openclacky 1.5.6 → 1.5.7

data/lib/clacky/agent.rb

@@ -51,7 +51,6 @@ module Clacky
                 :latest_latency,  # Hash of latency metrics from the most recent LLM call (see Client#send_messages_with_tools)
                 :reasoning_effort
     attr_accessor :pinned
-    attr_accessor :hidden
     attr_accessor :channel_info
     attr_accessor :project_id
 
@@ -82,15 +81,15 @@ module Clacky
       @source = source.to_sym  # :manual | :cron | :channel
       @channel_info = nil  # { platform:, user_id:, user_name:, chat_id: } set by ChannelManager
       @tool_registry = ToolRegistry.new
-      @hooks = HookManager.new
+      @hooks = HookManager.new(agent: self)
       @session_id = session_id
       @name = ""
       @pinned = false
-      @hidden = false
       @history = MessageHistory.new
       @todos = []  # Store todos in memory
       @iterations = 0
       @total_cost = 0.0
+      @cost_mutex = Mutex.new
       @cache_stats = {
         cache_creation_input_tokens: 0,
         cache_read_input_tokens: 0,
@@ -110,7 +109,7 @@ module Clacky
       @ui = ui  # UIController for direct UI interaction
       @debug_logs = []  # Debug logs for troubleshooting
       @pending_injections = []     # Pending inline skill injections to flush after observe()
-      @pending_subagent_transcript = nil # Subagent trail to attach to the next tool result (observe)
+      @pending_subagent_transcripts = {} # tool_call_id => subagent trail, attached by observe()
       @pending_script_tmpdirs = [] # Decrypted-script tmpdirs that live for the agent's lifetime
       @pending_error_rollback = false  # Deferred rollback flag set by restore_session on error
       @last_run_interrupted = false    # Set when run() exits via AgentInterrupted; tells the next run() to keep the task-start snapshot (continuation of the same task across a relay, not a brand-new task)
@@ -287,6 +286,27 @@ module Clacky
       @goal_manager&.active? || false
     end
 
+    # Emit a custom extension event to the UI.
+    #
+    # `type` must be namespaced "ext.<extension>.<event>" so custom events can
+    # never collide with the built-in protocol.
+    #
+    # Transient by default: progress ticks and other high-frequency chatter are
+    # pushed live and forgotten, so extensions cannot bloat session.json without
+    # opting in. Pass `persist: true` for milestone events that must reappear in
+    # the chat stream after a reload; those are anchored to the current message,
+    # survive compression via the chunk MD, and are replayed in place.
+    def emit_event(type, persist: false, **data)
+      name = type.to_s
+      unless name.start_with?("ext.")
+        raise ArgumentError, "custom event type must be namespaced as 'ext.<extension>.<event>', got #{name.inspect}"
+      end
+
+      @ui&.emit(name, **data)
+      @history.append_ext_event({ type: name, data: data }) if persist
+      self
+    end
+
     # Resolve the model name the goal judge should use. Prefer the provider's
     # lite model (cheap/fast for a one-line verdict); fall back to the primary
     # model when no lite is resolvable.
@@ -1139,6 +1159,13 @@ module Clacky
           next
         end
 
+        # A hook fulfilled the call itself (e.g. an extension that runs the
+        # skill on its own subagents). Its result stands in for the tool's.
+        if hook_result[:action] == :handled
+          results << build_success_result(call, hook_result[:result])
+          next
+        end
+
         # Show preview for edit and write tools even in auto-approve mode
         if should_auto_execute?(call[:name], call[:arguments])
           # In auto-approve mode, show preview for edit and write tools
@@ -1196,10 +1223,13 @@ module Clacky
             args[:todos_storage] = @todos
           end
 
-          # Special handling for InvokeSkill: inject agent and skill_loader
+          # Special handling for InvokeSkill: inject agent and skill_loader.
+          # tool_call_id lets the subagent transcript be keyed to *this* call, so
+          # multiple invoke_skill calls in one turn don't cross-attach trails.
           if call[:name] == "invoke_skill"
             args[:agent] = self
             args[:skill_loader] = @skill_loader
+            args[:tool_call_id] = call[:id]
           end
 
           # Inject working_dir so tools don't rely on Dir.chdir global state
@@ -1351,7 +1381,7 @@ module Clacky
         @history.append(truncated.merge(task_id: @current_task_id))
       end
 
-      attach_pending_subagent_transcript(response)
+      attach_pending_subagent_transcripts(response)
 
