@1mcp/agent 0.35.0-beta.1 → 0.35.0-beta.3

package/build/transport/http/routes/adminRoutes.js

@@ -1,17 +1,24 @@
-import { createHash } from 'node:crypto';
+import { createHmac } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { MCP_PROJECT_METADATA } from '../../../constants.js';
+import { parseTemplateConnectionKey } from '../../../core/server/templateIdentity.js';
 import { AdminConfiguredServerApplyError, AdminConfiguredServerNotFoundError, } from '../../../domains/admin/adminConfiguredServerService.js';
 import { ADMIN_SESSION_COOKIE_NAME, AdminIdentityError, } from '../../../domains/admin/adminIdentityService.js';
 import { AdminPresetConflictError, AdminPresetNotFoundError, } from '../../../domains/admin/adminPresetService.js';
+import { sensitiveOperationLimiter } from '../../../transport/http/middlewares/securityMiddleware.js';
 import { sanitizeErrorMessage } from '../../../utils/validation/sanitization.js';
 import express, { Router } from 'express';
-import { createRequire } from 'node:module';
+import rateLimit from 'express-rate-limit';
 import { z } from 'zod';
 const FAILED_LOGIN_LIMIT = 5;
 const FAILED_LOGIN_WINDOW_MS = 15 * 60 * 1000;
 const FAILED_LOGIN_MAX_ACTIVE_KEYS = 10_000;
+const ADMIN_AUTH_RATE_LIMIT = 30;
+const ADMIN_AUTH_RATE_LIMIT_WINDOW_MS = 15 * 60 * 1000;
+const ADMIN_STATUS_RATE_LIMIT = 120;
+const ADMIN_STATUS_RATE_LIMIT_WINDOW_MS = 60 * 1000;
 const ADMIN_USERNAME_MAX_LENGTH = 256;
 const ADMIN_PASSWORD_MAX_LENGTH = 4096;
 const CLI_ADMIN_PROTOCOL_VERSION = '1';
@@ -19,16 +26,33 @@ const CLI_ADMIN_RESPONSE_MAX_BYTES = 256 * 1024;
 const CLI_ADMIN_RESPONSE_TOO_LARGE_MESSAGE = 'CLI Admin response exceeded the maximum supported size; use a narrower or paginated request.';
 const CLI_SESSION_OPERATIONS = ['admin.login', 'admin.status', 'admin.logout'];
 const ADMIN_API_PROTOCOL_VERSION = '1';
-const packageMetadata = createRequire(import.meta.url)('../../../../package.json');
-const CLI_MCP_OPERATIONS = ['mcp.enable', 'mcp.disable'];
+const TEMPLATE_INSTANCE_ID_DISPLAY_LENGTH = 12;
+const CLI_CONFIGURED_SERVER_OPERATIONS = ['mcp.enable', 'mcp.disable'];
+const CLI_BACKEND_RESTART_OPERATION = 'mcp.restart';
+const SEA_ADMIN_CONSOLE_ASSETS_KEY = '__1MCP_SEA_ADMIN_CONSOLE_ASSETS__';
 const adminLoginBodySchema = z.object({
     username: z.string().trim().min(1).max(ADMIN_USERNAME_MAX_LENGTH),
     password: z.string().min(1).max(ADMIN_PASSWORD_MAX_LENGTH),
 });
+const adminOAuthServiceParamsSchema = z.object({
+    serviceId: z.string().trim().min(1).max(256),
+});
+const backendLogSnapshotQuerySchema = z.object({
+    sourceId: z.string().trim().min(1).max(256).optional(),
+});
 const cliConfiguredServerMutationBodySchema = z.object({
     targetName: z.string().trim().min(1).max(256),
     dryRun: z.boolean().optional(),
 });
+const cliBackendRestartBodySchema = z
+    .object({
+    targetName: z.string().trim().min(1).max(256),
+    instance: z.string().trim().min(1).max(64).optional(),
+    allInstances: z.boolean().optional(),
+})
+    .refine((value) => !(value.instance !== undefined && value.allInstances === true), {
+    message: 'instance and allInstances are mutually exclusive',
+});
 export function createAdminRoutes(options) {
     if (!options.adminEnabled) {
         options.adminService.revokeAllSessions();
@@ -36,6 +60,18 @@ export function createAdminRoutes(options) {
     }
     const router = Router();
     const failedLoginLimiter = new FailedLoginLimiter();
+    const authenticationLimiter = rateLimit({
+        windowMs: ADMIN_AUTH_RATE_LIMIT_WINDOW_MS,
+        max: ADMIN_AUTH_RATE_LIMIT,
+        standardHeaders: true,
+        legacyHeaders: false,
+    });
+    const statusLimiter = rateLimit({
+        windowMs: ADMIN_STATUS_RATE_LIMIT_WINDOW_MS,
+        max: ADMIN_STATUS_RATE_LIMIT,
+        standardHeaders: true,
+        legacyHeaders: false,
+    });
     const adminConsoleAssets = resolveAdminConsoleAssets(options.adminConsoleAssetsDir);
     options.adminService.bootstrapFirstAdminFromEnvironment();
     router.get('/cli/v1/capabilities', (req, res) => {
@@ -43,9 +79,18 @@ export function createAdminRoutes(options) {
         const setupRequired = !options.adminService.hasAdminAccount();
