@akanjs/cli 3.0.0-beta.2 → 3.0.0-beta.20

package/index-ztp3e73t.js

@@ -0,0 +1,700 @@
+// @bun
+import {
+  ConfigLock
+} from "./index-3hx1z96c.js";
+
+// pkgs/@akanjs/devkit/codeAgent/agent/SubagentPool.ts
+import { codeAgentReadOnlyBuiltins } from "akanjs/common";
+import { Type } from "typebox";
+var maxResultChars = 8000;
+var tickMs = 1000;
+
+class SubagentPool2 {
+  static kinds = {
+    explore: {
+      readOnly: true,
+      desc: "reads, searches and reports back. It cannot write a file or run a command."
+    },
+    code: {
+      readOnly: false,
+      desc: "makes the change itself, with the same tools as this session."
+    }
+  };
+  static defaultKind = "explore";
+  #options;
+  #children = new Map;
+  #spend;
+  #ticker = null;
+  constructor(options) {
+    this.#options = options;
+    this.#spend = options.spend ?? { tokens: 0, running: 0 };
+  }
+  static extensionFor(options) {
+    if (!options.parent.tools.subagent)
+      return;
+    if (options.depth >= options.parent.tools.subagent.maxDepth)
+      return;
+    const pool = new SubagentPool2(options);
+    return { name: "akan-subagent", factory: (pi) => pool.#register(pi) };
+  }
+  static toolName = "task";
+  #register(pi) {
+    pi.registerTool({
+      name: SubagentPool2.toolName,
+      label: "Task",
+      description: "Run a focused sub-agent on one self-contained question and get back its answer. Use it for searching and reading that would otherwise fill this conversation \u2014 the sub-agent's own reading does not come back, only its answer. Give it everything it needs: it cannot see this conversation.",
+      promptSnippet: "task: run a sub-agent on one self-contained question and get back only its answer",
+      parameters: Type.Object({
+        description: Type.String({ description: "Three to five words naming the task, for the activity log." }),
+        prompt: Type.String({
+          description: "The complete instruction. The sub-agent sees nothing of this conversation."
+        }),
+        type: Type.Optional(Type.Union(Object.entries(SubagentPool2.kinds).map(([kind, spec]) => Type.Literal(kind, { description: spec.desc })), { description: `What the sub-agent may do. Defaults to ${SubagentPool2.defaultKind}.` }))
+      }),
+      execute: async (id, params, signal) => {
+        const kind = params.type ?? SubagentPool2.defaultKind;
+        const refusal = this.#refuse();
+        if (refusal)
+          return { content: [{ type: "text", text: refusal }], details: undefined, isError: true };
+        this.#spend.running += 1;
+        this.#children.set(id, { kind, description: params.description, startedAt: Date.now() });
+        this.#report();
+        this.#options.onNotice?.(`${kind} sub-agent \xB7 ${params.description}`);
+        try {
+          const text = await this.#run(id, kind, params.prompt, signal);
+          return { content: [{ type: "text", text }], details: undefined };
+        } finally {
+          this.#spend.running -= 1;
+          this.#children.delete(id);
+          this.#report();
+        }
+      }
+    });
+  }
+  #refuse() {
+    const budget = this.#options.parent.tools.subagent;
+    if (!budget)
+      return "Sub-agents are disabled by this profile.";
+    if (this.#spend.running >= budget.maxConcurrent)
+      return `Too many sub-agents are already running (limit ${budget.maxConcurrent} at once, counted across the whole task tree). ${this.#children.size ? "Wait for one of yours to finish, or do" : "Do"} this part yourself.`;
+    if (this.#spend.tokens >= budget.budget)
+      return `The sub-agent token budget (${budget.budget}) is spent. Do the rest of this work yourself.`;
+    return;
+  }
+  static childOf(parent, kind) {
+    const budget = parent.tools.subagent;
+    return {
+      ...parent,
+      name: `${parent.name}:${kind}`,
+      tools: {
+        ...parent.tools,
+        builtin: SubagentPool2.kinds[kind].readOnly ? parent.tools.builtin.filter((tool) => codeAgentReadOnlyBuiltins.includes(tool)) : parent.tools.builtin,
