@akon-labs/nexus-cli 0.1.9 → 0.1.11-rc.2

package/dist/extensions/mcp/commands.js

@@ -0,0 +1,821 @@
+import { ensureCompatibilityImports, getMcpDiscoverySummary, getMcpStandardConfigSummary, getProjectConfigPath, getServerProvenance, previewCompatibilityImports, previewSharedServerEntry, previewStarterProjectConfig, writeDirectToolsConfig, writeProjectServerDisabledOverride, writeSharedServerEntry, writeStarterProjectConfig, } from "./config.js";
+import { clearFailure, getFailureAgeSeconds, getFailureMessage, markKeepAliveAfterConnect, notifyToolMetadataUpdated, recordFailure, updateMetadataCache, updateStatusBar, } from "./init.js";
+import { getAuthStorageOptions, inspectAuthForUrl } from "./mcp-auth.js";
+import { authenticate, removeAuth, supportsOAuth } from "./mcp-auth-flow.js";
+import { inspectBearerTokenForUrl, removeBearerToken } from "./mcp-bearer-store.js";
+import { createMcpPanel } from "./mcp-panel.js";
+import { createMcpSetupPanel } from "./mcp-setup-panel.js";
+import { loadMetadataCache, reconstructPromptMetadata } from "./metadata-cache.js";
+import { loadOnboardingState, markSharedConfigHintShown, markSetupCompleted as persistSetupCompleted, } from "./onboarding-state.js";
+import { isAbortError } from "./runtime-owner.js";
+import { buildToolMetadata } from "./tool-metadata.js";
+import { isServerDisabled, } from "./types.js";
+import { openPath, resolveServerUrl, sanitizeTerminalText } from "./utils.js";
+function terminalHyperlink(label, url) {
+    return `\u001B]8;;${sanitizeTerminalText(url)}\u001B\\${sanitizeTerminalText(label)}\u001B]8;;\u001B\\`;
+}
+/**
+ * True when this run mode can display a `ctx.ui.custom()` overlay.
+ *
+ * `ctx.hasUI` only reports that *some* UI context is bound. In rpc/print mode
+ * that context is a headless stub whose `custom()` returns immediately without
+ * ever invoking the factory or the `done` callback, so a panel awaited through
+ * `new Promise(resolve => ctx.ui.custom(...))` never settles and the command
+ * hangs. Overlay panels therefore additionally require `ctx.mode === "tui"`.
+ */
+function canRenderPanel(ctx) {
+    return ctx.hasUI && ctx.mode === "tui";
+}
+export async function showStatus(state, ctx) {
+    if (!ctx.hasUI)
+        return;
+    const lines = ["MCP Server Status:", ""];
+    for (const name of Object.keys(state.config.mcpServers)) {
+        const definition = state.config.mcpServers[name];
+        if (isServerDisabled(definition)) {
+            lines.push(`⊘ ${name}: disabled (run /mcp enable ${name}, then /reload)`);
+            continue;
+        }
+        const connection = state.manager.getConnection(name);
+        const metadata = state.toolMetadata.get(name);
+        const toolCount = metadata?.length ?? 0;
+        const failedAgo = getFailureAgeSeconds(state, name);
+        let status = "not connected";
+        let statusIcon = "○";
+        let failed = false;
+        if (connection?.status === "connected") {
+            status = "connected";
+            statusIcon = "✓";
+        }
+        else if (connection?.status === "needs-auth") {
+            status = "needs auth";
+            statusIcon = "⚠";
+        }
+        else if (failedAgo !== null) {
+            const reason = sanitizeTerminalText(getFailureMessage(state, name) ?? "");
+            status = reason ? `failed ${failedAgo}s ago — ${reason}` : `failed ${failedAgo}s ago`;
+            statusIcon = "✗";
+            failed = true;
+        }
+        else if (metadata !== undefined) {
+            status = "cached";
+        }
+        const toolSuffix = failed ? "" : ` (${toolCount} tools${status === "cached" ? ", cached" : ""})`;
+        lines.push(`${statusIcon} ${name}: ${status}${toolSuffix}`);
+    }
+    if (Object.keys(state.config.mcpServers).length === 0) {
+        lines.push("No MCP servers configured");
+        lines.push("Run /mcp setup to adopt imports or scaffold .nexus/mcp.json");
+    }
+    ctx.ui.notify(lines.join("\n"), "info");
+}
+export async function showPrompts(state, ctx) {
+    if (!ctx.hasUI)
+        return;
+    const allPrompts = [...(state.promptMetadata?.values() ?? [])].flat();
+    const failedPromptServers = [...(state.manager.getAllConnections?.() ?? [])]
