@aexol/spectral 0.9.254 → 0.9.255

package/dist/mcp/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/mcp/commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,YAAY,CAAC;AASzD,wBAAsB,UAAU,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsC/F;AAED,wBAAsB,SAAS,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB9F;AAED,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,gBAAgB,EACrB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAiDf;AAED,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,IAAI,CAAC,CA6Cf;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBpJ"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/mcp/commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,YAAY,CAAC;AASzD,wBAAsB,UAAU,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsC/F;AAED,wBAAsB,SAAS,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB9F;AAED,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,gBAAgB,EACrB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAiDf;AAED,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,IAAI,CAAC,CAkDf;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBpJ"}

package/dist/mcp/commands.js

@@ -122,6 +122,9 @@ export async function authenticateServer(serverName, config, ctx) {
             ctx.ui.notify(`OAuth authentication successful for "${serverName}"!\n` +
                 `Run /mcp reconnect ${serverName} to connect with the new token.`, "info");
         }
+        else if (status === "in_progress") {
+            ctx.ui.notify(`OAuth authentication for "${serverName}" is already in progress — deferring to the in-flight flow.`, "info");
+        }
         else {
             ctx.ui.notify(`OAuth authentication failed for "${serverName}".`, "error");
         }

package/dist/mcp/direct-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"direct-tools.d.ts","sourceRoot":"","sources":["../../src/mcp/direct-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAc,MAAM,YAAY,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAwEzD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,aAAa,GAAG,IAAI,EAC3B,MAAM,EAAE,QAAQ,GAAG,MAAM,GAAG,OAAO,EACnC,WAAW,CAAC,EAAE,MAAM,EAAE,GACrB,cAAc,EAAE,CAoGlB;AAED,wBAAgB,qCAAqC,CACnD,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,aAAa,GAAG,IAAI,GAC1B,MAAM,EAAE,CAkBV;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,aAAa,GAAG,IAAI,EAC3B,WAAW,EAAE,cAAc,EAAE,GAC5B,MAAM,CAoDR;AAED,KAAK,iBAAiB,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;AAEnD,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,iBAAiB,GAAG,IAAI,EACxC,cAAc,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,EACvD,IAAI,EAAE,cAAc,GACnB,iBAAiB,CAwJnB"}
+{"version":3,"file":"direct-tools.d.ts","sourceRoot":"","sources":["../../src/mcp/direct-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAc,MAAM,YAAY,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAwEzD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,aAAa,GAAG,IAAI,EAC3B,MAAM,EAAE,QAAQ,GAAG,MAAM,GAAG,OAAO,EACnC,WAAW,CAAC,EAAE,MAAM,EAAE,GACrB,cAAc,EAAE,CAoGlB;AAED,wBAAgB,qCAAqC,CACnD,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,aAAa,GAAG,IAAI,GAC1B,MAAM,EAAE,CAkBV;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,aAAa,GAAG,IAAI,EAC3B,WAAW,EAAE,cAAc,EAAE,GAC5B,MAAM,CAqDR;AAED,KAAK,iBAAiB,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;AAEnD,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,iBAAiB,GAAG,IAAI,EACxC,cAAc,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,EACvD,IAAI,EAAE,cAAc,GACnB,iBAAiB,CAwJnB"}

