@cybedefend/vibedefend 1.5.0 → 1.7.0

package/dist/mcp/auth/store.js

@@ -0,0 +1,260 @@
+/**
+ * Credentials obtained from THIRD-PARTY MCP servers.
+ *
+ * ─── Why a store of its own, rather than `src/auth/auth-store.ts` ───────────
+ *
+ * `auth-store.ts` is cut for the single CybeDefend session: its type demands
+ * `logtoEndpoint` / `cliAppId` / `logtoResource`, and its file fallback holds
+ * one entry. Here there is one credential PER MCP SERVER — a Linear token has
+ * no business at Notion.
+ *
+ * Where the bytes end up is `secrets.ts`'s problem: keychain on macOS, secret
+ * service on Linux, DPAPI on Windows, and an encrypted file when none of
+ * those answers. This file only decides what is worth keeping, when a
+ * credential is still good, and when it has to be erased.
+ *
+ * It never throws: an unreadable credential behaves like an absent one and
+ * the caller asks for a new authorization.
+ *
+ * ─── Tests never touch the real store ───────────────────────────────────────
+ *
+ * Every entry point takes a `backend` in its dependencies. `pnpm test` may run
+ * on a developer's machine, and a test that wrote into the real keychain
+ * during the suite would be exactly the class of damage the plan forbids for
+ * `~/.cybedefend/`, extended to the system keychain.
+ */
+import { mcpHomeDir } from '../proxy/paths.js';
+import { canonicalMcpUrl, mcpAuthKey, refreshMcpToken } from './oauth.js';
+import { selectSecretBackend, } from './secrets.js';
+export { MCP_KEYCHAIN_SERVICE } from './secrets.js';
+/**
+ * Choosing a backend runs a real write/read/delete round trip, so the result
+ * is kept. A proxy session reads its token once and refreshes it rarely;
+ * paying three keychain calls every time would be visible.
+ *
+ * Keyed by the directory the credentials live in, not process-wide: two calls
+ * with different environments are two different stores, and a cache that
+ * ignored that would hand the second one the first one's backend — which is
+ * a test suite quietly writing into the developer's real keychain.
+ */
+const selected = new Map();
+function backendFor(deps) {
+    if (deps.backend)
+        return deps.backend;
+    const key = deps.dir ?? mcpHomeDir(deps.env ?? process.env);
+    const known = selected.get(key);
+    if (known)
+        return known.backend;
+    const chosen = selectSecretBackend(deps);
+    selected.set(key, chosen);
+    return chosen.backend;
+}
+/** Forgets the cached choices. For tests, and for `vibedefend doctor`. */
+export function resetSecretBackend() {
+    selected.clear();
+}
+/**
+ * Persists a server's credential.
+ *
+ * Returns `false` when nothing could be written anywhere. That distinction
+ * matters: a store that silently failed would have the caller believe the
+ * authorization was kept, and the next read return `null` — the user is sent
+ * back to the browser every session with no explanation, the worst of both
+ * worlds. `secrets.ts` already announced the degradation from the platform
+ * store to the encrypted file; this is the case where even that failed.
+ */
+export function storeMcpAuth(serverUrl, auth, deps = {}) {
+    try {
+        backendFor(deps).set(mcpAuthKey(serverUrl), JSON.stringify(auth));
+        return true;
+    }
+    catch {
+        // The error is deliberately not propagated or interpolated: its message
+        // comes from a command that was handed a token.
