@akon-labs/nexus-cli 0.1.9 → 0.1.10

package/dist/extensions/mcp/server-manager.d.ts

@@ -0,0 +1,116 @@
+import { Client, type GetPromptResult, type ReadResourceResult, type RequestOptions, type UrlElicitationRequiredError } from "@modelcontextprotocol/client";
+import { type ServerElicitationConfig } from "./elicitation-handler.ts";
+import { type AuthStorageOptions } from "./mcp-auth.ts";
+import { type McpOAuthRuntime } from "./mcp-auth-flow.ts";
+import { type ServerSamplingConfig } from "./sampling-handler.ts";
+import { type McpPrompt, type McpResource, type McpTool, type McpTraceSettings, type ServerDefinition, type ServerStreamResultPatchNotification, type Transport } from "./types.ts";
+export interface ServerConnection {
+    client: Client;
+    transport: Transport;
+    definition: ServerDefinition;
+    tools: McpTool[];
+    /** Monotonic guard against older refresh responses replacing newer notifications. */
+    toolsRevision?: number;
+    resources: McpResource[];
+    prompts: McpPrompt[];
+    /** True when prompts were advertised but prompts/list failed. */
+    promptDiscoveryFailed?: boolean;
+    instructions?: string;
+    lastUsedAt: number;
+    inFlight: number;
+    status: "connected" | "closed" | "needs-auth";
+    /** True once this needs-auth episode discarded the cached credential. */
+    credentialsInvalidated?: boolean;
+}
+type UiStreamListener = (serverName: string, notification: ServerStreamResultPatchNotification["params"]) => void;
+type MetadataListChangedListener = (serverName: string, reason: string) => void;
+export type ToolRefreshResult = "updated" | "unchanged" | "superseded" | "refresh-timeout";
+export declare class McpServerManager {
+    private connections;
+    private connectPromises;
+    private reconnectPromises;
+    private uiStreamListeners;
+    private samplingConfig;
+    private metadataListChangedListener;
+    private pendingMetadataPublications;
+    private elicitationConfig;
+    private authStorageOptions;
+    private oauthRuntime;
+    private acceptedUrlElicitations;
+    private defaultRequestTimeoutMs;
+    private runtimeSignal;
+    private closePromises;
+    private closeGenerations;
+    private connectAttempts;
+    private traceSettings;
+    private traceWriter;
+    private stopped;
+    private readonly defaultCwd;
+    /** Default cwd for stdio servers without an explicit config `cwd`. */
+    constructor(defaultCwd?: string);
+    setSamplingConfig(config: ServerSamplingConfig | undefined): void;
+    setMetadataListChangedListener(listener: MetadataListChangedListener | undefined): void;
+    publishMetadataChanged(name: string, expectedConnection: ServerConnection, reason: string): boolean;
+    setElicitationConfig(config: ServerElicitationConfig | undefined): void;
+    setRuntimeSignal(signal: AbortSignal | undefined): void;
+    setDefaultRequestTimeoutMs(timeoutMs: number | undefined): void;
+    setTraceConfig(settings: McpTraceSettings | undefined): void;
+    setAuthStorageOptions(options: AuthStorageOptions): void;
+    setOAuthRuntime(runtime: McpOAuthRuntime): void;
+    getRequestOptions(name: string, signal?: AbortSignal): RequestOptions | undefined;
+    private getResolvedRequestTimeoutMs;
+    private buildRequestOptions;
+    connect(name: string, definition: ServerDefinition, signal?: AbortSignal): Promise<ServerConnection>;
+    /**
+     * Reconnect a server whose connection was proven stale (e.g. by a 404
+     * "session no longer exists" response). Single-flight per server name —
+     * concurrent callers that raced to the same failure share one reconnect —
+     * and identity-guarded: `staleConnection` is only torn down if it is
+     * still the manager's current connection for `name`. If a concurrent
+     * reconnect (or an unrelated connect()) already replaced it with a fresh
+     * connection, that fresh connection is returned untouched.
+     */
+    reconnect(name: string, definition: ServerDefinition, staleConnection: ServerConnection, signal?: AbortSignal): Promise<ServerConnection>;
+    /**
+     * Fetch the authoritative tool catalog for a connection that still appears
+     * connected. The SDK response cache is explicitly bypassed so this request
+     * also proves the remote Streamable HTTP session is usable. Results are
+     * identity-guarded: a late response from a replaced connection is ignored.
+     */
+    refreshTools(name: string, expectedConnection: ServerConnection, signal?: AbortSignal): Promise<ToolRefreshResult>;
+    private retryPendingMetadataPublication;
+    private doReconnect;
+    private createConnection;
+    private enrichHttpConnectionError;
+    private connectClientWithAbort;
+    private buildClientCapabilities;
+    private createClient;
+    private handleToolsListChanged;
+    private handlePromptsListChanged;
+    private handleResourcesListChanged;
+    handleUrlElicitationRequired(serverName: string, error: UrlElicitationRequiredError): Promise<"accept" | "decline" | "cancel">;
+    private rememberUrlElicitation;
+    private connectHttpClient;
+    private fetchAllTools;
+    private fetchAllPrompts;
+    private fetchAllResources;
+    private attachAdapterNotificationHandlers;
+    registerUiStreamListener(streamToken: string, listener: UiStreamListener): void;
+    removeUiStreamListener(streamToken: string): void;
+    getPrompt(name: string, promptName: string, args?: Record<string, string>, signal?: AbortSignal): Promise<GetPromptResult>;
+    readResource(name: string, uri: string, signal?: AbortSignal): Promise<ReadResourceResult>;
+    close(name: string): Promise<void>;
+    closeIfCurrent(name: string, expected: ServerConnection): Promise<boolean>;
+    private disposeConnection;
+    closeAll(): Promise<void>;
+    private containsCleanupFailure;
+    isConnecting(name: string): boolean;
+    getConnection(name: string): ServerConnection | undefined;
+    getAllConnections(): Map<string, ServerConnection>;
+    touch(name: string): void;
+    incrementInFlight(name: string): void;
+    decrementInFlight(name: string): void;
+    isIdle(name: string, timeoutMs: number): boolean;
+}
+export {};
+//# sourceMappingURL=server-manager.d.ts.map

package/dist/extensions/mcp/server-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-manager.d.ts","sourceRoot":"","sources":["../../../src/extensions/mcp/server-manager.ts"],"names":[],"mappings":"AAEA,OAAO,EAEN,MAAM,EACN,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EAOnB,KAAK,2BAA2B,EAEhC,MAAM,8BAA8B,CAAC;AAItC,OAAO,EAGN,KAAK,uBAAuB,EAC5B,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,KAAK,kBAAkB,EAA4B,MAAM,eAAe,CAAC;AAClF,OAAO,EAAsB,KAAK,eAAe,EAAiB,MAAM,oBAAoB,CAAC;AAe7F,OAAO,EAA2B,KAAK,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAEN,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,KAAK,gBAAgB,EAErB,KAAK,gBAAgB,EACrB,KAAK,mCAAmC,EAExC,KAAK,SAAS,EACd,MAAM,YAAY,CAAC;AAqEpB,MAAM,WAAW,gBAAgB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,SAAS,CAAC;IACrB,UAAU,EAAE,gBAAgB,CAAC;IAC7B,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,WAAW,EAAE,CAAC;IACzB,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,iEAAiE;IACjE,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,YAAY,CAAC;IAC9C,yEAAyE;IACzE,sBAAsB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,KAAK,gBAAgB,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,mCAAmC,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;AAClH,KAAK,2BAA2B,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;AAEhF,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,GAAG,iBAAiB,CAAC;AAI3F,qBAAa,gBAAgB;IAC5B,OAAO,CAAC,WAAW,CAAuC;IAC1D,OAAO,CAAC,eAAe,CAAgD;IACvE,OAAO,CAAC,iBAAiB,CAAgD;IACzE,OAAO,CAAC,iBAAiB,CAAuC;IAChE,OAAO,CAAC,cAAc,CAAmC;IACzD,OAAO,CAAC,2BAA2B,CAA0C;IAC7E,OAAO,CAAC,2BAA2B,CAAuE;IAC1G,OAAO,CAAC,iBAAiB,CAAsC;IAC/D,OAAO,CAAC,kBAAkB,CAA0B;IACpD,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,uBAAuB,CAAkC;IACjE,OAAO,CAAC,uBAAuB,CAAqB;IACpD,OAAO,CAAC,aAAa,CAA0B;IAC/C,OAAO,CAAC,aAAa,CAAoC;IACzD,OAAO,CAAC,gBAAgB,CAA6B;IACrD,OAAO,CAAC,eAAe,CAAsC;IAC7D,OAAO,CAAC,aAAa,CAA+B;IACpD,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAEhD,sEAAsE;IACtE,YAAY,UAAU,CAAC,EAAE,MAAM,EAE9B;IAED,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,GAAG,SAAS,GAAG,IAAI,CAEhE;IAED,8BAA8B,CAAC,QAAQ,EAAE,2BAA2B,GAAG,SAAS,GAAG,IAAI,CAEtF;IAED,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAalG;IAED,oBAAoB,CAAC,MAAM,EAAE,uBAAuB,GAAG,SAAS,GAAG,IAAI,CAEtE;IAED,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI,CAEtD;IAED,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAE9D;IAED,cAAc,CAAC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GAAG,IAAI,CAE3D;IAED,qBAAqB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAEvD;IAED,eAAe,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAE9C;IAED,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,cAAc,GAAG,SAAS,CAGhF;IAED,OAAO,CAAC,2BAA2B;IAOnC,OAAO,CAAC,mBAAmB;IAcrB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAoDzG;IAED;;;;;;;;OAQG;IACG,SAAS,CACd,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,gBAAgB,EAC5B,eAAe,EAAE,gBAAgB,EACjC,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,gBAAgB,CAAC,CAiB3B;IAED;;;;;OAKG;IACG,YAAY,CACjB,IAAI,EAAE,MAAM,EACZ,kBAAkB,EAAE,gBAAgB,EACpC,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAyE5B;IAED,OAAO,CAAC,+BAA+B;YASzB,WAAW;YAuBX,gBAAgB;YAyMhB,yBAAyB;YAUzB,sBAAsB;IA8BpC,OAAO,CAAC,uBAAuB;IAc/B,OAAO,CAAC,YAAY;IAqDpB,OAAO,CAAC,sBAAsB;IAmB9B,OAAO,CAAC,wBAAwB;IAmBhC,OAAO,CAAC,0BAA0B;IAkB5B,4BAA4B,CACjC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,2BAA2B,GAChC,OAAO,CAAC,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC,CAc1C;IAED,OAAO,CAAC,sBAAsB;YAUhB,iBAAiB;YAoKjB,aAAa;YAab,eAAe;YAyBf,iBAAiB;IAyB/B,OAAO,CAAC,iCAAiC;IAYzC,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAE9E;IAED,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAEhD;IAEK,SAAS,CACd,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,eAAe,CAAC,CAgB1B;IAEK,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAiB/F;IAEK,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiCvC;IAEK,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAI/E;YAEa,iBAAiB;IAUzB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CA2B9B;IAED,OAAO,CAAC,sBAAsB;IAgB9B,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAElC;IAED,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAExD;IAED,iBAAiB,IAAI,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAEjD;IAED,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAKxB;IAED,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAKpC;IAED,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAKpC;IAED,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAK/C;CACD","sourcesContent":["import { mkdirSync } from \"node:fs\";\nimport { isDeepStrictEqual } from \"node:util\";\nimport {\n\ttype CacheableRequestOptions,\n\tClient,\n\ttype GetPromptResult,\n\ttype ReadResourceResult,\n\ttype RequestOptions,\n\tSdkError,\n\tSdkErrorCode,\n\tSdkHttpError,\n\tSSEClientTransport,\n\tStreamableHTTPClientTransport,\n\tUnauthorizedError,\n\ttype UrlElicitationRequiredError,\n\ttype VersionNegotiationOptions,\n} from \"@modelcontextprotocol/client\";\nimport { StdioClientTransport } from \"@modelcontextprotocol/client/stdio\";\nimport { VERSION } from \"../../config.ts\";\nimport { abortable, throwIfAborted } from \"./abort.ts\";\nimport {\n\thandleUrlElicitation,\n\tregisterElicitationHandler,\n\ttype ServerElicitationConfig,\n} from \"./elicitation-handler.ts\";\nimport { createJsonSchemaValidator } from \"./json-schema-validator.ts\";\nimport { logger } from \"./logger.ts\";\nimport { type AuthStorageOptions, invalidateAuthEntryCache } from \"./mcp-auth.ts\";\nimport { extractOAuthConfig, type McpOAuthRuntime, supportsOAuth } from \"./mcp-auth-flow.ts\";\nimport { getBearerTokenForUrl } from \"./mcp-bearer-store.ts\";\nimport { McpOAuthProvider } from \"./mcp-oauth-provider.ts\";\nimport { probeMcpEndpoint } from \"./mcp-probe.ts\";\nimport {\n\tcreateMcpTraceWriter,\n\tisMcpTraceEnabled,\n\ttype McpTraceObserver,\n\ttype McpTraceWriter,\n\ttraceTransportKind,\n\twrapTransportWithMcpTrace,\n} from \"./mcp-trace.ts\";\nimport { resolveNpxBinary } from \"./npx-resolver.ts\";\nimport { createRequestHeadersCommandFetch } from \"./request-headers-command.ts\";\nimport { combineAbortSignals } from \"./runtime-owner.ts\";\nimport { registerSamplingHandler, type ServerSamplingConfig } from \"./sampling-handler.ts\";\nimport {\n\tisServerDisabled,\n\ttype McpPrompt,\n\ttype McpResource,\n\ttype McpTool,\n\ttype McpTraceSettings,\n\tSERVER_STREAM_RESULT_PATCH_METHOD,\n\ttype ServerDefinition,\n\ttype ServerStreamResultPatchNotification,\n\tserverStreamResultPatchNotificationSchema,\n\ttype Transport,\n} from \"./types.ts\";\nimport { UnixSocketClientTransport } from \"./unix-socket-transport.ts\";\nimport {\n\tinterpolateEnvVars,\n\tresolveBearerToken,\n\tresolveCommandSecret,\n\tresolveCommandSecretsRecord,\n\tresolveConfigPath,\n\tresolveServerUrl,\n} from \"./utils.ts\";\n\nconst MAX_CAPTURED_STDERR_BYTES = 8 * 1024;\nconst MAX_CAPTURED_STDERR_LINES = 3;\nconst abortCleanupPromises = new WeakMap<object, Promise<void>>();\n\ntype HttpAuthProviderState =\n\t| { status: \"disabled\" }\n\t| { status: \"implicit-deferred\" }\n\t| { status: \"explicit\"; provider: McpOAuthProvider }\n\t| { status: \"implicit-challenged\"; provider: McpOAuthProvider };\n\nfunction isUnauthorizedHttpError(error: unknown): boolean {\n\treturn error instanceof UnauthorizedError || (error instanceof SdkHttpError && error.status === 401);\n}\n\nfunction shouldFallbackToSse(error: unknown, definition: ServerDefinition): boolean {\n\tif (definition.protocolVersion === \"2026-07-28\") return false;\n\treturn error instanceof SdkHttpError && [404, 405, 406, 415].includes(error.status);\n}\n\nfunction resolveVersionNegotiation(definition: ServerDefinition): VersionNegotiationOptions | undefined {\n\tswitch (definition.protocolVersion) {\n\t\tcase undefined:\n\t\tcase \"legacy\":\n\t\t\treturn undefined;\n\t\tcase \"auto\":\n\t\t\treturn { mode: \"auto\" };\n\t\tcase \"2026-07-28\":\n\t\t\treturn { mode: { pin: \"2026-07-28\" } };\n\t\tdefault:\n\t\t\tthrow new Error(`Invalid MCP protocolVersion: ${String(definition.protocolVersion)}`);\n\t}\n}\n\nfunction boundedStderrChunk(chunk: Buffer | string): Buffer {\n\tif (Buffer.isBuffer(chunk)) {\n\t\tconst start = Math.max(0, chunk.byteLength - MAX_CAPTURED_STDERR_BYTES);\n\t\treturn Buffer.from(chunk.subarray(start));\n\t}\n\n\t// Limit string conversion before encoding; Buffer.from(largeString) would\n\t// otherwise allocate the entire stderr event before applying the cap.