         const mutationAvailability = cliMutationAvailability(options, setupRequired);
         const configuredServerOperationsSupported = Boolean(options.configuredServerService);
-        const mcpMutationsReady = configuredServerOperationsSupported && mutationAvailability.available;
-        const mcpOperations = configuredServerOperationsSupported ? [...CLI_MCP_OPERATIONS] : [];
-        const mcpMutationOperations = mcpMutationsReady ? ['enable', 'disable'] : [];
+        const backendRestartSupported = Boolean(options.backendRestartService);
+        const mcpMutationsReady = (configuredServerOperationsSupported || backendRestartSupported) && mutationAvailability.available;
+        const mcpOperations = [
+            ...(configuredServerOperationsSupported ? [...CLI_CONFIGURED_SERVER_OPERATIONS] : []),
+            ...(backendRestartSupported ? [CLI_BACKEND_RESTART_OPERATION] : []),
+        ];
+        const mcpMutationOperations = mutationAvailability.available
+            ? [
+                ...(configuredServerOperationsSupported ? ['enable', 'disable'] : []),
+                ...(backendRestartSupported ? ['restart'] : []),
+            ]
+            : [];
         const mcpReadinessStatus = cliMcpReadinessStatus(mutationAvailability);
         sendCliSuccess(req, res, {
             runtime: toCliRuntimeIdentity(identity),
@@ -67,11 +112,12 @@ export function createAdminRoutes(options) {
                 adminSessions: true,
                 bearerSessionAuth: true,
                 csrfTokens: true,
-                mcpEnableDisable: mcpMutationsReady,
+                mcpEnableDisable: configuredServerOperationsSupported && mutationAvailability.available,
+                mcpRestart: backendRestartSupported && mutationAvailability.available,
             },
         });
     });
-    router.post('/cli/v1/session/login', async (req, res) => {
+    router.post('/cli/v1/session/login', authenticationLimiter, async (req, res) => {
         const parsedBody = adminLoginBodySchema.safeParse(req.body);
         if (!parsedBody.success) {
             sendCliError(req, res, {
@@ -143,7 +189,10 @@ export function createAdminRoutes(options) {
     router.post('/cli/v1/operations/disable-server', async (req, res) => {
         await handleCliConfiguredServerMutation(req, res, options, 'disableConfiguredServer');
     });
-    router.post('/api/session/login', async (req, res) => {
+    router.post('/cli/v1/operations/restart-server', async (req, res) => {
+        await handleCliBackendRestart(req, res, options);
+    });
+    router.post('/api/session/login', authenticationLimiter, async (req, res) => {
         const parsedBody = adminLoginBodySchema.safeParse(req.body);
         if (!parsedBody.success) {
             res.status(400).json({ error: 'admin_login_request_invalid' });
@@ -205,7 +254,7 @@ export function createAdminRoutes(options) {
         clearAdminSessionCookie(res, options.getRuntimeIdentity().externalUrl);
         res.status(200).json({ ok: true });
     });
-    router.get('/api/status', (req, res) => {
+    router.get('/api/status', statusLimiter, (req, res) => {
         const session = options.adminService.validateSession(getAdminSessionCookie(req));
         if (!session) {
             res.status(401).json({ authenticated: false });
@@ -231,6 +280,55 @@ export function createAdminRoutes(options) {
             }),
         });
     });
+    router.get('/api/logs/snapshot', statusLimiter, (req, res) => {
+        const broker = options.getBackendLogBroker?.();
+        if (!broker) {
+            res.status(404).json({ error: 'admin_backend_logs_unavailable' });
+            return;
+        }
+        const parsedQuery = backendLogSnapshotQuerySchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            res.status(400).json({ error: 'admin_backend_logs_query_invalid' });
+            return;
+        }
+        res.status(200).json(broker.snapshot(parsedQuery.data.sourceId));
+    });
+    router.get('/api/logs/stream', (req, res) => {
+        const broker = options.getBackendLogBroker?.();
+        if (!broker) {
+            res.status(404).json({ error: 'admin_backend_logs_unavailable' });
+            return;
+        }
+        streamBackendLogs(req, res, broker, options.adminService);
