@duckmind/dm-linux-x64 0.65.5 → 0.65.7

package/extensions/dm-mcp-adapter/dist/session-approvals.js

@@ -0,0 +1,127 @@
+import { createHash } from "node:crypto";
+import { logger } from "./logger.js";
+import { stableStringify } from "./utils.js";
+export const MCP_APPROVAL_CUSTOM_TYPE = "mcp-approval-v1";
+const TOOL_APPROVAL_KEYS = [
+  "version",
+  "kind",
+  "decision",
+  "serverName",
+  "originalToolName",
+  "definitionHash",
+  "argsHash"
+];
+const IFRAME_APPROVAL_KEYS = ["version", "kind", "decision", "serverName"];
+const SHA256_HEX = /^[0-9a-f]{64}$/;
+export function computeToolArgumentsHash(args) {
+  return createHash("sha256").update(stableStringify(args ?? {})).digest("hex");
+}
+export function computeToolDefinitionHash(toolMeta) {
+  return createHash("sha256").update(stableStringify({
+    originalName: toolMeta.originalName,
+    inputSchema: toolMeta.inputSchema ?? null,
+    resourceUri: toolMeta.resourceUri ?? null,
+    uiResourceUri: toolMeta.uiResourceUri ?? null
+  })).digest("hex");
+}
+export function makeToolApprovalKey(serverName, originalToolName, definitionHash, argsHash) {
+  return `${serverName}\x00${originalToolName}\x00${definitionHash}\x00${argsHash}`;
+}
+export function getToolApprovalIdentity(serverName, toolMeta, args) {
+  const definitionHash = computeToolDefinitionHash(toolMeta);
+  const argsHash = computeToolArgumentsHash(args);
+  return {
+    definitionHash,
+    argsHash,
+    cacheKey: makeToolApprovalKey(serverName, toolMeta.originalName, definitionHash, argsHash)
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasExactKeys(value, keys) {
+  const actualKeys = Object.keys(value);
+  return actualKeys.length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function isSha256(value) {
+  return typeof value === "string" && SHA256_HEX.test(value);
+}
+function isSessionApprovalEntry(value) {
+  if (!isRecord(value) || value.version !== 1 || !isNonEmptyString(value.serverName))
+    return false;
+  if (value.kind === "tool") {
+    return hasExactKeys(value, TOOL_APPROVAL_KEYS) && value.decision === "allow_for_session" && isNonEmptyString(value.originalToolName) && isSha256(value.definitionHash) && isSha256(value.argsHash);
+  }
+  if (value.kind === "iframe") {
+    return hasExactKeys(value, IFRAME_APPROVAL_KEYS) && (value.decision === "allow" || value.decision === "deny");
+  }
+  return false;
+}
+function isApprovalCustomEntry(entry) {
+  return isRecord(entry) && entry.type === "custom" && entry.customType === MCP_APPROVAL_CUSTOM_TYPE;
+}
+export function createSessionApprovalWriter(appendEntry, canAppend = undefined) {
+  return (record) => {
+    if (canAppend && !canAppend())
+      return;
+    try {
+      appendEntry(MCP_APPROVAL_CUSTOM_TYPE, record);
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      logger.debug(`MCP: failed to persist session approval: ${detail}`);
+    }
+  };
+}
+export function rememberToolApproval(state, serverName, toolMeta, args) {
+  const { definitionHash, argsHash, cacheKey } = getToolApprovalIdentity(serverName, toolMeta, args);
+  const approvedToolCalls = state.approvedToolCalls ??= new Map;
+  if (approvedToolCalls.has(cacheKey))
+    return;
+  approvedToolCalls.set(cacheKey, true);
+  const record = {
+    version: 1,
+    kind: "tool",
+    decision: "allow_for_session",
+    serverName,
+    originalToolName: toolMeta.originalName,
+    definitionHash,
+    argsHash
+  };
+  try {
+    state.persistSessionApproval?.(record);
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    logger.debug(`MCP: session approval persistence callback failed: ${detail}`);
+  }
+}
+export function getServerApprovalIdentity(state, serverName) {
+  if (!Object.hasOwn(state.config.mcpServers, serverName))
+    return;
+  const definition = state.config.mcpServers[serverName];
+  if (!definition)
+    return;
+  return {
+    definition,
+    hash: createHash("sha256").update(stableStringify(definition)).digest("hex")
+  };
+}
+export function restoreSessionApprovalState(state, branchEntries) {
+  const approvedToolCalls = state.approvedToolCalls ??= new Map;
+  approvedToolCalls.clear();
+  state.approvedServers = new Map;
+  state.consentManager.clear();
+  for (const entry of branchEntries) {
+    if (!isApprovalCustomEntry(entry))
+      continue;
+    if (!isSessionApprovalEntry(entry.data))
+      continue;
+    if (entry.data.kind === "tool") {
+      approvedToolCalls.set(makeToolApprovalKey(entry.data.serverName, entry.data.originalToolName, entry.data.definitionHash, entry.data.argsHash), true);
+      continue;
+    }
+    state.consentManager.restoreDecision(entry.data.serverName, entry.data.decision === "allow");
+  }
+}

