@akon-labs/nexus-cli 0.1.9 → 0.1.11-rc.2

package/dist/extensions/mcp/commands.d.ts

@@ -0,0 +1,47 @@
+import type { ExtensionAPI, ExtensionContext } from "../../core/extensions/types.ts";
+import { type McpOAuthRuntime } from "./mcp-auth-flow.ts";
+import type { McpExtensionState } from "./state.ts";
+import { type McpAuthResult, type McpConfig, type ServerEntry } from "./types.ts";
+export declare function showStatus(state: McpExtensionState, ctx: ExtensionContext): Promise<void>;
+export declare function showPrompts(state: McpExtensionState, ctx: ExtensionContext): Promise<void>;
+export declare function showTools(state: McpExtensionState, ctx: ExtensionContext): Promise<void>;
+export declare function reconnectServer(state: McpExtensionState, ctx: ExtensionContext, name: string): Promise<boolean>;
+export declare function reconnectServers(state: McpExtensionState, ctx: ExtensionContext, targetServer?: string): Promise<void>;
+export declare function authenticateServer(serverName: string, config: McpConfig, ctx: ExtensionContext, signal?: AbortSignal, runtime?: McpOAuthRuntime, nexus?: ExtensionAPI): Promise<McpAuthResult>;
+export declare function logoutServer(serverName: string, state: McpExtensionState, ctx: ExtensionContext): Promise<{
+    ok: boolean;
+    message: string;
+}>;
+export declare function manageBearerToken(action: "set" | "remove" | "status", serverName: string, state: McpExtensionState, ctx: ExtensionContext): Promise<{
+    ok: boolean;
+    message: string;
+}>;
+type ParsedAddServer = {
+    ok: true;
+    name: string;
+    entry: ServerEntry;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Parses `/mcp add <name> ...` arguments. Mirrors the rest of /mcp's naive
+ * whitespace-split argument handling (no quoting support) rather than
+ * inventing a shell-quote parser just for this subcommand.
+ */
+export declare function parseAddServerArgs(argv: string[]): ParsedAddServer;
+export declare const ADD_SERVER_USAGE: string;
+/** Adds a server to the project's shared MCP config. Reused by both `/mcp add` and any UI entry point. */
+export declare function addCustomServer(cwd: string, name: string, entry: ServerEntry): {
+    path: string;
+};
+export interface PanelFlowResult {
+    configChanged: boolean;
+}
+export declare function openMcpSetup(state: McpExtensionState, nexus: ExtensionAPI, ctx: ExtensionContext, configOverridePath?: string, mode?: "empty" | "setup", options?: {
+    includeHostConfigs?: boolean;
+}): Promise<PanelFlowResult>;
+export declare function openMcpPanel(state: McpExtensionState, nexus: ExtensionAPI, ctx: ExtensionContext, configOverridePath?: string, onDirectToolsConfigChanged?: (changes: Map<string, true | string[] | false>) => void | Promise<void>): Promise<PanelFlowResult>;
+export declare function openMcpAuthPanel(state: McpExtensionState, nexus: ExtensionAPI, ctx: ExtensionContext, configOverridePath?: string): Promise<PanelFlowResult>;
+export {};
+//# sourceMappingURL=commands.d.ts.map

package/dist/extensions/mcp/commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../src/extensions/mcp/commands.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AA2BrF,OAAO,EAAgB,KAAK,eAAe,EAA6B,MAAM,oBAAoB,CAAC;AAWnG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,OAAO,EAGN,KAAK,aAAa,EAClB,KAAK,SAAS,EAGd,KAAK,WAAW,EAChB,MAAM,YAAY,CAAC;AAoBpB,wBAAsB,UAAU,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4C/F;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyChG;AAED,wBAAsB,SAAS,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAe9F;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA4ErH;AAED,wBAAsB,gBAAgB,CACrC,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,gBAAgB,EACrB,YAAY,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAcf;AAcD,wBAAsB,kBAAkB,CACvC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,gBAAgB,EACrB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,eAAe,EACzB,KAAK,CAAC,EAAE,YAAY,GAClB,OAAO,CAAC,aAAa,CAAC,CAkFxB;AAED,wBAAsB,YAAY,CACjC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,gBAAgB,GACnB,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA8C3C;AA8BD,wBAAsB,iBAAiB,CACtC,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,EACnC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,gBAAgB,GACnB,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAwC3C;AAED,KAAK,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAarG;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CAkFlE;AAED,eAAO,MAAM,gBAAgB,QAcjB,CAAC;AAEb,0GAA0G;AAC1G,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAG/F;AAED,MAAM,WAAW,eAAe;IAC/B,aAAa,EAAE,OAAO,CAAC;CACvB;AAuBD,wBAAsB,YAAY,CACjC,KAAK,EAAE,iBAAiB,EACxB,KAAK,EAAE,YAAY,EACnB,GAAG,EAAE,gBAAgB,EACrB,kBAAkB,CAAC,EAAE,MAAM,EAC3B,IAAI,GAAE,OAAO,GAAG,OAAiB,EACjC,OAAO,GAAE;IAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC5C,OAAO,CAAC,eAAe,CAAC,CAsI1B;AAsED,wBAAsB,YAAY,CACjC,KAAK,EAAE,iBAAiB,EACxB,KAAK,EAAE,YAAY,EACnB,GAAG,EAAE,gBAAgB,EACrB,kBAAkB,CAAC,EAAE,MAAM,EAC3B,0BAA0B,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAClG,OAAO,CAAC,eAAe,CAAC,CA4E1B;AAED,wBAAsB,gBAAgB,CACrC,KAAK,EAAE,iBAAiB,EACxB,KAAK,EAAE,YAAY,EACnB,GAAG,EAAE,gBAAgB,EACrB,kBAAkB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,eAAe,CAAC,CA2D1B","sourcesContent":["import type { OverlayHandle } from \"@earendil-works/pi-tui\";\nimport type { ExtensionAPI, ExtensionContext } from \"../../core/extensions/types.ts\";\nimport {\n\tensureCompatibilityImports,\n\tgetMcpDiscoverySummary,\n\tgetMcpStandardConfigSummary,\n\tgetProjectConfigPath,\n\tgetServerProvenance,\n\ttype KnownServerPreset,\n\tpreviewCompatibilityImports,\n\tpreviewSharedServerEntry,\n\tpreviewStarterProjectConfig,\n\twriteDirectToolsConfig,\n\twriteProjectServerDisabledOverride,\n\twriteSharedServerEntry,\n\twriteStarterProjectConfig,\n} from \"./config.ts\";\nimport {\n\tclearFailure,\n\tgetFailureAgeSeconds,\n\tgetFailureMessage,\n\tmarkKeepAliveAfterConnect,\n\tnotifyToolMetadataUpdated,\n\trecordFailure,\n\tupdateMetadataCache,\n\tupdateStatusBar,\n} from \"./init.ts\";\nimport { getAuthStorageOptions, inspectAuthForUrl } from \"./mcp-auth.ts\";\nimport { authenticate, type McpOAuthRuntime, removeAuth, supportsOAuth } from \"./mcp-auth-flow.ts\";\nimport { inspectBearerTokenForUrl, removeBearerToken } from \"./mcp-bearer-store.ts\";\nimport { createMcpPanel } from \"./mcp-panel.ts\";\nimport { createMcpSetupPanel } from \"./mcp-setup-panel.ts\";\nimport { loadMetadataCache, reconstructPromptMetadata } from \"./metadata-cache.ts\";\nimport {\n\tloadOnboardingState,\n\tmarkSharedConfigHintShown,\n\tmarkSetupCompleted as persistSetupCompleted,\n} from \"./onboarding-state.ts\";\nimport { isAbortError } from \"./runtime-owner.ts\";\nimport type { McpExtensionState } from \"./state.ts\";\nimport { buildToolMetadata } from \"./tool-metadata.ts\";\nimport {\n\ttype ImportKind,\n\tisServerDisabled,\n\ttype McpAuthResult,\n\ttype McpConfig,\n\ttype McpPanelCallbacks,\n\ttype McpPanelResult,\n\ttype ServerEntry,\n} from \"./types.ts\";\nimport { openPath, resolveServerUrl, sanitizeTerminalText } from \"./utils.ts\";\n\nfunction terminalHyperlink(label: string, url: string): string {\n\treturn `\\u001B]8;;${sanitizeTerminalText(url)}\\u001B\\\\${sanitizeTerminalText(label)}\\u001B]8;;\\u001B\\\\`;\n}\n\n/**\n * True when this run mode can display a `ctx.ui.custom()` overlay.\n *\n * `ctx.hasUI` only reports that *some* UI context is bound. In rpc/print mode\n * that context is a headless stub whose `custom()` returns immediately without\n * ever invoking the factory or the `done` callback, so a panel awaited through\n * `new Promise(resolve => ctx.ui.custom(...))` never settles and the command\n * hangs. Overlay panels therefore additionally require `ctx.mode === \"tui\"`.\n */\nfunction canRenderPanel(ctx: ExtensionContext): boolean {\n\treturn ctx.hasUI && ctx.mode === \"tui\";\n}\n\nexport async function showStatus(state: McpExtensionState, ctx: ExtensionContext): Promise<void> {\n\tif (!ctx.hasUI) return;\n\n\tconst lines: string[] = [\"MCP Server Status:\", \"\"];\n\n\tfor (const name of Object.keys(state.config.mcpServers)) {\n\t\tconst definition = state.config.mcpServers[name];\n\t\tif (isServerDisabled(definition)) {\n\t\t\tlines.push(`⊘ ${name}: disabled (run /mcp enable ${name}, then /reload)`);\n\t\t\tcontinue;\n\t\t}\n\t\tconst connection = state.manager.getConnection(name);\n\t\tconst metadata = state.toolMetadata.get(name);\n\t\tconst toolCount = metadata?.length ?? 0;\n\t\tconst failedAgo = getFailureAgeSeconds(state, name);\n\t\tlet status = \"not connected\";\n\t\tlet statusIcon = \"○\";\n\t\tlet failed = false;\n\n\t\tif (connection?.status === \"connected\") {\n\t\t\tstatus = \"connected\";\n\t\t\tstatusIcon = \"✓\";\n\t\t} else if (connection?.status === \"needs-auth\") {\n\t\t\tstatus = \"needs auth\";\n\t\t\tstatusIcon = \"⚠\";\n\t\t} else if (failedAgo !== null) {\n\t\t\tconst reason = sanitizeTerminalText(getFailureMessage(state, name) ?? \"\");\n\t\t\tstatus = reason ? `failed ${failedAgo}s ago — ${reason}` : `failed ${failedAgo}s ago`;\n\t\t\tstatusIcon = \"✗\";\n\t\t\tfailed = true;\n\t\t} else if (metadata !== undefined) {\n\t\t\tstatus = \"cached\";\n\t\t}\n\n\t\tconst toolSuffix = failed ? \"\" : ` (${toolCount} tools${status === \"cached\" ? \", cached\" : \"\"})`;\n\t\tlines.push(`${statusIcon} ${name}: ${status}${toolSuffix}`);\n\t}\n\n\tif (Object.keys(state.config.mcpServers).length === 0) {\n\t\tlines.push(\"No MCP servers configured\");\n\t\tlines.push(\"Run /mcp setup to adopt imports or scaffold .nexus/mcp.json\");\n\t}\n\n\tctx.ui.notify(lines.join(\"\\n\"), \"info\");\n}\n\nexport async function showPrompts(state: McpExtensionState, ctx: ExtensionContext): Promise<void> {\n\tif (!ctx.hasUI) return;\n\tconst allPrompts = [...(state.promptMetadata?.values() ?? [])].flat();\n\tconst failedPromptServers = [...(state.manager.getAllConnections?.() ?? [])]\n\t\t.filter(([, connection]) => connection.status === \"connected\" && connection.promptDiscoveryFailed)\n\t\t.map(([serverName]) => serverName)\n\t\t.sort();\n\tif (allPrompts.length === 0) {\n\t\tconst failureNote =\n\t\t\tfailedPromptServers.length > 0 ? ` Prompt discovery failed for: ${failedPromptServers.join(\", \")}.` : \"\";\n\t\tctx.ui.notify(\n\t\t\t`No MCP prompts available. Prompts are discovered when servers with the \\`prompts\\` capability connect.