\n\tconst suffix = chunk.length > MAX_CAPTURED_STDERR_BYTES ? chunk.slice(-MAX_CAPTURED_STDERR_BYTES) : chunk;\n\tconst bytes = Buffer.from(suffix, \"utf8\");\n\treturn bytes.byteLength > MAX_CAPTURED_STDERR_BYTES\n\t\t? Buffer.from(bytes.subarray(bytes.byteLength - MAX_CAPTURED_STDERR_BYTES))\n\t\t: bytes;\n}\n\nfunction appendStderrTail(tail: Buffer, chunk: Buffer | string): Buffer {\n\tconst bytes = boundedStderrChunk(chunk);\n\tif (bytes.length === 0) return tail;\n\tif (tail.length === 0) return bytes;\n\tconst combined = Buffer.concat([tail, bytes]);\n\treturn combined.length > MAX_CAPTURED_STDERR_BYTES\n\t\t? Buffer.from(combined.subarray(combined.length - MAX_CAPTURED_STDERR_BYTES))\n\t\t: combined;\n}\n\nexport interface ServerConnection {\n\tclient: Client;\n\ttransport: Transport;\n\tdefinition: ServerDefinition;\n\ttools: McpTool[];\n\t/** Monotonic guard against older refresh responses replacing newer notifications. */\n\ttoolsRevision?: number;\n\tresources: McpResource[];\n\tprompts: McpPrompt[];\n\t/** True when prompts were advertised but prompts/list failed. */\n\tpromptDiscoveryFailed?: boolean;\n\tinstructions?: string;\n\tlastUsedAt: number;\n\tinFlight: number;\n\tstatus: \"connected\" | \"closed\" | \"needs-auth\";\n\t/** True once this needs-auth episode discarded the cached credential. */\n\tcredentialsInvalidated?: boolean;\n}\n\ntype UiStreamListener = (serverName: string, notification: ServerStreamResultPatchNotification[\"params\"]) => void;\ntype MetadataListChangedListener = (serverName: string, reason: string) => void;\n\nexport type ToolRefreshResult = \"updated\" | \"unchanged\" | \"superseded\" | \"refresh-timeout\";\n\nconst KEEP_ALIVE_REFRESH_TIMEOUT_MS = 5_000;\n\nexport class McpServerManager {\n\tprivate connections = new Map<string, ServerConnection>();\n\tprivate connectPromises = new Map<string, Promise<ServerConnection>>();\n\tprivate reconnectPromises = new Map<string, Promise<ServerConnection>>();\n\tprivate uiStreamListeners = new Map<string, UiStreamListener>();\n\tprivate samplingConfig: ServerSamplingConfig | undefined;\n\tprivate metadataListChangedListener: MetadataListChangedListener | undefined;\n\tprivate pendingMetadataPublications = new Map<string, { connection: ServerConnection; reason: string }>();\n\tprivate elicitationConfig: ServerElicitationConfig | undefined;\n\tprivate authStorageOptions: AuthStorageOptions = {};\n\tprivate oauthRuntime: McpOAuthRuntime | undefined;\n\tprivate acceptedUrlElicitations = new Map<string, Set<string>>();\n\tprivate defaultRequestTimeoutMs: number | undefined;\n\tprivate runtimeSignal: AbortSignal | undefined;\n\tprivate closePromises = new Map<string, Promise<void>>();\n\tprivate closeGenerations = new Map<string, number>();\n\tprivate connectAttempts = new Map<string, AbortController>();\n\tprivate traceSettings: McpTraceSettings | undefined;\n\tprivate traceWriter: McpTraceWriter | undefined;\n\tprivate stopped = false;\n\tprivate readonly defaultCwd: string | undefined;\n\n\t/** Default cwd for stdio servers without an explicit config `cwd`. */\n\tconstructor(defaultCwd?: string) {\n\t\tthis.defaultCwd = defaultCwd;\n\t}\n\n\tsetSamplingConfig(config: ServerSamplingConfig | undefined): void {\n\t\tthis.samplingConfig = config;\n\t}\n\n\tsetMetadataListChangedListener(listener: MetadataListChangedListener | undefined): void {\n\t\tthis.metadataListChangedListener = listener;\n\t}\n\n\tpublishMetadataChanged(name: string, expectedConnection: ServerConnection, reason: string): boolean {\n\t\tconst current = this.connections.get(name);\n\t\tif (current !== expectedConnection || current.status !== \"connected\") return false;\n\t\ttry {\n\t\t\tthis.metadataListChangedListener?.(name, reason);\n\t\t\tthis.pendingMetadataPublications.delete(name);\n\t\t\treturn true;\n\t\t} catch (error) {\n\t\t\tthis.pendingMetadataPublications.set(name, { connection: expectedConnection, reason });\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tlogger.debug(`MCP: metadata publication failed for ${name}; queued for retry: ${message}`);\n\t\t\treturn false;\n\t\t}\n\t}\n\n\tsetElicitationConfig(config: ServerElicitationConfig | undefined): void {\n\t\tthis.elicitationConfig = config;\n\t}\n\n\tsetRuntimeSignal(signal: AbortSignal | undefined): void {\n\t\tthis.runtimeSignal = signal;\n\t}\n\n\tsetDefaultRequestTimeoutMs(timeoutMs: number | undefined): void {\n\t\tthis.defaultRequestTimeoutMs = normalizeRequestTimeoutMs(timeoutMs);\n\t}\n\n\tsetTraceConfig(settings: McpTraceSettings | undefined): void {\n\t\tthis.traceSettings = settings;\n\t}\n\n\tsetAuthStorageOptions(options: AuthStorageOptions): void {\n\t\tthis.authStorageOptions = options;\n\t}\n\n\tsetOAuthRuntime(runtime: McpOAuthRuntime): void {\n\t\tthis.oauthRuntime = runtime;\n\t}\n\n\tgetRequestOptions(name: string, signal?: AbortSignal): RequestOptions | undefined {\n\t\tconst connection = this.connections.get(name);\n\t\treturn this.buildRequestOptions(connection?.definition, signal);\n\t}\n\n\tprivate getResolvedRequestTimeoutMs(definition?: ServerDefinition): number | undefined {\n\t\tif (definition?.requestTimeoutMs !== undefined) {\n\t\t\treturn normalizeRequestTimeoutMs(definition.requestTimeoutMs);\n\t\t}\n\t\treturn this.defaultRequestTimeoutMs;\n\t}\n\n\tprivate buildRequestOptions(definition?: ServerDefinition, signal?: AbortSignal): RequestOptions | undefined {\n\t\tconst timeout = this.getResolvedRequestTimeoutMs(definition);\n\t\tconst ownedSignal = combineAbortSignals(this.runtimeSignal, signal);\n\n\t\tif (!ownedSignal && timeout === undefined) {\n\t\t\treturn undefined;\n\t\t}\n\n\t\treturn {\n\t\t\t...(ownedSignal ? { signal: ownedSignal } : {}),\n\t\t\t...(timeout !== undefined ? { timeout } : {}),\n\t\t};\n\t}\n\n\tasync connect(name: string, definition: ServerDefinition, signal?: AbortSignal): Promise<ServerConnection> {\n\t\tif (isServerDisabled(definition)) throw new Error(`MCP server \"${name}\" is disabled`);\n\t\tif (this.stopped) throw new Error(\"MCP server manager is closed\");\n\t\tconst ownedSignal = combineAbortSignals(this.runtimeSignal, signal);\n\t\tthrowIfAborted(ownedSignal);\n\t\tconst closing = this.closePromises.get(name);\n\t\tif (closing) await abortable(closing, ownedSignal);\n\t\tthrowIfAborted(ownedSignal);\n\n\t\t// Dedupe concurrent connection attempts.\n\t\tif (this.connectPromises.has(name)) {\n\t\t\treturn abortable(this.connectPromises.get(name)!, ownedSignal);\n\t\t}\n\n\t\tconst existing = this.connections.get(name);\n\t\tif (existing?.status === \"connected\") {\n\t\t\texisting.lastUsedAt = Date.now();\n\t\t\treturn existing;\n\t\t}\n\n\t\tconst credentialsInvalidated = existing?.status === \"needs-auth\" && existing.credentialsInvalidated === true;\n\t\tconst generation = this.closeGenerations.get(name) ?? 0;\n\t\tconst attemptController = new AbortController();\n\t\tconst attemptSignal = combineAbortSignals(ownedSignal, attemptController.signal);\n\t\tconst connectionAttempt = this.createConnection(\n\t\t\tname,\n\t\t\tdefinition,\n\t\t\tattemptSignal,\n\t\t\townedSignal,\n\t\t\tcredentialsInvalidated,\n\t\t);\n\t\tconst promise = definition.url\n\t\t\t? connectionAttempt.catch(async (error) => {\n\t\t\t\t\tthrow await this.enrichHttpConnectionError(definition, error);\n\t\t\t\t})\n\t\t\t: connectionAttempt;\n\t\tthis.connectPromises.set(name, promise);\n\t\tthis.connectAttempts.set(name, attemptController);\n\n\t\ttry {\n\t\t\tconst connection = await promise;\n\t\t\tif (attemptController.signal.aborted || (this.closeGenerations.get(name) ?? 0) !== generation) {\n\t\t\t\tawait this.disposeConnection(connection);\n\t\t\t\tthrowIfAborted(attemptSignal);\n\t\t\t\tthrow new Error(`MCP connection for ${name} was closed while connecting`);\n\t\t\t}\n\t\t\tthis.connections.set(name, connection);\n\t\t\treturn connection;\n\t\t} finally {\n\t\t\tif (this.connectPromises.get(name) === promise) this.connectPromises.delete(name);\n\t\t\tif (this.connectAttempts.get(name) === attemptController) this.connectAttempts.delete(name);\n\t\t}\n\t}\n\n\t/**\n\t * Reconnect a server whose connection was proven stale (e.g. by a 404\n\t * \"session no longer exists\" response). Single-flight per server name —\n\t * concurrent callers that raced to the same failure share one reconnect —\n\t * and identity-guarded: `staleConnection` is only torn down if it is\n\t * still the manager's current connection for `name`. If a concurrent\n\t * reconnect (or an unrelated connect()) already replaced it with a fresh\n\t * connection, that fresh connection is returned untouched.