@bastani/atomic 0.9.25-alpha.2 → 0.9.25-alpha.3

package/dist/builtin/mcp/index.bundle.mjs

@@ -210,6 +210,90 @@ var init_state_lease = __esm(() => {
   };
 });
 
+// dist/builtin/mcp/authorization-notice.ts
+import { hyperlink } from "@earendil-works/pi-tui";
+function authorizationNotice(url) {
+  const clickHint = process.platform === "darwin" ? "Cmd+click to open" : "Ctrl+click to open";
+  return `Approve access in your browser. If it did not open, visit:
+${hyperlink(url, url)}
+${hyperlink(clickHint, url)}`;
+}
+var init_authorization_notice = () => {};
+
+// dist/builtin/mcp/provider-auth.ts
+function isProviderAuth(auth) {
+  return typeof auth === "object" && auth !== null && typeof auth.provider === "string";
+}
+function providerAuthShapeError(auth) {
+  if (typeof auth !== "object" || auth === null)
+    return;
+  const provider = auth.provider;
+  return typeof provider === "string" && provider.trim() ? undefined : "auth.provider must be a provider name";
+}
+function providerAuthUrlError(value) {
+  if (!value)
+    return "auth.provider requires a url";
+  try {
+    const url = new URL(value);
+    if (url.protocol === "https:" || url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname))
+      return;
+  } catch {}
+  return URL_REQUIREMENT;
+}
+function providerSignInMessage(serverName, provider) {
+  return `MCP server "${serverName}" requires sign-in. Run /login ${provider} to sign in.`;
+}
+function providerSignInGuidance(definition, serverName) {
+  return isProviderAuth(definition?.auth) ? providerSignInMessage(serverName, definition.auth.provider) : undefined;
+}
+function signInRequired(serverName, provider) {
+  return new McpProviderAuthError(providerSignInMessage(serverName, provider), provider);
+}
+function createProviderAuthFetch(options) {
+  const { serverName, provider, token } = options;
+  const origin = new URL(options.serverUrl).origin;
+  return async (input, init) => {
+    let url = new URL(input);
+    for (let redirects = 0;; redirects++) {
+      if (url.origin !== origin) {
+        throw new McpProviderAuthError(`MCP server "${serverName}" request refused: provider credentials are only sent to the configured server origin.`);
+      }
+      const value = await token?.(provider);
+      if (!value)
+        throw signInRequired(serverName, provider);
+      const headers = new Headers(init?.headers);
+      headers.set("Authorization", `Bearer ${value}`);
+      const response = await (options.fetch ?? globalThis.fetch)(url, { ...init, headers, redirect: "manual" });
+      if (response.status === 401) {
+        await response.body?.cancel().catch(() => {});
+        throw signInRequired(serverName, provider);
+      }
+      const location = response.status >= 300 && response.status < 400 ? response.headers.get("location") : null;
+      if (!location)
+        return response;
+      await response.body?.cancel().catch(() => {});
+      const target = new URL(location, url);
+      const samePreservingRedirect = response.status === 307 || response.status === 308;
+      if (!samePreservingRedirect || target.origin !== origin || redirects >= MAX_SAME_ORIGIN_REDIRECTS) {
+        throw new McpProviderAuthError(`MCP server "${serverName}" redirected the request; provider credentials are not sent across redirects.`);
+      }
+      url = target;
+    }
+  };
+}
+var LOOPBACK_HOSTS, MAX_SAME_ORIGIN_REDIRECTS = 3, URL_REQUIREMENT = "auth.provider requires an https URL, or http on localhost, 127.0.0.1, or [::1]", McpProviderAuthError;
+var init_provider_auth = __esm(() => {
+  LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+  McpProviderAuthError = class McpProviderAuthError extends Error {
+    provider;
+    constructor(message, provider) {
+      super(message);
+      this.provider = provider;
+      this.name = "McpProviderAuthError";
+    }
+  };
+});
+
 // dist/builtin/mcp/agent-dir.ts
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
@@ -6453,10 +6537,141 @@ var init_tool_call_timeout = __esm(() => {
   };
 });
 