+        .filter(([, connection]) => connection.status === "connected" && connection.promptDiscoveryFailed)
+        .map(([serverName]) => serverName)
+        .sort();
+    if (allPrompts.length === 0) {
+        const failureNote = failedPromptServers.length > 0 ? ` Prompt discovery failed for: ${failedPromptServers.join(", ")}.` : "";
+        ctx.ui.notify(`No MCP prompts available. Prompts are discovered when servers with the \`prompts\` capability connect.${failureNote}`, "info");
+        return;
+    }
+    const lines = ["MCP Prompts:", ""];
+    const grouped = new Map();
+    for (const prompt of allPrompts) {
+        const list = grouped.get(prompt.serverName) ?? [];
+        list.push(prompt);
+        grouped.set(prompt.serverName, list);
+    }
+    for (const [serverName, prompts] of [...grouped.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+        lines.push(`${serverName}:`);
+        for (const prompt of prompts.sort((a, b) => a.commandName.localeCompare(b.commandName))) {
+            const args = prompt.arguments
+                .map((argument) => (argument.required ? `<${argument.name}>` : `[${argument.name}]`))
+                .join(" ");
+            lines.push(`  /${prompt.commandName}${args ? ` ${args}` : ""}`);
+            if (prompt.description)
+                lines.push(`      ${prompt.description}`);
+        }
+        lines.push("");
+    }
+    lines.push(`Total: ${allPrompts.length} prompt${allPrompts.length === 1 ? "" : "s"}`);
+    if (failedPromptServers.length > 0) {
+        lines.push(`Prompt discovery failed for: ${failedPromptServers.join(", ")}. Cached prompt metadata may be stale.`);
+    }
+    ctx.ui.notify(lines.join("\n"), "info");
+}
+export async function showTools(state, ctx) {
+    if (!ctx.hasUI)
+        return;
+    const allTools = [...state.toolMetadata.entries()]
+        .filter(([serverName]) => !isServerDisabled(state.config.mcpServers[serverName]))
+        .flatMap(([, metadata]) => metadata.map((m) => m.name));
+    if (allTools.length === 0) {
+        ctx.ui.notify("No MCP tools available", "info");
+        return;
+    }
+    const lines = ["MCP Tools:", "", ...allTools.map((t) => `  ${t}`), "", `Total: ${allTools.length} tools`];
+    ctx.ui.notify(lines.join("\n"), "info");
+}
+export async function reconnectServer(state, ctx, name) {
+    const definition = state.config.mcpServers[name];
+    const ui = ctx.hasUI ? ctx.ui : undefined;
+    const signal = state.owner?.signal;
+    if (!definition) {
+        if (ui) {
+            ui.notify(`Server "${name}" not found in config`, "error");
+        }
+        return false;
+    }
+    if (isServerDisabled(definition)) {
+        if (ui)
+            ui.notify(`MCP: ${name} is disabled. Run /mcp enable ${name}, then /reload.`, "warning");
+        return false;
+    }
+    try {
+        await state.manager.close(name);
+        state.owner?.throwIfInactive();
+        const connection = signal
+            ? await state.manager.connect(name, definition, signal)
+            : await state.manager.connect(name, definition);
+        state.owner?.throwIfInactive();
+        if (connection.status === "needs-auth") {
+            if (ui) {
+                ui.notify(`MCP: ${name} requires OAuth. Run /mcp-auth ${name} first.`, "warning");
+            }
+            updateStatusBar(state);
+            return false;
+        }
+        const prefix = state.config.settings?.toolPrefix ?? "server";
+        const { metadata, failedTools } = buildToolMetadata(connection.tools, connection.resources, definition, name, prefix, state.config.mcpServers, state.toolMetadata);
+        state.toolMetadata.set(name, metadata);
+        if (!connection.promptDiscoveryFailed) {
+            state.promptMetadata?.set(name, reconstructPromptMetadata(name, connection.prompts ?? [], prefix, definition));
+            state.promptMetadataLive?.add(name);
+        }
+        if (connection.instructions) {
+            state.serverInstructions.set(name, connection.instructions);
+        }
+        else {
+            state.serverInstructions.delete(name);
+        }
+        updateMetadataCache(state, name);
