@duckmind/dm-darwin-x64 0.66.5 → 0.66.6

package/extensions/dm-mcp-adapter/cli.js

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
+import { spawnSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
 import stripJsonComments from "strip-json-comments";
 const HOME = os.homedir();
@@ -35,12 +36,12 @@ function getAgentDir() {
   return path.join(HOME, getConfigDirName(), "agent");
 }
 const AGENT_DIR = getAgentDir();
-const PI_CONFIG_PATH = path.join(AGENT_DIR, "mcp.json");
+const PI_CONFIG_PATH = path.join(AGENT_DIR, "mcp-adapter.json");
 const GENERIC_GLOBAL_CONFIG_PATH = path.join(HOME, ".config", "mcp", "mcp.json");
 const AGENTS_GLOBAL_CONFIG_PATH = path.join(HOME, ".agents", "mcp.json");
 const AGENTS_NESTED_GLOBAL_CONFIG_PATH = path.join(HOME, ".agents", "mcp", "mcp.json");
 const PROJECT_CONFIG_PATH = path.resolve(process.cwd(), ".mcp.json");
-const PROJECT_PI_CONFIG_PATH = path.resolve(process.cwd(), getConfigDirName(), "mcp.json");
+const PROJECT_PI_CONFIG_PATH = path.resolve(process.cwd(), getConfigDirName(), "mcp-adapter.json");
 const IMPORT_PATHS = {
   cursor: [path.join(HOME, ".cursor", "mcp.json")],
   "claude-code": [
@@ -71,6 +72,10 @@ function printHelp(log = console.log) {
   log("  dm-mcp-adapter init --dry-run");
   log("  dm-mcp-adapter init --discover-host-configs  Opt in to host config fallback discovery");
   log("");
+  log("Check configured servers (exits 1 when an enabled server fails):");
+  log("  dm-mcp-adapter doctor         Connect each enabled server and report its state and tool count");
+  log("  dm-mcp-adapter doctor --json  Print the same report as a JSON array");
+  log("");
   log('Bearer token storage (servers configured with auth: "bearer" and bearerTokenStore: true):');
   log("  dm-mcp-adapter token set <server>     Store a token read from stdin (masked prompt or pipe; never argv)");
   log("  dm-mcp-adapter token status <server>  Report whether a stored token matches the configured URL");
@@ -82,25 +87,29 @@ function printHelp(log = console.log) {
   log("  dm-mcp-adapter key remove systemone  Remove the stored key");
 }
 function readJsonFile(filePath) {
-  return JSON.parse(stripJsonComments(fs.readFileSync(filePath, "utf-8"), { trailingCommas: true }));
+  const raw = fs.readFileSync(filePath, "utf-8");
+  const text = raw.charCodeAt(0) === 65279 ? raw.slice(1) : raw;
+  return text.trim() === "" ? {} : JSON.parse(stripJsonComments(text, { trailingCommas: true }));
 }
 function loadPiConfig() {
-  if (!fs.existsSync(PI_CONFIG_PATH)) {
+  if (!fs.lstatSync(PI_CONFIG_PATH, { throwIfNoEntry: false })) {
     return { mcpServers: {} };
   }
   const raw = readJsonFile(PI_CONFIG_PATH);
-  const mcpServers = raw.mcpServers ?? raw["mcp-servers"] ?? {};
-  if (!mcpServers || typeof mcpServers !== "object" || Array.isArray(mcpServers)) {
-    throw new Error(`Invalid MCP config at ${PI_CONFIG_PATH}: expected "mcpServers" to be an object`);
-  }
-  const normalized = { ...raw };
-  delete normalized["mcp-servers"];
-  const imports = Array.isArray(raw.imports) ? raw.imports.filter((value) => typeof value === "string") : undefined;
-  return {
-    ...normalized,
-    mcpServers,
-    imports
-  };
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error(`Invalid MCP config at ${PI_CONFIG_PATH}: top-level value must be an object`);
+  }
+  for (const key of ["mcpServers", "mcp-servers", "settings"]) {
+    const value = raw[key];
+    if (value !== undefined && (!value || typeof value !== "object" || Array.isArray(value))) {
+      throw new Error(`Invalid MCP config at ${PI_CONFIG_PATH}: ${key} must be an object`);
+    }
+  }
+  if (raw.imports !== undefined && (!Array.isArray(raw.imports) || raw.imports.some((value) => typeof value !== "string"))) {
+    throw new Error(`Invalid MCP config at ${PI_CONFIG_PATH}: imports must be an array of strings`);
+  }
+  const { "mcp-servers": legacyServers, ...normalized } = raw;
+  return { ...normalized, mcpServers: raw.mcpServers ?? legacyServers ?? {} };
 }
 function findAvailableImports() {
   const found = [];
@@ -119,9 +128,9 @@ function printDiscovery(log, imports) {