+// dist/builtin/mcp/utils.ts
+var exports_utils = {};
+__export(exports_utils, {
+  extractToolUiStreamMode: () => extractToolUiStreamMode,
+  formatAuthRequiredMessage: () => formatAuthRequiredMessage,
+  getConfigPathFromArgv: () => getConfigPathFromArgv,
+  interpolateEnvRecord: () => interpolateEnvRecord,
+  interpolateEnvVars: () => interpolateEnvVars,
+  openPath: () => openPath,
+  openUrl: () => openUrl,
+  parallelLimit: () => parallelLimit,
+  resolveBearerToken: () => resolveBearerToken,
+  resolveConfigPath: () => resolveConfigPath,
+  resolveServerUrl: () => resolveServerUrl,
+  truncateAtWord: () => truncateAtWord,
+  unflattenToolArguments: () => unflattenToolArguments
+});
+import { unflattenArgumentsWithSchema } from "@bastani/atomic";
+import { homedir as homedir2, platform } from "node:os";
+import { join as join2 } from "node:path";
+async function execOpen(pi, target, browser) {
+  const os = platform();
+  if (os === "darwin") {
+    return browser ? pi.exec("open", ["-a", browser, target]) : pi.exec("open", [target]);
+  }
+  if (os === "win32") {
+    return browser ? pi.exec("cmd", ["/c", "start", "", browser, target]) : pi.exec("cmd", ["/c", "start", "", target]);
+  }
+  return browser ? pi.exec(browser, [target]) : pi.exec("xdg-open", [target]);
+}
+async function openUrl(pi, url, browser) {
+  const result = await execOpen(pi, url, browser);
+  if (result.code !== 0) {
+    throw new Error(result.stderr || `Failed to open browser (exit code ${result.code})`);
+  }
+}
+async function openPath(pi, targetPath) {
+  const result = await execOpen(pi, targetPath);
+  if (result.code !== 0) {
+    throw new Error(result.stderr || `Failed to open path (exit code ${result.code})`);
+  }
+}
+async function parallelLimit(items, limit, fn) {
+  const results = [];
+  let index = 0;
+  async function worker() {
+    while (index < items.length) {
+      const i = index++;
+      results[i] = await fn(items[i]);
+    }
+  }
+  const workers = Array(Math.min(limit, items.length)).fill(null).map(() => worker());
+  await Promise.all(workers);
+  return results;
+}
+function getConfigPathFromArgv() {
+  const idx = process.argv.indexOf("--mcp-config");
+  if (idx >= 0 && idx + 1 < process.argv.length) {
+    return process.argv[idx + 1];
+  }
+  return;
+}
+function interpolateEnvVars(value) {
+  return value.replace(/\$\{(\w+)\}/g, (_, name) => process.env[name] ?? "").replace(/\$env:(\w+)/g, (_, name) => process.env[name] ?? "");
+}
+function resolveServerUrl(value) {
+  const resolved = interpolateEnvVars(value);
+  try {
+    const url = new URL(resolved);
+    if (url.protocol === "http:" || url.protocol === "https:")
+      return resolved;
+  } catch {}
+  throw new Error("Invalid MCP server url: expected a non-empty HTTP(S) URL after environment variable interpolation.");
+}
+function interpolateEnvRecord(values) {
+  if (!values)
+    return;
+  const resolved = {};
+  for (const [key, value] of Object.entries(values)) {
+    resolved[key] = interpolateEnvVars(value);
+  }
+  return resolved;
+}
+function resolveConfigPath(value) {
+  if (value === undefined)
+    return;
+  const resolved = interpolateEnvVars(value);
+  if (resolved === "~")
+    return homedir2();
+  if (resolved.startsWith("~/") || resolved.startsWith("~\\")) {
+    return join2(homedir2(), resolved.slice(2));
+  }
+  return resolved;
+}
+function resolveBearerToken(definition) {
+  if (definition.bearerToken !== undefined) {
+    return interpolateEnvVars(definition.bearerToken);
+  }
+  return definition.bearerTokenEnv ? process.env[definition.bearerTokenEnv] : undefined;
+}
+function truncateAtWord(text, target) {
+  if (!text || text.length <= target)
+    return text;
+  const truncated = text.slice(0, target);
+  const lastSpace = truncated.lastIndexOf(" ");
+  if (lastSpace > target * 0.6) {
+    return truncated.slice(0, lastSpace) + "...";
+  }
+  return truncated + "...";
+}
+function formatAuthRequiredMessage(config, serverName, defaultMessage) {
+  const template = config.settings?.authRequiredMessage;
+  return template ? template.replaceAll("${server}", serverName) : defaultMessage;
+}
+function extractToolUiStreamMode(toolMeta) {
+  const uiMeta = toolMeta?.ui;
+  if (!uiMeta || typeof uiMeta !== "object")
+    return;
+  const streamMode = uiMeta["pi-mcp-adapter.streamMode"];
+  if (streamMode === "eager" || streamMode === "stream-first") {
+    return streamMode;
+  }
+  return;
+}
+function unflattenToolArguments(args, inputSchema) {
+  if (args === null || args === undefined)
+    return {};
+  return unflattenArgumentsWithSchema(args, inputSchema);
+}
+var init_utils = () => {};
+
 // dist/builtin/mcp/config.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import { dirname as dirname2, join as join2, resolve as resolve2 } from "node:path";
+import { homedir as homedir3 } from "node:os";
+import { dirname as dirname2, join as join3, resolve as resolve2 } from "node:path";
 import { CONFIG_DIR_NAME as CONFIG_DIR_NAME2, getProjectConfigPaths } from "@bastani/atomic";
 function getPiGlobalConfigPath(overridePath) {
   return overridePath ? resolve2(overridePath) : getAgentPath("mcp.json");
@@ -6472,7 +6687,7 @@ function getProjectPiConfigPaths(cwd = process.cwd()) {
 }
 function getMcpDiscoverySummary(overridePath, cwd = process.cwd()) {
   const sources = getConfigSources(overridePath, cwd).map((source) => {
-    const loaded = readValidatedConfig(source.readPath, `MCP config from ${source.readPath}`);
+    const loaded = readValidatedConfig(source.readPath, `MCP config from ${source.readPath}`, source.scope === "global");
     return {
       id: source.id,
       label: source.label,
@@ -6520,10 +6735,10 @@ function getMcpDiscoverySummary(overridePath, cwd = process.cwd()) {
 function loadMcpConfig(overridePath, cwd = process.cwd(), contributions = []) {
   let config = { mcpServers: validateContributedServers(contributions) };
   for (const source of getConfigSources(overridePath, cwd)) {
-    const loaded = readValidatedConfig(source.readPath, `MCP config from ${source.readPath}`);
+    const loaded = readValidatedConfig(source.readPath, `MCP config from ${source.readPath}`, source.scope === "global");
     if (!loaded)
       continue;
-    config = mergeConfigs(config, expandImports(loaded, cwd));
+    config = mergeConfigs(config, expandImports(loaded, cwd, source.scope === "global"));
   }
   return withoutDisabledServers(config);
 }
@@ -6547,7 +6762,7 @@ function validateContributedServers(contributions) {
   const servers = {};
   for (const contribution of contributions) {
     try {
-      Object.assign(servers, validateMcpServerTimeouts({ [contribution.name]: contribution.config }));
+      Object.assign(servers, validateServerEntries({ [contribution.name]: contribution.config }, contribution.origin === "extension", describeMcpContributionSource(contribution)));
     } catch (error) {
       const reason = error instanceof Error ? error.message : String(error);
       const message = `Ignoring MCP server "${contribution.name}" from ${describeMcpContributionSource(contribution)}: ${reason}`;
@@ -6555,7 +6770,7 @@ function validateContributedServers(contributions) {
         console.warn(message);
     }
   }
-  return servers;
+  return validateServerEntries(servers, true);
 }
 function withoutDisabledServers(config) {
   const enabled = Object.entries(config.mcpServers).filter(([, entry]) => entry.disabled !== true);
@@ -6619,8 +6834,16 @@ function getConfigSources(overridePath, cwd = process.cwd()) {
   return sources;
 }
 function mergeConfigs(base, next) {
+  const servers = { ...base.mcpServers };
+  for (const [name, entry] of Object.entries(next.mcpServers)) {
+    for (const previous of Object.keys(servers)) {
+      if (previous !== name && previous.replace(/-/g, "_") === name.replace(/-/g, "_"))
+        delete servers[previous];
+    }
+    servers[name] = entry;
+  }
   return {
-    mcpServers: { ...base.mcpServers, ...next.mcpServers },
+    mcpServers: servers,
     imports: mergeImports(base.imports, next.imports),
     settings: next.settings ? { ...base.settings, ...next.settings } : base.settings
   };
@@ -6631,7 +6854,7 @@ function mergeImports(left, right) {
     return;
   return [...new Set(merged)];
 }
-function expandImports(config, cwd = process.cwd()) {
+function expandImports(config, cwd = process.cwd(), allowProviderAuth = false) {
   if (!config.imports?.length)
     return config;
   const importedServers = {};
@@ -6641,7 +6864,7 @@ function expandImports(config, cwd = process.cwd()) {
       continue;
     try {
       const imported = JSON.parse(readFileSync2(importPath, "utf-8"));
-      const servers = extractServers(imported, importKind);
+      const servers = extractServers(imported, importKind, allowProviderAuth && importKind !== "vscode");
       for (const [name, definition] of Object.entries(servers)) {
         if (!importedServers[name]) {
           importedServers[name] = definition;
@@ -6673,16 +6896,16 @@ function resolveImportPath(importKind, cwd = process.cwd()) {
 function getImportServerCount(importKind, path) {