package/extensions/dm-mcp-adapter/dist/session-recovery.js

@@ -0,0 +1,82 @@
+import { ProtocolError, SdkHttpError, UnauthorizedError } from "@modelcontextprotocol/client";
+import { logger } from "./logger.js";
+import { throwIfAborted } from "./abort.js";
+import { isServerDisabled } from "./types.js";
+import { supportsOAuth } from "./mcp-auth-flow.js";
+import { invalidateAuthEntryCache } from "./mcp-auth.js";
+const CONNECTION_CLOSED_PROTOCOL_CODE = -32000;
+const SERVER_NOT_INITIALIZED_MCP_MESSAGES = new Set([
+  "Server not initialized",
+  "Bad Request: Server not initialized"
+]);
+export function isTerminatedSession(err, hadSessionId) {
+  if (!hadSessionId)
+    return false;
+  if (err instanceof SdkHttpError) {
+    return err.status === 404 || err.status === 400 && /"code"\s*:\s*-32000/.test(err.message) && /"message"\s*:\s*"Bad Request: Server not initialized"/.test(err.message);
+  }
+  return err instanceof ProtocolError && err.code === CONNECTION_CLOSED_PROTOCOL_CODE && SERVER_NOT_INITIALIZED_MCP_MESSAGES.has(err.message);
+}
+function hasSessionId(connection) {
+  const transport = connection.transport;
+  return transport?.sessionId != null;
+}
+
+export class SessionRecoveryAuthRequiredError extends Error {
+  serverName;
+  authMessage;
+  constructor(serverName, authMessage) {
+    super(authMessage ?? `MCP server "${serverName}" requires OAuth authentication after reconnect.`);
+    this.serverName = serverName;
+    this.authMessage = authMessage;
+    this.name = "SessionRecoveryAuthRequiredError";
+  }
+}
+export async function withSessionRecovery(deps, serverName, fn) {
+  if (isServerDisabled(deps.config.mcpServers[serverName])) {
+    throw new Error(`MCP server "${serverName}" is disabled`);
+  }
+  const connection = deps.manager.getConnection(serverName);
+  if (!connection) {
+    throw new Error(`Server "${serverName}" is not connected`);
+  }
+  const hadSessionId = hasSessionId(connection);
+  try {
+    return await fn(connection);
+  } catch (err) {
+    const definition = deps.config.mcpServers[serverName];
+    if (definition && supportsOAuth(definition) && (err instanceof UnauthorizedError || err instanceof SdkHttpError && err.status === 401)) {
+      invalidateAuthEntryCache(serverName);
+    }
+    if (!isTerminatedSession(err, hadSessionId)) {
+      throw err;
+    }
+    if (!definition) {
+      throw err;
+    }
+    throwIfAborted(deps.signal);
+    logger.debug(`MCP session for "${serverName}" expired; reconnecting`, {
+      server: serverName
+    });
+    let freshConnection = deps.signal ? await deps.manager.reconnect(serverName, definition, connection, deps.signal) : await deps.manager.reconnect(serverName, definition, connection);
+    throwIfAborted(deps.signal);
+    if (freshConnection.status === "needs-auth") {
+      freshConnection = await deps.onNeedsAuth?.(serverName) ?? freshConnection;
+      throwIfAborted(deps.signal);
+    }
+    if (freshConnection.status === "needs-auth") {
+      throw new SessionRecoveryAuthRequiredError(serverName);
+    }
+    if (freshConnection.status !== "connected") {
+      throw err;
+    }
+    try {
+      deps.manager.publishMetadataChanged(serverName, freshConnection, "session-reconnect");
+    } catch (publicationError) {
+      const message = publicationError instanceof Error ? publicationError.message : String(publicationError);
+      logger.debug(`MCP metadata publication after reconnect failed for "${serverName}": ${message}`);
+    }
+    throwIfAborted(deps.signal);
+    return fn(freshConnection);
+  }
+}