package/dist/mcp/direct-tools.js

@@ -8,7 +8,7 @@ import { resourceNameToToolName } from "./resource-tools.js";
 import { authenticate, supportsOAuth } from "./mcp-auth-flow.js";
 import { formatAuthRequiredMessage } from "./utils.js";
 const BUILTIN_NAMES = new Set(["read", "bash", "edit", "write", "grep", "ls", "mcp"]);
-function getDirectAuthRequiredMessage(state, serverName, defaultMessage = `MCP server "${serverName}" requires OAuth authentication. Run /mcp-auth ${serverName} first.`) {
+function getDirectAuthRequiredMessage(state, serverName, defaultMessage = `MCP server "${serverName}" requires OAuth authentication. Run /mcp-auth ${serverName} first, or call mcp({ auth: "${serverName}" }) to start the OAuth flow (a browser opens on this machine).`) {
     return formatAuthRequiredMessage(state.config, serverName, defaultMessage);
 }
 function getDirectAuthFailedMessage(state, serverName, message) {
@@ -16,7 +16,7 @@ function getDirectAuthFailedMessage(state, serverName, message) {
     if (customGuidance) {
         return `OAuth authentication failed for "${serverName}": ${message}. ${getDirectAuthRequiredMessage(state, serverName)}`;
     }
-    return `OAuth authentication failed for "${serverName}": ${message}. Run /mcp-auth ${serverName} first.`;
+    return `OAuth authentication failed for "${serverName}": ${message}. Run /mcp-auth ${serverName} first, or call mcp({ auth: "${serverName}" }) to start the OAuth flow.`;
 }
 async function attemptDirectAutoAuth(state, serverName) {
     if (state.config.settings?.autoAuth !== true) {
@@ -31,7 +31,7 @@ async function attemptDirectAutoAuth(state, serverName) {
     if (!state.ui && grantType !== "client_credentials") {
         return {
             status: "failed",
-            message: getDirectAuthRequiredMessage(state, serverName, `MCP server "${serverName}" requires OAuth authentication. Run /mcp-auth ${serverName} in an interactive session.`),
+            message: getDirectAuthRequiredMessage(state, serverName, `MCP server "${serverName}" requires OAuth authentication. Call mcp({ auth: "${serverName}" }) to start the OAuth flow (a browser opens on this machine), or run /mcp-auth ${serverName} in an interactive session.`),
         };
     }
     try {
@@ -206,6 +206,7 @@ export function buildProxyDescription(config, cache, directSpecs) {
     desc += `  mcp({ search: "query" })              → Search MCP tools by name/description\n`;
     desc += `  mcp({ describe: "tool_name" })        → Show tool details and parameters\n`;
     desc += `  mcp({ connect: "server-name" })       → Connect to a server and refresh metadata\n`;
+    desc += `  mcp({ auth: "server-name" })          → Start OAuth for a server (non-blocking; opens a browser on this machine)\n`;
     desc += `  mcp({ tool: "name", args: '{"key": "value"}' })    → Call a tool (args is JSON string)\n`;
     desc += `  mcp({ action: "ui-messages" })        → Retrieve accumulated messages from completed UI sessions\n`;
     desc += `\nMode: tool (call) > connect > describe > search > server (list) > action > nothing (status)`;

package/dist/mcp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAY,MAAM,8BAA8B,CAAC;AAa3E,MAAM,CAAC,OAAO,UAAU,UAAU,CAAC,GAAG,EAAE,YAAY,QAqSnD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAY,MAAM,8BAA8B,CAAC;AAa3E,MAAM,CAAC,OAAO,UAAU,UAAU,CAAC,GAAG,EAAE,YAAY,QA0SnD"}

package/dist/mcp/index.js

@@ -5,7 +5,7 @@ import { loadMcpConfig } from "./config.js";
 import { buildProxyDescription, createDirectToolExecutor, getMissingConfiguredDirectToolServers, resolveDirectTools } from "./direct-tools.js";
 import { flushMetadataCache, initializeMcp, updateStatusBar } from "./init.js";
 import { loadMetadataCache } from "./metadata-cache.js";
-import { executeCall, executeConnect, executeDescribe, executeSearch, executeStatus, executeUiMessages } from "./proxy-modes.js";
+import { executeAuth, executeCall, executeConnect, executeDescribe, executeSearch, executeStatus, executeUiMessages } from "./proxy-modes.js";
 import { getConfigPathFromArgv, truncateAtWord } from "./utils.js";
 import { initializeOAuth, shutdownOAuth } from "./mcp-auth-flow.js";
 export default function mcpAdapter(ext) {
@@ -98,6 +98,7 @@ export default function mcpAdapter(ext) {
                     parameters: Type.Object({
                         tool: Type.Optional(Type.String({ description: "Tool name to call (e.g., 'xcodebuild_list_sims')" })),
                         args: Type.Optional(Type.String({ description: "Arguments as JSON string (e.g., '{\"key\": \"value\"}')" })),
+                        auth: Type.Optional(Type.String({ description: "Server name to authenticate via OAuth. Starts a non-blocking OAuth flow and opens a browser on this machine. Use when a server reports needs-auth." })),
                         connect: Type.Optional(Type.String({ description: "Server name to connect (closes any stale connection first, forces fresh reconnect)" })),
                         describe: Type.Optional(Type.String({ description: "Tool name to describe (shows parameters)" })),
                         search: Type.Optional(Type.String({ description: "Search tools by name/description" })),
@@ -142,6 +143,9 @@ export default function mcpAdapter(ext) {
                                 details: { error: "not_initialized" },
                             };
                         }
+                        if (params.auth) {
+                            return executeAuth(state, params.auth);
+                        }
                         if (params.action === "ui-messages") {
                             return executeUiMessages(state);
                         }

package/dist/mcp/mcp-auth-flow.d.ts

@@ -6,7 +6,7 @@
 import { type StoredTokens } from "./mcp-auth.js";
 import type { ServerEntry } from "./types.js";
 /** Auth status for a server */
-export type AuthStatus = "authenticated" | "expired" | "not_authenticated";
+export type AuthStatus = "authenticated" | "expired" | "not_authenticated" | "in_progress";
 /**
  * Start OAuth authentication flow for a server.
  * Returns the authorization URL when browser authorization is required.