     ["User-global standard MCP", GENERIC_GLOBAL_CONFIG_PATH],
     ["User-global .agents MCP", AGENTS_GLOBAL_CONFIG_PATH],
     ["User-global .agents nested MCP", AGENTS_NESTED_GLOBAL_CONFIG_PATH],
-    ["DM global override", PI_CONFIG_PATH],
+    ["MCP adapter global override", PI_CONFIG_PATH],
     ["Project standard MCP", PROJECT_CONFIG_PATH],
-    ["Project DM override", PROJECT_PI_CONFIG_PATH]
+    ["Project MCP adapter override", PROJECT_PI_CONFIG_PATH]
   ];
   for (const [label, filePath] of paths) {
     const prefix = fs.existsSync(filePath) ? "✓" : "-";
@@ -154,8 +163,8 @@ async function runInit(argv, log = console.log) {
   const discoverySettingChanged = discoverHostConfigs && existingConfig.settings?.hostConfigDiscovery !== "on";
   if (importsToAdd.length === 0 && !discoverySettingChanged) {
     log(`
-No DM config changes needed.`);
-    log("Standard MCP configs are discovered automatically, and host-specific imports are already configured or unavailable.");
+No MCP adapter config changes needed.`);
+    log("Standard MCP configs are discovered automatically. DM's mcp.json files are reserved for built-in MCP; adapter settings belong in mcp-adapter.json.");
     return 0;
   }
   const nextConfig = {
@@ -166,10 +175,10 @@ No DM config changes needed.`);
   };
   if (importsToAdd.length > 0) {
     log(`
-Detected host configs to import into DM: ${importsToAdd.join(", ")}`);
+Detected host configs to import into the MCP adapter: ${importsToAdd.join(", ")}`);
   }
   if (discoverySettingChanged) {
-    log("Opting in to host-specific fallback discovery (standard and DM-owned configs still take precedence).");
+    log("Opting in to host-specific fallback discovery (standard and adapter-owned configs still take precedence).");
   }
   if (dryRun) {
     log(`Dry run: would update ${PI_CONFIG_PATH}`);
@@ -177,7 +186,7 @@ Detected host configs to import into DM: ${importsToAdd.join(", ")}`);
   }
   writePiConfig(nextConfig);
   log(`Updated ${PI_CONFIG_PATH}`);
-  log("DM will now keep reading standard MCP configs automatically, while these imports cover host-specific config formats.");
+  log("The adapter reads standard MCP configs automatically and stores adapter-specific imports in mcp-adapter.json; DM's mcp.json is never read by the adapter.");
   if (discoverySettingChanged) {
     log("Host config discovery is explicit and does not write to or execute commands from external host files.");
   }
@@ -391,10 +400,240 @@ async function runKey(argv, log, error, stdin) {
   }
   if (Object.hasOwn(process.env, "SYSTEMONE_API_KEY"))
     log("Note: SYSTEMONE_API_KEY is present and overrides the stored key.");
+  else if (endpoint.origin === store.OPENROUTER_ORIGIN && Object.hasOwn(process.env, "OPENROUTER_API_KEY"))
+    log("Note: OPENROUTER_API_KEY is present and overrides the stored key.");
   else if (Object.hasOwn(process.env, "TYPESAFE_API_KEY"))
     log(endpoint.href === store.JEV_DEFAULT_ENDPOINT ? "Note: TYPESAFE_API_KEY is present and overrides the stored key." : `Note: TYPESAFE_API_KEY is ignored for ${endpoint.href}; it is a TypeSafe credential and is never sent there.`);
   return 0;
 }
+const DOCTOR_CONNECT_TIMEOUT_MS = 15000;
+function redactDoctorMessage(text, definition, utils) {
+  const configured = [definition.bearerToken, definition.oauth?.clientSecret, ...Object.values(definition.headers ?? {}), ...Object.values(definition.env ?? {})];
+  if (definition.bearerTokenEnv)
+    configured.push(process.env[definition.bearerTokenEnv]);
+  if (typeof definition.url === "string") {
+    try {
+      configured.push(...new URL(utils.interpolateEnvVars(definition.url)).searchParams.values());
+    } catch {}
+  }
+  const secrets = configured.filter((value) => typeof value === "string").flatMap((value) => [value, utils.interpolateEnvVars(value)]).flatMap((value) => [value, ...value.split(/\s+/)]).filter((value) => value.length >= 4).sort((left, right) => right.length - left.length);
+  let redacted = text;
+  for (const secret of secrets)
+    redacted = redacted.replaceAll(secret, "***");
