[sergeyfast]

Two independent fixes, one per commit.

Problem

uninstall left the profile behind, and refused the @ spelling

Reported from the field:

$ mcpurl uninstall @asksrv
mcpurl: no entry "@asksrv" in .../claude_desktop_config.json

uninstall was the only command that took a name without passing it through
profile resolution, so the @ — which show and Config.Get strip — reached
the JSON lookup verbatim. Dropping the @ then removed the entry but left
[profiles.asksrv] in config.toml, and no command could remove it:
uninstall was specified as "the entry and nothing else". The user edited the
TOML by hand. Re-running install was no way out either — an existing name
failed with "pass a different --name".

A 401 body was thrown away, and re-login happened anyway

docs/tasks/02-401-body-discarded.md. The server answered with a complete
diagnosis (oidc: malformed jwt: unexpected signature algorithm "HS256"), and
none of it reached the user: a response body reads exactly once, and the debug
line read it first. mcpurl then refreshed, opened a browser, and got the same
401 — the authorization server issues those tokens happily, the resource server
refuses them, and no amount of new tokens changes that.

Changes

uninstall / install

• One resolution rule for every command (Config.Resolve): an http(s) URL is an
  endpoint, anything else is a profile name with an optional @. A target
  that is neither produces one message naming both readings. This also fixes
  claude-config asksrv, which insisted on the @ from the other side.
• uninstall is the full undo: the client entry, the profile the entry
  references (--name may differ from the profile name) and the tokens stored
  for it — with the profile gone there is no target left to logout with. Each
  part is best-effort, so a half-installed setup still gets cleaned; only
  "nothing found anywhere" is an error. Entries in other clients that still
  point at the removed profile are reported.
• install updates an existing profile in place: the URL follows the new
  target, passed flags override, and everything else — headers above all — is
  carried over.
• config.toml is edited as text (pkg/app/tomledit.go), never a TOML
  round-trip: comments, alignment and other profiles survive byte-for-byte,
  including a comment that documents the profile below the one being removed.
• Both config files are replaced via tmp+rename (internal/atomicfile), so an
  interrupted write cannot truncate them. Symlinks are followed, not replaced —
  a config.toml symlinked out of a dotfiles repository stays linked. .bak as
  before.
• Fixed install treating a bare profile name as a URL, which minted a
  duplicate profile named after the host.

401 diagnostics

• The failed response body is buffered before anything else reads it, and put
  back, so the log line and the error built later see the same bytes. The
  server's own text is rendered into HTTPError.Error() and into the JSON-RPC
  error the MCP client shows, which used to read upstream HTTP 401.
• The RFC 6750 error/error_description pair is parsed out of
  WWW-Authenticate and named in the give-up message.
• No browser escalation when the rejected token is one this process just minted
  — unless the challenge calls it expired, which a new token can still fix. The
  ladder is capped, and stops when a provider re-offers a rejected token.
• A failed initialize is answered before exiting: a client that only renders
  the error surface must still learn why the handshake failed.
• JWT-shaped runs are redacted from server-supplied text (internal/redact) —
  gateways quote the credential they refused, and that text now reaches a
  plaintext client log and the client UI.

Verification

go test -race ./..., make lint and gofmt clean; the first commit was also
checked out into a separate worktree and tested on its own, so it stands up on
CI without the second.

Beyond unit tests, both paths were exercised end to end with a real binary
against a temporary HOME: install → re-install with a different URL →
uninstall @name → uninstall name again; a config where the removed profile
sits between a comment block and another profile; a config.toml symlinked into
a dotfiles directory; and an entry belonging to another MCP server.

Notes

• Shape-based redaction cannot catch an opaque bearer token — it is
  indistinguishable from an identifier. Scrubbing the exact presented value at
  capture time is the complete fix and needs a change to how the body is
  captured; filed for a follow-up task together with the error bodies still
  dropped in fetchJSON and the token endpoint's error_description.
• uninstall <name> still removes an entry that mcpurl did not write, and
  trusts that entry's @arg when choosing which profile to drop. It warns and
  points at the .bak; gating the cascade on ownership is a deliberate
  non-change here.
• When the 401 ladder hits its cap the user reads upstream HTTP 401 rather
  than "mcpurl stopped trying" — worth a distinct error later.