   try {
     const raw = JSON.parse(readFileSync2(path, "utf-8"));
-    return Object.keys(extractServers(raw, importKind)).length;
+    return Object.keys(extractServers(raw, importKind, importKind !== "vscode")).length;
   } catch {
     return 0;
   }
 }
-function readValidatedConfig(path, label) {
+function readValidatedConfig(path, label, allowProviderAuth) {
   if (!existsSync2(path))
     return null;
   try {
-    return validateMcpConfig(JSON.parse(readFileSync2(path, "utf-8")));
+    return validateMcpConfig(JSON.parse(readFileSync2(path, "utf-8")), allowProviderAuth);
   } catch (error) {
     if (error instanceof McpTimeoutConfigError)
       throw error;
@@ -6691,7 +6914,7 @@ function readValidatedConfig(path, label) {
     return null;
   }
 }
-function validateMcpConfig(raw) {
+function validateMcpConfig(raw, allowProviderAuth = true) {
   if (!raw || typeof raw !== "object") {
     return { mcpServers: {} };
   }
@@ -6701,12 +6924,47 @@ function validateMcpConfig(raw) {
     return { mcpServers: {} };
   }
   return {
-    mcpServers: validateMcpServerTimeouts(servers),
+    mcpServers: validateServerEntries(servers, allowProviderAuth),
     imports: Array.isArray(obj.imports) ? obj.imports : undefined,
     settings: obj.settings
   };
 }
-function extractServers(config, kind) {
+function serverEntryError(entry, allowProviderAuth) {
+  const oauth = entry?.oauth;
+  if (oauth && oauth.clientName !== undefined && (typeof oauth.clientName !== "string" || !oauth.clientName.trim())) {
+    return "oauth.clientName must be a non-empty string";
+  }
+  const auth = entry?.auth;
+  if (typeof auth !== "object" || auth === null)
+    return;
+  return providerAuthShapeError(auth) ?? (allowProviderAuth ? undefined : "auth.provider is only allowed in the global mcp.json and from extensions") ?? providerAuthUrlError(typeof entry?.url === "string" ? interpolateEnvVars(entry.url) : undefined);
+}
+function validateServerEntries(servers, allowProviderAuth, origin) {
+  const candidates = {};
+  for (const [name, entry] of Object.entries(servers)) {
+    const reason = serverEntryError(entry, allowProviderAuth);
+    if (reason) {
+      if (!reportOwnedMcpLog("warn")) {
+        console.warn(`Ignoring MCP server "${name}"${origin ? ` from ${origin}` : ""}: ${reason}`);
+      }
+      continue;
+    }
+    candidates[name] = entry;
+  }
+  const validated = validateMcpServerTimeouts(candidates);
+  const accepted = {};
+  for (const [name, entry] of Object.entries(validated)) {
+    const clash = Object.keys(accepted).find((other) => other !== name && other.replace(/-/g, "_") === name.replace(/-/g, "_"));
+    if (clash) {
+      if (!reportOwnedMcpLog("warn"))
+        console.warn(`MCP server "${name}" conflicts with "${clash}"`);
+      continue;
+    }
+    accepted[name] = entry;
+  }
+  return accepted;
+}
+function extractServers(config, kind, allowProviderAuth) {
   if (!config || typeof config !== "object")
     return {};
   const obj = config;
@@ -6727,7 +6985,7 @@ function extractServers(config, kind) {
   if (!servers || typeof servers !== "object" || Array.isArray(servers)) {
     return {};
   }
-  return validateMcpServerTimeouts(servers);
+  return validateServerEntries(servers, allowProviderAuth);
 }
 function isRepoPromptServer(name, entry) {
   const normalizedName = name.toLowerCase();
@@ -6743,7 +7001,7 @@ function isRepoPromptServer(name, entry) {
 function findProjectRoot(cwd = process.cwd()) {
   let current = resolve2(cwd);
   while (true) {
-    if (existsSync2(join2(current, ".git")) || existsSync2(join2(current, "package.json")) || existsSync2(join2(current, PROJECT_CONFIG_NAME)) || existsSync2(join2(current, CONFIG_DIR_NAME2))) {
+    if (existsSync2(join3(current, ".git")) || existsSync2(join3(current, "package.json")) || existsSync2(join3(current, PROJECT_CONFIG_NAME)) || existsSync2(join3(current, CONFIG_DIR_NAME2))) {
       return current;
     }
     const parent = dirname2(current);
@@ -6763,7 +7021,7 @@ function detectRepoPrompt(summary, cwd = process.cwd()) {
   for (const source of summary.sources) {
     if (source.kind !== "shared" || source.serverCount === 0)
       continue;
-    const config = readValidatedConfig(source.path, `MCP config from ${source.path}`);
+    const config = readValidatedConfig(source.path, `MCP config from ${source.path}`, source.scope === "global");
     if (!config)
       continue;
     for (const [name, entry] of Object.entries(config.mcpServers)) {
@@ -6777,7 +7035,7 @@ function detectRepoPrompt(summary, cwd = process.cwd()) {
     return { configured: false };
   }
   const projectRoot = findProjectRoot(cwd);
-  const targetPath = projectRoot ? join2(projectRoot, PROJECT_CONFIG_NAME) : GENERIC_GLOBAL_CONFIG_PATH;
+  const targetPath = projectRoot ? join3(projectRoot, PROJECT_CONFIG_NAME) : GENERIC_GLOBAL_CONFIG_PATH;
   return {
     configured: false,
     executablePath,
@@ -6853,7 +7111,7 @@ function getServerProvenance(overridePath, cwd = process.cwd(), contributions =
     });
   }
   for (const source of getConfigSources(overridePath, cwd)) {
-    const loaded = readValidatedConfig(source.readPath, `MCP config from ${source.readPath}`);
+    const loaded = readValidatedConfig(source.readPath, `MCP config from ${source.readPath}`, source.scope === "global");
     if (!loaded)
       continue;
     if (loaded.imports?.length) {
@@ -6863,7 +7121,7 @@ function getServerProvenance(overridePath, cwd = process.cwd(), contributions =
           continue;
         try {
           const imported = JSON.parse(readFileSync2(importPath, "utf-8"));
-          const servers = extractServers(imported, importKind);
+          const servers = extractServers(imported, importKind, source.scope === "global" && importKind !== "vscode");
           for (const name of Object.keys(servers)) {
             if (!provenance.has(name) || provenance.get(name)?.kind === "contributed") {
               provenance.set(name, { path: userPath, kind: "import", importKind });
@@ -6916,18 +7174,20 @@ var init_config = __esm(() => {
   init_agent_dir();
   init_config_write_utils();
   init_tool_call_timeout();
-  GENERIC_GLOBAL_CONFIG_PATH = join2(homedir2(), ".config", "mcp", "mcp.json");
+  init_utils();
+  init_provider_auth();
+  GENERIC_GLOBAL_CONFIG_PATH = join3(homedir3(), ".config", "mcp", "mcp.json");
   PROJECT_PI_CONFIG_NAME = `${CONFIG_DIR_NAME2}/mcp.json`;
-  REPOPROMPT_BINARY_CANDIDATES = [join2(homedir2(), "RepoPrompt", "repoprompt_cli"), "/Applications/Repo Prompt.app/Contents/MacOS/repoprompt-mcp"];
+  REPOPROMPT_BINARY_CANDIDATES = [join3(homedir3(), "RepoPrompt", "repoprompt_cli"), "/Applications/Repo Prompt.app/Contents/MacOS/repoprompt-mcp"];
   IMPORT_PATHS = {
     "claude-code": [
-      join2(homedir2(), ".claude", "mcp.json"),
-      join2(homedir2(), ".claude.json"),
-      join2(homedir2(), ".claude", "claude_desktop_config.json")
+      join3(homedir3(), ".claude", "mcp.json"),
+      join3(homedir3(), ".claude.json"),
+      join3(homedir3(), ".claude", "claude_desktop_config.json")
     ],
-    "claude-desktop": [join2(homedir2(), "Library", "Application Support", "Claude", "claude_desktop_config.json")],
-    codex: [join2(homedir2(), ".codex", "config.json")],
-    windsurf: [join2(homedir2(), ".windsurf", "mcp.json")],
+    "claude-desktop": [join3(homedir3(), "Library", "Application Support", "Claude", "claude_desktop_config.json")],
+    codex: [join3(homedir3(), ".codex", "config.json")],
+    windsurf: [join3(homedir3(), ".windsurf", "mcp.json")],
     vscode: [".vscode/mcp.json"]
   };
 });
@@ -9134,20 +9394,25 @@ function getServerPrefix(serverName, mode) {
 }
 function formatToolName(toolName, serverName, prefix) {
   const p = getServerPrefix(serverName, prefix);
-  return p ? `${p}_${toolName}` : toolName;
+  const name = (p ? `${p}_${toolName}` : toolName).replace(/[^A-Za-z0-9_]/g, "_");
+  return /^\d/.test(name) ? `_${name}` : name;
 }
 function normalizeToolName(value) {
   return value.replace(/-/g, "_");
 }
+function legacyToolName(toolName, serverName, prefix) {
+  const p = getServerPrefix(serverName, prefix);
+  return p ? `${p}_${toolName}` : toolName;
+}
 function isToolExcluded(toolName, serverName, prefix, excludeTools) {
   if (!Array.isArray(excludeTools) || excludeTools.length === 0)
     return false;
-  const candidates = new Set([
-    normalizeToolName(toolName),
-    normalizeToolName(formatToolName(toolName, serverName, prefix)),
-    normalizeToolName(formatToolName(toolName, serverName, "server")),
-    normalizeToolName(formatToolName(toolName, serverName, "short"))
-  ]);
+  const modes = new Set([prefix, "server", "short"]);
+  const candidates = new Set([normalizeToolName(toolName)]);
+  for (const mode of modes) {
+    candidates.add(normalizeToolName(formatToolName(toolName, serverName, mode)));
+    candidates.add(normalizeToolName(legacyToolName(toolName, serverName, mode)));
+  }
   for (const excluded of excludeTools) {
     if (typeof excluded !== "string")
       continue;
@@ -9161,6 +9426,27 @@ var init_types2 = __esm(() => {
   init_ui_stream_types();
 });
 