+  return redacted;
+}
+function describeConnectError(err, definition, url) {
+  if (!definition.url) {
+    const base = err.cause instanceof Error && err.message.startsWith(`${err.cause.message} (`) ? err.cause : err;
+    const message = typeof base.code === "number" ? `server returned JSON-RPC error ${base.code}` : base.message;
+    return definition.command ? `${message} — run the command directly to see its output` : message;
+  }
+  if (/^(Failed to resolve MCP server|HTTP request headers command|MCP caFile|Missing environment variable in MCP caFile)/.test(err.message)) {
+    return err.message;
+  }
+  let status;
+  const codes = new Set;
+  const pending = [err];
+  const seen = new Set;
+  while (pending.length > 0) {
+    const current = pending.pop();
+    if (typeof current !== "object" || current === null || seen.has(current))
+      continue;
+    seen.add(current);
+    if (typeof current.status === "number")
+      status ??= current.status;
+    status ??= /\(HTTP (\d{3})\)/.exec(current.message ?? "")?.[1];
+    if (typeof current.code === "string" && /^E[A-Z]+$/.test(current.code))
+      codes.add(current.code);
+    pending.push(current.cause, current.data?.cause, ...current instanceof AggregateError ? current.errors : []);
+  }
+  const parts = [...status ? [`HTTP ${status}`] : [], ...codes];
+  const suffix = err.cause instanceof Error && err.message.startsWith(err.cause.message) ? err.message.slice(err.cause.message.length) : "";
+  if (suffix.startsWith(" — probe: "))
+    parts.push(suffix.slice(3));
+  if (codes.has("ECONNREFUSED") && ["localhost", "127.0.0.1", "[::1]"].includes(new URL(url).hostname)) {
+    const configured = definition.url.replace(/[?#].*$/s, "").replace(/^([a-z][a-z\d+.-]*:\/\/)[^/]*@/i, "$1");
+    parts.push(`Nothing is listening at ${configured}. Start the app or local process that serves this MCP server.`);
+  }
+  return parts.length > 0 ? parts.join(" — ") : "connection failed";
+}
+const PI_CORE_PACKAGE = "@duckmind/dm-coding-agent";
+async function importPiCore() {
+  try {
+    return await import(PI_CORE_PACKAGE);
+  } catch (err) {
+    const names = process.platform === "win32" ? (process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").map((ext) => `pi${ext}`) : ["pi"];
+    const bin = (process.env.PATH ?? "").split(path.delimiter).filter(Boolean).flatMap((dir) => names.map((name) => path.join(dir, name))).find((file) => {
+      try {
+        fs.accessSync(file, fs.constants.X_OK);
+        return fs.statSync(file).isFile();
+      } catch {
+        return false;
+      }
+    });
+    if (!bin)
+      throw err;
+    const isPiCore = (dir) => {
+      const file = path.join(dir, "package.json");
+      return fs.existsSync(file) && JSON.parse(fs.readFileSync(file, "utf8")).name === PI_CORE_PACKAGE;
+    };
+    let root;
+    if (/\.(cmd|ps1)$/i.test(bin)) {
+      const shimmed = path.join(path.dirname(bin), "node_modules", PI_CORE_PACKAGE);
+      if (/node_modules[\\/]@earendil-works[\\/]pi-coding-agent[\\/]/i.test(fs.readFileSync(bin, "utf8")) && isPiCore(shimmed))
+        root = shimmed;
+    } else {
+      for (let dir = path.dirname(fs.realpathSync(bin));!root; dir = path.dirname(dir)) {
+        if (isPiCore(dir))
+          root = dir;
+        else if (path.dirname(dir) === dir)
+          break;
+      }
+    }
+    if (!root)
+      throw err;
+    const pkg = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
+    const target = pkg.exports?.["."];
+    const entry = typeof target === "string" ? target : target?.import ?? pkg.main;
+    return import(pathToFileURL(path.join(root, entry)).href);
+  }
+}
+async function runDoctor(argv, log, error) {
+  const json = argv[0] === "--json";
+  if (argv.length > (json ? 1 : 0)) {
+    error("Usage: dm-mcp-adapter doctor [--json]");
+    return 1;
+  }
+  let config, trust, manager, auth, authFlow, utils, agentDir;
+  try {
+    [config, trust, manager, auth, authFlow, utils, agentDir] = await Promise.all([
+      import("./dist/config.js"),
+      import("./dist/project-server-trust.js"),