package/extensions/dm-mcp-adapter/dist/state.js

@@ -0,0 +1 @@
+export {};

package/extensions/dm-mcp-adapter/dist/types.js

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 export const MCP_STATUS_EVENT = "dm-mcp-adapter/status/v1";
 export const MCP_STATUS_SNAPSHOT_VERSION = 1;
 export { UI_STREAM_HOST_CONTEXT_KEY, UI_STREAM_REQUEST_META_KEY, UI_STREAM_RESULT_PATCH_METHOD, SERVER_STREAM_RESULT_PATCH_METHOD, UI_STREAM_STRUCTURED_CONTENT_KEY, uiStreamModeSchema, visualizationStreamPhaseSchema, visualizationStreamFrameTypeSchema, visualizationStreamStatusSchema, uiStreamHostContextSchema, visualizationStreamEnvelopeSchema, uiStreamCallToolResultSchema, uiStreamResultPatchNotificationSchema, serverStreamResultPatchNotificationSchema, getUiStreamHostContext, getVisualizationStreamEnvelope } from "./ui-stream-types.js";
@@ -58,6 +59,27 @@ export function createUiModelContextUpdate(params, maxChars = 12000) {
 export function isServerDisabled(definition) {
   return definition?.disabled === true;
 }
+const ENCODED_SERVER_NAMESPACE_MARKER = "_mcpns_";
+const MAX_SERVER_NAMESPACE_LENGTH = 59;
+export function formatServerNamespace(serverName) {
+  const normalized = serverName.replace(/-/g, "_");
+  const safe = /^[A-Za-z0-9_]*$/.test(normalized) && !normalized.startsWith(ENCODED_SERVER_NAMESPACE_MARKER);
+  const body = safe ? normalized : encodeServerNamespace(normalized);
+  const namespace = safe ? body : `${ENCODED_SERVER_NAMESPACE_MARKER}${body}`;
+  if (namespace.length <= MAX_SERVER_NAMESPACE_LENGTH)
+    return namespace;
+  const digest = createHash("sha256").update(namespace, "utf8").digest("hex").slice(0, 16);
+  const hashPrefix = `${ENCODED_SERVER_NAMESPACE_MARKER}_h_`;
+  const head = body.slice(0, MAX_SERVER_NAMESPACE_LENGTH - hashPrefix.length - digest.length - 1);
+  return `${hashPrefix}${head}_${digest}`;
+}
+function encodeServerNamespace(name) {
+  return Array.from(name, (character) => {
+    if (character === "_")
+      return "__";
+    return /^[A-Za-z0-9]$/.test(character) ? character : `_${character.codePointAt(0).toString(16)}_`;
+  }).join("");
+}
 export const MCP_TOOL_APPROVAL_REQUEST_EVENT = "dm-mcp-adapter:tool-approval-request";
 function sanitizeServerPrefix(serverName, preserveProviderValid = true) {
   const validCharacters = preserveProviderValid ? /^[A-Za-z0-9_-]$/ : /^[A-Za-z0-9]$/;
@@ -79,11 +101,28 @@ export function getServerPrefix(serverName, mode) {
 export function formatToolName(toolName, serverName, prefix) {
   const p = getServerPrefix(serverName, prefix);
   const sanitized = toolName.replace(/\./g, "_");
+  if (p && sanitized.startsWith(`${p}_`) && sanitized.length > p.length + 1) {
+    return sanitized;
+  }
   return p ? `${p}_${sanitized}` : sanitized;
 }
 export function resolveToolPrefix(definition, globalPrefix) {
   return definition?.toolPrefix ?? globalPrefix ?? "server";
 }
+export function resolveUniqueNameOwnership(entries, getName) {
+  const owners = new Map;
+  for (const entry of entries) {
+    const name = getName(entry);
+    const named = owners.get(name) ?? [];
+    named.push(entry);
+    owners.set(name, named);
+  }
+  const collisions = new Map([...owners].filter(([, named]) => named.length > 1));
+  return {
+    unique: entries.filter((entry) => !collisions.has(getName(entry))),
+    collisions
+  };
+}
 export function resolveServerFromToolName(toolName, serverNames, prefix) {
   if (prefix === "none")
     return;