+    });
+    router.post('/api/oauth/:serviceId/authorize', sensitiveOperationLimiter, async (req, res) => {
+        if (!options.oauthService) {
+            res.status(503).json({ error: 'backend_oauth_runtime_unavailable' });
+            return;
+        }
+        const serviceId = parseAdminOAuthServiceId(req, res);
+        if (!serviceId)
+            return;
+        const result = await options.oauthService.authorizeService({
+            context: buildAdminOperationContext(req, options, { type: 'backend_oauth_service', id: serviceId }),
+            serviceId,
+        });
+        sendAdminOAuthOperationResult(res, result);
+    });
+    router.post('/api/oauth/:serviceId/restart', sensitiveOperationLimiter, async (req, res) => {
+        if (!options.oauthService) {
+            res.status(503).json({ error: 'backend_oauth_runtime_unavailable' });
+            return;
+        }
+        const serviceId = parseAdminOAuthServiceId(req, res);
+        if (!serviceId)
+            return;
+        const result = await options.oauthService.restartService({
+            context: buildAdminOperationContext(req, options, { type: 'backend_oauth_service', id: serviceId }),
+            serviceId,
+        });
+        sendAdminOAuthOperationResult(res, result);
+    });
     router.get('/api/presets', async (req, res) => {
         if (!options.presetService)
             return void res.status(404).json({ error: 'admin_presets_unavailable' });
@@ -340,10 +438,27 @@ export function createAdminRoutes(options) {
     router.post('/api/configured-servers/:name/disable', async (req, res) => {
         await handleConfiguredServerMutation(req, res, options, 'disableConfiguredServer');
     });
-    router.use('/assets', express.static(path.join(adminConsoleAssets.rootDir, 'assets'), {
-        immutable: true,
-        maxAge: '1y',
-    }));
+    if (adminConsoleAssets.kind === 'filesystem') {
+        router.use('/assets', express.static(path.join(adminConsoleAssets.rootDir, 'assets'), {
+            immutable: true,
+            maxAge: '1y',
+        }));
+    }
+    else {
+        router.use('/assets', (req, res, next) => {
+            if (req.method !== 'GET' && req.method !== 'HEAD') {
+                next();
+                return;
+            }
+            const asset = adminConsoleAssets.assets.get(`assets/${req.path.replace(/^\//u, '')}`);
+            if (!asset) {
+                next();
+                return;
+            }
+            res.set('Cache-Control', 'public, max-age=31536000, immutable');
+            res.status(200).type(path.extname(req.path)).send(asset);
+        });
+    }
     router.use('/assets', (_req, res) => {
         res.status(404).type('text/plain').send('Admin Console asset not found');
     });
@@ -352,29 +467,136 @@ export function createAdminRoutes(options) {
             next();
             return;
         }
-        sendAdminConsoleIndex(res, adminConsoleAssets.indexPath);
+        sendAdminConsoleIndex(res, adminConsoleAssets);
     });
     return router;
 }
+function streamBackendLogs(req, res, broker, adminService) {
+    const sessionToken = getAdminSessionCookie(req);
+    let closed = false;
+    let unsubscribe = () => undefined;
+    let sessionTimer = null;
+    const close = () => {
+        if (closed)
+            return;
+        closed = true;
+        if (sessionTimer)
+            clearInterval(sessionTimer);
+        unsubscribe();
+        if (!res.writableEnded)
+            res.end();
+    };
+    const writeFrame = (frame) => {
+        if (closed || res.writableEnded)
+            return false;
+        try {
+            res.write(frame);
+            return true;
+        }
+        catch {
+            close();
+            return false;
+        }
+    };
+    const write = (event, data, id) => {
+        const frame = `${id === undefined ? '' : `id: ${id}\n`}event: ${event}\ndata: ${JSON.stringify(data)}\n\n`;
+        return writeFrame(frame);
+    };
+    res.status(200);
+    res.set({
+        'Content-Type': 'text/event-stream; charset=utf-8',
+        'Cache-Control': 'no-cache, no-transform',
+        Connection: 'keep-alive',
+        'X-Accel-Buffering': 'no',
+    });