+      import("./dist/server-manager.js"),
+      import("./dist/mcp-auth.js"),
+      import("./dist/mcp-auth-flow.js"),
+      import("./dist/utils.js"),
+      import("./dist/agent-dir.js")
+    ]);
+  } catch (err) {
+    error("Unable to load doctor command modules.");
+    error(`Import failed: ${err instanceof Error ? err.message : String(err)}`);
+    return 1;
+  }
+  const cwd = process.cwd();
+  const piVersion = spawnSync("pi", ["--version"], { encoding: "utf8", timeout: 5000, shell: process.platform === "win32" }).stdout ?? "";
+  const [major, minor] = piVersion.trim().split(".").map(Number);
+  const piSupportsMcp = major > 0 || minor >= 99;
+  config.setPiMcpConfigEnabled(piSupportsMcp);
+  if (!piSupportsMcp && [config.getPiMcpGlobalConfigPath(), config.getProjectPiMcpConfigPath(cwd)].some((file) => fs.existsSync(file))) {
+    error("DM 0.99 or later wasn't found on PATH, so DM's own mcp.json files were not checked.");
+  }
+  const loaded = config.loadMcpConfigWithSources(undefined, cwd);
+  let projectTrusted = false;
+  if (loaded.projectServers.size > 0) {
+    try {
+      const pi = await importPiCore();
+      if (typeof pi.hasTrustRequiringProjectResources === "function" && !pi.hasTrustRequiringProjectResources(cwd)) {
+        projectTrusted = true;
+      } else {
+        projectTrusted = new pi.ProjectTrustStore(agentDir.getAgentDir()).get(cwd) === true;
+      }
+    } catch (err) {
+      error(`Could not read DM's project trust, so project servers are treated as untrusted: ${utils.formatTerminalError(err)}`);
+    }
+  }
+  const { config: effective, blockedServers } = await trust.applyProjectServerTrust(loaded, {
+    cwd,
+    hasUI: false,
+    isProjectTrusted: () => projectTrusted
+  });
+  const authOptions = auth.getAuthStorageOptions(effective.settings?.oauthDir, cwd, effective.settings?.oauthCredentialStore);
+  const serverManager = new manager.McpServerManager(cwd);
+  serverManager.setDefaultRequestTimeoutMs(effective.settings?.requestTimeoutMs);
+  serverManager.setAuthStorageOptions(authOptions);
+  const check = async (name, definition, signal) => {
+    const block = blockedServers.get(name);
+    if (block)
+      return { state: "blocked", message: trust.describeProjectServerBlock(block.reason) };
+    if (definition.disabled === true)
+      return { state: "disabled" };
+    if (definition.url && typeof definition.auth === "object") {
+      return { state: "needs-auth", message: `signs in with a DM provider: run /login ${definition.auth.provider} in DM` };
+    }
+    const needsSignIn = { state: "needs-auth", message: `sign-in required: run /mcp-auth ${name} in DM` };
+    let anonymous = false;
+    let url;
+    if (definition.url) {
+      try {
+        url = utils.resolveServerUrl(definition);
+      } catch {
+        const missing = typeof definition.url === "string" ? utils.getMissingEnvVars(definition.url) : [];
+        return { state: "failed", message: missing.length > 0 ? `URL uses unset environment variables: ${missing.join(", ")}` : "URL is invalid" };
+      }
+      if (authFlow.supportsOAuth(definition)) {
+        const stored = auth.inspectAuthForUrl(name, url, authOptions);
+        if (stored.status === "unavailable")
+          return { state: "failed", message: stored.message };
+        if (stored.status === "absent" || !(stored.entry.tokens?.accessToken || stored.entry.tokens?.refreshToken)) {
+          if (definition.auth === "oauth")
+            return needsSignIn;
+          anonymous = true;
+        }
+      }
+    }
+    const connectDefinition = { ...definition, debug: false, ...anonymous ? { oauth: false } : {} };
+    try {
+      const connection = await serverManager.connect(name, connectDefinition, signal);
+      return connection.status === "needs-auth" ? needsSignIn : { state: "ok", tools: connection.tools.length };
+    } catch (err) {
+      if (anonymous && [err, err?.cause].some(manager.isUnauthorizedHttpError))
+        return needsSignIn;
+      return { state: "failed", message: describeConnectError(err, definition, url) };
+    }
