@code-yeongyu/senpi 2026.7.4 → 2026.7.9-2

package/dist/core/extensions/builtin/mcp/auth/callback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback.js","sourceRoot":"","sources":["../../../../../../src/core/extensions/builtin/mcp/auth/callback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAGjG,OAAO,EAA0B,SAAS,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AA2BnD,+EAA+E;AAC/E,6EAA6E;AAC7E,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAyD;IAEzD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzE,OAAO;YACN,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,KAAK;YACnB,WAAW,EAAE,GAAG,EAAE,CACjB,OAAO,CAAC,MAAM,CACb,IAAI,cAAc,CACjB,UAAU,EACV,cAAc,OAAO,CAAC,UAAU,iFAAiF,EACjH,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAClC,CACD;YACF,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE;SAC9B,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACzC,OAAO;QACN,WAAW;QACX,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE;QACvC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;KAC3B,CAAC;AACH,CAAC;AAED,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,MAAM,YAAY,GAAG,2FAA2F,CAAC;AACjH,MAAM,YAAY,GAAG,4FAA4F,CAAC;AAElH,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,MAAM,OAAO,sBAAsB;IACzB,QAAQ,CAAwB;IACzC,OAAO,CAAqB;IAC5B,YAAY,CAAqB;IACjC,OAAO,CAAsC;IAC7C,QAAQ,CAAiD;IACzD,OAAO,CAAuC;IAC9C,MAAM,CAA6B;IACnC,QAAQ,GAAG,KAAK,CAAC;IAEjB,YAAY,OAA8B;QACzC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,IAAI,WAAW;QACd,OAAO,IAAI,CAAC,YAAY,CAAC;IAC1B,CAAC;IAED,IAAI,KAAK;QACR,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACpC,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,KAAK;QACV,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,WAAW,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,WAAW,CAAC;QAC/C,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;QAChD,IAAI,CAAC,YAAY,GAAG,UAAU,IAAI,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;QAC5D,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9D,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;YACxB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,SAAS,CACtB,uBAAuB,EACvB,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,kBAAkB,EAC7C,GAAG,EAAE,CACJ,IAAI,CAAC,KAAK,CACT,IAAI,cAAc,CACjB,YAAY,EACZ,cAAc,IAAI,CAAC,QAAQ,CAAC,UAAU,2CAA2C,EACjF,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CACxC,CACD,EACF,IAAI,CAAC,KAAK,CACV,CAAC;QACF,OAAO,IAAI,CAAC,YAAY,CAAC;IAC1B,CAAC;IAED,WAAW;QACV,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC/E,OAAO,IAAI,CAAC,OAAO,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,KAAK;QACV,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO;QACjC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,CAAC,MAAc,EAAE,IAAY,EAAE,IAAY;QACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACtC,MAAM,OAAO,GAAG,CAAC,KAA4B,EAAQ,EAAE;gBACtD,MAAM,MAAM,GACX,KAAK,CAAC,IAAI,KAAK,YAAY;oBAC1B,CAAC,CAAC,QAAQ,IAAI,yGAAyG;oBACvH,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;gBAClB,MAAM,CACL,IAAI,cAAc,CACjB,YAAY,EACZ,cAAc,IAAI,CAAC,QAAQ,CAAC,UAAU,8BAA8B,MAAM,EAAE,EAC5E;oBACC,KAAK,EAAE,KAAK;oBACZ,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU;iBACpC,CACD,CACD,CAAC;YACH,CAAC,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;gBAC9B,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACxC,OAAO,EAAE,CAAC;YACX,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAoB,EAAE,GAAmB,EAAE,IAAY;QAC9D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACR,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;QACzD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACnG,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACtE,KAAK,IAAI,CAAC,KAAK,CACd,IAAI,cAAc,CACjB,gBAAgB,EAChB,cAAc,IAAI,CAAC,QAAQ,CAAC,UAAU,qGAAqG,EAC3I,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CACxC,CACD,CAAC;YACF,OAAO;QACR,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,QAAQ,CAAC,MAAsB;QAC9B,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;QACxB,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAY;QACvB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACtB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;CACD","sourcesContent":["import { createServer, type IncomingMessage, type Server, type ServerResponse } from \"node:http\";\nimport type { AddressInfo } from \"node:net\";\nimport type { McpLogger } from \"../log.ts\";\nimport { type McpAsyncErrorSink, safeTimer } from \"../wrap.ts\";\nimport { OAuthFlowError } from \"./oauth-errors.ts\";\n\nexport interface CallbackServerOptions {\n\tserverName: string;\n\t// Fixed port required for pre-registered clients; omit for an OS-assigned\n\t// port (used with DCR/CIMD dynamic redirect registration).\n\tport?: number;\n\thost?: string;\n\tpath?: string;\n\ttimeoutMs?: number;\n\tlogger?: McpLogger;\n\t// Single-use CSRF check. Returning false yields a 400 and does NOT complete.\n\tvalidateState: (state: string | undefined) => boolean;\n}\n\nexport interface CallbackResult {\n\tcode: string;\n\tstate: string | undefined;\n}\n\nexport interface CallbackChannel {\n\tredirectUrl: string;\n\tusesLoopback: boolean;\n\twaitForCode: () => Promise<CallbackResult>;\n\tclose: () => Promise<void>;\n}\n\n// Chooses the redirect channel for an authorization: a real loopback listener,\n// or — when `mcp.oauthCallbackUrl` is configured — a paste channel with ZERO\n// local listeners (completion arrives via /mcp auth-complete).\nexport async function openCallbackChannel(\n\toptions: CallbackServerOptions & { overrideUrl?: string },\n): Promise<CallbackChannel> {\n\tif (options.overrideUrl !== undefined && options.overrideUrl.length > 0) {\n\t\treturn {\n\t\t\tredirectUrl: options.overrideUrl,\n\t\t\tusesLoopback: false,\n\t\t\twaitForCode: () =>\n\t\t\t\tPromise.reject(\n\t\t\t\t\tnew OAuthFlowError(\n\t\t\t\t\t\t\"headless\",\n\t\t\t\t\t\t`MCP server ${options.serverName} uses a callback URL override; complete with /mcp auth-complete <redirect-url>.`,\n\t\t\t\t\t\t{ serverName: options.serverName },\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\tclose: () => Promise.resolve(),\n\t\t};\n\t}\n\tconst server = new LoopbackCallbackServer(options);\n\tconst redirectUrl = await server.start();\n\treturn {\n\t\tredirectUrl,\n\t\tusesLoopback: true,\n\t\twaitForCode: () => server.waitForCode(),\n\t\tclose: () => server.close(),\n\t};\n}\n\nconst DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;\nconst SUCCESS_HTML = \"<!doctype html><title>senpi</title><p>Authorization complete. You can close this tab.</p>\";\nconst FAILURE_HTML = \"<!doctype html><title>senpi</title><p>Authorization failed. Return to senpi and retry.</p>\";\n\n// Lazily-bound 127.0.0.1 listener that exists only for the duration of one\n// OAuth authorization. The handle is unref'd so it never keeps the process\n// alive, and it tears down on success, invalid state, or a 5-minute timeout.\nexport class LoopbackCallbackServer {\n\treadonly #options: CallbackServerOptions;\n\t#server: Server | undefined;\n\t#redirectUrl: string | undefined;\n\t#result: Promise<CallbackResult> | undefined;\n\t#resolve: ((result: CallbackResult) => void) | undefined;\n\t#reject: ((error: Error) => void) | undefined;\n\t#timer: NodeJS.Timeout | undefined;\n\t#settled = false;\n\n\tconstructor(options: CallbackServerOptions) {\n\t\tthis.#options = options;\n\t}\n\n\tget redirectUrl(): string | undefined {\n\t\treturn this.#redirectUrl;\n\t}\n\n\tget #sink(): McpAsyncErrorSink {\n\t\tconst logger = this.#options.logger;\n\t\treturn { logger: { error: (message, data) => logger?.error(message, data) } };\n\t}\n\n\tasync start(): Promise<string> {\n\t\tconst host = this.#options.host ?? \"127.0.0.1\";\n\t\tconst path = this.#options.path ?? \"/callback\";\n\t\tconst server = createServer((req, res) => this.#handle(req, res, path));\n\t\tserver.unref();\n\t\tthis.#server = server;\n\t\tawait this.#listen(server, host, this.#options.port ?? 0);\n\t\tconst address = server.address() as AddressInfo;\n\t\tthis.#redirectUrl = `http://${host}:${address.port}${path}`;\n\t\tthis.#result = new Promise<CallbackResult>((resolve, reject) => {\n\t\t\tthis.#resolve = resolve;\n\t\t\tthis.#reject = reject;\n\t\t});\n\t\tthis.#timer = safeTimer(\n\t\t\t\"auth.callback.timeout\",\n\t\t\tthis.#options.timeoutMs ?? DEFAULT_TIMEOUT_MS,\n\t\t\t() =>\n\t\t\t\tthis.#fail(\n\t\t\t\t\tnew OAuthFlowError(\n\t\t\t\t\t\t\"needs_auth\",\n\t\t\t\t\t\t`MCP server ${this.#options.serverName} authorization timed out after 5 minutes.`,\n\t\t\t\t\t\t{ serverName: this.#options.serverName },\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\tthis.#sink,\n\t\t);\n\t\treturn this.#redirectUrl;\n\t}\n\n\twaitForCode(): Promise<CallbackResult> {\n\t\tif (this.#result === undefined) throw new Error(\"callback server not started\");\n\t\treturn this.#result;\n\t}\n\n\tasync close(): Promise<void> {\n\t\tif (this.#timer !== undefined) clearTimeout(this.#timer);\n\t\tconst server = this.#server;\n\t\tthis.#server = undefined;\n\t\tif (server === undefined) return;\n\t\tawait new Promise<void>((resolve) => server.close(() => resolve()));\n\t}\n\n\t#listen(server: Server, host: string, port: number): Promise<void> {\n\t\treturn new Promise((resolve, reject) => {\n\t\t\tconst onError = (error: NodeJS.ErrnoException): void => {\n\t\t\t\tconst detail =\n\t\t\t\t\terror.code === \"EADDRINUSE\"\n\t\t\t\t\t\t? `port ${port} is already in use (another senpi auth flow may be running); free it or configure a different callback.`\n\t\t\t\t\t\t: error.message;\n\t\t\t\treject(\n\t\t\t\t\tnew OAuthFlowError(\n\t\t\t\t\t\t\"needs_auth\",\n\t\t\t\t\t\t`MCP server ${this.#options.serverName} callback listener failed: ${detail}`,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tcause: error,\n\t\t\t\t\t\t\tserverName: this.#options.serverName,\n\t\t\t\t\t\t},\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t};\n\t\t\tserver.once(\"error\", onError);\n\t\t\tserver.listen(port, host, () => {\n\t\t\t\tserver.removeListener(\"error\", onError);\n\t\t\t\tresolve();\n\t\t\t});\n\t\t});\n\t}\n\n\t#handle(req: IncomingMessage, res: ServerResponse, path: string): void {\n\t\tconst url = new URL(req.url ?? \"/\", this.#redirectUrl);\n\t\tif (url.pathname !== path) {\n\t\t\tres.writeHead(404).end();\n\t\t\treturn;\n\t\t}\n\t\tconst code = url.searchParams.get(\"code\");\n\t\tconst state = url.searchParams.get(\"state\") ?? undefined;\n\t\tconst error = url.searchParams.get(\"error\");\n\t\tif (error !== null || code === null || state === undefined || !this.#options.validateState(state)) {\n\t\t\tres.writeHead(400, { \"content-type\": \"text/html\" }).end(FAILURE_HTML);\n\t\t\tvoid this.#fail(\n\t\t\t\tnew OAuthFlowError(\n\t\t\t\t\t\"state_mismatch\",\n\t\t\t\t\t`MCP server ${this.#options.serverName} authorization state did not match (possible CSRF or a stale/replayed link); restart the auth flow.`,\n\t\t\t\t\t{ serverName: this.#options.serverName },\n\t\t\t\t),\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\t\tres.writeHead(200, { \"content-type\": \"text/html\" }).end(SUCCESS_HTML);\n\t\tthis.#succeed({ code, state });\n\t}\n\n\t#succeed(result: CallbackResult): void {\n\t\tif (this.#settled) return;\n\t\tthis.#settled = true;\n\t\tif (this.#timer !== undefined) clearTimeout(this.#timer);\n\t\tthis.#resolve?.(result);\n\t\tvoid this.close();\n\t}\n\n\tasync #fail(error: Error): Promise<void> {\n\t\tif (this.#settled) return;\n\t\tthis.#settled = true;\n\t\tthis.#reject?.(error);\n\t\tawait this.close();\n\t}\n}\n"]}