package/extensions/dm-mcp-adapter/dist/ui-resource-handler.js

@@ -0,0 +1,204 @@
+import { RESOURCE_MIME_TYPE } from "./ui-app-bridge-helpers.js";
+import { UrlElicitationRequiredError } from "@modelcontextprotocol/client";
+import { getInputRequiredNeedsUiDetails, InputRequiredNeedsUiError, ResourceFetchError, ResourceParseError } from "./errors.js";
+import { logger } from "./logger.js";
+import { SessionRecoveryAuthRequiredError, withSessionRecovery } from "./session-recovery.js";
+import { isServerDisabled } from "./types.js";
+
+export class UiResourceHandler {
+  manager;
+  config;
+  log = logger.child({ component: "UiResourceHandler" });
+  constructor(manager, config = undefined) {
+    this.manager = manager;
+    this.config = config;
+  }
+  async readUiResource(serverName, uri, options = {}) {
+    const log = this.log.child({ server: serverName, uri });
+    if (!uri.startsWith("ui://")) {
+      throw new ResourceParseError(uri, "URI must start with ui://", { server: serverName });
+    }
+    log.debug("Fetching UI resource");
+    let result;
+    try {
+      const config = options.config ?? this.config;
+      if (config && isServerDisabled(config.mcpServers[serverName])) {
+        throw new Error(`MCP server "${serverName}" is disabled`);
+      }
+      if (config) {
+        this.manager.touch(serverName);
+        this.manager.incrementInFlight(serverName);
+        try {
+          result = await withSessionRecovery({
+            manager: this.manager,
+            config,
+            ...options.signal ? { signal: options.signal } : {},
+            ...options.onNeedsAuth ? { onNeedsAuth: options.onNeedsAuth } : {}
+          }, serverName, async (connection) => {
+            const refreshRead = await this.manager.prepareResourceUse?.(serverName, uri, connection);
+            const requestOptions = this.manager.getRequestOptions(serverName, options.signal);
+            return connection.client.readResource({ uri }, refreshRead ? { ...requestOptions, cacheMode: "refresh" } : requestOptions);
+          });
+        } finally {
+          this.manager.decrementInFlight(serverName);
+          this.manager.touch(serverName);
+        }
+      } else {
+        result = await this.manager.readResource(serverName, uri, options.signal);
+      }
+    } catch (error) {
+      if (error instanceof UrlElicitationRequiredError || error instanceof SessionRecoveryAuthRequiredError)
+        throw error;
+      const inputRequired = getInputRequiredNeedsUiDetails(error, { server: serverName, resourceUri: uri });
+      if (inputRequired) {
+        throw new InputRequiredNeedsUiError(inputRequired, error instanceof Error ? error : undefined);
+      }
+      const message = error instanceof Error ? error.message : String(error);
+      log.error("Failed to read resource", error instanceof Error ? error : undefined);
+      throw new ResourceFetchError(uri, message, {
+        server: serverName,
+        ...error instanceof Error ? { cause: error } : {}
+      });
+    }
+    const content = selectContent(result, uri);
+    const mimeType = content.mimeType;
+    if (mimeType && !isHtmlMimeType(mimeType)) {
+      log.warn("Unsupported MIME type", { mimeType });
+      throw new ResourceParseError(uri, `unsupported MIME type "${mimeType}" (expected text/html or ${RESOURCE_MIME_TYPE})`, { server: serverName, mimeType });
+    }
+    const html = toHtml(content);
+    if (!html.trim()) {
+      log.warn("Resource content is empty");
+      throw new ResourceParseError(uri, "content is empty", { server: serverName });
+    }
+    const contentMeta = extractUiMeta(content._meta);
+    const listMeta = extractUiMeta(this.getListResourceMeta(serverName, uri));
+    log.debug("Resource loaded successfully", {
+      contentLength: html.length,
+      hasCsp: !!contentMeta.csp || !!listMeta.csp
+    });
+    return {
+      uri: content.uri ?? uri,
+      html,
+      mimeType: mimeType ?? RESOURCE_MIME_TYPE,
+      meta: {
+        ...(contentMeta.csp ?? listMeta.csp) !== undefined ? { csp: contentMeta.csp ?? listMeta.csp } : {},
+        ...(contentMeta.permissions ?? listMeta.permissions) !== undefined ? { permissions: contentMeta.permissions ?? listMeta.permissions } : {},
