fix: use correct field names for missing secrets in doctor output

Update doctor command to use field names from contracts.MissingSecretInfo:
- secret_name instead of name
- used_by (array) instead of server

Also fix tests to match the actual backend JSON structure.

Author: technicalpickles

cmd/mcpproxy/doctor_cmd.go

@@ -253,16 +253,22 @@ func outputDiagnostics(diag map[string]interface{}, info map[string]interface{})
 			fmt.Println("━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━")
 			for _, secretItem := range missingSecrets {
 				if secretMap, ok := secretItem.(map[string]interface{}); ok {
-					name := getStringField(secretMap, "name")
-					server := getStringField(secretMap, "server")
-					reference := getStringField(secretMap, "reference")
-
-					fmt.Printf("\n  • %s\n", name)
-					if server != "" {
-						fmt.Printf("    Server: %s\n", server)
-					}
-					if reference != "" {
-						fmt.Printf("    Reference: %s\n", reference)
+					// Use correct field names from contracts.MissingSecretInfo
+					secretName := getStringField(secretMap, "secret_name")
+					usedBy := getArrayField(secretMap, "used_by")
+
+					fmt.Printf("\n  • %s\n", secretName)
+					if len(usedBy) > 0 {
+						fmt.Printf("    Used by: ")
+						for i, server := range usedBy {
+							if serverStr, ok := server.(string); ok {
+								if i > 0 {
+									fmt.Printf(", ")
+								}
+								fmt.Printf("%s", serverStr)
+							}
+						}
+						fmt.Println()
 					}
 				}
 			}

cmd/mcpproxy/doctor_cmd_test.go

@@ -147,8 +147,17 @@ func TestOutputDiagnostics_PrettyFormat_WithUpstreamErrors(t *testing.T) {
 
 func TestOutputDiagnostics_PrettyFormat_WithOAuthRequired(t *testing.T) {
 	diag := map[string]interface{}{
-		"total_issues":   2,
-		"oauth_required": []interface{}{"sentry-server", "github-server"},
+		"total_issues": 2,
+		"oauth_required": []interface{}{
+			map[string]interface{}{
+				"server_name": "sentry-server",
+				"message":     "Authentication required",
+			},
+			map[string]interface{}{
+				"server_name": "github-server",
+				"message":     "",
+			},
+		},
 	}
 
 	// Capture stdout
@@ -191,9 +200,8 @@ func TestOutputDiagnostics_PrettyFormat_WithMissingSecrets(t *testing.T) {
 		"total_issues": 1,
 		"missing_secrets": []interface{}{
 			map[string]interface{}{
-				"name":      "API_KEY",
-				"server":    "weather-api",
-				"reference": "${WEATHER_API_KEY}",
+				"secret_name": "API_KEY",
+				"used_by":     []interface{}{"weather-api"},
 			},
 		},
 	}
@@ -226,9 +234,6 @@ func TestOutputDiagnostics_PrettyFormat_WithMissingSecrets(t *testing.T) {
 	if !strings.Contains(output, "weather-api") {
 		t.Error("Missing server name")
 	}
-	if !strings.Contains(output, "${WEATHER_API_KEY}") {
-		t.Error("Missing secret reference")
-	}
 }
 
 func TestOutputDiagnostics_PrettyFormat_WithRuntimeWarnings(t *testing.T) {
@@ -606,8 +611,8 @@ func TestOutputDiagnostics_SecretWithoutOptionalFields(t *testing.T) {
 		"total_issues": 1,
 		"missing_secrets": []interface{}{
 			map[string]interface{}{
-				"name": "API_KEY",
-				// server and reference are optional
+				"secret_name": "API_KEY",
+				// used_by is optional
 			},
 		},
 	}
@@ -635,3 +640,49 @@ func TestOutputDiagnostics_SecretWithoutOptionalFields(t *testing.T) {
 		t.Error("Should display secret name even without optional fields")
 	}
 }
+
+// TestOutputDiagnostics_MissingSecretsRealJSON tests that the doctor command
+// correctly parses the actual JSON field names produced by the backend.
+// The MissingSecretInfo struct uses json:"secret_name" and json:"used_by",
+// NOT "name", "server", "reference".
+func TestOutputDiagnostics_MissingSecretsRealJSON(t *testing.T) {
+	// This is the ACTUAL JSON structure produced by the backend
+	// (see internal/contracts/types.go MissingSecretInfo struct)
+	diag := map[string]interface{}{
+		"total_issues": 1,
+		"missing_secrets": []interface{}{
+			map[string]interface{}{
+				"secret_name": "GITHUB_TOKEN",              // NOT "name"
+				"used_by":     []interface{}{"github-mcp"}, // NOT "server" (and it's an array)
+			},
+		},
+	}
+
+	// Capture stdout
+	oldStdout := os.Stdout
+	r, w, _ := os.Pipe()
+	os.Stdout = w
+	defer func() { os.Stdout = oldStdout }()
+
+	doctorOutput = "pretty"
+	err := outputDiagnostics(diag, nil)
+
+	w.Close()
+	var buf bytes.Buffer
+	buf.ReadFrom(r)
+	output := buf.String()
+
+	if err != nil {
+		t.Errorf("outputDiagnostics() returned error: %v", err)
+	}
+
+	// Verify the secret name is displayed
+	if !strings.Contains(output, "GITHUB_TOKEN") {
+		t.Errorf("Should display secret name 'GITHUB_TOKEN' from secret_name field.\nGot output:\n%s", output)
+	}
+
+	// Verify the server name is displayed
+	if !strings.Contains(output, "github-mcp") {
+		t.Errorf("Should display server 'github-mcp' from used_by field.\nGot output:\n%s", output)
+	}
+}