@desplega.ai/agent-swarm 1.158.0 → 1.159.0

package/dist/cli-3gvrr8vj.js

@@ -0,0 +1,1422 @@
+import {
+  FileAuthStorageBackend,
+  JSON_RPC_ERROR_CODES,
+  LATEST_PROTOCOL_VERSION,
+  McpAuthRequiredError,
+  McpClient,
+  McpError,
+  McpHttpError,
+  McpSessionExpiredError,
+  StdioTransport,
+  StreamableHttpTransport,
+  isMcpAppResource,
+  isObject,
+  require_proper_lockfile,
+  resolveConfigValueOrThrow,
+  resolveHeadersOrThrow
+} from "./cli-ejpygnqz.js";
+import {
+  APP_NAME,
+  VERSION,
+  getAgentDir
+} from "./cli-hj65wsts.js";
+import {
+  oauthErrorHtml,
+  oauthSuccessHtml
+} from "./cli-rykfmgwg.js";
+import {
+  __toESM
+} from "./cli-bc05qbss.js";
+
+// node_modules/@earendil-works/pi-coding-agent/dist/extensions/mcp/runtime.js
+import { homedir } from "node:os";
+import { basename, join as join2, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+// node_modules/@earendil-works/pi-mcp/dist/oauth/callback.js
+import { createServer } from "node:http";
+function plainText(page) {
+  if (page.ok)
+    return "Authorization complete. You may close this window.";
+  return page.details ? `${page.message}
+
+${page.details}` : page.message;
+}
+
+class OAuthCallbackServer {
+  redirectUrl;
+  server;
+  path;
+  timeoutMs;
+  renderPage;
+  pending = new Map;
+  constructor(server, redirectUrl, path, timeoutMs, renderPage) {
+    this.server = server;
+    this.redirectUrl = redirectUrl;
+    this.path = path;
+    this.timeoutMs = timeoutMs;
+    this.renderPage = renderPage;
+  }
+  static async listen(options = {}) {
+    const host = options.host ?? "127.0.0.1";
+    const redirectHost = options.redirectHost ?? host;
+    const path = options.path ?? "/callback";
+    let instance;
+    const server = createServer((request, response) => instance?.handle(request.url ?? "/", response));
+    await new Promise((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(options.port ?? 0, host, () => {
+        server.off("error", reject);
+        resolve();
+      });
+    });
+    const address = server.address();
+    if (!address || typeof address === "string")
+      throw new Error("OAuth callback server did not bind to TCP");
+    instance = new OAuthCallbackServer(server, `http://${redirectHost.includes(":") ? `[${redirectHost}]` : redirectHost}:${address.port}${path}`, path, options.timeoutMs ?? 5 * 60000, options.renderPage);
+    return instance;
+  }
+  waitForCallback(state) {
+    if (this.pending.has(state))
+      throw new Error("OAuth state is already pending");
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        this.pending.delete(state);
+        reject(new Error("OAuth callback timed out"));
+      }, this.timeoutMs);
+      this.pending.set(state, { resolve, reject, timer });
+    });
+  }
+  async close() {
+    for (const pending of this.pending.values()) {
+      clearTimeout(pending.timer);
+      pending.reject(new Error("OAuth callback server closed"));
+    }
+    this.pending.clear();
+    await new Promise((resolve, reject) => {
+      this.server.close((error) => error ? reject(error) : resolve());
+    });
+  }
+  reply(response, status, page) {
+    if (this.renderPage) {
+      response.writeHead(status, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
+      response.end(this.renderPage(page));
+    } else {
+      response.writeHead(status, { "content-type": "text/plain; charset=utf-8" }).end(plainText(page));
+    }
+  }
+  handle(rawUrl, response) {
+    const url = new URL(rawUrl, this.redirectUrl);
+    if (url.pathname !== this.path) {
+      this.reply(response, 404, { ok: false, message: "Not found" });
+      return;
+    }
+    const state = url.searchParams.get("state");
+    const pending = state ? this.pending.get(state) : undefined;
+    if (!state || !pending) {
+      this.reply(response, 400, { ok: false, message: "Invalid or expired OAuth state" });
+      return;
+    }
+    clearTimeout(pending.timer);
+    this.pending.delete(state);
+    const error = url.searchParams.get("error");
+    if (error) {
+      const description = url.searchParams.get("error_description") ?? error;
+      pending.reject(new Error(description));
+      this.reply(response, 200, {
+        ok: false,
+        message: "Authorization failed. You may close this window.",
+        details: description
+      });
+      return;
+    }
+    const code = url.searchParams.get("code");
+    if (!code) {
+      pending.reject(new Error("OAuth callback did not include an authorization code"));
+      this.reply(response, 400, { ok: false, message: "Missing authorization code" });
+      return;
+    }
+    const iss = url.searchParams.get("iss");
+    pending.resolve({ code, state, ...iss ? { iss } : {} });
+    this.reply(response, 200, { ok: true });
+  }
+}
+// node_modules/@earendil-works/pi-mcp/dist/oauth/errors.js
+class OAuthError extends Error {
+  code;
+  errorUri;
+  constructor(code, message, errorUri) {
+    super(message || code);
+    this.name = "OAuthError";
+    this.code = code;
+    this.errorUri = errorUri;
+  }
+}
+
+class OAuthIssuerMismatchError extends Error {
+  expected;
+  received;
+  constructor(expected, received) {
+    super(`OAuth issuer mismatch: expected ${JSON.stringify(expected)}, received ${JSON.stringify(received)}`);
+    this.name = "OAuthIssuerMismatchError";
+    this.expected = expected;
+    this.received = received;
+  }
+}
+
+class OAuthInsecureEndpointError extends Error {
+  endpoint;
+  constructor(endpoint) {
+    super(`Refusing to send OAuth credentials to non-HTTPS endpoint ${endpoint}`);
+    this.name = "OAuthInsecureEndpointError";
+    this.endpoint = endpoint;
+  }
+}
+
+class OAuthRegistrationError extends Error {
+  status;
+  body;
+  constructor(status, body) {
+    super(`OAuth dynamic client registration failed with status ${status}: ${body}`);
+    this.name = "OAuthRegistrationError";
+    this.status = status;
+    this.body = body;
+  }
+}
+
+class McpOAuthAuthorizationRequiredError extends Error {
+  constructor() {
+    super("MCP OAuth authorization requires user interaction");
+    this.name = "McpOAuthAuthorizationRequiredError";
+  }
+}
+
+// node_modules/@earendil-works/pi-mcp/dist/oauth/types.js
+function object(value, name) {
+  if (!isObject(value))
+    throw new Error(`Invalid ${name}`);
+  return value;
+}
+function compact(value) {
+  return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== undefined));
+}
+function requiredString(value, name) {
+  if (typeof value !== "string" || value.length === 0)
+    throw new Error(`Invalid ${name}`);
+  return value;
+}