\n\t */\n\tasync reconnect(\n\t\tname: string,\n\t\tdefinition: ServerDefinition,\n\t\tstaleConnection: ServerConnection,\n\t\tsignal?: AbortSignal,\n\t): Promise<ServerConnection> {\n\t\tif (isServerDisabled(definition)) throw new Error(`MCP server \"${name}\" is disabled`);\n\t\tif (this.stopped) throw new Error(\"MCP server manager is closed\");\n\t\tconst ownedSignal = combineAbortSignals(this.runtimeSignal, signal);\n\t\tthrowIfAborted(ownedSignal);\n\t\tconst inFlight = this.reconnectPromises.get(name);\n\t\tif (inFlight) {\n\t\t\treturn abortable(inFlight, ownedSignal);\n\t\t}\n\n\t\tconst promise = this.doReconnect(name, definition, staleConnection, ownedSignal).finally(() => {\n\t\t\tif (this.reconnectPromises.get(name) === promise) {\n\t\t\t\tthis.reconnectPromises.delete(name);\n\t\t\t}\n\t\t});\n\t\tthis.reconnectPromises.set(name, promise);\n\t\treturn abortable(promise, ownedSignal);\n\t}\n\n\t/**\n\t * Fetch the authoritative tool catalog for a connection that still appears\n\t * connected. The SDK response cache is explicitly bypassed so this request\n\t * also proves the remote Streamable HTTP session is usable. Results are\n\t * identity-guarded: a late response from a replaced connection is ignored.\n\t */\n\tasync refreshTools(\n\t\tname: string,\n\t\texpectedConnection: ServerConnection,\n\t\tsignal?: AbortSignal,\n\t): Promise<ToolRefreshResult> {\n\t\tif (this.stopped) throw new Error(\"MCP server manager is closed\");\n\t\tconst ownedSignal = combineAbortSignals(this.runtimeSignal, signal);\n\t\tthrowIfAborted(ownedSignal);\n\n\t\tconst current = this.connections.get(name);\n\t\tif (current !== expectedConnection || current.status !== \"connected\") {\n\t\t\treturn \"superseded\";\n\t\t}\n\n\t\tconst requestOptions = this.buildRequestOptions(expectedConnection.definition, signal);\n\t\tconst timeout = Math.min(requestOptions?.timeout ?? KEEP_ALIVE_REFRESH_TIMEOUT_MS, KEEP_ALIVE_REFRESH_TIMEOUT_MS);\n\t\tconst healthOptions = {\n\t\t\t...requestOptions,\n\t\t\ttimeout,\n\t\t};\n\t\tif (!expectedConnection.client.getServerCapabilities?.()?.tools) {\n\t\t\tawait expectedConnection.client.ping(healthOptions);\n\t\t\tthrowIfAborted(ownedSignal);\n\t\t\tif (this.connections.get(name) !== expectedConnection || expectedConnection.status !== \"connected\") {\n\t\t\t\treturn \"superseded\";\n\t\t\t}\n\t\t\tthis.retryPendingMetadataPublication(name, expectedConnection);\n\t\t\treturn \"unchanged\";\n\t\t}\n\n\t\tconst toolsRevision = expectedConnection.toolsRevision ?? 0;\n\t\tconst refreshSignal = combineAbortSignals(healthOptions.signal, AbortSignal.timeout(timeout));\n\t\tlet tools: McpTool[];\n\t\ttry {\n\t\t\ttools = await this.fetchAllTools(expectedConnection.client, {\n\t\t\t\t...healthOptions,\n\t\t\t\t...(refreshSignal ? { signal: refreshSignal } : {}),\n\t\t\t\tcacheMode: \"refresh\",\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tthrowIfAborted(ownedSignal);\n\t\t\tif (this.connections.get(name) !== expectedConnection || expectedConnection.status !== \"connected\") {\n\t\t\t\treturn \"superseded\";\n\t\t\t}\n\t\t\tif (error instanceof SdkError && error.code === SdkErrorCode.RequestTimeout) {\n\t\t\t\treturn \"refresh-timeout\";\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t\tthrowIfAborted(ownedSignal);\n\n\t\tif (this.connections.get(name) !== expectedConnection || expectedConnection.status !== \"connected\") {\n\t\t\treturn \"superseded\";\n\t\t}\n\t\tif ((expectedConnection.toolsRevision ?? 0) !== toolsRevision) {\n\t\t\treturn \"superseded\";\n\t\t}\n\n\t\tif (isDeepStrictEqual(expectedConnection.tools, tools)) {\n\t\t\tthis.retryPendingMetadataPublication(name, expectedConnection);\n\t\t\treturn \"unchanged\";\n\t\t}\n\n\t\tconst previousTools = expectedConnection.tools;\n\t\texpectedConnection.tools = tools;\n\t\texpectedConnection.toolsRevision = toolsRevision + 1;\n\t\ttry {\n\t\t\tawait this.metadataListChangedListener?.(name, \"keep-alive-refresh\");\n\t\t\tthis.pendingMetadataPublications.delete(name);\n\t\t} catch (error) {\n\t\t\tif (this.connections.get(name) === expectedConnection && expectedConnection.tools === tools) {\n\t\t\t\texpectedConnection.tools = previousTools;\n\t\t\t\texpectedConnection.toolsRevision = toolsRevision;\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t\treturn \"updated\";\n\t}\n\n\tprivate retryPendingMetadataPublication(name: string, connection: ServerConnection): void {\n\t\tconst pendingPublication = this.pendingMetadataPublications.get(name);\n\t\tif (pendingPublication?.connection !== connection) return;\n\t\tthis.metadataListChangedListener?.(name, pendingPublication.reason);\n\t\tif (this.pendingMetadataPublications.get(name) === pendingPublication) {\n\t\t\tthis.pendingMetadataPublications.delete(name);\n\t\t}\n\t}\n\n\tprivate async doReconnect(\n\t\tname: string,\n\t\tdefinition: ServerDefinition,\n\t\tstaleConnection: ServerConnection,\n\t\tsignal?: AbortSignal,\n\t): Promise<ServerConnection> {\n\t\tthrowIfAborted(signal);\n\t\tconst current = this.connections.get(name);\n\n\t\t// Never tear down a connection we didn't prove stale: if the map no\n\t\t// longer holds the connection we were asked to replace, someone else\n\t\t// already reconnected (or connected) first.\n\t\tif (current !== staleConnection) {\n\t\t\treturn current ?? this.connect(name, definition, signal);\n\t\t}\n\n\t\tconst staleInFlight = staleConnection.inFlight;\n\t\tawait this.close(name);\n\t\tconst fresh = await this.connect(name, definition, signal);\n\t\tfresh.inFlight = Math.max(fresh.inFlight, staleInFlight);\n\t\treturn fresh;\n\t}\n\n\tprivate async createConnection(\n\t\tname: string,\n\t\tdefinition: ServerDefinition,\n\t\tsignal?: AbortSignal,\n\t\trequestSignal?: AbortSignal,\n\t\tcredentialsInvalidated = false,\n\t): Promise<ServerConnection> {\n\t\tthrowIfAborted(signal);\n\n\t\tconst tracingEnabled = isMcpTraceEnabled(definition, this.traceSettings);\n\t\tif (tracingEnabled && !this.traceWriter) {\n\t\t\tthis.traceWriter = createMcpTraceWriter(this.defaultCwd, this.traceSettings ?? {});\n\t\t}\n\t\tconst traceWriter = tracingEnabled ? this.traceWriter : undefined;\n\t\tconst traceObserver: McpTraceObserver | undefined = traceWriter\n\t\t\t? { record: (event) => traceWriter.write(event) }\n\t\t\t: undefined;\n\n\t\tlet client: Client;\n\t\tlet transport: Transport;\n\t\tlet clientConnected = false;\n\t\tlet invalidated = credentialsInvalidated;\n\t\tlet transportAlreadyTraced = false;\n\t\tlet stderrTail: Buffer<ArrayBufferLike> = Buffer.alloc(0);\n\t\tconst configuredTransports = [definition.command, definition.url, definition.socket].filter(\n\t\t\t(value) => typeof value === \"string\" && value.length > 0,\n\t\t);\n\t\tif (configuredTransports.length !