+        subagent: budget ? { ...budget, maxDepth: budget.maxDepth } : false
+      },
+      session: { store: "memory", crossSession: false },
+      ui: { canPrompt: false },
+      context: { projectFiles: false, skills: parent.context.skills }
+    };
+  }
+  #report() {
+    const onAgents = this.#options.onAgents;
+    if (!onAgents)
+      return;
+    onAgents([...this.#children].map(([id, child]) => ({
+      id,
+      kind: child.kind,
+      description: child.description,
+      startedAt: child.startedAt,
+      tokens: child.agent?.tokensUsed ?? 0
+    })));
+    if (this.#children.size && !this.#ticker) {
+      this.#ticker = setInterval(() => this.#report(), tickMs);
+      this.#ticker.unref?.();
+    } else if (!this.#children.size && this.#ticker) {
+      clearInterval(this.#ticker);
+      this.#ticker = null;
+    }
+  }
+  async#run(id, kind, prompt, signal) {
+    const { CodeAgent } = await import("./CodeAgent-awv258wb.js");
+    const budget = this.#options.parent.tools.subagent;
+    const child = SubagentPool2.childOf(this.#options.parent, kind);
+    const agent = await CodeAgent.create({
+      workspace: this.#options.workspace,
+      cwd: this.#options.cwd,
+      profile: child,
+      apps: [],
+      depth: this.#options.depth + 1,
+      subagentSpend: this.#spend
+    });
+    const running = this.#children.get(id);
+    if (running)
+      running.agent = agent;
+    let stopped = false;
+    const abort = () => {
+      stopped = true;
+      agent.abort();
+    };
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted)
+      stopped = true;
+    let finished = false;
+    try {
+      let answer = "";
+      agent.on((event) => {
+        if (event.type === "message" && event.role === "assistant")
+          answer = event.text;
+        if (event.type === "turn_start" && stopped)
+          agent.abort();
+      });
+      if (!stopped) {
+        await agent.prompt(prompt);
+        await agent.waitForIdle();
+      }
+      finished = true;
+      return answer.length > maxResultChars ? `${answer.slice(0, maxResultChars)}
+\u2026(truncated)` : answer || "(no answer)";
+    } finally {
+      signal?.removeEventListener("abort", abort);
+      const tokens = agent.tokensUsed;
+      this.#spend.tokens += tokens;
+      const outcome = stopped ? "stopped" : finished ? "finished" : "failed";
+      const ceiling = budget ? budget.budget : 0;
+      this.#options.onNotice?.(`${kind} sub-agent ${outcome}, ${tokens} tokens (${this.#spend.tokens} of ${ceiling} spent)`);
+      agent.dispose();
+    }
+  }
+}
+
+// pkgs/@akanjs/devkit/codeAgent/agent/akanCodePaths.ts
+import { existsSync } from "fs";
+import { homedir } from "os";
+import path from "path";
+var builtinSkillsDir = () => {
+  const candidates = [path.join(import.meta.dir, "skills"), path.join(import.meta.dir, "..", "skills")];
+  return candidates.find((candidate) => existsSync(candidate));
+};
+var globalDir = () => process.env.AKAN_CODE_HOME ?? path.join(homedir(), ".akan", "code");
+var akanCodePaths2 = {
+  workspaceDir: (workspaceRoot) => path.join(workspaceRoot, ".akan", "code"),
+  sessionsDir: (workspaceRoot) => path.join(workspaceRoot, ".akan", "code", "sessions"),
+  extensionsDir: (workspaceRoot) => path.join(workspaceRoot, ".akan", "code", "extensions"),
+  skillsDir: (workspaceRoot) => path.join(workspaceRoot, ".akan", "code", "skills"),
+  mailDir: (workspaceRoot) => path.join(workspaceRoot, ".akan", "code", "mail"),
+  builtinSkillsDir,
+  mcpFile: (workspaceRoot) => path.join(workspaceRoot, ".akan", "code", "mcp.json"),
+  globalMcpFile: () => path.join(globalDir(), "mcp.json"),
+  globalSkillsDir: () => path.join(globalDir(), "skills"),
+  globalDir,
+  authFile: () => path.join(globalDir(), "auth.json"),
+  mcpAuthFile: () => path.join(globalDir(), "mcpAuth.json"),
+  modelsFile: () => path.join(globalDir(), "models.json")