+function optionalString(value, name) {
+  if (value === undefined)
+    return;
+  return requiredString(value, name);
+}
+function optionalStrings(value, name) {
+  if (value === undefined)
+    return;
+  if (!Array.isArray(value) || value.some((item) => typeof item !== "string"))
+    throw new Error(`Invalid ${name}`);
+  return [...value];
+}
+function safeUrl(value, name) {
+  const text = requiredString(value, name);
+  const url = new URL(text);
+  if (["javascript:", "data:", "vbscript:"].includes(url.protocol))
+    throw new Error(`Invalid ${name}`);
+  return text;
+}
+function optionalUrl(value, name) {
+  return value === undefined ? undefined : safeUrl(value, name);
+}
+function parseProtectedResourceMetadata(value) {
+  const input = object(value, "OAuth protected resource metadata");
+  return compact({
+    ...input,
+    resource: safeUrl(input.resource, "OAuth protected resource metadata resource"),
+    authorization_servers: optionalStrings(input.authorization_servers, "authorization_servers")?.map((url) => safeUrl(url, "authorization server URL")),
+    scopes_supported: optionalStrings(input.scopes_supported, "scopes_supported")
+  });
+}
+function parseAuthorizationServerMetadata(value) {
+  const input = object(value, "authorization server metadata");
+  const responseTypes = optionalStrings(input.response_types_supported, "response_types_supported");
+  if (!responseTypes)
+    throw new Error("Invalid response_types_supported");
+  return compact({
+    ...input,
+    issuer: safeUrl(input.issuer, "authorization server issuer"),
+    authorization_endpoint: safeUrl(input.authorization_endpoint, "authorization endpoint"),
+    token_endpoint: safeUrl(input.token_endpoint, "token endpoint"),
+    registration_endpoint: optionalUrl(input.registration_endpoint, "registration endpoint"),
+    scopes_supported: optionalStrings(input.scopes_supported, "scopes_supported"),
+    response_types_supported: responseTypes,
+    grant_types_supported: optionalStrings(input.grant_types_supported, "grant_types_supported"),
+    token_endpoint_auth_methods_supported: optionalStrings(input.token_endpoint_auth_methods_supported, "token_endpoint_auth_methods_supported"),
+    code_challenge_methods_supported: optionalStrings(input.code_challenge_methods_supported, "code_challenge_methods_supported"),
+    client_id_metadata_document_supported: typeof input.client_id_metadata_document_supported === "boolean" ? input.client_id_metadata_document_supported : undefined
+  });
+}
+function parseOAuthTokens(value) {
+  const input = object(value, "OAuth token response");
+  const expires = input.expires_in === undefined ? undefined : Number(input.expires_in);
+  if (expires !== undefined && !Number.isFinite(expires))
+    throw new Error("Invalid expires_in");
+  return compact({
+    access_token: requiredString(input.access_token, "access_token"),
+    token_type: requiredString(input.token_type, "token_type"),
+    expires_in: expires,
+    scope: optionalString(input.scope, "scope"),
+    refresh_token: optionalString(input.refresh_token, "refresh_token"),
+    id_token: optionalString(input.id_token, "id_token")
+  });
+}
+function parseClientInformation(value) {
+  const input = object(value, "OAuth client registration response");
+  return compact({
+    ...input,
+    client_id: requiredString(input.client_id, "client_id"),
+    client_secret: optionalString(input.client_secret, "client_secret"),
+    client_id_issued_at: typeof input.client_id_issued_at === "number" ? input.client_id_issued_at : undefined,
+    client_secret_expires_at: typeof input.client_secret_expires_at === "number" ? input.client_secret_expires_at : undefined,
+    redirect_uris: optionalStrings(input.redirect_uris, "redirect_uris") ?? []
+  });
+}
+
+// node_modules/@earendil-works/pi-mcp/dist/oauth/discovery.js
+function discard(response) {
+  response?.body?.cancel().catch(() => {});
+}
+function isDiscoveryMiss(status) {
+  return status >= 400 && status < 500 || status === 502;
+}
+function pathSuffix(pathname) {
+  return pathname.endsWith("/") ? pathname.slice(0, -1) : pathname;
+}
+function field(header, name) {
+  const match = header.match(new RegExp(String.raw`(?:^|[,\s])${name}=(?:"([^"]*)"|([^\s,]+))`, "i"));
+  return match?.[1] ?? match?.[2];
+}
+function parseWwwAuthenticate(header) {
+  if (!header)
+    return {};
+  const scheme = header.trimStart().split(/\s+/, 1)[0]?.toLowerCase();
+  if (scheme !== "bearer" && scheme !== "dpop")
+    return {};
+  const resourceMetadata = field(header, "resource_metadata");
+  let resourceMetadataUrl;
+  if (resourceMetadata) {
+    try {
+      resourceMetadataUrl = new URL(resourceMetadata);
+    } catch {}
+  }
+  return {
+    resourceMetadataUrl,
+    scope: field(header, "scope"),
+    error: field(header, "error"),
+    errorDescription: field(header, "error_description")
+  };
+}
+async function fetchMetadata(url, fetch, protocolVersion) {
+  return fetch(url, {
+    headers: { Accept: "application/json", "MCP-Protocol-Version": protocolVersion }
+  });
+}
+async function discoverProtectedResourceMetadata(serverUrl, options = {}) {
+  const server = new URL(serverUrl);
+  const fetch = options.fetch ?? globalThis.fetch;
+  const version = options.protocolVersion ?? LATEST_PROTOCOL_VERSION;
+  let response = await fetchMetadata(options.resourceMetadataUrl ? new URL(options.resourceMetadataUrl) : new URL(`/.well-known/oauth-protected-resource${pathSuffix(server.pathname)}`, server.origin), fetch, version);
+  if (!options.resourceMetadataUrl && server.pathname !== "/" && isDiscoveryMiss(response.status)) {
+    discard(response);
+    response = await fetchMetadata(new URL("/.well-known/oauth-protected-resource", server.origin), fetch, version);
+  }
+  if (!response.ok) {
+    discard(response);
+    throw new Error(`HTTP ${response.status} loading OAuth protected resource metadata`);
+  }
+  return parseProtectedResourceMetadata(await response.json());
+}
+function buildAuthorizationServerDiscoveryUrls(authorizationServerUrl) {
+  const issuer = new URL(authorizationServerUrl);
+  const path = pathSuffix(issuer.pathname);
+  const urls = [
+    { url: new URL(`/.well-known/oauth-authorization-server${path}`, issuer.origin), type: "oauth" },
+    { url: new URL(`/.well-known/openid-configuration${path}`, issuer.origin), type: "oidc" }
+  ];
+  if (path)
+    urls.push({ url: new URL(`${path}/.well-known/openid-configuration`, issuer.origin), type: "oidc" });
+  return urls;
+}
+async function discoverAuthorizationServerMetadata(authorizationServerUrl, options = {}) {