${failureNote}`,\n\t\t\t\"info\",\n\t\t);\n\t\treturn;\n\t}\n\tconst lines = [\"MCP Prompts:\", \"\"];\n\tconst grouped = new Map<string, typeof allPrompts>();\n\tfor (const prompt of allPrompts) {\n\t\tconst list = grouped.get(prompt.serverName) ?? [];\n\t\tlist.push(prompt);\n\t\tgrouped.set(prompt.serverName, list);\n\t}\n\tfor (const [serverName, prompts] of [...grouped.entries()].sort(([a], [b]) => a.localeCompare(b))) {\n\t\tlines.push(`${serverName}:`);\n\t\tfor (const prompt of prompts.sort((a, b) => a.commandName.localeCompare(b.commandName))) {\n\t\t\tconst args = prompt.arguments\n\t\t\t\t.map((argument) => (argument.required ? `<${argument.name}>` : `[${argument.name}]`))\n\t\t\t\t.join(\" \");\n\t\t\tlines.push(`  /${prompt.commandName}${args ? ` ${args}` : \"\"}`);\n\t\t\tif (prompt.description) lines.push(`      ${prompt.description}`);\n\t\t}\n\t\tlines.push(\"\");\n\t}\n\tlines.push(`Total: ${allPrompts.length} prompt${allPrompts.length === 1 ? \"\" : \"s\"}`);\n\tif (failedPromptServers.length > 0) {\n\t\tlines.push(\n\t\t\t`Prompt discovery failed for: ${failedPromptServers.join(\", \")}. Cached prompt metadata may be stale.`,\n\t\t);\n\t}\n\tctx.ui.notify(lines.join(\"\\n\"), \"info\");\n}\n\nexport async function showTools(state: McpExtensionState, ctx: ExtensionContext): Promise<void> {\n\tif (!ctx.hasUI) return;\n\n\tconst allTools = [...state.toolMetadata.entries()]\n\t\t.filter(([serverName]) => !isServerDisabled(state.config.mcpServers[serverName]))\n\t\t.flatMap(([, metadata]) => metadata.map((m) => m.name));\n\n\tif (allTools.length === 0) {\n\t\tctx.ui.notify(\"No MCP tools available\", \"info\");\n\t\treturn;\n\t}\n\n\tconst lines = [\"MCP Tools:\", \"\", ...allTools.map((t) => `  ${t}`), \"\", `Total: ${allTools.length} tools`];\n\n\tctx.ui.notify(lines.join(\"\\n\"), \"info\");\n}\n\nexport async function reconnectServer(state: McpExtensionState, ctx: ExtensionContext, name: string): Promise<boolean> {\n\tconst definition = state.config.mcpServers[name];\n\tconst ui = ctx.hasUI ? ctx.ui : undefined;\n\tconst signal = state.owner?.signal;\n\tif (!definition) {\n\t\tif (ui) {\n\t\t\tui.notify(`Server \"${name}\" not found in config`, \"error\");\n\t\t}\n\t\treturn false;\n\t}\n\tif (isServerDisabled(definition)) {\n\t\tif (ui) ui.notify(`MCP: ${name} is disabled. Run /mcp enable ${name}, then /reload.`, \"warning\");\n\t\treturn false;\n\t}\n\n\ttry {\n\t\tawait state.manager.close(name);\n\t\tstate.owner?.throwIfInactive();\n\t\tconst connection = signal\n\t\t\t? await state.manager.connect(name, definition, signal)\n\t\t\t: await state.manager.connect(name, definition);\n\t\tstate.owner?.throwIfInactive();\n\t\tif (connection.status === \"needs-auth\") {\n\t\t\tif (ui) {\n\t\t\t\tui.notify(`MCP: ${name} requires OAuth. Run /mcp-auth ${name} first.`, \"warning\");\n\t\t\t}\n\t\t\tupdateStatusBar(state);\n\t\t\treturn false;\n\t\t}\n\n\t\tconst prefix = state.config.settings?.toolPrefix ?? \"server\";\n\t\tconst { metadata, failedTools } = buildToolMetadata(\n\t\t\tconnection.tools,\n\t\t\tconnection.resources,\n\t\t\tdefinition,\n\t\t\tname,\n\t\t\tprefix,\n\t\t\tstate.config.mcpServers,\n\t\t\tstate.toolMetadata,\n\t\t);\n\t\tstate.toolMetadata.set(name, metadata);\n\t\tif (!connection.promptDiscoveryFailed) {\n\t\t\tstate.promptMetadata?.set(name, reconstructPromptMetadata(name, connection.prompts ?? [], prefix, definition));\n\t\t\tstate.promptMetadataLive?.add(name);\n\t\t}\n\t\tif (connection.instructions) {\n\t\t\tstate.serverInstructions.set(name, connection.instructions);\n\t\t} else {\n\t\t\tstate.serverInstructions.delete(name);\n\t\t}\n\t\tupdateMetadataCache(state, name);\n\t\tnotifyToolMetadataUpdated(state, name, \"command-reconnect\");\n\t\tmarkKeepAliveAfterConnect(state, name);\n\t\tclearFailure(state, name);\n\n\t\tif (ui) {\n\t\t\tui.notify(\n\t\t\t\t`MCP: Reconnected to ${name} (${connection.tools.length} tools, ${connection.resources.length} resources)`,\n\t\t\t\t\"info\",\n\t\t\t);\n\t\t\tif (failedTools.length > 0) {\n\t\t\t\tui.notify(`MCP: ${name} - ${failedTools.length} tools skipped`, \"warning\");\n\t\t\t}\n\t\t}\n\t\tupdateStatusBar(state);\n\t\treturn true;\n\t} catch (error) {\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\tif (isAbortError(error, signal)) throw error;\n\t\trecordFailure(state, name, message);\n\t\tif (ui) {\n\t\t\tui.notify(`MCP: Failed to reconnect to ${name}: ${sanitizeTerminalText(message)}`, \"error\");\n\t\t}\n\t\tupdateStatusBar(state);\n\t\treturn false;\n\t}\n}\n\nexport async function reconnectServers(\n\tstate: McpExtensionState,\n\tctx: ExtensionContext,\n\ttargetServer?: string,\n): Promise<void> {\n\tif (targetServer && !state.config.mcpServers[targetServer]) {\n\t\tif (ctx.hasUI) {\n\t\t\tctx.ui.notify(`Server \"${targetServer}\" not found in config`, \"error\");\n\t\t}\n\t\treturn;\n\t}\n\n\tconst names = targetServer ? [targetServer] : Object.keys(state.config.mcpServers);\n\tfor (const name of names) {\n\t\tawait reconnectServer(state, ctx, name);\n\t}\n\n\tupdateStatusBar(state);\n}\n\n/** Whether stored OAuth tokens actually exist for a server — independent of whether it's currently connected. */\nfunction isSignedInForOAuth(serverName: string, definition: ServerEntry, state: McpExtensionState): boolean {\n\ttry {\n\t\tconst serverUrl = resolveServerUrl(definition);\n\t\tif (!serverUrl) return false;\n\t\tconst authStatus = inspectAuthForUrl(serverName, serverUrl, state.authStorageOptions);\n\t\treturn authStatus.status !== \"absent\" && authStatus.status !== \"unavailable\" && !!authStatus.entry.tokens;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nexport async function authenticateServer(\n\tserverName: string,\n\tconfig: McpConfig,\n\tctx: ExtensionContext,\n\tsignal?: AbortSignal,\n\truntime?: McpOAuthRuntime,\n\tnexus?: ExtensionAPI,\n): Promise<McpAuthResult> {\n\tconst ui = ctx.hasUI ? ctx.ui : undefined;\n\tconst cwd = ctx.cwd;\n\tsignal ??= ctx.signal;\n\tif (!ui) return { ok: false, message: \"OAuth authentication requires an interactive session.