== 1) {\n\t\t\tthrow new Error(`Server ${name} must configure exactly one of command, url, or socket`);\n\t\t}\n\n\t\tconst requestOptions = this.buildRequestOptions(definition, requestSignal);\n\n\t\tif (definition.command) {\n\t\t\tclient = this.createClient(name, definition);\n\t\t\tlet command = definition.command;\n\t\t\tlet args = (definition.args ?? []).map(interpolateEnvVars);\n\n\t\t\tif (command === \"npx\" || command === \"npm\") {\n\t\t\t\tconst resolved = await resolveNpxBinary(command, args, signal);\n\t\t\t\tif (resolved) {\n\t\t\t\t\tcommand = resolved.isJs ? \"node\" : resolved.binPath;\n\t\t\t\t\targs = resolved.isJs ? [resolved.binPath, ...resolved.extraArgs] : resolved.extraArgs;\n\t\t\t\t\tlogger.debug(`${name} resolved to ${resolved.binPath} (skipping npm parent)`);\n\t\t\t\t}\n\t\t\t}\n\t\t\tthrowIfAborted(signal);\n\n\t\t\tif (definition.pluginDataDir) mkdirSync(definition.pluginDataDir, { recursive: true });\n\t\t\tconst cwd = resolveConfigPath(definition.cwd) ?? this.defaultCwd;\n\t\t\tconst stdioTransport = new StdioClientTransport({\n\t\t\t\tcommand,\n\t\t\t\targs,\n\t\t\t\tenv: resolveEnv(definition.env, name, definition.literalEnv === true),\n\t\t\t\t...(cwd !== undefined ? { cwd } : {}),\n\t\t\t\tstderr: definition.debug ? \"inherit\" : \"pipe\",\n\t\t\t});\n\t\t\t// Keep non-debug child diagnostics available for connection failures without\n\t\t\t// retaining an unbounded stream or changing the existing debug behavior.\n\t\t\tif (stdioTransport.stderr) {\n\t\t\t\tstdioTransport.stderr.on(\"data\", (chunk: Buffer | string) => {\n\t\t\t\t\tstderrTail = appendStderrTail(stderrTail, chunk);\n\t\t\t\t});\n\t\t\t}\n\t\t\ttransport = stdioTransport;\n\t\t} else if (definition.url) {\n\t\t\tconst httpConnection = await this.connectHttpClient(\n\t\t\t\tdefinition,\n\t\t\t\tname,\n\t\t\t\trequestOptions,\n\t\t\t\tsignal,\n\t\t\t\ttraceObserver,\n\t\t\t\tinvalidated,\n\t\t\t);\n\t\t\tclient = httpConnection.client;\n\t\t\ttransport = httpConnection.transport;\n\t\t\tinvalidated = httpConnection.credentialsInvalidated;\n\t\t\tif (httpConnection.status === \"needs-auth\") {\n\t\t\t\treturn {\n\t\t\t\t\tclient,\n\t\t\t\t\ttransport,\n\t\t\t\t\tdefinition,\n\t\t\t\t\ttools: [],\n\t\t\t\t\tresources: [],\n\t\t\t\t\tprompts: [],\n\t\t\t\t\tlastUsedAt: Date.now(),\n\t\t\t\t\tinFlight: 0,\n\t\t\t\t\tstatus: \"needs-auth\",\n\t\t\t\t\tcredentialsInvalidated: invalidated,\n\t\t\t\t};\n\t\t\t}\n\t\t\tclientConnected = true;\n\t\t\ttransportAlreadyTraced = traceObserver !== undefined;\n\t\t} else {\n\t\t\tclient = this.createClient(name, definition);\n\t\t\ttransport = new UnixSocketClientTransport(resolveConfigPath(definition.socket!)!);\n\t\t}\n\n\t\tif (traceObserver && !transportAlreadyTraced) {\n\t\t\tconst traceTransportKindValue = traceTransportKind(definition, transport);\n\t\t\ttransport = wrapTransportWithMcpTrace(transport, name, traceTransportKindValue, traceObserver);\n\t\t}\n\n\t\ttry {\n\t\t\tthrowIfAborted(signal);\n\t\t\tif (!clientConnected) {\n\t\t\t\tawait this.connectClientWithAbort(client, transport, requestOptions, signal);\n\t\t\t}\n\t\t\tthis.attachAdapterNotificationHandlers(name, client);\n\n\t\t\tconst instructions = client.getInstructions?.();\n\t\t\tconst connection: ServerConnection = {\n\t\t\t\tclient,\n\t\t\t\ttransport,\n\t\t\t\tdefinition,\n\t\t\t\ttools: [],\n\t\t\t\ttoolsRevision: 0,\n\t\t\t\tresources: [],\n\t\t\t\tprompts: [],\n\t\t\t\t...(instructions !== undefined ? { instructions } : {}),\n\t\t\t\tlastUsedAt: Date.now(),\n\t\t\t\tinFlight: 0,\n\t\t\t\tstatus: \"connected\",\n\t\t\t};\n\n\t\t\t// Reflect the SDK's own close signal in connection status, guarded by\n\t\t\t// identity so a stale connection's late close can never clobber a fresh\n\t\t\t// connection. The SDK client owns the transport callbacks.\n\t\t\tclient.onclose = () => {\n\t\t\t\tif (this.connections.get(name) === connection) {\n\t\t\t\t\tconnection.status = \"closed\";\n\t\t\t\t}\n\t\t\t};\n\n\t\t\t// Discover tools, resources, and prompts. Resource and prompt listing is\n\t\t\t// optional: only servers advertising the capability are queried.\n\t\t\tconst [tools, resources, promptResult] = await Promise.all([\n\t\t\t\tthis.fetchAllTools(client, requestOptions),\n\t\t\t\tthis.fetchAllResources(client, requestOptions),\n\t\t\t\tthis.fetchAllPrompts(client, requestOptions),\n\t\t\t]);\n\t\t\tconnection.tools = tools;\n\t\t\tconnection.resources = resources;\n\t\t\tconnection.prompts = promptResult.prompts;\n\t\t\tconnection.promptDiscoveryFailed = promptResult.failed;\n\n\t\t\treturn connection;\n\t\t} catch (error) {\n\t\t\t// If connectClientWithAbort closed the transport, await that exact close.\n\t\t\t// Otherwise the SDK client owns its transport and performs cleanup once.\n\t\t\tconst abortCleanup = abortCleanupPromises.get(transport);\n\t\t\tconst abortCleanupFailed =\n\t\t\t\terror instanceof AggregateError && error.message === \"MCP connection abort cleanup failed\";\n\t\t\tconst cleanupResults = abortCleanupFailed\n\t\t\t\t? []\n\t\t\t\t: await Promise.allSettled([abortCleanup ?? Promise.resolve().then(() => client.close())]);\n\t\t\tconst cleanupFailures = cleanupResults.flatMap((result) =>\n\t\t\t\tresult.status === \"rejected\" ? [result.reason] : [],\n\t\t\t);\n\t\t\tlet reportedError: unknown = error;\n\t\t\tif (cleanupFailures.length > 0) {\n\t\t\t\treportedError = new AggregateError([error, ...cleanupFailures], \"MCP connection setup failed\");\n\t\t\t}\n\n\t\t\t// A cleanup failure remains a setup failure rather than being hidden\n\t\t\t// behind needs-auth.\n\t\t\tif (isUnauthorizedHttpError(error) && supportsOAuth(definition) && cleanupFailures.length === 0) {\n\t\t\t\tif (!invalidated) {\n\t\t\t\t\tinvalidateAuthEntryCache(name);\n\t\t\t\t\tinvalidated = true;\n\t\t\t\t}\n\t\t\t\treturn {\n\t\t\t\t\tclient,\n\t\t\t\t\ttransport,\n\t\t\t\t\tdefinition,\n\t\t\t\t\ttools: [],\n\t\t\t\t\tresources: [],\n\t\t\t\t\tprompts: [],\n\t\t\t\t\tlastUsedAt: Date.now(),\n\t\t\t\t\tinFlight: 0,\n\t\t\t\t\tstatus: \"needs-auth\",\n\t\t\t\t\tcredentialsInvalidated: invalidated,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (stderrTail.length > 0) {\n\t\t\t\tconst stderrText = stderrTail.toString(\"utf8\").trim();\n\t\t\t\tconst lines = stderrText\n\t\t\t\t\t.split(/\\r?\\n/)\n\t\t\t\t\t.map((line) => line.trim())\n\t\t\t\t\t.filter(Boolean);\n\t\t\t\tif (lines.length > 0) {\n\t\t\t\t\tconst baseMessage = reportedError instanceof Error ? reportedError.message : String(reportedError);\n\t\t\t\t\tconst detail = lines.slice(-MAX_CAPTURED_STDERR_LINES).join(\" — \");\n\t\t\t\t\tthrow new Error(`${baseMessage} (${detail})`, { cause: reportedError });\n\t\t\t\t}\n\t\t\t}\n\t\t\tthrow reportedError;\n\t\t}\n\t}\n\n\tprivate async enrichHttpConnectionError(definition: ServerDefinition, error: unknown): Promise<Error> {\n\t\tconst originalMessage = error instanceof Error ? error.message : String(error);\n\t\ttry {\n\t\t\tconst probe = await probeMcpEndpoint(resolveServerUrl(definition)!);\n\t\t\treturn new Error(`${originalMessage} — probe: ${probe.classification}`, { cause: error });\n\t\t} catch {\n\t\t\treturn error instanceof Error ? error : new Error(originalMessage);\n\t\t}\n\t}\n\n\tprivate async connectClientWithAbort(\n\t\tclient: Client,\n\t\ttransport: Transport,\n\t\trequestOptions?: RequestOptions,\n\t\tsignal?: AbortSignal,\n\t): Promise<void> {\n\t\tthrowIfAborted(signal);\n\t\tlet abortCleanup: Promise<void> | undefined;\n\t\tconst closeTransport = () => {\n\t\t\tabortCleanup = Promise.resolve().then(() => transport.close());\n\t\t\tabortCleanupPromises.set(transport, abortCleanup);\n\t\t};\n\t\tsignal?.addEventListener(\"abort\", closeTransport, { once: true });\n\t\ttry {\n\t\t\tawait abortable(client.connect(transport, requestOptions), signal);\n\t\t\tawait abortCleanup;\n\t\t} catch (error) {\n\t\t\tif (abortCleanup) {\n\t\t\t\ttry {\n\t\t\t\t\tawait abortCleanup;\n\t\t\t\t} catch (cleanupError) {\n\t\t\t\t\tthrow new AggregateError([error, cleanupError], \"MCP connection abort cleanup failed\");\n\t\t\t\t}\n\t\t\t}\n\t\t\tthrow error;\n\t\t} finally {\n\t\t\tsignal?.removeEventListener(\"abort\", closeTransport);\n\t\t}\n\t}\n\n\tprivate buildClientCapabilities() {\n\t\treturn {\n\t\t\t...