+  const fetch = options.fetch ?? globalThis.fetch;
+  for (const { url } of buildAuthorizationServerDiscoveryUrls(authorizationServerUrl)) {
+    const response = await fetchMetadata(url, fetch, options.protocolVersion ?? LATEST_PROTOCOL_VERSION);
+    if (!response.ok) {
+      discard(response);
+      if (isDiscoveryMiss(response.status))
+        continue;
+      throw new Error(`HTTP ${response.status} loading authorization server metadata from ${url}`);
+    }
+    const metadata = parseAuthorizationServerMetadata(await response.json());
+    if (!options.skipIssuerValidation) {
+      const expected = String(authorizationServerUrl);
+      const trim = (value) => value.endsWith("/") ? value.slice(0, -1) : value;
+      if (trim(metadata.issuer) !== trim(expected))
+        throw new OAuthIssuerMismatchError(expected, metadata.issuer);
+    }
+    return metadata;
+  }
+  return;
+}
+async function discoverOAuthServerInfo(serverUrl, options = {}) {
+  let resourceMetadata;
+  try {
+    resourceMetadata = await discoverProtectedResourceMetadata(serverUrl, {
+      resourceMetadataUrl: options.resourceMetadataUrl,
+      fetch: options.fetch
+    });
+  } catch (error) {
+    if (error instanceof TypeError)
+      throw error;
+  }
+  const authorizationServerUrl = resourceMetadata?.authorization_servers?.[0] ?? String(new URL("/", serverUrl));
+  return {
+    authorizationServerUrl,
+    authorizationServerMetadata: await discoverAuthorizationServerMetadata(authorizationServerUrl, {
+      fetch: options.fetch,
+      skipIssuerValidation: options.skipIssuerValidation
+    }),
+    resourceMetadata
+  };
+}
+function resourceUrlFromServerUrl(value) {
+  const url = new URL(value);
+  url.hash = "";
+  return url;
+}
+function selectResource(serverUrl, metadata) {
+  if (!metadata)
+    return;
+  const requested = resourceUrlFromServerUrl(serverUrl);
+  const configured = new URL(metadata.resource);
+  if (requested.origin !== configured.origin) {
+    throw new Error(`Protected resource ${metadata.resource} does not match MCP server ${requested}`);
+  }
+  const requestedPath = requested.pathname.endsWith("/") ? requested.pathname : `${requested.pathname}/`;
+  const configuredPath = configured.pathname.endsWith("/") ? configured.pathname : `${configured.pathname}/`;
+  if (!requestedPath.startsWith(configuredPath)) {
+    throw new Error(`Protected resource ${metadata.resource} does not match MCP server ${requested}`);
+  }
+  return metadata.resource;
+}
+// node_modules/@earendil-works/pi-mcp/dist/oauth/flow.js
+function loopback(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
+}
+function secureEndpoint(value) {
+  const url = new URL(value);
+  if (url.protocol !== "https:" && !loopback(url.hostname))
+    throw new OAuthInsecureEndpointError(url.href);
+  return url;
+}
+function selectClientAuthMethod(information, supported) {
+  const hinted = "token_endpoint_auth_method" in information ? information.token_endpoint_auth_method : undefined;
+  if (hinted && ["client_secret_basic", "client_secret_post", "none"].includes(hinted) && (supported.length === 0 || supported.includes(hinted))) {
+    return hinted;
+  }
+  if (supported.length === 0)
+    return information.client_secret ? "client_secret_basic" : "none";
+  if (information.client_secret && supported.includes("client_secret_basic"))
+    return "client_secret_basic";
+  if (information.client_secret && supported.includes("client_secret_post"))
+    return "client_secret_post";
+  if (supported.includes("none"))
+    return "none";
+  return information.client_secret ? "client_secret_post" : "none";
+}
+function applyClientAuthentication(method, information, headers, params) {
+  if (method === "client_secret_basic") {
+    if (!information.client_secret)
+      throw new Error("client_secret_basic requires a client secret");
+    headers.set("Authorization", `Basic ${Buffer.from(`${information.client_id}:${information.client_secret}`).toString("base64")}`);
+  } else {
+    params.set("client_id", information.client_id);
+    if (method === "client_secret_post" && information.client_secret)
+      params.set("client_secret", information.client_secret);
+  }
+}
+async function pkce() {
+  const bytes = crypto.getRandomValues(new Uint8Array(32));
+  const verifier = Buffer.from(bytes).toString("base64url");
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return { verifier, challenge: Buffer.from(digest).toString("base64url") };
+}
+async function startAuthorization(authorizationServerUrl, options) {
+  const metadata = options.metadata;
+  if (metadata && !metadata.response_types_supported.includes("code")) {
+    throw new Error("Authorization server does not support authorization codes");
+  }
+  if (metadata?.code_challenge_methods_supported && !metadata.code_challenge_methods_supported.includes("S256")) {
+    throw new Error("Authorization server does not support PKCE S256");
+  }
+  const url = new URL(metadata?.authorization_endpoint ?? new URL("/authorize", authorizationServerUrl));
+  const { verifier, challenge } = await pkce();
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", options.clientInformation.client_id);
+  url.searchParams.set("code_challenge", challenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("redirect_uri", String(options.redirectUrl));
+  if (options.state)
+    url.searchParams.set("state", options.state);
+  if (options.scope)
+    url.searchParams.set("scope", options.scope);
+  if (options.scope?.split(/\s+/).includes("offline_access"))
+    url.searchParams.set("prompt", "consent");
+  if (options.resource)
+    url.searchParams.set("resource", options.resource);
+  return { authorizationUrl: url, codeVerifier: verifier };
+}
+async function tokenRequest(authorizationServerUrl, options, params) {
+  const url = secureEndpoint(options.metadata?.token_endpoint ?? new URL("/token", authorizationServerUrl));
+  const headers = new Headers({ Accept: "application/json", "content-type": "application/x-www-form-urlencoded" });
+  if (options.resource)
+    params.set("resource", options.resource);
+  if (options.addClientAuthentication) {
+    await options.addClientAuthentication(headers, params, url, options.metadata);
+  } else {
+    applyClientAuthentication(selectClientAuthMethod(options.clientInformation, options.metadata?.token_endpoint_auth_methods_supported ?? []), options.clientInformation, headers, params);
+  }
+  const response = await (options.fetch ?? globalThis.fetch)(url, { method: "POST", headers, body: params });
+  const text = await response.text();