\" };\n\n\tconst definition = config.mcpServers[serverName];\n\tif (!definition) {\n\t\tconst message = `Server \"${serverName}\" not found in config`;\n\t\tui.notify(message, \"error\");\n\t\treturn { ok: false, message };\n\t}\n\tif (isServerDisabled(definition)) {\n\t\tconst message = `Server \"${serverName}\" is disabled. Run /mcp enable ${serverName}, then /reload.`;\n\t\tui.notify(message, \"warning\");\n\t\treturn { ok: false, message };\n\t}\n\n\tif (!supportsOAuth(definition)) {\n\t\tconst message = `Server \"${serverName}\" does not use OAuth authentication. Set \"auth\": \"oauth\" or omit auth for auto-detection.`;\n\t\tui.notify(\n\t\t\t`Server \"${serverName}\" does not use OAuth authentication.\\n` +\n\t\t\t\t`Set \"auth\": \"oauth\" or omit auth for auto-detection.`,\n\t\t\t\"error\",\n\t\t);\n\t\treturn { ok: false, message };\n\t}\n\n\ttry {\n\t\tconst serverUrl = resolveServerUrl(definition);\n\t\tif (!serverUrl) {\n\t\t\tconst message = `Server \"${serverName}\" has no URL configured (OAuth requires HTTP transport)`;\n\t\t\tui.notify(message, \"error\");\n\t\t\treturn { ok: false, message };\n\t\t}\n\n\t\tui.setStatus(\"mcp-auth\", `Authenticating ${serverName}...`);\n\t\tconst authStorageOptions = getAuthStorageOptions(config.settings?.oauthDir, cwd);\n\t\tconst status = await authenticate(serverName, serverUrl, definition, {\n\t\t\t...(authStorageOptions.baseDir ? { authStorageOptions } : {}),\n\t\t\tonAuthorizationUrl: async (authorizationUrl) => {\n\t\t\t\t// Best-effort: launch the user's browser straight to the authorization page\n\t\t\t\t// instead of relying on them to click (or copy) the link printed below.\n\t\t\t\tif (!nexus) return;\n\t\t\t\ttry {\n\t\t\t\t\tawait openPath(nexus, authorizationUrl);\n\t\t\t\t} catch {\n\t\t\t\t\t// The link is still shown in the prompt text below; nothing else to do here.\n\t\t\t\t}\n\t\t\t},\n\t\t\tonAuthorizationInput: async (authorizationUrl, inputSignal) => {\n\t\t\t\tif (inputSignal.aborted) return undefined;\n\t\t\t\treturn ui.input(\n\t\t\t\t\t`Complete ${serverName} OAuth\\n\\n` +\n\t\t\t\t\t\t`${terminalHyperlink(\"Open authorization page\", authorizationUrl)}\\n${authorizationUrl}\\n\\n` +\n\t\t\t\t\t\t\"Approve access, then paste the full localhost callback URL below.\",\n\t\t\t\t\tundefined,\n\t\t\t\t\t{ signal: inputSignal },\n\t\t\t\t);\n\t\t\t},\n\t\t\t...(signal ? { signal } : {}),\n\t\t\t...(runtime ? { runtime } : {}),\n\t\t});\n\t\tif (signal?.aborted) signal.throwIfAborted();\n\n\t\tif (status === \"authenticated\") {\n\t\t\tconst message = `OAuth authentication successful for \"${serverName}\".`;\n\t\t\tui.notify(message, \"info\");\n\t\t\treturn { ok: true, message };\n\t\t}\n\n\t\tconst message = `OAuth authentication failed for \"${serverName}\".`;\n\t\tui.notify(message, \"error\");\n\t\treturn { ok: false, message };\n\t} catch (error) {\n\t\tif (signal?.aborted) throw error;\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\tui.notify(`Failed to authenticate \"${serverName}\": ${message}`, \"error\");\n\t\treturn { ok: false, message };\n\t} finally {\n\t\tif (!signal?.aborted) ui.setStatus(\"mcp-auth\", undefined);\n\t}\n}\n\nexport async function logoutServer(\n\tserverName: string,\n\tstate: McpExtensionState,\n\tctx: ExtensionContext,\n): Promise<{ ok: boolean; message: string }> {\n\tconst definition = state.config.mcpServers[serverName];\n\tconst ui = ctx.hasUI ? ctx.ui : undefined;\n\tif (!definition) {\n\t\tconst message = `Server \"${serverName}\" not found in config`;\n\t\tif (ui) ui.notify(message, \"error\");\n\t\treturn { ok: false, message };\n\t}\n\n\tconst signal = state.owner?.signal;\n\ttry {\n\t\tawait removeAuth(serverName, {\n\t\t\tauthStorageOptions: state.authStorageOptions,\n\t\t\tsignal,\n\t\t\truntime: state.oauthRuntime,\n\t\t});\n\t} catch (error) {\n\t\tif (isAbortError(error, signal)) throw error;\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\tif (ui) {\n\t\t\tui.notify(`Failed to clear OAuth credentials for \"${serverName}\": ${sanitizeTerminalText(message)}`, \"error\");\n\t\t}\n\t\treturn { ok: false, message };\n\t}\n\n\tstate.owner?.throwIfInactive();\n\ttry {\n\t\tawait state.manager.close(serverName);\n\t} catch (error) {\n\t\tif (isAbortError(error, signal)) throw error;\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\tif (ui) {\n\t\t\tui.notify(\n\t\t\t\t`OAuth credentials were cleared for \"${serverName}\", but its connection could not be closed: ${sanitizeTerminalText(message)}`,\n\t\t\t\t\"error\",\n\t\t\t);\n\t\t}\n\t\treturn { ok: false, message };\n\t}\n\n\tstate.owner?.throwIfInactive();\n\tupdateStatusBar(state);\n\n\tconst message = `OAuth credentials cleared for \"${serverName}\". Run /mcp-auth ${serverName} to authenticate again.`;\n\tif (ui) ui.notify(message, \"info\");\n\treturn { ok: true, message };\n}\n\nfunction validateBearerTokenStoreServer(\n\tserverName: string,\n\tstate: McpExtensionState,\n): { ok: true; serverUrl: string } | { ok: false; message: string; type: \"error\" | \"warning\" } {\n\tconst safeName = sanitizeTerminalText(serverName);\n\tconst definition = state.config.mcpServers[serverName];\n\tif (!definition) return { ok: false, message: `Server \"${safeName}\" not found in config`, type: \"error\" };\n\tif (isServerDisabled(definition))\n\t\treturn {\n\t\t\tok: false,\n\t\t\tmessage: `Server \"${safeName}\" is disabled. Run /mcp enable ${safeName}, then /reload.`,\n\t\t\ttype: \"warning\",\n\t\t};\n\tif (definition.auth !