+// dist/builtin/mcp/tool-names.ts
+import { createHash } from "node:crypto";
+function assignToolNames(names, server, prefix) {
+  const unique = [...new Set(names)];
+  const counts = new Map;
+  for (const name of unique) {
+    const plain = formatToolName(name, server, prefix);
+    counts.set(plain, (counts.get(plain) ?? 0) + 1);
+  }
+  return new Map(unique.map((name) => {
+    const plain = formatToolName(name, server, prefix);
+    if (plain.length <= 64 && counts.get(plain) === 1)
+      return [name, plain];
+    const hash = createHash("sha256").update(`${server}\x00${name}`).digest("hex").slice(0, 8);
+    return [name, `${plain.slice(0, 55)}_${hash}`];
+  }));
+}
+var init_tool_names = __esm(() => {
+  init_types2();
+});
+
 // dist/builtin/mcp/resource-tools.ts
 function resourceNameToToolName(name) {
   let result = name.replace(/[^a-zA-Z0-9]/g, "_").replace(/_+/g, "_").replace(/^_+/, "").replace(/_+$/, "").toLowerCase();
@@ -9170,141 +9456,10 @@ function resourceNameToToolName(name) {
   return result;
 }
 
-// dist/builtin/mcp/utils.ts
-var exports_utils = {};
-__export(exports_utils, {
-  extractToolUiStreamMode: () => extractToolUiStreamMode,
-  formatAuthRequiredMessage: () => formatAuthRequiredMessage,
-  getConfigPathFromArgv: () => getConfigPathFromArgv,
-  interpolateEnvRecord: () => interpolateEnvRecord,
-  interpolateEnvVars: () => interpolateEnvVars,
-  openPath: () => openPath,
-  openUrl: () => openUrl,
-  parallelLimit: () => parallelLimit,
-  resolveBearerToken: () => resolveBearerToken,
-  resolveConfigPath: () => resolveConfigPath,
-  resolveServerUrl: () => resolveServerUrl,
-  truncateAtWord: () => truncateAtWord,
-  unflattenToolArguments: () => unflattenToolArguments
-});
-import { unflattenArgumentsWithSchema } from "@bastani/atomic";
-import { homedir as homedir3, platform } from "node:os";
-import { join as join3 } from "node:path";
-async function execOpen(pi, target, browser) {
-  const os = platform();
-  if (os === "darwin") {
-    return browser ? pi.exec("open", ["-a", browser, target]) : pi.exec("open", [target]);
-  }
-  if (os === "win32") {
-    return browser ? pi.exec("cmd", ["/c", "start", "", browser, target]) : pi.exec("cmd", ["/c", "start", "", target]);
-  }
-  return browser ? pi.exec(browser, [target]) : pi.exec("xdg-open", [target]);
-}
-async function openUrl(pi, url, browser) {
-  const result = await execOpen(pi, url, browser);
-  if (result.code !== 0) {
-    throw new Error(result.stderr || `Failed to open browser (exit code ${result.code})`);
-  }
-}
-async function openPath(pi, targetPath) {
-  const result = await execOpen(pi, targetPath);
-  if (result.code !== 0) {
-    throw new Error(result.stderr || `Failed to open path (exit code ${result.code})`);
-  }
-}
-async function parallelLimit(items, limit, fn) {
-  const results = [];
-  let index = 0;
-  async function worker() {
-    while (index < items.length) {
-      const i = index++;
-      results[i] = await fn(items[i]);
-    }
-  }
-  const workers = Array(Math.min(limit, items.length)).fill(null).map(() => worker());
-  await Promise.all(workers);
-  return results;
-}
-function getConfigPathFromArgv() {
-  const idx = process.argv.indexOf("--mcp-config");
-  if (idx >= 0 && idx + 1 < process.argv.length) {
-    return process.argv[idx + 1];
-  }
-  return;
-}
-function interpolateEnvVars(value) {
-  return value.replace(/\$\{(\w+)\}/g, (_, name) => process.env[name] ?? "").replace(/\$env:(\w+)/g, (_, name) => process.env[name] ?? "");
-}
-function resolveServerUrl(value) {
-  const resolved = interpolateEnvVars(value);
-  try {
-    const url = new URL(resolved);
-    if (url.protocol === "http:" || url.protocol === "https:")
-      return resolved;
-  } catch {}
-  throw new Error("Invalid MCP server url: expected a non-empty HTTP(S) URL after environment variable interpolation.");
-}
-function interpolateEnvRecord(values) {
-  if (!values)
-    return;
-  const resolved = {};
-  for (const [key, value] of Object.entries(values)) {
-    resolved[key] = interpolateEnvVars(value);
-  }
-  return resolved;
-}
-function resolveConfigPath(value) {
-  if (value === undefined)
-    return;
-  const resolved = interpolateEnvVars(value);
-  if (resolved === "~")
-    return homedir3();
-  if (resolved.startsWith("~/") || resolved.startsWith("~\\")) {
-    return join3(homedir3(), resolved.slice(2));
-  }
-  return resolved;
-}
-function resolveBearerToken(definition) {
-  if (definition.bearerToken !== undefined) {
-    return interpolateEnvVars(definition.bearerToken);
-  }
-  return definition.bearerTokenEnv ? process.env[definition.bearerTokenEnv] : undefined;
-}
-function truncateAtWord(text, target) {
-  if (!text || text.length <= target)
-    return text;
-  const truncated = text.slice(0, target);
-  const lastSpace = truncated.lastIndexOf(" ");
-  if (lastSpace > target * 0.6) {
-    return truncated.slice(0, lastSpace) + "...";
-  }
-  return truncated + "...";
-}
-function formatAuthRequiredMessage(config, serverName, defaultMessage) {
-  const template = config.settings?.authRequiredMessage;
-  return template ? template.replaceAll("${server}", serverName) : defaultMessage;
-}
-function extractToolUiStreamMode(toolMeta) {
-  const uiMeta = toolMeta?.ui;
-  if (!uiMeta || typeof uiMeta !== "object")
-    return;
-  const streamMode = uiMeta["pi-mcp-adapter.streamMode"];
-  if (streamMode === "eager" || streamMode === "stream-first") {
-    return streamMode;
-  }
-  return;
-}
-function unflattenToolArguments(args, inputSchema) {
-  if (args === null || args === undefined)
-    return {};
-  return unflattenArgumentsWithSchema(args, inputSchema);
-}
-var init_utils = () => {};
-
 // dist/builtin/mcp/metadata-cache.ts
 import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2, renameSync as renameSync2, mkdirSync as mkdirSync2 } from "node:fs";
 import { dirname as dirname3 } from "node:path";
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 function getMetadataCachePath() {
   return getAgentPath("mcp-cache.json");
 }
@@ -9359,7 +9514,7 @@ function computeServerHash(definition) {
     excludeTools: definition.excludeTools
   };
   const normalized = stableStringify(identity);
-  return createHash("sha256").update(normalized).digest("hex");
+  return createHash2("sha256").update(normalized).digest("hex");
 }
 function isServerCacheValid(entry, definition, maxAgeMs = CACHE_MAX_AGE_MS) {
   if (!entry || entry.configHash !== computeServerHash(definition))
@@ -9372,6 +9527,10 @@ function isServerCacheValid(entry, definition, maxAgeMs = CACHE_MAX_AGE_MS) {
 }
 function reconstructToolMetadata(serverName, entry, prefix, definition) {
   const metadata = [];
+  const names = assignToolNames([
+    ...(entry.tools ?? []).filter((tool) => tool?.name).map((tool) => tool.name),
+    ...definition.exposeResources !== false ? (entry.resources ?? []).filter((resource) => resource?.name && resource?.uri).map((resource) => `get_${resourceNameToToolName(resource.name)}`) : []
+  ], serverName, prefix);
   for (const tool of entry.tools ?? []) {
     if (!tool?.name)
       continue;
@@ -9379,7 +9538,7 @@ function reconstructToolMetadata(serverName, entry, prefix, definition) {
       continue;
     }
     metadata.push({
-      name: formatToolName(tool.name, serverName, prefix),
+      name: names.get(tool.name),
       originalName: tool.name,
       description: tool.description ?? "",
       inputSchema: tool.inputSchema,
@@ -9396,7 +9555,7 @@ function reconstructToolMetadata(serverName, entry, prefix, definition) {
         continue;
       }
       metadata.push({
-        name: formatToolName(baseName, serverName, prefix),
+        name: names.get(baseName),
         originalName: baseName,
         description: resource.description ?? `Read resource: ${resource.uri}`,
         resourceUri: resource.uri
@@ -9445,6 +9604,7 @@ var init_metadata_cache = __esm(() => {
   init_agent_dir();
   init_app_bridge();
   init_types2();
+  init_tool_names();
   init_utils();
   CACHE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
 });
@@ -20222,7 +20382,7 @@ class McpOAuthProvider {
   get clientMetadata() {
     if (this.usesClientCredentials) {
       return {
-        client_name: "Pi Coding Agent",
+        client_name: this.config.clientName ?? "atomic",
         redirect_uris: [],
         grant_types: ["client_credentials"],
         token_endpoint_auth_method: this.config.clientSecret ? "client_secret_post" : "none"
@@ -20234,7 +20394,7 @@ class McpOAuthProvider {
     }
     return {
       redirect_uris: [redirectUrl],
-      client_name: "Pi Coding Agent",
+      client_name: this.config.clientName ?? "atomic",
       client_uri: "https://github.com/nicobailon/pi-mcp-adapter",
       grant_types: ["authorization_code", "refresh_token"],
       response_types: ["code"],
@@ -21314,7 +21474,7 @@ function redactDiagnosticText(message, endpoint, preserveSafeUrls = false) {
 }
 function sanitizeRemoteError(error, endpoint) {
   const message = redactDiagnosticText(error instanceof Error ? error.message : String(error), endpoint);
-  const safe = error instanceof UnauthorizedError ? new UnauthorizedError(message) : new Error(message);
+  const safe = error instanceof UnauthorizedError ? new UnauthorizedError(message) : error instanceof McpProviderAuthError ? new McpProviderAuthError(message, error.provider) : new Error(message);
   if (error instanceof Error && "code" in error && typeof error.code === "number") {
     Object.assign(safe, { code: error.code });
   }
@@ -21388,6 +21548,7 @@ function protectRemoteTransport(transport, endpoint) {
 var init_remote_diagnostics = __esm(() => {
   init_auth2();
   init_types();
+  init_provider_auth();
 });
 