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {}
+  if (isObject(value) && typeof value.error === "string") {
+    throw new OAuthError(value.error, typeof value.error_description === "string" ? value.error_description : value.error, typeof value.error_uri === "string" ? value.error_uri : undefined);
+  }
+  if (!response.ok)
+    throw new OAuthError("server_error", `HTTP ${response.status}: ${text}`);
+  return parseOAuthTokens(value);
+}
+async function registerClient(authorizationServerUrl, options) {
+  const endpoint = options.metadata?.registration_endpoint;
+  if (options.metadata && !endpoint)
+    throw new Error("Authorization server does not support dynamic client registration");
+  const response = await (options.fetch ?? globalThis.fetch)(new URL(endpoint ?? new URL("/register", authorizationServerUrl)), {
+    method: "POST",
+    headers: { Accept: "application/json", "content-type": "application/json" },
+    body: JSON.stringify({ ...options.clientMetadata, ...options.scope ? { scope: options.scope } : {} })
+  });
+  if (!response.ok)
+    throw new OAuthRegistrationError(response.status, await response.text());
+  return parseClientInformation(await response.json());
+}
+async function exchangeAuthorizationCode(authorizationServerUrl, options) {
+  return tokenRequest(authorizationServerUrl, options, new URLSearchParams({
+    grant_type: "authorization_code",
+    code: options.code,
+    code_verifier: options.codeVerifier,
+    redirect_uri: String(options.redirectUrl)
+  }));
+}
+async function refreshAuthorization(authorizationServerUrl, options) {
+  const tokens = await tokenRequest(authorizationServerUrl, options, new URLSearchParams({ grant_type: "refresh_token", refresh_token: options.refreshToken }));
+  return { refresh_token: options.refreshToken, ...tokens };
+}
+async function runFlow(provider, options) {
+  const cached = await provider.discoveryState?.();
+  const discovered = cached?.authorizationServerUrl ? {
+    authorizationServerUrl: cached.authorizationServerUrl,
+    authorizationServerMetadata: cached.authorizationServerMetadata ?? await discoverAuthorizationServerMetadata(cached.authorizationServerUrl, {
+      fetch: options.fetch,
+      skipIssuerValidation: options.skipIssuerValidation
+    }),
+    resourceMetadata: cached.resourceMetadata
+  } : await discoverOAuthServerInfo(options.serverUrl, {
+    resourceMetadataUrl: options.resourceMetadataUrl,
+    fetch: options.fetch,
+    skipIssuerValidation: options.skipIssuerValidation
+  });
+  await provider.saveDiscoveryState?.({
+    ...discovered,
+    ...options.resourceMetadataUrl ? { resourceMetadataUrl: options.resourceMetadataUrl.href } : {}
+  });
+  const metadata = discovered.authorizationServerMetadata;
+  const resource = selectResource(options.serverUrl, discovered.resourceMetadata);
+  const scope = options.scope ?? discovered.resourceMetadata?.scopes_supported?.join(" ") ?? provider.clientMetadata.scope;
+  let client = await provider.clientInformation();
+  if (!client) {
+    if (options.authorizationCode)
+      throw new Error("OAuth client information is missing during code exchange");
+    if (metadata?.client_id_metadata_document_supported && provider.clientMetadataUrl) {
+      const url = new URL(provider.clientMetadataUrl);
+      if (url.protocol !== "https:" || url.pathname === "/")
+        throw new Error("Invalid OAuth client metadata URL");
+      client = { client_id: provider.clientMetadataUrl };
+      await provider.saveClientInformation?.(client);
+    } else {
+      if (!provider.saveClientInformation)
+        throw new Error("OAuth client information cannot be persisted");
+      client = await registerClient(discovered.authorizationServerUrl, {
+        metadata,
+        clientMetadata: provider.clientMetadata,
+        scope,
+        fetch: options.fetch
+      });
+      await provider.saveClientInformation(client);
+    }
+  }
+  const tokenOptions = {
+    metadata,
+    clientInformation: client,
+    resource,
+    addClientAuthentication: provider.addClientAuthentication,
+    fetch: options.fetch
+  };
+  if (options.authorizationCode) {
+    const tokens = await exchangeAuthorizationCode(discovered.authorizationServerUrl, {
+      ...tokenOptions,
+      code: options.authorizationCode,
+      codeVerifier: await provider.codeVerifier(),
+      redirectUrl: provider.redirectUrl
+    });
+    await provider.saveTokens(tokens);
+    return "AUTHORIZED";
+  }
+  const existing = options.skipRefresh ? undefined : await provider.tokens();
+  if (existing?.refresh_token) {
+    try {
+      const tokens = await refreshAuthorization(discovered.authorizationServerUrl, {
+        ...tokenOptions,
+        refreshToken: existing.refresh_token
+      });
+      await provider.saveTokens(tokens);
+      return "AUTHORIZED";
+    } catch (error) {
+      if (error instanceof OAuthInsecureEndpointError)
+        throw error;
+      if (error instanceof OAuthError && error.code !== "server_error")
+        throw error;
+    }
+  }
+  const state = await provider.state?.();
+  const authorization = await startAuthorization(discovered.authorizationServerUrl, {
+    metadata,
+    clientInformation: client,
+    redirectUrl: provider.redirectUrl,
+    scope,
+    state,
+    resource
+  });
+  await provider.saveCodeVerifier(authorization.codeVerifier);
+  await provider.redirectToAuthorization(authorization.authorizationUrl);
+  return "REDIRECT";
+}
+async function authorizeMcp(provider, options) {
+  try {
+    return await runFlow(provider, options);
+  } catch (error) {
+    if (error instanceof OAuthError && ["invalid_client", "unauthorized_client"].includes(error.code)) {
+      await provider.invalidateCredentials?.("all");
+      return runFlow(provider, options);
+    }
+    if (error instanceof OAuthError && error.code === "invalid_grant") {
+      await provider.invalidateCredentials?.("tokens");
+      return runFlow(provider, options);
+    }
+    throw error;
+  }
+}
+// node_modules/@earendil-works/pi-mcp/dist/oauth/provider.js
+class MemoryOAuthStateStore {
+  value;
+  load() {
+    return this.value === undefined ? undefined : structuredClone(this.value);
+  }
+  save(state) {
+    this.value = structuredClone(state);
+  }
+}
+
+class McpOAuthProvider {
+  redirectUrl;
+  clientMetadata;
+  serverUrl;
+  configuredClient;
+  store;
+  onRedirect;
+  writes = Promise.resolve();
+  constructor(options) {
+    this.serverUrl = String(new URL(options.serverUrl));
+    this.redirectUrl = String(options.redirectUrl);
+    this.clientMetadata = {