+    res.flushHeaders?.();
+    const requestedSequence = parseBackendLogSequence(req.header('Last-Event-ID'));
+    if (requestedSequence === undefined) {
+        const snapshot = broker.snapshot();
+        if (!write('snapshot', snapshot, snapshot.sequence))
+            return;
+    }
+    else {
+        const snapshot = broker.snapshot();
+        if (!write('sources', snapshot.sources))
+            return;
+        const replay = broker.replayAfter(requestedSequence);
+        if (replay.kind === 'gap') {
+            if (!write('gap', replay.snapshot, replay.snapshot.sequence))
+                return;
+        }
+        else {
+            for (const entry of replay.entries) {
+                if (!write('entry', entry, entry.sequence))
+                    return;
+            }
+        }
+    }
+    unsubscribe = broker.subscribe({
+        onEvent: (entry) => void write('entry', entry, entry.sequence),
+        onSourceUpdate: (update) => void write('source', update),
+        onDisconnect: close,
+    });
+    sessionTimer = setInterval(() => {
+        if (!adminService.validateSession(sessionToken)) {
+            close();
+            return;
+        }
+        void writeFrame(': keep-alive\n\n');
+    }, 10_000);
+    sessionTimer.unref?.();
+    req.on('close', close);
+    res.on('close', close);
+}
+function parseBackendLogSequence(value) {
+    if (!value || !/^\d+$/.test(value))
+        return undefined;
+    const sequence = Number(value);
+    return Number.isSafeInteger(sequence) ? sequence : undefined;
+}
 function resolveAdminConsoleAssets(configuredDir) {
+    if (!configuredDir) {
+        const embeddedAssets = readEmbeddedAdminConsoleAssets();
+        if (embeddedAssets) {
+            return { kind: 'embedded', assets: embeddedAssets };
+        }
+    }
     const rootDir = configuredDir ?? resolveDefaultAdminConsoleAssetsDir();
     return {
+        kind: 'filesystem',
         rootDir,
         indexPath: path.join(rootDir, 'index.html'),
     };
 }
+function readEmbeddedAdminConsoleAssets() {
+    const rawAssets = globalThis[SEA_ADMIN_CONSOLE_ASSETS_KEY];
+    if (!rawAssets || typeof rawAssets !== 'object' || Array.isArray(rawAssets)) {
+        return undefined;
+    }
+    const assets = new Map();
+    for (const [assetPath, encodedAsset] of Object.entries(rawAssets)) {
+        if (typeof encodedAsset === 'string') {
+            assets.set(assetPath, Buffer.from(encodedAsset, 'base64'));
+        }
+    }
+    return assets.has('index.html') ? assets : undefined;
+}
 export function resolveDefaultAdminConsoleAssetsDir() {
     return fileURLToPath(new URL('../../../admin', import.meta.url));
 }
 function isAdminApiPath(pathname) {
     return (pathname === '/api' || pathname.startsWith('/api/') || pathname === '/cli/v1' || pathname.startsWith('/cli/v1/'));
 }
-function sendAdminConsoleIndex(res, indexPath) {
-    if (!fs.existsSync(indexPath)) {
+function sendAdminConsoleIndex(res, adminConsoleAssets) {
+    if (adminConsoleAssets.kind === 'embedded') {
+        res.status(200).type('html').send(adminConsoleAssets.assets.get('index.html'));
+        return;
+    }
+    if (!fs.existsSync(adminConsoleAssets.indexPath)) {
         res.status(503).type('text/plain').send('Admin Console assets are not available. Run the package build first.');
         return;
     }
-    res.status(200).sendFile(indexPath);
+    res.status(200).sendFile(adminConsoleAssets.indexPath, { dotfiles: 'allow' });
 }
 function unauthenticatedAdminApiResponse(options) {
     return options.adminService.hasAdminAccount()
@@ -452,6 +674,109 @@ async function handleCliConfiguredServerMutation(req, res, options, operationNam
         : await options.configuredServerService.disableConfiguredServer(input);
     sendCliAdminOperationResult(req, res, result);
 }
+async function handleCliBackendRestart(req, res, options) {
+    if (!options.backendRestartService) {
+        sendCliError(req, res, {
+            status: 404,
+            code: 'backend_restart_unavailable',
+            message: 'Backend restart administration is unavailable',
+            retryable: false,
+        });
+        return;
+    }
+    if (isMutationLocked(options)) {
+        sendCliError(req, res, {