package/dist/core/extensions/builtin/mcp/auth/commands-auth-dispatch.d.ts

@@ -0,0 +1,3 @@
+import type { ExtensionAPI, ExtensionCommandContext } from "../../../types.ts";
+export declare function handleMcpAuthCommand(subcommand: string, args: readonly string[], ctx: ExtensionCommandContext, pi: Pick<ExtensionAPI, "getActiveTools" | "setActiveTools" | "registerTool">): Promise<void>;
+//# sourceMappingURL=commands-auth-dispatch.d.ts.map

package/dist/core/extensions/builtin/mcp/auth/commands-auth-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands-auth-dispatch.d.ts","sourceRoot":"","sources":["../../../../../../src/core/extensions/builtin/mcp/auth/commands-auth-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAO/E,wBAAsB,oBAAoB,CACzC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,EAAE,uBAAuB,EAC5B,EAAE,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,cAAc,CAAC,GAC1E,OAAO,CAAC,IAAI,CAAC,CA2Cf"}

package/dist/core/extensions/builtin/mcp/auth/commands-auth-dispatch.js

@@ -0,0 +1,53 @@
+import { createMcpLogger } from "../log.js";
+import { getMcpService } from "../service.js";
+import { runAuth, runAuthComplete, runAuthStart, runLogout } from "./commands-auth.js";
+// Bridges the /mcp slash command to the pure auth flow runners in
+// commands-auth.ts, sourcing config/agentDir/env from the running service.
+export async function handleMcpAuthCommand(subcommand, args, ctx, pi) {
+    const name = args[0] ?? "";
+    const service = getMcpService();
+    const target = service.getAuthTarget(name);
+    if (name.length === 0 || target === undefined) {
+        ctx.ui.notify(`Unknown MCP server: ${name || "<missing>"}`, "error");
+        return;
+    }
+    const deps = {
+        agentDir: target.agentDir,
+        callbackUrl: target.callbackUrl,
+        config: target.config,
+        env: target.env,
+        hasUI: ctx.hasUI,
+        logger: createMcpLogger(name),
+        notify: (message, type) => ctx.ui.notify(message, type),
+        onReconnect: async () => {
+            try {
+                await service.reconnectServer(name);
+            }
+            catch {
+                // A needs_auth/degraded state after logout is expected; status shows it.
+            }
+            await service.attachSession({ type: "session_start", reason: "reload" }, ctx, pi).catch(() => undefined);
+        },
+        openBrowser: (url) => ctx.ui.notify(`Open this URL to authorize ${name}:\n${url.toString()}`),
+        pending: service.getPendingAuth(),
+        serverName: name,
+    };
+    if (subcommand === "auth")
+        return runAuth(deps);
+    if (subcommand === "auth-start") {
+        await runAuthStart(deps);
+        return;
+    }
+    if (subcommand === "auth-complete") {
+        const redirect = args[1] ?? "";
+        if (redirect.length === 0) {
+            ctx.ui.notify(`Usage: /mcp auth-complete ${name} <redirect-url>`, "error");
+            return;
+        }
+        return runAuthComplete(deps, redirect);
+    }
+    if (subcommand === "logout")
+        return runLogout(deps);
+    ctx.ui.notify(`Unknown MCP auth subcommand: ${subcommand}`, "error");
+}
+//# sourceMappingURL=commands-auth-dispatch.js.map