+};
+
+// pkgs/@akanjs/devkit/codeAgent/tools/McpServerConfig.ts
+import { existsSync as existsSync2, mkdirSync, readFileSync, writeFileSync } from "fs";
+import path2 from "path";
+class McpServerConfig {
+  static file(workspaceRoot, scope = "workspace") {
+    return scope === "global" ? akanCodePaths2.globalMcpFile() : akanCodePaths2.mcpFile(workspaceRoot);
+  }
+  static files(workspaceRoot) {
+    return [
+      { scope: "global", file: McpServerConfig.file(workspaceRoot, "global") },
+      { scope: "workspace", file: McpServerConfig.file(workspaceRoot, "workspace") }
+    ];
+  }
+  static read(workspaceRoot) {
+    return McpServerConfig.declared(workspaceRoot).filter((entry) => !entry.disabled).map((entry) => entry.ref);
+  }
+  static declared(workspaceRoot) {
+    const byName = new Map;
+    for (const { scope } of McpServerConfig.files(workspaceRoot))
+      for (const [name, entry] of Object.entries(McpServerConfig.#parse(workspaceRoot, scope).map))
+        byName.set(name, { ref: McpServerConfig.#refOf(name, entry), disabled: !!entry.disabled, scope });
+    return [...byName.values()];
+  }
+  static add(workspaceRoot, name, target, scope = "global") {
+    const [head, ...rest] = target;
+    if (!head)
+      throw new Error("Give the server a command to run, or a url to reach.");
+    const entry = /^https?:\/\//.test(head) ? { url: head } : { command: head, args: rest };
+    const { file, key, map } = McpServerConfig.#parse(workspaceRoot, scope);
+    const next = { ...map, [name]: entry };
+    mkdirSync(path2.dirname(file), { recursive: true });
+    writeFileSync(file, `${JSON.stringify({ [key]: next }, null, 2)}
+`);
+    return McpServerConfig.#refOf(name, entry);
+  }
+  static remove(workspaceRoot, name, only) {
+    const candidates = McpServerConfig.files(workspaceRoot).filter(({ scope }) => !only || scope === only);
+    for (const { scope } of candidates.reverse()) {
+      const { file, key, map } = McpServerConfig.#parse(workspaceRoot, scope);
+      if (!(name in map))
+        continue;
+      const next = { ...map };
+      delete next[name];
+      writeFileSync(file, `${JSON.stringify({ [key]: next }, null, 2)}
+`);
+      return scope;
+    }
+    return false;
+  }
+  static #refOf(name, entry) {
+    return {
+      name,
+      transport: entry.url ? "http" : "stdio",
+      ...entry.command ? { command: entry.command } : {},
+      ...entry.args ? { args: entry.args } : {},
+      ...entry.url ? { url: entry.url } : {},
+      ...entry.env ? { env: entry.env } : {},
+      ...entry.headers ? { headers: entry.headers } : {},
+      ...entry.oauth ? { oauth: entry.oauth } : {}
+    };
+  }
+  static targetOf(ref) {
+    return ref.url ?? [ref.command, ...ref.args ?? []].filter(Boolean).join(" ");
+  }
+  static problem(workspaceRoot) {
+    for (const { file } of McpServerConfig.files(workspaceRoot)) {
+      if (!existsSync2(file))
+        continue;
+      try {
+        JSON.parse(readFileSync(file, "utf8"));
+      } catch (error) {
+        return `${file} is not valid JSON \u2014 ${String(error)}`;
+      }
+    }
+    return;
+  }
+  static #parse(workspaceRoot, scope) {
+    const file = McpServerConfig.file(workspaceRoot, scope);
+    const empty = { file, key: "mcpServers", map: {} };
+    if (!existsSync2(file))
+      return empty;
+    try {
+      const parsed = JSON.parse(readFileSync(file, "utf8"));
+      if (parsed.servers && !parsed.mcpServers)
+        return { file, key: "servers", map: parsed.servers };
+      return { ...empty, map: parsed.mcpServers ?? {} };
+    } catch {
+      return empty;
+    }
+  }
+}
+
+// pkgs/@akanjs/devkit/codeAgent/tools/McpTokenStore.ts
+import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, writeFileSync as writeFileSync2 } from "fs";
+import path3 from "path";
+class McpTokenStore {
+  static file() {
+    return akanCodePaths2.mcpAuthFile();
+  }
+  static lockFile() {
+    return `${McpTokenStore.file()}.lock`;