(this.samplingConfig ? { sampling: {} } : {}),\n\t\t\t...(this.elicitationConfig\n\t\t\t\t? {\n\t\t\t\t\t\telicitation: {\n\t\t\t\t\t\t\tform: {},\n\t\t\t\t\t\t\t...(this.elicitationConfig.allowUrl ? { url: {} } : {}),\n\t\t\t\t\t\t},\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t};\n\t}\n\n\tprivate createClient(serverName: string, definition: ServerDefinition): Client {\n\t\tconst capabilities = this.buildClientCapabilities();\n\t\tconst versionNegotiation = resolveVersionNegotiation(definition);\n\t\tlet client: Client;\n\t\tclient = new Client(\n\t\t\t{ name: `nexus-cli-mcp-${serverName}`, version: VERSION },\n\t\t\t{\n\t\t\t\tjsonSchemaValidator: createJsonSchemaValidator(),\n\t\t\t\t...(versionNegotiation ? { versionNegotiation } : {}),\n\t\t\t\t...(Object.keys(capabilities).length > 0 ? { capabilities } : {}),\n\t\t\t\tlistChanged: {\n\t\t\t\t\ttools: {\n\t\t\t\t\t\tonChanged: (error: Error | null, tools: McpTool[] | null) => {\n\t\t\t\t\t\t\tthis.handleToolsListChanged(serverName, client, error, tools);\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t\tresources: {\n\t\t\t\t\t\tonChanged: (error: Error | null, resources: McpResource[] | null) => {\n\t\t\t\t\t\t\tthis.handleResourcesListChanged(serverName, client, error, resources);\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t\tprompts: {\n\t\t\t\t\t\tonChanged: (error: Error | null, prompts: McpPrompt[] | null) => {\n\t\t\t\t\t\t\tthis.handlePromptsListChanged(serverName, client, error, prompts);\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t);\n\t\tif (this.samplingConfig) {\n\t\t\tregisterSamplingHandler(client, { ...this.samplingConfig, serverName });\n\t\t}\n\t\tif (this.elicitationConfig) {\n\t\t\tregisterElicitationHandler(client, {\n\t\t\t\t...this.elicitationConfig,\n\t\t\t\tserverName,\n\t\t\t\tonUrlAccepted: (elicitationId) => this.rememberUrlElicitation(serverName, elicitationId),\n\t\t\t});\n\t\t\tif (this.elicitationConfig.allowUrl) {\n\t\t\t\tclient.setNotificationHandler(\"notifications/elicitation/complete\", (notification) => {\n\t\t\t\t\tif (this.runtimeSignal?.aborted) return;\n\t\t\t\t\tconst accepted = this.acceptedUrlElicitations.get(serverName);\n\t\t\t\t\tif (!accepted?.delete(notification.params.elicitationId)) return;\n\t\t\t\t\tthis.elicitationConfig?.ui.notify(\n\t\t\t\t\t\t`MCP browser interaction for ${serverName} completed. You can retry the tool now.`,\n\t\t\t\t\t\t\"info\",\n\t\t\t\t\t);\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t\treturn client;\n\t}\n\n\tprivate handleToolsListChanged(\n\t\tserverName: string,\n\t\tclient: Client,\n\t\terror: Error | null,\n\t\ttools: McpTool[] | null,\n\t): void {\n\t\tif (error) {\n\t\t\tlogger.debug(`MCP: tools/list_changed refresh failed for ${serverName}: ${error.message}`);\n\t\t\treturn;\n\t\t}\n\t\tif (!tools) return;\n\t\tconst connection = this.connections.get(serverName);\n\t\tif (!connection || connection.client !== client || connection.status !== \"connected\") return;\n\t\tconnection.tools = tools;\n\t\tconnection.toolsRevision = (connection.toolsRevision ?? 0) + 1;\n\t\tthis.metadataListChangedListener?.(serverName, \"tools-list-changed\");\n\t\tthis.pendingMetadataPublications.delete(serverName);\n\t}\n\n\tprivate handlePromptsListChanged(\n\t\tserverName: string,\n\t\tclient: Client,\n\t\terror: Error | null,\n\t\tprompts: McpPrompt[] | null,\n\t): void {\n\t\tif (error) {\n\t\t\tlogger.debug(`MCP: prompts/list_changed refresh failed for ${serverName}: ${error.message}`);\n\t\t\treturn;\n\t\t}\n\t\tif (!prompts) return;\n\t\tconst connection = this.connections.get(serverName);\n\t\tif (!connection || connection.client !== client || connection.status !== \"connected\") return;\n\t\tconnection.prompts = prompts;\n\t\tconnection.promptDiscoveryFailed = false;\n\t\tthis.metadataListChangedListener?.(serverName, \"prompts-list-changed\");\n\t\tthis.pendingMetadataPublications.delete(serverName);\n\t}\n\n\tprivate handleResourcesListChanged(\n\t\tserverName: string,\n\t\tclient: Client,\n\t\terror: Error | null,\n\t\tresources: McpResource[] | null,\n\t): void {\n\t\tif (error) {\n\t\t\tlogger.debug(`MCP: resources/list_changed refresh failed for ${serverName}: ${error.message}`);\n\t\t\treturn;\n\t\t}\n\t\tif (!resources) return;\n\t\tconst connection = this.connections.get(serverName);\n\t\tif (!connection || connection.client !== client || connection.status !== \"connected\") return;\n\t\tconnection.resources = resources;\n\t\tthis.metadataListChangedListener?.(serverName, \"resources-list-changed\");\n\t\tthis.pendingMetadataPublications.delete(serverName);\n\t}\n\n\tasync handleUrlElicitationRequired(\n\t\tserverName: string,\n\t\terror: UrlElicitationRequiredError,\n\t): Promise<\"accept\" | \"decline\" | \"cancel\"> {\n\t\tif (this.runtimeSignal?.aborted || !this.elicitationConfig?.allowUrl) return \"cancel\";\n\t\tfor (const params of error.elicitations) {\n\t\t\tconst result = await handleUrlElicitation(\n\t\t\t\t{\n\t\t\t\t\t...this.elicitationConfig,\n\t\t\t\t\tserverName,\n\t\t\t\t\tonUrlAccepted: (elicitationId) => this.rememberUrlElicitation(serverName, elicitationId),\n\t\t\t\t},\n\t\t\t\tparams,\n\t\t\t);\n\t\t\tif (result.action !== \"accept\") return result.action;\n\t\t}\n\t\treturn \"accept\";\n\t}\n\n\tprivate rememberUrlElicitation(serverName: string, elicitationId: string): void {\n\t\tif (this.runtimeSignal?.aborted) return;\n\t\tlet accepted = this.acceptedUrlElicitations.get(serverName);\n\t\tif (!accepted) {\n\t\t\taccepted = new Set();\n\t\t\tthis.acceptedUrlElicitations.set(serverName, accepted);\n\t\t}\n\t\taccepted.add(elicitationId);\n\t}\n\n\tprivate async connectHttpClient(\n\t\tdefinition: ServerDefinition,\n\t\tserverName: string,\n\t\trequestOptions: RequestOptions | undefined,\n\t\tsignal?: AbortSignal,\n\t\ttraceObserver?: McpTraceObserver,\n\t\tcredentialsInvalidated = false,\n\t): Promise<{\n\t\tclient: Client;\n\t\ttransport: Transport;\n\t\tstatus: \"connected\" | \"needs-auth\";\n\t\tcredentialsInvalidated: boolean;\n\t}> {\n\t\tthrowIfAborted(signal);\n\t\tconst serverUrl = resolveServerUrl(definition)!;\n\t\tconst url = new URL(serverUrl);\n\n\t\t// Resolve secret commands only for this connection attempt, without\n\t\t// mutating the persisted configuration.\n\t\tconst hasCommandHeader = Object.values(definition.headers ?? {}).some(\n\t\t\t(value) => value.startsWith(\"!\") && !value.startsWith(\"!!\"),\n\t\t);\n\t\tconst headers =\n\t\t\tresolveCommandSecretsRecord(definition.headers, (key) => `MCP server \"${serverName}\" HTTP header \"${key}\"`) ??\n\t\t\t{};\n\n\t\t// Resolve bearer auth before creating requestInit so every attempted\n\t\t// transport receives the same headers.\n\t\tconst commandBearer =\n\t\t\tdefinition.bearerToken?.startsWith(\"!\") && !definition.bearerToken.startsWith(\"!!\")\n\t\t\t\t? definition.bearerToken\n\t\t\t\t: undefined;\n\t\tif (definition.auth === \"bearer\") {\n\t\t\tconst token = commandBearer\n\t\t\t\t? resolveCommandSecret(commandBearer, `MCP server \"${serverName}\" HTTP bearer token`)\n\t\t\t\t: (resolveBearerToken(definition) ??