@ashx-j/lunr 0.2.25 → 0.2.27

package/dist/builtin-extensions/pi-mcp-adapter/mcp-oauth-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-oauth-provider.d.ts","sourceRoot":"","sources":["../../../src/builtin-extensions/pi-mcp-adapter/mcp-oauth-provider.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAA;AAE5G,OAAO,KAAK,EACV,mBAAmB,EACnB,WAAW,EACX,sBAAsB,EACtB,0BAA0B,EAC3B,MAAM,0CAA0C,CAAA;AAejD,QAAA,MAAM,2BAA2B,QAAQ,CAAA;AACzC,QAAA,MAAM,2BAA2B,cAAc,CAAA;AAc/C,wBAAgB,8BAA8B,IAAI,MAAM,CAEvD;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEvD;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEvD;AAED,sCAAsC;AACtC,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAAA;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,4CAA4C;AAC5C,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/C;AAED;;;GAGG;AACH,qBAAa,gBAAiB,YAAW,mBAAmB;IAIxD,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,SAAS;IANnB,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAoB;IAExD,YACU,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,iBAAiB,EAKrC;IAED,OAAO,KAAK,qBAAqB,GAEhC;IAED;;;OAGG;IACH,IAAI,WAAW,IAAI,MAAM,GAAG,SAAS,CAEpC;IAED;;;OAGG;IACH,IAAI,cAAc,IAAI,mBAAmB,CAyBxC;IAED;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAyBrE;IAED;;OAEG;IACG,qBAAqB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAU3E;IAED;;;OAGG;IACG,MAAM,IAAI,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAc/C;IAED;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAQnD;IAED;;;;;;;;OAQG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAalE;IAED;;OAEG;IACG,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;IAED;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CASpC;IAED;;OAEG;IACG,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5C;IAED;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAW7B;IAED;;;OAGG;IACG,qBAAqB,CAAC,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAY5E;IAED;;;OAGG;IACH,uBAAuB,EAAE,uBAAuB,CAwC/C;IAED,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAW/D;CACF;AAED,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,CAAA","sourcesContent":["// @ts-nocheck\n/**\n * MCP OAuth Provider\n * \n * Implementation of the MCP SDK's OAuthClientProvider interface.\n * Handles OAuth client registration, token storage, and authorization redirection.\n */\n\nimport type { AddClientAuthentication, OAuthClientProvider } from \"@modelcontextprotocol/sdk/client/auth.js\"\nimport { UnauthorizedError } from \"@modelcontextprotocol/sdk/client/auth.js\"\nimport type {\n  OAuthClientMetadata,\n  OAuthTokens,\n  OAuthClientInformation,\n  OAuthClientInformationFull,\n} from \"@modelcontextprotocol/sdk/shared/auth.js\"\nimport {\n  getAuthForUrl,\n  updateTokens,\n  updateClientInfo,\n  updateCodeVerifier,\n  updateOAuthState,\n  clearAllCredentials,\n  clearClientInfo,\n  clearTokens,\n  type StoredTokens,\n  type StoredClientInfo,\n} from \"./mcp-auth.ts\"\n\n// Callback server configuration\nconst DEFAULT_OAUTH_CALLBACK_PORT = 19876\nconst DEFAULT_OAUTH_CALLBACK_PATH = \"/callback\"\n\nlet configuredOAuthCallbackPort = DEFAULT_OAUTH_CALLBACK_PORT\n\nif (process.env.MCP_OAUTH_CALLBACK_PORT) {\n  const parsedPort = Number.parseInt(process.env.MCP_OAUTH_CALLBACK_PORT, 10)\n  if (Number.isInteger(parsedPort) && parsedPort > 0 && parsedPort <= 65535) {\n    configuredOAuthCallbackPort = parsedPort\n  }\n}\n\nlet oauthCallbackPort = configuredOAuthCallbackPort\nlet oauthCallbackPath = DEFAULT_OAUTH_CALLBACK_PATH\n\nexport function getConfiguredOAuthCallbackPort(): number {\n  return configuredOAuthCallbackPort\n}\n\nexport function getOAuthCallbackPort(): number {\n  return oauthCallbackPort\n}\n\nexport function setOAuthCallbackPort(port: number): void {\n  oauthCallbackPort = port\n}\n\nexport function getOAuthCallbackPath(): string {\n  return oauthCallbackPath\n}\n\nexport function setOAuthCallbackPath(path: string): void {\n  oauthCallbackPath = path.startsWith(\"/\") ? path : `/${path}`\n}\n\n/** Configuration options for OAuth */\nexport interface McpOAuthConfig {\n  grantType?: \"authorization_code\" | \"client_credentials\"\n  clientId?: string\n  clientSecret?: string\n  scope?: string\n  redirectUri?: string\n  clientName?: string\n  clientUri?: string\n}\n\n/** Callbacks for OAuth flow interactions */\nexport interface McpOAuthCallbacks {\n  onRedirect: (url: URL) => void | Promise<void>\n}\n\n/**\n * OAuth provider implementation for MCP servers.\n * Implements the OAuthClientProvider interface from the MCP SDK.\n */\nexport class McpOAuthProvider implements OAuthClientProvider {\n  private readonly redirectUrlSnapshot: string | undefined\n\n  constructor(\n    private serverName: string,\n    private serverUrl: string,\n    private config: McpOAuthConfig,\n    private callbacks: McpOAuthCallbacks,\n  ) {\n    this.redirectUrlSnapshot = config.grantType === \"client_credentials\"\n      ? undefined\n      : config.redirectUri ?? `http://localhost:${getOAuthCallbackPort()}${getOAuthCallbackPath()}`\n  }\n\n  private get usesClientCredentials(): boolean {\n    return this.config.grantType === \"client_credentials\"\n  }\n\n  /**\n   * The redirect URL for OAuth callbacks.\n   * This must match the redirect_uri in client metadata.\n   */\n  get redirectUrl(): string | undefined {\n    return this.redirectUrlSnapshot\n  }\n\n  /**\n   * Client metadata for dynamic registration.\n   * Describes this client to the OAuth authorization server.\n   */\n  get clientMetadata(): OAuthClientMetadata {\n    if (this.usesClientCredentials) {\n      return {\n        client_name: this.config.clientName ?? \"Pi Coding Agent\",\n        client_uri: this.config.clientUri ?? \"https://github.com/nicobailon/pi-mcp-adapter\",\n        redirect_uris: [],\n        grant_types: [\"client_credentials\"],\n        token_endpoint_auth_method: this.config.clientSecret ? \"client_secret_post\" : \"none\",\n      }\n    }\n\n    const redirectUrl = this.redirectUrl\n    if (!redirectUrl) {\n      throw new Error(\"redirectUrl is required for authorization_code flow\")\n    }\n\n    return {\n      redirect_uris: [redirectUrl],\n      client_name: this.config.clientName ?? \"Pi Coding Agent\",\n      client_uri: this.config.clientUri ?? \"https://github.com/nicobailon/pi-mcp-adapter\",\n      grant_types: [\"authorization_code\", \"refresh_token\"],\n      response_types: [\"code\"],\n      token_endpoint_auth_method: this.config.clientSecret ? \"client_secret_post\" : \"none\",\n      ...(this.config.scope !== undefined ? { scope: this.config.scope } : {}),\n    }\n  }\n\n  /**\n   * Get client information (for pre-registered or dynamically registered clients).\n   * Returns undefined if no client info exists or if the server URL has changed.\n   */\n  async clientInformation(): Promise<OAuthClientInformation | undefined> {\n    // Check config first (pre-registered client)\n    if (this.config.clientId) {\n      return {\n        client_id: this.config.clientId,\n        client_secret: this.config.clientSecret,\n      }\n    }\n\n    // Check stored client info (from dynamic registration)\n    // Use getAuthForUrl to validate credentials are for the current server URL\n    const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n    if (entry?.clientInfo) {\n      // Check if client secret has expired\n      if (entry.clientInfo.clientSecretExpiresAt && entry.clientInfo.clientSecretExpiresAt < Date.now() / 1000) {\n        return undefined\n      }\n      return {\n        client_id: entry.clientInfo.clientId,\n        client_secret: entry.clientInfo.clientSecret,\n      }\n    }\n\n    // No client info or URL changed - will trigger dynamic registration\n    return undefined\n  }\n\n  /**\n   * Save client information from dynamic registration.\n   */\n  async saveClientInformation(info: OAuthClientInformationFull): Promise<void> {\n    const redirectUris = info.redirect_uris ?? (this.redirectUrl ? [this.redirectUrl] : undefined)\n    const clientInfo: StoredClientInfo = {\n      clientId: info.client_id,\n      clientSecret: info.client_secret,\n      clientIdIssuedAt: info.client_id_issued_at,\n      clientSecretExpiresAt: info.client_secret_expires_at,\n      redirectUris,\n    }\n    updateClientInfo(this.serverName, clientInfo, this.serverUrl)\n  }\n\n  /**\n   * Get stored OAuth tokens.\n   * Returns undefined if no tokens exist or if the server URL has changed.\n   */\n  async tokens(): Promise<OAuthTokens | undefined> {\n    // Use getAuthForUrl to validate tokens are for the current server URL\n    const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n    if (!entry?.tokens) return undefined\n\n    return {\n      access_token: entry.tokens.accessToken,\n      token_type: \"Bearer\",\n      refresh_token: entry.tokens.refreshToken,\n      expires_in: entry.tokens.expiresAt\n        ? Math.max(0, Math.floor(entry.tokens.expiresAt - Date.now() / 1000))\n        : undefined,\n      scope: entry.tokens.scope,\n    }\n  }\n\n  /**\n   * Save OAuth tokens.\n   */\n  async saveTokens(tokens: OAuthTokens): Promise<void> {\n    const storedTokens: StoredTokens = {\n      accessToken: tokens.access_token,\n      refreshToken: tokens.refresh_token,\n      expiresAt: tokens.expires_in ? Date.now() / 1000 + tokens.expires_in : undefined,\n      scope: tokens.scope,\n    }\n    updateTokens(this.serverName, storedTokens, this.serverUrl)\n  }\n\n  /**\n   * Redirect the user to the authorization URL.\n   * This opens the browser for the user to authenticate.\n   *\n   * Throws UnauthorizedError when called outside of a user-initiated flow\n   * (no oauthState saved by startAuth). That path is reached when the SDK\n   * falls through from a failed refresh into a fresh authorization_code\n   * flow, which library hosts cannot complete in-process.\n   */\n  async redirectToAuthorization(authorizationUrl: URL): Promise<void> {\n    if (this.usesClientCredentials) {\n      throw new Error(\"redirectToAuthorization is not used for client_credentials flow\")\n    }\n    // No saved oauthState means we're on the post-refresh authorize fallback.\n    const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n    if (!entry?.oauthState) {\n      throw new UnauthorizedError(\n        `Re-authentication required for MCP server: ${this.serverName}`,\n      )\n    }\n    // URL is passed to callback, not logged (may contain sensitive params)\n    await this.callbacks.onRedirect(authorizationUrl)\n  }\n\n  /**\n   * Save the PKCE code verifier.\n   */\n  async saveCodeVerifier(codeVerifier: string): Promise<void> {\n    updateCodeVerifier(this.serverName, codeVerifier, this.serverUrl)\n  }\n\n  /**\n   * Get the stored PKCE code verifier.\n   * @throws Error if no code verifier is stored\n   */\n  async codeVerifier(): Promise<string> {\n    if (this.usesClientCredentials) {\n      throw new Error(\"codeVerifier is not used for client_credentials flow\")\n    }\n    const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n    if (!entry?.codeVerifier) {\n      throw new Error(`No code verifier saved for MCP server: ${this.serverName}`)\n    }\n    return entry.codeVerifier\n  }\n\n  /**\n   * Save the OAuth state parameter for CSRF protection.\n   */\n  async saveState(state: string): Promise<void> {\n    updateOAuthState(this.serverName, state, this.serverUrl)\n  }\n\n  /**\n   * Get the stored OAuth state parameter.\n   * @throws UnauthorizedError if no flow is in progress (see redirectToAuthorization)\n   */\n  async state(): Promise<string> {\n    if (this.usesClientCredentials) {\n      throw new Error(\"state is not used for client_credentials flow\")\n    }\n    const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n    if (!entry?.oauthState) {\n      throw new UnauthorizedError(\n        `Re-authentication required for MCP server: ${this.serverName}`,\n      )\n    }\n    return entry.oauthState\n  }\n\n  /**\n   * Invalidate credentials when authentication fails.\n   * Clears tokens, client info, or all credentials based on the type.\n   */\n  async invalidateCredentials(type: \"all\" | \"client\" | \"tokens\"): Promise<void> {\n    switch (type) {\n      case \"all\":\n        clearAllCredentials(this.serverName)\n        break\n      case \"client\":\n        clearClientInfo(this.serverName)\n        break\n      case \"tokens\":\n        clearTokens(this.serverName)\n        break\n    }\n  }\n\n  /**\n   * Adds configured authorization-code scope without replacing the SDK's\n   * default token endpoint authentication behavior.\n   */\n  addClientAuthentication: AddClientAuthentication = async (headers, params, _url, metadata) => {\n    if (params.get(\"grant_type\") === \"authorization_code\" && !params.has(\"scope\") && this.config.scope) {\n      params.set(\"scope\", this.config.scope)\n    }\n\n    const clientInfo = await this.clientInformation()\n    if (!clientInfo) {\n      return\n    }\n\n    const supportedMethods = metadata?.token_endpoint_auth_methods_supported ?? []\n    const hasClientSecret = clientInfo.client_secret !== undefined\n    let authMethod: \"client_secret_basic\" | \"client_secret_post\" | \"none\"\n\n    if (supportedMethods.length === 0) {\n      authMethod = hasClientSecret ? \"client_secret_post\" : \"none\"\n    } else if (hasClientSecret && supportedMethods.includes(\"client_secret_basic\")) {\n      authMethod = \"client_secret_basic\"\n    } else if (hasClientSecret && supportedMethods.includes(\"client_secret_post\")) {\n      authMethod = \"client_secret_post\"\n    } else if (supportedMethods.includes(\"none\")) {\n      authMethod = \"none\"\n    } else {\n      authMethod = hasClientSecret ? \"client_secret_post\" : \"none\"\n    }\n\n    if (authMethod === \"client_secret_basic\") {\n      if (!clientInfo.client_secret) {\n        throw new Error(\"client_secret_basic authentication requires a client_secret\")\n      }\n      headers.set(\"Authorization\", `Basic ${Buffer.from(`${clientInfo.client_id}:${clientInfo.client_secret}`).toString(\"base64\")}`)\n      return\n    }\n\n    if (!params.has(\"client_id\")) {\n      params.set(\"client_id\", clientInfo.client_id)\n    }\n    if (authMethod === \"client_secret_post\" && clientInfo.client_secret && !params.has(\"client_secret\")) {\n      params.set(\"client_secret\", clientInfo.client_secret)\n    }\n  }\n\n  prepareTokenRequest(scope?: string): URLSearchParams | undefined {\n    if (!this.usesClientCredentials) {\n      return undefined\n    }\n\n    const params = new URLSearchParams({ grant_type: \"client_credentials\" })\n    const requestedScope = scope ?? this.config.scope\n    if (requestedScope) {\n      params.set(\"scope\", requestedScope)\n    }\n    return params\n  }\n}\n\nexport { DEFAULT_OAUTH_CALLBACK_PORT, DEFAULT_OAUTH_CALLBACK_PATH }\n"]}
+{"version":3,"file":"mcp-oauth-provider.d.ts","sourceRoot":"","sources":["../../../src/builtin-extensions/pi-mcp-adapter/mcp-oauth-provider.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAA;AAE5G,OAAO,KAAK,EACV,mBAAmB,EACnB,WAAW,EACX,sBAAsB,EACtB,0BAA0B,EAC3B,MAAM,0CAA0C,CAAA;AACjD,OAAO,EAUL,KAAK,gBAAgB,EACtB,MAAM,eAAe,CAAA;AAItB,qFAAqF;AACrF,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,WAAW,CAAA;IACnB,UAAU,CAAC,EAAE,gBAAgB,CAAA;CAC9B;AAGD,QAAA,MAAM,2BAA2B,QAAQ,CAAA;AACzC,QAAA,MAAM,2BAA2B,cAAc,CAAA;AAc/C,wBAAgB,8BAA8B,IAAI,MAAM,CAEvD;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEvD;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEvD;AAED,sCAAsC;AACtC,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAAA;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,4CAA4C;AAC5C,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/C;AAED;;;GAGG;AACH,qBAAa,gBAAiB,YAAW,mBAAmB;IAMxD,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,SAAS,CAAC;IATpB,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAoB;IACxD,OAAO,CAAC,cAAc,CAAC,CAAkB;IACzC,OAAO,CAAC,oBAAoB,CAAQ;IAEpC,YACU,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,iBAAiB,EAC5B,SAAS,CAAC,+BAAmB,EAWtC;IAED,OAAO,KAAK,qBAAqB,GAEhC;IAED;;;OAGG;IACH,IAAI,WAAW,IAAI,MAAM,GAAG,SAAS,CAEpC;IAED;;;OAGG;IACH,IAAI,cAAc,IAAI,mBAAmB,CAyBxC;IAED;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAwBrE;IAED;;OAEG;IACG,qBAAqB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAe3E;IAED;;;OAGG;IACG,MAAM,IAAI,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAc/C;IAED;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAcnD;IAED;;;;;;;;OAQG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBlE;IAED;;OAEG;IACG,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO1D;IAED;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAcpC;IAED;;OAEG;IACG,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO5C;IAED;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAa7B;IAED;;;OAGG;IACG,qBAAqB,CAAC,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB5E;IAED;;;OAGG;IACH,uBAAuB,EAAE,uBAAuB,CAwC/C;IAED,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAW/D;CACF;AAED,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,CAAA","sourcesContent":["// @ts-nocheck\n/**\n * MCP OAuth Provider\n * \n * Implementation of the MCP SDK's OAuthClientProvider interface.\n * Handles OAuth client registration, token storage, and authorization redirection.\n */\n\nimport type { AddClientAuthentication, OAuthClientProvider } from \"@modelcontextprotocol/sdk/client/auth.js\"\nimport { UnauthorizedError } from \"@modelcontextprotocol/sdk/client/auth.js\"\nimport type {\n  OAuthClientMetadata,\n  OAuthTokens,\n  OAuthClientInformation,\n  OAuthClientInformationFull,\n} from \"@modelcontextprotocol/sdk/shared/auth.js\"\nimport {\n  getAuthForUrl,\n  updateTokens,\n  updateClientInfo,\n  updateCodeVerifier,\n  updateOAuthState,\n  clearAllCredentials,\n  clearClientInfo,\n  clearTokens,\n  type StoredTokens,\n  type StoredClientInfo,\n} from \"./mcp-auth.ts\"\n\nimport { throwIfAborted } from \"./abort.ts\"\n\n/** Temporary authorization state belongs to one flow, never the credential cache. */\nexport interface McpOAuthFlowState {\n  oauthState: string\n  codeVerifier?: string\n  signal: AbortSignal\n  clientInfo?: StoredClientInfo\n}\n\n// Callback server configuration\nconst DEFAULT_OAUTH_CALLBACK_PORT = 19876\nconst DEFAULT_OAUTH_CALLBACK_PATH = \"/callback\"\n\nlet configuredOAuthCallbackPort = DEFAULT_OAUTH_CALLBACK_PORT\n\nif (process.env.MCP_OAUTH_CALLBACK_PORT) {\n  const parsedPort = Number.parseInt(process.env.MCP_OAUTH_CALLBACK_PORT, 10)\n  if (Number.isInteger(parsedPort) && parsedPort > 0 && parsedPort <= 65535) {\n    configuredOAuthCallbackPort = parsedPort\n  }\n}\n\nlet oauthCallbackPort = configuredOAuthCallbackPort\nlet oauthCallbackPath = DEFAULT_OAUTH_CALLBACK_PATH\n\nexport function getConfiguredOAuthCallbackPort(): number {\n  return configuredOAuthCallbackPort\n}\n\nexport function getOAuthCallbackPort(): number {\n  return oauthCallbackPort\n}\n\nexport function setOAuthCallbackPort(port: number): void {\n  oauthCallbackPort = port\n}\n\nexport function getOAuthCallbackPath(): string {\n  return oauthCallbackPath\n}\n\nexport function setOAuthCallbackPath(path: string): void {\n  oauthCallbackPath = path.startsWith(\"/\") ? path : `/${path}`\n}\n\n/** Configuration options for OAuth */\nexport interface McpOAuthConfig {\n  grantType?: \"authorization_code\" | \"client_credentials\"\n  clientId?: string\n  clientSecret?: string\n  scope?: string\n  redirectUri?: string\n  clientName?: string\n  clientUri?: string\n}\n\n/** Callbacks for OAuth flow interactions */\nexport interface McpOAuthCallbacks {\n  onRedirect: (url: URL) => void | Promise<void>\n}\n\n/**\n * OAuth provider implementation for MCP servers.\n * Implements the OAuthClientProvider interface from the MCP SDK.\n */\nexport class McpOAuthProvider implements OAuthClientProvider {\n  private readonly redirectUrlSnapshot: string | undefined\n  private flowClientInfo?: StoredClientInfo\n  private flowClientInfoLoaded = false\n\n  constructor(\n    private serverName: string,\n    private serverUrl: string,\n    private config: McpOAuthConfig,\n    private callbacks: McpOAuthCallbacks,\n    private flowState?: McpOAuthFlowState,\n  ) {\n    if (flowState) {\n      const info = flowState.clientInfo\n      this.flowClientInfo = info?.clientSecretExpiresAt && info.clientSecretExpiresAt < Date.now() / 1000\n        ? undefined : info\n      this.flowClientInfoLoaded = true\n    }\n    this.redirectUrlSnapshot = config.grantType === \"client_credentials\"\n      ? undefined\n      : config.redirectUri ?? `http://localhost:${getOAuthCallbackPort()}${getOAuthCallbackPath()}`\n  }\n\n  private get usesClientCredentials(): boolean {\n    return this.config.grantType === \"client_credentials\"\n  }\n\n  /**\n   * The redirect URL for OAuth callbacks.