "$HOME/Library/Application Support/Claude/claude_desktop_config.json" \
-               "$HOME/.config/Claude/claude_desktop_config.json"; do
-        [ -f "$cfg" ] || continue
-        if grep -q '"agentkey"' "$cfg" 2>/dev/null \
-           && grep -qE '"AGENTKEY_API_KEY"[^"]*"ak_[A-Za-z0-9_-]+"' "$cfg" 2>/dev/null; then
-            return 0
-        fi
-    done
-    return 1
-}
-
 install_node() {
     local platform="$1"
     ui_info "Installing Node.js v$NODE_MIN_MAJOR+ ..."
@@ -272,7 +253,6 @@ main() {
     local PRINT_HELP=false
     local LIST_AGENTS=false
     local ALL_AGENTS=false
-    local FORCE_MCP=false
     # FORCE_REMOTE / FORCE_LOCAL are read by detect_remote(). Declared as
     # plain (non-`local`) so the helpers see them — they're dynamic-scope
     # accessible either way in bash, but explicit assignment here keeps
@@ -295,7 +275,6 @@ main() {
             --list-agents)     LIST_AGENTS=true; shift ;;
             --remote)          FORCE_REMOTE=true; shift ;;
             --local)           FORCE_LOCAL=true; shift ;;
-            --force-mcp)       FORCE_MCP=true; shift ;;
             --skip-skill)      SKIP_SKILL=true; shift ;;
             --skip-mcp)        SKIP_MCP=true; shift ;;
             --no-telemetry)    NO_TELEMETRY=true; shift ;;
@@ -481,13 +460,13 @@ main() {
     fi
 
     # ── 3. MCP authentication ────────────────────────────────────────────
+    # Always run auth-login. The CLI itself decides whether the existing
+    # token can be reused or a fresh device-code flow is needed — the
+    # installer no longer second-guesses by sniffing config files (which
+    # produced false positives across the stdio → HTTP schema change).
     if $SKIP_MCP; then
         ui_step "3. Register the MCP server"
         ui_muted "Skipped (--skip-mcp)"
-    elif already_authed && ! $FORCE_MCP; then
-        ui_step "3. Register the MCP server"
-        ui_ok "AgentKey is already configured in an MCP client config — skipping auth."
-        ui_muted "Re-run with --force-mcp to authenticate again."
     else
         # Decide local-vs-remote and route the MCP CLI flags accordingly.
         local IS_REMOTE=false