+            status: 409,
+            code: 'runtime_scope_locked',
+            message: 'Runtime scope admin mutations are locked by another writer',
+            retryable: true,
+            details: { operationName: 'restartBackend', reason: 'writer_lock_unavailable' },
+        });
+        return;
+    }
+    const sessionToken = getBearerSessionToken(req);
+    const session = sessionToken ? options.adminService.validateSession(sessionToken) : null;
+    if (!sessionToken || !session) {
+        sendCliError(req, res, {
+            status: 401,
+            code: 'admin_session_required',
+            message: 'A valid admin session bearer token is required',
+            retryable: false,
+        });
+        return;
+    }
+    const parsedBody = cliBackendRestartBodySchema.safeParse(req.body);
+    if (!parsedBody.success) {
+        sendCliError(req, res, {
+            status: 400,
+            code: 'validation_request_invalid',
+            message: 'Backend targetName and restart selectors must have valid, mutually exclusive values',
+            retryable: false,
+        });
+        return;
+    }
+    const { targetName, instance, allInstances = false } = parsedBody.data;
+    const selection = instance
+        ? { mode: 'instance', instanceIdOrPrefix: instance }
+        : allInstances
+            ? { mode: 'all_instances' }
+            : { mode: 'target_default' };
+    const context = buildCliAdminOperationContext(req, options, session.account, sessionToken, {
+        type: 'backend',
+        id: targetName,
+    });
+    const result = await options.backendRestartService.restartBackend({
+        context,
+        targetName,
+        selection,
+        confirmationRequirements: cliBackendRestartConfirmationRequirements(options, targetName),
+    });
+    if (result.ok && isBackendRestartFailureResult(result.result)) {
+        sendCliBackendRestartOutcome(req, res, result.result);
+        return;
+    }
+    sendCliAdminOperationResult(req, res, result);
+}
+function sendCliBackendRestartOutcome(req, res, result) {
+    const response = backendRestartFailure(result.outcome);
+    sendCliError(req, res, {
+        status: response.status,
+        code: response.code,
+        message: response.message,
+        retryable: false,
+        details: {
+            targetName: result.targetName,
+            ...(result.candidateInstanceIds ? { candidateInstanceIds: result.candidateInstanceIds } : {}),
+        },
+    });
+}
+function isBackendRestartFailureResult(result) {
+    return result.outcome !== 'restarted';
+}
+function backendRestartFailure(outcome) {
+    switch (outcome) {
+        case 'target_not_found':
+            return { status: 404, code: 'backend_not_found', message: 'Backend target was not found' };
+        case 'target_disabled':
+            return { status: 409, code: 'backend_disabled', message: 'Backend target is disabled' };
+        case 'instance_not_found':
+            return { status: 404, code: 'backend_instance_not_found', message: 'Backend instance was not found' };
+        case 'instance_ambiguous':
+            return { status: 409, code: 'backend_instance_ambiguous', message: 'Backend instance prefix is ambiguous' };
+        case 'no_active_instances':
+            return {
+                status: 409,
+                code: 'backend_no_active_instances',
+                message: 'Backend has no active instances to restart',
+            };
+        case 'no_unhealthy_instances':
+            return {
+                status: 409,
+                code: 'backend_no_unhealthy_instances',
+                message: 'Backend has no unhealthy active instances to restart by default',
+            };
+    }
+}
 async function handleConfiguredServerDetail(req, res, options) {
     if (!options.configuredServerService) {
         res.status(404).json({ error: 'admin_configured_servers_unavailable' });
@@ -623,7 +948,7 @@ async function handleConfiguredServerMutation(req, res, options, operationName)
     sendAdminOperationResult(res, result);
 }
 function cliMutationAvailability(options, setupRequired) {
-    if (!options.configuredServerService) {
+    if (!options.configuredServerService && !options.backendRestartService) {