package/dist/core/extensions/builtin/mcp/auth/commands-auth-dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands-auth-dispatch.js","sourceRoot":"","sources":["../../../../../../src/core/extensions/builtin/mcp/auth/commands-auth-dispatch.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAwB,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE7G,kEAAkE;AAClE,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,UAAkB,EAClB,IAAuB,EACvB,GAA4B,EAC5B,EAA4E;IAE5E,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/C,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,uBAAuB,IAAI,IAAI,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC;QACrE,OAAO;IACR,CAAC;IACD,MAAM,IAAI,GAAoB;QAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC;QAC7B,MAAM,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;QACvD,WAAW,EAAE,KAAK,IAAI,EAAE;YACvB,IAAI,CAAC;gBACJ,MAAM,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACR,yEAAyE;YAC1E,CAAC;YACD,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1G,CAAC;QACD,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,8BAA8B,IAAI,MAAM,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC7F,OAAO,EAAE,OAAO,CAAC,cAAc,EAAE;QACjC,UAAU,EAAE,IAAI;KAChB,CAAC;IACF,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;QACjC,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QACzB,OAAO;IACR,CAAC;IACD,IAAI,UAAU,KAAK,eAAe,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,6BAA6B,IAAI,iBAAiB,EAAE,OAAO,CAAC,CAAC;YAC3E,OAAO;QACR,CAAC;QACD,OAAO,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,UAAU,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IACpD,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,gCAAgC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC;AACtE,CAAC","sourcesContent":["import type { ExtensionAPI, ExtensionCommandContext } from \"../../../types.ts\";\nimport { createMcpLogger } from \"../log.ts\";\nimport { getMcpService } from \"../service.ts\";\nimport { type AuthCommandDeps, runAuth, runAuthComplete, runAuthStart, runLogout } from \"./commands-auth.ts\";\n\n// Bridges the /mcp slash command to the pure auth flow runners in\n// commands-auth.ts, sourcing config/agentDir/env from the running service.\nexport async function handleMcpAuthCommand(\n\tsubcommand: string,\n\targs: readonly string[],\n\tctx: ExtensionCommandContext,\n\tpi: Pick<ExtensionAPI, \"getActiveTools\" | \"setActiveTools\" | \"registerTool\">,\n): Promise<void> {\n\tconst name = args[0] ?? \"\";\n\tconst service = getMcpService();\n\tconst target = service.getAuthTarget(name);\n\tif (name.length === 0 || target === undefined) {\n\t\tctx.ui.notify(`Unknown MCP server: ${name || \"<missing>\"}`, \"error\");\n\t\treturn;\n\t}\n\tconst deps: AuthCommandDeps = {\n\t\tagentDir: target.agentDir,\n\t\tcallbackUrl: target.callbackUrl,\n\t\tconfig: target.config,\n\t\tenv: target.env,\n\t\thasUI: ctx.hasUI,\n\t\tlogger: createMcpLogger(name),\n\t\tnotify: (message, type) => ctx.ui.notify(message, type),\n\t\tonReconnect: async () => {\n\t\t\ttry {\n\t\t\t\tawait service.reconnectServer(name);\n\t\t\t} catch {\n\t\t\t\t// A needs_auth/degraded state after logout is expected; status shows it.\n\t\t\t}\n\t\t\tawait service.attachSession({ type: \"session_start\", reason: \"reload\" }, ctx, pi).catch(() => undefined);\n\t\t},\n\t\topenBrowser: (url) => ctx.ui.notify(`Open this URL to authorize ${name}:\\n${url.toString()}`),\n\t\tpending: service.getPendingAuth(),\n\t\tserverName: name,\n\t};\n\tif (subcommand === \"auth\") return runAuth(deps);\n\tif (subcommand === \"auth-start\") {\n\t\tawait runAuthStart(deps);\n\t\treturn;\n\t}\n\tif (subcommand === \"auth-complete\") {\n\t\tconst redirect = args[1] ?? \"\";\n\t\tif (redirect.length === 0) {\n\t\t\tctx.ui.notify(`Usage: /mcp auth-complete ${name} <redirect-url>`, \"error\");\n\t\t\treturn;\n\t\t}\n\t\treturn runAuthComplete(deps, redirect);\n\t}\n\tif (subcommand === \"logout\") return runLogout(deps);\n\tctx.ui.notify(`Unknown MCP auth subcommand: ${subcommand}`, \"error\");\n}\n"]}

package/dist/core/extensions/builtin/mcp/auth/commands-auth.d.ts

@@ -0,0 +1,25 @@
+import type { McpServerConfig } from "../config-schema.ts";
+import type { McpLogger } from "../log.ts";
+import type { OAuthFlowOptions } from "./oauth.ts";
+import type { McpOAuthProvider } from "./oauth-provider.ts";
+type Notify = (message: string, type?: "info" | "warning" | "error") => void;
+export interface AuthCommandDeps {
+    serverName: string;
+    config: McpServerConfig;
+    agentDir?: string;
+    env?: Record<string, string | undefined>;
+    logger?: McpLogger;
+    hasUI: boolean;
+    notify: Notify;
+    callbackUrl?: string;
+    openBrowser?: (url: URL) => void | Promise<void>;
+    onReconnect: () => Promise<void>;
+    pending: Map<string, McpOAuthProvider>;
+    flow?: OAuthFlowOptions;
+}
+export declare function runAuth(deps: AuthCommandDeps): Promise<void>;
+export declare function runAuthStart(deps: AuthCommandDeps): Promise<string>;
+export declare function runAuthComplete(deps: AuthCommandDeps, redirectUrl: string): Promise<void>;
+export declare function runLogout(deps: AuthCommandDeps): Promise<void>;
+export {};
+//# sourceMappingURL=commands-auth.d.ts.map

package/dist/core/extensions/builtin/mcp/auth/commands-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands-auth.d.ts","sourceRoot":"","sources":["../../../../../../src/core/extensions/builtin/mcp/auth/commands-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAG3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AASnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,KAAK,MAAM,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,KAAK,IAAI,CAAC;AAE7E,MAAM,WAAW,eAAe;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,eAAe,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IAEf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAGjC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE,gBAAgB,CAAC;CACxB;AAqCD,wBAAsB,OAAO,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBlE;AA4DD,wBAAsB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAezE;AAGD,wBAAsB,eAAe,CAAC,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ/F;AAGD,wBAAsB,SAAS,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAMpE"}