+        return false;
+    }
+}
+export function mcpClientKey(serverUrl) {
+    return `mcp-client|${canonicalMcpUrl(serverUrl) ?? serverUrl.trim().toLowerCase()}`;
+}
+export function storeMcpClient(serverUrl, client, deps = {}) {
+    try {
+        backendFor(deps).set(mcpClientKey(serverUrl), JSON.stringify(client));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function loadMcpClient(serverUrl, deps = {}) {
+    let blob;
+    try {
+        blob = backendFor(deps).get(mcpClientKey(serverUrl));
+    }
+    catch {
+        return null;
+    }
+    if (!blob)
+        return null;
+    try {
+        const parsed = JSON.parse(blob);
+        if (typeof parsed.clientId !== 'string' || parsed.clientId === '')
+            return null;
+        return {
+            clientId: parsed.clientId,
+            clientSecret: typeof parsed.clientSecret === 'string' ? parsed.clientSecret : null,
+            callbackPort: typeof parsed.callbackPort === 'number' ? parsed.callbackPort : null,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function clearMcpClient(serverUrl, deps = {}) {
+    try {
+        backendFor(deps).delete(mcpClientKey(serverUrl));
+    }
+    catch {
+        /* already gone, or the store is unavailable */
+    }
+}
+/** A server's credential, or `null`. */
+export function loadMcpAuth(serverUrl, deps = {}) {
+    let blob;
+    try {
+        blob = backendFor(deps).get(mcpAuthKey(serverUrl));
+    }
+    catch {
+        return null;
+    }
+    if (!blob)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(blob);
+    }
+    catch {
+        return null;
+    }
+    if (typeof parsed.accessToken !== 'string' || parsed.accessToken === '')
+        return null;
+    if (typeof parsed.tokenEndpoint !== 'string' || typeof parsed.clientId !== 'string')
+        return null;
+    // No check on `resource` here. The partitioning between servers is already
+    // structural: the key IS the canonical URL of the server, so a credential
+    // read under it was written for it. The legacy store also indexed by HOST
+    // alone, which is why it needed `resource` to prove ownership; that key is
+    // gone. Re-adding the check would reject a legitimate credential from an
+    // authorization server that names its resource differently from the MCP
+    // endpoint — `https://host/` for `https://host/mcp` is a common shape.
+    return parsed;
+}
+/**
+ * Erases a server's credential.
+ *
+ * Called by `ensureMcpAccessToken` on `invalid_grant`: keeping a dead refresh
+ * token would reproduce the failure on every later call, for ever and
+ * silently. Erasing makes the missing authorization VISIBLE to the caller
+ * (`loadMcpAuth` returns `null`), which can then ask for a reconnection
+ * instead of looping.
+ */
+export function clearMcpAuth(serverUrl, deps = {}) {
+    try {
+        backendFor(deps).delete(mcpAuthKey(serverUrl));
+    }
+    catch {
+        /* already gone, or the store is unavailable */
+    }
+}
+/**
+ * The access token if it is still good, or `null`. NEVER refreshes.
+ *
+ * 60 s of margin: a token that expires while the request is in flight is as
+ * useless as an expired one, and replaying it fails the probe instead of
+ * cleanly asking for a new authorization.
+ */
+export function validMcpAccessToken(serverUrl, deps = {}) {
+    const auth = loadMcpAuth(serverUrl, deps);
+    if (!auth)
+        return null;
+    if (auth.expiresAt && auth.expiresAt - 60_000 <= Date.now())
+        return null;
+    return auth.accessToken;
+}
+/**
+ * Renews the credential whatever the local clock thinks, and persists it.
+ *
+ * `ensureMcpAccessToken` only refreshes a token it believes has expired, which
+ * is the right thing on the happy path and the wrong thing after a 401: a
+ * server that revoked a token, or that expires it earlier than it advertised,
+ * leaves us holding one that looks perfectly valid here. Re-reading the store
+ * would hand back the same dead token and the retry would fail for the same
+ * reason as the first attempt.
+ *
+ * `null` means a new human authorization is needed.
+ */
+export async function refreshMcpAuth(serverUrl, deps = {}) {
+    const auth = loadMcpAuth(serverUrl, deps);
+    if (!auth || !auth.refreshToken)
+        return null;
+    const outcome = await (deps.refreshFn ?? refreshMcpToken)({
+        tokenEndpoint: auth.tokenEndpoint,
+        clientId: auth.clientId,
+        clientSecret: auth.clientSecret,
+        refreshToken: auth.refreshToken,
+        resource: auth.resource,
+    });
+    if (!outcome.ok) {
+        if (outcome.reason === 'invalid_grant')
+            clearMcpAuth(serverUrl, deps);
+        return null;
+    }
+    const renewed = { ...auth, ...outcome.tokens };
+    storeMcpAuth(serverUrl, renewed, deps);
+    return renewed.accessToken;
+}
+/**
+ * A usable access token, renewing if needed.