+      ...options.clientMetadata,
+      redirect_uris: options.clientMetadata.redirect_uris ?? [this.redirectUrl],
+      grant_types: options.clientMetadata.grant_types ?? ["authorization_code", "refresh_token"],
+      response_types: options.clientMetadata.response_types ?? ["code"],
+      token_endpoint_auth_method: options.clientMetadata.token_endpoint_auth_method ?? (options.clientSecret ? "client_secret_post" : "none")
+    };
+    this.configuredClient = options.clientId ? { client_id: options.clientId, ...options.clientSecret ? { client_secret: options.clientSecret } : {} } : undefined;
+    this.store = options.store ?? new MemoryOAuthStateStore;
+    this.onRedirect = options.onRedirect;
+  }
+  async state() {
+    const existing = (await this.load()).oauthState;
+    if (existing)
+      return existing;
+    const state = Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString("hex");
+    await this.update((value) => ({ ...value, oauthState: state }));
+    return state;
+  }
+  async clientInformation() {
+    return this.configuredClient ?? (await this.load()).clientInformation;
+  }
+  async saveClientInformation(information) {
+    if (this.configuredClient)
+      return;
+    await this.update((value) => ({ ...value, clientInformation: information }));
+  }
+  async tokens() {
+    return (await this.load()).tokens;
+  }
+  async saveTokens(tokens) {
+    const expiresAt = tokens.expires_in === undefined ? undefined : Date.now() + tokens.expires_in * 1000;
+    await this.update((value) => {
+      const next = { ...value, tokens };
+      if (expiresAt === undefined)
+        delete next.tokensExpireAt;
+      else
+        next.tokensExpireAt = expiresAt;
+      return next;
+    });
+  }
+  async redirectToAuthorization(url) {
+    await this.onRedirect(url);
+  }
+  async saveCodeVerifier(verifier) {
+    await this.update((value) => ({ ...value, codeVerifier: verifier }));
+  }
+  async codeVerifier() {
+    const verifier = (await this.load()).codeVerifier;
+    if (!verifier)
+      throw new Error("No OAuth PKCE code verifier is stored");
+    return verifier;
+  }
+  async invalidateCredentials(kind) {
+    await this.update((value) => {
+      const next = { ...value };
+      if (kind === "all" || kind === "client")
+        delete next.clientInformation;
+      if (kind === "all" || kind === "tokens") {
+        delete next.tokens;
+        delete next.tokensExpireAt;
+      }
+      if (kind === "all" || kind === "verifier")
+        delete next.codeVerifier;
+      if (kind === "all" || kind === "discovery")
+        delete next.discovery;
+      if (kind === "all")
+        delete next.oauthState;
+      return next;
+    });
+  }
+  async saveDiscoveryState(discovery) {
+    await this.update((value) => ({ ...value, discovery }));
+  }
+  async discoveryState() {
+    return (await this.load()).discovery;
+  }
+  async load() {
+    await this.writes;
+    return this.own(await this.store.load());
+  }
+  async update(update) {
+    this.writes = this.writes.then(async () => {
+      await this.store.save(update(this.own(await this.store.load())));
+    });
+    await this.writes;
+  }
+  own(state) {
+    return state?.serverUrl === this.serverUrl ? state : { serverUrl: this.serverUrl };
+  }
+}
+// node_modules/@earendil-works/pi-coding-agent/dist/extensions/mcp/oauth.js
+import { createHash } from "node:crypto";
+import { mkdirSync } from "node:fs";
+import { join } from "node:path";
+var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
+var CALLBACK_HOST = "127.0.0.1";
+var CALLBACK_PATH = "/callback";
+var FALLBACK_REDIRECT_URL = `http://${CALLBACK_HOST}${CALLBACK_PATH}`;
+var REFRESH_SKEW_MS = 30000;
+var REFRESH_REQUEST_TIMEOUT_MS = 15000;
+var REFRESH_LOCK_STALE_MS = 20000;
+var REFRESH_LOCK_WAIT_MS = 25000;
+var REFRESH_LOCK_RETRY_MS = 100;
+function callbackSettings(settings) {
+  const url = new URL(settings.callbackUrl ?? `http://${CALLBACK_HOST}${CALLBACK_PATH}`);
+  const address = url.hostname.replace(/^\[|\]$/g, "");
+  const port = url.port ? Number(url.port) : settings.callbackPort;
+  let fixedRedirectUrl;
+  if (url.port)
+    fixedRedirectUrl = settings.callbackUrl;
+  else if (port !== undefined) {
+    url.port = String(port);
+    fixedRedirectUrl = url.href;
+  }
+  return {
+    host: address === "localhost" ? CALLBACK_HOST : address,
+    redirectHost: address,
+    port,
+    path: url.pathname,
+    fixedRedirectUrl
+  };
+}
+function mergeScopes(...scopes) {
+  const merged = [...new Set(scopes.flatMap((scope) => scope?.split(/\s+/).filter(Boolean) ?? []))];
+  return merged.length > 0 ? merged.join(" ") : undefined;
+}
+function parseStates(content) {
+  if (!content?.trim())
+    return {};
+  const parsed = JSON.parse(content);
+  return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : {};
+}
+
+class McpOAuthCredentialStore {
+  backend;
+  lockDir;
+  constructor(backend, lockDir) {
+    this.backend = backend ?? new FileAuthStorageBackend(join(getAgentDir(), "mcp-auth.json"));
+    this.lockDir = backend ? lockDir : getAgentDir();
+  }
+  forServer(serverUrl) {
+    const key = String(new URL(serverUrl));
+    return {
+      load: () => this.read()[key],
+      save: (state) => this.write((states) => {
+        states[key] = state;
+      }),
+      withRefreshLock: (fn) => this.withRefreshLock(key, fn)
+    };
+  }
+  async withRefreshLock(key, fn) {
+    if (!this.lockDir)
+      return fn();
+    mkdirSync(this.lockDir, { recursive: true, mode: 448 });
+    const hash = createHash("sha256").update(key).digest("hex").slice(0, 16);
+    const release = await import_proper_lockfile.default.lock(join(this.lockDir, `mcp-auth-refresh-${hash}`), {
+      realpath: false,
+      stale: REFRESH_LOCK_STALE_MS,
+      retries: {
+        retries: REFRESH_LOCK_WAIT_MS / REFRESH_LOCK_RETRY_MS,
+        factor: 1,
+        minTimeout: REFRESH_LOCK_RETRY_MS,
+        maxTimeout: REFRESH_LOCK_RETRY_MS
+      },
+      onCompromised: () => {}
+    });
+    try {
+      return await fn();
+    } finally {
+      await release().catch(() => {
+        return;
+      });
+    }
+  }
+  tokens(serverUrl) {
+    return this.read()[String(new URL(serverUrl))]?.tokens;
+  }
+  remove(serverUrl) {
+    const key = String(new URL(serverUrl));
+    if (!(key in this.read()))
+      return false;
+    this.write((states) => {
+      delete states[key];
+    });
+    return true;
+  }
+  read() {
+    return this.backend.withLock((current) => ({ result: parseStates(current) }));
+  }
+  write(update) {
+    this.backend.withLock((current) => {