package/dist/core/extensions/builtin/mcp/auth/commands-auth.js

@@ -0,0 +1,127 @@
+import { openCallbackChannel } from "./callback.js";
+import { resolveServerAuth } from "./context.js";
+import { beginAuthorization, clientCredentialsGrant, completeAuthorization, finishAuthorization, logout, } from "./oauth.js";
+import { OAuthFlowError } from "./oauth-errors.js";
+const PASTE_REDIRECT = "http://127.0.0.1:0/callback";
+const activeInteractiveAuthServers = new Set();
+function ensureOAuth(deps) {
+    if (deps.config.auth === false || deps.config.type !== "http" || deps.config.url === undefined) {
+        throw new OAuthFlowError("headless", `MCP server ${deps.serverName} is not an OAuth HTTP server.`, {
+            serverName: deps.serverName,
+        });
+    }
+}
+function buildProvider(deps, redirectUrl, onRedirect) {
+    const plan = resolveServerAuth({
+        agentDir: deps.agentDir,
+        config: { ...deps.config, auth: "oauth" },
+        env: deps.env,
+        logger: deps.logger,
+        onRedirect,
+        redirectUrl,
+        serverName: deps.serverName,
+    });
+    if (plan.provider === undefined) {
+        throw new OAuthFlowError("headless", `MCP server ${deps.serverName} could not build an OAuth provider.`, {
+            serverName: deps.serverName,
+        });
+    }
+    return plan.provider;
+}
+// `/mcp auth <server>`: client_credentials M2M, or interactive loopback flow.
+// Non-UI callers fail fast with an actionable headless hint (no browser).
+export async function runAuth(deps) {
+    ensureOAuth(deps);
+    if (deps.config.oauth?.flow === "client_credentials") {
+        const provider = buildProvider(deps, deps.callbackUrl ?? PASTE_REDIRECT);
+        await clientCredentialsGrant(provider, deps.flow);
+        await deps.onReconnect();
+        deps.notify(`MCP server ${deps.serverName} authenticated (client_credentials)`);
+        return;
+    }
+    if (!deps.hasUI) {
+        deps.notify(`MCP server ${deps.serverName} needs interactive OAuth. Run senpi in a terminal, then: /mcp auth-start ${deps.serverName}  and  /mcp auth-complete ${deps.serverName} <redirect-url>`, "error");
+        return;
+    }
+    await runInteractive(deps);
+}
+async function runInteractive(deps) {
+    if (activeInteractiveAuthServers.has(deps.serverName)) {
+        throw new OAuthFlowError("needs_auth", `MCP server ${deps.serverName} authorization is already in progress; complete the existing browser flow or retry after it finishes.`, { serverName: deps.serverName });
+    }
+    activeInteractiveAuthServers.add(deps.serverName);
+    let provider;
+    let channel;
+    const oauth = deps.config.oauth;
+    let callbackPort;
+    if ((deps.callbackUrl === undefined || deps.callbackUrl.length === 0) &&
+        oauth?.clientId !== undefined &&
+        oauth.clientMetadataUrl === undefined) {
+        callbackPort = oauth.callbackPort;
+    }
+    try {
+        channel = await openCallbackChannel({
+            overrideUrl: deps.callbackUrl,
+            port: callbackPort,
+            serverName: deps.serverName,
+            validateState: (state) => provider?.consumeState(state) ?? false,
+        });
+        const loopbackResult = channel.usesLoopback ? channel.waitForCode() : undefined;
+        provider = buildProvider(deps, channel.redirectUrl, (url) => deps.openBrowser?.(url));
+        const begin = await beginAuthorization(provider, deps.flow);
+        if (begin.authorizationUrl !== undefined)
+            deps.notify(`Opening browser to authorize ${deps.serverName}...`);
+        if (!channel.usesLoopback) {
+            deps.pending.set(deps.serverName, provider);
+            if (begin.authorizationUrl === undefined) {
+                throw new OAuthFlowError("needs_auth", `MCP server ${deps.serverName} did not produce an authorization URL.`, {
+                    serverName: deps.serverName,
+                });
+            }
+            deps.notify(`Complete the browser flow, then run /mcp auth-complete ${deps.serverName} <redirect-url> with the final redirect URL.`);
+            return;
+        }
+        const { code } = await (loopbackResult ?? channel.waitForCode());
+        await finishAuthorization(provider, code, deps.flow);
+        await deps.onReconnect();
+        deps.notify(`MCP server ${deps.serverName} authorized`);
+    }
+    finally {
+        activeInteractiveAuthServers.delete(deps.serverName);
+        await channel?.close();
+    }
+}
+// `/mcp auth-start <server>`: print the authorize URL for a browser-less paste.
+export async function runAuthStart(deps) {
+    ensureOAuth(deps);
+    const provider = buildProvider(deps, deps.callbackUrl ?? PASTE_REDIRECT);
+    const begin = await beginAuthorization(provider, deps.flow);
+    const url = begin.authorizationUrl;
+    if (url === undefined) {
+        throw new OAuthFlowError("needs_auth", `MCP server ${deps.serverName} did not produce an authorization URL.`, {
+            serverName: deps.serverName,
+        });
+    }
+    deps.pending.set(deps.serverName, provider);
+    deps.notify(`Open this URL, approve, then run /mcp auth-complete ${deps.serverName} <redirect-url>:\n${url.toString()}`);
+    return url.toString();
+}
+// `/mcp auth-complete <server> <redirect-url>`: finish the paste flow.
+export async function runAuthComplete(deps, redirectUrl) {
+    ensureOAuth(deps);
+    const pending = deps.pending.get(deps.serverName);
+    const provider = pending ?? buildProvider(deps, deps.callbackUrl ?? PASTE_REDIRECT);
+    await completeAuthorization(provider, redirectUrl, deps.flow);
+    deps.pending.delete(deps.serverName);
+    await deps.onReconnect();
+    deps.notify(`MCP server ${deps.serverName} authorized`);
+}
+// `/mcp logout <server>`: clear stored credentials.
+export async function runLogout(deps) {
+    const provider = buildProvider(deps, PASTE_REDIRECT);
+    await logout(provider);
+    deps.pending.delete(deps.serverName);
+    await deps.onReconnect();
+    deps.notify(`MCP server ${deps.serverName} logged out`);
+}
+//# sourceMappingURL=commands-auth.js.map