       # Append a follow-up `role:"user"` message for any image payloads that
       # could not be delivered inside the tool message.
@@ -1396,22 +1426,24 @@ module Clacky
       end
     end
 
-    # Attach the captured subagent transcript (set by execute_skill_with_subagent)
-    # to the invoke_skill tool result message just appended by observe(). The
-    # transcript rides on the tool message as :subagent_transcript — an internal
-    # field stripped before the LLM call but persisted to session.json and
-    # replayed to the WebUI. Cleared after attaching so it fires exactly once.
-    private def attach_pending_subagent_transcript(response)
-      transcript = @pending_subagent_transcript
-      return unless transcript
+    # Attach captured subagent transcripts (set by execute_skill_with_subagent)
+    # to their own invoke_skill tool result messages just appended by observe().
+    # Each transcript rides on its tool message as :subagent_transcript — an
+    # internal field stripped before the LLM call but persisted to session.json
+    # and replayed to the WebUI. Keyed by tool_call_id so a turn with several
+    # invoke_skill calls attaches each subagent's trail to the call that spawned
+    # it. Consumed entries are deleted so each fires exactly once.
+    private def attach_pending_subagent_transcripts(response)
+      return if @pending_subagent_transcripts.empty?
 
-      @pending_subagent_transcript = nil
+      Array(response[:tool_calls]).each do |tc|
+        next unless (tc[:name] || tc.dig(:function, :name)) == "invoke_skill"
 
-      skill_call = Array(response[:tool_calls]).find { |tc| (tc[:name] || tc.dig(:function, :name)) == "invoke_skill" }
-      target_id = skill_call && skill_call[:id]
-      return unless target_id
+        transcript = @pending_subagent_transcripts.delete(tc[:id])
+        next unless transcript
 
-      @history.attach_to_tool_result(target_id, :subagent_transcript, transcript)
+        @history.attach_to_tool_result(tc[:id], :subagent_transcript, transcript)
+      end
     end
 
     # Cap oversized tool result content to keep a single tool message from
@@ -1587,8 +1619,67 @@ module Clacky
       parent_count = subagent.instance_variable_get(:@parent_message_count) || 0
       result = subagent.run(task)
 
-      @total_cost += result[:total_cost_usd] || 0.0
+      # A detached run stays invisible, so its cost is merged silently — the
+      # sessionbar refresh would be the one thing that gives it away.
+      absorb_subagent_cost(result, notify_ui: false)
+
+      final_assistant_text(subagent, parent_count)
+    end
+
+    # Run several independent tasks on forked subagents at the same time.
+    #
+    # Each subagent is forked on the calling thread (forking deep-copies parent
+    # config + history, which must not race) and only the blocking run is moved
+    # onto the pool. Results keep the order of `tasks`; a task that raises or
+    # overruns the budget yields a failed slot instead of aborting its siblings.
+    #
+    # Subagents run silently by default: they share the parent's session, so a
+    # live UI would interleave several raw transcripts into one chat.
+    #
+    # @param tasks [Array<String>] one prompt per subagent
+    # @param model [String, nil] model for every subagent (nil = current)
+    # @param forbidden_tools [Array<String>] tool names blocked at runtime
+    # @param max_concurrency [Integer] subagents allowed to run at once
+    # @param timeout [Numeric, nil] wall-clock budget for the whole batch
+    # @return [Array<Fanout::Result>] value is the subagent's final reply text
+    def fan_out_subagents(tasks, model: nil, forbidden_tools: [], max_concurrency: Fanout::DEFAULT_MAX_CONCURRENCY,
+                          timeout: nil)
+      return [] if tasks.empty?
+
+      jobs = tasks.each_with_index.map do |task, index|
+        subagent = fork_subagent(
+          model: model,
+          forbidden_tools: forbidden_tools,
+          system_prompt_suffix: "You are one of several subagents running in parallel on independent tasks. " \
+                                "Do your task and return only the requested output. Do not ask follow-up questions."
+        )
+        parent_count = subagent.instance_variable_get(:@parent_message_count) || 0
+        label = "Subagent #{index + 1}/#{tasks.size}"
+        # Fanout workers are fresh threads, so the epoch that lets the web
+        # broadcaster drop events from superseded tasks has to be carried over
+        # by hand — otherwise interrupted subagents keep writing to the new task.
+        epoch = Thread.current[:task_epoch]
+
+        lambda do
+          Thread.current[:task_epoch] = epoch
+          within_phase(label, kind: "fanout_subagent", concurrent: true) do
+            result = subagent.run(task)
+            absorb_subagent_cost(result, notify_ui: false)
+            final_assistant_text(subagent, parent_count)
+          end
+        end
+      end
+
+      Fanout.new(max_concurrency: max_concurrency, timeout: timeout).run(jobs)
+    end
+
+    private def within_phase(label, kind:, concurrent:, &block)
+      return yield unless @ui.respond_to?(:with_phase)
+
+      @ui.with_phase(kind: kind, label: label, concurrent: concurrent, &block)
+    end
 