+      const states = parseStates(current);
+      update(states);
+      return { result: undefined, next: `${JSON.stringify(states, null, 2)}
+` };
+    });
+  }
+}
+function registeredRedirectUrls(client) {
+  return client && "redirect_uris" in client ? client.redirect_uris : [];
+}
+function createProvider(serverUrl, store, settings, redirectUrl, onRedirect) {
+  return new McpOAuthProvider({
+    serverUrl,
+    redirectUrl,
+    clientMetadata: { client_name: APP_NAME },
+    clientId: settings.clientId,
+    clientSecret: settings.clientSecret,
+    store,
+    onRedirect
+  });
+}
+function createMcpAuthProvider(options) {
+  const { serverUrl, store } = options;
+  let refreshing;
+  const refresh = (staleToken, fetch = globalThis.fetch, challenge) => {
+    refreshing ??= store.withRefreshLock(async () => {
+      const state = await store.load();
+      if (state?.tokens?.access_token !== staleToken)
+        return;
+      if (!state?.tokens?.refresh_token)
+        throw new McpOAuthAuthorizationRequiredError;
+      const settings = options.settings();
+      const redirectUrl = callbackSettings(settings).fixedRedirectUrl ?? registeredRedirectUrls(state.clientInformation)[0] ?? FALLBACK_REDIRECT_URL;
+      const provider = createProvider(serverUrl, store, settings, redirectUrl, () => {});
+      const result = await authorizeMcp(provider, {
+        serverUrl,
+        resourceMetadataUrl: challenge?.resourceMetadataUrl,
+        scope: challenge?.scope,
+        fetch: (input, init) => fetch(input, { ...init, signal: AbortSignal.timeout(REFRESH_REQUEST_TIMEOUT_MS) })
+      });
+      if (result === "REDIRECT")
+        throw new McpOAuthAuthorizationRequiredError;
+    }).finally(() => {
+      refreshing = undefined;
+    });
+    return refreshing;
+  };
+  return {
+    token: async () => {
+      await refreshing?.catch(() => {
+        return;
+      });
+      const state = await store.load();
+      const token = state?.tokens?.access_token;
+      const expired = state?.tokensExpireAt !== undefined && state.tokensExpireAt - REFRESH_SKEW_MS <= Date.now();
+      if (!expired || !state?.tokens?.refresh_token)
+        return token;
+      await refresh(token).catch(() => {
+        return;
+      });
+      return (await store.load())?.tokens?.access_token;
+    },
+    onUnauthorized: async (context) => {
+      const challenge = parseWwwAuthenticate(context.response.headers.get("www-authenticate"));
+      options.onChallenge(challenge);
+      if (challenge.error === "insufficient_scope")
+        throw new McpOAuthAuthorizationRequiredError;
+      await refresh(context.token, context.fetch, challenge);
+    },
+    settled: async () => {
+      await refreshing?.catch(() => {
+        return;
+      });
+    }
+  };
+}
+
+class McpSignInCancelledError extends Error {
+  constructor() {
+    super("Sign-in cancelled");
+    this.name = "McpSignInCancelledError";
+  }
+}
+function codeFromRedirectUrl(input, state) {
+  let url;
+  try {
+    url = new URL(input.trim());
+  } catch {
+    throw new Error("Expected the full redirect URL from the browser address bar");
+  }
+  const error = url.searchParams.get("error");
+  if (error)
+    throw new Error(url.searchParams.get("error_description") ?? error);
+  if (url.searchParams.get("state") !== state)
+    throw new Error("The redirect URL belongs to a different sign-in");
+  const code = url.searchParams.get("code");
+  if (!code)
+    throw new Error("The redirect URL does not contain an authorization code");
+  return code;
+}
+async function waitForAuthorizationCode(callback, state, prompt) {
+  const controller = new AbortController;
+  const fromBrowser = callback.waitForCallback(state).then((result) => result.code);
+  const fromUser = prompt.promptForRedirectUrl(controller.signal).then((input) => {
+    if (!input?.trim())
+      throw new McpSignInCancelledError;
+    return codeFromRedirectUrl(input, state);
+  });
+  try {
+    return await Promise.race([fromBrowser, fromUser]);
+  } finally {
+    controller.abort();
+    fromBrowser.catch(() => {
+      return;
+    });
+    fromUser.catch(() => {
+      return;
+    });
+  }
+}
+async function listenForCallback(settings, port, required) {
+  const options = {
+    host: settings.host,
+    redirectHost: settings.redirectHost,
+    path: settings.path,
+    renderPage: (page) => page.ok ? oauthSuccessHtml("Signed in to the MCP server. You may now close this page.") : oauthErrorHtml(page.message, page.details)
+  };
+  try {
+    return await OAuthCallbackServer.listen({ ...options, port: port ?? 0 });
+  } catch (error) {
+    if (required || port === undefined)
+      throw error;
+    return OAuthCallbackServer.listen(options);
+  }
+}
+async function signInMcpServer(options) {
+  const { serverUrl, store, settings } = options;
+  const stored = await store.load();
+  const callbackOptions = callbackSettings(settings);
+  const registered = registeredRedirectUrls(stored?.clientInformation)[0];
+  const preferredPort = callbackOptions.port ?? (registered ? Number(new URL(registered).port) || undefined : undefined);
+  const callback = await listenForCallback(callbackOptions, preferredPort, callbackOptions.port !== undefined);
+  const redirectUrl = callbackOptions.fixedRedirectUrl ?? callback.redirectUrl;
+  try {
+    if (stored) {
+      const next = { ...stored };
+      delete next.oauthState;
+      if (!settings.clientId && !registeredRedirectUrls(stored.clientInformation).includes(redirectUrl)) {
+        delete next.clientInformation;
+        delete next.tokens;
+        delete next.tokensExpireAt;
+      }
+      await store.save(next);
+    }
+    let authorizationUrl;
+    const provider = createProvider(serverUrl, store, settings, redirectUrl, (url) => {
+      authorizationUrl = url;
+    });
+    const flow = {
+      serverUrl,
+      resourceMetadataUrl: options.challenge?.resourceMetadataUrl,
+      scope: mergeScopes(settings.scope, options.challenge?.scope)
+    };
+    const skipRefresh = options.challenge?.error === "insufficient_scope";
+    if (await authorizeMcp(provider, { ...flow, skipRefresh }) === "AUTHORIZED")
+      return;
+    if (!authorizationUrl)
+      throw new Error("OAuth flow did not produce an authorization URL");
+    const state = await provider.state();
+    options.prompt.showAuthorizationUrl(authorizationUrl);
+    const code = await waitForAuthorizationCode(callback, state, options.prompt);
+    await authorizeMcp(provider, { ...flow, authorizationCode: code });
+  } finally {
+    await callback.close();
+  }
+}
+