+  }
+  static read(name) {
+    return McpTokenStore.#all()[name];
+  }
+  static names() {
+    return Object.keys(McpTokenStore.#all());
+  }
+  static write(name, auth) {
+    McpTokenStore.#save({ ...McpTokenStore.#all(), [name]: auth });
+  }
+  static clear(name) {
+    const all = McpTokenStore.#all();
+    if (!(name in all))
+      return false;
+    delete all[name];
+    McpTokenStore.#save(all);
+    return true;
+  }
+  static isExpired(auth) {
+    return auth.expiresAt !== undefined && auth.expiresAt <= Date.now() + McpTokenStore.skewMs;
+  }
+  static skewMs = 60000;
+  static #all() {
+    const file = McpTokenStore.file();
+    if (!existsSync3(file))
+      return {};
+    try {
+      const parsed = JSON.parse(readFileSync2(file, "utf8"));
+      return parsed.servers ?? {};
+    } catch {
+      return {};
+    }
+  }
+  static #save(servers) {
+    const file = McpTokenStore.file();
+    mkdirSync2(path3.dirname(file), { recursive: true, mode: 448 });
+    const temp = `${file}.${process.pid}.tmp`;
+    writeFileSync2(temp, `${JSON.stringify({ servers }, null, 2)}
+`, { mode: 384 });
+    renameSync(temp, file);
+    chmodSync(file, 384);
+  }
+}
+
+// pkgs/@akanjs/devkit/codeAgent/tools/McpOAuth.ts
+import { createHash, randomBytes } from "crypto";
+
+class McpOAuth {
+  static resourceWellKnown = "/.well-known/oauth-protected-resource";
+  static serverWellKnown = "/.well-known/oauth-authorization-server";
+  static openidWellKnown = "/.well-known/openid-configuration";
+  static ports = [33418, 33419, 33420, 33421, 33422];
+  static callbackPath = "/callback";
+  static timeoutMs = 300000;
+  static #json(response) {
+    return response.json();
+  }
+  static resourceMetadataUrls(serverUrl, challenge) {
+    const named = challenge ? /resource_metadata="([^"]+)"/.exec(challenge)?.[1] : undefined;
+    if (named)
+      return [named];
+    const url = new URL(serverUrl);
+    const withPath = url.pathname === "/" ? "" : url.pathname.replace(/\/$/, "");
+    return [
+      new URL(`${McpOAuth.resourceWellKnown}${withPath}`, url.origin).href,
+      new URL(McpOAuth.resourceWellKnown, url.origin).href
+    ];
+  }
+  static serverMetadataUrls(issuer) {
+    const url = new URL(issuer);
+    const withPath = url.pathname === "/" ? "" : url.pathname.replace(/\/$/, "");
+    return [
+      new URL(`${McpOAuth.serverWellKnown}${withPath}`, url.origin).href,
+      new URL(`${withPath}${McpOAuth.openidWellKnown}`, url.origin).href,
+      new URL(McpOAuth.serverWellKnown, url.origin).href
+    ];
+  }
+  static async discover(serverUrl, challenge) {
+    const resourceDoc = await McpOAuth.#first(McpOAuth.resourceMetadataUrls(serverUrl, challenge));
+    const resource = typeof resourceDoc?.resource === "string" ? resourceDoc.resource : serverUrl;
+    const resourceScopes = McpOAuth.#strings(resourceDoc?.scopes_supported);
+    const issuers = McpOAuth.#strings(resourceDoc?.authorization_servers);
+    const candidates = issuers.length ? issuers : [new URL(serverUrl).origin];
+    for (const issuer of candidates) {
+      const doc = await McpOAuth.#first(McpOAuth.serverMetadataUrls(issuer));
+      if (!doc)
+        continue;
+      const methods = McpOAuth.#strings(doc.code_challenge_methods_supported);
+      if (methods.length && !methods.includes("S256"))
+        throw new Error(`${issuer} does not offer PKCE S256, which is the only method this client will use.`);
+      const authorizationEndpoint = typeof doc.authorization_endpoint === "string" ? doc.authorization_endpoint : "";
+      const tokenEndpoint = typeof doc.token_endpoint === "string" ? doc.token_endpoint : "";
+      if (!authorizationEndpoint || !tokenEndpoint)
+        continue;
+      return {
+        issuer: typeof doc.issuer === "string" ? doc.issuer : issuer,
+        authorizationEndpoint,
+        tokenEndpoint,
+        ...typeof doc.registration_endpoint === "string" ? { registrationEndpoint: doc.registration_endpoint } : {},