\n\t\t\t\t\t(definition.bearerToken === undefined &&\n\t\t\t\t\tdefinition.bearerTokenEnv === undefined &&\n\t\t\t\t\tdefinition.bearerTokenStore === true\n\t\t\t\t\t\t? getBearerTokenForUrl(serverName, serverUrl)\n\t\t\t\t\t\t: undefined));\n\t\t\tif (token) headers.Authorization = `Bearer ${token}`;\n\t\t}\n\n\t\tif (hasCommandHeader || commandBearer) {\n\t\t\ttry {\n\t\t\t\tnew Headers(headers);\n\t\t\t} catch {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Failed to resolve MCP server \"${serverName}\" HTTP command secret: command returned an invalid header value`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tconst requestInit = Object.keys(headers).length > 0 ? { headers } : undefined;\n\t\tconst requestFetch = definition.requestHeadersCommand\n\t\t\t? createRequestHeadersCommandFetch(definition.requestHeadersCommand)\n\t\t\t: undefined;\n\t\tconst createAuthProvider = (): McpOAuthProvider =>\n\t\t\tnew McpOAuthProvider(\n\t\t\t\tserverName,\n\t\t\t\tserverUrl,\n\t\t\t\textractOAuthConfig(definition),\n\t\t\t\t{ onRedirect: async () => {} },\n\t\t\t\tthis.authStorageOptions,\n\t\t\t\tthis.oauthRuntime?.signal,\n\t\t\t);\n\n\t\t// Explicit OAuth checks secure storage immediately. Implicit OAuth defers\n\t\t// provider construction until the server proves authentication is needed.\n\t\tlet authState: HttpAuthProviderState = supportsOAuth(definition)\n\t\t\t? definition.auth === undefined\n\t\t\t\t? { status: \"implicit-deferred\" }\n\t\t\t\t: { status: \"explicit\", provider: createAuthProvider() }\n\t\t\t: { status: \"disabled\" };\n\n\t\tconst attempt = async (\n\t\t\tkind: \"streamable-http\" | \"sse\",\n\t\t): Promise<\n\t\t\t| { status: \"connected\"; client: Client; transport: Transport }\n\t\t\t| { status: \"failed\"; client: Client; transport: Transport; error: unknown }\n\t\t> => {\n\t\t\tconst authProvider = \"provider\" in authState ? authState.provider : undefined;\n\t\t\tconst transportOptions = {\n\t\t\t\t...(requestInit !== undefined ? { requestInit } : {}),\n\t\t\t\t...(requestFetch !== undefined ? { fetch: requestFetch } : {}),\n\t\t\t\t...(authProvider !== undefined ? { authProvider } : {}),\n\t\t\t\t...(authProvider !== undefined &&\n\t\t\t\tdefinition.oauth !== false &&\n\t\t\t\tdefinition.oauth?.skipIssuerMetadataValidation === true\n\t\t\t\t\t? { skipIssuerMetadataValidation: true }\n\t\t\t\t\t: {}),\n\t\t\t};\n\t\t\tconst baseTransport: Transport =\n\t\t\t\tkind === \"streamable-http\"\n\t\t\t\t\t? new StreamableHTTPClientTransport(url, transportOptions)\n\t\t\t\t\t: new SSEClientTransport(url, transportOptions);\n\t\t\tconst transport = traceObserver\n\t\t\t\t? wrapTransportWithMcpTrace(baseTransport, serverName, kind, traceObserver)\n\t\t\t\t: baseTransport;\n\t\t\tconst client = this.createClient(serverName, definition);\n\n\t\t\ttry {\n\t\t\t\tawait this.connectClientWithAbort(client, transport, requestOptions, signal);\n\t\t\t\treturn { status: \"connected\", client, transport };\n\t\t\t} catch (error) {\n\t\t\t\tconst abortCleanupFailed =\n\t\t\t\t\terror instanceof AggregateError && error.message === \"MCP connection abort cleanup failed\";\n\t\t\t\tif (!abortCleanupFailed) {\n\t\t\t\t\ttry {\n\t\t\t\t\t\tawait (abortCleanupPromises.get(transport) ?? client.close());\n\t\t\t\t\t} catch (cleanupError) {\n\t\t\t\t\t\tthrow new AggregateError([error, cleanupError], \"MCP HTTP connection cleanup failed\");\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\treturn { status: \"failed\", client, transport, error };\n\t\t\t}\n\t\t};\n\n\t\t// Connect the real client once. Retry Streamable HTTP only for an implicit\n\t\t// OAuth challenge; use SSE only for definitive endpoint incompatibility.\n\t\t// Agent Plugins set httpTransport, and their declared transport is used without fallback.\n\t\tlet kind: \"streamable-http\" | \"sse\" = definition.httpTransport ?? \"streamable-http\";\n\t\tlet invalidated = credentialsInvalidated;\n\t\tfor (;;) {\n\t\t\tconst result = await attempt(kind);\n\t\t\tif (result.status === \"connected\") return { ...result, credentialsInvalidated: invalidated };\n\t\t\tif (result.error instanceof AggregateError && result.error.message === \"MCP connection abort cleanup failed\") {\n\t\t\t\tthrow result.error;\n\t\t\t}\n\t\t\tif (signal?.aborted) throwIfAborted(signal);\n\n\t\t\tif (authState.status === \"implicit-deferred\" && isUnauthorizedHttpError(result.error)) {\n\t\t\t\tauthState = { status: \"implicit-challenged\", provider: createAuthProvider() };\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (isUnauthorizedHttpError(result.error)) {\n\t\t\t\tif (supportsOAuth(definition)) {\n\t\t\t\t\tif (!invalidated) {\n\t\t\t\t\t\tinvalidateAuthEntryCache(serverName);\n\t\t\t\t\t\tinvalidated = true;\n\t\t\t\t\t}\n\t\t\t\t\treturn {\n\t\t\t\t\t\tclient: result.client,\n\t\t\t\t\t\ttransport: result.transport,\n\t\t\t\t\t\tstatus: \"needs-auth\",\n\t\t\t\t\t\tcredentialsInvalidated: invalidated,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t\tthrow result.error;\n\t\t\t}\n\n\t\t\tif (\n\t\t\t\tdefinition.httpTransport === undefined &&\n\t\t\t\tkind === \"streamable-http\" &&\n\t\t\t\tshouldFallbackToSse(result.error, definition)\n\t\t\t) {\n\t\t\t\tkind = \"sse\";\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tthrow result.error;\n\t\t}\n\t}\n\n\tprivate async fetchAllTools(client: Client, requestOptions?: CacheableRequestOptions): Promise<McpTool[]> {\n\t\tconst allTools: McpTool[] = [];\n\t\tlet cursor: string | undefined;\n\n\t\tdo {\n\t\t\tconst result = await client.listTools(cursor ? { cursor } : undefined, requestOptions);\n\t\t\tallTools.push(...(result.tools ?? []));\n\t\t\tcursor = result.nextCursor;\n\t\t} while (cursor);\n\n\t\treturn allTools;\n\t}\n\n\tprivate async fetchAllPrompts(\n\t\tclient: Client,\n\t\trequestOptions?: RequestOptions,\n\t): Promise<{ prompts: McpPrompt[]; failed: boolean }> {\n\t\tconst capabilities = client.getServerCapabilities?.();\n\t\tif (!capabilities?.prompts) return { prompts: [], failed: false };\n\n\t\ttry {\n\t\t\tconst prompts: McpPrompt[] = [];\n\t\t\tlet cursor: string | undefined;\n\t\t\tdo {\n\t\t\t\tconst result = await client.listPrompts(cursor ? { cursor } : undefined, requestOptions);\n\t\t\t\tprompts.push(...(result.prompts ?? []));\n\t\t\t\tcursor = result.nextCursor;\n\t\t\t} while (cursor);\n\t\t\treturn { prompts, failed: false };\n\t\t} catch (error) {\n\t\t\tif (requestOptions?.signal?.aborted) throwIfAborted(requestOptions.signal);\n\t\t\tif (isUnauthorizedHttpError(error)) throw error;\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tlogger.debug(`MCP: prompts/list failed: ${message}`);\n\t\t\treturn { prompts: [], failed: true };\n\t\t}\n\t}\n\n\tprivate async fetchAllResources(client: Client, requestOptions?: RequestOptions): Promise<McpResource[]> {\n\t\tconst capabilities = client.getServerCapabilities?.();\n\t\tif (!capabilities?.resources) return [];\n\n\t\ttry {\n\t\t\tconst allResources: McpResource[] = [];\n\t\t\tlet cursor: string | undefined;\n\n\t\t\tdo {\n\t\t\t\tconst result = await client.listResources(cursor ? { cursor } : undefined, requestOptions);\n\t\t\t\tallResources.push(...(result.resources ?? []));\n\t\t\t\tcursor = result.nextCursor;\n\t\t\t} while (cursor);\n\n\t\t\treturn allResources;\n\t\t} catch (error) {\n\t\t\tif (requestOptions?.signal?.aborted) {\n\t\t\t\tthrowIfAborted(requestOptions.signal);\n\t\t\t}\n\t\t\tif (isUnauthorizedHttpError(error)) throw error;\n\t\t\t// The server advertises resources but the listing failed\n\t\t\treturn [];\n\t\t}\n\t}\n\n\tprivate attachAdapterNotificationHandlers(serverName: string, client: Client): void {\n\t\tclient.setNotificationHandler(\n\t\t\tSERVER_STREAM_RESULT_PATCH_METHOD,\n\t\t\t{ params: serverStreamResultPatchNotificationSchema.shape.params },\n\t\t\t(params) => {\n\t\t\t\tconst listener = this.uiStreamListeners.get(params.streamToken);\n\t\t\t\tif (!listener) return;\n\t\t\t\tlistener(serverName, params);\n\t\t\t},\n\t\t);\n\t}\n\n\tregisterUiStreamListener(streamToken: string, listener: UiStreamListener): void {\n\t\tthis.uiStreamListeners.set(streamToken, listener);\n\t}\n\n\tremoveUiStreamListener(streamToken: string): void {\n\t\tthis.uiStreamListeners.delete(streamToken);\n\t}\n\n\tasync getPrompt(\n\t\tname: string,\n\t\tpromptName: string,\n\t\targs?: Record<string, string>,\n\t\tsignal?: AbortSignal,\n\t): Promise<GetPromptResult> {\n\t\tconst connection = this.connections.get(name);\n\t\tif (!connection || connection.status !