+        ...(contentMeta.domain ?? listMeta.domain) !== undefined ? { domain: contentMeta.domain ?? listMeta.domain } : {},
+        ...(contentMeta.prefersBorder ?? listMeta.prefersBorder) !== undefined ? { prefersBorder: contentMeta.prefersBorder ?? listMeta.prefersBorder } : {}
+      }
+    };
+  }
+  getListResourceMeta(serverName, uri) {
+    const connection = this.manager.getConnection(serverName);
+    if (!connection?.resources?.length)
+      return;
+    const resource = connection.resources.find((entry) => entry.uri === uri);
+    if (!resource || !resource._meta || typeof resource._meta !== "object")
+      return;
+    return resource._meta;
+  }
+}
+function selectContent(result, preferredUri) {
+  const contents = result.contents ?? [];
+  if (contents.length === 0) {
+    throw new Error(`No contents returned for UI resource: ${preferredUri}`);
+  }
+  const byUri = contents.find((content) => content.uri === preferredUri);
+  if (byUri)
+    return byUri;
+  const byHtmlMime = contents.find((content) => content.mimeType && isHtmlMimeType(content.mimeType));
+  if (byHtmlMime)
+    return byHtmlMime;
+  const firstContent = contents[0];
+  if (!firstContent) {
+    throw new Error(`No contents returned for UI resource: ${preferredUri}`);
+  }
+  return firstContent;
+}
+function isHtmlMimeType(mimeType) {
+  const normalized = mimeType.toLowerCase();
+  return normalized.startsWith("text/html") || normalized === RESOURCE_MIME_TYPE.toLowerCase();
+}
+function toHtml(content) {
+  if (typeof content.text === "string") {
+    return content.text;
+  }
+  if (typeof content.blob === "string") {
+    return Buffer.from(content.blob, "base64").toString("utf-8");
+  }
+  throw new Error(`UI resource ${content.uri ?? "(unknown)"} did not include text or blob content`);
+}
+const OPENAI_CSP_FIELD_MAPPINGS = [
+  ["resource_domains", "resourceDomains"],
+  ["connect_domains", "connectDomains"],
+  ["frame_domains", "frameDomains"]
+];
+const UI_CSP_DOMAIN_FIELDS = [
+  "resourceDomains",
+  "connectDomains",
+  "frameDomains",
+  "baseUriDomains"
+];
+function extractUiMeta(meta) {
+  if (!meta || typeof meta !== "object")
+    return {};
+  const ui = isRecord(meta.ui) ? meta.ui : undefined;
+  const out = {};
+  const openAiCsp = Object.hasOwn(meta, "openai/widgetCSP") ? normalizeOpenAiWidgetCsp(meta["openai/widgetCSP"]) : undefined;
+  const hasStandardCsp = !!ui && Object.hasOwn(ui, "csp");
+  const standardCspValue = hasStandardCsp ? ui.csp : undefined;
+  if (hasStandardCsp && !isRecord(standardCspValue)) {
+    out.csp = {};
+  } else {
+    const standardCsp = hasStandardCsp ? normalizeUiResourceCsp(standardCspValue) : undefined;
+    if (openAiCsp || standardCsp) {
+      out.csp = { ...openAiCsp, ...standardCsp };
+      if (isRecord(standardCspValue)) {
+        for (const [, standardField] of OPENAI_CSP_FIELD_MAPPINGS) {
+          if (Object.hasOwn(standardCspValue, standardField) && !copyStringArray(standardCspValue[standardField])) {
+            delete out.csp[standardField];
+          }
+        }
+      }
+    }
+  }
+  if (ui && isRecord(ui.permissions)) {
+    out.permissions = ui.permissions;
+  }
+  if (ui && typeof ui.domain === "string") {
+    out.domain = ui.domain;
+  }
+  if (ui && typeof ui.prefersBorder === "boolean") {
+    out.prefersBorder = ui.prefersBorder;
+  }
+  return out;
+}
+function normalizeUiResourceCsp(value) {
+  if (!isRecord(value))
+    return {};
+  const csp = {};
+  for (const field of UI_CSP_DOMAIN_FIELDS) {
+    const domains = copyStringArray(value[field]);
+    if (domains)
+      csp[field] = domains;
+  }
+  return csp;
+}
+function normalizeOpenAiWidgetCsp(value) {
+  if (!isRecord(value))
+    return {};
+  const csp = {};
+  for (const [sourceField, targetField] of OPENAI_CSP_FIELD_MAPPINGS) {
+    const domains = copyStringArray(value[sourceField]);
+    if (domains)
+      csp[targetField] = domains;
+  }
+  return csp;
+}
+function copyStringArray(value) {
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? [...value] : undefined;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/extensions/dm-mcp-adapter/dist/unix-socket-transport.js

