@fitchmultz/pi-mcp-adapter 8.0.6 → 8.0.7

package/dist/mcp-auth.js

@@ -9,46 +9,47 @@
  * when set, otherwise <Pi agent dir>/fitch-mcp-adapter/mcp-oauth/sha256-<server-hash>/tokens.json,
  * then the plaintext file is removed.
  */
-import { spawnSync } from 'child_process';
-import { createHash } from 'crypto';
-import { createRequire } from 'module';
-import { readFileSync, existsSync, rmSync } from 'fs';
-import { dirname, join } from 'path';
-import { fileURLToPath } from 'url';
-import { getAdapterPath, getAgentPath } from './agent-dir.js';
-import { resolveConfiguredOAuthDir } from './config.js';
+import { spawnSync } from "child_process";
+import { createHash } from "crypto";
+import { createRequire } from "module";
+import { readFileSync, existsSync, rmSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+import { getAdapterPath, getAgentPath } from "./agent-dir.js";
+import { resolveConfiguredOAuthDir } from "./config.js";
 const require = createRequire(import.meta.url);
-const AUTH_SECRET_SERVICE = 'fitch-mcp-adapter.oauth';
-const LEGACY_AUTH_SECRET_SERVICE = 'pi-mcp-adapter.oauth';
-const TEST_AUTH_STORE_ENV = 'PI_MCP_ADAPTER_TEST_AUTH_STORE';
+const AUTH_SECRET_SERVICE = "fitch-mcp-adapter.oauth";
+const LEGACY_AUTH_SECRET_SERVICE = "pi-mcp-adapter.oauth";
+const TEST_AUTH_STORE_ENV = "PI_MCP_ADAPTER_TEST_AUTH_STORE";
 const AUTH_SECRET_CHUNK_SIZE = 1800;
-const KEYRING_RECOVERY_DISABLED_ENV = 'PI_MCP_ADAPTER_DISABLE_KEYRING_RECOVERY';
-const KEYRING_RECOVERY_KEYCTL_ENV = 'PI_MCP_ADAPTER_KEYRING_RECOVERY_KEYCTL';
-const KEYRING_RECOVERY_NODE_ENV = 'PI_MCP_ADAPTER_KEYRING_RECOVERY_NODE';
-const KEYRING_RECOVERY_HELPER_ENV = 'PI_MCP_ADAPTER_KEYRING_RECOVERY_HELPER';
-const TEST_LINUX_KEYRING_RECOVERY_ENV = 'PI_MCP_ADAPTER_TEST_LINUX_KEYRING_RECOVERY';
+const KEYRING_RECOVERY_DISABLED_ENV = "PI_MCP_ADAPTER_DISABLE_KEYRING_RECOVERY";
+const KEYRING_RECOVERY_KEYCTL_ENV = "PI_MCP_ADAPTER_KEYRING_RECOVERY_KEYCTL";
+const KEYRING_RECOVERY_NODE_ENV = "PI_MCP_ADAPTER_KEYRING_RECOVERY_NODE";
+const KEYRING_RECOVERY_HELPER_ENV = "PI_MCP_ADAPTER_KEYRING_RECOVERY_HELPER";
+const TEST_LINUX_KEYRING_RECOVERY_ENV = "PI_MCP_ADAPTER_TEST_LINUX_KEYRING_RECOVERY";
 const KEYRING_RECOVERY_TIMEOUT_MS = 10_000;
-const AUTH_CHUNK_MANIFEST_KEY = '__piMcpAdapterOAuthChunked';
+const AUTH_CHUNK_MANIFEST_KEY = "__piMcpAdapterOAuthChunked";
 export class OAuthCredentialStoreError extends Error {
-    code = 'OAUTH_CREDENTIAL_STORE_UNAVAILABLE';
+    code = "OAUTH_CREDENTIAL_STORE_UNAVAILABLE";
     operation;
     constructor(message, operation, cause) {
         super(isAndroidKeyringLoadFailure(cause)
             ? `${message}. Android/Termux: @napi-rs/keyring could not load a native binding. Persistent OAuth requires a supported platform with an OS credential store; no plaintext fallback is used.`
             : message, { cause });
         this.operation = operation;
-        this.name = 'OAuthCredentialStoreError';
+        this.name = "OAuthCredentialStoreError";
     }
 }
 function causeChainContains(error, pattern) {
     const seen = new Set();
     let current = error;
-    while ((typeof current === 'object' && current !== null) || typeof current === 'function') {
-        if (seen.has(current))
+    while ((typeof current === "object" && current !== null) || typeof current === "function") {
+        if (seen.has(current)) {
             break;
+        }
         seen.add(current);
         const candidate = current;
-        if ([candidate.name, candidate.message, candidate.code].some(value => typeof value === 'string' && pattern.test(value))) {
+        if ([candidate.name, candidate.message, candidate.code].some((value) => typeof value === "string" && pattern.test(value))) {
             return true;
         }
         current = candidate.cause;
@@ -56,15 +57,18 @@ function causeChainContains(error, pattern) {
     return false;
 }
 function isAndroidKeyringLoadFailure(error) {
-    return process.platform === 'android' && causeChainContains(error, /^Failed to load @napi-rs\/keyring;/);