+// node_modules/@earendil-works/pi-coding-agent/dist/extensions/mcp/log.js
+import { appendFileSync, mkdirSync as mkdirSync2, renameSync, statSync } from "node:fs";
+import { dirname } from "node:path";
+var MAX_LOG_BYTES = 5 * 1024 * 1024;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function formatData(data) {
+  if (typeof data === "string")
+    return data;
+  try {
+    return JSON.stringify(data) ?? String(data);
+  } catch {
+    return String(data);
+  }
+}
+function formatMcpLogMessage(server, params, now = new Date) {
+  const message = isRecord(params) ? params : { data: params };
+  const level = typeof message.level === "string" ? message.level : "info";
+  const logger = typeof message.logger === "string" && message.logger ? ` ${message.logger}:` : "";
+  const text = formatData(message.data).replace(/\r?\n/g, `
+    `);
+  return `${now.toISOString()} [${server}] ${level}${logger} ${text}
+`;
+}
+
+class McpServerLog {
+  path;
+  size;
+  constructor(path) {
+    this.path = path;
+  }
+  write(server, params) {
+    const line = formatMcpLogMessage(server, params);
+    try {
+      if (this.size === undefined) {
+        mkdirSync2(dirname(this.path), { recursive: true });
+        this.size = this.currentSize();
+      }
+      if (this.size > MAX_LOG_BYTES) {
+        if (this.currentSize() > MAX_LOG_BYTES)
+          renameSync(this.path, `${this.path}.1`);
+        this.size = this.currentSize();
+      }
+      appendFileSync(this.path, line);
+      this.size += Buffer.byteLength(line);
+    } catch {}
+  }
+  currentSize() {
+    try {
+      return statSync(this.path).size;
+    } catch {
+      return 0;
+    }
+  }
+}
+
+// node_modules/@earendil-works/pi-coding-agent/dist/extensions/mcp/runtime.js
+var DEFAULT_TIMEOUT_SECONDS = 60;
+var STDERR_TAIL_CHARS = 2000;
+var CONNECT_RETRY_DELAYS_MS = [250, 1000];
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function isTransientError(error) {
+  if (error instanceof McpHttpError) {
+    return error.status === 408 || error.status === 429 || error.status >= 500 && error.status !== 501;
+  }
+  return error instanceof TypeError;
+}
+function signInRequiredMessage(name) {
+  return `MCP server "${name}" requires sign-in. Run /mcp to sign in.`;
+}
+function usesOAuth(entry) {
+  const { config } = entry;
+  if (!("url" in config))
+    return false;
+  return !Object.keys(config.headers ?? {}).some((header) => header.toLowerCase() === "authorization");
+}
+function expandHome(value) {
+  if (value === "~")
+    return homedir();
+  if (value.startsWith("~/") || process.platform === "win32" && value.startsWith("~\\")) {
+    return join2(homedir(), value.slice(2));
+  }
+  return value;
+}
+function createDefaultTransport(entry, cwd, authProvider) {
+  const { config, name } = entry;
+  if ("url" in config) {
+    return new StreamableHttpTransport({
+      url: config.url,
+      headers: resolveHeadersOrThrow(config.headers, `MCP server "${name}"`),
+      authProvider
+    });
+  }
+  const env = {};
+  for (const [key, value] of Object.entries(config.env ?? {})) {
+    env[key] = resolveConfigValueOrThrow(value, `MCP server "${name}" env "${key}"`);
+  }
+  return new StdioTransport({
+    command: expandHome(config.command),
+    args: config.args?.map(expandHome),
+    cwd: resolve(cwd, expandHome(config.cwd ?? ".")),
+    env,
+    stderr: "pipe"
+  });
+}
+async function withoutTemplates(list, empty) {
+  try {
+    return await list();
+  } catch (error) {
+    if (error instanceof McpError && error.code === JSON_RPC_ERROR_CODES.methodNotFound)
+      return empty;
+    throw error;
+  }
+}
+function listTemplates(client, options = {}) {
+  return withoutTemplates(() => client.listResourceTemplates(options), []);
+}
+async function fetchResources(client) {
+  const [resources, resourceTemplates] = await Promise.all([
+    client.listResources().catch(() => []),
+    listTemplates(client).catch(() => [])
+  ]);
+  return {
+    resources: resources.filter((resource) => !isMcpAppResource(resource)),
+    resourceTemplates: resourceTemplates.filter((template) => !isMcpAppResource(template))
+  };
+}
+
+class McpServerConnection {
+  entry;
+  state = "connecting";
+  error;
+  tools = [];
+  hasResources = false;
+  resources = [];
+  resourceTemplates = [];
+  instructions;
+  challenge;
+  client;
+  opening;
+  closed = false;
+  stderrTail;
+  cwd;
+  createTransport;
+  authProvider;
+  onTools;
+  onChange;
+  log;
+  constructor(options) {
+    this.entry = options.entry;
+    this.cwd = options.cwd;
+    this.createTransport = options.createTransport;
+    this.onTools = options.onTools;
+    this.onChange = options.onChange;
+    this.log = options.log;
+    const url = this.oauthUrl;
+    this.authProvider = url ? createMcpAuthProvider({
+      serverUrl: url,
+      store: options.credentials.forServer(url),
+      settings: () => this.oauthSettings(),
+      onChallenge: (challenge) => {
+        this.challenge = challenge;
+      }
+    }) : undefined;
+  }
+  get name() {
+    return this.entry.name;
+  }
+  get timeoutMs() {
+    return (this.entry.config.timeout ?? DEFAULT_TIMEOUT_SECONDS) * 1000;
+  }
+  get oauthUrl() {
+    return usesOAuth(this.entry) && "url" in this.entry.config ? this.entry.config.url : undefined;
+  }
+  oauthSettings() {
+    const oauth = "url" in this.entry.config ? this.entry.config.oauth : undefined;
+    if (!oauth)
+      return {};
+    return {
+      clientId: oauth.clientId,
+      clientSecret: oauth.clientSecret === undefined ? undefined : resolveConfigValueOrThrow(oauth.clientSecret, `MCP server "${this.entry.name}" oauth.clientSecret`),
+      callbackPort: oauth.callbackPort,
+      callbackUrl: oauth.callbackUrl,
+      scope: oauth.scope
+    };
+  }
+  getClient() {
+    if (this.closed)
+      return Promise.reject(new Error(`MCP server "${this.entry.name}" is shut down`));
+    if (this.client?.connectionState === "connected")
+      return Promise.resolve(this.client);
+    this.opening ??= this.open().finally(() => {
+      this.opening = undefined;
+    });
+    return this.opening;
+  }
+  callTool(name, args, options) {
+    return this.withClient((client) => client.callTool(name, args, options));
+  }
+  readResource(uri, options) {
+    return this.withClient((client) => client.readResource(uri, options), true);
+  }
+  resourcesPage(cursor, options) {
+    return this.withClient((client) => client.listResourcesPage(cursor, options), true);
+  }
+  resourceTemplatesPage(cursor, options) {