+    private def final_assistant_text(subagent, parent_count)
       new_messages = subagent.history.to_a[parent_count..] || []
       new_messages
         .reverse

data/lib/clacky/anthropic_stream_aggregator.rb

@@ -121,7 +121,12 @@ module Clacky
 
     private def emit_usage_progress
       return unless @on_chunk
-      input  = @usage["input_tokens"].to_i + @usage["cache_read_input_tokens"].to_i
+      raw_input      = @usage["input_tokens"].to_i
+      cache_read     = @usage["cache_read_input_tokens"].to_i
+      cache_creation = @usage["cache_creation_input_tokens"].to_i
+      # Mirrors MessageFormat::Anthropic.parse_response so the live readout and
+      # the final billed numbers agree.
+      input = MessageFormat::Anthropic.normalise_prompt_tokens(raw_input, cache_read, cache_creation)
       output = @usage["output_tokens"].to_i
       return if input == @last_input_tokens && output == @last_output_tokens
       @last_input_tokens = input

data/lib/clacky/cli.rb

@@ -8,6 +8,7 @@ require_relative "json_ui_controller"
 require_relative "plain_ui_controller"
 require_relative "brand_config"
 require_relative "extension/cli_commands"
+require_relative "mcp/cli_commands"
 
 module Clacky
   class CLI < Thor
@@ -1217,6 +1218,9 @@ module Clacky
     desc "ext SUBCOMMAND", "Manage extension containers (new, verify, list, pack, install, publish, search)"
     subcommand "ext", Clacky::CliExtensionCommands
 
+    desc "mcp SUBCOMMAND", "Manage MCP server connections and OAuth authorization"
+    subcommand "mcp", Clacky::Mcp::CliCommands
+
     desc "billing", "Show billing summary and usage statistics"
     long_desc <<-LONGDESC
       Display billing summary with token usage and cost breakdown.

data/lib/clacky/client.rb

@@ -415,7 +415,7 @@ module Clacky
         if defined?(Clacky::Logger)
           Clacky::Logger.warn("[parse_simple_openai_response] no content. status=#{response.status} body=#{snippet}")
         end
-        raise Clacky::Error,
+        raise RetryableError,
           "Upstream OpenAI-compatible response missing choices[0].message.content. " \
           "Body snippet: #{snippet}"
       end

data/lib/clacky/default_extensions/ext-studio/skills/ext-develop/SKILL.md

@@ -206,16 +206,21 @@ Response helpers: `json` / `text(str)` / `send_data(bytes, content_type:, filena
 - Drive sessions from the backend: `create_session(prompt:, profile:, …)`,
   `submit_task(session_id, prompt)`, `dispatch_to_session(session_id, prompt)` (runs a
   side task on a fork and returns its reply without touching the conversation).
-- `create_session(hidden: true)` creates a session the openclacky session list hides
-  and the 200-session cleanup skips - use it for dedicated extension sessions you
-  manage yourself. Still reachable by `session_id` via `submit_task` /
-  `dispatch_to_session` / `registry.with_session`; forking resets `hidden` to false.
 - **Projects**: `project_manager.all` lists projects, `find(id)` returns one (or
   `nil`), `create(name:, working_dir:, …)` / `update(id, …)` / `delete(id)` mutate.
   Pass `project_id:` to `create_session` to bind a session to a project - its
   `working_dir` is inherited (unless overridden) and `agent.project_id` is persisted.
   A panel can also `fetch("/api/projects")` directly (same-origin, no-auth; see
   [Host API](/docs/extend-host-api)).
+- **Session source grouping** (⚠️ opt-in only): `create_session` accepts `source: "manual"`
+  (default) or `source: "ext"`; anything else is rejected with 400. Use `"ext"` **only**
+  when the extension creates sessions the user did not individually ask for (bookkeeping,
+  background workers, one per webhook) and would otherwise flood the list — they collapse
+  under a single "Extensions" sidebar entry with their own 200-session cleanup pool.
+  **Default to `"manual"`**: a session the user asked for is one they should be able to
+  find, and folded sessions are easy to overlook while the separate pool silently consumes
+  storage until evicted. Sessions bound to a project always show in that project's area
+  regardless of `source`, and count toward the regular pool rather than the ext one.
 - Public (no-auth) endpoints: call `public_endpoint("/path")` in the class **and** set
   `public: true` at ext.yml top level — both are required.
 