+  };
+  const results = await Promise.all(Object.entries(effective.mcpServers).map(async ([name, definition]) => {
+    const controller = new AbortController;
+    let timer;
+    const timedOut = new Promise((resolve) => {
+      timer = setTimeout(() => {
+        controller.abort();
+        resolve({ state: "failed", message: `no response within ${DOCTOR_CONNECT_TIMEOUT_MS / 1000}s` });
+      }, DOCTOR_CONNECT_TIMEOUT_MS);
+    });
+    const result = await Promise.race([
+      check(name, definition, controller.signal).catch((err) => ({ state: "failed", message: utils.formatTerminalError(err) })),
+      timedOut
+    ]);
+    clearTimeout(timer);
+    return {
+      name,
+      state: result.state,
+      tools: result.tools ?? null,
+      message: result.message ? utils.sanitizeTerminalText(redactDoctorMessage(result.message, definition, utils)) : null
+    };
+  }));
+  let closed = true;
+  try {
+    if (json) {
+      log(JSON.stringify(results, null, 2));
+    } else {
+      if (results.length === 0)
+        log("No MCP servers configured.");
+      for (const result of results) {
+        const tools = result.tools === null ? "" : `, ${result.tools} tool${result.tools === 1 ? "" : "s"}`;
+        log(`${utils.sanitizeTerminalText(result.name)}: ${result.state}${tools}${result.message ? ` — ${result.message}` : ""}`);
+      }
+    }
+  } finally {
+    try {
+      await serverManager.closeAll();
+    } catch (err) {
+      closed = false;
+      error(`Some MCP connections did not close cleanly: ${utils.formatTerminalError(err)}`);
+    }
+  }
+  return !closed || results.some((result) => result.state === "failed" || result.state === "needs-auth") ? 1 : 0;
+}
 export async function main(argv = process.argv.slice(2), log = console.log, error = console.error, stdin = process.stdin) {
   const [command, ...rest] = argv;
   if (!command || command === "help" || command === "--help" || command === "-h") {
@@ -407,6 +646,9 @@ export async function main(argv = process.argv.slice(2), log = console.log, erro
   if (command === "key") {
     return runKey(rest, log, error, stdin);
   }
+  if (command === "doctor") {
+    return runDoctor(rest, log, error);
+  }
   if (command === "install") {
     error("The custom downloader has been retired.");
     error("Use `dm install npm:dm-mcp-adapter` instead, then optionally run `dm-mcp-adapter init`.");

package/extensions/dm-mcp-adapter/commands.js

@@ -1,4 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
+import { createConnection } from "node:net";
+import { isDeepStrictEqual } from "node:util";
 import { isServerDisabled } from "./types.js";
 import {
   ensureCompatibilityImports,
@@ -6,6 +8,7 @@ import {
   getMcpDiscoverySummary,
   getMcpStandardConfigSummary,
   getServerProvenance,
+  loadMcpConfig,
   previewCompatibilityImports,
   previewSharedServerEntry,
   previewStarterSharedConfig,
@@ -24,9 +27,11 @@ import { supportsOAuth, authenticate, removeAuth } from "./mcp-auth-flow.js";
 import { getAuthStorageOptions, inspectAuthForUrl } from "./mcp-auth.js";
 import { inspectBearerTokenForUrl, removeBearerToken } from "./mcp-bearer-store.js";
 import { loadOnboardingState, markSetupCompleted as persistSetupCompleted, markSharedConfigHintShown } from "./onboarding-state.js";
-import { formatTerminalError, openPath, resolveServerUrl, sanitizeTerminalText } from "./utils.js";
+import { findPiSignInImports, importPiSignIn } from "./pi-signin-import.js";
+import { formatTerminalError, openPath, providerSignInMessage, resolveServerUrl, sanitizeTerminalText } from "./utils.js";
 import { isAbortError } from "./runtime-owner.js";
 import { resolveJevCredential } from "./jev-key-store.js";
+import { describeProjectServerBlock } from "./project-server-trust.js";
 function terminalHyperlink(label, url) {
   return `\x1B]8;;${sanitizeTerminalText(url)}\x1B\\${sanitizeTerminalText(label)}\x1B]8;;\x1B\\`;
 }
@@ -59,7 +64,7 @@ export async function setupJevSemanticSearch(state, ctx, configOverridePath) {
   if (credential.status !== "present") {