package/dist/mcp/mcp-auth-flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-auth-flow.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp-auth-flow.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,OAAO,EAQL,KAAK,YAAY,EAClB,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,+BAA+B;AAC/B,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,SAAS,GAAG,mBAAmB,CAAA;AAkD1E;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,WAAW,GACvB,OAAO,CAAC;IAAE,gBAAgB,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAyD5D;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,UAAU,CAAC,CAcrB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,WAAW,GACvB,OAAO,CAAC,UAAU,CAAC,CAuErB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA2C9B;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAM3E;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAalE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,WAAW,GAAG,OAAO,CAU9D;AAED;;;GAGG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAErD;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAEnD"}
+{"version":3,"file":"mcp-auth-flow.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp-auth-flow.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,OAAO,EAQL,KAAK,YAAY,EAClB,MAAM,eAAe,CAAA;AAEtB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,+BAA+B;AAC/B,MAAM,MAAM,UAAU,GAClB,eAAe,GACf,SAAS,GACT,mBAAmB,GACnB,aAAa,CAAA;AAkDjB;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,WAAW,GACvB,OAAO,CAAC;IAAE,gBAAgB,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAyD5D;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,UAAU,CAAC,CAcrB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,WAAW,GACvB,OAAO,CAAC,UAAU,CAAC,CAqFrB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA2C9B;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAM3E;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAalE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,WAAW,GAAG,OAAO,CAU9D;AAED;;;GAGG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAErD;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAEnD"}

package/dist/mcp/mcp-auth-flow.js

@@ -9,6 +9,7 @@ import open from "open";
 import { McpOAuthProvider, setOAuthCallbackPort } from "./mcp-oauth-provider.js";
 import { ensureCallbackServer, waitForCallback, cancelPendingCallback, stopCallbackServer, } from "./mcp-callback-server.js";
 import { getAuthForUrl, isTokenExpired, hasStoredTokens, clearAllCredentials, updateOAuthState, getOAuthState, clearOAuthState, } from "./mcp-auth.js";
+import { inFlightMcpAuths } from "./mcp-auth-start.js";
 // Track pending transports for auth completion
 const pendingTransports = new Map();
 // Deduplicate concurrent authenticate() calls per server.
@@ -138,10 +139,21 @@ export async function completeAuth(serverName, authorizationCode) {
  * @returns The final auth status
  */
 export async function authenticate(serverName, serverUrl, definition) {
+    // Canonical cross-entry-point in-flight guard: a non-blocking flow
+    // (startMcpAuthFlow) may already be in flight for this server. Starting
+    // startAuth again would overwrite the persisted OAuth state and the
+    // pending transport the in-flight browser callback completes against,
+    // breaking the first flow. Defer to it instead.
+    if (inFlightMcpAuths.has(serverName)) {
+        return "in_progress";
+    }
     const inFlight = pendingAuthentications.get(serverName);
     if (inFlight) {
         return inFlight;
     }
+    // Track this blocking flow in the same canonical guard so a concurrent
+    // non-blocking start (relay / agent tool) defers to us as well.
+    inFlightMcpAuths.add(serverName);
     const operation = (async () => {
         // Start auth flow
         const { authorizationUrl, oauthState } = await startAuth(serverName, serverUrl, definition);
@@ -197,6 +209,7 @@ export async function authenticate(serverName, serverUrl, definition) {
         if (pendingAuthentications.get(serverName) === operation) {
             pendingAuthentications.delete(serverName);
         }
+        inFlightMcpAuths.delete(serverName);
     }
 }
 /**