== \"connected\") {\n\t\t\tthrow new Error(`Server \"${name}\" is not connected`);\n\t\t}\n\t\ttry {\n\t\t\tthis.touch(name);\n\t\t\tthis.incrementInFlight(name);\n\t\t\treturn await connection.client.getPrompt(\n\t\t\t\t{ name: promptName, ...(args ? { arguments: args } : {}) },\n\t\t\t\tthis.getRequestOptions(name, signal),\n\t\t\t);\n\t\t} finally {\n\t\t\tthis.decrementInFlight(name);\n\t\t\tthis.touch(name);\n\t\t}\n\t}\n\n\tasync readResource(name: string, uri: string, signal?: AbortSignal): Promise<ReadResourceResult> {\n\t\tif (isServerDisabled(this.connections.get(name)?.definition)) {\n\t\t\tthrow new Error(`MCP server \"${name}\" is disabled`);\n\t\t}\n\t\tconst connection = this.connections.get(name);\n\t\tif (!connection || connection.status !== \"connected\") {\n\t\t\tthrow new Error(`Server \"${name}\" is not connected`);\n\t\t}\n\n\t\ttry {\n\t\t\tthis.touch(name);\n\t\t\tthis.incrementInFlight(name);\n\t\t\treturn await connection.client.readResource({ uri }, this.getRequestOptions(name, signal));\n\t\t} finally {\n\t\t\tthis.decrementInFlight(name);\n\t\t\tthis.touch(name);\n\t\t}\n\t}\n\n\tasync close(name: string): Promise<void> {\n\t\tthis.closeGenerations.set(name, (this.closeGenerations.get(name) ?? 0) + 1);\n\t\tthis.connectAttempts.get(name)?.abort(new Error(`MCP connection ${name} was closed`));\n\t\tthis.pendingMetadataPublications.delete(name);\n\n\t\tconst connection = this.connections.get(name);\n\t\tif (!connection) {\n\t\t\tconst pendingClose = this.closePromises.get(name);\n\t\t\tif (pendingClose) {\n\t\t\t\tawait pendingClose;\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tconst pendingConnect = this.connectPromises.get(name);\n\t\t\tif (pendingConnect) {\n\t\t\t\ttry {\n\t\t\t\t\tawait pendingConnect;\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (this.containsCleanupFailure(error)) throw error;\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\n\t\t// Delete before awaiting SDK cleanup so a replacement cannot be removed by\n\t\t// an old close operation finishing later.\n\t\tconnection.status = \"closed\";\n\t\tthis.connections.delete(name);\n\t\tthis.acceptedUrlElicitations.delete(name);\n\t\tconst closing = this.disposeConnection(connection).finally(() => {\n\t\t\tif (this.closePromises.get(name) === closing) this.closePromises.delete(name);\n\t\t});\n\t\tthis.closePromises.set(name, closing);\n\t\treturn closing;\n\t}\n\n\tasync closeIfCurrent(name: string, expected: ServerConnection): Promise<boolean> {\n\t\tif (this.connections.get(name) !== expected) return false;\n\t\tawait this.close(name);\n\t\treturn true;\n\t}\n\n\tprivate async disposeConnection(connection: ServerConnection): Promise<void> {\n\t\tconst results = await Promise.allSettled([\n\t\t\t// Only client.close() is needed; the client owns the transport and will close it internally.\n\t\t\tPromise.resolve().then(() => connection.client.close()),\n\t\t\tthis.traceWriter?.flush() ?? Promise.resolve(),\n\t\t]);\n\t\tconst failures = results.flatMap((result) => (result.status === \"rejected\" ? [result.reason] : []));\n\t\tif (failures.length > 0) throw new AggregateError(failures, \"MCP connection cleanup failed\");\n\t}\n\n\tasync closeAll(): Promise<void> {\n\t\tthis.stopped = true;\n\t\tconst names = new Set([...this.connections.keys(), ...this.connectPromises.keys()]);\n\t\tfor (const name of names) {\n\t\t\tthis.closeGenerations.set(name, (this.closeGenerations.get(name) ?? 0) + 1);\n\t\t\tthis.connectAttempts.get(name)?.abort(new Error(`MCP connection ${name} was closed`));\n\t\t}\n\n\t\tconst pendingConnects = [...this.connectPromises.values()];\n\t\tconst currentNames = [...this.connections.keys()];\n\t\tconst pendingResults = await Promise.allSettled(pendingConnects);\n\t\tconst results = await Promise.allSettled(currentNames.map((name) => this.close(name)));\n\n\t\t// A connect that resolved during the first close snapshot is still fenced;\n\t\t// close any handle that was already inserted before its attempt settled.\n\t\tconst lateNames = [...this.connections.keys()];\n\t\tconst lateResults = await Promise.allSettled(lateNames.map((name) => this.close(name)));\n\t\tconst failures = [...pendingResults, ...results, ...lateResults]\n\t\t\t.flatMap((result) => (result.status === \"rejected\" ? [result.reason] : []))\n\t\t\t.filter((error) => this.containsCleanupFailure(error));\n\t\tthis.uiStreamListeners.clear();\n\t\tthis.acceptedUrlElicitations.clear();\n\t\tthis.pendingMetadataPublications.clear();\n\t\tthis.samplingConfig = undefined;\n\t\tthis.elicitationConfig = undefined;\n\t\tawait this.traceWriter?.flush();\n\t\tif (failures.length > 0) throw new AggregateError(failures, \"MCP manager cleanup failed\");\n\t}\n\n\tprivate containsCleanupFailure(error: unknown): boolean {\n\t\tconst pending: unknown[] = [error];\n\t\tconst seen = new Set<unknown>();\n\t\twhile (pending.length > 0) {\n\t\t\tconst current = pending.pop();\n\t\t\tif (!(current instanceof Error) || seen.has(current)) continue;\n\t\t\tseen.add(current);\n\t\t\tif (current instanceof AggregateError) {\n\t\t\t\tif (/cleanup failed|setup failed/.test(current.message)) return true;\n\t\t\t\tpending.push(...current.errors);\n\t\t\t}\n\t\t\tif (current.cause !== undefined) pending.push(current.cause);\n\t\t}\n\t\treturn false;\n\t}\n\n\tisConnecting(name: string): boolean {\n\t\treturn this.connectPromises.has(name);\n\t}\n\n\tgetConnection(name: string): ServerConnection | undefined {\n\t\treturn this.connections.get(name);\n\t}\n\n\tgetAllConnections(): Map<string, ServerConnection> {\n\t\treturn new Map(this.connections);\n\t}\n\n\ttouch(name: string): void {\n\t\tconst connection = this.connections.get(name);\n\t\tif (connection) {\n\t\t\tconnection.lastUsedAt = Date.now();\n\t\t}\n\t}\n\n\tincrementInFlight(name: string): void {\n\t\tconst connection = this.connections.get(name);\n\t\tif (connection) {\n\t\t\tconnection.inFlight = (connection.inFlight ?? 0) + 1;\n\t\t}\n\t}\n\n\tdecrementInFlight(name: string): void {\n\t\tconst connection = this.connections.get(name);\n\t\tif (connection?.inFlight) {\n\t\t\tconnection.inFlight--;\n\t\t}\n\t}\n\n\tisIdle(name: string, timeoutMs: number): boolean {\n\t\tconst connection = this.connections.get(name);\n\t\tif (!connection || connection.status !== \"connected\") return false;\n\t\tif (connection.inFlight > 0) return false;\n\t\treturn Date.now() - connection.lastUsedAt > timeoutMs;\n\t}\n}\n\n/**\n * Resolve environment variables with interpolation.\n */\nfunction resolveEnv(\n\tenv: Record<string, string> | undefined,\n\tserverName: string,\n\tliteralEnv = false,\n): Record<string, string> {\n\tconst resolved: Record<string, string> = {};\n\tfor (const [key, value] of Object.entries(process.env)) {\n\t\tif (value !== undefined) resolved[key] = value;\n\t}\n\tif (literalEnv) return env ? { ...resolved, ...env } : resolved;\n\n\tconst overrides = resolveCommandSecretsRecord(env, (key) => `MCP server \"${serverName}\" stdio env \"${key}\"`);\n\treturn overrides ? { ...resolved, ...overrides } : resolved;\n}\n\nfunction normalizeRequestTimeoutMs(timeoutMs: number | undefined): number | undefined {\n\treturn typeof timeoutMs === \"number\" && Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : undefined;\n}\n"]}