\n   * This must match the redirect_uri in client metadata.\n   */\n  get redirectUrl(): string | undefined {\n    return this.redirectUrlSnapshot\n  }\n\n  /**\n   * Client metadata for dynamic registration.\n   * Describes this client to the OAuth authorization server.\n   */\n  get clientMetadata(): OAuthClientMetadata {\n    if (this.usesClientCredentials) {\n      return {\n        client_name: this.config.clientName ?? \"lunR\",\n        ...(this.config.clientUri ? { client_uri: this.config.clientUri } : {}),\n        redirect_uris: [],\n        grant_types: [\"client_credentials\"],\n        token_endpoint_auth_method: this.config.clientSecret ? \"client_secret_post\" : \"none\",\n      }\n    }\n\n    const redirectUrl = this.redirectUrl\n    if (!redirectUrl) {\n      throw new Error(\"redirectUrl is required for authorization_code flow\")\n    }\n\n    return {\n      redirect_uris: [redirectUrl],\n      client_name: this.config.clientName ?? \"lunR\",\n      ...(this.config.clientUri ? { client_uri: this.config.clientUri } : {}),\n      grant_types: [\"authorization_code\", \"refresh_token\"],\n      response_types: [\"code\"],\n      token_endpoint_auth_method: this.config.clientSecret ? \"client_secret_post\" : \"none\",\n      ...(this.config.scope !== undefined ? { scope: this.config.scope } : {}),\n    }\n  }\n\n  /**\n   * Get client information (for pre-registered or dynamically registered clients).\n   * Returns undefined if no client info exists or if the server URL has changed.\n   */\n  async clientInformation(): Promise<OAuthClientInformation | undefined> {\n    // Check config first (pre-registered client)\n    if (this.config.clientId) {\n      return {\n        client_id: this.config.clientId,\n        client_secret: this.config.clientSecret,\n      }\n    }\n\n    // An active flow keeps the registration it started with even if another\n    // session uses the same server name with a different endpoint.\n    if (!this.flowState || !this.flowClientInfoLoaded) {\n      const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n      throwIfAborted(this.flowState?.signal)\n      const info = entry?.clientInfo\n      this.flowClientInfo = info?.clientSecretExpiresAt && info.clientSecretExpiresAt < Date.now() / 1000\n        ? undefined : info\n      this.flowClientInfoLoaded = true\n    }\n    if (!this.flowClientInfo) return undefined\n    return {\n      client_id: this.flowClientInfo.clientId,\n      client_secret: this.flowClientInfo.clientSecret,\n    }\n  }\n\n  /**\n   * Save client information from dynamic registration.\n   */\n  async saveClientInformation(info: OAuthClientInformationFull): Promise<void> {\n    throwIfAborted(this.flowState?.signal)\n    const redirectUris = info.redirect_uris ?? (this.redirectUrl ? [this.redirectUrl] : undefined)\n    const clientInfo: StoredClientInfo = {\n      clientId: info.client_id,\n      clientSecret: info.client_secret,\n      clientIdIssuedAt: info.client_id_issued_at,\n      clientSecretExpiresAt: info.client_secret_expires_at,\n      redirectUris,\n    }\n    if (this.flowState) {\n      this.flowClientInfo = clientInfo\n      this.flowClientInfoLoaded = true\n    }\n    updateClientInfo(this.serverName, clientInfo, this.serverUrl)\n  }\n\n  /**\n   * Get stored OAuth tokens.\n   * Returns undefined if no tokens exist or if the server URL has changed.\n   */\n  async tokens(): Promise<OAuthTokens | undefined> {\n    // Use getAuthForUrl to validate tokens are for the current server URL\n    const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n    if (!entry?.tokens) return undefined\n\n    return {\n      access_token: entry.tokens.accessToken,\n      token_type: \"Bearer\",\n      refresh_token: entry.tokens.refreshToken,\n      expires_in: entry.tokens.expiresAt\n        ? Math.max(0, Math.floor(entry.tokens.expiresAt - Date.now() / 1000))\n        : undefined,\n      scope: entry.tokens.scope,\n    }\n  }\n\n  /**\n   * Save OAuth tokens.\n   */\n  async saveTokens(tokens: OAuthTokens): Promise<void> {\n    throwIfAborted(this.flowState?.signal)\n    const storedTokens: StoredTokens = {\n      accessToken: tokens.access_token,\n      refreshToken: tokens.refresh_token,\n      expiresAt: tokens.expires_in ? Date.now() / 1000 + tokens.expires_in : undefined,\n      scope: tokens.scope,\n    }\n    // Keep the completed flow's registration with its tokens if another\n    // same-name endpoint replaced the shared credential entry meanwhile.\n    if (this.flowState && this.flowClientInfo) {\n      updateClientInfo(this.serverName, this.flowClientInfo, this.serverUrl)\n    }\n    updateTokens(this.serverName, storedTokens, this.serverUrl)\n  }\n\n  /**\n   * Redirect the user to the authorization URL.\n   * This opens the browser for the user to authenticate.\n   *\n   * Throws UnauthorizedError when called without owned or legacy flow state.\n   * That path is reached when the SDK\n   * falls through from a failed refresh into a fresh authorization_code\n   * flow, which library hosts cannot complete in-process.\n   */\n  async redirectToAuthorization(authorizationUrl: URL): Promise<void> {\n    if (this.usesClientCredentials) {\n      throw new Error(\"redirectToAuthorization is not used for client_credentials flow\")\n    }\n    throwIfAborted(this.flowState?.signal)\n    if (this.flowState) {\n      await this.callbacks.onRedirect(authorizationUrl)\n      return\n    }\n    // No saved oauthState means we're on the post-refresh authorize fallback.\n    const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n    if (!entry?.oauthState) {\n      throw new UnauthorizedError(\n        `Re-authentication required for MCP server: ${this.serverName}`,\n      )\n    }\n    // URL is passed to callback, not logged (may contain sensitive params)\n    await this.callbacks.onRedirect(authorizationUrl)\n  }\n\n  /**\n   * Save the PKCE code verifier.\n   */\n  async saveCodeVerifier(codeVerifier: string): Promise<void> {\n    throwIfAborted(this.flowState?.signal)\n    if (this.flowState) {\n      this.flowState.codeVerifier = codeVerifier\n      return\n    }\n    updateCodeVerifier(this.serverName, codeVerifier, this.serverUrl)\n  }\n\n  /**\n   * Get the stored PKCE code verifier.\n   * @throws Error if no code verifier is stored\n   */\n  async codeVerifier(): Promise<string> {\n    throwIfAborted(this.flowState?.signal)\n    if (this.flowState) {\n      if (!this.flowState.codeVerifier) throw new Error(`No code verifier saved for MCP server: ${this.serverName}`)\n      return this.flowState.codeVerifier\n    }\n    if (this.usesClientCredentials) {\n      throw new Error(\"codeVerifier is not used for client_credentials flow\")\n    }\n    const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n    if (!entry?.codeVerifier) {\n      throw new Error(`No code verifier saved for MCP server: ${this.serverName}`)\n    }\n    return entry.codeVerifier\n  }\n\n  /**\n   * Save the OAuth state parameter for CSRF protection.\n   */\n  async saveState(state: string): Promise<void> {\n    throwIfAborted(this.flowState?.signal)\n    if (this.flowState) {\n      this.flowState.oauthState = state\n      return\n    }\n    updateOAuthState(this.serverName, state, this.serverUrl)\n  }\n\n  /**\n   * Get the stored OAuth state parameter.\n   * @throws UnauthorizedError if no flow is in progress (see redirectToAuthorization)\n   */\n  async state(): Promise<string> {\n    throwIfAborted(this.flowState?.signal)\n    if (this.flowState) return this.flowState.oauthState\n    if (this.usesClientCredentials) {\n      throw new Error(\"state is not used for client_credentials flow\")\n    }\n    const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n    if (!entry?.oauthState) {\n      throw new UnauthorizedError(\n        `Re-authentication required for MCP server: ${this.serverName}`,\n      )\n    }\n    return entry.oauthState\n  }\n\n  /**\n   * Invalidate credentials when authentication fails.\n   * Clears tokens, client info, or all credentials based on the type.\n   */\n  async invalidateCredentials(type: \"all\" | \"client\" | \"tokens\"): Promise<void> {\n    throwIfAborted(this.flowState?.signal)\n    if (this.flowState && type !== \"tokens\") {\n      this.flowClientInfo = undefined\n      this.flowClientInfoLoaded = true\n    }\n    switch (type) {\n      case \"all\":\n        clearAllCredentials(this.serverName)\n        break\n      case \"client\":\n        clearClientInfo(this.serverName)\n        break\n      case \"tokens\":\n        clearTokens(this.serverName)\n        break\n    }\n  }\n\n  /**\n   * Adds configured authorization-code scope without replacing the SDK's\n   * default token endpoint authentication behavior.\n   */\n  addClientAuthentication: AddClientAuthentication = async (headers, params, _url, metadata) => {\n    if (params.get(\"grant_type\") === \"authorization_code\" && !params.has(\"scope\") && this.config.scope) {\n      params.set(\"scope\", this.config.scope)\n    }\n\n    const clientInfo = await this.clientInformation()\n    if (!clientInfo) {\n      return\n    }\n\n    const supportedMethods = metadata?.token_endpoint_auth_methods_supported ?? []\n    const hasClientSecret = clientInfo.client_secret !== undefined\n    let authMethod: \"client_secret_basic\" | \"client_secret_post\" | \"none\"\n\n    if (supportedMethods.length === 0) {\n      authMethod = hasClientSecret ? \"client_secret_post\" : \"none\"\n    } else if (hasClientSecret && supportedMethods.includes(\"client_secret_basic\")) {\n      authMethod = \"client_secret_basic\"\n    } else if (hasClientSecret && supportedMethods.includes(\"client_secret_post\")) {\n      authMethod = \"client_secret_post\"\n    } else if (supportedMethods.includes(\"none\")) {\n      authMethod = \"none\"\n    } else {\n      authMethod = hasClientSecret ? \"client_secret_post\" : \"none\"\n    }\n\n    if (authMethod === \"client_secret_basic\") {\n      if (!clientInfo.client_secret) {\n        throw new Error(\"client_secret_basic authentication requires a client_secret\")\n      }\n      headers.set(\"Authorization\", `Basic ${Buffer.from(`${clientInfo.client_id}:${clientInfo.client_secret}`).toString(\"base64\")}`)\n      return\n    }\n\n    if (!params.has(\"client_id\")) {\n      params.set(\"client_id\", clientInfo.client_id)\n    }\n    if (authMethod === \"client_secret_post\" && clientInfo.client_secret && !params.has(\"client_secret\")) {\n      params.set(\"client_secret\", clientInfo.client_secret)\n    }\n  }\n\n  prepareTokenRequest(scope?: string): URLSearchParams | undefined {\n    if (!this.usesClientCredentials) {\n      return undefined\n    }\n\n    const params = new URLSearchParams({ grant_type: \"client_credentials\" })\n    const requestedScope = scope ?? this.config.scope\n    if (requestedScope) {\n      params.set(\"scope\", requestedScope)\n    }\n    return params\n  }\n}\n\nexport { DEFAULT_OAUTH_CALLBACK_PORT, DEFAULT_OAUTH_CALLBACK_PATH }\n"]}

package/dist/builtin-extensions/pi-mcp-adapter/mcp-oauth-provider.js

@@ -7,6 +7,7 @@
  */
 import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
 import { getAuthForUrl, updateTokens, updateClientInfo, updateCodeVerifier, updateOAuthState, clearAllCredentials, clearClientInfo, clearTokens, } from "./mcp-auth.js";
+import { throwIfAborted } from "./abort.js";
 // Callback server configuration
 const DEFAULT_OAUTH_CALLBACK_PORT = 19876;
 const DEFAULT_OAUTH_CALLBACK_PATH = "/callback";
@@ -43,12 +44,22 @@ export class McpOAuthProvider {
     serverUrl;
     config;
     callbacks;
+    flowState;
     redirectUrlSnapshot;
-    constructor(serverName, serverUrl, config, callbacks) {
+    flowClientInfo;
+    flowClientInfoLoaded = false;
+    constructor(serverName, serverUrl, config, callbacks, flowState) {
         this.serverName = serverName;
         this.serverUrl = serverUrl;
         this.config = config;
         this.callbacks = callbacks;
+        this.flowState = flowState;
+        if (flowState) {
+            const info = flowState.clientInfo;
+            this.flowClientInfo = info?.clientSecretExpiresAt && info.clientSecretExpiresAt < Date.now() / 1000
+                ? undefined : info;
+            this.flowClientInfoLoaded = true;
+        }
         this.redirectUrlSnapshot = config.grantType === "client_credentials"
             ? undefined
             : config.redirectUri ?? `http://localhost:${getOAuthCallbackPort()}${getOAuthCallbackPath()}`;
@@ -70,8 +81,8 @@ export class McpOAuthProvider {
     get clientMetadata() {
         if (this.usesClientCredentials) {
             return {
-                client_name: this.config.clientName ?? "Pi Coding Agent",
-                client_uri: this.config.clientUri ?? "https://github.com/nicobailon/pi-mcp-adapter",
+                client_name: this.config.clientName ?? "lunR",
+                ...(this.config.clientUri ? { client_uri: this.config.clientUri } : {}),
                 redirect_uris: [],
                 grant_types: ["client_credentials"],
                 token_endpoint_auth_method: this.config.clientSecret ? "client_secret_post" : "none",
@@ -83,8 +94,8 @@ export class McpOAuthProvider {
         }
         return {
             redirect_uris: [redirectUrl],
-            client_name: this.config.clientName ?? "Pi Coding Agent",
-            client_uri: this.config.clientUri ?? "https://github.com/nicobailon/pi-mcp-adapter",
+            client_name: this.config.clientName ?? "lunR",
+            ...(this.config.clientUri ? { client_uri: this.config.clientUri } : {}),
             grant_types: ["authorization_code", "refresh_token"],
             response_types: ["code"],
             token_endpoint_auth_method: this.config.clientSecret ? "client_secret_post" : "none",
@@ -103,26 +114,28 @@ export class McpOAuthProvider {
                 client_secret: this.config.clientSecret,
             };
         }
-        // Check stored client info (from dynamic registration)
-        // Use getAuthForUrl to validate credentials are for the current server URL
-        const entry = await getAuthForUrl(this.serverName, this.serverUrl);
-        if (entry?.clientInfo) {
-            // Check if client secret has expired
-            if (entry.clientInfo.clientSecretExpiresAt && entry.clientInfo.clientSecretExpiresAt < Date.now() / 1000) {
-                return undefined;
-            }
-            return {
-                client_id: entry.clientInfo.clientId,
-                client_secret: entry.clientInfo.clientSecret,
-            };
+        // An active flow keeps the registration it started with even if another
+        // session uses the same server name with a different endpoint.
+        if (!this.flowState || !this.flowClientInfoLoaded) {
+            const entry = await getAuthForUrl(this.serverName, this.serverUrl);
+            throwIfAborted(this.flowState?.signal);
+            const info = entry?.clientInfo;
+            this.flowClientInfo = info?.clientSecretExpiresAt && info.clientSecretExpiresAt < Date.now() / 1000
+                ? undefined : info;
+            this.flowClientInfoLoaded = true;
         }
-        // No client info or URL changed - will trigger dynamic registration
-        return undefined;
+        if (!this.flowClientInfo)
+            return undefined;
+        return {
+            client_id: this.flowClientInfo.clientId,
+            client_secret: this.flowClientInfo.clientSecret,
+        };
     }
     /**
      * Save client information from dynamic registration.
      */
     async saveClientInformation(info) {
+        throwIfAborted(this.flowState?.signal);
         const redirectUris = info.redirect_uris ?? (this.redirectUrl ? [this.redirectUrl] : undefined);
         const clientInfo = {
             clientId: info.client_id,
@@ -131,6 +144,10 @@ export class McpOAuthProvider {
             clientSecretExpiresAt: info.client_secret_expires_at,
             redirectUris,
         };
+        if (this.flowState) {
+            this.flowClientInfo = clientInfo;
+            this.flowClientInfoLoaded = true;
+        }
         updateClientInfo(this.serverName, clientInfo, this.serverUrl);
     }
     /**
@@ -156,20 +173,26 @@ export class McpOAuthProvider {
      * Save OAuth tokens.
      */
     async saveTokens(tokens) {
+        throwIfAborted(this.flowState?.signal);
         const storedTokens = {
             accessToken: tokens.access_token,
             refreshToken: tokens.refresh_token,
             expiresAt: tokens.expires_in ? Date.now() / 1000 + tokens.expires_in : undefined,
             scope: tokens.scope,
         };
+        // Keep the completed flow's registration with its tokens if another
+        // same-name endpoint replaced the shared credential entry meanwhile.
+        if (this.flowState && this.flowClientInfo) {
+            updateClientInfo(this.serverName, this.flowClientInfo, this.serverUrl);
+        }
         updateTokens(this.serverName, storedTokens, this.serverUrl);
     }
     /**
      * Redirect the user to the authorization URL.
      * This opens the browser for the user to authenticate.
      *
-     * Throws UnauthorizedError when called outside of a user-initiated flow
-     * (no oauthState saved by startAuth). That path is reached when the SDK
+     * Throws UnauthorizedError when called without owned or legacy flow state.
+     * That path is reached when the SDK
      * falls through from a failed refresh into a fresh authorization_code
      * flow, which library hosts cannot complete in-process.
      */
@@ -177,6 +200,11 @@ export class McpOAuthProvider {
         if (this.usesClientCredentials) {
             throw new Error("redirectToAuthorization is not used for client_credentials flow");
         }
+        throwIfAborted(this.flowState?.signal);
+        if (this.flowState) {
+            await this.callbacks.onRedirect(authorizationUrl);
+            return;
+        }
         // No saved oauthState means we're on the post-refresh authorize fallback.
         const entry = await getAuthForUrl(this.serverName, this.serverUrl);
         if (!entry?.oauthState) {
@@ -189,6 +217,11 @@ export class McpOAuthProvider {
      * Save the PKCE code verifier.
      */
     async saveCodeVerifier(codeVerifier) {
+        throwIfAborted(this.flowState?.signal);
+        if (this.flowState) {
+            this.flowState.codeVerifier = codeVerifier;
+            return;
+        }
         updateCodeVerifier(this.serverName, codeVerifier, this.serverUrl);
     }
     /**
@@ -196,6 +229,12 @@ export class McpOAuthProvider {
      * @throws Error if no code verifier is stored
      */
     async codeVerifier() {
+        throwIfAborted(this.flowState?.signal);
+        if (this.flowState) {
+            if (!this.flowState.codeVerifier)
+                throw new Error(`No code verifier saved for MCP server: ${this.serverName}`);
+            return this.flowState.codeVerifier;
+        }
         if (this.usesClientCredentials) {
             throw new Error("codeVerifier is not used for client_credentials flow");
         }
@@ -209,6 +248,11 @@ export class McpOAuthProvider {
      * Save the OAuth state parameter for CSRF protection.
      */
     async saveState(state) {
+        throwIfAborted(this.flowState?.signal);
+        if (this.flowState) {
+            this.flowState.oauthState = state;
+            return;
+        }
         updateOAuthState(this.serverName, state, this.serverUrl);
     }
     /**
@@ -216,6 +260,9 @@ export class McpOAuthProvider {
      * @throws UnauthorizedError if no flow is in progress (see redirectToAuthorization)
      */
     async state() {
+        throwIfAborted(this.flowState?.signal);
+        if (this.flowState)
+            return this.flowState.oauthState;
         if (this.usesClientCredentials) {
             throw new Error("state is not used for client_credentials flow");
         }
@@ -230,6 +277,11 @@ export class McpOAuthProvider {
      * Clears tokens, client info, or all credentials based on the type.