package/dist/mcp/mcp-auth-start.d.ts

@@ -0,0 +1,64 @@
+/**
+ * MCP Auth Start — shared, non-blocking OAuth flow starter.
+ *
+ * Single code path used by:
+ *   - the relay handler (`POST /api/mcp-auth`)
+ *   - the agent-facing `mcp` tool (`auth` action) and `connect` auto-trigger
+ *
+ * The flow is non-blocking: `startAuth` captures the authorization URL, and
+ * the local callback server completes the exchange in the background
+ * (waitForCallback → completeAuth → reloadMcpConfig).
+ */
+import type { McpExtensionState } from "./state.js";
+/**
+ * Validation/in-flight errors thrown by `startMcpAuthFlow`. The relay handler
+ * maps these to `BadRequestError` (HTTP 400); the agent tool surfaces the
+ * message as tool output.
+ */
+export declare class McpAuthStartError extends Error {
+    constructor(message: string);
+}
+export interface StartMcpAuthFlowOptions {
+    /** Best-effort: open the authorization URL in the system browser. */
+    openBrowser?: boolean;
+}
+export type StartMcpAuthFlowResult = {
+    status: "already-authenticated";
+} | {
+    status: "auth_url_ready";
+    authUrl: string;
+    openedBrowser: boolean;
+};
+/**
+ * Per-server in-flight guard. `startAuth` keys its pending transports and
+ * persisted OAuth state by server name, so two concurrent flows for the same
+ * server would clobber each other. Reject the second start until the first
+ * flow's background chain finishes.
+ */
+export declare const inFlightMcpAuths: Set<string>;
+/**
+ * An authorization URL may be opened in a real browser, so it must never be
+ * a `javascript:` / `data:` / malformed URL coming from a malicious MCP
+ * server's OAuth metadata. Defense in depth: the landing UI applies the
+ * same check before `window.open`.
+ */
+export declare function assertSafeAuthorizationUrl(authUrl: string): void;
+/**
+ * Start a non-blocking OAuth flow for a configured MCP server.
+ *
+ * - Looks up the server definition (throws `McpAuthStartError` when missing,
+ *   not OAuth-capable, or url-less).
+ * - Enforces the per-server in-flight guard.
+ * - Calls `startAuth`: an empty `authorizationUrl` means the server is
+ *   already authenticated (or was via client_credentials).
+ * - Optionally opens the authorization URL in the system browser
+ *   (best-effort — a failed `open` never fails the call).
+ * - Kicks off the background completion chain
+ *   (waitForCallback → completeAuth → reloadMcpConfig) fire-and-forget.
+ *
+ * @param state - The live MCP extension state (config + reload target).
+ * @param name - Configured MCP server name.
+ * @param opts - `openBrowser` to launch the system browser on the auth URL.
+ */
+export declare function startMcpAuthFlow(state: McpExtensionState, name: string, opts?: StartMcpAuthFlowOptions): Promise<StartMcpAuthFlowResult>;
+//# sourceMappingURL=mcp-auth-start.d.ts.map

package/dist/mcp/mcp-auth-start.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-auth-start.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp-auth-start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAWH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,MAAM,EAAE,uBAAuB,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAE,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,aAAoB,CAAC;AAElD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAUhE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,iBAAiB,EACxB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,uBAA4B,GACjC,OAAO,CAAC,sBAAsB,CAAC,CA+EjC"}