+        ...McpOAuth.#strings(doc.scopes_supported).length ? { scopesSupported: McpOAuth.#strings(doc.scopes_supported) } : {},
+        resource,
+        ...resourceScopes.length ? { resourceScopes } : {}
+      };
+    }
+    throw new Error(`No OAuth metadata was found for ${serverUrl}. Declare "oauth" for it in mcp.json.`);
+  }
+  static async register(server, redirectUri, name) {
+    if (!server.registrationEndpoint)
+      throw new Error(`${server.issuer} registers no clients on demand. Put its "oauth": { "clientId": "\u2026" } in mcp.json.`);
+    const response = await fetch(server.registrationEndpoint, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        client_name: `akan code (${name})`,
+        redirect_uris: [redirectUri],
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        token_endpoint_auth_method: "none",
+        application_type: "native"
+      }),
+      signal: AbortSignal.timeout(30000)
+    });
+    const body = await McpOAuth.#json(response);
+    if (!response.ok || !body.client_id)
+      throw new Error(`${server.issuer} refused the client registration: ${body.error ?? response.status}`);
+    return { clientId: body.client_id, ...body.client_secret ? { clientSecret: body.client_secret } : {} };
+  }
+  static async authorize(options) {
+    const verifier = randomBytes(32).toString("base64url");
+    const state = randomBytes(16).toString("base64url");
+    const scope = options.scope ?? options.server.resourceScopes?.join(" ") ?? options.server.scopesSupported?.join(" ");
+    const authorize = new URL(options.server.authorizationEndpoint);
+    for (const [key, value] of Object.entries({
+      response_type: "code",
+      client_id: options.clientId,
+      redirect_uri: options.redirectUri,
+      code_challenge: createHash("sha256").update(verifier).digest("base64url"),
+      code_challenge_method: "S256",
+      state,
+      resource: options.server.resource,
+      ...scope ? { scope } : {}
+    }))
+      authorize.searchParams.set(key, value);
+    options.open(authorize.href);
+    const params = await options.wait();
+    const error = params.get("error");
+    if (error)
+      throw new Error(`${error}: ${params.get("error_description") ?? "the authorization was refused"}`);
+    if (params.get("state") !== state)
+      throw new Error("The authorization response carried the wrong state.");
+    const iss = params.get("iss");
+    if (iss && iss !== options.server.issuer)
+      throw new Error(`The authorization response came from ${iss}, not ${options.server.issuer}.`);
+    const code = params.get("code");
+    if (!code)
+      throw new Error("The authorization response carried no code.");
+    return await McpOAuth.#token(options.server, {
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: options.redirectUri,
+      client_id: options.clientId,
+      code_verifier: verifier,
+      resource: options.server.resource,
+      ...options.clientSecret ? { client_secret: options.clientSecret } : {}
+    });
+  }
+  static async refresh(server, auth) {
+    if (!auth.refreshToken)
+      throw new Error("There is no refresh token for this server.");
+    return await McpOAuth.#token(server, {
+      grant_type: "refresh_token",
+      refresh_token: auth.refreshToken,
+      client_id: auth.clientId,
+      resource: server.resource,
+      ...auth.clientSecret ? { client_secret: auth.clientSecret } : {},
+      ...auth.scope ? { scope: auth.scope } : {}
+    });
+  }
+  static scopeOf(ref, server) {
+    return ref.oauth?.scope ?? server.resourceScopes?.join(" ") ?? server.scopesSupported?.join(" ");
+  }
+  static async#token(server, form) {
+    const response = await fetch(server.tokenEndpoint, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+      body: new URLSearchParams(form).toString(),
+      signal: AbortSignal.timeout(30000)
+    });
+    const body = await McpOAuth.#json(response);