+    return (process.platform === "android" &&
+        causeChainContains(error, /^Failed to load @napi-rs\/keyring;/));
 }
 export function formatOAuthCredentialStoreUnavailable(error) {
-    if (isAndroidKeyringLoadFailure(error))
+    if (isAndroidKeyringLoadFailure(error)) {
         return error.message;
-    if (process.platform === 'linux' && causeChainContains(error, /key\s*(?:has been\s*)?revoked|keyrevoked/i)) {
-        return 'OAuth credential store unavailable: the Linux session keyring may be revoked. Start Pi from a fresh login/keyring session and retry.';
     }
-    return 'OAuth credential store unavailable. Configure or unlock the OS credential store and retry.';
+    if (process.platform === "linux" &&
+        causeChainContains(error, /key\s*(?:has been\s*)?revoked|keyrevoked/i)) {
+        return "OAuth credential store unavailable: the Linux session keyring may be revoked. Start Pi from a fresh login/keyring session and retry.";
+    }
+    return "OAuth credential store unavailable. Configure or unlock the OS credential store and retry.";
 }
 let KeyringEntryClass;
 const memoryAuthEntries = new Map();
@@ -96,17 +100,19 @@ function keyringAuthSecretStore(service) {
 }
 const unavailableAuthSecretStore = {
     read() {
-        throw new Error('simulated secure credential store unavailable');
+        throw new Error("simulated secure credential store unavailable");
     },
     write() {
-        throw new Error('simulated secure credential store unavailable');
+        throw new Error("simulated secure credential store unavailable");
     },
     remove() {
-        throw new Error('simulated secure credential store unavailable');
+        throw new Error("simulated secure credential store unavailable");
     },
 };
 function createKeyRevokedTestError() {
-    return new Error("Couldn't access platform storage: KeyRevoked", { cause: new Error('KeyRevoked') });
+    return new Error("Couldn't access platform storage: KeyRevoked", {
+        cause: new Error("KeyRevoked"),
+    });
 }
 const keyRevokedAuthSecretStore = {
     read() {
@@ -120,12 +126,15 @@ const keyRevokedAuthSecretStore = {
     },
 };
 function getAuthSecretStore(service = AUTH_SECRET_SERVICE) {
-    if (process.env[TEST_AUTH_STORE_ENV] === 'memory')
+    if (process.env[TEST_AUTH_STORE_ENV] === "memory") {
         return memoryAuthSecretStore(service);
-    if (process.env[TEST_AUTH_STORE_ENV] === 'unavailable')
+    }
+    if (process.env[TEST_AUTH_STORE_ENV] === "unavailable") {
         return unavailableAuthSecretStore;
-    if (process.env[TEST_AUTH_STORE_ENV] === 'keyrevoked')
+    }
+    if (process.env[TEST_AUTH_STORE_ENV] === "keyrevoked") {
         return keyRevokedAuthSecretStore;
+    }
     return keyringAuthSecretStore(service);
 }
 function getKeyringEntry(account, service) {
@@ -134,12 +143,12 @@ function getKeyringEntry(account, service) {
         return new KeyringEntryClass(service, account);
     }
     catch (error) {
-        throw new Error('OAuth secure credential storage is unavailable. Configure the OS credential store and retry authentication.', { cause: error });
+        throw new Error("OAuth secure credential storage is unavailable. Configure the OS credential store and retry authentication.", { cause: error });
     }
 }
 function loadKeyringEntryClass(keyringRequire = require, platform = process.platform, arch = process.arch) {
     try {
-        return keyringRequire('@napi-rs/keyring').Entry;
+        return keyringRequire("@napi-rs/keyring").Entry;
     }
     catch (loaderError) {
         try {
@@ -170,157 +179,178 @@ function loadKeyringNativeBindingFallback(keyringRequire, platform, arch) {
     throw lastError instanceof Error ? lastError : new Error(String(lastError));
 }
 function getKeyringNativeBindingTargets(platform, arch) {
-    return getKeyringNativeBindingSuffixes(platform, arch).map(suffix => ({
+    return getKeyringNativeBindingSuffixes(platform, arch).map((suffix) => ({