      */
     async invalidateCredentials(type) {
+        throwIfAborted(this.flowState?.signal);
+        if (this.flowState && type !== "tokens") {
+            this.flowClientInfo = undefined;
+            this.flowClientInfoLoaded = true;
+        }
         switch (type) {
             case "all":
                 clearAllCredentials(this.serverName);

package/dist/builtin-extensions/pi-mcp-adapter/mcp-oauth-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-oauth-provider.js","sourceRoot":"","sources":["../../../src/builtin-extensions/pi-mcp-adapter/mcp-oauth-provider.ts"],"names":[],"mappings":"AAAA,cAAc;AACd;;;;;GAKG;AAGH,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AAO5E,OAAO,EACL,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,WAAW,GAGZ,MAAM,eAAe,CAAA;AAEtB,gCAAgC;AAChC,MAAM,2BAA2B,GAAG,KAAK,CAAA;AACzC,MAAM,2BAA2B,GAAG,WAAW,CAAA;AAE/C,IAAI,2BAA2B,GAAG,2BAA2B,CAAA;AAE7D,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAA;IAC3E,IAAI,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,IAAI,KAAK,EAAE,CAAC;QAC1E,2BAA2B,GAAG,UAAU,CAAA;IAC1C,CAAC;AACH,CAAC;AAED,IAAI,iBAAiB,GAAG,2BAA2B,CAAA;AACnD,IAAI,iBAAiB,GAAG,2BAA2B,CAAA;AAEnD,MAAM,UAAU,8BAA8B,GAAW;IACvD,OAAO,2BAA2B,CAAA;AAAA,CACnC;AAED,MAAM,UAAU,oBAAoB,GAAW;IAC7C,OAAO,iBAAiB,CAAA;AAAA,CACzB;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAQ;IACvD,iBAAiB,GAAG,IAAI,CAAA;AAAA,CACzB;AAED,MAAM,UAAU,oBAAoB,GAAW;IAC7C,OAAO,iBAAiB,CAAA;AAAA,CACzB;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAQ;IACvD,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAA;AAAA,CAC7D;AAkBD;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IAIjB,UAAU;IACV,SAAS;IACT,MAAM;IACN,SAAS;IANF,mBAAmB,CAAoB;IAExD,YACU,UAAkB,EAClB,SAAiB,EACjB,MAAsB,EACtB,SAA4B,EACpC;0BAJQ,UAAU;yBACV,SAAS;sBACT,MAAM;yBACN,SAAS;QAEjB,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC,SAAS,KAAK,oBAAoB;YAClE,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,CAAC,WAAW,IAAI,oBAAoB,oBAAoB,EAAE,GAAG,oBAAoB,EAAE,EAAE,CAAA;IAAA,CAChG;IAED,IAAY,qBAAqB,GAAY;QAC3C,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,oBAAoB,CAAA;IAAA,CACtD;IAED;;;OAGG;IACH,IAAI,WAAW,GAAuB;QACpC,OAAO,IAAI,CAAC,mBAAmB,CAAA;IAAA,CAChC;IAED;;;OAGG;IACH,IAAI,cAAc,GAAwB;QACxC,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,iBAAiB;gBACxD,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,8CAA8C;gBACnF,aAAa,EAAE,EAAE;gBACjB,WAAW,EAAE,CAAC,oBAAoB,CAAC;gBACnC,0BAA0B,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM;aACrF,CAAA;QACH,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAA;QACpC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QACxE,CAAC;QAED,OAAO;YACL,aAAa,EAAE,CAAC,WAAW,CAAC;YAC5B,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,iBAAiB;YACxD,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,8CAA8C;YACnF,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM;YACpF,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAA;IAAA,CACF;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,GAAgD;QACrE,6CAA6C;QAC7C,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzB,OAAO;gBACL,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;aACxC,CAAA;QACH,CAAC;QAED,uDAAuD;QACvD,2EAA2E;QAC3E,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAClE,IAAI,KAAK,EAAE,UAAU,EAAE,CAAC;YACtB,qCAAqC;YACrC,IAAI,KAAK,CAAC,UAAU,CAAC,qBAAqB,IAAI,KAAK,CAAC,UAAU,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBACzG,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO;gBACL,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;gBACpC,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,YAAY;aAC7C,CAAA;QACH,CAAC;QAED,oEAAoE;QACpE,OAAO,SAAS,CAAA;IAAA,CACjB;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CAAC,IAAgC,EAAiB;QAC3E,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC9F,MAAM,UAAU,GAAqB;YACnC,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,gBAAgB,EAAE,IAAI,CAAC,mBAAmB;YAC1C,qBAAqB,EAAE,IAAI,CAAC,wBAAwB;YACpD,YAAY;SACb,CAAA;QACD,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IAAA,CAC9D;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,GAAqC;QAC/C,sEAAsE;QACtE,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAClE,IAAI,CAAC,KAAK,EAAE,MAAM;YAAE,OAAO,SAAS,CAAA;QAEpC,OAAO;YACL,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW;YACtC,UAAU,EAAE,QAAQ;YACpB,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACxC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;gBAChC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;gBACrE,CAAC,CAAC,SAAS;YACb,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;SAC1B,CAAA;IAAA,CACF;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,MAAmB,EAAiB;QACnD,MAAM,YAAY,GAAiB;YACjC,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,YAAY,EAAE,MAAM,CAAC,aAAa;YAClC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YAChF,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAA;QACD,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IAAA,CAC5D;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,uBAAuB,CAAC,gBAAqB,EAAiB;QAClE,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;QACpF,CAAC;QACD,0EAA0E;QAC1E,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAClE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,iBAAiB,CACzB,8CAA8C,IAAI,CAAC,UAAU,EAAE,CAChE,CAAA;QACH,CAAC;QACD,uEAAuE;QACvE,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAA;IAAA,CAClD;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,YAAoB,EAAiB;QAC1D,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IAAA,CAClE;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,GAAoB;QACpC,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;QACzE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAClE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;QAC9E,CAAC;QACD,OAAO,KAAK,CAAC,YAAY,CAAA;IAAA,CAC1B;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,KAAa,EAAiB;QAC5C,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IAAA,CACzD;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,GAAoB;QAC7B,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAClE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAClE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,iBAAiB,CACzB,8CAA8C,IAAI,CAAC,UAAU,EAAE,CAChE,CAAA;QACH,CAAC;QACD,OAAO,KAAK,CAAC,UAAU,CAAA;IAAA,CACxB;IAED;;;OAGG;IACH,KAAK,CAAC,qBAAqB,CAAC,IAAiC,EAAiB;QAC5E,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,KAAK;gBACR,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;gBACpC,MAAK;YACP,KAAK,QAAQ;gBACX,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;gBAChC,MAAK;YACP,KAAK,QAAQ;gBACX,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;gBAC5B,MAAK;QACT,CAAC;IAAA,CACF;IAED;;;OAGG;IACH,uBAAuB,GAA4B,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;QAC5F,IAAI,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,oBAAoB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACnG,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACxC,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAA;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAM;QACR,CAAC;QAED,MAAM,gBAAgB,GAAG,QAAQ,EAAE,qCAAqC,IAAI,EAAE,CAAA;QAC9E,MAAM,eAAe,GAAG,UAAU,CAAC,aAAa,KAAK,SAAS,CAAA;QAC9D,IAAI,UAAiE,CAAA;QAErE,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAA;QAC9D,CAAC;aAAM,IAAI,eAAe,IAAI,gBAAgB,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC/E,UAAU,GAAG,qBAAqB,CAAA;QACpC,CAAC;aAAM,IAAI,eAAe,IAAI,gBAAgB,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC9E,UAAU,GAAG,oBAAoB,CAAA;QACnC,CAAC;aAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7C,UAAU,GAAG,MAAM,CAAA;QACrB,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAA;QAC9D,CAAC;QAED,IAAI,UAAU,KAAK,qBAAqB,EAAE,CAAC;YACzC,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;YAChF,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;YAC9H,OAAM;QACR,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,UAAU,KAAK,oBAAoB,IAAI,UAAU,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACpG,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,aAAa,CAAC,CAAA;QACvD,CAAC;IAAA,CACF,CAAA;IAED,mBAAmB,CAAC,KAAc,EAA+B;QAC/D,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAChC,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAA;QACxE,MAAM,cAAc,GAAG,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAA;QACjD,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;QACrC,CAAC;QACD,OAAO,MAAM,CAAA;IAAA,CACd;CACF;AAED,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,CAAA","sourcesContent":["// @ts-nocheck\n/**\n * MCP OAuth Provider\n * \n * Implementation of the MCP SDK's OAuthClientProvider interface.\n * Handles OAuth client registration, token storage, and authorization redirection.\n */\n\nimport type { AddClientAuthentication, OAuthClientProvider } from \"@modelcontextprotocol/sdk/client/auth.js\"\nimport { UnauthorizedError } from \"@modelcontextprotocol/sdk/client/auth.js\"\nimport type {\n  OAuthClientMetadata,\n  OAuthTokens,\n  OAuthClientInformation,\n  OAuthClientInformationFull,\n} from \"@modelcontextprotocol/sdk/shared/auth.js\"\nimport {\n  getAuthForUrl,\n  updateTokens,\n  updateClientInfo,\n  updateCodeVerifier,\n  updateOAuthState,\n  clearAllCredentials,\n  clearClientInfo,\n  clearTokens,\n  type StoredTokens,\n  type StoredClientInfo,\n} from \"./mcp-auth.ts\"\n\n// Callback server configuration\nconst DEFAULT_OAUTH_CALLBACK_PORT = 19876\nconst DEFAULT_OAUTH_CALLBACK_PATH = \"/callback\"\n\nlet configuredOAuthCallbackPort = DEFAULT_OAUTH_CALLBACK_PORT\n\nif (process.env.MCP_OAUTH_CALLBACK_PORT) {\n  const parsedPort = Number.parseInt(process.env.MCP_OAUTH_CALLBACK_PORT, 10)\n  if (Number.isInteger(parsedPort) && parsedPort > 0 && parsedPort <= 65535) {\n    configuredOAuthCallbackPort = parsedPort\n  }\n}\n\nlet oauthCallbackPort = configuredOAuthCallbackPort\nlet oauthCallbackPath = DEFAULT_OAUTH_CALLBACK_PATH\n\nexport function getConfiguredOAuthCallbackPort(): number {\n  return configuredOAuthCallbackPort\n}\n\nexport function getOAuthCallbackPort(): number {\n  return oauthCallbackPort\n}\n\nexport function setOAuthCallbackPort(port: number): void {\n  oauthCallbackPort = port\n}\n\nexport function getOAuthCallbackPath(): string {\n  return oauthCallbackPath\n}\n\nexport function setOAuthCallbackPath(path: string): void {\n  oauthCallbackPath = path.startsWith(\"/\") ? path : `/${path}`\n}\n\n/** Configuration options for OAuth */\nexport interface McpOAuthConfig {\n  grantType?: \"authorization_code\" | \"client_credentials\"\n  clientId?: string\n  clientSecret?: string\n  scope?: string\n  redirectUri?: string\n  clientName?: string\n  clientUri?: string\n}\n\n/** Callbacks for OAuth flow interactions */\nexport interface McpOAuthCallbacks {\n  onRedirect: (url: URL) => void | Promise<void>\n}\n\n/**\n * OAuth provider implementation for MCP servers.\n * Implements the OAuthClientProvider interface from the MCP SDK.\n */\nexport class McpOAuthProvider implements OAuthClientProvider {\n  private readonly redirectUrlSnapshot: string | undefined\n\n  constructor(\n    private serverName: string,\n    private serverUrl: string,\n    private config: McpOAuthConfig,\n    private callbacks: McpOAuthCallbacks,\n  ) {\n    this.redirectUrlSnapshot = config.grantType === \"client_credentials\"\n      ? undefined\n      : config.redirectUri ?? `http://localhost:${getOAuthCallbackPort()}${getOAuthCallbackPath()}`\n  }\n\n  private get usesClientCredentials(): boolean {\n    return this.config.grantType === \"client_credentials\"\n  }\n\n  /**\n   * The redirect URL for OAuth callbacks.\n   * This must match the redirect_uri in client metadata.\n   */\n  get redirectUrl(): string | undefined {\n    return this.redirectUrlSnapshot\n  }\n\n  /**\n   * Client metadata for dynamic registration.\n   * Describes this client to the OAuth authorization server.\n   */\n  get clientMetadata(): OAuthClientMetadata {\n    if (this.usesClientCredentials) {\n      return {\n        client_name: this.config.clientName ?? \"Pi Coding Agent\",\n        client_uri: this.config.clientUri ?? \"https://github.com/nicobailon/pi-mcp-adapter\",\n        redirect_uris: [],\n        grant_types: [\"client_credentials\"],\n        token_endpoint_auth_method: this.config.clientSecret ? \"client_secret_post\" : \"none\",\n      }\n    }\n\n    const redirectUrl = this.redirectUrl\n    if (!redirectUrl) {\n      throw new Error(\"redirectUrl is required for authorization_code flow\")\n    }\n\n    return {\n      redirect_uris: [redirectUrl],\n      client_name: this.config.clientName ?? \"Pi Coding Agent\",\n      client_uri: this.config.clientUri ?? \"https://github.com/nicobailon/pi-mcp-adapter\",\n      grant_types: [\"authorization_code\", \"refresh_token\"],\n      response_types: [\"code\"],\n      token_endpoint_auth_method: this.config.clientSecret ? \"client_secret_post\" : \"none\",\n      ...(this.config.scope !== undefined ? { scope: this.config.scope } : {}),\n    }\n  }\n\n  /**\n   * Get client information (for pre-registered or dynamically registered clients).\n   * Returns undefined if no client info exists or if the server URL has changed.\n   */\n  async clientInformation(): Promise<OAuthClientInformation | undefined> {\n    // Check config first (pre-registered client)\n    if (this.config.clientId) {\n      return {\n        client_id: this.config.clientId,\n        client_secret: this.config.clientSecret,\n      }\n    }\n\n    // Check stored client info (from dynamic registration)\n    // Use getAuthForUrl to validate credentials are for the current server URL\n    const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n    if (entry?.clientInfo) {\n      // Check if client secret has expired\n      if (entry.clientInfo.clientSecretExpiresAt && entry.clientInfo.clientSecretExpiresAt < Date.now() / 1000) {\n        return undefined\n      }\n      return {\n        client_id: entry.clientInfo.clientId,\n        client_secret: entry.clientInfo.clientSecret,\n      }\n    }\n\n    // No client info or URL changed - will trigger dynamic registration\n    return undefined\n  }\n\n  /**\n   * Save client information from dynamic registration.\n   */\n  async saveClientInformation(info: OAuthClientInformationFull): Promise<void> {\n    const redirectUris = info.redirect_uris ?? (this.redirectUrl ? [this.redirectUrl] : undefined)\n    const clientInfo: StoredClientInfo = {\n      clientId: info.client_id,\n      clientSecret: info.client_secret,\n      clientIdIssuedAt: info.client_id_issued_at,\n      clientSecretExpiresAt: info.client_secret_expires_at,\n      redirectUris,\n    }\n    updateClientInfo(this.serverName, clientInfo, this.serverUrl)\n  }\n\n  /**\n   * Get stored OAuth tokens.\n   * Returns undefined if no tokens exist or if the server URL has changed.\n   */\n  async tokens(): Promise<OAuthTokens | undefined> {\n    // Use getAuthForUrl to validate tokens are for the current server URL\n    const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n    if (!entry?.tokens) return undefined\n\n    return {\n      access_token: entry.tokens.accessToken,\n      token_type: \"Bearer\",\n      refresh_token: entry.tokens.refreshToken,\n      expires_in: entry.tokens.expiresAt\n        ? Math.max(0, Math.floor(entry.tokens.expiresAt - Date.now() / 1000))\n        : undefined,\n      scope: entry.tokens.scope,\n    }\n  }\n\n  /**\n   * Save OAuth tokens.\n   */\n  async saveTokens(tokens: OAuthTokens): Promise<void> {\n    const storedTokens: StoredTokens = {\n      accessToken: tokens.access_token,\n      refreshToken: tokens.refresh_token,\n      expiresAt: tokens.expires_in ? Date.now() / 1000 + tokens.expires_in : undefined,\n      scope: tokens.scope,\n    }\n    updateTokens(this.serverName, storedTokens, this.serverUrl)\n  }\n\n  /**\n   * Redirect the user to the authorization URL.\n   * This opens the browser for the user to authenticate.\n   *\n   * Throws UnauthorizedError when called outside of a user-initiated flow\n   * (no oauthState saved by startAuth). That path is reached when the SDK\n   * falls through from a failed refresh into a fresh authorization_code\n   * flow, which library hosts cannot complete in-process.\n   */\n  async redirectToAuthorization(authorizationUrl: URL): Promise<void> {\n    if (this.usesClientCredentials) {\n      throw new Error(\"redirectToAuthorization is not used for client_credentials flow\")\n    }\n    // No saved oauthState means we're on the post-refresh authorize fallback.\n    const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n    if (!entry?.oauthState) {\n      throw new UnauthorizedError(\n        `Re-authentication required for MCP server: ${this.serverName}`,\n      )\n    }\n    // URL is passed to callback, not logged (may contain sensitive params)\n    await this.callbacks.onRedirect(authorizationUrl)\n  }\n\n  /**\n   * Save the PKCE code verifier.\n   */\n  async saveCodeVerifier(codeVerifier: string): Promise<void> {\n    updateCodeVerifier(this.serverName, codeVerifier, this.serverUrl)\n  }\n\n  /**\n   * Get the stored PKCE code verifier.\n   * @throws Error if no code verifier is stored\n   */\n  async codeVerifier(): Promise<string> {\n    if (this.usesClientCredentials) {\n      throw new Error(\"codeVerifier is not used for client_credentials flow\")\n    }\n    const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n    if (!entry?.codeVerifier) {\n      throw new Error(`No code verifier saved for MCP server: ${this.serverName}`)\n    }\n    return entry.codeVerifier\n  }\n\n  /**\n   * Save the OAuth state parameter for CSRF protection.\n   */\n  async saveState(state: string): Promise<void> {\n    updateOAuthState(this.serverName, state, this.serverUrl)\n  }\n\n  /**\n   * Get the stored OAuth state parameter.\n   * @throws UnauthorizedError if no flow is in progress (see redirectToAuthorization)\n   */\n  async state(): Promise<string> {\n    if (this.usesClientCredentials) {\n      throw new Error(\"state is not used for client_credentials flow\")\n    }\n    const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n    if (!entry?.oauthState) {\n      throw new UnauthorizedError(\n        `Re-authentication required for MCP server: ${this.serverName}`,\n      )\n    }\n    return entry.oauthState\n  }\n\n  /**\n   * Invalidate credentials when authentication fails.\n   * Clears tokens, client info, or all credentials based on the type.\n   */\n  async invalidateCredentials(type: \"all\" | \"client\" | \"tokens\"): Promise<void> {\n    switch (type) {\n      case \"all\":\n        clearAllCredentials(this.serverName)\n        break\n      case \"client\":\n        clearClientInfo(this.serverName)\n        break\n      case \"tokens\":\n        clearTokens(this.serverName)\n        break\n    }\n  }\n\n  /**\n   * Adds configured authorization-code scope without replacing the SDK's\n   * default token endpoint authentication behavior.\n   */\n  addClientAuthentication: AddClientAuthentication = async (headers, params, _url, metadata) => {\n    if (params.get(\"grant_type\") === \"authorization_code\" && !params.has(\"scope\") && this.config.scope) {\n      params.set(\"scope\", this.config.scope)\n    }\n\n    const clientInfo = await this.clientInformation()\n    if (!clientInfo) {\n      return\n    }\n\n    const supportedMethods = metadata?.token_endpoint_auth_methods_supported ?? []\n    const hasClientSecret = clientInfo.client_secret !== undefined\n    let authMethod: \"client_secret_basic\" | \"client_secret_post\" | \"none\"\n\n    if (supportedMethods.length === 0) {\n      authMethod = hasClientSecret ? \"client_secret_post\" : \"none\"\n    } else if (hasClientSecret && supportedMethods.includes(\"client_secret_basic\")) {\n      authMethod = \"client_secret_basic\"\n    } else if (hasClientSecret && supportedMethods.includes(\"client_secret_post\")) {\n      authMethod = \"client_secret_post\"\n    } else if (supportedMethods.includes(\"none\")) {\n      authMethod = \"none\"\n    } else {\n      authMethod = hasClientSecret ? \"client_secret_post\" : \"none\"\n    }\n\n    if (authMethod === \"client_secret_basic\") {\n      if (!clientInfo.client_secret) {\n        throw new Error(\"client_secret_basic authentication requires a client_secret\")\n      }\n      headers.set(\"Authorization\", `Basic ${Buffer.from(`${clientInfo.client_id}:${clientInfo.client_secret}`).toString(\"base64\")}`)\n      return\n    }\n\n    if (!params.has(\"client_id\")) {\n      params.set(\"client_id\", clientInfo.client_id)\n    }\n    if (authMethod === \"client_secret_post\" && clientInfo.client_secret && !params.has(\"client_secret\")) {\n      params.set(\"client_secret\", clientInfo.client_secret)\n    }\n  }\n\n  prepareTokenRequest(scope?: string): URLSearchParams | undefined {\n    if (!this.usesClientCredentials) {\n      return undefined\n    }\n\n    const params = new URLSearchParams({ grant_type: \"client_credentials\" })\n    const requestedScope = scope ?? this.config.scope\n    if (requestedScope) {\n      params.set(\"scope\", requestedScope)\n    }\n    return params\n  }\n}\n\nexport { DEFAULT_OAUTH_CALLBACK_PORT, DEFAULT_OAUTH_CALLBACK_PATH }\n"]}