+    if (!response.ok || !body.access_token)
+      throw new Error(`${server.tokenEndpoint} refused the token request: ${body.error ?? response.status}`);
+    return {
+      accessToken: body.access_token,
+      ...body.refresh_token ? { refreshToken: body.refresh_token } : {},
+      ...body.expires_in ? { expiresAt: Date.now() + body.expires_in * 1000 } : {},
+      ...body.scope ? { scope: body.scope } : {}
+    };
+  }
+  static async#first(urls) {
+    for (const url of urls) {
+      try {
+        const response = await fetch(url, {
+          headers: { accept: "application/json", "mcp-protocol-version": "2025-06-18" },
+          signal: AbortSignal.timeout(15000)
+        });
+        if (!response.ok)
+          continue;
+        return await McpOAuth.#json(response);
+      } catch {}
+    }
+    return;
+  }
+  static #strings(value) {
+    return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+  }
+}
+
+// pkgs/@akanjs/devkit/codeAgent/tools/McpOAuthLoopback.ts
+class McpOAuthLoopback {
+  #server;
+  #port;
+  #resolve;
+  #answer;
+  constructor(port) {
+    this.#port = port;
+    this.#answer = new Promise((resolve) => {
+      this.#resolve = resolve;
+    });
+    this.#server = Bun.serve({
+      port,
+      hostname: "127.0.0.1",
+      fetch: (request) => this.#handle(request)
+    });
+  }
+  static bind(preferred) {
+    const ports = preferred ? [preferred, ...McpOAuth.ports.filter((port) => port !== preferred)] : McpOAuth.ports;
+    const failures = [];
+    for (const port of ports) {
+      try {
+        return new McpOAuthLoopback(port);
+      } catch (error) {
+        failures.push(`${port}: ${String(error)}`);
+      }
+    }
+    throw new Error(`No loopback port was free for the sign-in \u2014 ${failures.join(", ")}`);
+  }
+  get redirectUri() {
+    return `http://127.0.0.1:${this.#port}${McpOAuth.callbackPath}`;
+  }
+  async wait() {
+    const timeout = new Promise((_, reject) => setTimeout(() => reject(new Error("The sign-in was not completed in time.")), McpOAuth.timeoutMs).unref?.());
+    return await Promise.race([this.#answer, timeout]);
+  }
+  close() {
+    this.#server.stop(true);
+  }
+  #handle(request) {
+    const url = new URL(request.url);
+    if (url.pathname !== McpOAuth.callbackPath)
+      return new Response("Not found", { status: 404 });
+    this.#resolve?.(url.searchParams);
+    const failed = url.searchParams.get("error");
+    return new Response(`<!doctype html><meta charset="utf-8"><title>akan code</title><body style="font:16px system-ui;padding:3rem">
+<h1>${failed ? "Sign-in failed" : "Signed in"}</h1>
+<p>${failed ? `The authorization server said: ${Bun.escapeHTML(failed)}` : "You can close this tab and go back to the terminal."}</p>`, { status: failed ? 400 : 200, headers: { "content-type": "text/html; charset=utf-8" } });
+  }
+}
+
+// pkgs/@akanjs/devkit/codeAgent/tools/McpSignIn.ts
+class McpSignIn {
+  static #refreshing = new Map;
+  static async token(ref, onNotice) {
+    const stored = McpTokenStore.read(ref.name);
+    if (!stored)
+      return;
+    if (!McpTokenStore.isExpired(stored))
+      return stored.accessToken;
+    return await McpSignIn.#refreshOnce(ref, stored, onNotice);
+  }
+  static async retryToken(ref, refused, onNotice) {
+    const stored = McpTokenStore.read(ref.name);
+    if (!stored)
+      return;
+    if (stored.accessToken !== refused && !McpTokenStore.isExpired(stored))
+      return stored.accessToken;
+    return await McpSignIn.#refreshOnce(ref, stored, onNotice);
+  }
+  static async#refreshOnce(ref, stored, onNotice) {
+    const key = `${ref.name}
+${stored.refreshToken}`;
+    let pending = McpSignIn.#refreshing.get(key);
+    if (!pending) {
+      pending = McpSignIn.#refreshed(ref, stored, onNotice).finally(() => McpSignIn.#refreshing.delete(key));
+      McpSignIn.#refreshing.set(key, pending);
+    }
+    return await pending;
+  }
+  static async#refreshed(ref, stored, onNotice) {