 // dist/builtin/mcp/mcp-auth-flow.ts
@@ -21419,7 +21580,8 @@ function extractOAuthConfig(definition) {
     grantType: definition.oauth?.grantType,
     clientId: definition.oauth?.clientId,
     clientSecret: definition.oauth?.clientSecret,
-    scope: definition.oauth?.scope
+    scope: definition.oauth?.scope,
+    clientName: definition.oauth?.clientName
   };
 }
 function assertActive(owner) {
@@ -21537,6 +21699,9 @@ async function performAuthentication(owner, serverUrl, definition) {
   }
   const callbackPromise = waitForCallback(started.oauthState);
   try {
+    owner.authorizationUrl = started.authorizationUrl;
+    for (const listener of owner.authorizationListeners)
+      listener(started.authorizationUrl);
     if (!reportOwnedMcpLog("info"))
       console.log(`MCP Auth: Opening browser for ${serverName}`);
     try {
@@ -21564,11 +21729,17 @@ async function performAuthentication(owner, serverUrl, definition) {
     throw failure;
   }
 }
-function authenticate(serverName, serverUrl, definition) {
+function authenticate(serverName, serverUrl, definition, onAuthorizationUrl) {
   const { pendingAuthentications, oauthCleanupBarrier } = oauthLifecycle();
   const inFlight = pendingAuthentications.get(serverName);
-  if (inFlight)
+  if (inFlight) {
+    if (onAuthorizationUrl) {
+      inFlight.authorizationListeners.add(onAuthorizationUrl);
+      if (inFlight.authorizationUrl)
+        onAuthorizationUrl(inFlight.authorizationUrl);
+    }
     return inFlight.result;
+  }
   let resolve;
   let reject;
   const result = new Promise((resolveResult, rejectResult) => {
@@ -21579,7 +21750,7 @@ function authenticate(serverName, serverUrl, definition) {
   const inheritedCleanup = oauthCleanupBarrier.wait();
   let owner;
   const producer = inheritedCleanup.then(() => performAuthentication(owner, serverUrl, definition));
-  owner = { serverName, controller, result, producer, resolve, reject };
+  owner = { serverName, controller, result, producer, resolve, reject, authorizationListeners: new Set(onAuthorizationUrl ? [onAuthorizationUrl] : []) };
   pendingAuthentications.set(serverName, owner);
   const removeOwner = () => {
     if (pendingAuthentications.get(serverName) === owner)
@@ -21886,9 +22057,13 @@ class McpServerManager {
   connectPromises = new Map;
   uiStreamListeners = new Map;
   samplingConfig;
+  providerToken;
   setSamplingConfig(config) {
     this.samplingConfig = config;
   }
+  setProviderTokenResolver(resolver) {
+    this.providerToken = resolver;
+  }
   async connect(name, definition) {
     if (this.connectPromises.has(name)) {
       return this.connectPromises.get(name);
@@ -21930,7 +22105,23 @@ class McpServerManager {
         stderr: definition.debug ? "inherit" : "ignore"
       });
     } else if (definition.url !== undefined) {
-      transport = await this.createHttpTransport(definition, name);
+      try {
+        transport = await this.createHttpTransport(definition, name);
+      } catch (error) {
+        if (error instanceof McpProviderAuthError && error.provider !== undefined) {
+          return {
+            client,
+            transport: new StreamableHTTPClientTransport(new URL(resolveServerUrl(definition.url))),
+            definition,
+            tools: [],
+            resources: [],
+            lastUsedAt: Date.now(),
+            inFlight: 0,
+            status: "needs-auth"
+          };
+        }
+        throw error;
+      }
     } else {
       throw new Error(`Server ${name} has no command or url`);
     }
@@ -21952,7 +22143,7 @@ class McpServerManager {
         status: "connected"
       };
     } catch (error) {
-      if (error instanceof UnauthorizedError && supportsOAuth(definition)) {
+      if (error instanceof UnauthorizedError && supportsOAuth(definition) || error instanceof McpProviderAuthError && error.provider !== undefined) {
         await client.close().catch(() => {});
         await transport.close().catch(() => {});
         return {
@@ -21995,12 +22186,25 @@ class McpServerManager {
         grantType: definition.oauth?.grantType,
         clientId: definition.oauth?.clientId,
         clientSecret: definition.oauth?.clientSecret,
-        scope: definition.oauth?.scope
+        scope: definition.oauth?.scope,
+        clientName: definition.oauth?.clientName
       };
       authProvider = new McpOAuthProvider(serverName, resolvedUrl, oauthConfig, {
         onRedirect: async (_authUrl) => {}
       });
     }
+    let providerFetch;
+    if (isProviderAuth(definition.auth)) {
+      const urlError = providerAuthUrlError(resolvedUrl);
+      if (urlError)
+        throw new Error(`MCP server "${serverName}": ${urlError}`);
+      providerFetch = createProviderAuthFetch({
+        serverName,
+        provider: definition.auth.provider,
+        serverUrl: resolvedUrl,
+        token: this.providerToken
+      });
+    }
     const protect = (transport) => {
       if (authProvider) {
         const close = transport.close.bind(transport);
@@ -22014,20 +22218,56 @@ class McpServerManager {
     const streamableTransport = protect(new StreamableHTTPClientTransport(url, {
       requestInit,
       authProvider,
-      fetch: authProvider?.fetch
+      fetch: authProvider?.fetch ?? providerFetch
     }));
     try {
       const testClient = new Client({ name: "pi-mcp-probe", version: "2.1.2" });
       await testClient.connect(streamableTransport);
       await testClient.close().catch(() => {});
       await streamableTransport.close().catch(() => {});
-      return protect(new StreamableHTTPClientTransport(url, { requestInit, authProvider, fetch: authProvider?.fetch }));
+      return protect(new StreamableHTTPClientTransport(url, { requestInit, authProvider, fetch: authProvider?.fetch ?? providerFetch }));
     } catch (error) {
       await streamableTransport.close().catch(() => {});
-      if (error instanceof UnauthorizedError) {
+      if (error instanceof UnauthorizedError || error instanceof McpProviderAuthError) {
         throw error;
       }
-      return protect(new SSEClientTransport(url, { requestInit, authProvider, fetch: authProvider?.fetch }));
+      let pendingStart;
+      const sseTransport = new SSEClientTransport(url, {
+        requestInit,
+        authProvider,
+        fetch: authProvider?.fetch ?? providerFetch,
+        eventSourceInit: providerFetch ? {
+          fetch: async (input, init) => {
+            const attempt = pendingStart;
+            if (attempt)
+              attempt.error = undefined;
+            try {
+              return await providerFetch(input, init);
+            } catch (error) {
+              if (attempt && pendingStart === attempt && !init?.signal?.aborted && error instanceof McpProviderAuthError) {
+                attempt.error = error;
+              }
+              throw error;
+            }
+          }
+        } : undefined
+      });
+      if (providerFetch) {
+        const start = sseTransport.start.bind(sseTransport);
+        sseTransport.start = async () => {
+          const attempt = {};
+          pendingStart = attempt;
+          try {
+            await start();
+          } catch (error) {
+            throw attempt.error ?? error;
+          } finally {
+            if (pendingStart === attempt)
+              pendingStart = undefined;
+          }
+        };
+      }
+      return protect(sseTransport);
     }
   }
   async fetchAllTools(client) {
@@ -22155,12 +22395,17 @@ var init_server_manager = __esm(() => {
   init_sampling_handler();
   init_utils();
   init_remote_diagnostics();
+  init_provider_auth();
 });
 