+{"version":3,"file":"mcp-oauth-provider.js","sourceRoot":"","sources":["../../../src/builtin-extensions/pi-mcp-adapter/mcp-oauth-provider.ts"],"names":[],"mappings":"AAAA,cAAc;AACd;;;;;GAKG;AAGH,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AAO5E,OAAO,EACL,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,WAAW,GAGZ,MAAM,eAAe,CAAA;AAEtB,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAU3C,gCAAgC;AAChC,MAAM,2BAA2B,GAAG,KAAK,CAAA;AACzC,MAAM,2BAA2B,GAAG,WAAW,CAAA;AAE/C,IAAI,2BAA2B,GAAG,2BAA2B,CAAA;AAE7D,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAA;IAC3E,IAAI,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,IAAI,KAAK,EAAE,CAAC;QAC1E,2BAA2B,GAAG,UAAU,CAAA;IAC1C,CAAC;AACH,CAAC;AAED,IAAI,iBAAiB,GAAG,2BAA2B,CAAA;AACnD,IAAI,iBAAiB,GAAG,2BAA2B,CAAA;AAEnD,MAAM,UAAU,8BAA8B,GAAW;IACvD,OAAO,2BAA2B,CAAA;AAAA,CACnC;AAED,MAAM,UAAU,oBAAoB,GAAW;IAC7C,OAAO,iBAAiB,CAAA;AAAA,CACzB;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAQ;IACvD,iBAAiB,GAAG,IAAI,CAAA;AAAA,CACzB;AAED,MAAM,UAAU,oBAAoB,GAAW;IAC7C,OAAO,iBAAiB,CAAA;AAAA,CACzB;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAQ;IACvD,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAA;AAAA,CAC7D;AAkBD;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IAMjB,UAAU;IACV,SAAS;IACT,MAAM;IACN,SAAS;IACT,SAAS;IATF,mBAAmB,CAAoB;IAChD,cAAc,CAAmB;IACjC,oBAAoB,GAAG,KAAK,CAAA;IAEpC,YACU,UAAkB,EAClB,SAAiB,EACjB,MAAsB,EACtB,SAA4B,EAC5B,SAA6B,EACrC;0BALQ,UAAU;yBACV,SAAS;sBACT,MAAM;yBACN,SAAS;yBACT,SAAS;QAEjB,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAA;YACjC,IAAI,CAAC,cAAc,GAAG,IAAI,EAAE,qBAAqB,IAAI,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;gBACjG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;YACpB,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAA;QAClC,CAAC;QACD,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC,SAAS,KAAK,oBAAoB;YAClE,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,CAAC,WAAW,IAAI,oBAAoB,oBAAoB,EAAE,GAAG,oBAAoB,EAAE,EAAE,CAAA;IAAA,CAChG;IAED,IAAY,qBAAqB,GAAY;QAC3C,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,oBAAoB,CAAA;IAAA,CACtD;IAED;;;OAGG;IACH,IAAI,WAAW,GAAuB;QACpC,OAAO,IAAI,CAAC,mBAAmB,CAAA;IAAA,CAChC;IAED;;;OAGG;IACH,IAAI,cAAc,GAAwB;QACxC,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM;gBAC7C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,aAAa,EAAE,EAAE;gBACjB,WAAW,EAAE,CAAC,oBAAoB,CAAC;gBACnC,0BAA0B,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM;aACrF,CAAA;QACH,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAA;QACpC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QACxE,CAAC;QAED,OAAO;YACL,aAAa,EAAE,CAAC,WAAW,CAAC;YAC5B,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM;YAC7C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM;YACpF,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAA;IAAA,CACF;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,GAAgD;QACrE,6CAA6C;QAC7C,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzB,OAAO;gBACL,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;aACxC,CAAA;QACH,CAAC;QAED,wEAAwE;QACxE,+DAA+D;QAC/D,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;YAClE,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;YACtC,MAAM,IAAI,GAAG,KAAK,EAAE,UAAU,CAAA;YAC9B,IAAI,CAAC,cAAc,GAAG,IAAI,EAAE,qBAAqB,IAAI,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;gBACjG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;YACpB,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAA;QAClC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,OAAO,SAAS,CAAA;QAC1C,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,QAAQ;YACvC,aAAa,EAAE,IAAI,CAAC,cAAc,CAAC,YAAY;SAChD,CAAA;IAAA,CACF;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CAAC,IAAgC,EAAiB;QAC3E,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QACtC,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC9F,MAAM,UAAU,GAAqB;YACnC,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,gBAAgB,EAAE,IAAI,CAAC,mBAAmB;YAC1C,qBAAqB,EAAE,IAAI,CAAC,wBAAwB;YACpD,YAAY;SACb,CAAA;QACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,cAAc,GAAG,UAAU,CAAA;YAChC,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAA;QAClC,CAAC;QACD,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IAAA,CAC9D;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,GAAqC;QAC/C,sEAAsE;QACtE,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAClE,IAAI,CAAC,KAAK,EAAE,MAAM;YAAE,OAAO,SAAS,CAAA;QAEpC,OAAO;YACL,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW;YACtC,UAAU,EAAE,QAAQ;YACpB,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACxC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;gBAChC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;gBACrE,CAAC,CAAC,SAAS;YACb,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;SAC1B,CAAA;IAAA,CACF;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,MAAmB,EAAiB;QACnD,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QACtC,MAAM,YAAY,GAAiB;YACjC,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,YAAY,EAAE,MAAM,CAAC,aAAa;YAClC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YAChF,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAA;QACD,oEAAoE;QACpE,qEAAqE;QACrE,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC1C,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QACxE,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IAAA,CAC5D;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,uBAAuB,CAAC,gBAAqB,EAAiB;QAClE,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;QACpF,CAAC;QACD,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QACtC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAA;YACjD,OAAM;QACR,CAAC;QACD,0EAA0E;QAC1E,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAClE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,iBAAiB,CACzB,8CAA8C,IAAI,CAAC,UAAU,EAAE,CAChE,CAAA;QACH,CAAC;QACD,uEAAuE;QACvE,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAA;IAAA,CAClD;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,YAAoB,EAAiB;QAC1D,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QACtC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,CAAC,YAAY,GAAG,YAAY,CAAA;YAC1C,OAAM;QACR,CAAC;QACD,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IAAA,CAClE;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,GAAoB;QACpC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QACtC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;YAC9G,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAA;QACpC,CAAC;QACD,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;QACzE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAClE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;QAC9E,CAAC;QACD,OAAO,KAAK,CAAC,YAAY,CAAA;IAAA,CAC1B;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,KAAa,EAAiB;QAC5C,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QACtC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,CAAC,UAAU,GAAG,KAAK,CAAA;YACjC,OAAM;QACR,CAAC;QACD,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IAAA,CACzD;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,GAAoB;QAC7B,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QACtC,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAA;QACpD,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAClE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAClE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,iBAAiB,CACzB,8CAA8C,IAAI,CAAC,UAAU,EAAE,CAChE,CAAA;QACH,CAAC;QACD,OAAO,KAAK,CAAC,UAAU,CAAA;IAAA,CACxB;IAED;;;OAGG;IACH,KAAK,CAAC,qBAAqB,CAAC,IAAiC,EAAiB;QAC5E,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QACtC,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxC,IAAI,CAAC,cAAc,GAAG,SAAS,CAAA;YAC/B,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAA;QAClC,CAAC;QACD,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,KAAK;gBACR,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;gBACpC,MAAK;YACP,KAAK,QAAQ;gBACX,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;gBAChC,MAAK;YACP,KAAK,QAAQ;gBACX,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;gBAC5B,MAAK;QACT,CAAC;IAAA,CACF;IAED;;;OAGG;IACH,uBAAuB,GAA4B,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;QAC5F,IAAI,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,oBAAoB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACnG,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACxC,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAA;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAM;QACR,CAAC;QAED,MAAM,gBAAgB,GAAG,QAAQ,EAAE,qCAAqC,IAAI,EAAE,CAAA;QAC9E,MAAM,eAAe,GAAG,UAAU,CAAC,aAAa,KAAK,SAAS,CAAA;QAC9D,IAAI,UAAiE,CAAA;QAErE,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAA;QAC9D,CAAC;aAAM,IAAI,eAAe,IAAI,gBAAgB,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC/E,UAAU,GAAG,qBAAqB,CAAA;QACpC,CAAC;aAAM,IAAI,eAAe,IAAI,gBAAgB,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC9E,UAAU,GAAG,oBAAoB,CAAA;QACnC,CAAC;aAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7C,UAAU,GAAG,MAAM,CAAA;QACrB,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAA;QAC9D,CAAC;QAED,IAAI,UAAU,KAAK,qBAAqB,EAAE,CAAC;YACzC,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;YAChF,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;YAC9H,OAAM;QACR,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,UAAU,KAAK,oBAAoB,IAAI,UAAU,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACpG,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,aAAa,CAAC,CAAA;QACvD,CAAC;IAAA,CACF,CAAA;IAED,mBAAmB,CAAC,KAAc,EAA+B;QAC/D,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAChC,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAA;QACxE,MAAM,cAAc,GAAG,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAA;QACjD,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;QACrC,CAAC;QACD,OAAO,MAAM,CAAA;IAAA,CACd;CACF;AAED,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,CAAA","sourcesContent":["// @ts-nocheck\n/**\n * MCP OAuth Provider\n * \n * Implementation of the MCP SDK's OAuthClientProvider interface.\n * Handles OAuth client registration, token storage, and authorization redirection.\n */\n\nimport type { AddClientAuthentication, OAuthClientProvider } from \"@modelcontextprotocol/sdk/client/auth.js\"\nimport { UnauthorizedError } from \"@modelcontextprotocol/sdk/client/auth.js\"\nimport type {\n  OAuthClientMetadata,\n  OAuthTokens,\n  OAuthClientInformation,\n  OAuthClientInformationFull,\n} from \"@modelcontextprotocol/sdk/shared/auth.js\"\nimport {\n  getAuthForUrl,\n  updateTokens,\n  updateClientInfo,\n  updateCodeVerifier,\n  updateOAuthState,\n  clearAllCredentials,\n  clearClientInfo,\n  clearTokens,\n  type StoredTokens,\n  type StoredClientInfo,\n} from \"./mcp-auth.ts\"\n\nimport { throwIfAborted } from \"./abort.ts\"\n\n/** Temporary authorization state belongs to one flow, never the credential cache. */\nexport interface McpOAuthFlowState {\n  oauthState: string\n  codeVerifier?: string\n  signal: AbortSignal\n  clientInfo?: StoredClientInfo\n}\n\n// Callback server configuration\nconst DEFAULT_OAUTH_CALLBACK_PORT = 19876\nconst DEFAULT_OAUTH_CALLBACK_PATH = \"/callback\"\n\nlet configuredOAuthCallbackPort = DEFAULT_OAUTH_CALLBACK_PORT\n\nif (process.env.MCP_OAUTH_CALLBACK_PORT) {\n  const parsedPort = Number.parseInt(process.env.MCP_OAUTH_CALLBACK_PORT, 10)\n  if (Number.isInteger(parsedPort) && parsedPort > 0 && parsedPort <= 65535) {\n    configuredOAuthCallbackPort = parsedPort\n  }\n}\n\nlet oauthCallbackPort = configuredOAuthCallbackPort\nlet oauthCallbackPath = DEFAULT_OAUTH_CALLBACK_PATH\n\nexport function getConfiguredOAuthCallbackPort(): number {\n  return configuredOAuthCallbackPort\n}\n\nexport function getOAuthCallbackPort(): number {\n  return oauthCallbackPort\n}\n\nexport function setOAuthCallbackPort(port: number): void {\n  oauthCallbackPort = port\n}\n\nexport function getOAuthCallbackPath(): string {\n  return oauthCallbackPath\n}\n\nexport function setOAuthCallbackPath(path: string): void {\n  oauthCallbackPath = path.startsWith(\"/\") ? path : `/${path}`\n}\n\n/** Configuration options for OAuth */\nexport interface McpOAuthConfig {\n  grantType?: \"authorization_code\" | \"client_credentials\"\n  clientId?: string\n  clientSecret?: string\n  scope?: string\n  redirectUri?: string\n  clientName?: string\n  clientUri?: string\n}\n\n/** Callbacks for OAuth flow interactions */\nexport interface McpOAuthCallbacks {\n  onRedirect: (url: URL) => void | Promise<void>\n}\n\n/**\n * OAuth provider implementation for MCP servers.\n * Implements the OAuthClientProvider interface from the MCP SDK.\n */\nexport class McpOAuthProvider implements OAuthClientProvider {\n  private readonly redirectUrlSnapshot: string | undefined\n  private flowClientInfo?: StoredClientInfo\n  private flowClientInfoLoaded = false\n\n  constructor(\n    private serverName: string,\n    private serverUrl: string,\n    private config: McpOAuthConfig,\n    private callbacks: McpOAuthCallbacks,\n    private flowState?: McpOAuthFlowState,\n  ) {\n    if (flowState) {\n      const info = flowState.clientInfo\n      this.flowClientInfo = info?.clientSecretExpiresAt && info.clientSecretExpiresAt < Date.now() / 1000\n        ? undefined : info\n      this.flowClientInfoLoaded = true\n    }\n    this.redirectUrlSnapshot = config.grantType === \"client_credentials\"\n      ? undefined\n      : config.redirectUri ?? `http://localhost:${getOAuthCallbackPort()}${getOAuthCallbackPath()}`\n  }\n\n  private get usesClientCredentials(): boolean {\n    return this.config.grantType === \"client_credentials\"\n  }\n\n  /**\n   * The redirect URL for OAuth callbacks.\n   * This must match the redirect_uri in client metadata.\n   */\n  get redirectUrl(): string | undefined {\n    return this.redirectUrlSnapshot\n  }\n\n  /**\n   * Client metadata for dynamic registration.\n   * Describes this client to the OAuth authorization server.\n   */\n  get clientMetadata(): OAuthClientMetadata {\n    if (this.usesClientCredentials) {\n      return {\n        client_name: this.config.clientName ?? \"lunR\",\n        ...(this.config.clientUri ? { client_uri: this.config.clientUri } : {}),\n        redirect_uris: [],\n        grant_types: [\"client_credentials\"],\n        token_endpoint_auth_method: this.config.clientSecret ? \"client_secret_post\" : \"none\",\n      }\n    }\n\n    const redirectUrl = this.redirectUrl\n    if (!redirectUrl) {\n      throw new Error(\"redirectUrl is required for authorization_code flow\")\n    }\n\n    return {\n      redirect_uris: [redirectUrl],\n      client_name: this.config.clientName ?? \"lunR\",\n      ...(this.config.clientUri ? { client_uri: this.config.clientUri } : {}),\n      grant_types: [\"authorization_code\", \"refresh_token\"],\n      response_types: [\"code\"],\n      token_endpoint_auth_method: this.config.clientSecret ? \"client_secret_post\" : \"none\",\n      ...(this.config.scope !== undefined ? { scope: this.config.scope } : {}),\n    }\n  }\n\n  /**\n   * Get client information (for pre-registered or dynamically registered clients).\n   * Returns undefined if no client info exists or if the server URL has changed.\n   */\n  async clientInformation(): Promise<OAuthClientInformation | undefined> {\n    // Check config first (pre-registered client)\n    if (this.config.clientId) {\n      return {\n        client_id: this.config.clientId,\n        client_secret: this.config.clientSecret,\n      }\n    }\n\n    // An active flow keeps the registration it started with even if another\n    // session uses the same server name with a different endpoint.\n    if (!this.flowState || !this.flowClientInfoLoaded) {\n      const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n      throwIfAborted(this.flowState?.signal)\n      const info = entry?.clientInfo\n      this.flowClientInfo = info?.clientSecretExpiresAt && info.clientSecretExpiresAt < Date.now() / 1000\n        ? undefined : info\n      this.flowClientInfoLoaded = true\n    }\n    if (!this.flowClientInfo) return undefined\n    return {\n      client_id: this.flowClientInfo.clientId,\n      client_secret: this.flowClientInfo.clientSecret,\n    }\n  }\n\n  /**\n   * Save client information from dynamic registration.\n   */\n  async saveClientInformation(info: OAuthClientInformationFull): Promise<void> {\n    throwIfAborted(this.flowState?.signal)\n    const redirectUris = info.redirect_uris ?? (this.redirectUrl ? [this.redirectUrl] : undefined)\n    const clientInfo: StoredClientInfo = {\n      clientId: info.client_id,\n      clientSecret: info.client_secret,\n      clientIdIssuedAt: info.client_id_issued_at,\n      clientSecretExpiresAt: info.client_secret_expires_at,\n      redirectUris,\n    }\n    if (this.flowState) {\n      this.flowClientInfo = clientInfo\n      this.flowClientInfoLoaded = true\n    }\n    updateClientInfo(this.serverName, clientInfo, this.serverUrl)\n  }\n\n  /**\n   * Get stored OAuth tokens.\n   * Returns undefined if no tokens exist or if the server URL has changed.\n   */\n  async tokens(): Promise<OAuthTokens | undefined> {\n    // Use getAuthForUrl to validate tokens are for the current server URL\n    const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n    if (!entry?.tokens) return undefined\n\n    return {\n      access_token: entry.tokens.accessToken,\n      token_type: \"Bearer\",\n      refresh_token: entry.tokens.refreshToken,\n      expires_in: entry.tokens.expiresAt\n        ? Math.max(0, Math.floor(entry.tokens.expiresAt - Date.now() / 1000))\n        : undefined,\n      scope: entry.tokens.scope,\n    }\n  }\n\n  /**\n   * Save OAuth tokens.\n   */\n  async saveTokens(tokens: OAuthTokens): Promise<void> {\n    throwIfAborted(this.flowState?.signal)\n    const storedTokens: StoredTokens = {\n      accessToken: tokens.access_token,\n      refreshToken: tokens.refresh_token,\n      expiresAt: tokens.expires_in ? Date.now() / 1000 + tokens.expires_in : undefined,\n      scope: tokens.scope,\n    }\n    // Keep the completed flow's registration with its tokens if another\n    // same-name endpoint replaced the shared credential entry meanwhile.\n    if (this.flowState && this.flowClientInfo) {\n      updateClientInfo(this.serverName, this.flowClientInfo, this.serverUrl)\n    }\n    updateTokens(this.serverName, storedTokens, this.serverUrl)\n  }\n\n  /**\n   * Redirect the user to the authorization URL.\n   * This opens the browser for the user to authenticate.\n   *\n   * Throws UnauthorizedError when called without owned or legacy flow state.\n   * That path is reached when the SDK\n   * falls through from a failed refresh into a fresh authorization_code\n   * flow, which library hosts cannot complete in-process.\n   */\n  async redirectToAuthorization(authorizationUrl: URL): Promise<void> {\n    if (this.usesClientCredentials) {\n      throw new Error(\"redirectToAuthorization is not used for client_credentials flow\")\n    }\n    throwIfAborted(this.flowState?.signal)\n    if (this.flowState) {\n      await this.callbacks.onRedirect(authorizationUrl)\n      return\n    }\n    // No saved oauthState means we're on the post-refresh authorize fallback.\n    const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n    if (!entry?.oauthState) {\n      throw new UnauthorizedError(\n        `Re-authentication required for MCP server: ${this.serverName}`,\n      )\n    }\n    // URL is passed to callback, not logged (may contain sensitive params)\n    await this.callbacks.onRedirect(authorizationUrl)\n  }\n\n  /**\n   * Save the PKCE code verifier.\n   */\n  async saveCodeVerifier(codeVerifier: string): Promise<void> {\n    throwIfAborted(this.flowState?.signal)\n    if (this.flowState) {\n      this.flowState.codeVerifier = codeVerifier\n      return\n    }\n    updateCodeVerifier(this.serverName, codeVerifier, this.serverUrl)\n  }\n\n  /**\n   * Get the stored PKCE code verifier.\n   * @throws Error if no code verifier is stored\n   */\n  async codeVerifier(): Promise<string> {\n    throwIfAborted(this.flowState?.signal)\n    if (this.flowState) {\n      if (!this.flowState.codeVerifier) throw new Error(`No code verifier saved for MCP server: ${this.serverName}`)\n      return this.flowState.codeVerifier\n    }\n    if (this.usesClientCredentials) {\n      throw new Error(\"codeVerifier is not used for client_credentials flow\")\n    }\n    const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n    if (!entry?.codeVerifier) {\n      throw new Error(`No code verifier saved for MCP server: ${this.serverName}`)\n    }\n    return entry.codeVerifier\n  }\n\n  /**\n   * Save the OAuth state parameter for CSRF protection.\n   */\n  async saveState(state: string): Promise<void> {\n    throwIfAborted(this.flowState?.signal)\n    if (this.flowState) {\n      this.flowState.oauthState = state\n      return\n    }\n    updateOAuthState(this.serverName, state, this.serverUrl)\n  }\n\n  /**\n   * Get the stored OAuth state parameter.