@@ -0,0 +1,83 @@
+import { createConnection } from "node:net";
+import { ReadBuffer, serializeMessage } from "@modelcontextprotocol/client";
+
+export class UnixSocketClientTransport {
+  socketPath;
+  socket;
+  readBuffer = new ReadBuffer;
+  onclose;
+  onerror;
+  onmessage;
+  constructor(socketPath) {
+    this.socketPath = socketPath;
+  }
+  async start() {
+    if (this.socket) {
+      throw new Error("UnixSocketClientTransport already started");
+    }
+    await new Promise((resolve, reject) => {
+      const socket = createConnection(this.socketPath);
+      this.socket = socket;
+      let connected = false;
+      socket.once("connect", () => {
+        connected = true;
+        resolve();
+      });
+      socket.on("data", (chunk) => {
+        try {
+          this.readBuffer.append(chunk);
+          while (true) {
+            const message = this.readBuffer.readMessage();
+            if (message === null)
+              break;
+            this.onmessage?.(message);
+          }
+        } catch (error) {
+          const cause = error instanceof Error ? error : new Error(String(error));
+          this.onerror?.(cause);
+          this.close();
+        }
+      });
+      socket.on("error", (error) => {
+        if (!connected)
+          reject(error);
+        this.onerror?.(error);
+      });
+      socket.on("close", () => {
+        if (this.socket === socket)
+          this.socket = undefined;
+        this.readBuffer.clear();
+        this.onclose?.();
+      });
+    });
+  }
+  async close() {
+    const socket = this.socket;
+    this.socket = undefined;
+    this.readBuffer.clear();
+    if (!socket || socket.destroyed)
+      return;
+    await new Promise((resolve) => {
+      const timeout = setTimeout(() => socket.destroy(), 2000);
+      timeout.unref();
+      socket.once("close", () => {
+        clearTimeout(timeout);
+        resolve();
+      });
+      socket.end();
+    });
+  }
+  async send(message) {
+    const socket = this.socket;
+    if (!socket || socket.destroyed)
+      throw new Error("Unix socket is not connected");
+    await new Promise((resolve, reject) => {
+      socket.write(serializeMessage(message), (error) => {
+        if (error)
+          reject(error);
+        else
+          resolve();
+      });
+    });
+  }
+}