package/dist/mcp/mcp-auth-start.js

@@ -0,0 +1,136 @@
+/**
+ * MCP Auth Start — shared, non-blocking OAuth flow starter.
+ *
+ * Single code path used by:
+ *   - the relay handler (`POST /api/mcp-auth`)
+ *   - the agent-facing `mcp` tool (`auth` action) and `connect` auto-trigger
+ *
+ * The flow is non-blocking: `startAuth` captures the authorization URL, and
+ * the local callback server completes the exchange in the background
+ * (waitForCallback → completeAuth → reloadMcpConfig).
+ */
+import open from "open";
+import { completeAuth, startAuth, supportsOAuth, } from "./mcp-auth-flow.js";
+import { clearOAuthState } from "./mcp-auth.js";
+import { waitForCallback } from "./mcp-callback-server.js";
+import { reloadMcpConfig } from "./init.js";
+/**
+ * Validation/in-flight errors thrown by `startMcpAuthFlow`. The relay handler
+ * maps these to `BadRequestError` (HTTP 400); the agent tool surfaces the
+ * message as tool output.
+ */
+export class McpAuthStartError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "McpAuthStartError";
+    }
+}
+/**
+ * Per-server in-flight guard. `startAuth` keys its pending transports and
+ * persisted OAuth state by server name, so two concurrent flows for the same
+ * server would clobber each other. Reject the second start until the first
+ * flow's background chain finishes.
+ */
+export const inFlightMcpAuths = new Set();
+/**
+ * An authorization URL may be opened in a real browser, so it must never be
+ * a `javascript:` / `data:` / malformed URL coming from a malicious MCP
+ * server's OAuth metadata. Defense in depth: the landing UI applies the
+ * same check before `window.open`.
+ */
+export function assertSafeAuthorizationUrl(authUrl) {
+    let parsed;
+    try {
+        parsed = new URL(authUrl);
+    }
+    catch {
+        throw new McpAuthStartError("Invalid authorization URL");
+    }
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+        throw new McpAuthStartError("Invalid authorization URL");
+    }
+}
+/**
+ * Start a non-blocking OAuth flow for a configured MCP server.
+ *
+ * - Looks up the server definition (throws `McpAuthStartError` when missing,
+ *   not OAuth-capable, or url-less).
+ * - Enforces the per-server in-flight guard.
+ * - Calls `startAuth`: an empty `authorizationUrl` means the server is
+ *   already authenticated (or was via client_credentials).
+ * - Optionally opens the authorization URL in the system browser
+ *   (best-effort — a failed `open` never fails the call).
+ * - Kicks off the background completion chain
+ *   (waitForCallback → completeAuth → reloadMcpConfig) fire-and-forget.
+ *
+ * @param state - The live MCP extension state (config + reload target).
+ * @param name - Configured MCP server name.
+ * @param opts - `openBrowser` to launch the system browser on the auth URL.
+ */
+export async function startMcpAuthFlow(state, name, opts = {}) {
+    const definition = state.config.mcpServers[name];
+    if (!definition) {
+        throw new McpAuthStartError(`Unknown MCP server: ${name}`);
+    }
+    if (!definition.url || !supportsOAuth(definition)) {
+        throw new McpAuthStartError(`MCP server "${name}" does not support OAuth`);
+    }
+    if (inFlightMcpAuths.has(name)) {
+        throw new McpAuthStartError("OAuth authentication already in progress for this server");
+    }
+    inFlightMcpAuths.add(name);
+    let authorizationUrl;
+    let oauthState;
+    try {
+        ({ authorizationUrl, oauthState } = await startAuth(name, definition.url, definition));
+        if (authorizationUrl === "") {
+            inFlightMcpAuths.delete(name);
+            return { status: "already-authenticated" };
+        }
+        // Fail loudly instead of skipping background completion — a flow without
+        // its persisted state could never be completed nor cleanly aborted.
+        if (!oauthState) {
+            throw new McpAuthStartError("OAuth state missing after authorization start");
+        }
+        assertSafeAuthorizationUrl(authorizationUrl);
+    }
+    catch (error) {
+        // Release the guard so a failed start does not wedge the server.
+        inFlightMcpAuths.delete(name);
+        throw error;
+    }
+    if (opts.openBrowser) {
+        // Best-effort: a failed `open` must not fail the call — the user can
+        // always open authUrl manually.
+        open(authorizationUrl).catch((error) => {
+            console.warn(`MCP Auth: failed to open browser for ${name}`, error);
+        });
+    }
+    // Complete the flow in the background from the local callback server:
+    // waitForCallback resolves with the authorization code, completeAuth
+    // exchanges it for tokens, and the MCP config is reloaded so the server
+    // comes up authenticated. Fire-and-forget — auth progress is observable
+    // via server status, so failures are logged, not surfaced. The finally
+    // block releases the per-server in-flight guard and clears the
+    // now-stale OAuth state (idempotent) on every path.
+    waitForCallback(oauthState)
+        .then((code) => completeAuth(name, code))
+        .then(() => reloadMcpConfig(state))
+        .catch((error) => {
+        console.warn(`MCP Auth: background completion failed for ${name}`, error);
+    })
+        .finally(() => {
+        inFlightMcpAuths.delete(name);
+        try {
+            clearOAuthState(name);
+        }
+        catch {
+            // Storage errors must not surface as unhandled rejections.
+        }
+    });
+    return {
+        status: "auth_url_ready",
+        authUrl: authorizationUrl,
+        openedBrowser: !!opts.openBrowser,
+    };
+}

package/dist/mcp/proxy-modes.d.ts

@@ -1,6 +1,13 @@
 import type { AgentToolResult, ToolInfo } from "../sdk/coding-agent/index.js";
 import type { McpExtensionState } from "./state.js";
 type ProxyToolResult = AgentToolResult<Record<string, unknown>>;
+/**
+ * Start the OAuth flow for a server (the `mcp({ auth: "<name>" })` action).
+ * Non-blocking: opens the browser on this machine and returns immediately;
+ * the local callback server completes the token exchange in the background
+ * and reloads the MCP config, so the next connect succeeds.
+ */
+export declare function executeAuth(state: McpExtensionState, serverName: string): Promise<ProxyToolResult>;
 export declare function executeUiMessages(state: McpExtensionState): ProxyToolResult;
 export declare function executeStatus(state: McpExtensionState): ProxyToolResult;
 export declare function executeDescribe(state: McpExtensionState, toolName: string): ProxyToolResult;

package/dist/mcp/proxy-modes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy-modes.d.ts","sourceRoot":"","sources":["../../src/mcp/proxy-modes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAUpD,KAAK,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAoDhE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,CA4E3E;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,CAsDvE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,CAuC3F;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,iBAAiB,EACxB,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,OAAO,EACf,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,OAAO,GACvB,eAAe,CAiFjB;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,CAqDrF;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAsD3G;AAED,wBAAsB,WAAW,CAC/B,KAAK,EAAE,iBAAiB,EACxB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,cAAc,CAAC,EAAE,MAAM,EACvB,gBAAgB,CAAC,EAAE,MAAM,QAAQ,EAAE,GAClC,OAAO,CAAC,eAAe,CAAC,CAkW1B"}
+{"version":3,"file":"proxy-modes.d.ts","sourceRoot":"","sources":["../../src/mcp/proxy-modes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAWpD,KAAK,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAuBhE;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,iBAAiB,EACxB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,eAAe,CAAC,CAoB1B;AA+BD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,CA4E3E;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,CAsDvE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,CAuC3F;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,iBAAiB,EACxB,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,OAAO,EACf,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,OAAO,GACvB,eAAe,CAiFjB;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,CAqDrF;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAuF3G;AAED,wBAAsB,WAAW,CAC/B,KAAK,EAAE,iBAAiB,EACxB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,cAAc,CAAC,EAAE,MAAM,EACvB,gBAAgB,CAAC,EAAE,MAAM,QAAQ,EAAE,GAClC,OAAO,CAAC,eAAe,CAAC,CAkW1B"}