+ *
+ * `validMcpAccessToken` only reports the expiry; this repairs it. Without it
+ * an authorization does not survive the day and verification stops without a
+ * word — measured on a Linear token that expired within hours.
+ *
+ * `null` means a new human authorization is needed, whether nothing was
+ * stored or the renewal failed.
+ *
+ * An `invalid_grant` erases the local credential: the refresh token is dead.
+ * An `unavailable` (network, transient server failure) does NOT: the
+ * authorization is still good, only this renewal failed, and forcing a human
+ * reconnection for a network blip is a regression, not a protection. A
+ * `suspicious_redirect` is left to the caller, which must not escalate to an
+ * interactive flow against a server that just behaved that way.
+ */
+export async function ensureMcpAccessToken(serverUrl, deps = {}) {
+    const auth = loadMcpAuth(serverUrl, deps);
+    if (!auth)
+        return null;
+    const stillValid = !auth.expiresAt || auth.expiresAt - 60_000 > Date.now();
+    if (stillValid)
+        return auth.accessToken;
+    if (!auth.refreshToken)
+        return null;
+    const outcome = await (deps.refreshFn ?? refreshMcpToken)({
+        tokenEndpoint: auth.tokenEndpoint,
+        clientId: auth.clientId,
+        clientSecret: auth.clientSecret,
+        refreshToken: auth.refreshToken,
+        resource: auth.resource,
+    });
+    if (!outcome.ok) {
+        if (outcome.reason === 'invalid_grant')
+            clearMcpAuth(serverUrl, deps);
+        return null;
+    }
+    // Persisted: otherwise every call would replay a renewal, and the NEW
+    // refresh token (rotation) would be lost at the next CLI restart.
+    const renewed = { ...auth, ...outcome.tokens };
+    storeMcpAuth(serverUrl, renewed, deps);
+    return renewed.accessToken;
+}
+//# sourceMappingURL=store.js.map

package/dist/mcp/auth/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/mcp/auth/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,eAAe,EAAuB,MAAM,YAAY,CAAC;AAC/F,OAAO,EACL,mBAAmB,GAIpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAgBpD;;;;;;;;;GASG;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;AAEpD,SAAS,UAAU,CAAC,IAAuB;IACzC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IAChC,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACzC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB;IAChC,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,SAAiB,EACjB,IAAmB,EACnB,OAA0B,EAAE;IAE5B,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,gDAAgD;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAqBD,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,OAAO,cAAc,eAAe,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,SAAiB,EACjB,MAAuB,EACvB,OAA0B,EAAE;IAE5B,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,OAA0B,EAAE;IAC3E,IAAI,IAAmB,CAAC;IACxB,IAAI,CAAC;QACH,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6B,CAAC;QAC5D,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAC/E,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY,EAAE,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;YAClF,YAAY,EAAE,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;SACnF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,OAA0B,EAAE;IAC5E,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;AACH,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,OAA0B,EAAE;IACzE,IAAI,IAAmB,CAAC;IACxB,IAAI,CAAC;QACH,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,MAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACrF,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEjG,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,wEAAwE;IACxE,uEAAuE;IACvE,OAAO,MAAuB,CAAC;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,OAA0B,EAAE;IAC1E,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAiB,EACjB,OAA0B,EAAE;IAE5B,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACzE,OAAO,IAAI,CAAC,WAAW,CAAC;AAC1B,CAAC;AAMD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAiB,EACjB,OAAwB,EAAE;IAE1B,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAE7C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,CAAC;QACxD,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe;YAAE,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAkB,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAC9D,YAAY,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,WAAW,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,OAAwB,EAAE;IAE1B,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3E,IAAI,UAAU;QAAE,OAAO,IAAI,CAAC,WAAW,CAAC;IAExC,IAAI,CAAC,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,CAAC;QACxD,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe;YAAE,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sEAAsE;IACtE,kEAAkE;IAClE,MAAM,OAAO,GAAkB,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAC9D,YAAY,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,WAAW,CAAC;AAC7B,CAAC"}

package/dist/mcp/auth/tokenSource.js

@@ -0,0 +1,55 @@
+import { loadMcpAuth, refreshMcpAuth } from './store.js';
+/** A minute of slack, the same `ensureMcpAccessToken` applies. */
+const EXPIRY_SLACK_MS = 60_000;
+export function createTokenSource(serverUrl, deps = {}) {
+    let cached = null;
+    let inFlight;
+    const resolve = async (previous) => {
+        let stored = null;
+        try {
+            stored = loadMcpAuth(serverUrl, deps);
+        }
+        catch {
+            stored = null;
+        }
+        if (!stored) {
+            deps.onLookup?.('absent');
+            return { token: null, renewed: false };
+        }
+        // A read, and nothing else: the token is good as far as the local clock
+        // knows and the server has not refused it. The first 401 of every session
+        // ends here, since nothing was sent before it.