\n   * @throws UnauthorizedError if no flow is in progress (see redirectToAuthorization)\n   */\n  async state(): Promise<string> {\n    throwIfAborted(this.flowState?.signal)\n    if (this.flowState) return this.flowState.oauthState\n    if (this.usesClientCredentials) {\n      throw new Error(\"state is not used for client_credentials flow\")\n    }\n    const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n    if (!entry?.oauthState) {\n      throw new UnauthorizedError(\n        `Re-authentication required for MCP server: ${this.serverName}`,\n      )\n    }\n    return entry.oauthState\n  }\n\n  /**\n   * Invalidate credentials when authentication fails.\n   * Clears tokens, client info, or all credentials based on the type.\n   */\n  async invalidateCredentials(type: \"all\" | \"client\" | \"tokens\"): Promise<void> {\n    throwIfAborted(this.flowState?.signal)\n    if (this.flowState && type !== \"tokens\") {\n      this.flowClientInfo = undefined\n      this.flowClientInfoLoaded = true\n    }\n    switch (type) {\n      case \"all\":\n        clearAllCredentials(this.serverName)\n        break\n      case \"client\":\n        clearClientInfo(this.serverName)\n        break\n      case \"tokens\":\n        clearTokens(this.serverName)\n        break\n    }\n  }\n\n  /**\n   * Adds configured authorization-code scope without replacing the SDK's\n   * default token endpoint authentication behavior.\n   */\n  addClientAuthentication: AddClientAuthentication = async (headers, params, _url, metadata) => {\n    if (params.get(\"grant_type\") === \"authorization_code\" && !params.has(\"scope\") && this.config.scope) {\n      params.set(\"scope\", this.config.scope)\n    }\n\n    const clientInfo = await this.clientInformation()\n    if (!clientInfo) {\n      return\n    }\n\n    const supportedMethods = metadata?.token_endpoint_auth_methods_supported ?? []\n    const hasClientSecret = clientInfo.client_secret !== undefined\n    let authMethod: \"client_secret_basic\" | \"client_secret_post\" | \"none\"\n\n    if (supportedMethods.length === 0) {\n      authMethod = hasClientSecret ? \"client_secret_post\" : \"none\"\n    } else if (hasClientSecret && supportedMethods.includes(\"client_secret_basic\")) {\n      authMethod = \"client_secret_basic\"\n    } else if (hasClientSecret && supportedMethods.includes(\"client_secret_post\")) {\n      authMethod = \"client_secret_post\"\n    } else if (supportedMethods.includes(\"none\")) {\n      authMethod = \"none\"\n    } else {\n      authMethod = hasClientSecret ? \"client_secret_post\" : \"none\"\n    }\n\n    if (authMethod === \"client_secret_basic\") {\n      if (!clientInfo.client_secret) {\n        throw new Error(\"client_secret_basic authentication requires a client_secret\")\n      }\n      headers.set(\"Authorization\", `Basic ${Buffer.from(`${clientInfo.client_id}:${clientInfo.client_secret}`).toString(\"base64\")}`)\n      return\n    }\n\n    if (!params.has(\"client_id\")) {\n      params.set(\"client_id\", clientInfo.client_id)\n    }\n    if (authMethod === \"client_secret_post\" && clientInfo.client_secret && !params.has(\"client_secret\")) {\n      params.set(\"client_secret\", clientInfo.client_secret)\n    }\n  }\n\n  prepareTokenRequest(scope?: string): URLSearchParams | undefined {\n    if (!this.usesClientCredentials) {\n      return undefined\n    }\n\n    const params = new URLSearchParams({ grant_type: \"client_credentials\" })\n    const requestedScope = scope ?? this.config.scope\n    if (requestedScope) {\n      params.set(\"scope\", requestedScope)\n    }\n    return params\n  }\n}\n\nexport { DEFAULT_OAUTH_CALLBACK_PORT, DEFAULT_OAUTH_CALLBACK_PATH }\n"]}

package/dist/builtin-extensions/pi-mcp-adapter/proxy-modes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy-modes.d.ts","sourceRoot":"","sources":["../../../src/builtin-extensions/pi-mcp-adapter/proxy-modes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAGjF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAYpD,KAAK,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAmGhE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,CA4E3E;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,CAsDvE;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAoC7G;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CA+B/H;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,CAuC3F;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,iBAAiB,EACxB,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,OAAO,EACf,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,OAAO,GACvB,eAAe,CAwGjB;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,CAqDrF;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,CAqDjI;AAED,wBAAsB,WAAW,CAC/B,KAAK,EAAE,iBAAiB,EACxB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,cAAc,CAAC,EAAE,MAAM,EACvB,UAAU,CAAC,EAAE,MAAM,QAAQ,EAAE,EAC7B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,eAAe,CAAC,CAyW1B","sourcesContent":["// @ts-nocheck\nimport type { AgentToolResult, ToolInfo } from \"@ashx-j/lunr\";\nimport { UrlElicitationRequiredError } from \"@modelcontextprotocol/sdk/types.js\";\nimport { checkSync } from \"recheck\";\nimport type { McpExtensionState } from \"./state.ts\";\nimport type { ToolMetadata, McpContent } from \"./types.ts\";\nimport { getServerPrefix, parseUiPromptHandoff } from \"./types.ts\";\nimport { lazyConnect, updateServerMetadata, updateMetadataCache, getFailureAgeSeconds, updateStatusBar } from \"./init.ts\";\nimport { abortable, throwIfAborted } from \"./abort.ts\";\nimport { buildToolMetadata, getToolNames, findToolByName, formatSchema } from \"./tool-metadata.ts\";\nimport { resolveMcpResultContent, transformMcpContent } from \"./tool-registrar.ts\";\nimport { guardMcpOutput, guardedMcpDetails, resolveMcpOutputGuardOptions } from \"./mcp-output-guard.ts\";\nimport { maybeStartUiSession, type UiSessionRuntime } from \"./ui-session.ts\";\nimport { formatAuthRequiredMessage, truncateAtWord } from \"./utils.ts\";\nimport { authenticate, completeAuthFromInput, startAuth, supportsOAuth } from \"./mcp-auth-flow.ts\";\n\ntype ProxyToolResult = AgentToolResult<Record<string, unknown>>;\n\nconst MAX_REGEX_SEARCH_QUERY_LENGTH = 256;\nconst REGEX_SAFETY_CHECK_PARAMS = {\n  attackTimeout: 50,\n  incubationTimeout: 50,\n  timeout: 250,\n} as const;\n\ntype AutoAuthResult =\n  | { status: \"skipped\" }\n  | { status: \"success\" }\n  | { status: \"failed\"; message: string };\n\nfunction getAuthRequiredMessage(\n  state: McpExtensionState,\n  serverName: string,\n  defaultMessage = `Server \"${serverName}\" requires OAuth authentication. Run mcp({ action: \"auth-start\", server: \"${serverName}\" }) to get a browser URL, or /mcp-auth ${serverName} in an interactive local session.`,\n): string {\n  return formatAuthRequiredMessage(state.config, serverName, defaultMessage);\n}\n\nfunction getAuthFailedMessage(state: McpExtensionState, serverName: string, message: string): string {\n  const customGuidance = state.config.settings?.authRequiredMessage;\n  if (customGuidance) {\n    return `OAuth authentication failed for \"${serverName}\": ${message}. ${getAuthRequiredMessage(state, serverName)}`;\n  }\n  return `OAuth authentication failed for \"${serverName}\": ${message}. Run mcp({ action: \"auth-start\", server: \"${serverName}\" }) to get a browser URL, or /mcp-auth ${serverName} in an interactive local session.`;\n}\n\nfunction getRedirectPort(authorizationUrl: string): number | undefined {\n  try {\n    const redirectUri = new URL(authorizationUrl).searchParams.get(\"redirect_uri\");\n    if (!redirectUri) return undefined;\n    const port = Number.parseInt(new URL(redirectUri).port, 10);\n    return Number.isInteger(port) ? port : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction formatManualAuthInstructions(serverName: string, authorizationUrl: string): string {\n  const port = getRedirectPort(authorizationUrl);\n  const portNote = port\n    ? `\\nThe redirect URL will use local port ${port}. On a remote server it is expected for that localhost page to fail locally; copy the address bar URL anyway.`\n    : \"\";\n\n  return [\n    `MCP OAuth required for \"${serverName}\".`,\n    \"\",\n    \"Open this URL in your local browser:\",\n    \"\",\n    authorizationUrl,\n    \"\",\n    \"After approving, copy the full redirected localhost URL from your browser address bar and send it back with:\",\n    `mcp({ action: \"auth-complete\", server: \"${serverName}\", args: '{\"redirectUrl\":\"PASTE_REDIRECT_URL_HERE\"}' })`,\n    \"\",\n    \"You can also pass just the `code` query parameter as `args: '{\\\"code\\\":\\\"PASTE_CODE_HERE\\\"}'`.\",\n    portNote.trimEnd(),\n  ].filter(Boolean).join(\"\\n\");\n}\n\nasync function attemptAutoAuth(\n  state: McpExtensionState,\n  serverName: string,\n): Promise<AutoAuthResult> {\n  if (state.config.settings?.autoAuth !== true) {\n    return { status: \"skipped\" };\n  }\n\n  const definition = state.config.mcpServers[serverName];\n  if (!definition || !supportsOAuth(definition) || !definition.url) {\n    return { status: \"skipped\" };\n  }\n\n  const grantType = definition.oauth ? definition.oauth.grantType ?? \"authorization_code\" : \"authorization_code\";\n  if (!state.ui && grantType !== \"client_credentials\") {\n    return {\n      status: \"failed\",\n      message: getAuthRequiredMessage(\n        state,\n        serverName,\n        `Server \"${serverName}\" requires OAuth authentication. Run mcp({ action: \"auth-start\", server: \"${serverName}\" }) to get a browser URL, or /mcp-auth ${serverName} in an interactive local session.`,\n      ),\n    };\n  }\n\n  try {\n    await authenticate(serverName, definition.url, definition);\n    return { status: \"success\" };\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    return {\n      status: \"failed\",\n      message: getAuthFailedMessage(state, serverName, message),\n    };\n  }\n}\n\nexport function executeUiMessages(state: McpExtensionState): ProxyToolResult {\n  const sessions = state.completedUiSessions;\n\n  if (sessions.length === 0) {\n    return {\n      content: [{ type: \"text\" as const, text: \"No UI session messages available.\" }],\n      details: { sessions: 0 },\n    };\n  }\n\n  const output: string[] = [];\n  output.push(`UI Session Messages (${sessions.length} session${sessions.length > 1 ? \"s\" : \"\"}):\\n`);\n\n  const allPrompts: string[] = [];\n  const allIntents = sessions.flatMap((session) => session.messages.intents);\n  const parsedHandoffs: Array<{ intent: string; params: Record<string, unknown>; raw: string }> = [];\n\n  for (const session of sessions) {\n    const timestamp = session.completedAt.toLocaleTimeString();\n    output.push(`\\n## ${session.serverName} / ${session.toolName} (${timestamp}, ${session.reason})`);\n\n    const plainPrompts: string[] = [];\n    for (const prompt of session.messages.prompts) {\n      allPrompts.push(prompt);\n      const handoff = parseUiPromptHandoff(prompt);\n      if (handoff) {\n        parsedHandoffs.push(handoff);\n      } else {\n        plainPrompts.push(prompt);\n      }\n    }\n\n    if (plainPrompts.length > 0) {\n      output.push(\"\\n### Prompts:\");\n      for (const prompt of plainPrompts) {\n        output.push(`- ${prompt}`);\n      }\n    }\n\n    const intentsForSession = [\n      ...session.messages.intents,\n      ...session.messages.prompts\n        .map((prompt) => parseUiPromptHandoff(prompt))\n        .filter((handoff): handoff is NonNullable<typeof handoff> => !!handoff)\n        .map((handoff) => ({ intent: handoff.intent, params: handoff.params })),\n    ];\n\n    if (intentsForSession.length > 0) {\n      output.push(\"\\n### Intents:\");\n      for (const intent of intentsForSession) {\n        const params = intent.params ? ` (${JSON.stringify(intent.params)})` : \"\";\n        output.push(`- ${intent.intent}${params}`);\n      }\n    }\n\n    if (session.messages.notifications.length > 0) {\n      output.push(\"\\n### Notifications:\");\n      for (const notification of session.messages.notifications) {\n        output.push(`- ${notification}`);\n      }\n    }\n  }\n\n  const count = sessions.length;\n  state.completedUiSessions = [];\n\n  return {\n    content: [{ type: \"text\" as const, text: output.join(\"\\n\") }],\n    details: {\n      sessions: count,\n      prompts: allPrompts,\n      intents: [...allIntents, ...parsedHandoffs.map(({ intent, params }) => ({ intent, params }))],\n      handoffs: parsedHandoffs,\n      cleared: true,\n    },\n  };\n}\n\nexport function executeStatus(state: McpExtensionState): ProxyToolResult {\n  const servers: Array<{ name: string; status: string; toolCount: number; failedAgo: number | null }> = [];\n\n  for (const name of Object.keys(state.config.mcpServers)) {\n    const connection = state.manager.getConnection(name);\n    const metadata = state.toolMetadata.get(name);\n    const toolCount = metadata?.length ?? 0;\n    const failedAgo = getFailureAgeSeconds(state, name);\n    let status = \"not connected\";\n    if (connection?.status === \"connected\") {\n      status = \"connected\";\n    } else if (connection?.status === \"needs-auth\") {\n      status = \"needs-auth\";\n    } else if (failedAgo !== null) {\n      status = \"failed\";\n    } else if (metadata !== undefined) {\n      status = \"cached\";\n    }\n\n    servers.push({ name, status, toolCount, failedAgo });\n  }\n\n  const totalTools = servers.reduce((sum, s) => sum + s.toolCount, 0);\n  const connectedCount = servers.filter(s => s.status === \"connected\").length;\n\n  let text = `MCP: ${connectedCount}/${servers.length} servers, ${totalTools} tools\\n\\n`;\n  for (const server of servers) {\n    if (server.status === \"connected\") {\n      text += `✓ ${server.name} (${server.toolCount} tools)\\n`;\n      continue;\n    }\n    if (server.status === \"needs-auth\") {\n      text += `⚠ ${server.name} (needs auth)\\n`;\n      continue;\n    }\n    if (server.status === \"cached\") {\n      text += `○ ${server.name} (${server.toolCount} tools, cached)\\n`;\n      continue;\n    }\n    if (server.status === \"failed\") {\n      text += `✗ ${server.name} (failed ${server.failedAgo ?? 0}s ago)\\n`;\n      continue;\n    }\n    text += `○ ${server.name} (not connected)\\n`;\n  }\n\n  if (servers.length > 0) {\n    text += `\\nmcp({ server: \"name\" }) to list tools, mcp({ search: \"...\" }) to search`;\n  }\n\n  return {\n    content: [{ type: \"text\" as const, text: text.trim() }],\n    details: { mode: \"status\", servers, totalTools, connectedCount },\n  };\n}\n\nexport async function executeAuthStart(state: McpExtensionState, serverName: string): Promise<ProxyToolResult> {\n  const definition = state.config.mcpServers[serverName];\n  if (!definition) {\n    return {\n      content: [{ type: \"text\" as const, text: `Server \"${serverName}\" not found. Use mcp({}) to see available servers.` }],\n      details: { mode: \"auth-start\", error: \"not_found\", server: serverName },\n    };\n  }\n\n  if (!definition.url || !supportsOAuth(definition)) {\n    return {\n      content: [{ type: \"text\" as const, text: `Server \"${serverName}\" is not configured for OAuth over HTTP.` }],\n      details: { mode: \"auth-start\", error: \"oauth_not_supported\", server: serverName },\n    };\n  }\n\n  try {\n    const { authorizationUrl } = await startAuth(serverName, definition.url, definition);\n    if (!authorizationUrl) {\n      return {\n        content: [{ type: \"text\" as const, text: `OAuth authentication successful for \"${serverName}\".` }],\n        details: { mode: \"auth-start\", server: serverName, authenticated: true },\n      };\n    }\n\n    return {\n      content: [{ type: \"text\" as const, text: formatManualAuthInstructions(serverName, authorizationUrl) }],\n      details: { mode: \"auth-start\", server: serverName, authorizationUrl },\n    };\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    return {\n      content: [{ type: \"text\" as const, text: `Failed to start OAuth for \"${serverName}\": ${message}` }],\n      details: { mode: \"auth-start\", error: \"auth_start_failed\", server: serverName, message },\n    };\n  }\n}\n\nexport async function executeAuthComplete(state: McpExtensionState, serverName: string, input: string): Promise<ProxyToolResult> {\n  if (!state.config.mcpServers[serverName]) {\n    return {\n      content: [{ type: \"text\" as const, text: `Server \"${serverName}\" not found. Use mcp({}) to see available servers.` }],\n      details: { mode: \"auth-complete\", error: \"not_found\", server: serverName },\n    };\n  }\n\n  try {\n    const status = await completeAuthFromInput(serverName, input);\n    if (status !== \"authenticated\") {\n      return {\n        content: [{ type: \"text\" as const, text: `OAuth authentication did not complete for \"${serverName}\".` }],\n        details: { mode: \"auth-complete\", error: \"not_authenticated\", server: serverName, status },\n      };\n    }\n\n    await state.manager.close(serverName);\n    state.failureTracker.delete(serverName);\n    updateStatusBar(state);\n    return {\n      content: [{ type: \"text\" as const, text: `OAuth authentication successful for \"${serverName}\". Run mcp({ connect: \"${serverName}\" }) to connect with the new token.` }],\n      details: { mode: \"auth-complete\", server: serverName, authenticated: true },\n    };\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    return {\n      content: [{ type: \"text\" as const, text: `Failed to complete OAuth for \"${serverName}\": ${message}` }],\n      details: { mode: \"auth-complete\", error: \"auth_complete_failed\", server: serverName, message },\n    };\n  }\n}\n\nexport function executeDescribe(state: McpExtensionState, toolName: string): ProxyToolResult {\n  let serverName: string | undefined;\n  let toolMeta: ToolMetadata | undefined;\n\n  for (const [server, metadata] of state.toolMetadata.entries()) {\n    const found = findToolByName(metadata, toolName);\n    if (found) {\n      serverName = server;\n      toolMeta = found;\n      break;\n    }\n  }\n\n  if (!serverName || !toolMeta) {\n    return {\n      content: [{ type: \"text\" as const, text: `Tool \"${toolName}\" not found. Use mcp({ search: \"...\" }) to search.` }],\n      details: { mode: \"describe\", error: \"tool_not_found\", requestedTool: toolName },\n    };\n  }\n\n  let text = `${toolMeta.name}\\n`;\n  text += `Server: ${serverName}\\n`;\n  if (toolMeta.resourceUri) {\n    text += `Type: Resource (reads from ${toolMeta.resourceUri})\\n`;\n  }\n  text += `\\n${toolMeta.description || \"(no description)\"}\\n`;\n\n  if (toolMeta.inputSchema && !toolMeta.resourceUri) {\n    text += `\\nParameters:\\n${formatSchema(toolMeta.inputSchema)}`;\n  } else if (toolMeta.resourceUri) {\n    text += `\\nNo parameters required (resource tool).`;\n  } else {\n    text += `\\nNo parameters defined.`;\n  }\n\n  return {\n    content: [{ type: \"text\" as const, text: text.trim() }],\n    details: { mode: \"describe\", tool: toolMeta, server: serverName },\n  };\n}\n\nexport function executeSearch(\n  state: McpExtensionState,\n  query: string,\n  regex?: boolean,\n  server?: string,\n  includeSchemas?: boolean,\n): ProxyToolResult {\n  const showSchemas = includeSchemas !== false;\n\n  const matches: Array<{ server: string; tool: ToolMetadata }> = [];\n\n  let pattern: RegExp;\n  try {\n    if (regex) {\n      if (query.length > MAX_REGEX_SEARCH_QUERY_LENGTH) {\n        return {\n          content: [{ type: \"text\" as const, text: `Regex query is too long; maximum length is ${MAX_REGEX_SEARCH_QUERY_LENGTH} characters.` }],\n          details: { mode: \"search\", error: \"query_too_long\", query, maxLength: MAX_REGEX_SEARCH_QUERY_LENGTH },\n        };\n      }\n\n      pattern = new RegExp(query, \"i\");\n      let safety;\n      try {\n        safety = checkSync(query, \"i\", REGEX_SAFETY_CHECK_PARAMS);\n      } catch (error) {\n        const message = error instanceof Error ? error.message : String(error);\n        return {\n          content: [{ type: \"text\" as const, text: \"Regex query rejected because safety analysis failed.\" }],\n          details: { mode: \"search\", error: \"unsafe_pattern\", query, reason: message },\n        };\n      }\n      if (safety.status !== \"safe\") {\n        return {\n          content: [{ type: \"text\" as const, text: `Regex query rejected as unsafe (${safety.status}).` }],\n          details: { mode: \"search\", error: \"unsafe_pattern\", query, safetyStatus: safety.status },\n        };\n      }\n    } else {\n      const terms = query.trim().split(/\\s+/).filter(t => t.length > 0);\n      if (terms.length === 0) {\n        return {\n          content: [{ type: \"text\" as const, text: \"Search query cannot be empty\" }],\n          details: { mode: \"search\", error: \"empty_query\" },\n        };\n      }\n      const escaped = terms.map(t => t.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\"));\n      pattern = new RegExp(escaped.join(\"|\"), \"i\");\n    }\n  } catch {\n    return {\n      content: [{ type: \"text\" as const, text: `Invalid regex: ${query}` }],\n      details: { mode: \"search\", error: \"invalid_pattern\", query },\n    };\n  }\n\n  for (const [serverName, metadata] of state.toolMetadata.entries()) {\n    if (server && serverName !