package/dist/mcp/proxy-modes.js

@@ -5,7 +5,8 @@ import { transformMcpContent } from "./tool-registrar.js";
 import { maybeStartUiSession } from "./ui-session.js";
 import { formatAuthRequiredMessage, truncateAtWord } from "./utils.js";
 import { authenticate, supportsOAuth } from "./mcp-auth-flow.js";
-function getAuthRequiredMessage(state, serverName, defaultMessage = `Server "${serverName}" requires OAuth authentication. Run /mcp-auth ${serverName} first.`) {
+import { startMcpAuthFlow } from "./mcp-auth-start.js";
+function getAuthRequiredMessage(state, serverName, defaultMessage = `Server "${serverName}" requires OAuth authentication. Run /mcp-auth ${serverName} first, or call mcp({ auth: "${serverName}" }) to start the OAuth flow (a browser opens on this machine).`) {
     return formatAuthRequiredMessage(state.config, serverName, defaultMessage);
 }
 function getAuthFailedMessage(state, serverName, message) {
@@ -13,7 +14,35 @@ function getAuthFailedMessage(state, serverName, message) {
     if (customGuidance) {
         return `OAuth authentication failed for "${serverName}": ${message}. ${getAuthRequiredMessage(state, serverName)}`;
     }
-    return `OAuth authentication failed for "${serverName}": ${message}. Run /mcp-auth ${serverName} first.`;
+    return `OAuth authentication failed for "${serverName}": ${message}. Run /mcp-auth ${serverName} first, or call mcp({ auth: "${serverName}" }) to start the OAuth flow.`;
+}
+/**
+ * Start the OAuth flow for a server (the `mcp({ auth: "<name>" })` action).
+ * Non-blocking: opens the browser on this machine and returns immediately;
+ * the local callback server completes the token exchange in the background
+ * and reloads the MCP config, so the next connect succeeds.
+ */
+export async function executeAuth(state, serverName) {
+    try {
+        const result = await startMcpAuthFlow(state, serverName, { openBrowser: true });
+        if (result.status === "already-authenticated") {
+            return {
+                content: [{ type: "text", text: `MCP server "${serverName}" is already authenticated.` }],
+                details: { mode: "auth", server: serverName, status: "already-authenticated" },
+            };
+        }
+        return {
+            content: [{ type: "text", text: `OAuth started for MCP server "${serverName}". A browser window should have opened on this machine — complete the sign-in there, then retry the connection.` }],
+            details: { mode: "auth", server: serverName, status: "auth_url_ready", authUrl: result.authUrl },
+        };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            content: [{ type: "text", text: `Failed to start OAuth for "${serverName}": ${message}` }],
+            details: { mode: "auth", server: serverName, error: "auth_start_failed", message },
+        };
+    }
 }
 async function attemptAutoAuth(state, serverName) {
     if (state.config.settings?.autoAuth !== true) {
@@ -340,16 +369,47 @@ export async function executeConnect(state, serverName) {
         await state.manager.close(serverName);
         let connection = await state.manager.connect(serverName, definition);
         if (connection.status === "needs-auth") {
-            const autoAuth = await attemptAutoAuth(state, serverName);
-            if (autoAuth.status === "failed") {
-                return {
-                    content: [{ type: "text", text: autoAuth.message }],
-                    details: { mode: "connect", error: "auth_required", server: serverName, message: autoAuth.message },
-                };
+            const autoAuthEnabled = state.config.settings?.autoAuth === true;
+            const oauthConfig = definition.oauth === false ? undefined : definition.oauth;
+            const isClientCredentials = oauthConfig?.grantType === "client_credentials";
+            // authorization-code + autoAuth: non-blocking OAuth — open the browser
+            // and return immediately (the callback server completes the exchange).
+            // client_credentials (no browser) keeps the blocking attemptAutoAuth
+            // path, as does autoAuth=false (attemptAutoAuth returns "skipped").
+            const useBrowserFlow = autoAuthEnabled && !isClientCredentials;
+            if (!useBrowserFlow) {
+                const autoAuth = await attemptAutoAuth(state, serverName);
+                if (autoAuth.status === "failed") {
+                    return {
+                        content: [{ type: "text", text: autoAuth.message }],
+                        details: { mode: "connect", error: "auth_required", server: serverName, message: autoAuth.message },
+                    };
+                }
+                if (autoAuth.status === "success") {
+                    await state.manager.close(serverName);
+                    connection = await state.manager.connect(serverName, definition);
+                }
             }
-            if (autoAuth.status === "success") {
-                await state.manager.close(serverName);
-                connection = await state.manager.connect(serverName, definition);
+            if (connection.status === "needs-auth" && useBrowserFlow) {
+                try {
+                    const result = await startMcpAuthFlow(state, serverName, { openBrowser: true });
+                    if (result.status === "auth_url_ready") {
+                        return {
+                            content: [{ type: "text", text: `OAuth started for MCP server "${serverName}". A browser window should have opened on this machine — complete the sign-in there, then retry the connection.` }],
+                            details: { mode: "connect", error: "auth_started", server: serverName, authUrl: result.authUrl },
+                        };
+                    }
+                    // already-authenticated (race) — reconnect below.
+                    await state.manager.close(serverName);
+                    connection = await state.manager.connect(serverName, definition);
+                }
+                catch (error) {
+                    const message = error instanceof Error ? error.message : String(error);
+                    return {
+                        content: [{ type: "text", text: getAuthFailedMessage(state, serverName, message) }],
+                        details: { mode: "connect", error: "auth_failed", server: serverName, message },
+                    };
+                }
             }
             if (connection.status === "needs-auth") {
                 const message = getAuthRequiredMessage(state, serverName);