         return {
             available: false,
             reason: 'mutation_service_unavailable',
@@ -745,9 +1070,20 @@ function getBearerSessionToken(req) {
     if (!authorization) {
         return undefined;
     }
-    const match = authorization.match(/^Bearer\s+(.+)$/i);
-    const token = match?.[1]?.trim();
-    return token || undefined;
+    const bearerScheme = 'Bearer';
+    if (authorization.length <= bearerScheme.length ||
+        authorization.slice(0, bearerScheme.length).toLowerCase() !== bearerScheme.toLowerCase()) {
+        return undefined;
+    }
+    let tokenStart = bearerScheme.length;
+    if (authorization.charCodeAt(tokenStart) !== 0x20) {
+        return undefined;
+    }
+    while (authorization.charCodeAt(tokenStart) === 0x20) {
+        tokenStart += 1;
+    }
+    const token = authorization.slice(tokenStart);
+    return token && !/\s/u.test(token) ? token : undefined;
 }
 function isHttpsRuntime(externalUrl) {
     try {
@@ -864,6 +1200,26 @@ function sendAdminOperationResult(res, result) {
     const status = result.status === 'idempotency_key_required' ? 400 : result.status === 'mutation_failed' ? 409 : 409;
     res.status(status).json(result);
 }
+function sendAdminOAuthOperationResult(res, result) {
+    if (!result.ok && result.status === 'mutation_failed') {
+        const status = result.error === 'backend_oauth_service_not_found'
+            ? 404
+            : result.error === 'backend_oauth_runtime_unavailable'
+                ? 503
+                : 502;
+        res.status(status).json({ ok: false, error: result.error });
+        return;
+    }
+    sendAdminOperationResult(res, result);
+}
+function parseAdminOAuthServiceId(req, res) {
+    const parsed = adminOAuthServiceParamsSchema.safeParse(req.params);
+    if (!parsed.success) {
+        res.status(400).json({ error: 'backend_oauth_service_id_invalid' });
+        return null;
+    }
+    return parsed.data.serviceId;
+}
 async function handlePresetMutation(req, res, options, action) {
     if (!options.presetService) {
         res.status(404).json({ error: 'admin_presets_unavailable' });
@@ -937,16 +1293,10 @@ function buildAboutMetadata(runtime, ui) {
             timestamp: process.env.ADMIN_UI_BUILD_TIMESTAMP || undefined,
         },
         project: {
-            repository: normalizeRepositoryUrl(packageMetadata.repository?.url) ?? packageMetadata.homepage,
-            documentation: packageMetadata.documentation,
-            issues: packageMetadata.bugs?.url,
-            license: packageMetadata.license,
+            ...MCP_PROJECT_METADATA,
         },
     };
 }
-function normalizeRepositoryUrl(value) {
-    return value?.replace(/^git\+/u, '').replace(/\.git$/u, '');
-}
 function buildAdminOperationContext(req, options, target) {
     const sessionToken = getAdminSessionCookie(req);
     const session = options.adminService.validateSession(sessionToken);
@@ -972,7 +1322,9 @@ function buildAdminOperationContext(req, options, target) {
             jsonMode: true,
         },
         idempotencyKey: req.header('Idempotency-Key'),
-        requestFingerprint: configuredServerRequestFingerprint(operationName, target.id, req.body),
+        requestFingerprint: target.type === 'backend_oauth_service'
+            ? backendOAuthRequestFingerprint(operationName, target.id)
+            : configuredServerRequestFingerprint(operationName, target.id, req.body),
         confirmationFacts: getBodyRecord(req.body, 'confirmationFacts'),
     };
 }
@@ -1016,6 +1368,19 @@ function cliConfiguredServerConfirmationRequirements(options, targetName, operat
         },
     ];
 }
+function cliBackendRestartConfirmationRequirements(options, targetName) {
+    const identity = options.getRuntimeIdentity();
+    if (isLoopbackRuntimeUrl(identity.externalUrl)) {
+        return [];
+    }
+    const target = { type: 'backend', id: targetName };
+    return [
+        { code: 'confirm_non_loopback_runtime', expected: true, target },
+        { code: 'confirmedOperation', expected: 'mcp.restart', target },
+        { code: 'confirmedRuntimeScopeId', expected: identity.runtimeScopeId, target },
+        { code: 'confirmationSource', expected: 'cli_flag', target },
+    ];