 // dist/builtin/mcp/tool-metadata.ts
 function buildToolMetadata(tools, resources, definition, serverName, prefix) {
   const metadata = [];
   const failedTools = [];
+  const names = assignToolNames([
+    ...tools.filter((tool) => tool?.name).map((tool) => tool.name),
+    ...definition.exposeResources !== false ? resources.filter((resource) => resource?.name && resource?.uri).map((resource) => `get_${resourceNameToToolName(resource.name)}`) : []
+  ], serverName, prefix);
   for (const tool of tools) {
     if (!tool?.name) {
       failedTools.push("(unnamed)");
@@ -22176,7 +22421,7 @@ function buildToolMetadata(tools, resources, definition, serverName, prefix) {
       failedTools.push(tool.name);
     }
     metadata.push({
-      name: formatToolName(tool.name, serverName, prefix),
+      name: names.get(tool.name),
       originalName: tool.name,
       description: tool.description ?? "",
       inputSchema: tool.inputSchema,
@@ -22186,12 +22431,14 @@ function buildToolMetadata(tools, resources, definition, serverName, prefix) {
   }
   if (definition.exposeResources !== false) {
     for (const resource of resources) {
+      if (!resource?.name || !resource?.uri)
+        continue;
       const baseName = `get_${resourceNameToToolName(resource.name)}`;
       if (isToolExcluded(baseName, serverName, prefix, definition.excludeTools)) {
         continue;
       }
       metadata.push({
-        name: formatToolName(baseName, serverName, prefix),
+        name: names.get(baseName),
         originalName: baseName,
         description: resource.description ?? `Read resource: ${resource.uri}`,
         resourceUri: resource.uri
@@ -22282,6 +22529,7 @@ function formatProperty(name, schema, required, indent) {
 var init_tool_metadata = __esm(() => {
   init_app_bridge();
   init_types2();
+  init_tool_names();
   init_utils();
 });
 