+        notifyToolMetadataUpdated(state, name, "command-reconnect");
+        markKeepAliveAfterConnect(state, name);
+        clearFailure(state, name);
+        if (ui) {
+            ui.notify(`MCP: Reconnected to ${name} (${connection.tools.length} tools, ${connection.resources.length} resources)`, "info");
+            if (failedTools.length > 0) {
+                ui.notify(`MCP: ${name} - ${failedTools.length} tools skipped`, "warning");
+            }
+        }
+        updateStatusBar(state);
+        return true;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (isAbortError(error, signal))
+            throw error;
+        recordFailure(state, name, message);
+        if (ui) {
+            ui.notify(`MCP: Failed to reconnect to ${name}: ${sanitizeTerminalText(message)}`, "error");
+        }
+        updateStatusBar(state);
+        return false;
+    }
+}
+export async function reconnectServers(state, ctx, targetServer) {
+    if (targetServer && !state.config.mcpServers[targetServer]) {
+        if (ctx.hasUI) {
+            ctx.ui.notify(`Server "${targetServer}" not found in config`, "error");
+        }
+        return;
+    }
+    const names = targetServer ? [targetServer] : Object.keys(state.config.mcpServers);
+    for (const name of names) {
+        await reconnectServer(state, ctx, name);
+    }
+    updateStatusBar(state);
+}
+/** Whether stored OAuth tokens actually exist for a server — independent of whether it's currently connected. */
+function isSignedInForOAuth(serverName, definition, state) {
+    try {
+        const serverUrl = resolveServerUrl(definition);
+        if (!serverUrl)
+            return false;
+        const authStatus = inspectAuthForUrl(serverName, serverUrl, state.authStorageOptions);
+        return authStatus.status !== "absent" && authStatus.status !== "unavailable" && !!authStatus.entry.tokens;
+    }
+    catch {
+        return false;
+    }
+}
+export async function authenticateServer(serverName, config, ctx, signal, runtime, nexus) {
+    const ui = ctx.hasUI ? ctx.ui : undefined;
+    const cwd = ctx.cwd;
+    signal ??= ctx.signal;
+    if (!ui)
+        return { ok: false, message: "OAuth authentication requires an interactive session." };
+    const definition = config.mcpServers[serverName];
+    if (!definition) {
+        const message = `Server "${serverName}" not found in config`;
+        ui.notify(message, "error");
+        return { ok: false, message };
+    }
+    if (isServerDisabled(definition)) {
+        const message = `Server "${serverName}" is disabled. Run /mcp enable ${serverName}, then /reload.`;
+        ui.notify(message, "warning");
+        return { ok: false, message };
+    }
+    if (!supportsOAuth(definition)) {
+        const message = `Server "${serverName}" does not use OAuth authentication. Set "auth": "oauth" or omit auth for auto-detection.`;
+        ui.notify(`Server "${serverName}" does not use OAuth authentication.\n` +
+            `Set "auth": "oauth" or omit auth for auto-detection.`, "error");
+        return { ok: false, message };
+    }
+    try {
+        const serverUrl = resolveServerUrl(definition);
+        if (!serverUrl) {
+            const message = `Server "${serverName}" has no URL configured (OAuth requires HTTP transport)`;
+            ui.notify(message, "error");
+            return { ok: false, message };
+        }
+        ui.setStatus("mcp-auth", `Authenticating ${serverName}...`);
+        const authStorageOptions = getAuthStorageOptions(config.settings?.oauthDir, cwd);
+        const status = await authenticate(serverName, serverUrl, definition, {
+            ...(authStorageOptions.baseDir ? { authStorageOptions } : {}),
+            onAuthorizationUrl: async (authorizationUrl) => {
+                // Best-effort: launch the user's browser straight to the authorization page
+                // instead of relying on them to click (or copy) the link printed below.
+                if (!nexus)
+                    return;
+                try {
+                    await openPath(nexus, authorizationUrl);
+                }
+                catch {
+                    // The link is still shown in the prompt text below; nothing else to do here.