+    if (!stored.refreshToken)
+      return;
+    try {
+      return await ConfigLock.run(McpTokenStore.lockFile(), async () => {
+        const current = McpTokenStore.read(ref.name);
+        if (!current)
+          return;
+        if (current.accessToken !== stored.accessToken && !McpTokenStore.isExpired(current))
+          return current.accessToken;
+        const server = {
+          issuer: current.issuer,
+          authorizationEndpoint: "",
+          tokenEndpoint: current.tokenEndpoint,
+          resource: current.resource
+        };
+        const tokens = await McpOAuth.refresh(server, current);
+        const { expiresAt: _spent, ...grant } = current;
+        McpTokenStore.write(ref.name, { ...grant, ...tokens });
+        return tokens.accessToken;
+      });
+    } catch (error) {
+      onNotice?.(`MCP server "${ref.name}" needs signing in again \u2014 ${String(error)}`);
+      return;
+    }
+  }
+  static async run(ref, options) {
+    if (!ref.url)
+      throw new Error(`"${ref.name}" is a stdio server: give it its credential through "env".`);
+    const challenge = await McpSignIn.challenge(ref);
+    const server = await McpOAuth.discover(ref.url, challenge);
+    const stored = McpTokenStore.read(ref.name);
+    const reusable = stored && stored.issuer === server.issuer && !ref.oauth?.clientId ? stored : undefined;
+    const loopback = McpOAuthLoopback.bind(McpSignIn.#portOf(reusable?.redirectUri));
+    try {
+      const redirectUri = loopback.redirectUri;
+      const client = await McpSignIn.#client(ref, server, redirectUri, reusable);
+      options.onNotice?.(`Opening a browser to sign in to "${ref.name}"\u2026`);
+      const scope = McpOAuth.scopeOf(ref, server);
+      const tokens = await McpOAuth.authorize({
+        server,
+        clientId: client.clientId,
+        ...client.clientSecret ? { clientSecret: client.clientSecret } : {},
+        redirectUri,
+        ...scope ? { scope } : {},
+        open: options.open,
+        wait: () => loopback.wait()
+      });
+      const auth = {
+        issuer: server.issuer,
+        tokenEndpoint: server.tokenEndpoint,
+        resource: server.resource,
+        clientId: client.clientId,
+        ...client.clientSecret ? { clientSecret: client.clientSecret } : {},
+        redirectUri,
+        ...tokens
+      };
+      McpTokenStore.write(ref.name, auth);
+      return auth;
+    } finally {
+      loopback.close();
+    }
+  }
+  static async challenge(ref) {
+    if (!ref.url)
+      return null;
+    try {
+      const response = await fetch(ref.url, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          accept: "application/json, text/event-stream",
+          ...ref.headers
+        },
+        body: JSON.stringify({
+          jsonrpc: "2.0",
+          id: 0,
+          method: "initialize",
+          params: { protocolVersion: "2025-06-18", capabilities: {}, clientInfo: { name: "akan-code", version: "1" } }
+        }),
+        signal: AbortSignal.timeout(15000)
+      });
+      return response.status === 401 ? response.headers.get("www-authenticate") ?? "" : null;
+    } catch {
+      return null;
+    }
+  }
+  static async#client(ref, server, redirectUri, reusable) {
+    if (ref.oauth?.clientId)
+      return {
+        clientId: ref.oauth.clientId,
+        ...ref.oauth.clientSecret ? { clientSecret: ref.oauth.clientSecret } : {}
+      };
+    if (reusable && reusable.redirectUri === redirectUri)
+      return {
+        clientId: reusable.clientId,
+        ...reusable.clientSecret ? { clientSecret: reusable.clientSecret } : {}
+      };
+    return await McpOAuth.register(server, redirectUri, ref.name);
+  }
+  static #portOf(redirectUri) {
+    if (!redirectUri)
+      return;
+    const port = Number(new URL(redirectUri).port);
+    return Number.isFinite(port) && port > 0 ? port : undefined;
+  }
+}
+
+export { SubagentPool2, akanCodePaths2, McpServerConfig, McpTokenStore, McpSignIn };