== \"bearer\" || definition.bearerTokenStore !== true) {\n\t\treturn { ok: false, message: `Server \"${safeName}\" is not configured for bearerTokenStore.`, type: \"error\" };\n\t}\n\t// resolveServerUrl embeds the interpolated URL in its exceptions; redact it\n\t// because the URL can carry userinfo or interpolated secrets.\n\tlet serverUrl: string | undefined;\n\ttry {\n\t\tserverUrl = resolveServerUrl(definition);\n\t} catch {\n\t\treturn { ok: false, message: `Server \"${safeName}\" has an invalid or unresolvable URL.`, type: \"error\" };\n\t}\n\tif (!serverUrl) return { ok: false, message: `Server \"${safeName}\" has no URL configured.`, type: \"error\" };\n\treturn { ok: true, serverUrl };\n}\n\nexport async function manageBearerToken(\n\taction: \"set\" | \"remove\" | \"status\",\n\tserverName: string,\n\tstate: McpExtensionState,\n\tctx: ExtensionContext,\n): Promise<{ ok: boolean; message: string }> {\n\tconst ui = ctx.hasUI ? ctx.ui : undefined;\n\tconst safeName = sanitizeTerminalText(serverName);\n\tconst validation = validateBearerTokenStoreServer(serverName, state);\n\tif (!validation.ok) {\n\t\tif (ui) ui.notify(validation.message, validation.type);\n\t\treturn { ok: false, message: validation.message };\n\t}\n\n\tif (action === \"set\") {\n\t\tconst message = `Nexus will not collect bearer tokens through an unmasked prompt. Configure bearerTokenEnv for \"${safeName}\" in MCP config, then reload.`;\n\t\tif (ui) ui.notify(message, \"error\");\n\t\treturn { ok: false, message };\n\t}\n\n\tif (action === \"status\") {\n\t\tconst status = inspectBearerTokenForUrl(serverName, validation.serverUrl);\n\t\tconst message =\n\t\t\tstatus.status === \"present\"\n\t\t\t\t? `Bearer token is stored for \"${safeName}\".`\n\t\t\t\t: status.status === \"url-mismatch\"\n\t\t\t\t\t? `Bearer token is stored for \"${safeName}\", but its URL does not match the current server URL.`\n\t\t\t\t\t: status.status === \"unavailable\"\n\t\t\t\t\t\t? status.message\n\t\t\t\t\t\t: `No bearer token is stored for \"${safeName}\".`;\n\t\tif (ui) ui.notify(message, status.status === \"unavailable\" ? \"error\" : \"info\");\n\t\treturn { ok: status.status !== \"unavailable\", message };\n\t}\n\n\ttry {\n\t\tremoveBearerToken(serverName);\n\t} catch (error) {\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\tif (ui) ui.notify(`Failed to remove bearer token for \"${safeName}\": ${sanitizeTerminalText(message)}`, \"error\");\n\t\treturn { ok: false, message };\n\t}\n\n\tconst message = `Bearer token removed for \"${safeName}\".`;\n\tif (ui) ui.notify(message, \"info\");\n\treturn { ok: true, message };\n}\n\ntype ParsedAddServer = { ok: true; name: string; entry: ServerEntry } | { ok: false; error: string };\n\nconst ADD_SERVER_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\n\nfunction parseKeyValueFlag(\n\tflag: string,\n\traw: string | undefined,\n): { ok: true; key: string; value: string } | { ok: false; error: string } {\n\tconst eq = raw?.indexOf(\"=\") ?? -1;\n\tif (!raw || eq <= 0) return { ok: false, error: `${flag} expects KEY=VALUE, got \"${raw ?? \"\"}\".` };\n\treturn { ok: true, key: raw.slice(0, eq), value: raw.slice(eq + 1) };\n}\n\n/**\n * Parses `/mcp add <name> ...` arguments. Mirrors the rest of /mcp's naive\n * whitespace-split argument handling (no quoting support) rather than\n * inventing a shell-quote parser just for this subcommand.\n */\nexport function parseAddServerArgs(argv: string[]): ParsedAddServer {\n\tconst name = argv[0];\n\tif (!name) return { ok: false, error: \"Missing server name.\" };\n\tif (!ADD_SERVER_NAME_PATTERN.test(name)) {\n\t\treturn { ok: false, error: `Invalid server name \"${name}\" — use letters, digits, \".\", \"_\", \"-\".` };\n\t}\n\n\tconst rest = argv.slice(1);\n\tconst env: Record<string, string> = {};\n\tconst headers: Record<string, string> = {};\n\tlet cwd: string | undefined;\n\tlet url: string | undefined;\n\tlet auth: \"oauth\" | \"bearer\" | undefined;\n\tlet bearerTokenEnv: string | undefined;\n\tlet commandArgv: string[] | undefined;\n\n\tlet i = 0;\n\twhile (i < rest.length) {\n\t\tconst token = rest[i];\n\t\tif (token === \"--\") {\n\t\t\tcommandArgv = rest.slice(i + 1);\n\t\t\tbreak;\n\t\t}\n\t\tif (token === \"--url\") {\n\t\t\turl = rest[i + 1];\n\t\t\ti += 2;\n\t\t\tcontinue;\n\t\t}\n\t\tif (token === \"--env\" || token === \"--header\") {\n\t\t\tconst parsed = parseKeyValueFlag(token, rest[i + 1]);\n\t\t\tif (!parsed.ok) return parsed;\n\t\t\t(token === \"--env\" ? env : headers)[parsed.key] = parsed.value;\n\t\t\ti += 2;\n\t\t\tcontinue;\n\t\t}\n\t\tif (token === \"--cwd\") {\n\t\t\tcwd = rest[i + 1];\n\t\t\ti += 2;\n\t\t\tcontinue;\n\t\t}\n\t\tif (token === \"--auth\") {\n\t\t\tconst value = rest[i + 1];\n\t\t\tif (value !== \"oauth\" && value !== \"bearer\") {\n\t\t\t\treturn { ok: false, error: `--auth expects \"oauth\" or \"bearer\", got \"${value ?? \"\"}\".` };\n\t\t\t}\n\t\t\tauth = value;\n\t\t\ti += 2;\n\t\t\tcontinue;\n\t\t}\n\t\tif (token === \"--bearer-env\") {\n\t\t\tbearerTokenEnv = rest[i + 1];\n\t\t\ti += 2;\n\t\t\tcontinue;\n\t\t}\n\t\treturn { ok: false, error: `Unrecognized argument \"${token}\".` };\n\t}\n\n\tif (url && commandArgv) {\n\t\treturn { ok: false, error: \"Use either --url (remote server) or -- <command> (local server), not both.\" };\n\t}\n\tif (!url && !commandArgv) {\n\t\treturn { ok: false, error: \"Specify a server type: --url <url> (remote), or -- <command> [args...] (local).