+                }
+            },
+            onAuthorizationInput: async (authorizationUrl, inputSignal) => {
+                if (inputSignal.aborted)
+                    return undefined;
+                return ui.input(`Complete ${serverName} OAuth\n\n` +
+                    `${terminalHyperlink("Open authorization page", authorizationUrl)}\n${authorizationUrl}\n\n` +
+                    "Approve access, then paste the full localhost callback URL below.", undefined, { signal: inputSignal });
+            },
+            ...(signal ? { signal } : {}),
+            ...(runtime ? { runtime } : {}),
+        });
+        if (signal?.aborted)
+            signal.throwIfAborted();
+        if (status === "authenticated") {
+            const message = `OAuth authentication successful for "${serverName}".`;
+            ui.notify(message, "info");
+            return { ok: true, message };
+        }
+        const message = `OAuth authentication failed for "${serverName}".`;
+        ui.notify(message, "error");
+        return { ok: false, message };
+    }
+    catch (error) {
+        if (signal?.aborted)
+            throw error;
+        const message = error instanceof Error ? error.message : String(error);
+        ui.notify(`Failed to authenticate "${serverName}": ${message}`, "error");
+        return { ok: false, message };
+    }
+    finally {
+        if (!signal?.aborted)
+            ui.setStatus("mcp-auth", undefined);
+    }
+}
+export async function logoutServer(serverName, state, ctx) {
+    const definition = state.config.mcpServers[serverName];
+    const ui = ctx.hasUI ? ctx.ui : undefined;
+    if (!definition) {
+        const message = `Server "${serverName}" not found in config`;
+        if (ui)
+            ui.notify(message, "error");
+        return { ok: false, message };
+    }
+    const signal = state.owner?.signal;
+    try {
+        await removeAuth(serverName, {
+            authStorageOptions: state.authStorageOptions,
+            signal,
+            runtime: state.oauthRuntime,
+        });
+    }
+    catch (error) {
+        if (isAbortError(error, signal))
+            throw error;
+        const message = error instanceof Error ? error.message : String(error);
+        if (ui) {
+            ui.notify(`Failed to clear OAuth credentials for "${serverName}": ${sanitizeTerminalText(message)}`, "error");
+        }
+        return { ok: false, message };
+    }
+    state.owner?.throwIfInactive();
+    try {
+        await state.manager.close(serverName);
+    }
+    catch (error) {
+        if (isAbortError(error, signal))
+            throw error;
+        const message = error instanceof Error ? error.message : String(error);
+        if (ui) {
+            ui.notify(`OAuth credentials were cleared for "${serverName}", but its connection could not be closed: ${sanitizeTerminalText(message)}`, "error");
+        }
+        return { ok: false, message };
+    }
+    state.owner?.throwIfInactive();
+    updateStatusBar(state);
+    const message = `OAuth credentials cleared for "${serverName}". Run /mcp-auth ${serverName} to authenticate again.`;
+    if (ui)
+        ui.notify(message, "info");
+    return { ok: true, message };
+}
+function validateBearerTokenStoreServer(serverName, state) {
+    const safeName = sanitizeTerminalText(serverName);
+    const definition = state.config.mcpServers[serverName];
+    if (!definition)
+        return { ok: false, message: `Server "${safeName}" not found in config`, type: "error" };
+    if (isServerDisabled(definition))
+        return {
+            ok: false,
+            message: `Server "${safeName}" is disabled. Run /mcp enable ${safeName}, then /reload.`,
+            type: "warning",
+        };
+    if (definition.auth !== "bearer" || definition.bearerTokenStore !== true) {
+        return { ok: false, message: `Server "${safeName}" is not configured for bearerTokenStore.`, type: "error" };
+    }
+    // resolveServerUrl embeds the interpolated URL in its exceptions; redact it
+    // because the URL can carry userinfo or interpolated secrets.
+    let serverUrl;
+    try {
+        serverUrl = resolveServerUrl(definition);
+    }
+    catch {
+        return { ok: false, message: `Server "${safeName}" has an invalid or unresolvable URL.`, type: "error" };
+    }
+    if (!serverUrl)
+        return { ok: false, message: `Server "${safeName}" has no URL configured.`, type: "error" };
+    return { ok: true, serverUrl };
+}
+export async function manageBearerToken(action, serverName, state, ctx) {
+    const ui = ctx.hasUI ? ctx.ui : undefined;
+    const safeName = sanitizeTerminalText(serverName);
+    const validation = validateBearerTokenStoreServer(serverName, state);
+    if (!validation.ok) {
+        if (ui)
+            ui.notify(validation.message, validation.type);
+        return { ok: false, message: validation.message };
+    }
+    if (action === "set") {
+        const message = `Nexus will not collect bearer tokens through an unmasked prompt. Configure bearerTokenEnv for "${safeName}" in MCP config, then reload.`;
+        if (ui)
+            ui.notify(message, "error");
+        return { ok: false, message };
+    }
+    if (action === "status") {
+        const status = inspectBearerTokenForUrl(serverName, validation.serverUrl);
+        const message = status.status === "present"
+            ? `Bearer token is stored for "${safeName}".`
+            : status.status === "url-mismatch"
+                ? `Bearer token is stored for "${safeName}", but its URL does not match the current server URL.`
+                : status.status === "unavailable"
+                    ? status.message
+                    : `No bearer token is stored for "${safeName}".`;
+        if (ui)
+            ui.notify(message, status.status === "unavailable" ? "error" : "info");
+        return { ok: status.status !== "unavailable", message };
+    }
+    try {
+        removeBearerToken(serverName);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (ui)
+            ui.notify(`Failed to remove bearer token for "${safeName}": ${sanitizeTerminalText(message)}`, "error");
+        return { ok: false, message };
+    }
+    const message = `Bearer token removed for "${safeName}".`;
+    if (ui)
+        ui.notify(message, "info");
+    return { ok: true, message };
+}
+const ADD_SERVER_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+function parseKeyValueFlag(flag, raw) {
+    const eq = raw?.indexOf("=") ?? -1;
+    if (!raw || eq <= 0)
+        return { ok: false, error: `${flag} expects KEY=VALUE, got "${raw ?? ""}".` };
+    return { ok: true, key: raw.slice(0, eq), value: raw.slice(eq + 1) };
+}
+/**
+ * Parses `/mcp add <name> ...` arguments. Mirrors the rest of /mcp's naive
+ * whitespace-split argument handling (no quoting support) rather than
+ * inventing a shell-quote parser just for this subcommand.