     const detail = credential.status === "unavailable" ? ` ${credential.message}` : "";
     ctx.ui.notify(`Jev needs a System One API key.${detail}
-Run \`dm-mcp-adapter key set systemone\` in a terminal, then run \`/mcp jev setup\` again.`, "error");
+Run \`dm-mcp-adapter key set systemone\` in a terminal, then run \`/mcp-adapter jev setup\` again.`, "error");
     return false;
   }
   const servers = Object.keys(state.config.mcpServers).filter((name) => !isServerDisabled(state.config.mcpServers[name])).sort((a, b) => a.localeCompare(b));
@@ -106,13 +111,21 @@ export async function showStatus(state, ctx) {
   if (!ctx.hasUI)
     return;
   const lines = ["MCP Server Status:", ""];
+  if (state.migrationNotices?.length) {
+    lines.push(...state.migrationNotices.map((notice) => `⚠ ${notice}`), "");
+  }
   if (!state.programmaticConfig) {
-    lines.push("Shared MCP config: .mcp.json for this project/team or ~/.config/mcp/mcp.json for all projects.", "DM-owned files hold compatibility imports and adapter-specific overrides.", "");
+    lines.push("Shared MCP config: .mcp.json for this project/team or ~/.config/mcp/mcp.json for all projects.", "mcp-adapter.json files hold compatibility imports and adapter-specific overrides; DM's mcp.json files are reserved for DM and ignored.", "");
   }
   for (const name of Object.keys(state.config.mcpServers)) {
     const definition = state.config.mcpServers[name];
+    const block = state.blockedProjectServers?.get(name);
+    if (block) {
+      lines.push(`⊘ ${name}: ${describeProjectServerBlock(block.reason)}`);
+      continue;
+    }
     if (isServerDisabled(definition)) {
-      lines.push(`⊘ ${name}: disabled (run /mcp enable ${name}, then /reload)`);
+      lines.push(`⊘ ${name}: disabled (run /mcp-adapter enable ${name}, then /reload)`);
       continue;
     }
     const connection = state.manager.getConnection(name);
@@ -144,7 +157,7 @@ export async function showStatus(state, ctx) {
   }
   if (Object.keys(state.config.mcpServers).length === 0) {
     lines.push("No MCP servers configured");
-    lines.push("Run /mcp setup to add a server to .mcp.json or ~/.config/mcp/mcp.json");
+    lines.push("Run /mcp-adapter setup to add a server to .mcp.json or ~/.config/mcp/mcp.json");
   }
   ctx.ui.notify(lines.join(`
 `), "info");
@@ -213,7 +226,7 @@ export async function reconnectServer(state, ctx, name) {
   }
   if (isServerDisabled(definition)) {
     if (ui)
-      ui.notify(`MCP: ${name} is disabled. Run /mcp enable ${name}, then /reload.`, "warning");
+      ui.notify(`MCP: ${name} is disabled. Run /mcp-adapter enable ${name}, then /reload.`, "warning");
     return false;
   }
   try {
@@ -223,7 +236,7 @@ export async function reconnectServer(state, ctx, name) {
     state.owner?.throwIfInactive();
     if (connection.status === "needs-auth") {
       if (ui) {
-        ui.notify(`MCP: ${name} requires OAuth. Run /mcp-auth ${name} first.`, "warning");
+        ui.notify(typeof definition.auth === "object" ? `MCP: ${providerSignInMessage(name, definition.auth.provider)}` : `MCP: ${name} requires OAuth. Run /mcp-auth ${name} first.`, "warning");
       }
       updateStatusBar(state);
       return false;
@@ -291,10 +304,15 @@ export async function authenticateServer(serverName, config, ctx, signal, runtim
     return { ok: false, message };
   }
   if (isServerDisabled(definition)) {
-    const message = `Server "${serverName}" is disabled. Run /mcp enable ${serverName}, then /reload.`;
+    const message = `Server "${serverName}" is disabled. Run /mcp-adapter enable ${serverName}, then /reload.`;
     ui.notify(message, "warning");
     return { ok: false, message };
   }
+  if (typeof definition.auth === "object") {
+    const message = providerSignInMessage(serverName, definition.auth.provider);
+    ui.notify(message, "info");
+    return { ok: false, message };
+  }
   if (!supportsOAuth(definition)) {
     const message = `Server "${serverName}" does not use OAuth authentication. Set "auth": "oauth" or omit auth for auto-detection.`;
     ui.notify(`Server "${serverName}" does not use OAuth authentication.