package/dist/core/extensions/builtin/mcp/auth/commands-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands-auth.js","sourceRoot":"","sources":["../../../../../../src/core/extensions/builtin/mcp/auth/commands-auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EACN,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EACnB,MAAM,GACN,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAuBnD,MAAM,cAAc,GAAG,6BAA6B,CAAC;AACrD,MAAM,4BAA4B,GAAG,IAAI,GAAG,EAAU,CAAC;AAEvD,SAAS,WAAW,CAAC,IAAqB;IACzC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAChG,MAAM,IAAI,cAAc,CAAC,UAAU,EAAE,cAAc,IAAI,CAAC,UAAU,+BAA+B,EAAE;YAClG,UAAU,EAAE,IAAI,CAAC,UAAU;SAC3B,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CACrB,IAAqB,EACrB,WAAmB,EACnB,UAA+C;IAE/C,MAAM,IAAI,GAAG,iBAAiB,CAAC;QAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE;QACzC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU;QACV,WAAW;QACX,UAAU,EAAE,IAAI,CAAC,UAAU;KAC3B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,cAAc,CAAC,UAAU,EAAE,cAAc,IAAI,CAAC,UAAU,qCAAqC,EAAE;YACxG,UAAU,EAAE,IAAI,CAAC,UAAU;SAC3B,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAC;AACtB,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAqB;IAClD,WAAW,CAAC,IAAI,CAAC,CAAC;IAClB,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,KAAK,oBAAoB,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;QACzE,MAAM,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,UAAU,qCAAqC,CAAC,CAAC;QAChF,OAAO;IACR,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,CAAC,MAAM,CACV,cAAc,IAAI,CAAC,UAAU,4EAA4E,IAAI,CAAC,UAAU,6BAA6B,IAAI,CAAC,UAAU,iBAAiB,EACrL,OAAO,CACP,CAAC;QACF,OAAO;IACR,CAAC;IACD,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAqB;IAClD,IAAI,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,cAAc,CACvB,YAAY,EACZ,cAAc,IAAI,CAAC,UAAU,uGAAuG,EACpI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAC/B,CAAC;IACH,CAAC;IACD,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,QAAsC,CAAC;IAC3C,IAAI,OAAoE,CAAC;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;IAChC,IAAI,YAAgC,CAAC;IACrC,IACC,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC;QACjE,KAAK,EAAE,QAAQ,KAAK,SAAS;QAC7B,KAAK,CAAC,iBAAiB,KAAK,SAAS,EACpC,CAAC;QACF,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACnC,CAAC;IACD,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,mBAAmB,CAAC;YACnC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK;SAChE,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,CAAC,gCAAgC,IAAI,CAAC,UAAU,KAAK,CAAC,CAAC;QAC5G,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC5C,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBAC1C,MAAM,IAAI,cAAc,CACvB,YAAY,EACZ,cAAc,IAAI,CAAC,UAAU,wCAAwC,EACrE;oBACC,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC3B,CACD,CAAC;YACH,CAAC;YACD,IAAI,CAAC,MAAM,CACV,0DAA0D,IAAI,CAAC,UAAU,8CAA8C,CACvH,CAAC;YACF,OAAO;QACR,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,cAAc,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QACjE,MAAM,mBAAmB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,UAAU,aAAa,CAAC,CAAC;IACzD,CAAC;YAAS,CAAC;QACV,4BAA4B,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;IACxB,CAAC;AACF,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAqB;IACvD,WAAW,CAAC,IAAI,CAAC,CAAC;IAClB,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,KAAK,CAAC,gBAAgB,CAAC;IACnC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,cAAc,CAAC,YAAY,EAAE,cAAc,IAAI,CAAC,UAAU,wCAAwC,EAAE;YAC7G,UAAU,EAAE,IAAI,CAAC,UAAU;SAC3B,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CACV,uDAAuD,IAAI,CAAC,UAAU,qBAAqB,GAAG,CAAC,QAAQ,EAAE,EAAE,CAC3G,CAAC;IACF,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAqB,EAAE,WAAmB;IAC/E,WAAW,CAAC,IAAI,CAAC,CAAC;IAClB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,IAAI,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IACpF,MAAM,qBAAqB,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;IACzB,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,UAAU,aAAa,CAAC,CAAC;AACzD,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAqB;IACpD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACrD,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;IACzB,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,UAAU,aAAa,CAAC,CAAC;AACzD,CAAC","sourcesContent":["import type { McpServerConfig } from \"../config-schema.ts\";\nimport type { McpLogger } from \"../log.ts\";\nimport { openCallbackChannel } from \"./callback.ts\";\nimport { resolveServerAuth } from \"./context.ts\";\nimport type { OAuthFlowOptions } from \"./oauth.ts\";\nimport {\n\tbeginAuthorization,\n\tclientCredentialsGrant,\n\tcompleteAuthorization,\n\tfinishAuthorization,\n\tlogout,\n} from \"./oauth.ts\";\nimport { OAuthFlowError } from \"./oauth-errors.ts\";\nimport type { McpOAuthProvider } from \"./oauth-provider.ts\";\n\ntype Notify = (message: string, type?: \"info\" | \"warning\" | \"error\") => void;\n\nexport interface AuthCommandDeps {\n\tserverName: string;\n\tconfig: McpServerConfig;\n\tagentDir?: string;\n\tenv?: Record<string, string | undefined>;\n\tlogger?: McpLogger;\n\thasUI: boolean;\n\tnotify: Notify;\n\t// settings.oauthCallbackUrl override: when set, no local listener is opened.\n\tcallbackUrl?: string;\n\topenBrowser?: (url: URL) => void | Promise<void>;\n\tonReconnect: () => Promise<void>;\n\t// Persists the provider between auth-start and auth-complete so the in-memory\n\t// CSRF state survives across two command invocations in one session.\n\tpending: Map<string, McpOAuthProvider>;\n\tflow?: OAuthFlowOptions;\n}\n\nconst PASTE_REDIRECT = \"http://127.0.0.1:0/callback\";\nconst activeInteractiveAuthServers = new Set<string>();\n\nfunction ensureOAuth(deps: AuthCommandDeps): void {\n\tif (deps.config.auth === false || deps.config.type !== \"http\" || deps.config.url === undefined) {\n\t\tthrow new OAuthFlowError(\"headless\", `MCP server ${deps.serverName} is not an OAuth HTTP server.`, {\n\t\t\tserverName: deps.serverName,\n\t\t});\n\t}\n}\n\nfunction buildProvider(\n\tdeps: AuthCommandDeps,\n\tredirectUrl: string,\n\tonRedirect?: (url: URL) => void | Promise<void>,\n): McpOAuthProvider {\n\tconst plan = resolveServerAuth({\n\t\tagentDir: deps.agentDir,\n\t\tconfig: { ...deps.config, auth: \"oauth\" },\n\t\tenv: deps.env,\n\t\tlogger: deps.logger,\n\t\tonRedirect,\n\t\tredirectUrl,\n\t\tserverName: deps.serverName,\n\t});\n\tif (plan.provider === undefined) {\n\t\tthrow new OAuthFlowError(\"headless\", `MCP server ${deps.serverName} could not build an OAuth provider.`, {\n\t\t\tserverName: deps.serverName,\n\t\t});\n\t}\n\treturn plan.provider;\n}\n\n// `/mcp auth <server>`: client_credentials M2M, or interactive loopback flow.\n// Non-UI callers fail fast with an actionable headless hint (no browser).\nexport async function runAuth(deps: AuthCommandDeps): Promise<void> {\n\tensureOAuth(deps);\n\tif (deps.config.oauth?.flow === \"client_credentials\") {\n\t\tconst provider = buildProvider(deps, deps.callbackUrl ?? PASTE_REDIRECT);\n\t\tawait clientCredentialsGrant(provider, deps.flow);\n\t\tawait deps.onReconnect();\n\t\tdeps.notify(`MCP server ${deps.serverName} authenticated (client_credentials)`);\n\t\treturn;\n\t}\n\tif (!deps.hasUI) {\n\t\tdeps.notify(\n\t\t\t`MCP server ${deps.serverName} needs interactive OAuth. Run senpi in a terminal, then: /mcp auth-start ${deps.serverName}  and  /mcp auth-complete ${deps.serverName} <redirect-url>`,\n\t\t\t\"error\",\n\t\t);\n\t\treturn;\n\t}\n\tawait runInteractive(deps);\n}\n\nasync function runInteractive(deps: AuthCommandDeps): Promise<void> {\n\tif (activeInteractiveAuthServers.has(deps.serverName)) {\n\t\tthrow new OAuthFlowError(\n\t\t\t\"needs_auth\",\n\t\t\t`MCP server ${deps.serverName} authorization is already in progress; complete the existing browser flow or retry after it finishes.`,\n\t\t\t{ serverName: deps.serverName },\n\t\t);\n\t}\n\tactiveInteractiveAuthServers.add(deps.serverName);\n\tlet provider: McpOAuthProvider | undefined;\n\tlet channel: Awaited<ReturnType<typeof openCallbackChannel>> | undefined;\n\tconst oauth = deps.config.oauth;\n\tlet callbackPort: number | undefined;\n\tif (\n\t\t(deps.callbackUrl === undefined || deps.callbackUrl.length === 0) &&\n\t\toauth?.clientId !== undefined &&\n\t\toauth.clientMetadataUrl === undefined\n\t) {\n\t\tcallbackPort = oauth.callbackPort;\n\t}\n\ttry {\n\t\tchannel = await openCallbackChannel({\n\t\t\toverrideUrl: deps.callbackUrl,\n\t\t\tport: callbackPort,\n\t\t\tserverName: deps.serverName,\n\t\t\tvalidateState: (state) => provider?.consumeState(state) ?? false,\n\t\t});\n\t\tconst loopbackResult = channel.usesLoopback ? channel.waitForCode() : undefined;\n\t\tprovider = buildProvider(deps, channel.redirectUrl, (url) => deps.openBrowser?.(url));\n\t\tconst begin = await beginAuthorization(provider, deps.flow);\n\t\tif (begin.authorizationUrl !== undefined) deps.notify(`Opening browser to authorize ${deps.serverName}...`);\n\t\tif (!channel.usesLoopback) {\n\t\t\tdeps.pending.set(deps.serverName, provider);\n\t\t\tif (begin.authorizationUrl === undefined) {\n\t\t\t\tthrow new OAuthFlowError(\n\t\t\t\t\t\"needs_auth\",\n\t\t\t\t\t`MCP server ${deps.serverName} did not produce an authorization URL.`,\n\t\t\t\t\t{\n\t\t\t\t\t\tserverName: deps.serverName,\n\t\t\t\t\t},\n\t\t\t\t);\n\t\t\t}\n\t\t\tdeps.notify(\n\t\t\t\t`Complete the browser flow, then run /mcp auth-complete ${deps.serverName} <redirect-url> with the final redirect URL.`,\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\t\tconst { code } = await (loopbackResult ?? channel.waitForCode());\n\t\tawait finishAuthorization(provider, code, deps.flow);\n\t\tawait deps.onReconnect();\n\t\tdeps.notify(`MCP server ${deps.serverName} authorized`);\n\t} finally {\n\t\tactiveInteractiveAuthServers.delete(deps.serverName);\n\t\tawait channel?.close();\n\t}\n}\n\n// `/mcp auth-start <server>`: print the authorize URL for a browser-less paste.\nexport async function runAuthStart(deps: AuthCommandDeps): Promise<string> {\n\tensureOAuth(deps);\n\tconst provider = buildProvider(deps, deps.callbackUrl ?? PASTE_REDIRECT);\n\tconst begin = await beginAuthorization(provider, deps.flow);\n\tconst url = begin.authorizationUrl;\n\tif (url === undefined) {\n\t\tthrow new OAuthFlowError(\"needs_auth\", `MCP server ${deps.serverName} did not produce an authorization URL.`, {\n\t\t\tserverName: deps.serverName,\n\t\t});\n\t}\n\tdeps.pending.set(deps.serverName, provider);\n\tdeps.notify(\n\t\t`Open this URL, approve, then run /mcp auth-complete ${deps.serverName} <redirect-url>:\\n${url.toString()}`,\n\t);\n\treturn url.toString();\n}\n\n// `/mcp auth-complete <server> <redirect-url>`: finish the paste flow.\nexport async function runAuthComplete(deps: AuthCommandDeps, redirectUrl: string): Promise<void> {\n\tensureOAuth(deps);\n\tconst pending = deps.pending.get(deps.serverName);\n\tconst provider = pending ?? buildProvider(deps, deps.callbackUrl ?? PASTE_REDIRECT);\n\tawait completeAuthorization(provider, redirectUrl, deps.flow);\n\tdeps.pending.delete(deps.serverName);\n\tawait deps.onReconnect();\n\tdeps.notify(`MCP server ${deps.serverName} authorized`);\n}\n\n// `/mcp logout <server>`: clear stored credentials.\nexport async function runLogout(deps: AuthCommandDeps): Promise<void> {\n\tconst provider = buildProvider(deps, PASTE_REDIRECT);\n\tawait logout(provider);\n\tdeps.pending.delete(deps.serverName);\n\tawait deps.onReconnect();\n\tdeps.notify(`MCP server ${deps.serverName} logged out`);\n}\n"]}