+ */
+export function parseAddServerArgs(argv) {
+    const name = argv[0];
+    if (!name)
+        return { ok: false, error: "Missing server name." };
+    if (!ADD_SERVER_NAME_PATTERN.test(name)) {
+        return { ok: false, error: `Invalid server name "${name}" — use letters, digits, ".", "_", "-".` };
+    }
+    const rest = argv.slice(1);
+    const env = {};
+    const headers = {};
+    let cwd;
+    let url;
+    let auth;
+    let bearerTokenEnv;
+    let commandArgv;
+    let i = 0;
+    while (i < rest.length) {
+        const token = rest[i];
+        if (token === "--") {
+            commandArgv = rest.slice(i + 1);
+            break;
+        }
+        if (token === "--url") {
+            url = rest[i + 1];
+            i += 2;
+            continue;
+        }
+        if (token === "--env" || token === "--header") {
+            const parsed = parseKeyValueFlag(token, rest[i + 1]);
+            if (!parsed.ok)
+                return parsed;
+            (token === "--env" ? env : headers)[parsed.key] = parsed.value;
+            i += 2;
+            continue;
+        }
+        if (token === "--cwd") {
+            cwd = rest[i + 1];
+            i += 2;
+            continue;
+        }
+        if (token === "--auth") {
+            const value = rest[i + 1];
+            if (value !== "oauth" && value !== "bearer") {
+                return { ok: false, error: `--auth expects "oauth" or "bearer", got "${value ?? ""}".` };
+            }
+            auth = value;
+            i += 2;
+            continue;
+        }
+        if (token === "--bearer-env") {
+            bearerTokenEnv = rest[i + 1];
+            i += 2;
+            continue;
+        }
+        return { ok: false, error: `Unrecognized argument "${token}".` };
+    }
+    if (url && commandArgv) {
+        return { ok: false, error: "Use either --url (remote server) or -- <command> (local server), not both." };
+    }
+    if (!url && !commandArgv) {
+        return { ok: false, error: "Specify a server type: --url <url> (remote), or -- <command> [args...] (local)." };
+    }
+    if (commandArgv) {
+        const [command, ...args] = commandArgv;
+        if (!command)
+            return { ok: false, error: "Missing command after --." };
+        const entry = { command, ...(args.length ? { args } : {}) };
+        if (Object.keys(env).length)
+            entry.env = env;
+        if (cwd)
+            entry.cwd = cwd;
+        return { ok: true, name, entry };
+    }
+    const entry = { url: url };
+    if (Object.keys(headers).length)
+        entry.headers = headers;
+    if (bearerTokenEnv) {
+        entry.bearerTokenEnv = bearerTokenEnv;
+        entry.auth = auth ?? "bearer";
+    }
+    else if (auth) {
+        entry.auth = auth;
+    }
+    return { ok: true, name, entry };
+}
+export const ADD_SERVER_USAGE = [
+    "Usage:",
+    "  /mcp add <name> -- <command> [args...]          local server, runs over stdio",
+    "  /mcp add <name> --url <url>                      remote server over HTTP",
+    "",
+    "Flags:",
+    "  --env KEY=VALUE       extra environment variable (local, repeatable)",
+    "  --cwd <path>          working directory (local)",
+    "  --header KEY=VALUE    extra HTTP header (remote, repeatable)",
+    "  --auth oauth|bearer   auth mode (remote; default is OAuth auto-detection)",
+    "  --bearer-env <VAR>    read a bearer token from this env var (remote)",
+    "",
+    "For fields not covered here (lifecycle, includeTools, ...), edit the config",
+    'file directly — /mcp setup, then "Open detected config paths".',
+].join("\n");
+/** Adds a server to the project's shared MCP config. Reused by both `/mcp add` and any UI entry point. */
+export function addCustomServer(cwd, name, entry) {
+    const path = writeSharedServerEntry(getProjectConfigPath(cwd), name, entry);
+    return { path };
+}
+function buildSharedConfigNoticeLines(configOverridePath, cwd) {
+    const discovery = getMcpStandardConfigSummary(configOverridePath, cwd);
+    const onboardingState = loadOnboardingState();
+    if (!discovery.hasSharedServers || onboardingState.sharedConfigHintShown) {
+        return { lines: [], fingerprint: null };
+    }
+    const sharedSources = discovery.sources.filter((source) => source.kind === "shared" && source.serverCount > 0);
+    const sourceList = sharedSources.map((source) => source.path).join(", ");
+    return {
+        lines: [