@@ -22420,6 +22668,7 @@ async function initializeMcp(pi, ctx) {
   const contributions = pi.getMcpServerContributions?.() ?? [];
   const config = loadMcpConfig(configPath, ctx.cwd, contributions);
   const manager = new McpServerManager;
+  manager.setProviderTokenResolver((provider) => ctx.modelRegistry.getApiKeyForProvider(provider));
   const lifecycle = new McpLifecycleManager(manager);
   try {
     const samplingAutoApprove = config.settings?.samplingAutoApprove === true;
@@ -22482,7 +22731,12 @@ async function initializeMcp(pi, ctx) {
       try {
         const connection = await manager.connect(name, definition);
         if (connection.status === "needs-auth") {
-          return { name, definition, connection: null, error: `OAuth authentication required. Run /mcp-auth ${name}.` };
+          return {
+            name,
+            definition,
+            connection: null,
+            error: providerSignInGuidance(definition, name) ?? `OAuth authentication required. Run /mcp-auth ${name}.`
+          };
         }
         return { name, definition, connection, error: null };
       } catch (error) {
@@ -22655,7 +22909,9 @@ function getFailureAgeSeconds(state, serverName) {
 async function lazyConnect(state, serverName) {
   const connection = state.manager.getConnection(serverName);
   if (connection?.status === "needs-auth") {
-    return false;
+    if (!isProviderAuth(state.config.mcpServers[serverName]?.auth))
+      return false;
+    await state.manager.close(serverName);
   }
   if (connection?.status === "connected") {
     updateServerMetadata(state, serverName);
@@ -22712,6 +22968,7 @@ var init_init = __esm(() => {
   init_tool_metadata();
   init_ui_resource_handler();
   init_utils();
+  init_provider_auth();
   init_logger();
   FAILURE_BACKOFF_MS = 60 * 1000;
 });
@@ -23487,7 +23744,7 @@ var init_mcp_panel_types = __esm(() => {
 });
 
 // dist/builtin/mcp/mcp-panel-renderer.ts
-import { truncateToWidth as truncateToWidth2, visibleWidth as visibleWidth2 } from "@earendil-works/pi-tui";
+import { Text, truncateToWidth as truncateToWidth2, visibleWidth as visibleWidth2 } from "@earendil-works/pi-tui";
 function bold(text) {
   return `\x1B[1m${text}\x1B[22m`;
 }
@@ -23662,7 +23919,8 @@ function renderMcpPanel(context) {
       lines.push(emptyRow());
     }
     if (context.authNotice) {
-      lines.push(row(fg2(t.needsAuth, italic(context.authNotice))));
+      for (const line of new Text(fg2(t.needsAuth, context.authNotice), 0, 0).render(Math.max(1, innerW - 1)))
+        lines.push(row(line));
       lines.push(emptyRow());
     }
   }
@@ -23930,7 +24188,10 @@ class McpPanel {
     this.authInFlight = server.name;
     this.authNotice = `Authenticating ${server.name}...`;
     this.tui.requestRender();
-    this.callbacks.authenticate(server.name).then((result) => {
+    this.callbacks.authenticate(server.name, (url) => {
+      this.authNotice = authorizationNotice(url);
+      this.tui.requestRender();
+    }).then((result) => {
       server.connectionStatus = this.callbacks.getConnectionStatus(server.name);
       this.authNotice = result.ok ? `OAuth finished for ${server.name}. Run reconnect if it is still idle.` : `OAuth failed for ${server.name}${result.message ? `: ${result.message}` : ". Check the notification for details."}`;
       this.authInFlight = null;
@@ -24033,6 +24294,7 @@ function createMcpPanel(config, cache, provenance, callbacks, tui, done, options
   return new McpPanel(config, cache, provenance, callbacks, tui, done, options ?? {});
 }
 var init_mcp_panel = __esm(() => {
+  init_authorization_notice();
   init_mcp_panel_state();
   init_mcp_panel_renderer();
   init_mcp_panel_types();
@@ -24106,7 +24368,7 @@ async function reconnectServers(state, ctx, targetServer) {
       const connection = await state.manager.connect(name, definition);
       if (connection.status === "needs-auth") {
         if (ctx.hasUI) {
-          ctx.ui.notify(`MCP: ${name} requires OAuth. Run /mcp-auth ${name} first.`, "warning");
+          ctx.ui.notify(providerSignInGuidance(definition, name) ?? `MCP: ${name} requires OAuth. Run /mcp-auth ${name} first.`, "warning");
         }
         continue;
       }
@@ -24131,7 +24393,7 @@ async function reconnectServers(state, ctx, targetServer) {
   }
   updateStatusBar(state);
 }
-async function authenticateServer(serverName, config, ctx) {
+async function authenticateServer(serverName, config, ctx, onAuthorizationUrl) {
   if (!ctx.hasUI)
     return { ok: false, message: "OAuth authentication requires an interactive session." };
   const definition = config.mcpServers[serverName];
@@ -24153,7 +24415,12 @@ async function authenticateServer(serverName, config, ctx) {
   }
   try {
     ctx.ui.setStatus("mcp-auth", `Authenticating ${serverName}...`);
-    const status = await authenticate(serverName, definition.url, definition);
+    const status = await authenticate(serverName, definition.url, definition, (url) => {
+      if (onAuthorizationUrl)
+        onAuthorizationUrl(url);
+      else
+        ctx.ui.notify(authorizationNotice(url), "info");
+    });
     if (status === "authenticated") {
       const message = `OAuth authentication successful for "${serverName}"! Run /mcp reconnect ${serverName} to connect with the new token.`;
       ctx.ui.notify(`OAuth authentication successful for "${serverName}"!
@@ -24262,7 +24529,7 @@ function buildMcpPanelCallbacks(state, config, ctx) {
       const definition = config.mcpServers[serverName];
       return definition ? supportsOAuth(definition) : false;
     },
-    authenticate: (serverName) => authenticateServer(serverName, config, ctx),
+    authenticate: (serverName, onAuthorizationUrl) => authenticateServer(serverName, config, ctx, onAuthorizationUrl),
     getConnectionStatus: (serverName) => {
       const definition = config.mcpServers[serverName];
       const connection = state.manager.getConnection(serverName);
@@ -24342,6 +24609,8 @@ async function openMcpAuthPanel(state, pi, ctx, configOverridePath) {
   return { configChanged: false };
 }
 var init_commands = __esm(() => {
+  init_authorization_notice();
+  init_provider_auth();
   init_config();
   init_init();
   init_metadata_cache();
@@ -25688,7 +25957,7 @@ function asCallToolResult(result) {
 }
 