package/dist/core/extensions/builtin/mcp/auth/context.d.ts

@@ -0,0 +1,23 @@
+import type { McpServerConfig } from "../config-schema.ts";
+import type { McpLogger } from "../log.ts";
+import { McpOAuthProvider } from "./oauth-provider.ts";
+import { McpRefreshManager } from "./oauth-refresh.ts";
+export type ServerAuthMode = "none" | "bearer" | "oauth";
+export interface ServerAuthDeps {
+    serverName: string;
+    config: McpServerConfig;
+    agentDir?: string;
+    env?: Record<string, string | undefined>;
+    logger?: McpLogger;
+    redirectUrl?: string | URL;
+    onRedirect?: (url: URL) => void | Promise<void>;
+}
+export interface ServerAuthPlan {
+    mode: ServerAuthMode;
+    provider?: McpOAuthProvider;
+    refresh?: McpRefreshManager;
+}
+export declare function resolveAuthMode(config: McpServerConfig): ServerAuthMode;
+export declare function resolveServerAuth(deps: ServerAuthDeps): ServerAuthPlan;
+export declare function detectLiteralBearerWarnings(serverName: string, config: McpServerConfig): string[];
+//# sourceMappingURL=context.d.ts.map

package/dist/core/extensions/builtin/mcp/auth/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../../../../src/core/extensions/builtin/mcp/auth/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAGvD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;AAMzD,MAAM,WAAW,cAAc;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,eAAe,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IAC3B,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,cAAc,CAAC;IACrB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAID,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,cAAc,CAOvE;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CAoBtE;AAMD,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,MAAM,EAAE,CAWjG"}

package/dist/core/extensions/builtin/mcp/auth/context.js

@@ -0,0 +1,59 @@
+import { fingerprintSecret } from "../log.js";
+import { McpOAuthProvider } from "./oauth-provider.js";
+import { McpRefreshManager } from "./oauth-refresh.js";
+import { McpTokenStore } from "./token-store.js";
+// Placeholder loopback redirect for background (non-interactive) connects; the
+// real callback URL is supplied by /mcp auth. Never actually dereferenced.
+const BACKGROUND_REDIRECT = "http://127.0.0.1:0/callback";
+// OAuth autodetect (#158): headers or an explicit non-oauth `auth` disable it so
+// API-key servers never trigger DCR/discovery.
+export function resolveAuthMode(config) {
+    if (config.auth === "oauth")
+        return "oauth";
+    if (config.auth === false)
+        return "none";
+    if (config.auth === "bearer" || config.bearerTokenEnv !== undefined)
+        return "bearer";
+    if (config.headers !== undefined && Object.keys(config.headers).length > 0)
+        return "none";
+    if (config.type === "http" && typeof config.url === "string" && config.url.length > 0)
+        return "oauth";
+    return "none";
+}
+export function resolveServerAuth(deps) {
+    const mode = resolveAuthMode(deps.config);
+    if (mode !== "oauth")
+        return { mode };
+    const serverUrl = deps.config.url ?? "";
+    const store = new McpTokenStore({ agentDir: deps.agentDir, serverName: deps.serverName, serverUrl });
+    const provider = new McpOAuthProvider({
+        serverName: deps.serverName,
+        serverUrl,
+        store,
+        // A redirect URL must be present so the SDK selects the authorization-code
+        // flow and raises UnauthorizedError (-> needs_auth) on a token-less connect,
+        // rather than falling through to a client_credentials token request.
+        redirectUrl: deps.redirectUrl ?? BACKGROUND_REDIRECT,
+        scopes: deps.config.oauth?.scopes,
+        clientId: deps.config.oauth?.clientId,
+        clientMetadataUrl: deps.config.oauth?.clientMetadataUrl,
+        logger: deps.logger,
+        onRedirect: deps.onRedirect,
+    });
+    return { mode, provider, refresh: new McpRefreshManager(provider) };
+}
+const LITERAL_SECRET = /(?:bearer\s+\S|sk-[a-z0-9]|[a-z0-9]{24,})/i;
+// Warn (never block) when a plaintext token is embedded in headers instead of a
+// ${VAR} reference. Emits fingerprints only, never the raw value.
+export function detectLiteralBearerWarnings(serverName, config) {
+    const warnings = [];
+    for (const [header, value] of Object.entries(config.headers ?? {})) {
+        if (value.includes("${"))
+            continue;
+        if (LITERAL_SECRET.test(value)) {
+            warnings.push(`MCP server ${serverName} header '${header}' appears to contain a literal secret (fp ${fingerprintSecret(value)}); use \${ENV_VAR} so the token stays out of the config file.`);
+        }
+    }
+    return warnings;
+}
+//# sourceMappingURL=context.js.map