         packageName: `@napi-rs/keyring-${suffix}`,
         bindingFile: `keyring.${suffix}.node`,
     }));
 }
 function getKeyringNativeBindingSuffixes(platform, arch) {
-    if (platform === 'darwin') {
-        if (arch === 'arm64')
-            return ['darwin-arm64'];
-        if (arch === 'x64')
-            return ['darwin-x64'];
-    }
-    if (platform === 'win32') {
-        if (arch === 'arm64')
-            return ['win32-arm64-msvc'];
-        if (arch === 'x64')
-            return ['win32-x64-msvc'];
-        if (arch === 'ia32')
-            return ['win32-ia32-msvc'];
-    }
-    if (platform === 'linux') {
-        if (arch === 'arm64')
-            return ['linux-arm64-gnu', 'linux-arm64-musl'];
-        if (arch === 'arm')
-            return ['linux-arm-gnueabihf'];
-        if (arch === 'riscv64')
-            return ['linux-riscv64-gnu'];
-        if (arch === 'x64')
-            return ['linux-x64-gnu', 'linux-x64-musl'];
-    }
-    if (platform === 'freebsd' && arch === 'x64')
-        return ['freebsd-x64'];
+    if (platform === "darwin") {
+        if (arch === "arm64") {
+            return ["darwin-arm64"];
+        }
+        if (arch === "x64") {
+            return ["darwin-x64"];
+        }
+    }
+    if (platform === "win32") {
+        if (arch === "arm64") {
+            return ["win32-arm64-msvc"];
+        }
+        if (arch === "x64") {
+            return ["win32-x64-msvc"];
+        }
+        if (arch === "ia32") {
+            return ["win32-ia32-msvc"];
+        }
+    }
+    if (platform === "linux") {
+        if (arch === "arm64") {
+            return ["linux-arm64-gnu", "linux-arm64-musl"];
+        }
+        if (arch === "arm") {
+            return ["linux-arm-gnueabihf"];
+        }
+        if (arch === "riscv64") {
+            return ["linux-riscv64-gnu"];
+        }
+        if (arch === "x64") {
+            return ["linux-x64-gnu", "linux-x64-musl"];
+        }
+    }
+    if (platform === "freebsd" && arch === "x64") {
+        return ["freebsd-x64"];
+    }
     return [];
 }
 function formatErrorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
 function isLinuxKeyringRecoveryEnabled() {
-    if (process.env[KEYRING_RECOVERY_DISABLED_ENV] === '1')
+    if (process.env[KEYRING_RECOVERY_DISABLED_ENV] === "1") {
         return false;
-    return process.platform === 'linux' || process.env[TEST_LINUX_KEYRING_RECOVERY_ENV] === '1';
+    }
+    return process.platform === "linux" || process.env[TEST_LINUX_KEYRING_RECOVERY_ENV] === "1";
 }
 function shouldAttemptLinuxKeyringRecovery(error) {
-    return isLinuxKeyringRecoveryEnabled()
-        && causeChainContains(error, /key\s*(?:has been\s*)?revoked|keyrevoked/i);
+    return (isLinuxKeyringRecoveryEnabled() &&
+        causeChainContains(error, /key\s*(?:has been\s*)?revoked|keyrevoked/i));
 }
 function runLinuxKeyringRecoveryOperation(operation, account, payload, service) {
-    const keyctl = process.env[KEYRING_RECOVERY_KEYCTL_ENV]?.trim() || 'keyctl';
-    const node = process.env[KEYRING_RECOVERY_NODE_ENV]?.trim() || 'node';
-    const helper = process.env[KEYRING_RECOVERY_HELPER_ENV]?.trim()
-        || fileURLToPath(new URL('./mcp-keyring-helper.cjs', import.meta.url));
+    const keyctl = process.env[KEYRING_RECOVERY_KEYCTL_ENV]?.trim() || "keyctl";
+    const node = process.env[KEYRING_RECOVERY_NODE_ENV]?.trim() || "node";
+    const helper = process.env[KEYRING_RECOVERY_HELPER_ENV]?.trim() ||
+        fileURLToPath(new URL("./mcp-keyring-helper.cjs", import.meta.url));
     const request = JSON.stringify({ operation, service, account, payload });
-    const result = spawnSync(keyctl, ['session', '-', node, helper], {
+    const result = spawnSync(keyctl, ["session", "-", node, helper], {
         input: `${request}\n`,
-        encoding: 'utf8',
+        encoding: "utf8",
         maxBuffer: 1024 * 1024,
         timeout: KEYRING_RECOVERY_TIMEOUT_MS,
         windowsHide: true,
     });
     if (result.error) {