\" };\n\t}\n\n\tif (commandArgv) {\n\t\tconst [command, ...args] = commandArgv;\n\t\tif (!command) return { ok: false, error: \"Missing command after --.\" };\n\t\tconst entry: ServerEntry = { command, ...(args.length ? { args } : {}) };\n\t\tif (Object.keys(env).length) entry.env = env;\n\t\tif (cwd) entry.cwd = cwd;\n\t\treturn { ok: true, name, entry };\n\t}\n\n\tconst entry: ServerEntry = { url: url as string };\n\tif (Object.keys(headers).length) entry.headers = headers;\n\tif (bearerTokenEnv) {\n\t\tentry.bearerTokenEnv = bearerTokenEnv;\n\t\tentry.auth = auth ?? \"bearer\";\n\t} else if (auth) {\n\t\tentry.auth = auth;\n\t}\n\treturn { ok: true, name, entry };\n}\n\nexport const ADD_SERVER_USAGE = [\n\t\"Usage:\",\n\t\"  /mcp add <name> -- <command> [args...]          local server, runs over stdio\",\n\t\"  /mcp add <name> --url <url>                      remote server over HTTP\",\n\t\"\",\n\t\"Flags:\",\n\t\"  --env KEY=VALUE       extra environment variable (local, repeatable)\",\n\t\"  --cwd <path>          working directory (local)\",\n\t\"  --header KEY=VALUE    extra HTTP header (remote, repeatable)\",\n\t\"  --auth oauth|bearer   auth mode (remote; default is OAuth auto-detection)\",\n\t\"  --bearer-env <VAR>    read a bearer token from this env var (remote)\",\n\t\"\",\n\t\"For fields not covered here (lifecycle, includeTools, ...), edit the config\",\n\t'file directly — /mcp setup, then \"Open detected config paths\".',\n].join(\"\\n\");\n\n/** Adds a server to the project's shared MCP config. Reused by both `/mcp add` and any UI entry point. */\nexport function addCustomServer(cwd: string, name: string, entry: ServerEntry): { path: string } {\n\tconst path = writeSharedServerEntry(getProjectConfigPath(cwd), name, entry);\n\treturn { path };\n}\n\nexport interface PanelFlowResult {\n\tconfigChanged: boolean;\n}\n\nfunction buildSharedConfigNoticeLines(\n\tconfigOverridePath: string | undefined,\n\tcwd: string,\n): { lines: string[]; fingerprint: string | null } {\n\tconst discovery = getMcpStandardConfigSummary(configOverridePath, cwd);\n\tconst onboardingState = loadOnboardingState();\n\tif (!discovery.hasSharedServers || onboardingState.sharedConfigHintShown) {\n\t\treturn { lines: [], fingerprint: null };\n\t}\n\n\tconst sharedSources = discovery.sources.filter((source) => source.kind === \"shared\" && source.serverCount > 0);\n\tconst sourceList = sharedSources.map((source) => source.path).join(\", \");\n\treturn {\n\t\tlines: [\n\t\t\t`Using MCP configuration from ${sourceList}.`,\n\t\t\t\"Nexus writes compatibility imports and MCP-specific overrides only to Nexus configuration files.\",\n\t\t],\n\t\tfingerprint: discovery.fingerprint,\n\t};\n}\n\nexport async function openMcpSetup(\n\tstate: McpExtensionState,\n\tnexus: ExtensionAPI,\n\tctx: ExtensionContext,\n\tconfigOverridePath?: string,\n\tmode: \"empty\" | \"setup\" = \"setup\",\n\toptions: { includeHostConfigs?: boolean } = {},\n): Promise<PanelFlowResult> {\n\tif (!ctx.hasUI) return { configChanged: false };\n\tif (!canRenderPanel(ctx)) {\n\t\tctx.ui.notify(\n\t\t\t`The interactive MCP setup panel is only available in the terminal UI (current mode: ${ctx.mode}). Edit .nexus/mcp.json directly, or run /mcp status to review servers.`,\n\t\t\t\"info\",\n\t\t);\n\t\treturn { configChanged: false };\n\t}\n\tif (state.programmaticConfig) {\n\t\tctx.ui.notify(\"MCP setup is unavailable when config is supplied by createMcpAdapter().\", \"info\");\n\t\treturn { configChanged: false };\n\t}\n\n\tconst discovery = getMcpDiscoverySummary(configOverridePath, ctx.cwd, options);\n\tconst onboardingState = loadOnboardingState();\n\tconst installedServers = Object.entries(state.config.mcpServers).map(([name, definition]) => {\n\t\tconst authCapable = supportsOAuth(definition);\n\t\treturn {\n\t\t\tname,\n\t\t\tdisabled: isServerDisabled(definition),\n\t\t\tkind: (definition.command ? \"stdio\" : \"http\") as \"stdio\" | \"http\",\n\t\t\tauthCapable,\n\t\t\tsignedIn: authCapable ? isSignedInForOAuth(name, definition, state) : false,\n\t\t};\n\t});\n\tlet configChanged = false;\n\tlet overlayHandle: OverlayHandle | undefined;\n\n\tconst callbacks = {\n\t\tpreviewImports: (imports: ImportKind[]) => previewCompatibilityImports(imports, configOverridePath),\n\t\tpreviewStarterProject: () => previewStarterProjectConfig(ctx.cwd),\n\t\tpreviewRepoPrompt: () => {\n\t\t\tconst repoPrompt = getMcpDiscoverySummary(configOverridePath, ctx.cwd, options).repoPrompt;\n\t\t\tif (!repoPrompt.entry || !repoPrompt.targetPath || !repoPrompt.serverName) return null;\n\t\t\treturn previewSharedServerEntry(repoPrompt.targetPath, repoPrompt.serverName, repoPrompt.entry);\n\t\t},\n\t\tpreviewKnownServer: (preset: KnownServerPreset) =>\n\t\t\tpreviewSharedServerEntry(getProjectConfigPath(ctx.cwd), preset.id, preset.entry),\n\t\tadoptImports: async (imports: ImportKind[]) => {\n\t\t\tconst result = ensureCompatibilityImports(imports, configOverridePath);\n\t\t\tif (result.added.length > 0) configChanged = true;\n\t\t\treturn result;\n\t\t},\n\t\tscaffoldProjectConfig: async () => {\n\t\t\tconst path = writeStarterProjectConfig(ctx.cwd);\n\t\t\tconfigChanged = true;\n\t\t\treturn { path };\n\t\t},\n\t\taddRepoPrompt: async () => {\n\t\t\tconst repoPrompt = getMcpDiscoverySummary(configOverridePath, ctx.cwd, options).repoPrompt;\n\t\t\tif (!repoPrompt.entry || !repoPrompt.targetPath || !repoPrompt.serverName) {\n\t\t\t\tthrow new Error(\"RepoPrompt is not available to add from this setup screen.