+    return this.withClient((client) => withoutTemplates(() => client.listResourceTemplatesPage(cursor, options), { resourceTemplates: [] }), true);
+  }
+  allResources(options) {
+    return this.withClient((client) => client.listResources(options), true);
+  }
+  allResourceTemplates(options) {
+    return this.withClient((client) => listTemplates(client, options), true);
+  }
+  async withClient(run, readOnly = false) {
+    for (let attempt = 1;; attempt++) {
+      const client = await this.getClient();
+      try {
+        return await run(client);
+      } catch (error) {
+        if (readOnly && attempt === 1 && error instanceof McpHttpError && isTransientError(error)) {
+          await new Promise((resolve2) => setTimeout(resolve2, CONNECT_RETRY_DELAYS_MS[0]));
+          continue;
+        }
+        if (error instanceof McpSessionExpiredError && attempt === 1) {
+          if (this.client === client)
+            this.client = undefined;
+          continue;
+        }
+        if (!this.needsSignIn(error))
+          throw error;
+        await this.dropClient(client);
+        this.markNeedsAuth();
+        throw new Error(signInRequiredMessage(this.entry.name));
+      }
+    }
+  }
+  async reconnect() {
+    await this.opening?.catch(() => {
+      return;
+    });
+    if (this.client)
+      await this.dropClient(this.client);
+    await this.getClient();
+  }
+  async signOut() {
+    await this.opening?.catch(() => {
+      return;
+    });
+    if (this.client)
+      await this.dropClient(this.client);
+    if (!this.closed)
+      this.markNeedsAuth();
+  }
+  needsSignIn(error) {
+    return error instanceof McpOAuthAuthorizationRequiredError || this.oauthUrl !== undefined && error instanceof McpAuthRequiredError;
+  }
+  markNeedsAuth() {
+    this.state = "needs-auth";
+    this.error = undefined;
+    this.changed();
+  }
+  changed() {
+    this.onChange?.(this);
+  }
+  async dropClient(client) {
+    if (this.client === client)
+      this.client = undefined;
+    await client.close().catch(() => {
+      return;
+    });
+  }
+  async open() {
+    this.state = "connecting";
+    this.changed();
+    const retries = "url" in this.entry.config ? CONNECT_RETRY_DELAYS_MS : [];
+    for (let attempt = 0;; attempt++) {
+      this.stderrTail = undefined;
+      try {
+        return await this.connectOnce();
+      } catch (error) {
+        const delay = retries[attempt];
+        if (this.closed || delay === undefined || !isTransientError(error)) {
+          throw this.connectFailed(error);
+        }
+        await new Promise((resolve2) => setTimeout(resolve2, delay));
+        if (this.closed)
+          throw this.connectFailed(error);
+      }
+    }
+  }
+  async connectOnce() {
+    const client = new McpClient({
+      name: "pi",
+      version: VERSION,
+      requestTimeoutMs: this.timeoutMs,
+      roots: [{ uri: pathToFileURL(this.cwd).href, name: basename(this.cwd) }]
+    });
+    const log = this.log;
+    if (log)
+      client.onNotification("notifications/message", (params) => log.write(this.entry.name, params));
+    let transport;
+    try {
+      transport = this.createTransport(this.entry, this.cwd, this.authProvider);
+      await client.connect(transport);
+      client.onNotification("notifications/tools/list_changed", () => {
+        this.refreshTools(client);
+      });
+      client.onNotification("notifications/resources/list_changed", () => {
+        this.refreshResources(client);
+      });
+      const stdio = transport instanceof StdioTransport ? transport : undefined;
+      client.onClose(() => this.handleClientClose(client, stdio));
+      const hasResources = client.serverCapabilities?.resources !== undefined;
+      const [tools, resources] = await Promise.all([
+        client.serverCapabilities?.tools ? client.listTools() : [],
+        hasResources ? fetchResources(client) : { resources: [], resourceTemplates: [] }
+      ]);
+      if (this.closed)
+        throw new Error("shut down while connecting");
+      if (client.connectionState !== "connected")
+        throw new Error("connection closed during setup");
+      this.client = client;
+      this.tools = tools;
+      this.hasResources = hasResources;
+      this.resources = resources.resources;
+      this.resourceTemplates = resources.resourceTemplates;
+      this.instructions = client.instructions?.trim() || undefined;
+      this.state = "connected";
+      this.error = undefined;
+      this.onTools(this);
+      this.changed();
+      return client;
+    } catch (error) {
+      await client.close().catch(() => {
+        return;
+      });
+      if (transport instanceof StdioTransport) {
+        this.stderrTail = transport.stderr.trim().slice(-STDERR_TAIL_CHARS) || undefined;
+      }
+      throw error;
+    }
+  }
+  connectFailed(error) {
+    if (this.needsSignIn(error) && !this.closed) {
+      this.markNeedsAuth();
+      return new Error(signInRequiredMessage(this.entry.name));
+    }
+    this.state = this.closed ? "closed" : "failed";
+    this.error = this.stderrTail ? `${errorMessage(error)}
+${this.stderrTail}` : errorMessage(error);
+    this.changed();
+    return new Error(`MCP server "${this.entry.name}" failed to connect: ${this.error}`);
+  }
+  handleClientClose(client, stdio) {
+    if (this.client !== client || this.closed)
+      return;
+    this.client = undefined;
+    this.state = "disconnected";
+    const stderr = stdio?.stderr.trim().slice(-STDERR_TAIL_CHARS);
+    this.error = stderr ? `Connection closed
+${stderr}` : "Connection closed";
+    this.changed();
+  }
+  async refreshTools(client) {
+    try {
+      const tools = await client.listTools();
+      if (this.client !== client || this.closed)
+        return;
+      this.tools = tools;
+      this.onTools(this);
+    } catch (error) {
+      this.error = `Failed to refresh tools: ${errorMessage(error)}`;
+    }
+    this.changed();
+  }
+  async refreshResources(client) {
+    const { resources, resourceTemplates } = await fetchResources(client);
+    if (this.client !== client || this.closed)
+      return;
+    this.resources = resources;
+    this.resourceTemplates = resourceTemplates;
+    this.onTools(this);
+    this.changed();
+  }
+  async close() {
+    this.closed = true;
+    this.state = "closed";
+    this.changed();
+    const client = this.client;
+    this.client = undefined;
+    await client?.close().catch(() => {
+      return;
+    });
+    await this.authProvider?.settled();
+  }
+}
+
+export { McpOAuthCredentialStore, McpSignInCancelledError, signInMcpServer, McpServerLog, createDefaultTransport, McpServerConnection };