+        const stillValid = !stored.expiresAt || stored.expiresAt - EXPIRY_SLACK_MS > Date.now();
+        if (stillValid && stored.accessToken !== previous) {
+            deps.onLookup?.('found');
+            return { token: stored.accessToken, renewed: false };
+        }
+        // Either the local clock says it expired, or the store handed back the
+        // very token the server just refused — a server-side revocation, or an
+        // expiry earlier than advertised. Both are repaired the same way, and
+        // both are renewals worth the name.
+        const refreshed = await refreshMcpAuth(serverUrl, deps).catch(() => null);
+        deps.onLookup?.(refreshed ? 'refreshed' : 'absent');
+        return { token: refreshed, renewed: refreshed !== null };
+    };
+    return {
+        async token() {
+            return cached;
+        },
+        async reauthorize(previous) {
+            // Several requests can hit a 401 at once; one lookup is enough for all.
+            if (!inFlight) {
+                inFlight = resolve(previous)
+                    .then((outcome) => {
+                    cached = outcome.token;
+                    return outcome;
+                })
+                    .finally(() => {
+                    inFlight = undefined;
+                });
+            }
+            return inFlight;
+        },
+    };
+}
+//# sourceMappingURL=tokenSource.js.map

package/dist/mcp/auth/tokenSource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenSource.js","sourceRoot":"","sources":["../../../src/mcp/auth/tokenSource.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,WAAW,EAAE,cAAc,EAAwB,MAAM,YAAY,CAAC;AAoB/E,kEAAkE;AAClE,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,OAAwB,EAAE;IAC7E,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,QAA8C,CAAC;IAEnD,MAAM,OAAO,GAAG,KAAK,EAAE,QAAuB,EAA4B,EAAE;QAC1E,IAAI,MAAM,GAAmC,IAAI,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC;YAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACzC,CAAC;QAED,wEAAwE;QACxE,0EAA0E;QAC1E,+CAA+C;QAC/C,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,GAAG,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxF,IAAI,UAAU,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YAClD,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;YACzB,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACvD,CAAC;QAED,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,oCAAoC;QACpC,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC1E,IAAI,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,KAAK,IAAI,EAAE,CAAC;IAC3D,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,KAAK;YACT,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,QAAuB;YACvC,wEAAwE;YACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;qBACzB,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;oBAChB,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;oBACvB,OAAO,OAAO,CAAC;gBACjB,CAAC,CAAC;qBACD,OAAO,CAAC,GAAG,EAAE;oBACZ,QAAQ,GAAG,SAAS,CAAC;gBACvB,CAAC,CAAC,CAAC;YACP,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/mcp/config/atomicWrite.js

@@ -0,0 +1,98 @@
+/**
+ * Replacing a file without ever letting a reader see half of it.
+ *
+ * Write to a sibling, then `rename`. The rename is atomic on every filesystem
+ * we ship to, so a client reading `~/.claude.json` at the moment we replace it
+ * sees the old document or the new one, never a truncated one — and a crash
+ * mid-write leaves the original intact.
+ *
+ * Two things the naive version gets wrong:
+ *
+ *  - **symlinks.** A `~/.claude.json` that is a link into a dotfiles
+ *    repository is a common setup, and `rename` onto the link REPLACES THE
+ *    LINK with a regular file: the repository stops being the source of
+ *    truth, silently, and the next `git pull` in it does nothing visible.
+ *    Resolving the target first means we replace what the link points at,
+ *    which is what the user meant.