@@ -230,7 +235,10 @@ Response helpers: `json` / `text(str)` / `send_data(bytes, content_type:, filena
   `event` values (exactly these): `before_tool_use after_tool_use on_tool_error on_start
   on_complete on_iteration session_rollback`. A `before_tool_use` hook returning
   `{ action: :deny, reason: "…" }` **blocks** the tool call — this is how you audit or
-  gate dangerous commands.
+  gate dangerous commands. Every event passes the **agent as its last block arg**
+  (`|call, result, agent|` for `after_tool_use`); call `agent.emit_event("ext.<id>.<event>",
+  persist: true, **data)` to push structured events to the frontend. `persist: false`
+  (default) vanishes on refresh — emit a `persist: true` terminal event at the end.
 
 ## Scaffold
 

data/lib/clacky/extension/api_extension.rb

@@ -27,6 +27,10 @@ module Clacky
     MAX_TIMEOUT  = 600
     DEFAULT_TIMEOUT = 10
 
+    # "ext" groups the session under the sidebar's folded extension entry and
+    # gives it a dedicated cleanup pool; extensions cannot claim other sources.
+    ALLOWED_SESSION_SOURCES = %w[manual ext].freeze
+
     Route = Struct.new(:method, :pattern, :regex, :param_names, :block, :options, keyword_init: true)
 
     class Halt < StandardError
@@ -270,9 +274,14 @@ module Clacky
     # (unless an explicit working_dir overrides it) and the session is
     # associated with the project.
     def create_session(name: nil, prompt: nil, working_dir: nil, profile: "general",
-                       source: :manual, display_message: nil, hidden: false, project_id: nil)
+                       source: :manual, display_message: nil, project_id: nil)
       error!("server not ready", status: 503) unless @http_server
 
+      src = source.to_s
+      unless ALLOWED_SESSION_SOURCES.include?(src)
+        error!("invalid source '#{src}': allowed values are #{ALLOWED_SESSION_SOURCES.join(", ")}", status: 400)
+      end
+
       if project_id
         project_id = project_id.to_s.strip
         project_id = nil if project_id.empty?
@@ -288,8 +297,7 @@ module Clacky
         name: name,
         working_dir: working_dir,
         profile: profile,
-        source: source,
-        hidden: hidden
+        source: source
       )
 