package/extensions/dm-mcp-adapter/dist/utils.js

@@ -1,6 +1,45 @@
 import { spawnSync } from "node:child_process";
+import { existsSync, realpathSync } from "node:fs";
 import { homedir, platform } from "node:os";
-import { extname, isAbsolute, join } from "node:path";
+import { dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import stripJsonComments from "strip-json-comments";
+export function parseJsonWithComments(raw) {
+  return JSON.parse(stripJsonComments(raw, { trailingCommas: true }));
+}
+export function resolveRealContainedPath(root, candidate, allowMissing = false) {
+  const contained = resolveContainedPath(root, candidate);
+  if (!contained)
+    return null;
+  const canonical = (path) => {
+    let existing = path;
+    while (allowMissing && !existsSync(existing)) {
+      const parent = dirname(existing);
+      if (parent === existing)
+        throw new Error("No existing path ancestor");
+      existing = parent;
+    }
+    return resolve(realpathSync(existing), relative(existing, path));
+  };
+  try {
+    return resolveContainedPath(canonical(root), canonical(contained));
+  } catch {
+    return null;
+  }
+}
+export function resolveContainedPath(root, candidate) {
+  const resolved = resolve(root, candidate);
+  const rel = relative(root, resolved);
+  return rel === "" || !rel.startsWith("..") && !rel.startsWith(sep) && !isAbsolute(rel) ? resolved : null;
+}
+export function stableStringify(value) {
+  if (value === null || typeof value !== "object")
+    return JSON.stringify(value) ?? "undefined";
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => stableStringify(item)).join(",")}]`;
+  }
+  const object = value;
+  return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(object[key])}`).join(",")}}`;
+}
 async function execOpen(pi, target, browser, signal) {
   const os = platform();
   if (os === "darwin") {
@@ -43,16 +82,33 @@ export async function parallelLimit(items, limit, fn) {
   return results;
 }
 export function getConfigPathFromArgv() {
-  const idx = process.argv.indexOf("--mcp-config");
-  if (idx >= 0 && idx + 1 < process.argv.length) {
-    return process.argv[idx + 1];
+  let configPath;
+  for (let index = 2;index < process.argv.length; index++) {
+    const arg = process.argv[index];
+    if (arg === undefined)
+      continue;
+    if (arg === "--")
+      break;
+    if (arg === "--mcp-config") {
+      const value = process.argv[index + 1];
+      if (value !== undefined && !value.startsWith("-") && !value.startsWith("@")) {
+        configPath = value;
+        index++;
+      } else {
+        configPath = undefined;
+      }
+      continue;
+    }
+    if (arg.startsWith("--mcp-config=")) {
+      configPath = arg.slice("--mcp-config=".length);
+    }
   }
-  return;
+  return configPath;
 }
 export function interpolateEnvVars(value, environment = process.env) {
   return value.replace(/\$\{(\w+)\}/g, (_, name) => environment[name] ?? "").replace(/\$env:(\w+)/g, (_, name) => environment[name] ?? "").replace(/\{env:(\w+)\}/g, (_, name) => environment[name] ?? "");
 }
-function getMissingEnvVars(value, environment) {
+export function getMissingEnvVars(value, environment = process.env) {
   const missing = new Set;
   for (const match of value.matchAll(/\$\{(\w+)\}|\$env:(\w+)|\{env:(\w+)\}/g)) {
     const name = match[1] ?? match[2] ?? match[3];
@@ -144,11 +200,17 @@ export function resolveServerUrl(definition, environment = process.env) {
 export function resolveConfigPath(value, environment = process.env) {
   if (value === undefined)
     return;
-  const resolved = interpolateEnvVars(value, environment);
+  return expandHomePath(interpolateEnvVars(value, environment));
+}
+export function expandHomePath(value) {
+  if (value === undefined)
+    return;
+  const resolved = value;
   if (resolved === "~")
     return homedir();
-  if (resolved.startsWith("~/") || resolved.startsWith("~\\")) {
-    return join(homedir(), resolved.slice(2));
+  if (resolved.startsWith("~/") || platform() === "win32" && resolved.startsWith("~\\")) {
+    const suffix = platform() === "win32" ? resolved.slice(2).replace(/[\\/]/g, sep) : resolved.slice(2);
+    return join(homedir(), suffix);
   }
   return resolved;
 }
@@ -295,6 +357,19 @@ export function formatMcpStatus(config, message) {
     return;
   return `${config.settings?.showStatusIcon === false ? "MCP: " : "\uD83D\uDD0C MCP: "}${message}`;
 }
+export function formatMcpFooterStatus(config, enabledCount, disabledCount, connectedCount) {
+  if (enabledCount + disabledCount === 0 || config.settings?.mcpFooterStatus === "off")
+    return;
+  const footerStatus = config.settings?.mcpFooterStatus ?? "full";
+  if (footerStatus === "compact")
+    return `MCP ${connectedCount}/${enabledCount}`;
+  let status = `${enabledCount} ${enabledCount === 1 ? "server" : "servers"} enabled`;
+  if (connectedCount > 0)
+    status += ` (${connectedCount} connected)`;
+  if (disabledCount > 0)
+    status += ` (${disabledCount} disabled)`;
+  return formatMcpStatus(config, status);
+}
 export function extractToolUiStreamMode(toolMeta) {
   const uiMeta = toolMeta?.ui;
   if (!uiMeta || typeof uiMeta !== "object")