+ *  - **Windows.** `rename` fails with `EBUSY` or `EPERM` when an antivirus or
+ *    an editor has the target open for a few milliseconds. It is transient
+ *    and common enough that giving up on the first one loses writes on
+ *    exactly one platform.
+ */
+import { lstatSync, mkdirSync, readlinkSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+/** Attempts, and the pause between them, for the Windows `EBUSY` window. */
+export const RENAME_ATTEMPTS = 5;
+const RENAME_PAUSE_MS = 20;
+/**
+ * Resolves what `path` really points at.
+ *
+ * Three cases. An ordinary file resolves to itself. A link resolves to its
+ * target. And a DANGLING link — a dotfiles repository that has not been
+ * cloned yet — resolves to where it points, which is what `> link` does in a
+ * shell: the target gets created and the link starts working. Replacing the
+ * link with a regular file instead would quietly take the path out of the
+ * repository for good.
+ */
+export function resolveWriteTarget(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        /* it does not exist, or it is a dangling link; both are handled below */
+    }
+    try {
+        if (lstatSync(path).isSymbolicLink()) {
+            return resolve(dirname(path), readlinkSync(path));
+        }
+    }
+    catch {
+        /* not a link either: the caller is creating the file */
+    }
+    return path;
+}
+export function writeFileAtomic(path, content, options = {}) {
+    const target = resolveWriteTarget(path);
+    const temporary = `${target}.${process.pid}.${Date.now()}.tmp`;
+    mkdirSync(dirname(target), { recursive: true, mode: options.directoryMode ?? 0o700 });
+    writeFileSync(temporary, content, { encoding: 'utf8', mode: options.mode ?? 0o600 });
+    try {
+        renameWithRetry(temporary, target, options.sleep ?? busyWait, options.renameFn ?? renameSync);
+    }
+    catch (error) {
+        try {
+            unlinkSync(temporary);
+        }
+        catch {
+            /* nothing to clean up */
+        }
+        throw error;
+    }
+}
+function renameWithRetry(from, to, sleep, rename) {
+    for (let attempt = 1;; attempt += 1) {
+        try {
+            rename(from, to);
+            return;
+        }
+        catch (error) {
+            const code = error.code;
+            const transient = code === 'EBUSY' || code === 'EPERM' || code === 'EACCES';
+            if (!transient || attempt >= RENAME_ATTEMPTS)
+                throw error;
+            sleep(RENAME_PAUSE_MS * attempt);
+        }
+    }
+}
+/**
+ * Synchronous on purpose: every caller here is synchronous, and making them
+ * async to sleep properly would turn a config write into something a caller
+ * could forget to await. The total wait is bounded at 300 ms.
+ */
+function busyWait(ms) {
+    const until = Date.now() + ms;
+    while (Date.now() < until) {
+        /* spin */
+    }
+}
+//# sourceMappingURL=atomicWrite.js.map

package/dist/mcp/config/atomicWrite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomicWrite.js","sourceRoot":"","sources":["../../../src/mcp/config/atomicWrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AACjC,MAAM,eAAe,GAAG,EAAE,CAAC;AAa3B;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;IACD,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;YACrC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,OAAe,EACf,UAA8B,EAAE;IAEhC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;IAE/D,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,aAAa,IAAI,KAAK,EAAE,CAAC,CAAC;IACtF,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;IAErF,IAAI,CAAC;QACH,eAAe,CACb,SAAS,EACT,MAAM,EACN,OAAO,CAAC,KAAK,IAAI,QAAQ,EACzB,OAAO,CAAC,QAAQ,IAAI,UAAU,CAC/B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,UAAU,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,EAAU,EACV,KAA2B,EAC3B,MAA0C;IAE1C,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACjB,OAAO;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;YACnD,MAAM,SAAS,GAAG,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,CAAC;YAC5E,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,eAAe;gBAAE,MAAM,KAAK,CAAC;YAC1D,KAAK,CAAC,eAAe,GAAG,OAAO,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,EAAU;IAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;IAC9B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAC1B,UAAU;IACZ,CAAC;AACH,CAAC"}

package/dist/mcp/config/clients.js

@@ -0,0 +1,171 @@
+/**
+ * The five clients, one adapter each.