@@ -393,7 +411,7 @@ function validateBearerTokenStoreServer(serverName, state) {
   if (!definition)
     return { ok: false, message: `Server "${safeName}" not found in config`, type: "error" };
   if (isServerDisabled(definition))
-    return { ok: false, message: `Server "${safeName}" is disabled. Run /mcp enable ${safeName}, then /reload.`, type: "warning" };
+    return { ok: false, message: `Server "${safeName}" is disabled. Run /mcp-adapter enable ${safeName}, then /reload.`, type: "warning" };
   if (definition.auth !== "bearer" || definition.bearerTokenStore !== true) {
     return { ok: false, message: `Server "${safeName}" is not configured for bearerTokenStore.`, type: "error" };
   }
@@ -453,16 +471,29 @@ function buildSharedConfigNoticeLines(configOverridePath, cwd) {
   return {
     lines: [
       `Using standard MCP config from ${sourceList}.`,
-      "Use .mcp.json for project/team config or ~/.config/mcp/mcp.json for all projects. DM only writes compatibility imports and adapter-specific overrides into DM-owned files when needed."
+      "Use .mcp.json for project/team config or ~/.config/mcp/mcp.json for all projects. The adapter writes compatibility imports and adapter-specific overrides into mcp-adapter.json files when needed."
     ],
     fingerprint: discovery.fingerprint
   };
 }
+function isLocalServerReachable(url, timeoutMs = 1500) {
+  const { hostname, port } = new URL(url);
+  return new Promise((resolve) => {
+    const socket = createConnection({ host: hostname, port: Number(port) });
+    const finish = (reachable) => {
+      socket.destroy();
+      resolve(reachable);
+    };
+    socket.setTimeout(timeoutMs, () => finish(false));
+    socket.once("connect", () => finish(true));
+    socket.once("error", () => finish(false));
+  });
+}
 export async function openMcpSetup(state, pi, ctx, configOverridePath, mode = "setup", options = {}) {
   if (!ctx.hasUI)
     return { configChanged: false };
   if (!canRenderPanel(ctx)) {
-    ctx.ui.notify(`The interactive MCP setup panel is only available in the terminal UI (current mode: ${ctx.mode}). Edit .mcp.json directly, or run /mcp status to review servers.`, "info");
+    ctx.ui.notify(`The interactive MCP setup panel is only available in the terminal UI (current mode: ${ctx.mode}). Edit .mcp.json directly, or run /mcp-adapter status to review servers.`, "info");
     return { configChanged: false };
   }
   if (state.programmaticConfig) {
@@ -506,7 +537,12 @@ export async function openMcpSetup(state, pi, ctx, configOverridePath, mode = "s
     addKnownServer: async (preset, target) => {
       const path = writeSharedServerEntry(getSharedConfigPath(target, ctx.cwd), preset.id, preset.entry);
       configChanged = true;
-      return { path, serverName: preset.name };
+      const active = loadMcpConfig(configOverridePath, ctx.cwd).mcpServers[preset.id];
+      const ignoredBecause = !active ? `the current config mode doesn't read ${path}` : Object.entries(preset.entry).some(([field, value]) => !isDeepStrictEqual(active[field], value)) ? `another config file also defines ${preset.id} and takes precedence` : isServerDisabled(active) ? `another config file disables ${preset.id}` : undefined;
+      const result = { path, serverName: preset.name, ...ignoredBecause ? { ignoredBecause } : {} };
+      if (!preset.desktopApp)
+        return result;
+      return { ...result, reachable: await isLocalServerReachable(preset.entry.url) };
     },
     openPath: async (targetPath) => {
       await openPath(pi, targetPath);
@@ -521,7 +557,7 @@ export async function openMcpSetup(state, pi, ctx, configOverridePath, mode = "s
         done(undefined);
         resolve({ configChanged });
       });
-    }, { overlay: true, overlayOptions: { anchor: "center", width: 92 } });
+    }, { overlay: true, overlayOptions: { anchor: "center", width: 92, maxHeight: "100%", margin: { top: 1, bottom: 1 } } });
   });
 }