       if project_id

data/lib/clacky/fanout.rb

@@ -0,0 +1,100 @@
+# frozen_string_literal: true
+
+module Clacky
+  # Runs a batch of blocking jobs on a bounded thread pool and collects their
+  # results in the order the jobs were given, regardless of completion order.
+  #
+  # Built for subagent fan-out: each job blocks inside Agent#run, so the pool is
+  # sized for concurrency rather than CPU count. A job that raises is captured
+  # as a failed slot instead of tearing down its siblings.
+  class Fanout
+    Result = Struct.new(:index, :value, :error, :duration, keyword_init: true) do
+      def ok?
+        error.nil?
+      end
+    end
+
+    DEFAULT_MAX_CONCURRENCY = 4
+
+    # @param max_concurrency [Integer] jobs allowed to run at once
+    # @param timeout [Numeric, nil] wall-clock budget for the whole batch
+    def initialize(max_concurrency: DEFAULT_MAX_CONCURRENCY, timeout: nil)
+      raise ArgumentError, "max_concurrency must be positive" unless max_concurrency.to_i.positive?
+
+      @max_concurrency = max_concurrency.to_i
+      @timeout = timeout
+    end
+
+    # @param jobs [Array<#call>] each job is invoked with no arguments
+    # @return [Array<Result>] one entry per job, aligned to the input order
+    def run(jobs)
+      return [] if jobs.empty?
+
+      pending = build_queue(jobs)
+      results = Array.new(jobs.size)
+      deadline = @timeout && (monotonic_now + @timeout)
+
+      workers = Array.new([@max_concurrency, jobs.size].min) do
+        Thread.new { drain(pending, results, deadline) }
+      end
+      join_all(workers, deadline)
+
+      fill_unfinished(results)
+    end
+
+    private def build_queue(jobs)
+      queue = Queue.new
+      jobs.each_with_index { |job, index| queue << [index, job] }
+      queue
+    end
+
+    private def drain(pending, results, deadline)
+      # pop(true) raises ThreadError when the queue is drained, which is the
+      # only exit condition — workers outlive individual jobs.
+      loop do
+        index, job = pending.pop(true)
+        break if deadline && monotonic_now >= deadline
+
+        results[index] = invoke(index, job)
+      end
+    rescue ThreadError
+      nil
+    end
+
+    private def invoke(index, job)
+      started = monotonic_now
+      value = job.call
+      Result.new(index: index, value: value, error: nil, duration: monotonic_now - started)
+    rescue StandardError, ScriptError => e
+      Result.new(index: index, value: nil, error: e, duration: monotonic_now - started)
+    end
+
+    private def join_all(workers, deadline)
+      workers.each do |worker|
+        if deadline
+          remaining = deadline - monotonic_now
+          worker.join(remaining.positive? ? remaining : 0) or worker.kill
+        else
+          worker.join
+        end
+      end
+    end
+
+    private def fill_unfinished(results)
+      results.each_with_index do |result, index|
+        next if result
+
+        results[index] = Result.new(
+          index: index,
+          value: nil,
+          error: FanoutTimeoutError.new("fan-out job #{index} did not finish within #{@timeout}s"),
+          duration: @timeout
+        )
+      end
+    end
+
+    private def monotonic_now
+      Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    end
+  end
+end

data/lib/clacky/locales/en.rb

@@ -3,6 +3,8 @@
 module Clacky
   module Locales
     EN = {
+      "phase.skill_evolution"           => "Reflecting on this task",
+      "phase.skipped"                   => "skipped",
       "llm.error.insufficient_credit"   => "Insufficient credit, please top up your account to continue",
       "llm.error.rate_limit_400"        => "Rate limit or service issue, retrying...",
       "llm.error.invalid_api_key"       => "API key is invalid or expired, please update it in Settings",

data/lib/clacky/locales/zh.rb

@@ -3,6 +3,8 @@
 module Clacky
   module Locales
     ZH = {
+      "phase.skill_evolution"           => "正在复盘本次任务",
+      "phase.skipped"                   => "已跳过",
       "llm.error.insufficient_credit"   => "账户余额不足，请前往控制台充值后继续使用",
       "llm.error.rate_limit_400"        => "请求频率过高或服务暂时不可用，正在重试...",
       "llm.error.invalid_api_key"       => "API Key 无效或已过期，请到设置中重新配置",

data/lib/clacky/mcp/cli_commands.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require "thor"
+require "json"
+require_relative "connection_manager"
+
+module Clacky
+  module Mcp
+    class CliCommands < Thor
+      desc "capabilities", "Report MCP client capabilities"
+      option :json, type: :boolean, default: false
+      def capabilities
+        result = { "remote_oauth" => true }
+        emit(result, "Remote MCP OAuth: supported")
+      end
+
+      desc "login SERVER", "Authorize an OAuth-protected remote MCP server"
+      option :json, type: :boolean, default: false
+      def login(server)
+        result = manager(server).login
+        emit(result, "Connected MCP server '#{server}'.")
+      rescue ConnectionManager::Error => e
+        fail_with(e.message)
+      end
+
+      desc "status SERVER", "Show remote MCP authorization status"
+      option :json, type: :boolean, default: false
+      def status(server)
+        result = manager(server).status
+        label = result["connected"] ? "connected" : "disconnected"
+        emit(result, "MCP server '#{server}' is #{label}.")
+      rescue ConnectionManager::Error => e
+        fail_with(e.message)
+      end
+
+      desc "logout SERVER", "Delete credentials for a remote MCP server"
+      option :json, type: :boolean, default: false
+      def logout(server)
+        result = manager(server).logout
+        emit(result, "Disconnected MCP server '#{server}'.")
+      rescue ConnectionManager::Error => e
+        fail_with(e.message)
+      end
+
+      no_commands do
+        private def manager(server)
+          ConnectionManager.new(server_name: server)
+        end
+
+        private def emit(result, text)
+          puts(options[:json] ? JSON.generate(result) : text)
+        end
+
+        private def fail_with(message)
+          warn message
+          raise Thor::Error, message
+        end
+      end
+    end
+  end
+end