+ *
+ * They differ in three ways and no more: where the file lives, what the map
+ * of servers is called inside it, and how an HTTP server is spelled. Keeping
+ * them in one file makes those three differences readable side by side, which
+ * is the only reason anyone opens this module.
+ *
+ * The HTTP spellings, measured against what each client actually writes:
+ *
+ *   Claude Code    {"type":"http","url":…,"headers":{…}}
+ *   Claude Desktop stdio only — it spawns `mcp-remote` for remote servers
+ *   Cursor         {"url":…,"headers":{…}}          (no `type`)
+ *   VS Code        {"type":"http","url":…}          (map is `servers`, not `mcpServers`)
+ *   Windsurf       {"serverUrl":…}                  (its own key)
+ */
+import { join } from 'node:path';
+import { clientConfigRoot, clientConfigRootIsOverridden } from '../proxy/paths.js';
+import { wrappedEntryFor, } from './types.js';
+/** The home directory, or `VIBEDEFEND_MCP_DIR` standing in for it (see `paths.ts`). */
+function home(env) {
+    return clientConfigRoot(env);
+}
+/**
+ * Where a VS Code-family editor keeps its user profile.
+ *
+ * The same layout serves Claude Desktop, which is why it is shared: macOS
+ * puts it under `Application Support`, Windows under `APPDATA`, Linux under
+ * `XDG_CONFIG_HOME` or `~/.config`. When `VIBEDEFEND_MCP_DIR` stands in for
+ * the home directory, `APPDATA` and `XDG_CONFIG_HOME` are ignored too: they
+ * would point back at the real profile.
+ */
+function applicationSupport(env, platform, app) {
+    const isolated = clientConfigRootIsOverridden(env);
+    if (platform === 'darwin')
+        return join(home(env), 'Library', 'Application Support', app);
+    if (platform === 'win32') {
+        const roaming = !isolated && env.APPDATA ? env.APPDATA : join(home(env), 'AppData', 'Roaming');
+        return join(roaming, app);
+    }
+    const xdg = !isolated && env.XDG_CONFIG_HOME ? env.XDG_CONFIG_HOME : join(home(env), '.config');
+    return join(xdg, app);
+}
+/** `{command, args, env, cwd}`, the shape every client accepts. */
+function parseStdio(raw) {
+    const command = typeof raw.command === 'string' ? raw.command : '';
+    if (command === '')
+        return undefined;
+    return {
+        transport: 'stdio',
+        command,
+        args: Array.isArray(raw.args) ? raw.args.map((arg) => String(arg)) : [],
+        env: stringMap(raw.env),
+        cwd: typeof raw.cwd === 'string' ? raw.cwd : undefined,
+    };
+}
+function parseHttp(url, headers) {
+    if (typeof url !== 'string' || !/^https?:\/\//i.test(url))
+        return undefined;
+    return { transport: 'http', url, headers: stringMap(headers) };
+}
+function stringMap(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return undefined;
+    const out = {};
+    for (const [key, entry] of Object.entries(value)) {
+        if (typeof entry === 'string')
+            out[key] = entry;
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}
+function classify(spec) {
+    if (!spec)
+        return { kind: 'unknown' };
+    return { kind: spec.transport, spec };
+}
+/** The common case: one user-level file with an `mcpServers` object. */
+function simpleAdapter(options) {
+    return {
+        id: options.id,
+        label: options.label,
+        locations: (env, platform) => [
+            { client: options.id, file: options.file(env, platform), scope: 'user' },
+        ],
+        serverMaps: () => [{ keys: [options.mapKey] }],
+        parse: (_name, raw) => classify(options.parse(raw)),
+        wrappedEntry: (upstreamName) => wrappedEntryFor(upstreamName),
+    };
+}
+export const claudeCodeAdapter = {
+    id: 'claude-code',
+    label: 'Claude Code',
+    locations: (env) => [{ client: 'claude-code', file: join(home(env), '.claude.json'), scope: 'user' }],
+    /**
+     * Two levels in one file. `mcpServers` at the root is what
+     * `claude mcp add --scope user` writes; `projects.<path>.mcpServers` is
+     * what the default `--scope local` writes, and it is visible only from that
+     * directory. BOTH are discovered and BOTH are rewritten: they live in the
+     * same user-owned file, and the second is where `claude mcp add` writes by
+     * default (see `McpConfigScope`, amended 2026-09-09).