package/dist/mcp/server-manager.d.ts

@@ -4,7 +4,8 @@ import type { McpTool, McpResource, ServerDefinition, ServerStreamResultPatchNot
 import { type ServerSamplingConfig } from "./sampling-handler.js";
 interface ServerConnection {
     client: Client;
-    transport: Transport;
+    /** Undefined for needs-auth connections whose probe threw before a transport existed. */
+    transport?: Transport;
     definition: ServerDefinition;
     tools: McpTool[];
     resources: McpResource[];

package/dist/mcp/server-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-manager.d.ts","sourceRoot":"","sources":["../../src/mcp/server-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAKnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,KAAK,EACV,OAAO,EACP,WAAW,EACX,gBAAgB,EAChB,mCAAmC,EACnC,SAAS,EACV,MAAM,YAAY,CAAC;AAMpB,OAAO,EAA2B,KAAK,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAI3F,UAAU,gBAAgB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,SAAS,CAAC;IACrB,UAAU,EAAE,gBAAgB,CAAC;IAC7B,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,SAAS,EAAE,WAAW,EAAE,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,YAAY,CAAC;CAC/C;AAED,KAAK,gBAAgB,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,mCAAmC,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;AAElH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,WAAW,CAAuC;IAC1D,OAAO,CAAC,eAAe,CAAgD;IACvE,OAAO,CAAC,iBAAiB,CAAuC;IAChE,OAAO,CAAC,cAAc,CAAmC;IAEzD,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,GAAG,SAAS,GAAG,IAAI;IAI3D,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAyBtE,gBAAgB;IAmF9B,OAAO,CAAC,YAAY;YAWN,mBAAmB;YAyEnB,aAAa;YAab,iBAAiB;IAkB/B,OAAO,CAAC,iCAAiC;IAQzC,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,GAAG,IAAI;IAI/E,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAI3C,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAgBpE,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAelC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAK/B,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAIzD,iBAAiB,IAAI,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAIlD,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAOzB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAOrC,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAOrC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO;CAMjD"}
+{"version":3,"file":"server-manager.d.ts","sourceRoot":"","sources":["../../src/mcp/server-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAKnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,KAAK,EACV,OAAO,EACP,WAAW,EACX,gBAAgB,EAChB,mCAAmC,EACnC,SAAS,EACV,MAAM,YAAY,CAAC;AAMpB,OAAO,EAA2B,KAAK,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAI3F,UAAU,gBAAgB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,yFAAyF;IACzF,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,UAAU,EAAE,gBAAgB,CAAC;IAC7B,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,SAAS,EAAE,WAAW,EAAE,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,YAAY,CAAC;CAC/C;AAED,KAAK,gBAAgB,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,mCAAmC,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;AAElH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,WAAW,CAAuC;IAC1D,OAAO,CAAC,eAAe,CAAgD;IACvE,OAAO,CAAC,iBAAiB,CAAuC;IAChE,OAAO,CAAC,cAAc,CAAmC;IAEzD,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,GAAG,SAAS,GAAG,IAAI;IAI3D,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAyBtE,gBAAgB;IAuF9B,OAAO,CAAC,YAAY;YAWN,mBAAmB;YAyEnB,aAAa;YAab,iBAAiB;IAkB/B,OAAO,CAAC,iCAAiC;IAQzC,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,GAAG,IAAI;IAI/E,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAI3C,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAgBpE,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAelC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAK/B,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAIzD,iBAAiB,IAAI,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAIlD,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAOzB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAOrC,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAOrC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO;CAMjD"}