 // dist/builtin/mcp/direct-tool-executor.ts
-function getDirectAuthRequiredMessage(state, serverName, defaultMessage = `MCP server "${serverName}" requires OAuth authentication. Run /mcp-auth ${serverName} first.`) {
+function getDirectAuthRequiredMessage(state, serverName, defaultMessage = providerSignInGuidance(state.config.mcpServers[serverName], serverName) ?? `MCP server "${serverName}" requires OAuth authentication. Run /mcp-auth ${serverName} first.`) {
   return formatAuthRequiredMessage(state.config, serverName, defaultMessage);
 }
 function getDirectAuthFailedMessage(state, serverName, message) {
@@ -25927,6 +26196,7 @@ ${formatSchema(spec.inputSchema)}`;
   };
 }
 var init_direct_tool_executor = __esm(() => {
+  init_provider_auth();
   init_init();
   init_tool_metadata();
   init_ui_session();
@@ -25981,6 +26251,10 @@ function resolveDirectTools(config, cache, prefix, envOverride) {
     const serverCache = cache.servers[serverName];
     if (!serverCache || !isServerCacheValid(serverCache, definition))
       continue;
+    const names = assignToolNames([
+      ...(serverCache.tools ?? []).filter((tool) => tool?.name).map((tool) => tool.name),
+      ...definition.exposeResources !== false ? (serverCache.resources ?? []).filter((resource) => resource?.name && resource?.uri).map((resource) => `get_${resourceNameToToolName(resource.name)}`) : []
+    ], serverName, prefix);
     let toolFilter = false;
     if (envOverride) {
       if (envSelection.servers.has(serverName)) {
@@ -25998,11 +26272,13 @@ function resolveDirectTools(config, cache, prefix, envOverride) {
     if (!toolFilter)
       continue;
     for (const tool of serverCache.tools ?? []) {
+      if (!tool?.name)
+        continue;
       if (toolFilter !== true && !toolFilter.includes(tool.name))
         continue;
       if (isToolExcluded(tool.name, serverName, prefix, definition.excludeTools))
         continue;
-      const prefixedName = formatToolName(tool.name, serverName, prefix);
+      const prefixedName = names.get(tool.name);
       if (BUILTIN_NAMES.has(prefixedName)) {
         if (!reportOwnedMcpLog("warn"))
           console.warn(`MCP: skipping direct tool "${prefixedName}" (collides with builtin)`);
@@ -26026,12 +26302,14 @@ function resolveDirectTools(config, cache, prefix, envOverride) {
     }
     if (definition.exposeResources !== false) {
       for (const resource of serverCache.resources ?? []) {
+        if (!resource?.name || !resource?.uri)
+          continue;
         const baseName = `get_${resourceNameToToolName(resource.name)}`;
         if (toolFilter !== true && !toolFilter.includes(baseName))
           continue;
         if (isToolExcluded(baseName, serverName, prefix, definition.excludeTools))
           continue;
-        const prefixedName = formatToolName(baseName, serverName, prefix);
+        const prefixedName = names.get(baseName);
         if (BUILTIN_NAMES.has(prefixedName)) {
           if (!reportOwnedMcpLog("warn"))
             console.warn(`MCP: skipping direct resource tool "${prefixedName}" (collides with builtin)`);
@@ -26076,6 +26354,7 @@ var init_direct_tools = __esm(() => {
   init_diagnostics();
   init_metadata_cache();
   init_types2();
+  init_tool_names();
   init_direct_tool_executor();
   BUILTIN_NAMES = new Set(["read", "bash", "edit", "write", "grep", "find", "search", "ls", "mcp"]);
 });
@@ -26580,7 +26859,7 @@ var init_proxy_info_modes = __esm(() => {
 });
 
 // dist/builtin/mcp/proxy-auth.ts
-function getAuthRequiredMessage(state, serverName, defaultMessage = `Server "${serverName}" requires OAuth authentication. Run /mcp-auth ${serverName} first.`) {
+function getAuthRequiredMessage(state, serverName, defaultMessage = providerSignInGuidance(state.config.mcpServers[serverName], serverName) ?? `Server "${serverName}" requires OAuth authentication. Run /mcp-auth ${serverName} first.`) {
   return formatAuthRequiredMessage(state.config, serverName, defaultMessage);
 }
 function getAuthFailedMessage(state, serverName, message) {
@@ -26619,6 +26898,7 @@ async function attemptAutoAuth(state, serverName) {
 var init_proxy_auth = __esm(() => {
   init_mcp_auth_flow();
   init_utils();
+  init_provider_auth();
 });
 
 // dist/builtin/mcp/proxy-connect.ts
@@ -26719,7 +26999,7 @@ async function executeCall(state, toolName, args, serverOverride, getPiTools, si
       }
     }
   }
-  if (serverName && !toolMeta) {
+  if (serverName && (!toolMeta || state.manager.getConnection(serverName)?.status === "needs-auth" && isProviderAuth(state.config.mcpServers[serverName]?.auth))) {
     const connected = await waitForCaller(() => lazyConnect(state, serverName), signal);
     signal?.throwIfAborted();
     assertMcpStateLease(assertActive);
@@ -27086,6 +27366,7 @@ var init_proxy_call = __esm(() => {
   init_apps_cancellation();
   init_state_lease();
   init_tool_call_timeout();
+  init_provider_auth();
 });
 
 // dist/builtin/mcp/proxy-modes.ts
@@ -27197,7 +27478,7 @@ import { Type } from "typebox";
 
 // dist/builtin/mcp/tool-result-renderer.ts
 import { keyText } from "@bastani/atomic";
-import { Text } from "@earendil-works/pi-tui";
+import { Text as Text2 } from "@earendil-works/pi-tui";
 function blockToLines(block) {
   if (block.type === "text") {
     return block.text.split(`
@@ -27218,7 +27499,7 @@ function formatMcpToolResultLines(result, expanded, maxCollapsedLines = 5) {
 }
 function renderMcpToolResult(result, options, theme, context) {
   if (options.isPartial) {
-    return new Text(theme.fg("warning", "Running MCP tool..."), 0, 0);
+    return new Text2(theme.fg("warning", "Running MCP tool..."), 0, 0);
   }
   const hasErrorDetails = Boolean(result.details.error);
   const display = formatMcpToolResultLines(result, options.expanded || context?.isError === true || hasErrorDetails);
@@ -27227,14 +27508,14 @@ function renderMcpToolResult(result, options, theme, context) {
   const expandKey = keyText("app.tools.expand");
   const hint = display.truncated && !options.expanded && expandKey ? `
 ${theme.fg("muted", `(${expandKey} Expand)`)}` : "";
-  return new Text(`${output}${hint}`, 0, 0);
+  return new Text2(`${output}${hint}`, 0, 0);
 }
 
 // dist/builtin/mcp/tool-call-renderer.ts
 init_tool_metadata();
 init_types2();
 import { formatToolCallWithArgs } from "@bastani/atomic";
-import { stripTerminalSequences, Text as Text2 } from "@earendil-works/pi-tui";
+import { stripTerminalSequences, Text as Text3 } from "@earendil-works/pi-tui";
 function textArg(value) {
   return typeof value === "string" && value.length > 0 ? value : undefined;
 }
@@ -27259,8 +27540,8 @@ function redactArguments(value) {
 function header(theme, server, operation, args, expanded = false) {
   const clean = (value) => stripTerminalSequences(value).replace(/[\r\n\t]/g, " ");
   if (server && args && Object.keys(args).length > 0)
-    return new Text2(formatToolCallWithArgs(`MCP${server ? ` ${clean(server)}` : ""} · ${clean(operation)}`, redactArguments(args), { fg: (name, text) => theme.fg(name, text), bold: (text) => theme.bold?.(text) ?? text }, expanded), 0, 0);
-  return new Text2(theme.fg("toolTitle", `MCP${server ? ` ${clean(server)}` : ""}`) + theme.fg("muted", ` · ${clean(operation)}`), 0, 0);
+    return new Text3(formatToolCallWithArgs(`MCP${server ? ` ${clean(server)}` : ""} · ${clean(operation)}`, redactArguments(args), { fg: (name, text) => theme.fg(name, text), bold: (text) => theme.bold?.(text) ?? text }, expanded), 0, 0);
+  return new Text3(theme.fg("toolTitle", `MCP${server ? ` ${clean(server)}` : ""}`) + theme.fg("muted", ` · ${clean(operation)}`), 0, 0);
 }
 function renderMcpDirectToolCall(server, tool, theme, args, expanded = false) {
   return header(theme, server, tool, args, expanded);