+     */
+    serverMaps: (document, location) => {
+        const maps = [{ keys: ['mcpServers'] }];
+        const projects = document.value.projects;
+        if (typeof projects === 'object' && projects !== null && !Array.isArray(projects)) {
+            for (const projectPath of Object.keys(projects)) {
+                maps.push({ keys: ['projects', projectPath, 'mcpServers'] });
+            }
+        }
+        void location;
+        return maps;
+    },
+    parse: (_name, raw) => classify(raw.type === 'http' || raw.type === 'sse' || typeof raw.url === 'string'
+        ? parseHttp(raw.url, raw.headers)
+        : parseStdio(raw)),
+    wrappedEntry: (upstreamName) => wrappedEntryFor(upstreamName),
+};
+export const cursorAdapter = simpleAdapter({
+    id: 'cursor',
+    label: 'Cursor',
+    file: (env) => join(home(env), '.cursor', 'mcp.json'),
+    mapKey: 'mcpServers',
+    // Cursor tells the two apart by the presence of `url`, not by a `type`.
+    parse: (raw) => (typeof raw.url === 'string' ? parseHttp(raw.url, raw.headers) : parseStdio(raw)),
+});
+export const windsurfAdapter = simpleAdapter({
+    id: 'windsurf',
+    label: 'Windsurf',
+    file: (env) => join(home(env), '.codeium', 'windsurf', 'mcp_config.json'),
+    mapKey: 'mcpServers',
+    parse: (raw) => typeof raw.serverUrl === 'string'
+        ? parseHttp(raw.serverUrl, raw.headers)
+        : typeof raw.url === 'string'
+            ? parseHttp(raw.url, raw.headers)
+            : parseStdio(raw),
+});
+export const vscodeAdapter = simpleAdapter({
+    id: 'vscode',
+    label: 'VS Code',
+    file: (env, platform) => join(applicationSupport(env, platform, 'Code'), 'User', 'mcp.json'),
+    // `servers`, NOT `mcpServers`. Getting this wrong reads an empty file and
+    // reports "no MCP server configured" on a machine full of them.
+    mapKey: 'servers',
+    parse: (raw) => (typeof raw.url === 'string' ? parseHttp(raw.url, raw.headers) : parseStdio(raw)),
+});
+export const claudeDesktopAdapter = simpleAdapter({
+    id: 'claude-desktop',
+    label: 'Claude Desktop',
+    file: (env, platform) => join(applicationSupport(env, platform, 'Claude'), 'claude_desktop_config.json'),
+    mapKey: 'mcpServers',
+    // Claude Desktop has no HTTP transport: a remote server is configured as a
+    // command that spawns `mcp-remote`, so this is stdio-only on purpose.
+    parse: (raw) => parseStdio(raw),
+});
+export const MCP_CLIENT_ADAPTERS = [
+    claudeCodeAdapter,
+    cursorAdapter,
+    vscodeAdapter,
+    windsurfAdapter,
+    claudeDesktopAdapter,
+];
+export function mcpAdapterFor(id) {
+    const adapter = MCP_CLIENT_ADAPTERS.find((candidate) => candidate.id === id);
+    if (!adapter)
+        throw new Error(`no MCP client adapter for "${id}"`);
+    return adapter;
+}
+export function isMcpClientId(value) {
+    return MCP_CLIENT_ADAPTERS.some((adapter) => adapter.id === value);
+}
+//# sourceMappingURL=clients.js.map

package/dist/mcp/config/clients.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clients.js","sourceRoot":"","sources":["../../../src/mcp/config/clients.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAGnF,OAAO,EACL,eAAe,GAMhB,MAAM,YAAY,CAAC;AAEpB,uFAAuF;AACvF,SAAS,IAAI,CAAC,GAAsB;IAClC,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CACzB,GAAsB,EACtB,QAAyB,EACzB,GAAW;IAEX,MAAM,QAAQ,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;IACzF,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAC/F,OAAO,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;IAChG,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AACxB,CAAC;AAED,mEAAmE;AACnE,SAAS,UAAU,CAAC,GAA4B;IAC9C,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,OAAO;QACL,SAAS,EAAE,OAAO;QAClB,OAAO;QACP,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QACvE,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;QACvB,GAAG,EAAE,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;KACvD,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAY,EAAE,OAAgB;IAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC5E,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAClD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,QAAQ,CAAC,IAA8B;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACtC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,wEAAwE;AACxE,SAAS,aAAa,CAAC,OAMtB;IACC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC;YAC5B,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE;SACzE;QACD,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnD,YAAY,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