\");\n\t\t\t}\n\t\t\tconst path = writeSharedServerEntry(repoPrompt.targetPath, repoPrompt.serverName, repoPrompt.entry);\n\t\t\tconfigChanged = true;\n\t\t\treturn { path, serverName: repoPrompt.serverName };\n\t\t},\n\t\taddKnownServer: async (preset: KnownServerPreset) => {\n\t\t\tconst path = writeSharedServerEntry(getProjectConfigPath(ctx.cwd), preset.id, preset.entry);\n\t\t\tconfigChanged = true;\n\t\t\treturn { path, serverName: preset.name };\n\t\t},\n\t\topenPath: async (targetPath: string) => {\n\t\t\tawait openPath(nexus, targetPath);\n\t\t},\n\t\tmarkSetupCompleted: () => {\n\t\t\tpersistSetupCompleted(discovery.fingerprint);\n\t\t},\n\t\tseedEditor: (text: string) => {\n\t\t\tif (ctx.hasUI) ctx.ui.setEditorText(text);\n\t\t},\n\t\ttoggleServerDisabled: async (serverName: string, disabled: boolean) => {\n\t\t\tconst result = writeProjectServerDisabledOverride(configOverridePath, ctx.cwd, serverName, disabled);\n\t\t\tif (result.changed) configChanged = true;\n\t\t\treturn { path: result.path, changed: result.changed };\n\t\t},\n\t\tauthenticateServer: async (serverName: string, fallbackEntry?: ServerEntry) => {\n\t\t\t// A server added this session isn't in the live config until /reload —\n\t\t\t// hand authenticateServer a synthetic config with just that one entry\n\t\t\t// merged in, rather than making the user reload first.\n\t\t\tconst effectiveConfig: McpConfig =\n\t\t\t\tstate.config.mcpServers[serverName] || !fallbackEntry\n\t\t\t\t\t? state.config\n\t\t\t\t\t: { ...state.config, mcpServers: { ...state.config.mcpServers, [serverName]: fallbackEntry } };\n\t\t\t// The auth prompt (the actual link, and the \"paste the callback URL\"\n\t\t\t// input) renders as a *separate* overlay. Without hiding this one first,\n\t\t\t// it stays drawn on top and the auth prompt is invisible underneath it.\n\t\t\toverlayHandle?.setHidden(true);\n\t\t\ttry {\n\t\t\t\tconst result = await authenticateServer(\n\t\t\t\t\tserverName,\n\t\t\t\t\teffectiveConfig,\n\t\t\t\t\tctx,\n\t\t\t\t\tctx.signal,\n\t\t\t\t\tstate.oauthRuntime,\n\t\t\t\t\tnexus,\n\t\t\t\t);\n\t\t\t\treturn {\n\t\t\t\t\tok: result.ok,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\tresult.message ??\n\t\t\t\t\t\t(result.ok ? `Signed in to \"${serverName}\".` : `Sign-in failed for \"${serverName}\".`),\n\t\t\t\t};\n\t\t\t} finally {\n\t\t\t\toverlayHandle?.setHidden(false);\n\t\t\t\toverlayHandle?.focus();\n\t\t\t}\n\t\t},\n\t};\n\n\treturn new Promise<PanelFlowResult>((resolve) => {\n\t\tctx.ui.custom(\n\t\t\t(tui, _theme, keybindings, done) => {\n\t\t\t\treturn createMcpSetupPanel(\n\t\t\t\t\tdiscovery,\n\t\t\t\t\tcallbacks,\n\t\t\t\t\t{ mode, onboardingState, keybindings, installedServers },\n\t\t\t\t\ttui,\n\t\t\t\t\t() => {\n\t\t\t\t\t\tdone(undefined);\n\t\t\t\t\t\tresolve({ configChanged });\n\t\t\t\t\t},\n\t\t\t\t);\n\t\t\t},\n\t\t\t{\n\t\t\t\toverlay: true,\n\t\t\t\toverlayOptions: { anchor: \"center\", width: 92, maxHeight: \"90%\" },\n\t\t\t\tonHandle: (handle) => {\n\t\t\t\t\toverlayHandle = handle;\n\t\t\t\t},\n\t\t\t},\n\t\t);\n\t});\n}\n\nfunction buildMcpPanelCallbacks(\n\tstate: McpExtensionState,\n\tconfig: McpConfig,\n\tctx: ExtensionContext,\n\tnexus: ExtensionAPI,\n\tgetOverlayHandle?: () => OverlayHandle | undefined,\n): McpPanelCallbacks {\n\t// Panel-only diagnostics keep status inspection from mutating connection\n\t// failure state while allowing the existing panel failure UI to show why the\n\t// credential store could not be inspected.\n\tconst authStatusFailures = new Map<string, string>();\n\n\treturn {\n\t\treconnect: (serverName: string) => reconnectServer(state, ctx, serverName),\n\t\tcanAuthenticate: (serverName: string) => {\n\t\t\tconst definition = config.mcpServers[serverName];\n\t\t\treturn definition ? !isServerDisabled(definition) && supportsOAuth(definition) : false;\n\t\t},\n\t\tauthenticate: async (serverName: string) => {\n\t\t\tconst overlay = getOverlayHandle?.();\n\t\t\toverlay?.setHidden(true);\n\t\t\ttry {\n\t\t\t\treturn await authenticateServer(serverName, config, ctx, state.owner?.signal, state.oauthRuntime, nexus);\n\t\t\t} finally {\n\t\t\t\toverlay?.setHidden(false);\n\t\t\t\toverlay?.focus();\n\t\t\t}\n\t\t},\n\t\tgetConnectionStatus: (serverName: string) => {\n\t\t\tauthStatusFailures.delete(serverName);\n\t\t\tconst definition = config.mcpServers[serverName];\n\t\t\tif (isServerDisabled(definition)) return \"disabled\";\n\t\t\tconst connection = state.manager.getConnection(serverName);\n\t\t\tlet serverUrl: string | undefined;\n\t\t\ttry {\n\t\t\t\tserverUrl = definition ? resolveServerUrl(definition) : undefined;\n\t\t\t} catch {\n\t\t\t\treturn \"failed\";\n\t\t\t}\n\t\t\tif (\n\t\t\t\tdefinition?.auth === \"oauth\" &&\n\t\t\t\tserverUrl &&\n\t\t\t\tdefinition.oauth !== false &&\n\t\t\t\tdefinition.oauth?.grantType !== \"client_credentials\"\n\t\t\t) {\n\t\t\t\tconst authStatus = inspectAuthForUrl(serverName, serverUrl, state.authStorageOptions);\n\t\t\t\tif (authStatus.status === \"unavailable\") {\n\t\t\t\t\tauthStatusFailures.set(serverName, authStatus.message);\n\t\t\t\t\treturn \"failed\";\n\t\t\t\t}\n\t\t\t\tif (authStatus.status === \"absent\" || !authStatus.entry.tokens) {\n\t\t\t\t\treturn \"needs-auth\";\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (connection?.status === \"needs-auth\") return \"needs-auth\";\n\t\t\tif (connection?.status === \"connected\") return \"connected\";\n\t\t\tif (getFailureAgeSeconds(state, serverName) !