== server) continue;\n    for (const tool of metadata) {\n      if (pattern.test(tool.name) || pattern.test(tool.description)) {\n        matches.push({\n          server: serverName,\n          tool,\n        });\n      }\n    }\n  }\n\n  const totalCount = matches.length;\n\n  if (totalCount === 0) {\n    const msg = server\n      ? `No tools matching \"${query}\" in \"${server}\"`\n      : `No tools matching \"${query}\"`;\n    return {\n      content: [{ type: \"text\" as const, text: msg }],\n      details: { mode: \"search\", matches: [], count: 0, query },\n    };\n  }\n\n  let text = `Found ${totalCount} tool${totalCount === 1 ? \"\" : \"s\"} matching \"${query}\":\\n\\n`;\n\n  for (const match of matches) {\n    if (showSchemas) {\n      text += `${match.tool.name}\\n`;\n      text += `  ${match.tool.description || \"(no description)\"}\\n`;\n      if (match.tool.inputSchema && !match.tool.resourceUri) {\n        text += `\\n  Parameters:\\n${formatSchema(match.tool.inputSchema, \"    \")}\\n`;\n      } else if (match.tool.resourceUri) {\n        text += `  No parameters (resource tool).\\n`;\n      }\n      text += \"\\n\";\n    } else {\n      text += `- ${match.tool.name}`;\n      if (match.tool.description) {\n        text += ` - ${truncateAtWord(match.tool.description, 50)}`;\n      }\n      text += \"\\n\";\n    }\n  }\n\n  return {\n    content: [{ type: \"text\" as const, text: text.trim() }],\n    details: {\n      mode: \"search\",\n      matches: matches.map(m => ({ server: m.server, tool: m.tool.name })),\n      count: totalCount,\n      query,\n    },\n  };\n}\n\nexport function executeList(state: McpExtensionState, server: string): ProxyToolResult {\n  if (!state.config.mcpServers[server]) {\n    return {\n      content: [{ type: \"text\" as const, text: `Server \"${server}\" not found. Use mcp({}) to see available servers.` }],\n      details: { mode: \"list\", server, tools: [], count: 0, error: \"not_found\" },\n    };\n  }\n\n  const metadata = state.toolMetadata.get(server);\n  const toolNames = metadata?.map(m => m.name) ?? [];\n  const connection = state.manager.getConnection(server);\n\n  if (toolNames.length === 0) {\n    if (connection?.status === \"connected\") {\n      return {\n        content: [{ type: \"text\" as const, text: `Server \"${server}\" has no tools.` }],\n        details: { mode: \"list\", server, tools: [], count: 0 },\n      };\n    }\n    if (metadata !== undefined) {\n      return {\n        content: [{ type: \"text\" as const, text: `Server \"${server}\" has no cached tools (not connected).` }],\n        details: { mode: \"list\", server, tools: [], count: 0, cached: true },\n      };\n    }\n    return {\n      content: [{ type: \"text\" as const, text: `Server \"${server}\" is configured but not connected. Use mcp({ connect: \"${server}\" }) or /mcp reconnect ${server} to retry.` }],\n      details: { mode: \"list\", server, tools: [], count: 0, error: \"not_connected\" },\n    };\n  }\n\n  const cachedNote = connection?.status === \"connected\" ? \"\" : \" (not connected, cached)\";\n  let text = `${server} (${toolNames.length} tools${cachedNote}):\\n\\n`;\n\n  const descMap = new Map<string, string>();\n  if (metadata) {\n    for (const m of metadata) {\n      descMap.set(m.name, m.description);\n    }\n  }\n\n  for (const tool of toolNames) {\n    const desc = descMap.get(tool) ?? \"\";\n    const truncated = truncateAtWord(desc, 50);\n    text += `- ${tool}`;\n    if (truncated) text += ` - ${truncated}`;\n    text += \"\\n\";\n  }\n\n  return {\n    content: [{ type: \"text\" as const, text: text.trim() }],\n    details: { mode: \"list\", server, tools: toolNames, count: toolNames.length },\n  };\n}\n\nexport async function executeConnect(state: McpExtensionState, serverName: string, signal?: AbortSignal): Promise<ProxyToolResult> {\n  throwIfAborted(signal);\n  const definition = state.config.mcpServers[serverName];\n  if (!definition) {\n    return {\n      content: [{ type: \"text\" as const, text: `Server \"${serverName}\" not found. Use mcp({}) to see available servers.` }],\n      details: { mode: \"connect\", error: \"not_found\", server: serverName },\n    };\n  }\n\n  try {\n    if (state.ui) {\n      state.ui.setStatus(\"mcp\", `MCP: connecting to ${serverName}...`);\n    }\n    let connection = await state.manager.connect(serverName, definition, signal);\n    if (connection.status === \"needs-auth\") {\n      const autoAuth = await attemptAutoAuth(state, serverName);\n      if (autoAuth.status === \"failed\") {\n        return {\n          content: [{ type: \"text\" as const, text: autoAuth.message }],\n          details: { mode: \"connect\", error: \"auth_required\", server: serverName, message: autoAuth.message },\n        };\n      }\n      if (autoAuth.status === \"success\") {\n        await state.manager.close(serverName);\n        connection = await state.manager.connect(serverName, definition, signal);\n      }\n      if (connection.status === \"needs-auth\") {\n        const message = getAuthRequiredMessage(state, serverName);\n        return {\n          content: [{ type: \"text\" as const, text: message }],\n          details: { mode: \"connect\", error: \"auth_required\", server: serverName, message },\n        };\n      }\n    }\n    const prefix = state.config.settings?.toolPrefix ?? \"server\";\n    const { metadata } = buildToolMetadata(connection.tools, connection.resources, definition, serverName, prefix);\n    state.toolMetadata.set(serverName, metadata);\n    updateMetadataCache(state, serverName);\n    state.failureTracker.delete(serverName);\n    updateStatusBar(state);\n    return executeList(state, serverName);\n  } catch (error) {\n    if (!signal?.aborted) {\n      state.failureTracker.set(serverName, Date.now());\n    }\n    updateStatusBar(state);\n    const message = error instanceof Error ? error.message : String(error);\n    return {\n      content: [{ type: \"text\" as const, text: `Failed to connect to \"${serverName}\": ${message}` }],\n      details: { mode: \"connect\", error: signal?.aborted ? \"aborted\" : \"connect_failed\", server: serverName, message },\n    };\n  }\n}\n\nexport async function executeCall(\n  state: McpExtensionState,\n  toolName: string,\n  args?: Record<string, unknown>,\n  serverOverride?: string,\n  getPiTools?: () => ToolInfo[],\n  signal?: AbortSignal,\n): Promise<ProxyToolResult> {\n  throwIfAborted(signal);\n  let serverName: string | undefined = serverOverride;\n  let toolMeta: ToolMetadata | undefined;\n  let autoAuthAttempted = false;\n  const prefixMode = state.config.settings?.toolPrefix ?? \"server\";\n\n  if (serverName && !state.config.mcpServers[serverName]) {\n    return {\n      content: [{ type: \"text\" as const, text: `Server \"${serverName}\" not found. Use mcp({}) to see available servers.` }],\n      details: { mode: \"call\", error: \"server_not_found\", server: serverName },\n    };\n  }\n\n  if (serverName) {\n    toolMeta = findToolByName(state.toolMetadata.get(serverName), toolName);\n  } else {\n    for (const [server, metadata] of state.toolMetadata.entries()) {\n      const found = findToolByName(metadata, toolName);\n      if (found) {\n        serverName = server;\n        toolMeta = found;\n        break;\n      }\n    }\n  }\n\n  if (serverName && !toolMeta) {\n    const connected = await lazyConnect(state, serverName, signal);\n    if (connected) {\n      toolMeta = findToolByName(state.toolMetadata.get(serverName), toolName);\n    } else {\n      const needsAuthConnection = state.manager.getConnection(serverName);\n      if (needsAuthConnection?.status === \"needs-auth\") {\n        if (!autoAuthAttempted) {\n          autoAuthAttempted = true;\n          const autoAuth = await attemptAutoAuth(state, serverName);\n          if (autoAuth.status === \"failed\") {\n            return {\n              content: [{ type: \"text\" as const, text: autoAuth.message }],\n              details: { mode: \"call\", error: \"auth_required\", server: serverName, message: autoAuth.message },\n            };\n          }\n          if (autoAuth.status === \"success\") {\n            await state.manager.close(serverName);\n            state.failureTracker.delete(serverName);\n            const connectedAfterAuth = await lazyConnect(state, serverName, signal);\n            if (connectedAfterAuth) {\n              toolMeta = findToolByName(state.toolMetadata.get(serverName), toolName);\n              if (!toolMeta) {\n                return {\n                  content: [{ type: \"text\" as const, text: `Tool \"${toolName}\" not found on \"${serverName}\" after reconnect.` }],\n                  details: { mode: \"call\", error: \"tool_not_found_after_reconnect\", requestedTool: toolName },\n                };\n              }\n            }\n          }\n        }\n\n        if (!toolMeta && state.manager.getConnection(serverName)?.status === \"needs-auth\") {\n          const message = getAuthRequiredMessage(state, serverName);\n          return {\n            content: [{ type: \"text\" as const, text: message }],\n            details: { mode: \"call\", error: \"auth_required\", server: serverName, message },\n          };\n        }\n      }\n\n      if (!toolMeta) {\n        const failedAgo = getFailureAgeSeconds(state, serverName);\n        if (failedAgo !== null) {\n          return {\n            content: [{ type: \"text\" as const, text: `Server \"${serverName}\" not available (last failed ${failedAgo}s ago)` }],\n            details: { mode: \"call\", error: \"server_backoff\", server: serverName },\n          };\n        }\n      }\n    }\n  }\n\n  let prefixMatchedServer: string | undefined;\n\n  if (!serverName && !toolMeta && prefixMode !== \"none\") {\n    const candidates = Object.keys(state.config.mcpServers)\n      .map(name => ({ name, prefix: getServerPrefix(name, prefixMode) }))\n      .filter(c => c.prefix && toolName.startsWith(c.prefix + \"_\"))\n      .sort((a, b) => b.prefix.length - a.prefix.length);\n\n    for (const { name: configuredServer } of candidates) {\n      const existingConnection = state.manager.getConnection(configuredServer);\n      const failedAgo = getFailureAgeSeconds(state, configuredServer);\n      if (failedAgo !== null && existingConnection?.status !== \"needs-auth\") continue;\n\n      let connected = await lazyConnect(state, configuredServer, signal);\n      if (!connected && state.manager.getConnection(configuredServer)?.status === \"needs-auth\" && !autoAuthAttempted) {\n        autoAuthAttempted = true;\n        const autoAuth = await attemptAutoAuth(state, configuredServer);\n        if (autoAuth.status === \"failed\") {\n          return {\n            content: [{ type: \"text\" as const, text: autoAuth.message }],\n            details: { mode: \"call\", error: \"auth_required\", server: configuredServer, message: autoAuth.message },\n          };\n        }\n        if (autoAuth.status === \"success\") {\n          await state.manager.close(configuredServer);\n          state.failureTracker.delete(configuredServer);\n          connected = await lazyConnect(state, configuredServer, signal);\n        }\n      }\n\n      if (!connected) continue;\n      if (!prefixMatchedServer) prefixMatchedServer = configuredServer;\n      toolMeta = findToolByName(state.toolMetadata.get(configuredServer), toolName);\n      if (toolMeta) {\n        serverName = configuredServer;\n        break;\n      }\n    }\n  }\n\n  if (!serverName || !toolMeta) {\n    const nativeTool = !serverOverride\n      ? getPiTools?.().find((tool) => tool.name === toolName && tool.name !== \"mcp\")\n      : undefined;\n    if (nativeTool) {\n      return {\n        content: [{ type: \"text\" as const, text: `\"${toolName}\" is a native Pi tool. Call ${toolName} directly instead of using mcp({ tool: \"${toolName}\" }).` }],\n        details: { mode: \"call\", error: \"native_tool\", requestedTool: toolName },\n      };\n    }\n\n    const hintServer = serverName ?? prefixMatchedServer;\n    const available = hintServer ? getToolNames(state, hintServer) : [];\n    let msg = `Tool \"${toolName}\" not found.`;\n    if (available.length > 0) {\n      msg += ` Server \"${hintServer}\" has: ${available.join(\", \")}`;\n    } else {\n      msg += ` Use mcp({ search: \"...\" }) to search.`;\n    }\n    return {\n      content: [{ type: \"text\" as const, text: msg }],\n      details: { mode: \"call\", error: \"tool_not_found\", requestedTool: toolName, hintServer },\n    };\n  }\n\n  let connection = state.manager.getConnection(serverName);\n  if (connection?.status === \"needs-auth\") {\n    if (!autoAuthAttempted) {\n      autoAuthAttempted = true;\n      const autoAuth = await attemptAutoAuth(state, serverName);\n      if (autoAuth.status === \"failed\") {\n        return {\n          content: [{ type: \"text\" as const, text: autoAuth.message }],\n          details: { mode: \"call\", error: \"auth_required\", server: serverName, message: autoAuth.message },\n        };\n      }\n      if (autoAuth.status === \"success\") {\n        await state.manager.close(serverName);\n        state.failureTracker.delete(serverName);\n        connection = state.manager.getConnection(serverName);\n      }\n    }\n\n    if (connection?.status === \"needs-auth\") {\n      const message = getAuthRequiredMessage(state, serverName);\n      return {\n        content: [{ type: \"text\" as const, text: message }],\n        details: { mode: \"call\", error: \"auth_required\", server: serverName, message },\n      };\n    }\n  }\n  if (!connection || connection.status !== \"connected\") {\n    const failedAgo = getFailureAgeSeconds(state, serverName);\n    if (failedAgo !== null) {\n      return {\n        content: [{ type: \"text\" as const, text: `Server \"${serverName}\" not available (last failed ${failedAgo}s ago)` }],\n        details: { mode: \"call\", error: \"server_backoff\", server: serverName },\n      };\n    }\n\n    const definition = state.config.mcpServers[serverName];\n    if (!definition) {\n      return {\n        content: [{ type: \"text\" as const, text: `Server \"${serverName}\" not connected` }],\n        details: { mode: \"call\", error: \"server_not_connected\", server: serverName },\n      };\n    }\n\n    try {\n      if (state.ui) {\n        state.ui.setStatus(\"mcp\", `MCP: connecting to ${serverName}...`);\n      }\n      connection = await state.manager.connect(serverName, definition, signal);\n      if (connection.status === \"needs-auth\") {\n        if (!autoAuthAttempted) {\n          autoAuthAttempted = true;\n          const autoAuth = await attemptAutoAuth(state, serverName);\n          if (autoAuth.status === \"failed\") {\n            return {\n              content: [{ type: \"text\" as const, text: autoAuth.message }],\n              details: { mode: \"call\", error: \"auth_required\", server: serverName, message: autoAuth.message },\n            };\n          }\n          if (autoAuth.status === \"success\") {\n            await state.manager.close(serverName);\n            connection = await state.manager.connect(serverName, definition, signal);\n          }\n        }\n\n        if (connection.status === \"needs-auth\") {\n          const message = getAuthRequiredMessage(state, serverName);\n          return {\n            content: [{ type: \"text\" as const, text: message }],\n            details: { mode: \"call\", error: \"auth_required\", server: serverName, message },\n          };\n        }\n      }\n      state.failureTracker.delete(serverName);\n      updateServerMetadata(state, serverName);\n      updateMetadataCache(state, serverName);\n      updateStatusBar(state);\n      toolMeta = findToolByName(state.toolMetadata.get(serverName), toolName);\n      if (!toolMeta) {\n        const available = getToolNames(state, serverName);\n        const hint = available.length > 0\n          ? `Available tools on \"${serverName}\": ${available.join(\", \")}`\n          : `Server \"${serverName}\" has no tools.`;\n        return {\n          content: [{ type: \"text\" as const, text: `Tool \"${toolName}\" not found on \"${serverName}\" after reconnect. ${hint}` }],\n          details: { mode: \"call\", error: \"tool_not_found_after_reconnect\", requestedTool: toolName },\n        };\n      }\n    } catch (error) {\n      if (!signal?.aborted) {\n        state.failureTracker.set(serverName, Date.now());\n      }\n      updateStatusBar(state);\n      const message = error instanceof Error ? error.message : String(error);\n      return {\n        content: [{ type: \"text\" as const, text: `Failed to connect to \"${serverName}\": ${message}` }],\n        details: { mode: \"call\", error: signal?.aborted ? \"aborted\" : \"connect_failed\", message },\n      };\n    }\n  }\n\n  let uiSession: UiSessionRuntime | null = null;\n  const requestOptions = state.manager.getRequestOptions?.(serverName, signal) ?? (signal ? { signal } : undefined);\n\n  const outputGuardOptions = resolveMcpOutputGuardOptions(state.config.settings);\n\n  try {\n    state.manager.touch(serverName);\n    state.manager.incrementInFlight(serverName);\n\n    if (toolMeta.resourceUri) {\n      const result = await connection.client.readResource({ uri: toolMeta.resourceUri }, requestOptions);\n      const content = (result.contents ?? []).map(c => ({\n        type: \"text\" as const,\n        text: \"text\" in c ? c.text : (\"blob\" in c ? `[Binary data: ${(c as { mimeType?: string }).mimeType ?? \"unknown\"}]` : JSON.stringify(c)),\n      }));\n      const guarded = await guardMcpOutput(content.length > 0 ? content : [{ type: \"text\" as const, text: \"(empty resource)\" }], outputGuardOptions);\n      return {\n        content: guarded.content,\n        details: { mode: \"call\", resourceUri: toolMeta.resourceUri, server: serverName, ...guardedMcpDetails(guarded) },\n      };\n    }\n\n    uiSession = toolMeta.uiResourceUri\n      ? await maybeStartUiSession(state, {\n          serverName,\n          toolName: toolMeta.originalName,\n          toolArgs: args ?? {},\n          uiResourceUri: toolMeta.uiResourceUri,\n          streamMode: toolMeta.uiStreamMode,\n        })\n      : null;\n\n    const resultPromise = connection.client.callTool({\n      name: toolMeta.originalName,\n      arguments: args ?? {},\n      _meta: uiSession?.requestMeta,\n    }, undefined, requestOptions);\n\n    if (toolMeta.uiResourceUri) {\n      const result = await abortable(resultPromise, signal);\n      uiSession?.sendToolResult(result as unknown as import(\"@modelcontextprotocol/sdk/types.js\").CallToolResult);\n\n      if (result.isError) {\n        const mcpContent = (result.content ?? []) as McpContent[];\n        const content = transformMcpContent(mcpContent);\n        const outputContent = content.length > 0 ? content : [{ type: \"text\" as const, text: \"(empty result)\" }];\n        const schemaText = toolMeta.inputSchema ? `\\n\\nExpected parameters:\\n${formatSchema(toolMeta.inputSchema)}` : \"\";\n        const guarded = await guardMcpOutput(outputContent, { ...outputGuardOptions, prefix: \"Error: \", suffix: schemaText, emptyTextFallback: \"Tool execution failed\", rawMcpResult: result });\n        return {\n          content: guarded.content,\n          details: { mode: \"call\", error: \"tool_error\", ...guardedMcpDetails(guarded) },\n        };\n      }\n\n      const content = resolveMcpResultContent(result as Record<string, unknown>);\n      const outputContent = content.length > 0 ? content : [{ type: \"text\" as const, text: \"(empty result)\" }];\n      const uiMessage = uiSession?.reused\n        ? \"Updated the open UI.\"\n        : \"📺 Interactive UI is now open in your browser. I'll respond to your prompts and intents as you interact with it.\";\n      const guarded = await guardMcpOutput(outputContent, { ...outputGuardOptions, suffix: `\\n\\n${uiMessage}`, rawMcpResult: result });\n      return {\n        content: guarded.content,\n        details: { mode: \"call\", ...guardedMcpDetails(guarded), server: serverName, tool: toolMeta.originalName, uiOpen: true },\n      };\n    }\n\n    const result = await abortable(resultPromise, signal);\n\n    if (result.isError) {\n      const mcpContent = (result.content ?? []) as McpContent[];\n      const content = transformMcpContent(mcpContent);\n      const outputContent = content.length > 0 ? content : [{ type: \"text\" as const, text: \"(empty result)\" }];\n      const schemaText = toolMeta.inputSchema ? `\\n\\nExpected parameters:\\n${formatSchema(toolMeta.inputSchema)}` : \"\";\n      const guarded = await guardMcpOutput(outputContent, { ...outputGuardOptions, prefix: \"Error: \", suffix: schemaText, emptyTextFallback: \"Tool execution failed\", rawMcpResult: result });\n      return {\n        content: guarded.content,\n        details: { mode: \"call\", error: \"tool_error\", ...guardedMcpDetails(guarded) },\n      };\n    }\n\n    const content = resolveMcpResultContent(result as Record<string, unknown>);\n    const outputContent = content.length > 0 ? content : [{ type: \"text\" as const, text: \"(empty result)\" }];\n    const guarded = await guardMcpOutput(outputContent, { ...outputGuardOptions, rawMcpResult: result });\n    return {\n      content: guarded.content,\n      details: { mode: \"call\", ...guardedMcpDetails(guarded), server: serverName, tool: toolMeta.originalName },\n    };\n  } catch (error) {\n    if (error instanceof UrlElicitationRequiredError) {\n      const action = await state.manager.handleUrlElicitationRequired(serverName, error);\n      const message = action === \"accept\"\n        ? \"The original MCP tool did not run. Complete the opened browser interaction, then retry the tool.\"\n        : `The URL interaction was ${action === \"decline\" ? \"declined\" : \"cancelled\"}.`;\n      uiSession?.sendToolCancelled(message);\n      return {\n        content: [{ type: \"text\" as const, text: message }],\n        details: { mode: \"call\", error: \"url_elicitation_required\", server: serverName, action },\n      };\n    }\n    const message = error instanceof Error ? error.message : String(error);\n    uiSession?.sendToolCancelled(message);\n\n    const schemaText = toolMeta.inputSchema ? `\\n\\nExpected parameters:\\n${formatSchema(toolMeta.inputSchema)}` : \"\";\n    const guarded = await guardMcpOutput([{ type: \"text\" as const, text: message }], { ...outputGuardOptions, prefix: \"Failed to call tool: \", suffix: schemaText });\n\n    return {\n      content: guarded.content,\n      details: { mode: \"call\", error: \"call_failed\", message: guarded.outputGuard ? \"output truncated; see outputGuard.fullOutputPath\" : message, ...guardedMcpDetails(guarded) },\n    };\n  } finally {\n    if (uiSession?.reused) {\n      uiSession.close();\n    }\n    state.manager.decrementInFlight(serverName);\n    state.manager.touch(serverName);\n  }\n}\n"]}