package/dist/mcp/server-manager.js

@@ -95,14 +95,18 @@ export class McpServerManager {
             if (transport) {
                 await transport.close().catch(() => { });
             }
-            // Check for UnauthorizedError — server requires OAuth.
-            // This can fire from createHttpTransport probe or client.connect.
+            // OAuth-configured servers: classify ANY probe/connect failure as
+            // needs-auth, not only UnauthorizedError. OAuth discovery can fail
+            // with non-401 errors (missing/malformed WWW-Authenticate metadata,
+            // 405 from the SSE fallback, etc.) — surfacing "error" would wedge the
+            // server and hide the auth entry point. This can fire from
+            // createHttpTransport probe or client.connect.
             // transport may be undefined if createHttpTransport threw during the probe
             // before returning a transport; close() handles this safely.
-            if (error instanceof UnauthorizedError && supportsOAuth(definition)) {
+            if (supportsOAuth(definition)) {
                 return {
                     client,
-                    transport: transport,
+                    transport,
                     definition,
                     tools: [],
                     resources: [],

package/dist/sdk/coding-agent/core/extensions/native-extensions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native-extensions.d.ts","sourceRoot":"","sources":["../../../../../src/sdk/coding-agent/core/extensions/native-extensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,sBAAsB,GAAG,KAAK,GAAG,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEhG,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,GAAG,YAAY,GAAG,aAAa,CAAC;IAChD;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,cAAc,EAAE,OAAO,CAAC;IACxB,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,uBAAuB,EA6KtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAElF;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAI1G;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAI3G;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IAClG,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC,CAUD"}
+{"version":3,"file":"native-extensions.d.ts","sourceRoot":"","sources":["../../../../../src/sdk/coding-agent/core/extensions/native-extensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,sBAAsB,GAAG,KAAK,GAAG,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEhG,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,GAAG,YAAY,GAAG,aAAa,CAAC;IAChD;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,cAAc,EAAE,OAAO,CAAC;IACxB,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,uBAAuB,EAwLtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAElF;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAI1G;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAI3G;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IAClG,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC,CAUD"}

package/dist/sdk/coding-agent/core/extensions/native-extensions.js

@@ -176,6 +176,16 @@ export const NATIVE_EXTENSIONS = [
         defaultEnabled: true,
         tags: ["sessions", "parallel", "fanout", "orchestration"],
     },
+    {
+        id: "dataset-uploader",
+        label: "Dataset Uploader",
+        description: "Export, analyze, clean and upload harness sessions to the team dataset vault (training data). " +
+            "Use only on explicit user request.",
+        category: "integration",
+        entryPath: "src/extensions/dataset-uploader/index.ts",
+        defaultEnabled: false,
+        tags: ["dataset", "sft", "training", "upload"],
+    },
 ];
 /**
  * Look up a native extension by id. Returns undefined for unknown ids.

package/dist/server/handlers/mcp-auth.d.ts

@@ -2,10 +2,12 @@
  * Handler for `POST /api/mcp-auth`.
  *
  * Starts the OAuth flow for a locally configured MCP server managed by
- * `spectral serve`. Runs headless: `startAuth` captures the authorization
- * URL through the provider's `onRedirect` hook (no browser is opened
- * here — the caller renders `authUrl`), and the flow is completed in the
- * background once the local callback server receives the code.
+ * `spectral serve`. Delegates to the shared non-blocking helper
+ * (`startMcpAuthFlow`) used by the agent `mcp` tool: `startAuth` captures
+ * the authorization URL through the provider's `onRedirect` hook, and the
+ * flow is completed in the background once the local callback server
+ * receives the code. `openBrowser: true` in the body launches the system
+ * browser (default: headless — the caller renders `authUrl`).
  *
  * Pure handler pattern — no framework, no side effects on the wire. The
  * caller (the relay dispatcher) injects `McpExtensionState`; validation
@@ -20,6 +22,7 @@ export type McpAuthResult = {
 };
 export interface McpAuthBody {
     name?: unknown;
+    openBrowser?: boolean;
 }
 export declare function handleStartMcpAuth(state: McpExtensionState | undefined, body: McpAuthBody): Promise<McpAuthResult>;
 //# sourceMappingURL=mcp-auth.d.ts.map

package/dist/server/handlers/mcp-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-auth.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/mcp-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAW5D,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,uBAAuB,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AA6BD,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,iBAAiB,GAAG,SAAS,EACpC,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,aAAa,CAAC,CAyExB"}
+{"version":3,"file":"mcp-auth.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/mcp-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAO5D,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,uBAAuB,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,iBAAiB,GAAG,SAAS,EACpC,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,aAAa,CAAC,CAuBxB"}