+            `Using MCP configuration from ${sourceList}.`,
+            "Nexus writes compatibility imports and MCP-specific overrides only to Nexus configuration files.",
+        ],
+        fingerprint: discovery.fingerprint,
+    };
+}
+export async function openMcpSetup(state, nexus, ctx, configOverridePath, mode = "setup", options = {}) {
+    if (!ctx.hasUI)
+        return { configChanged: false };
+    if (!canRenderPanel(ctx)) {
+        ctx.ui.notify(`The interactive MCP setup panel is only available in the terminal UI (current mode: ${ctx.mode}). Edit .nexus/mcp.json directly, or run /mcp status to review servers.`, "info");
+        return { configChanged: false };
+    }
+    if (state.programmaticConfig) {
+        ctx.ui.notify("MCP setup is unavailable when config is supplied by createMcpAdapter().", "info");
+        return { configChanged: false };
+    }
+    const discovery = getMcpDiscoverySummary(configOverridePath, ctx.cwd, options);
+    const onboardingState = loadOnboardingState();
+    const installedServers = Object.entries(state.config.mcpServers).map(([name, definition]) => {
+        const authCapable = supportsOAuth(definition);
+        return {
+            name,
+            disabled: isServerDisabled(definition),
+            kind: (definition.command ? "stdio" : "http"),
+            authCapable,
+            signedIn: authCapable ? isSignedInForOAuth(name, definition, state) : false,
+        };
+    });
+    let configChanged = false;
+    let overlayHandle;
+    const callbacks = {
+        previewImports: (imports) => previewCompatibilityImports(imports, configOverridePath),
+        previewStarterProject: () => previewStarterProjectConfig(ctx.cwd),
+        previewRepoPrompt: () => {
+            const repoPrompt = getMcpDiscoverySummary(configOverridePath, ctx.cwd, options).repoPrompt;
+            if (!repoPrompt.entry || !repoPrompt.targetPath || !repoPrompt.serverName)
+                return null;
+            return previewSharedServerEntry(repoPrompt.targetPath, repoPrompt.serverName, repoPrompt.entry);
+        },
+        previewKnownServer: (preset) => previewSharedServerEntry(getProjectConfigPath(ctx.cwd), preset.id, preset.entry),
+        adoptImports: async (imports) => {
+            const result = ensureCompatibilityImports(imports, configOverridePath);
+            if (result.added.length > 0)
+                configChanged = true;
+            return result;
+        },
+        scaffoldProjectConfig: async () => {
+            const path = writeStarterProjectConfig(ctx.cwd);
+            configChanged = true;
+            return { path };
+        },
+        addRepoPrompt: async () => {
+            const repoPrompt = getMcpDiscoverySummary(configOverridePath, ctx.cwd, options).repoPrompt;
+            if (!repoPrompt.entry || !repoPrompt.targetPath || !repoPrompt.serverName) {
+                throw new Error("RepoPrompt is not available to add from this setup screen.");
+            }
+            const path = writeSharedServerEntry(repoPrompt.targetPath, repoPrompt.serverName, repoPrompt.entry);
+            configChanged = true;
+            return { path, serverName: repoPrompt.serverName };
+        },
+        addKnownServer: async (preset) => {
+            const path = writeSharedServerEntry(getProjectConfigPath(ctx.cwd), preset.id, preset.entry);
+            configChanged = true;
+            return { path, serverName: preset.name };
+        },
+        openPath: async (targetPath) => {
+            await openPath(nexus, targetPath);
+        },
+        markSetupCompleted: () => {
+            persistSetupCompleted(discovery.fingerprint);
+        },
+        seedEditor: (text) => {
+            if (ctx.hasUI)
+                ctx.ui.setEditorText(text);
+        },
+        toggleServerDisabled: async (serverName, disabled) => {
+            const result = writeProjectServerDisabledOverride(configOverridePath, ctx.cwd, serverName, disabled);
+            if (result.changed)
+                configChanged = true;
+            return { path: result.path, changed: result.changed };
+        },
+        authenticateServer: async (serverName, fallbackEntry) => {
+            // A server added this session isn't in the live config until /reload —
+            // hand authenticateServer a synthetic config with just that one entry
+            // merged in, rather than making the user reload first.