+}
 function buildCliAdminOperationContext(req, options, account, sessionToken, target) {
     const runtimeIdentity = options.getRuntimeIdentity();
     const operationName = operationNameForRequest(req);
@@ -1036,31 +1401,51 @@ function buildCliAdminOperationContext(req, options, account, sessionToken, targ
             jsonMode: true,
         },
         idempotencyKey: req.header('Idempotency-Key'),
-        requestFingerprint: configuredServerRequestFingerprint(operationName, target.id),
+        requestFingerprint: configuredServerRequestFingerprint(operationName, target.id, req.body),
         confirmationFacts: getBodyRecord(req.body, 'confirmationFacts'),
     };
 }
 function configuredServerRequestFingerprint(operationName, targetName, body) {
+    const previewFingerprint = getBodyString(body, 'previewFingerprint');
     const normalized = stableJsonStringify({
         schemaVersion: 1,
         operationName,
         target: {
-            type: 'configured_server',
+            type: operationName === 'restartBackend' ? 'backend' : 'configured_server',
             id: targetName ?? '',
         },
         ...(operationName === 'applyConfiguredServerEdit'
             ? {
-                previewFingerprint: getBodyString(body, 'previewFingerprint'),
-                editDigest: createHash('sha256')
-                    .update(stableJsonStringify(getBodyValue(body, 'edit') ?? {}))
-                    .digest('hex'),
+                previewFingerprint,
+                editDigest: keyedRequestFingerprint(previewFingerprint, 'configured-server-edit', stableJsonStringify(getBodyValue(body, 'edit') ?? {})),
+            }
+            : {}),
+        ...(operationName === 'restartBackend'
+            ? {
+                restartSelection: {
+                    instance: getBodyString(body, 'instance'),
+                    allInstances: getBodyValue(body, 'allInstances') === true,
+                },
             }
             : {}),
     });
     return operationName === 'applyConfiguredServerEdit'
-        ? `configured_server_apply_${createHash('sha256').update(normalized).digest('hex')}`
+        ? `configured_server_apply_${keyedRequestFingerprint(previewFingerprint, 'configured-server-apply', normalized)}`
         : normalized;
 }
+function keyedRequestFingerprint(key, domain, value) {
+    return createHmac('sha256', key).update(domain).update('\0').update(value).digest('hex');
+}
+function backendOAuthRequestFingerprint(operationName, serviceId) {
+    return stableJsonStringify({
+        schemaVersion: 1,
+        operationName,
+        target: {
+            type: 'backend_oauth_service',
+            id: serviceId ?? '',
+        },
+    });
+}
 function stableJsonStringify(value) {
     if (Array.isArray(value)) {
         return `[${value.map((item) => stableJsonStringify(item)).join(',')}]`;
@@ -1130,6 +1515,12 @@ function cliOperationErrorDetails(result) {
     return details;
 }
 function operationNameForRequest(req) {
+    if (req.path.startsWith('/api/oauth/')) {
+        return req.path.endsWith('/restart') ? 'restartBackendOAuth' : 'authorizeBackendOAuth';
+    }
+    if (req.path.endsWith('/restart-server')) {
+        return 'restartBackend';
+    }
     if (req.path.endsWith('/enable') || req.path.endsWith('/enable-server')) {
         return 'enableConfiguredServer';
     }
@@ -1179,10 +1570,19 @@ function sanitizeOAuthDashboard(dashboard) {
         ...dashboard,
         services: dashboard.services.map((service) => ({
             ...service,
+            id: service.name,
+            displayName: backendOAuthServiceDisplayName(service.name),
             lastError: service.lastError ? sanitizeErrorMessage(service.lastError) : undefined,
         })),
     };
 }
+function backendOAuthServiceDisplayName(serviceId) {
+    const identity = parseTemplateConnectionKey(serviceId);
+    if (identity.kind !== 'rendered' || identity.renderedHash.length <= TEMPLATE_INSTANCE_ID_DISPLAY_LENGTH) {
+        return serviceId;
+    }
+    return `${identity.templateName}:${identity.renderedHash.slice(0, TEMPLATE_INSTANCE_ID_DISPLAY_LENGTH)}`;
+}
 function getBodyValue(body, key) {
     if (!body || typeof body !== 'object') {
         return undefined;