== null) return \"failed\";\n\t\t\treturn \"idle\";\n\t\t},\n\t\tgetFailureMessage: (serverName: string) =>\n\t\t\tauthStatusFailures.get(serverName) ?? getFailureMessage(state, serverName),\n\t\trefreshCacheAfterReconnect: (serverName: string) => {\n\t\t\tconst freshCache = loadMetadataCache();\n\t\t\treturn freshCache?.servers?.[serverName] ?? null;\n\t\t},\n\t};\n}\n\nexport async function openMcpPanel(\n\tstate: McpExtensionState,\n\tnexus: ExtensionAPI,\n\tctx: ExtensionContext,\n\tconfigOverridePath?: string,\n\tonDirectToolsConfigChanged?: (changes: Map<string, true | string[] | false>) => void | Promise<void>,\n): Promise<PanelFlowResult> {\n\tif (state.programmaticConfig) {\n\t\tif (ctx.hasUI) {\n\t\t\tctx.ui.notify(\n\t\t\t\t\"MCP status is shown from the in-memory SDK config; configuration discovery is unavailable.\",\n\t\t\t\t\"info\",\n\t\t\t);\n\t\t\tawait showStatus(state, ctx);\n\t\t}\n\t\treturn { configChanged: false };\n\t}\n\tif (!canRenderPanel(ctx)) {\n\t\t// No overlay here, but the same information is available as text.\n\t\tawait showStatus(state, ctx);\n\t\treturn { configChanged: false };\n\t}\n\tif (Object.keys(state.config.mcpServers).length === 0) {\n\t\treturn openMcpSetup(state, nexus, ctx, configOverridePath, \"empty\", { includeHostConfigs: false });\n\t}\n\n\tconst config = state.config;\n\tconst cache = loadMetadataCache();\n\tconst configPath = (nexus.getFlag(\"mcp-config\") as string | undefined) ?? configOverridePath;\n\tconst provenanceMap = getServerProvenance(configPath, ctx.cwd);\n\tconst { lines: noticeLines, fingerprint } = buildSharedConfigNoticeLines(configPath, ctx.cwd);\n\n\tlet overlayHandle: OverlayHandle | undefined;\n\tconst callbacks = buildMcpPanelCallbacks(state, config, ctx, nexus, () => overlayHandle);\n\n\tlet configChanged = false;\n\n\tawait new Promise<void>((resolve) => {\n\t\tctx.ui.custom(\n\t\t\t(tui, _theme, keybindings, done) => {\n\t\t\t\treturn createMcpPanel(\n\t\t\t\t\tconfig,\n\t\t\t\t\tcache,\n\t\t\t\t\tprovenanceMap,\n\t\t\t\t\tcallbacks,\n\t\t\t\t\ttui,\n\t\t\t\t\t(result: McpPanelResult) => {\n\t\t\t\t\t\tvoid (async () => {\n\t\t\t\t\t\t\tif (!result.cancelled && result.changes.size > 0) {\n\t\t\t\t\t\t\t\twriteDirectToolsConfig(result.changes, provenanceMap);\n\t\t\t\t\t\t\t\tconfigChanged = true;\n\t\t\t\t\t\t\t\tawait onDirectToolsConfigChanged?.(result.changes);\n\t\t\t\t\t\t\t\tctx.ui.notify(\"Direct tools updated for this session.\", \"info\");\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tdone(undefined);\n\t\t\t\t\t\t\tresolve();\n\t\t\t\t\t\t})().catch((error) => {\n\t\t\t\t\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\t\t\t\t\tctx.ui.notify(`Direct tools updated, but live refresh failed: ${message}`, \"error\");\n\t\t\t\t\t\t\tconfigChanged = true;\n\t\t\t\t\t\t\tdone(undefined);\n\t\t\t\t\t\t\tresolve();\n\t\t\t\t\t\t});\n\t\t\t\t\t},\n\t\t\t\t\t{ noticeLines, keybindings },\n\t\t\t\t);\n\t\t\t},\n\t\t\t{\n\t\t\t\toverlay: true,\n\t\t\t\toverlayOptions: { anchor: \"center\", width: 82 },\n\t\t\t\tonHandle: (handle) => {\n\t\t\t\t\toverlayHandle = handle;\n\t\t\t\t},\n\t\t\t},\n\t\t);\n\t});\n\n\tif (noticeLines.length > 0 && fingerprint) {\n\t\tmarkSharedConfigHintShown(fingerprint);\n\t}\n\n\treturn { configChanged };\n}\n\nexport async function openMcpAuthPanel(\n\tstate: McpExtensionState,\n\tnexus: ExtensionAPI,\n\tctx: ExtensionContext,\n\tconfigOverridePath?: string,\n): Promise<PanelFlowResult> {\n\tif (!ctx.hasUI) return { configChanged: false };\n\tif (!canRenderPanel(ctx)) {\n\t\tctx.ui.notify(\n\t\t\t`The interactive MCP auth panel is only available in the terminal UI (current mode: ${ctx.mode}). Use /mcp-auth <server> to authenticate a specific server.`,\n\t\t\t\"info\",\n\t\t);\n\t\treturn { configChanged: false };\n\t}\n\tif (state.programmaticConfig) {\n\t\tctx.ui.notify(\"Use /mcp-auth <server> to authenticate a server from the in-memory SDK config.\", \"info\");\n\t\treturn { configChanged: false };\n\t}\n\n\tconst config = state.config;\n\tconst oauthServers = Object.entries(config.mcpServers).filter(\n\t\t([, definition]) => !isServerDisabled(definition) && supportsOAuth(definition),\n\t);\n\tif (oauthServers.length === 0) {\n\t\tctx.ui.notify(\"No OAuth-capable MCP servers are configured.\", \"warning\");\n\t\treturn { configChanged: false };\n\t}\n\n\tconst cache = loadMetadataCache();\n\tconst configPath = (nexus.getFlag(\"mcp-config\") as string | undefined) ?? configOverridePath;\n\tconst provenanceMap = getServerProvenance(configPath, ctx.cwd);\n\tlet overlayHandle: OverlayHandle | undefined;\n\tconst callbacks = buildMcpPanelCallbacks(state, config, ctx, nexus, () => overlayHandle);\n\tawait new Promise<void>((resolve) => {\n\t\tctx.ui.custom(\n\t\t\t(tui, _theme, keybindings, done) => {\n\t\t\t\treturn createMcpPanel(\n\t\t\t\t\tconfig,\n\t\t\t\t\tcache,\n\t\t\t\t\tprovenanceMap,\n\t\t\t\t\tcallbacks,\n\t\t\t\t\ttui,\n\t\t\t\t\t() => {\n\t\t\t\t\t\tdone(undefined);\n\t\t\t\t\t\tresolve();\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\tauthOnly: true,\n\t\t\t\t\t\tkeybindings,\n\t\t\t\t\t\tnoticeLines: [\"Select an OAuth MCP server and press Enter or ctrl+a to authenticate.\"],\n\t\t\t\t\t},\n\t\t\t\t);\n\t\t\t},\n\t\t\t{\n\t\t\t\toverlay: true,\n\t\t\t\toverlayOptions: { anchor: \"center\", width: 82 },\n\t\t\t\tonHandle: (handle) => {\n\t\t\t\t\toverlayHandle = handle;\n\t\t\t\t},\n\t\t\t},\n\t\t);\n\t});\n\n\treturn { configChanged: false };\n}\n"]}