+            const effectiveConfig = state.config.mcpServers[serverName] || !fallbackEntry
+                ? state.config
+                : { ...state.config, mcpServers: { ...state.config.mcpServers, [serverName]: fallbackEntry } };
+            // The auth prompt (the actual link, and the "paste the callback URL"
+            // input) renders as a *separate* overlay. Without hiding this one first,
+            // it stays drawn on top and the auth prompt is invisible underneath it.
+            overlayHandle?.setHidden(true);
+            try {
+                const result = await authenticateServer(serverName, effectiveConfig, ctx, ctx.signal, state.oauthRuntime, nexus);
+                return {
+                    ok: result.ok,
+                    message: result.message ??
+                        (result.ok ? `Signed in to "${serverName}".` : `Sign-in failed for "${serverName}".`),
+                };
+            }
+            finally {
+                overlayHandle?.setHidden(false);
+                overlayHandle?.focus();
+            }
+        },
+    };
+    return new Promise((resolve) => {
+        ctx.ui.custom((tui, _theme, keybindings, done) => {
+            return createMcpSetupPanel(discovery, callbacks, { mode, onboardingState, keybindings, installedServers }, tui, () => {
+                done(undefined);
+                resolve({ configChanged });
+            });
+        }, {
+            overlay: true,
+            overlayOptions: { anchor: "center", width: 92, maxHeight: "90%" },
+            onHandle: (handle) => {
+                overlayHandle = handle;
+            },
+        });
+    });
+}
+function buildMcpPanelCallbacks(state, config, ctx, nexus, getOverlayHandle) {
+    // Panel-only diagnostics keep status inspection from mutating connection
+    // failure state while allowing the existing panel failure UI to show why the
+    // credential store could not be inspected.
+    const authStatusFailures = new Map();
+    return {
+        reconnect: (serverName) => reconnectServer(state, ctx, serverName),
+        canAuthenticate: (serverName) => {
+            const definition = config.mcpServers[serverName];
+            return definition ? !isServerDisabled(definition) && supportsOAuth(definition) : false;
+        },
+        authenticate: async (serverName) => {
+            const overlay = getOverlayHandle?.();
+            overlay?.setHidden(true);
+            try {
+                return await authenticateServer(serverName, config, ctx, state.owner?.signal, state.oauthRuntime, nexus);
+            }
+            finally {
+                overlay?.setHidden(false);
+                overlay?.focus();
+            }
+        },
+        getConnectionStatus: (serverName) => {
+            authStatusFailures.delete(serverName);
+            const definition = config.mcpServers[serverName];
+            if (isServerDisabled(definition))
+                return "disabled";
+            const connection = state.manager.getConnection(serverName);
+            let serverUrl;
+            try {
+                serverUrl = definition ? resolveServerUrl(definition) : undefined;
+            }
+            catch {
+                return "failed";
+            }
+            if (definition?.auth === "oauth" &&
+                serverUrl &&
+                definition.oauth !== false &&
+                definition.oauth?.grantType !== "client_credentials") {
+                const authStatus = inspectAuthForUrl(serverName, serverUrl, state.authStorageOptions);
+                if (authStatus.status === "unavailable") {
+                    authStatusFailures.set(serverName, authStatus.message);
+                    return "failed";
+                }
+                if (authStatus.status === "absent" || !authStatus.entry.tokens) {
+                    return "needs-auth";
+                }
+            }
+            if (connection?.status === "needs-auth")
+                return "needs-auth";
+            if (connection?.status === "connected")
+                return "connected";
+            if (getFailureAgeSeconds(state, serverName) !== null)
+                return "failed";
+            return "idle";
+        },
+        getFailureMessage: (serverName) => authStatusFailures.get(serverName) ?? getFailureMessage(state, serverName),
+        refreshCacheAfterReconnect: (serverName) => {
+            const freshCache = loadMetadataCache();
+            return freshCache?.servers?.[serverName] ?? null;
+        },
+    };
+}
+export async function openMcpPanel(state, nexus, ctx, configOverridePath, onDirectToolsConfigChanged) {
+    if (state.programmaticConfig) {
+        if (ctx.hasUI) {
+            ctx.ui.notify("MCP status is shown from the in-memory SDK config; configuration discovery is unavailable.", "info");
+            await showStatus(state, ctx);
+        }
+        return { configChanged: false };
+    }
+    if (!canRenderPanel(ctx)) {
+        // No overlay here, but the same information is available as text.