+{"version":3,"file":"proxy-modes.d.ts","sourceRoot":"","sources":["../../../src/builtin-extensions/pi-mcp-adapter/proxy-modes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAGjF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAYpD,KAAK,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAmGhE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,CA4E3E;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,CAsDvE;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAoC7G;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CA+B/H;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,CAuC3F;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,iBAAiB,EACxB,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,OAAO,EACf,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,OAAO,GACvB,eAAe,CAwGjB;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,CAqDrF;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,CAqDjI;AAED,wBAAsB,WAAW,CAC/B,KAAK,EAAE,iBAAiB,EACxB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,cAAc,CAAC,EAAE,MAAM,EACvB,UAAU,CAAC,EAAE,MAAM,QAAQ,EAAE,EAC7B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,eAAe,CAAC,CAyW1B","sourcesContent":["// @ts-nocheck\nimport type { AgentToolResult, ToolInfo } from \"@ashx-j/lunr\";\nimport { UrlElicitationRequiredError } from \"@modelcontextprotocol/sdk/types.js\";\nimport { checkSync } from \"recheck\";\nimport type { McpExtensionState } from \"./state.ts\";\nimport type { ToolMetadata, McpContent } from \"./types.ts\";\nimport { getServerPrefix, parseUiPromptHandoff } from \"./types.ts\";\nimport { lazyConnect, updateServerMetadata, updateMetadataCache, getFailureAgeSeconds, updateStatusBar } from \"./init.ts\";\nimport { abortable, throwIfAborted } from \"./abort.ts\";\nimport { buildToolMetadata, getToolNames, findToolByName, formatSchema } from \"./tool-metadata.ts\";\nimport { resolveMcpResultContent, transformMcpContent } from \"./tool-registrar.ts\";\nimport { guardMcpOutput, guardedMcpDetails, resolveMcpOutputGuardOptions } from \"./mcp-output-guard.ts\";\nimport { maybeStartUiSession, type UiSessionRuntime } from \"./ui-session.ts\";\nimport { formatAuthRequiredMessage, truncateAtWord } from \"./utils.ts\";\nimport { supportsOAuth } from \"./mcp-auth-flow.ts\";\n\ntype ProxyToolResult = AgentToolResult<Record<string, unknown>>;\n\nconst MAX_REGEX_SEARCH_QUERY_LENGTH = 256;\nconst REGEX_SAFETY_CHECK_PARAMS = {\n  attackTimeout: 50,\n  incubationTimeout: 50,\n  timeout: 250,\n} as const;\n\ntype AutoAuthResult =\n  | { status: \"skipped\" }\n  | { status: \"success\" }\n  | { status: \"failed\"; message: string };\n\nfunction getAuthRequiredMessage(\n  state: McpExtensionState,\n  serverName: string,\n  defaultMessage = `Server \"${serverName}\" requires OAuth authentication. Run mcp({ action: \"auth-start\", server: \"${serverName}\" }) to get a browser URL, or /mcp-auth ${serverName} in an interactive local session.`,\n): string {\n  return formatAuthRequiredMessage(state.config, serverName, defaultMessage);\n}\n\nfunction getAuthFailedMessage(state: McpExtensionState, serverName: string, message: string): string {\n  const customGuidance = state.config.settings?.authRequiredMessage;\n  if (customGuidance) {\n    return `OAuth authentication failed for \"${serverName}\": ${message}. ${getAuthRequiredMessage(state, serverName)}`;\n  }\n  return `OAuth authentication failed for \"${serverName}\": ${message}. Run mcp({ action: \"auth-start\", server: \"${serverName}\" }) to get a browser URL, or /mcp-auth ${serverName} in an interactive local session.`;\n}\n\nfunction getRedirectPort(authorizationUrl: string): number | undefined {\n  try {\n    const redirectUri = new URL(authorizationUrl).searchParams.get(\"redirect_uri\");\n    if (!redirectUri) return undefined;\n    const port = Number.parseInt(new URL(redirectUri).port, 10);\n    return Number.isInteger(port) ? port : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction formatManualAuthInstructions(serverName: string, authorizationUrl: string): string {\n  const port = getRedirectPort(authorizationUrl);\n  const portNote = port\n    ? `\\nThe redirect URL will use local port ${port}. On a remote server it is expected for that localhost page to fail locally; copy the address bar URL anyway.`\n    : \"\";\n\n  return [\n    `MCP OAuth required for \"${serverName}\".`,\n    \"\",\n    \"Open this URL in your local browser:\",\n    \"\",\n    authorizationUrl,\n    \"\",\n    \"After approving, copy the full redirected localhost URL from your browser address bar and send it back with:\",\n    `mcp({ action: \"auth-complete\", server: \"${serverName}\", args: '{\"redirectUrl\":\"PASTE_REDIRECT_URL_HERE\"}' })`,\n    \"\",\n    \"You can also pass just the `code` query parameter as `args: '{\\\"code\\\":\\\"PASTE_CODE_HERE\\\"}'`.\",\n    portNote.trimEnd(),\n  ].filter(Boolean).join(\"\\n\");\n}\n\nasync function attemptAutoAuth(\n  state: McpExtensionState,\n  serverName: string,\n): Promise<AutoAuthResult> {\n  if (state.config.settings?.autoAuth !== true) {\n    return { status: \"skipped\" };\n  }\n\n  const definition = state.config.mcpServers[serverName];\n  if (!definition || !supportsOAuth(definition) || !definition.url) {\n    return { status: \"skipped\" };\n  }\n\n  const grantType = definition.oauth ? definition.oauth.grantType ?? \"authorization_code\" : \"authorization_code\";\n  if (!state.ui && grantType !== \"client_credentials\") {\n    return {\n      status: \"failed\",\n      message: getAuthRequiredMessage(\n        state,\n        serverName,\n        `Server \"${serverName}\" requires OAuth authentication. Run mcp({ action: \"auth-start\", server: \"${serverName}\" }) to get a browser URL, or /mcp-auth ${serverName} in an interactive local session.`,\n      ),\n    };\n  }\n\n  try {\n    await state.authFlow.authenticate(serverName, definition.url, definition);\n    return { status: \"success\" };\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    return {\n      status: \"failed\",\n      message: getAuthFailedMessage(state, serverName, message),\n    };\n  }\n}\n\nexport function executeUiMessages(state: McpExtensionState): ProxyToolResult {\n  const sessions = state.completedUiSessions;\n\n  if (sessions.length === 0) {\n    return {\n      content: [{ type: \"text\" as const, text: \"No UI session messages available.\" }],\n      details: { sessions: 0 },\n    };\n  }\n\n  const output: string[] = [];\n  output.push(`UI Session Messages (${sessions.length} session${sessions.length > 1 ? \"s\" : \"\"}):\\n`);\n\n  const allPrompts: string[] = [];\n  const allIntents = sessions.flatMap((session) => session.messages.intents);\n  const parsedHandoffs: Array<{ intent: string; params: Record<string, unknown>; raw: string }> = [];\n\n  for (const session of sessions) {\n    const timestamp = session.completedAt.toLocaleTimeString();\n    output.push(`\\n## ${session.serverName} / ${session.toolName} (${timestamp}, ${session.reason})`);\n\n    const plainPrompts: string[] = [];\n    for (const prompt of session.messages.prompts) {\n      allPrompts.push(prompt);\n      const handoff = parseUiPromptHandoff(prompt);\n      if (handoff) {\n        parsedHandoffs.push(handoff);\n      } else {\n        plainPrompts.push(prompt);\n      }\n    }\n\n    if (plainPrompts.length > 0) {\n      output.push(\"\\n### Prompts:\");\n      for (const prompt of plainPrompts) {\n        output.push(`- ${prompt}`);\n      }\n    }\n\n    const intentsForSession = [\n      ...session.messages.intents,\n      ...session.messages.prompts\n        .map((prompt) => parseUiPromptHandoff(prompt))\n        .filter((handoff): handoff is NonNullable<typeof handoff> => !!handoff)\n        .map((handoff) => ({ intent: handoff.intent, params: handoff.params })),\n    ];\n\n    if (intentsForSession.length > 0) {\n      output.push(\"\\n### Intents:\");\n      for (const intent of intentsForSession) {\n        const params = intent.params ? ` (${JSON.stringify(intent.params)})` : \"\";\n        output.push(`- ${intent.intent}${params}`);\n      }\n    }\n\n    if (session.messages.notifications.length > 0) {\n      output.push(\"\\n### Notifications:\");\n      for (const notification of session.messages.notifications) {\n        output.push(`- ${notification}`);\n      }\n    }\n  }\n\n  const count = sessions.length;\n  state.completedUiSessions = [];\n\n  return {\n    content: [{ type: \"text\" as const, text: output.join(\"\\n\") }],\n    details: {\n      sessions: count,\n      prompts: allPrompts,\n      intents: [...allIntents, ...parsedHandoffs.map(({ intent, params }) => ({ intent, params }))],\n      handoffs: parsedHandoffs,\n      cleared: true,\n    },\n  };\n}\n\nexport function executeStatus(state: McpExtensionState): ProxyToolResult {\n  const servers: Array<{ name: string; status: string; toolCount: number; failedAgo: number | null }> = [];\n\n  for (const name of Object.keys(state.config.mcpServers)) {\n    const connection = state.manager.getConnection(name);\n    const metadata = state.toolMetadata.get(name);\n    const toolCount = metadata?.length ?? 0;\n    const failedAgo = getFailureAgeSeconds(state, name);\n    let status = \"not connected\";\n    if (connection?.status === \"connected\") {\n      status = \"connected\";\n    } else if (connection?.status === \"needs-auth\") {\n      status = \"needs-auth\";\n    } else if (failedAgo !== null) {\n      status = \"failed\";\n    } else if (metadata !== undefined) {\n      status = \"cached\";\n    }\n\n    servers.push({ name, status, toolCount, failedAgo });\n  }\n\n  const totalTools = servers.reduce((sum, s) => sum + s.toolCount, 0);\n  const connectedCount = servers.filter(s => s.status === \"connected\").length;\n\n  let text = `MCP: ${connectedCount}/${servers.length} servers, ${totalTools} tools\\n\\n`;\n  for (const server of servers) {\n    if (server.status === \"connected\") {\n      text += `✓ ${server.name} (${server.toolCount} tools)\\n`;\n      continue;\n    }\n    if (server.status === \"needs-auth\") {\n      text += `⚠ ${server.name} (needs auth)\\n`;\n      continue;\n    }\n    if (server.status === \"cached\") {\n      text += `○ ${server.name} (${server.toolCount} tools, cached)\\n`;\n      continue;\n    }\n    if (server.status === \"failed\") {\n      text += `✗ ${server.name} (failed ${server.failedAgo ?? 0}s ago)\\n`;\n      continue;\n    }\n    text += `○ ${server.name} (not connected)\\n`;\n  }\n\n  if (servers.length > 0) {\n    text += `\\nmcp({ server: \"name\" }) to list tools, mcp({ search: \"...\" }) to search`;\n  }\n\n  return {\n    content: [{ type: \"text\" as const, text: text.trim() }],\n    details: { mode: \"status\", servers, totalTools, connectedCount },\n  };\n}\n\nexport async function executeAuthStart(state: McpExtensionState, serverName: string): Promise<ProxyToolResult> {\n  const definition = state.config.mcpServers[serverName];\n  if (!definition) {\n    return {\n      content: [{ type: \"text\" as const, text: `Server \"${serverName}\" not found. Use mcp({}) to see available servers.` }],\n      details: { mode: \"auth-start\", error: \"not_found\", server: serverName },\n    };\n  }\n\n  if (!definition.url || !supportsOAuth(definition)) {\n    return {\n      content: [{ type: \"text\" as const, text: `Server \"${serverName}\" is not configured for OAuth over HTTP.` }],\n      details: { mode: \"auth-start\", error: \"oauth_not_supported\", server: serverName },\n    };\n  }\n\n  try {\n    const { authorizationUrl } = await state.authFlow.startAuth(serverName, definition.url, definition);\n    if (!authorizationUrl) {\n      return {\n        content: [{ type: \"text\" as const, text: `OAuth authentication successful for \"${serverName}\".` }],\n        details: { mode: \"auth-start\", server: serverName, authenticated: true },\n      };\n    }\n\n    return {\n      content: [{ type: \"text\" as const, text: formatManualAuthInstructions(serverName, authorizationUrl) }],\n      details: { mode: \"auth-start\", server: serverName, authorizationUrl },\n    };\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    return {\n      content: [{ type: \"text\" as const, text: `Failed to start OAuth for \"${serverName}\": ${message}` }],\n      details: { mode: \"auth-start\", error: \"auth_start_failed\", server: serverName, message },\n    };\n  }\n}\n\nexport async function executeAuthComplete(state: McpExtensionState, serverName: string, input: string): Promise<ProxyToolResult> {\n  if (!state.config.mcpServers[serverName]) {\n    return {\n      content: [{ type: \"text\" as const, text: `Server \"${serverName}\" not found. Use mcp({}) to see available servers.` }],\n      details: { mode: \"auth-complete\", error: \"not_found\", server: serverName },\n    };\n  }\n\n  try {\n    const status = await state.authFlow.completeAuthFromInput(serverName, input);\n    if (status !== \"authenticated\") {\n      return {\n        content: [{ type: \"text\" as const, text: `OAuth authentication did not complete for \"${serverName}\".` }],\n        details: { mode: \"auth-complete\", error: \"not_authenticated\", server: serverName, status },\n      };\n    }\n\n    await state.manager.close(serverName);\n    state.failureTracker.delete(serverName);\n    updateStatusBar(state);\n    return {\n      content: [{ type: \"text\" as const, text: `OAuth authentication successful for \"${serverName}\". Run mcp({ connect: \"${serverName}\" }) to connect with the new token.` }],\n      details: { mode: \"auth-complete\", server: serverName, authenticated: true },\n    };\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    return {\n      content: [{ type: \"text\" as const, text: `Failed to complete OAuth for \"${serverName}\": ${message}` }],\n      details: { mode: \"auth-complete\", error: \"auth_complete_failed\", server: serverName, message },\n    };\n  }\n}\n\nexport function executeDescribe(state: McpExtensionState, toolName: string): ProxyToolResult {\n  let serverName: string | undefined;\n  let toolMeta: ToolMetadata | undefined;\n\n  for (const [server, metadata] of state.toolMetadata.entries()) {\n    const found = findToolByName(metadata, toolName);\n    if (found) {\n      serverName = server;\n      toolMeta = found;\n      break;\n    }\n  }\n\n  if (!serverName || !toolMeta) {\n    return {\n      content: [{ type: \"text\" as const, text: `Tool \"${toolName}\" not found. Use mcp({ search: \"...\" }) to search.` }],\n      details: { mode: \"describe\", error: \"tool_not_found\", requestedTool: toolName },\n    };\n  }\n\n  let text = `${toolMeta.name}\\n`;\n  text += `Server: ${serverName}\\n`;\n  if (toolMeta.resourceUri) {\n    text += `Type: Resource (reads from ${toolMeta.resourceUri})\\n`;\n  }\n  text += `\\n${toolMeta.description || \"(no description)\"}\\n`;\n\n  if (toolMeta.inputSchema && !toolMeta.resourceUri) {\n    text += `\\nParameters:\\n${formatSchema(toolMeta.inputSchema)}`;\n  } else if (toolMeta.resourceUri) {\n    text += `\\nNo parameters required (resource tool).`;\n  } else {\n    text += `\\nNo parameters defined.`;\n  }\n\n  return {\n    content: [{ type: \"text\" as const, text: text.trim() }],\n    details: { mode: \"describe\", tool: toolMeta, server: serverName },\n  };\n}\n\nexport function executeSearch(\n  state: McpExtensionState,\n  query: string,\n  regex?: boolean,\n  server?: string,\n  includeSchemas?: boolean,\n): ProxyToolResult {\n  const showSchemas = includeSchemas !== false;\n\n  const matches: Array<{ server: string; tool: ToolMetadata }> = [];\n\n  let pattern: RegExp;\n  try {\n    if (regex) {\n      if (query.length > MAX_REGEX_SEARCH_QUERY_LENGTH) {\n        return {\n          content: [{ type: \"text\" as const, text: `Regex query is too long; maximum length is ${MAX_REGEX_SEARCH_QUERY_LENGTH} characters.` }],\n          details: { mode: \"search\", error: \"query_too_long\", query, maxLength: MAX_REGEX_SEARCH_QUERY_LENGTH },\n        };\n      }\n\n      pattern = new RegExp(query, \"i\");\n      let safety;\n      try {\n        safety = checkSync(query, \"i\", REGEX_SAFETY_CHECK_PARAMS);\n      } catch (error) {\n        const message = error instanceof Error ? error.message : String(error);\n        return {\n          content: [{ type: \"text\" as const, text: \"Regex query rejected because safety analysis failed.\" }],\n          details: { mode: \"search\", error: \"unsafe_pattern\", query, reason: message },\n        };\n      }\n      if (safety.status !== \"safe\") {\n        return {\n          content: [{ type: \"text\" as const, text: `Regex query rejected as unsafe (${safety.status}).` }],\n          details: { mode: \"search\", error: \"unsafe_pattern\", query, safetyStatus: safety.status },\n        };\n      }\n    } else {\n      const terms = query.trim().split(/\\s+/).filter(t => t.length > 0);\n      if (terms.length === 0) {\n        return {\n          content: [{ type: \"text\" as const, text: \"Search query cannot be empty\" }],\n          details: { mode: \"search\", error: \"empty_query\" },\n        };\n      }\n      const escaped = terms.map(t => t.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\"));\n      pattern = new RegExp(escaped.join(\"|\"), \"i\");\n    }\n  } catch {\n    return {\n      content: [{ type: \"text\" as const, text: `Invalid regex: ${query}` }],\n      details: { mode: \"search\", error: \"invalid_pattern\", query },\n    };\n  }\n\n  for (const [serverName, metadata] of state.toolMetadata.entries()) {\n    if (server && serverName !== server) continue;\n    for (const tool of metadata) {\n      if (pattern.test(tool.name) || pattern.test(tool.description)) {\n        matches.push({\n          server: serverName,\n          tool,\n        });\n      }\n    }\n  }\n\n  const totalCount = matches.length;\n\n  if (totalCount === 0) {\n    const msg = server\n      ? `No tools matching \"${query}\" in \"${server}\"`\n      : `No tools matching \"${query}\"`;\n    return {\n      content: [{ type: \"text\" as const, text: msg }],\n      details: { mode: \"search\", matches: [], count: 0, query },\n    };\n  }\n\n  let text = `Found ${totalCount} tool${totalCount === 1 ? \"\" : \"s\"} matching \"${query}\":\\n\\n`;\n\n  for (const match of matches) {\n    if (showSchemas) {\n      text += `${match.tool.name}\\n`;\n      text += `  ${match.tool.description || \"(no description)\"}\\n`;\n      if (match.tool.inputSchema && !match.tool.resourceUri) {\n        text += `\\n  Parameters:\\n${formatSchema(match.tool.inputSchema, \"    \")}\\n`;\n      } else if (match.tool.resourceUri) {\n        text += `  No parameters (resource tool).\\n`;\n      }\n      text += \"\\n\";\n    } else {\n      text += `- ${match.tool.name}`;\n      if (match.tool.description) {\n        text += ` - ${truncateAtWord(match.tool.description, 50)}`;\n      }\n      text += \"\\n\";\n    }\n  }\n\n  return {\n    content: [{ type: \"text\" as const, text: text.trim() }],\n    details: {\n      mode: \"search\",\n      matches: matches.map(m => ({ server: m.server, tool: m.tool.name })),\n      count: totalCount,\n      query,\n    },\n  };\n}\n\nexport function executeList(state: McpExtensionState, server: string): ProxyToolResult {\n  if (!state.config.mcpServers[server]) {\n    return {\n      content: [{ type: \"text\" as const, text: `Server \"${server}\" not found. Use mcp({}) to see available servers.