package/dist/core/extensions/builtin/mcp/auth/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../../../../../src/core/extensions/builtin/mcp/auth/context.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAIjD,+EAA+E;AAC/E,2EAA2E;AAC3E,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AAkB1D,iFAAiF;AACjF,+CAA+C;AAC/C,MAAM,UAAU,eAAe,CAAC,MAAuB;IACtD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5C,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,MAAM,CAAC;IACzC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACrF,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAC1F,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACtG,OAAO,MAAM,CAAC;AACf,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAoB;IACrD,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;IACrG,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC;QACrC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS;QACT,KAAK;QACL,2EAA2E;QAC3E,6EAA6E;QAC7E,qEAAqE;QACrE,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,mBAAmB;QACpD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM;QACjC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ;QACrC,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,iBAAiB;QACvD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC3B,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,cAAc,GAAG,4CAA4C,CAAC;AAEpE,gFAAgF;AAChF,kEAAkE;AAClE,MAAM,UAAU,2BAA2B,CAAC,UAAkB,EAAE,MAAuB;IACtF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CACZ,cAAc,UAAU,YAAY,MAAM,6CAA6C,iBAAiB,CAAC,KAAK,CAAC,+DAA+D,CAC9K,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC","sourcesContent":["import type { McpServerConfig } from \"../config-schema.ts\";\nimport type { McpLogger } from \"../log.ts\";\nimport { fingerprintSecret } from \"../log.ts\";\nimport { McpOAuthProvider } from \"./oauth-provider.ts\";\nimport { McpRefreshManager } from \"./oauth-refresh.ts\";\nimport { McpTokenStore } from \"./token-store.ts\";\n\nexport type ServerAuthMode = \"none\" | \"bearer\" | \"oauth\";\n\n// Placeholder loopback redirect for background (non-interactive) connects; the\n// real callback URL is supplied by /mcp auth. Never actually dereferenced.\nconst BACKGROUND_REDIRECT = \"http://127.0.0.1:0/callback\";\n\nexport interface ServerAuthDeps {\n\tserverName: string;\n\tconfig: McpServerConfig;\n\tagentDir?: string;\n\tenv?: Record<string, string | undefined>;\n\tlogger?: McpLogger;\n\tredirectUrl?: string | URL;\n\tonRedirect?: (url: URL) => void | Promise<void>;\n}\n\nexport interface ServerAuthPlan {\n\tmode: ServerAuthMode;\n\tprovider?: McpOAuthProvider;\n\trefresh?: McpRefreshManager;\n}\n\n// OAuth autodetect (#158): headers or an explicit non-oauth `auth` disable it so\n// API-key servers never trigger DCR/discovery.\nexport function resolveAuthMode(config: McpServerConfig): ServerAuthMode {\n\tif (config.auth === \"oauth\") return \"oauth\";\n\tif (config.auth === false) return \"none\";\n\tif (config.auth === \"bearer\" || config.bearerTokenEnv !== undefined) return \"bearer\";\n\tif (config.headers !== undefined && Object.keys(config.headers).length > 0) return \"none\";\n\tif (config.type === \"http\" && typeof config.url === \"string\" && config.url.length > 0) return \"oauth\";\n\treturn \"none\";\n}\n\nexport function resolveServerAuth(deps: ServerAuthDeps): ServerAuthPlan {\n\tconst mode = resolveAuthMode(deps.config);\n\tif (mode !== \"oauth\") return { mode };\n\tconst serverUrl = deps.config.url ?? \"\";\n\tconst store = new McpTokenStore({ agentDir: deps.agentDir, serverName: deps.serverName, serverUrl });\n\tconst provider = new McpOAuthProvider({\n\t\tserverName: deps.serverName,\n\t\tserverUrl,\n\t\tstore,\n\t\t// A redirect URL must be present so the SDK selects the authorization-code\n\t\t// flow and raises UnauthorizedError (-> needs_auth) on a token-less connect,\n\t\t// rather than falling through to a client_credentials token request.\n\t\tredirectUrl: deps.redirectUrl ?? BACKGROUND_REDIRECT,\n\t\tscopes: deps.config.oauth?.scopes,\n\t\tclientId: deps.config.oauth?.clientId,\n\t\tclientMetadataUrl: deps.config.oauth?.clientMetadataUrl,\n\t\tlogger: deps.logger,\n\t\tonRedirect: deps.onRedirect,\n\t});\n\treturn { mode, provider, refresh: new McpRefreshManager(provider) };\n}\n\nconst LITERAL_SECRET = /(?:bearer\\s+\\S|sk-[a-z0-9]|[a-z0-9]{24,})/i;\n\n// Warn (never block) when a plaintext token is embedded in headers instead of a\n// ${VAR} reference. Emits fingerprints only, never the raw value.\nexport function detectLiteralBearerWarnings(serverName: string, config: McpServerConfig): string[] {\n\tconst warnings: string[] = [];\n\tfor (const [header, value] of Object.entries(config.headers ?? {})) {\n\t\tif (value.includes(\"${\")) continue;\n\t\tif (LITERAL_SECRET.test(value)) {\n\t\t\twarnings.push(\n\t\t\t\t`MCP server ${serverName} header '${header}' appears to contain a literal secret (fp ${fingerprintSecret(value)}); use \\${ENV_VAR} so the token stays out of the config file.`,\n\t\t\t);\n\t\t}\n\t}\n\treturn warnings;\n}\n"]}

package/dist/core/extensions/builtin/mcp/auth/oauth-errors.d.ts

@@ -0,0 +1,10 @@
+import { AuthError, type McpErrorOptions } from "../errors.ts";
+export type OAuthFailureKind = "s256_unsupported" | "needs_auth" | "invalid_grant" | "transient" | "state_mismatch" | "expired_code" | "no_verifier" | "headless" | "missing_env";
+export declare class OAuthFlowError extends AuthError {
+    readonly oauthKind: OAuthFailureKind;
+    readonly terminal: boolean;
+    constructor(oauthKind: OAuthFailureKind, message: string, options?: McpErrorOptions);
+}
+export declare function isInvalidGrant(error: unknown): boolean;
+export declare function isTransientTokenError(error: unknown): boolean;
+//# sourceMappingURL=oauth-errors.d.ts.map

package/dist/core/extensions/builtin/mcp/auth/oauth-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-errors.d.ts","sourceRoot":"","sources":["../../../../../../src/core/extensions/builtin/mcp/auth/oauth-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAI/D,MAAM,MAAM,gBAAgB,GACzB,kBAAkB,GAClB,YAAY,GACZ,eAAe,GACf,WAAW,GACX,gBAAgB,GAChB,cAAc,GACd,aAAa,GACb,UAAU,GACV,aAAa,CAAC;AAEjB,qBAAa,cAAe,SAAQ,SAAS;IAC5C,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAE3B,YAAY,SAAS,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,EAKtF;CACD;AAgBD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAKtD;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAM7D"}

package/dist/core/extensions/builtin/mcp/auth/oauth-errors.js

@@ -0,0 +1,50 @@
+import { AuthError } from "../errors.js";
+export class OAuthFlowError extends AuthError {
+    constructor(oauthKind, message, options = {}) {
+        super(message, options);
+        this.name = "OAuthFlowError";
+        this.oauthKind = oauthKind;
+        this.terminal = TERMINAL_KINDS.has(oauthKind);
+    }
+}
+const TERMINAL_KINDS = new Set([
+    "s256_unsupported",
+    "needs_auth",
+    "invalid_grant",
+    "state_mismatch",
+    "expired_code",
+    "no_verifier",
+    "headless",
+    "missing_env",
+]);
+const TERMINAL_OAUTH_CODES = new Set(["invalid_grant", "invalid_token", "invalid_client", "unauthorized_client"]);
+const TRANSIENT_OAUTH_CODES = new Set(["temporarily_unavailable", "server_error", "slow_down"]);
+export function isInvalidGrant(error) {
+    const code = oauthErrorCode(error);
+    if (code !== undefined)
+        return TERMINAL_OAUTH_CODES.has(code);
+    const text = errorText(error).toLowerCase();
+    return text.includes("invalid_grant") || text.includes("invalid_token");
+}
+export function isTransientTokenError(error) {
+    if (isInvalidGrant(error))
+        return false;
+    const code = oauthErrorCode(error);
+    if (code !== undefined && TRANSIENT_OAUTH_CODES.has(code))
+        return true;
+    const text = errorText(error).toLowerCase();
+    return /\b(?:500|502|503|504)\b/.test(text) || text.includes("econnrefused") || text.includes("network");
+}
+// SDK OAuth errors expose a machine-readable `errorCode` (RFC 6749 §5.2).
+function oauthErrorCode(error) {
+    if (typeof error !== "object" || error === null)
+        return undefined;
+    const code = error.errorCode;
+    return typeof code === "string" ? code : undefined;
+}
+function errorText(error) {
+    if (error instanceof Error)
+        return `${error.name} ${error.message}`;
+    return String(error);
+}
+//# sourceMappingURL=oauth-errors.js.map