+        await showStatus(state, ctx);
+        return { configChanged: false };
+    }
+    if (Object.keys(state.config.mcpServers).length === 0) {
+        return openMcpSetup(state, nexus, ctx, configOverridePath, "empty", { includeHostConfigs: false });
+    }
+    const config = state.config;
+    const cache = loadMetadataCache();
+    const configPath = nexus.getFlag("mcp-config") ?? configOverridePath;
+    const provenanceMap = getServerProvenance(configPath, ctx.cwd);
+    const { lines: noticeLines, fingerprint } = buildSharedConfigNoticeLines(configPath, ctx.cwd);
+    let overlayHandle;
+    const callbacks = buildMcpPanelCallbacks(state, config, ctx, nexus, () => overlayHandle);
+    let configChanged = false;
+    await new Promise((resolve) => {
+        ctx.ui.custom((tui, _theme, keybindings, done) => {
+            return createMcpPanel(config, cache, provenanceMap, callbacks, tui, (result) => {
+                void (async () => {
+                    if (!result.cancelled && result.changes.size > 0) {
+                        writeDirectToolsConfig(result.changes, provenanceMap);
+                        configChanged = true;
+                        await onDirectToolsConfigChanged?.(result.changes);
+                        ctx.ui.notify("Direct tools updated for this session.", "info");
+                    }
+                    done(undefined);
+                    resolve();
+                })().catch((error) => {
+                    const message = error instanceof Error ? error.message : String(error);
+                    ctx.ui.notify(`Direct tools updated, but live refresh failed: ${message}`, "error");
+                    configChanged = true;
+                    done(undefined);
+                    resolve();
+                });
+            }, { noticeLines, keybindings });
+        }, {
+            overlay: true,
+            overlayOptions: { anchor: "center", width: 82 },
+            onHandle: (handle) => {
+                overlayHandle = handle;
+            },
+        });
+    });
+    if (noticeLines.length > 0 && fingerprint) {
+        markSharedConfigHintShown(fingerprint);
+    }
+    return { configChanged };
+}
+export async function openMcpAuthPanel(state, nexus, ctx, configOverridePath) {
+    if (!ctx.hasUI)
+        return { configChanged: false };
+    if (!canRenderPanel(ctx)) {
+        ctx.ui.notify(`The interactive MCP auth panel is only available in the terminal UI (current mode: ${ctx.mode}). Use /mcp-auth <server> to authenticate a specific server.`, "info");
+        return { configChanged: false };
+    }
+    if (state.programmaticConfig) {
+        ctx.ui.notify("Use /mcp-auth <server> to authenticate a server from the in-memory SDK config.", "info");
+        return { configChanged: false };
+    }
+    const config = state.config;
+    const oauthServers = Object.entries(config.mcpServers).filter(([, definition]) => !isServerDisabled(definition) && supportsOAuth(definition));
+    if (oauthServers.length === 0) {
+        ctx.ui.notify("No OAuth-capable MCP servers are configured.", "warning");
+        return { configChanged: false };
+    }
+    const cache = loadMetadataCache();
+    const configPath = nexus.getFlag("mcp-config") ?? configOverridePath;
+    const provenanceMap = getServerProvenance(configPath, ctx.cwd);
+    let overlayHandle;
+    const callbacks = buildMcpPanelCallbacks(state, config, ctx, nexus, () => overlayHandle);
+    await new Promise((resolve) => {
+        ctx.ui.custom((tui, _theme, keybindings, done) => {
+            return createMcpPanel(config, cache, provenanceMap, callbacks, tui, () => {
+                done(undefined);
+                resolve();
+            }, {
+                authOnly: true,
+                keybindings,
+                noticeLines: ["Select an OAuth MCP server and press Enter or ctrl+a to authenticate."],
+            });
+        }, {
+            overlay: true,
+            overlayOptions: { anchor: "center", width: 82 },
+            onHandle: (handle) => {
+                overlayHandle = handle;
+            },
+        });
+    });
+    return { configChanged: false };
+}
+//# sourceMappingURL=commands.js.map