A bad token paste (or a vault/item that did not match the login-name
default) used to surface only as mcp-config asking for a LiteLLM key,
hiding that every vault key was missing. Now:
- the token is verified with `op whoami` and re-prompted on a bad paste
- vault and item are validated, auto-picked when the token sees only one,
and otherwise prompted with the list it can see
- bootstrap skips mcp-config and hermes, with an error naming the cause,
when no LITELLM_KEY came from the vault
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
noconnorandClaude Opus 5
5bc8a27f60