` }],\n      details: { mode: \"list\", server, tools: [], count: 0, error: \"not_found\" },\n    };\n  }\n\n  const metadata = state.toolMetadata.get(server);\n  const toolNames = metadata?.map(m => m.name) ?? [];\n  const connection = state.manager.getConnection(server);\n\n  if (toolNames.length === 0) {\n    if (connection?.status === \"connected\") {\n      return {\n        content: [{ type: \"text\" as const, text: `Server \"${server}\" has no tools.` }],\n        details: { mode: \"list\", server, tools: [], count: 0 },\n      };\n    }\n    if (metadata !== undefined) {\n      return {\n        content: [{ type: \"text\" as const, text: `Server \"${server}\" has no cached tools (not connected).` }],\n        details: { mode: \"list\", server, tools: [], count: 0, cached: true },\n      };\n    }\n    return {\n      content: [{ type: \"text\" as const, text: `Server \"${server}\" is configured but not connected. Use mcp({ connect: \"${server}\" }) or /mcp reconnect ${server} to retry.` }],\n      details: { mode: \"list\", server, tools: [], count: 0, error: \"not_connected\" },\n    };\n  }\n\n  const cachedNote = connection?.status === \"connected\" ? \"\" : \" (not connected, cached)\";\n  let text = `${server} (${toolNames.length} tools${cachedNote}):\\n\\n`;\n\n  const descMap = new Map<string, string>();\n  if (metadata) {\n    for (const m of metadata) {\n      descMap.set(m.name, m.description);\n    }\n  }\n\n  for (const tool of toolNames) {\n    const desc = descMap.get(tool) ?? \"\";\n    const truncated = truncateAtWord(desc, 50);\n    text += `- ${tool}`;\n    if (truncated) text += ` - ${truncated}`;\n    text += \"\\n\";\n  }\n\n  return {\n    content: [{ type: \"text\" as const, text: text.trim() }],\n    details: { mode: \"list\", server, tools: toolNames, count: toolNames.length },\n  };\n}\n\nexport async function executeConnect(state: McpExtensionState, serverName: string, signal?: AbortSignal): Promise<ProxyToolResult> {\n  throwIfAborted(signal);\n  const definition = state.config.mcpServers[serverName];\n  if (!definition) {\n    return {\n      content: [{ type: \"text\" as const, text: `Server \"${serverName}\" not found. Use mcp({}) to see available servers.` }],\n      details: { mode: \"connect\", error: \"not_found\", server: serverName },\n    };\n  }\n\n  try {\n    if (state.ui) {\n      state.ui.setStatus(\"mcp\", `MCP: connecting to ${serverName}...`);\n    }\n    let connection = await state.manager.connect(serverName, definition, signal);\n    if (connection.status === \"needs-auth\") {\n      const autoAuth = await attemptAutoAuth(state, serverName);\n      if (autoAuth.status === \"failed\") {\n        return {\n          content: [{ type: \"text\" as const, text: autoAuth.message }],\n          details: { mode: \"connect\", error: \"auth_required\", server: serverName, message: autoAuth.message },\n        };\n      }\n      if (autoAuth.status === \"success\") {\n        await state.manager.close(serverName);\n        connection = await state.manager.connect(serverName, definition, signal);\n      }\n      if (connection.status === \"needs-auth\") {\n        const message = getAuthRequiredMessage(state, serverName);\n        return {\n          content: [{ type: \"text\" as const, text: message }],\n          details: { mode: \"connect\", error: \"auth_required\", server: serverName, message },\n        };\n      }\n    }\n    const prefix = state.config.settings?.toolPrefix ?? \"server\";\n    const { metadata } = buildToolMetadata(connection.tools, connection.resources, definition, serverName, prefix);\n    state.toolMetadata.set(serverName, metadata);\n    updateMetadataCache(state, serverName);\n    state.failureTracker.delete(serverName);\n    updateStatusBar(state);\n    return executeList(state, serverName);\n  } catch (error) {\n    if (!signal?.aborted) {\n      state.failureTracker.set(serverName, Date.now());\n    }\n    updateStatusBar(state);\n    const message = error instanceof Error ? error.message : String(error);\n    return {\n      content: [{ type: \"text\" as const, text: `Failed to connect to \"${serverName}\": ${message}` }],\n      details: { mode: \"connect\", error: signal?.aborted ? \"aborted\" : \"connect_failed\", server: serverName, message },\n    };\n  }\n}\n\nexport async function executeCall(\n  state: McpExtensionState,\n  toolName: string,\n  args?: Record<string, unknown>,\n  serverOverride?: string,\n  getPiTools?: () => ToolInfo[],\n  signal?: AbortSignal,\n): Promise<ProxyToolResult> {\n  throwIfAborted(signal);\n  let serverName: string | undefined = serverOverride;\n  let toolMeta: ToolMetadata | undefined;\n  let autoAuthAttempted = false;\n  const prefixMode = state.config.settings?.toolPrefix ?? \"server\";\n\n  if (serverName && !state.config.mcpServers[serverName]) {\n    return {\n      content: [{ type: \"text\" as const, text: `Server \"${serverName}\" not found. Use mcp({}) to see available servers.` }],\n      details: { mode: \"call\", error: \"server_not_found\", server: serverName },\n    };\n  }\n\n  if (serverName) {\n    toolMeta = findToolByName(state.toolMetadata.get(serverName), toolName);\n  } else {\n    for (const [server, metadata] of state.toolMetadata.entries()) {\n      const found = findToolByName(metadata, toolName);\n      if (found) {\n        serverName = server;\n        toolMeta = found;\n        break;\n      }\n    }\n  }\n\n  if (serverName && !toolMeta) {\n    const connected = await lazyConnect(state, serverName, signal);\n    if (connected) {\n      toolMeta = findToolByName(state.toolMetadata.get(serverName), toolName);\n    } else {\n      const needsAuthConnection = state.manager.getConnection(serverName);\n      if (needsAuthConnection?.status === \"needs-auth\") {\n        if (!autoAuthAttempted) {\n          autoAuthAttempted = true;\n          const autoAuth = await attemptAutoAuth(state, serverName);\n          if (autoAuth.status === \"failed\") {\n            return {\n              content: [{ type: \"text\" as const, text: autoAuth.message }],\n              details: { mode: \"call\", error: \"auth_required\", server: serverName, message: autoAuth.message },\n            };\n          }\n          if (autoAuth.status === \"success\") {\n            await state.manager.close(serverName);\n            state.failureTracker.delete(serverName);\n            const connectedAfterAuth = await lazyConnect(state, serverName, signal);\n            if (connectedAfterAuth) {\n              toolMeta = findToolByName(state.toolMetadata.get(serverName), toolName);\n              if (!toolMeta) {\n                return {\n                  content: [{ type: \"text\" as const, text: `Tool \"${toolName}\" not found on \"${serverName}\" after reconnect.` }],\n                  details: { mode: \"call\", error: \"tool_not_found_after_reconnect\", requestedTool: toolName },\n                };\n              }\n            }\n          }\n        }\n\n        if (!toolMeta && state.manager.getConnection(serverName)?.status === \"needs-auth\") {\n          const message = getAuthRequiredMessage(state, serverName);\n          return {\n            content: [{ type: \"text\" as const, text: message }],\n            details: { mode: \"call\", error: \"auth_required\", server: serverName, message },\n          };\n        }\n      }\n\n      if (!toolMeta) {\n        const failedAgo = getFailureAgeSeconds(state, serverName);\n        if (failedAgo !== null) {\n          return {\n            content: [{ type: \"text\" as const, text: `Server \"${serverName}\" not available (last failed ${failedAgo}s ago)` }],\n            details: { mode: \"call\", error: \"server_backoff\", server: serverName },\n          };\n        }\n      }\n    }\n  }\n\n  let prefixMatchedServer: string | undefined;\n\n  if (!serverName && !toolMeta && prefixMode !== \"none\") {\n    const candidates = Object.keys(state.config.mcpServers)\n      .map(name => ({ name, prefix: getServerPrefix(name, prefixMode) }))\n      .filter(c => c.prefix && toolName.startsWith(c.prefix + \"_\"))\n      .sort((a, b) => b.prefix.length - a.prefix.length);\n\n    for (const { name: configuredServer } of candidates) {\n      const existingConnection = state.manager.getConnection(configuredServer);\n      const failedAgo = getFailureAgeSeconds(state, configuredServer);\n      if (failedAgo !== null && existingConnection?.status !== \"needs-auth\") continue;\n\n      let connected = await lazyConnect(state, configuredServer, signal);\n      if (!connected && state.manager.getConnection(configuredServer)?.status === \"needs-auth\" && !autoAuthAttempted) {\n        autoAuthAttempted = true;\n        const autoAuth = await attemptAutoAuth(state, configuredServer);\n        if (autoAuth.status === \"failed\") {\n          return {\n            content: [{ type: \"text\" as const, text: autoAuth.message }],\n            details: { mode: \"call\", error: \"auth_required\", server: configuredServer, message: autoAuth.message },\n          };\n        }\n        if (autoAuth.status === \"success\") {\n          await state.manager.close(configuredServer);\n          state.failureTracker.delete(configuredServer);\n          connected = await lazyConnect(state, configuredServer, signal);\n        }\n      }\n\n      if (!connected) continue;\n      if (!prefixMatchedServer) prefixMatchedServer = configuredServer;\n      toolMeta = findToolByName(state.toolMetadata.get(configuredServer), toolName);\n      if (toolMeta) {\n        serverName = configuredServer;\n        break;\n      }\n    }\n  }\n\n  if (!serverName || !toolMeta) {\n    const nativeTool = !serverOverride\n      ? getPiTools?.().find((tool) => tool.name === toolName && tool.name !== \"mcp\")\n      : undefined;\n    if (nativeTool) {\n      return {\n        content: [{ type: \"text\" as const, text: `\"${toolName}\" is a native Pi tool. Call ${toolName} directly instead of using mcp({ tool: \"${toolName}\" }).` }],\n        details: { mode: \"call\", error: \"native_tool\", requestedTool: toolName },\n      };\n    }\n\n    const hintServer = serverName ?? prefixMatchedServer;\n    const available = hintServer ? getToolNames(state, hintServer) : [];\n    let msg = `Tool \"${toolName}\" not found.`;\n    if (available.length > 0) {\n      msg += ` Server \"${hintServer}\" has: ${available.join(\", \")}`;\n    } else {\n      msg += ` Use mcp({ search: \"...\" }) to search.`;\n    }\n    return {\n      content: [{ type: \"text\" as const, text: msg }],\n      details: { mode: \"call\", error: \"tool_not_found\", requestedTool: toolName, hintServer },\n    };\n  }\n\n  let connection = state.manager.getConnection(serverName);\n  if (connection?.status === \"needs-auth\") {\n    if (!autoAuthAttempted) {\n      autoAuthAttempted = true;\n      const autoAuth = await attemptAutoAuth(state, serverName);\n      if (autoAuth.status === \"failed\") {\n        return {\n          content: [{ type: \"text\" as const, text: autoAuth.message }],\n          details: { mode: \"call\", error: \"auth_required\", server: serverName, message: autoAuth.message },\n        };\n      }\n      if (autoAuth.status === \"success\") {\n        await state.manager.close(serverName);\n        state.failureTracker.delete(serverName);\n        connection = state.manager.getConnection(serverName);\n      }\n    }\n\n    if (connection?.status === \"needs-auth\") {\n      const message = getAuthRequiredMessage(state, serverName);\n      return {\n        content: [{ type: \"text\" as const, text: message }],\n        details: { mode: \"call\", error: \"auth_required\", server: serverName, message },\n      };\n    }\n  }\n  if (!connection || connection.status !== \"connected\") {\n    const failedAgo = getFailureAgeSeconds(state, serverName);\n    if (failedAgo !== null) {\n      return {\n        content: [{ type: \"text\" as const, text: `Server \"${serverName}\" not available (last failed ${failedAgo}s ago)` }],\n        details: { mode: \"call\", error: \"server_backoff\", server: serverName },\n      };\n    }\n\n    const definition = state.config.mcpServers[serverName];\n    if (!definition) {\n      return {\n        content: [{ type: \"text\" as const, text: `Server \"${serverName}\" not connected` }],\n        details: { mode: \"call\", error: \"server_not_connected\", server: serverName },\n      };\n    }\n\n    try {\n      if (state.ui) {\n        state.ui.setStatus(\"mcp\", `MCP: connecting to ${serverName}...`);\n      }\n      connection = await state.manager.connect(serverName, definition, signal);\n      if (connection.status === \"needs-auth\") {\n        if (!autoAuthAttempted) {\n          autoAuthAttempted = true;\n          const autoAuth = await attemptAutoAuth(state, serverName);\n          if (autoAuth.status === \"failed\") {\n            return {\n              content: [{ type: \"text\" as const, text: autoAuth.message }],\n              details: { mode: \"call\", error: \"auth_required\", server: serverName, message: autoAuth.message },\n            };\n          }\n          if (autoAuth.status === \"success\") {\n            await state.manager.close(serverName);\n            connection = await state.manager.connect(serverName, definition, signal);\n          }\n        }\n\n        if (connection.status === \"needs-auth\") {\n          const message = getAuthRequiredMessage(state, serverName);\n          return {\n            content: [{ type: \"text\" as const, text: message }],\n            details: { mode: \"call\", error: \"auth_required\", server: serverName, message },\n          };\n        }\n      }\n      state.failureTracker.delete(serverName);\n      updateServerMetadata(state, serverName);\n      updateMetadataCache(state, serverName);\n      updateStatusBar(state);\n      toolMeta = findToolByName(state.toolMetadata.get(serverName), toolName);\n      if (!toolMeta) {\n        const available = getToolNames(state, serverName);\n        const hint = available.length > 0\n          ? `Available tools on \"${serverName}\": ${available.join(\", \")}`\n          : `Server \"${serverName}\" has no tools.`;\n        return {\n          content: [{ type: \"text\" as const, text: `Tool \"${toolName}\" not found on \"${serverName}\" after reconnect. ${hint}` }],\n          details: { mode: \"call\", error: \"tool_not_found_after_reconnect\", requestedTool: toolName },\n        };\n      }\n    } catch (error) {\n      if (!signal?.aborted) {\n        state.failureTracker.set(serverName, Date.now());\n      }\n      updateStatusBar(state);\n      const message = error instanceof Error ? error.message : String(error);\n      return {\n        content: [{ type: \"text\" as const, text: `Failed to connect to \"${serverName}\": ${message}` }],\n        details: { mode: \"call\", error: signal?.aborted ? \"aborted\" : \"connect_failed\", message },\n      };\n    }\n  }\n\n  let uiSession: UiSessionRuntime | null = null;\n  const requestOptions = state.manager.getRequestOptions?.(serverName, signal) ?? (signal ? { signal } : undefined);\n\n  const outputGuardOptions = resolveMcpOutputGuardOptions(state.config.settings);\n\n  try {\n    state.manager.touch(serverName);\n    state.manager.incrementInFlight(serverName);\n\n    if (toolMeta.resourceUri) {\n      const result = await connection.client.readResource({ uri: toolMeta.resourceUri }, requestOptions);\n      const content = (result.contents ?? []).map(c => ({\n        type: \"text\" as const,\n        text: \"text\" in c ? c.text : (\"blob\" in c ? `[Binary data: ${(c as { mimeType?: string }).mimeType ?? \"unknown\"}]` : JSON.stringify(c)),\n      }));\n      const guarded = await guardMcpOutput(content.length > 0 ? content : [{ type: \"text\" as const, text: \"(empty resource)\" }], outputGuardOptions);\n      return {\n        content: guarded.content,\n        details: { mode: \"call\", resourceUri: toolMeta.resourceUri, server: serverName, ...guardedMcpDetails(guarded) },\n      };\n    }\n\n    uiSession = toolMeta.uiResourceUri\n      ? await maybeStartUiSession(state, {\n          serverName,\n          toolName: toolMeta.originalName,\n          toolArgs: args ?? {},\n          uiResourceUri: toolMeta.uiResourceUri,\n          streamMode: toolMeta.uiStreamMode,\n        })\n      : null;\n\n    const resultPromise = connection.client.callTool({\n      name: toolMeta.originalName,\n      arguments: args ?? {},\n      _meta: uiSession?.requestMeta,\n    }, undefined, requestOptions);\n\n    if (toolMeta.uiResourceUri) {\n      const result = await abortable(resultPromise, signal);\n      uiSession?.sendToolResult(result as unknown as import(\"@modelcontextprotocol/sdk/types.js\").CallToolResult);\n\n      if (result.isError) {\n        const mcpContent = (result.content ?? []) as McpContent[];\n        const content = transformMcpContent(mcpContent);\n        const outputContent = content.length > 0 ? content : [{ type: \"text\" as const, text: \"(empty result)\" }];\n        const schemaText = toolMeta.inputSchema ? `\\n\\nExpected parameters:\\n${formatSchema(toolMeta.inputSchema)}` : \"\";\n        const guarded = await guardMcpOutput(outputContent, { ...outputGuardOptions, prefix: \"Error: \", suffix: schemaText, emptyTextFallback: \"Tool execution failed\", rawMcpResult: result });\n        return {\n          content: guarded.content,\n          details: { mode: \"call\", error: \"tool_error\", ...guardedMcpDetails(guarded) },\n        };\n      }\n\n      const content = resolveMcpResultContent(result as Record<string, unknown>);\n      const outputContent = content.length > 0 ? content : [{ type: \"text\" as const, text: \"(empty result)\" }];\n      const uiMessage = uiSession?.reused\n        ? \"Updated the open UI.\"\n        : \"📺 Interactive UI is now open in your browser. I'll respond to your prompts and intents as you interact with it.\";\n      const guarded = await guardMcpOutput(outputContent, { ...outputGuardOptions, suffix: `\\n\\n${uiMessage}`, rawMcpResult: result });\n      return {\n        content: guarded.content,\n        details: { mode: \"call\", ...guardedMcpDetails(guarded), server: serverName, tool: toolMeta.originalName, uiOpen: true },\n      };\n    }\n\n    const result = await abortable(resultPromise, signal);\n\n    if (result.isError) {\n      const mcpContent = (result.content ?? []) as McpContent[];\n      const content = transformMcpContent(mcpContent);\n      const outputContent = content.length > 0 ? content : [{ type: \"text\" as const, text: \"(empty result)\" }];\n      const schemaText = toolMeta.inputSchema ? `\\n\\nExpected parameters:\\n${formatSchema(toolMeta.inputSchema)}` : \"\";\n      const guarded = await guardMcpOutput(outputContent, { ...outputGuardOptions, prefix: \"Error: \", suffix: schemaText, emptyTextFallback: \"Tool execution failed\", rawMcpResult: result });\n      return {\n        content: guarded.content,\n        details: { mode: \"call\", error: \"tool_error\", ...guardedMcpDetails(guarded) },\n      };\n    }\n\n    const content = resolveMcpResultContent(result as Record<string, unknown>);\n    const outputContent = content.length > 0 ? content : [{ type: \"text\" as const, text: \"(empty result)\" }];\n    const guarded = await guardMcpOutput(outputContent, { ...outputGuardOptions, rawMcpResult: result });\n    return {\n      content: guarded.content,\n      details: { mode: \"call\", ...guardedMcpDetails(guarded), server: serverName, tool: toolMeta.originalName },\n    };\n  } catch (error) {\n    if (error instanceof UrlElicitationRequiredError) {\n      const action = await state.manager.handleUrlElicitationRequired(serverName, error);\n      const message = action === \"accept\"\n        ? \"The original MCP tool did not run. Complete the opened browser interaction, then retry the tool.\"\n        : `The URL interaction was ${action === \"decline\" ? \"declined\" : \"cancelled\"}.`;\n      uiSession?.sendToolCancelled(message);\n      return {\n        content: [{ type: \"text\" as const, text: message }],\n        details: { mode: \"call\", error: \"url_elicitation_required\", server: serverName, action },\n      };\n    }\n    const message = error instanceof Error ? error.message : String(error);\n    uiSession?.sendToolCancelled(message);\n\n    const schemaText = toolMeta.inputSchema ? `\\n\\nExpected parameters:\\n${formatSchema(toolMeta.inputSchema)}` : \"\";\n    const guarded = await guardMcpOutput([{ type: \"text\" as const, text: message }], { ...outputGuardOptions, prefix: \"Failed to call tool: \", suffix: schemaText });\n\n    return {\n      content: guarded.content,\n      details: { mode: \"call\", error: \"call_failed\", message: guarded.outputGuard ? \"output truncated; see outputGuard.fullOutputPath\" : message, ...guardedMcpDetails(guarded) },\n    };\n  } finally {\n    if (uiSession?.reused) {\n      uiSession.close();\n    }\n    state.manager.decrementInFlight(serverName);\n    state.manager.touch(serverName);\n  }\n}\n"]}