package/dist/core/extensions/builtin/mcp/auth/oauth-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-errors.js","sourceRoot":"","sources":["../../../../../../src/core/extensions/builtin/mcp/auth/oauth-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAwB,MAAM,cAAc,CAAC;AAe/D,MAAM,OAAO,cAAe,SAAQ,SAAS;IAI5C,YAAY,SAA2B,EAAE,OAAe,EAAE,OAAO,GAAoB,EAAE;QACtF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;CACD;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAmB;IAChD,kBAAkB;IAClB,YAAY;IACZ,eAAe;IACf,gBAAgB;IAChB,cAAc;IACd,aAAa;IACb,UAAU;IACV,aAAa;CACb,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAClH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,yBAAyB,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC;AAEhG,MAAM,UAAU,cAAc,CAAC,KAAc;IAC5C,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IACnD,IAAI,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,IAAI,KAAK,SAAS,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,OAAO,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC1G,CAAC;AAED,0EAA0E;AAC1E,SAAS,cAAc,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,IAAI,GAAI,KAAiC,CAAC,SAAS,CAAC;IAC1D,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAChC,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;IACpE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC","sourcesContent":["import { AuthError, type McpErrorOptions } from \"../errors.ts\";\n\n// Distinguishes terminal auth failures (drop credentials, require re-auth) from\n// transient ones (retry, keep credentials) and specific refusals.\nexport type OAuthFailureKind =\n\t| \"s256_unsupported\"\n\t| \"needs_auth\"\n\t| \"invalid_grant\"\n\t| \"transient\"\n\t| \"state_mismatch\"\n\t| \"expired_code\"\n\t| \"no_verifier\"\n\t| \"headless\"\n\t| \"missing_env\";\n\nexport class OAuthFlowError extends AuthError {\n\treadonly oauthKind: OAuthFailureKind;\n\treadonly terminal: boolean;\n\n\tconstructor(oauthKind: OAuthFailureKind, message: string, options: McpErrorOptions = {}) {\n\t\tsuper(message, options);\n\t\tthis.name = \"OAuthFlowError\";\n\t\tthis.oauthKind = oauthKind;\n\t\tthis.terminal = TERMINAL_KINDS.has(oauthKind);\n\t}\n}\n\nconst TERMINAL_KINDS = new Set<OAuthFailureKind>([\n\t\"s256_unsupported\",\n\t\"needs_auth\",\n\t\"invalid_grant\",\n\t\"state_mismatch\",\n\t\"expired_code\",\n\t\"no_verifier\",\n\t\"headless\",\n\t\"missing_env\",\n]);\n\nconst TERMINAL_OAUTH_CODES = new Set([\"invalid_grant\", \"invalid_token\", \"invalid_client\", \"unauthorized_client\"]);\nconst TRANSIENT_OAUTH_CODES = new Set([\"temporarily_unavailable\", \"server_error\", \"slow_down\"]);\n\nexport function isInvalidGrant(error: unknown): boolean {\n\tconst code = oauthErrorCode(error);\n\tif (code !== undefined) return TERMINAL_OAUTH_CODES.has(code);\n\tconst text = errorText(error).toLowerCase();\n\treturn text.includes(\"invalid_grant\") || text.includes(\"invalid_token\");\n}\n\nexport function isTransientTokenError(error: unknown): boolean {\n\tif (isInvalidGrant(error)) return false;\n\tconst code = oauthErrorCode(error);\n\tif (code !== undefined && TRANSIENT_OAUTH_CODES.has(code)) return true;\n\tconst text = errorText(error).toLowerCase();\n\treturn /\\b(?:500|502|503|504)\\b/.test(text) || text.includes(\"econnrefused\") || text.includes(\"network\");\n}\n\n// SDK OAuth errors expose a machine-readable `errorCode` (RFC 6749 §5.2).\nfunction oauthErrorCode(error: unknown): string | undefined {\n\tif (typeof error !== \"object\" || error === null) return undefined;\n\tconst code = (error as { errorCode?: unknown }).errorCode;\n\treturn typeof code === \"string\" ? code : undefined;\n}\n\nfunction errorText(error: unknown): string {\n\tif (error instanceof Error) return `${error.name} ${error.message}`;\n\treturn String(error);\n}\n"]}

package/dist/core/extensions/builtin/mcp/auth/oauth-provider.d.ts

@@ -0,0 +1,45 @@
+import type { OAuthClientProvider, OAuthDiscoveryState } from "@modelcontextprotocol/sdk/client/auth.js";
+import type { OAuthClientInformationFull, OAuthClientInformationMixed, OAuthClientMetadata, OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
+import type { McpLogger } from "../log.ts";
+import type { McpStoredAuth, McpTokenStore } from "./token-store.ts";
+export declare const REFRESH_LEEWAY_MS: number;
+export interface McpOAuthProviderOptions {
+    serverName: string;
+    serverUrl: string;
+    store: McpTokenStore;
+    redirectUrl?: string | URL;
+    scopes?: string[];
+    clientId?: string;
+    clientMetadataUrl?: string;
+    logger?: McpLogger;
+    onRedirect?: (url: URL) => void | Promise<void>;
+}
+export declare function tokenExpiresAt(tokens: OAuthTokens, now?: number): number | undefined;
+export declare function storedAuthToTokens(record: McpStoredAuth | undefined, now?: number): OAuthTokens | undefined;
+export declare function mergeTokensIntoStoredAuth(current: McpStoredAuth | undefined, tokens: OAuthTokens, serverUrl: string): McpStoredAuth;
+export declare class McpOAuthProvider implements OAuthClientProvider {
+    #private;
+    constructor(options: McpOAuthProviderOptions);
+    get lastAuthorizationUrl(): URL | undefined;
+    get redirectUrl(): string | URL | undefined;
+    get clientMetadataUrl(): string | undefined;
+    get clientMetadata(): OAuthClientMetadata;
+    state(): string;
+    consumeState(candidate: string | undefined): boolean;
+    clientInformation(): OAuthClientInformationMixed | undefined;
+    saveClientInformation(info: OAuthClientInformationFull): Promise<void>;
+    saveDiscoveryState(state: OAuthDiscoveryState): Promise<void>;
+    discoveryState(): OAuthDiscoveryState | undefined;
+    tokens(): OAuthTokens | undefined;
+    saveTokens(tokens: OAuthTokens): Promise<void>;
+    saveCodeVerifier(codeVerifier: string): Promise<void>;
+    codeVerifier(): string;
+    redirectToAuthorization(authorizationUrl: URL): Promise<void>;
+    validateResourceURL(serverUrl: string | URL, resource?: string): Promise<URL | undefined>;
+    invalidateCredentials(scope: "all" | "client" | "tokens" | "verifier" | "discovery"): Promise<void>;
+    get serverName(): string;
+    get serverUrl(): string;
+    get store(): McpTokenStore;
+    get scopes(): string[] | undefined;
+}
+//# sourceMappingURL=oauth-provider.d.ts.map

package/dist/core/extensions/builtin/mcp/auth/oauth-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider.d.ts","sourceRoot":"","sources":["../../../../../../src/core/extensions/builtin/mcp/auth/oauth-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACzG,OAAO,KAAK,EACX,0BAA0B,EAC1B,2BAA2B,EAC3B,mBAAmB,EACnB,WAAW,EACX,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAG3C,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGrE,eAAO,MAAM,iBAAiB,QAAgB,CAAC;AAE/C,MAAM,WAAW,uBAAuB;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,aAAa,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,SAAa,GAAG,MAAM,GAAG,SAAS,CAGxF;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,EAAE,GAAG,SAAa,GAAG,WAAW,GAAG,SAAS,CAU/G;AAED,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,MAAM,EAAE,WAAW,EACnB,SAAS,EAAE,MAAM,GACf,aAAa,CAYf;AAKD,qBAAa,gBAAiB,YAAW,mBAAmB;;IAK3D,YAAY,OAAO,EAAE,uBAAuB,EAE3C;IAED,IAAI,oBAAoB,IAAI,GAAG,GAAG,SAAS,CAE1C;IAED,IAAI,WAAW,IAAI,MAAM,GAAG,GAAG,GAAG,SAAS,CAE1C;IAED,IAAI,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAE1C;IAED,IAAI,cAAc,IAAI,mBAAmB,CAUxC;IAED,KAAK,IAAI,MAAM,CAGd;IAGD,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAInD;IAED,iBAAiB,IAAI,2BAA2B,GAAG,SAAS,CAI3D;IAEK,qBAAqB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3E;IAEK,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAElE;IAED,cAAc,IAAI,mBAAmB,GAAG,SAAS,CAEhD;IAED,MAAM,IAAI,WAAW,GAAG,SAAS,CAEhC;IAEK,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAGnD;IAEK,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;IAED,YAAY,IAAI,MAAM,CAQrB;IAEK,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAGlE;IAGD,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAExF;IAEK,qBAAqB,CAAC,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBxG;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IACD,IAAI,SAAS,IAAI,MAAM,CAEtB;IACD,IAAI,KAAK,IAAI,aAAa,CAEzB;IACD,IAAI,MAAM,IAAI,MAAM,EAAE,GAAG,SAAS,CAEjC;CASD"}