 function buildMcpPanelCallbacks(state, config, ctx, getOverlayHandle) {
@@ -545,6 +581,8 @@ function buildMcpPanelCallbacks(state, config, ctx, getOverlayHandle) {
     getConnectionStatus: (serverName) => {
       authStatusFailures.delete(serverName);
       const definition = config.mcpServers[serverName];
+      if (state.blockedProjectServers?.has(serverName))
+        return "blocked";
       if (isServerDisabled(definition))
         return "disabled";
       const connection = state.manager.getConnection(serverName);
@@ -572,7 +610,7 @@ function buildMcpPanelCallbacks(state, config, ctx, getOverlayHandle) {
         return "failed";
       return "idle";
     },
-    getFailureMessage: (serverName) => authStatusFailures.get(serverName) ?? getFailureMessage(state, serverName),
+    getFailureMessage: (serverName) => state.blockedProjectServers?.get(serverName)?.reason ?? authStatusFailures.get(serverName) ?? getFailureMessage(state, serverName),
     refreshCacheAfterReconnect: (serverName) => {
       const freshCache = loadMetadataCache();
       return freshCache?.servers?.[serverName] ?? null;
@@ -603,9 +641,27 @@ export async function openMcpPanel(state, pi, ctx, configOverridePath, onDirectT
   const callbacks = buildMcpPanelCallbacks(state, config, ctx, () => overlayHandle);
   const { createMcpPanel } = await import("./mcp-panel.js");
   let configChanged = false;
+  const authStorageOptions = state.authStorageOptions ?? {};
+  if (findPiSignInImports(config, authStorageOptions).length > 0) {
+    callbacks.importPiSignIns = () => {
+      const imported = [];
+      const failed = [];
+      for (const candidate of findPiSignInImports(config, authStorageOptions)) {
+        try {
+          if (importPiSignIn(candidate, authStorageOptions))
+            imported.push(candidate.serverName);
+        } catch (error) {
+          failed.push({ server: candidate.serverName, error: error instanceof Error ? error.message : String(error) });
+        }
+      }
+      return { imported, failed };
+    };
+  }
   await new Promise((resolve) => {
     ctx.ui.custom((tui, theme, keybindings, done) => {
       return createMcpPanel(config, cache, provenanceMap, callbacks, tui, (result) => {
+        let directToolsSaved = false;
+        let directToolsFileWritten = false;
         (async () => {
           if (!result.cancelled && result.disabledChanges.size > 0) {
             for (const [serverName, disabled] of result.disabledChanges) {
@@ -620,7 +676,10 @@ export async function openMcpPanel(state, pi, ctx, configOverridePath, onDirectT
             }
           }
           if (!result.cancelled && result.changes.size > 0) {
-            writeDirectToolsConfig(result.changes, provenanceMap, config);
+            writeDirectToolsConfig(result.changes, provenanceMap, config, () => {
+              directToolsFileWritten = true;
+            });
+            directToolsSaved = true;
             await onDirectToolsConfigChanged?.(result.changes);
             ctx.ui.notify("Direct tools updated for this session.", "info");
           }
@@ -628,8 +687,15 @@ export async function openMcpPanel(state, pi, ctx, configOverridePath, onDirectT
           resolve();
         })().catch((error) => {
           const message = error instanceof Error ? error.message : String(error);
-          ctx.ui.notify(`Direct tools updated, but live refresh failed: ${message}`, "error");
-          configChanged = true;
+          if (directToolsSaved) {
+            ctx.ui.notify(`Direct tools updated, but live refresh failed: ${message}`, "error");
+            configChanged = true;
+          } else if (directToolsFileWritten) {
+            ctx.ui.notify(`Direct tools were partially saved before another write failed: ${message}`, "error");
+            configChanged = true;
+          } else {
+            ctx.ui.notify(`Failed to save direct tools: ${message}`, "error");
+          }
           done(undefined);
           resolve();
         });