data/lib/clacky/mcp/client.rb

@@ -6,6 +6,10 @@ require "monitor"
 require_relative "transport"
 require_relative "stdio_transport"
 require_relative "http_transport"
+require_relative "oauth/config"
+require_relative "oauth/credential_store"
+require_relative "oauth/authorization_manager"
+require_relative "oauth/session"
 
 module Clacky
   module Mcp
@@ -29,7 +33,7 @@ module Clacky
       # Build a Client from an mcp.json spec hash.
       # Recognized fields:
       #   stdio: command (required), args, env, cwd
-      #   http:  type: "http", url (required), headers
+      #   http:  type: "http", url (required), headers, auth
       def self.from_spec(name, spec)
         type = (spec["type"] || (spec["url"] ? "http" : "stdio")).to_s
         case type
@@ -45,12 +49,24 @@ module Clacky
             )
           )
         when "http", "streamable-http"
+          oauth_config = OAuth::Config.from_server_spec(spec)
+          authorization = nil
+          if oauth_config.enabled?
+            store = OAuth::CredentialStore.new(server_name: name)
+            manager = OAuth::AuthorizationManager.new(
+              server_name: name,
+              config: oauth_config,
+              store: store
+            )
+            authorization = OAuth::Session.new(store: store, manager: manager)
+          end
           new(
             name:    name,
             transport: HttpTransport.new(
               name:    name,
               url:     spec["url"],
-              headers: spec["headers"] || {}
+              headers: spec["headers"] || {},
+              authorization: authorization
             )
           )
         else

data/lib/clacky/mcp/connection_manager.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+require "json"
+require_relative "oauth/config"
+require_relative "oauth/credential_store"
+require_relative "oauth/authorization_manager"
+require_relative "oauth/session"
+
+module Clacky
+  module Mcp
+    class ConnectionManager
+      class Error < StandardError; end
+
+      def initialize(server_name:, home: Dir.home, working_dir: Dir.pwd, session_factory: nil)
+        @server_name = server_name.to_s
+        @home = File.expand_path(home)
+        @working_dir = working_dir && File.expand_path(working_dir)
+        @session_factory = session_factory || lambda do |_config, store, manager|
+          OAuth::Session.new(store: store, manager: manager)
+        end
+      end
+
+      def login
+        session.login
+        safe_status
+      rescue OAuth::AuthorizationManager::Error, OAuth::Session::Error, OAuth::CredentialStore::Error => e
+        raise Error, e.message
+      end
+
+      def status
+        safe_status
+      rescue OAuth::CredentialStore::Error => e
+        raise Error, e.message
+      end
+
+      def logout
+        session.logout
+        { "server" => @server_name, "connected" => false }
+      rescue OAuth::Session::Error, OAuth::CredentialStore::Error => e
+        raise Error, e.message
+      end
+
+      private def safe_status
+        session.status.merge("server" => @server_name)
+      end
+
+      private def session
+        return @session if @session
+
+        spec = server_spec
+        raise Error, "MCP server '#{@server_name}' is not configured" unless spec
+        config = OAuth::Config.from_server_spec(spec)
+        raise Error, "MCP server '#{@server_name}' is not configured for OAuth" unless config.enabled?
+        store = OAuth::CredentialStore.new(server_name: @server_name, home: @home)
+        manager = OAuth::AuthorizationManager.new(
+          server_name: @server_name,
+          config: config,
+          store: store
+        )
+        @session = @session_factory.call(config, store, manager)
+      rescue OAuth::Config::Error => e
+        raise Error, e.message
+      end
+
+      private def server_spec
+        servers = {}
+        config_paths.each do |path|
+          next unless File.file?(path)
+          document = JSON.parse(File.read(path))
+          source = document["mcpServers"] || document["servers"] || {}
+          source.each { |name, spec| servers[name.to_s] = spec if spec.is_a?(Hash) }
+        rescue JSON::ParserError
+          raise Error, "invalid MCP configuration in #{path}"
+        end
+        servers[@server_name]
+      end
+
+      private def config_paths
+        paths = [File.join(@home, ".clacky", "mcp.json")]
+        paths << File.join(@working_dir, ".clacky", "mcp.json") if @working_dir
+        paths
+      end
+    end
+  end
+end