,eAAe,CAAC,YAAY,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAqB;IACjD,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,aAAa;IACpB,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACrG;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,QAAsB,EAAE,QAA2B,EAAmB,EAAE;QACnF,MAAM,IAAI,GAAoB,CAAC,EAAE,IAAI,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;QACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClF,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,QAAmC,CAAC,EAAE,CAAC;gBAC3E,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QACD,KAAK,QAAQ,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACpB,QAAQ,CACN,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QACtE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;QACjC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CACpB;IACH,YAAY,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,eAAe,CAAC,YAAY,CAAC;CAC9D,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;IACzC,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,QAAQ;IACf,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC;IACrD,MAAM,EAAE,YAAY;IACpB,wEAAwE;IACxE,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;CAClG,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;IAC3C,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,UAAU;IACjB,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,CAAC;IACzE,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CACb,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QAC/B,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC;QACvC,CAAC,CAAC,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAC3B,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;YACjC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;IACzC,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC;IAC5F,0EAA0E;IAC1E,gEAAgE;IAChE,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;CAClG,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAC;IAChD,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,gBAAgB;IACvB,IAAI,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CACtB,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,4BAA4B,CAAC;IACjF,MAAM,EAAE,YAAY;IACpB,2EAA2E;IAC3E,sEAAsE;IACtE,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;CAChC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAgC;IAC9D,iBAAiB;IACjB,aAAa;IACb,aAAa;IACb,eAAe;IACf,oBAAoB;CACZ,CAAC;AAEX,MAAM,UAAU,aAAa,CAAC,EAAe;IAC3C,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;IACnE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;AACrE,CAAC"}

package/dist/mcp/config/cybedefend-servers.js

@@ -0,0 +1,48 @@
+/**
+ * CybeDefend's own MCP servers, which the proxy never wraps.
+ *
+ * Wrapping one bought nothing (its tools would be checked against itself) and
+ * cost a second OAuth sign-in, without which the agent lost the CybeDefend
+ * tools; and `vibedefend install` manages that entry itself, so each install
+ * wrote it back in clear and the next sync wrapped it again under another
+ * name.
+ *
+ * Trusted sources only, as `trustedMcpNames` in `uninstall.ts`: the built-in
+ * regions, the region recorded at install time and the user-global
+ * ~/.cybedefend/regions.json. Never the `vibedefend.regions.json` of the
+ * working directory: a cloned repository could list any server there and
+ * take it out of the proxy.
+ */
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { sameMcpUrl } from '../../clients/mcp-url.js';
+import { REGIONS } from '../../config.js';
+function readJsonQuiet(path) {
+    try {
+        return JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+/** The MCP URLs of every CybeDefend region this machine trusts. */
+export function cybedefendMcpUrls(env = process.env) {
+    const dir = join(env.CYBEDEFEND_HOME ?? env.HOME ?? homedir(), '.cybedefend');
+    const urls = REGIONS.map((region) => region.mcpUrl);
+    const runtime = readJsonQuiet(join(dir, 'runtime-config.json'));
+    urls.push(runtime?.region?.mcpUrl);
+    const userRegions = readJsonQuiet(join(dir, 'regions.json'));
+    if (Array.isArray(userRegions)) {
+        for (const region of userRegions) {
+            if (region && typeof region === 'object')
+                urls.push(region.mcpUrl);
+        }
+    }
+    return urls.filter((url) => typeof url === 'string' && url.trim() !== '');
+}
+/** Is `url` one of CybeDefend's own MCP servers? */
+export function isCybeDefendMcpUrl(url, env = process.env) {
+    return cybedefendMcpUrls(env).some((known) => sameMcpUrl(known, url));
+}
+//# sourceMappingURL=cybedefend-servers.js.map