-        throw new Error(`Linux keyring recovery helper could not start: ${result.error.message}`, { cause: result.error });
+        throw new Error(`Linux keyring recovery helper could not start: ${result.error.message}`, {
+            cause: result.error,
+        });
     }
     if (result.status !== 0) {
-        throw new Error(`Linux keyring recovery helper failed with exit code ${result.status ?? 'unknown'}`);
+        throw new Error(`Linux keyring recovery helper failed with exit code ${result.status ?? "unknown"}`);
     }
     let response;
     try {
         response = JSON.parse(result.stdout.trim());
     }
     catch (error) {
-        throw new Error('Linux keyring recovery helper returned invalid JSON', { cause: error });
+        throw new Error("Linux keyring recovery helper returned invalid JSON", { cause: error });
     }
-    if (typeof response !== 'object' || response === null || typeof response.ok !== 'boolean') {
-        throw new Error('Linux keyring recovery helper returned an invalid response');
+    if (typeof response !== "object" ||
+        response === null ||
+        typeof response.ok !== "boolean") {
+        throw new Error("Linux keyring recovery helper returned an invalid response");
     }
     const typedResponse = response;
-    if (typedResponse.ok === false) {
-        throw new Error(typedResponse.error || 'Linux keyring recovery helper failed');
+    if (!typedResponse.ok) {
+        throw new Error(typedResponse.error || "Linux keyring recovery helper failed");
     }
-    if (operation === 'read' && typedResponse.found === true && typeof typedResponse.value !== 'string') {
-        throw new Error('Linux keyring recovery helper returned an invalid read response');
+    if (operation === "read" &&
+        typedResponse.found === true &&
+        typeof typedResponse.value !== "string") {
+        throw new Error("Linux keyring recovery helper returned an invalid read response");
     }
     return typedResponse;
 }
 function linuxKeyringRecoveryAuthSecretStore(service = AUTH_SECRET_SERVICE) {
     return {
         read(account) {
-            const response = runLinuxKeyringRecoveryOperation('read', account, undefined, service);
+            const response = runLinuxKeyringRecoveryOperation("read", account, undefined, service);
             return response.ok && response.found === true ? response.value : undefined;
         },
         write(account, payload) {
-            runLinuxKeyringRecoveryOperation('write', account, payload, service);
+            runLinuxKeyringRecoveryOperation("write", account, payload, service);
         },
         remove(account) {
-            runLinuxKeyringRecoveryOperation('remove', account, undefined, service);
+            runLinuxKeyringRecoveryOperation("remove", account, undefined, service);
         },
     };
 }
 export function getAuthStorageOptions(oauthDir, cwd = process.cwd()) {
     const baseDir = resolveConfiguredOAuthDir(oauthDir, cwd);
-    return baseDir ? { baseDir: join(baseDir, 'fitch-mcp-adapter') } : {};
+    return baseDir ? { baseDir: join(baseDir, "fitch-mcp-adapter") } : {};
 }
 export function getAuthBaseDir(options = {}) {
     const override = process.env.FITCH_MCP_OAUTH_DIR?.trim();
-    if (override)
+    if (override) {
         return override;
-    return options.baseDir ?? getAdapterPath('mcp-oauth');
+    }
+    return options.baseDir ?? getAdapterPath("mcp-oauth");
 }
 /**
  * Get the legacy server-specific directory path.
  */
 function getServerDir(serverName, options) {
-    if (typeof serverName !== 'string') {
+    if (typeof serverName !== "string") {
         throw new Error(`Invalid MCP server name: ${JSON.stringify(serverName)}`);
     }
     const storageKey = getAuthEntryAccount(serverName);
     return join(getAuthBaseDir(options), storageKey);
 }
 function getAuthEntryAccount(serverName) {
-    if (typeof serverName !== 'string') {
+    if (typeof serverName !== "string") {
         throw new Error(`Invalid MCP server name: ${JSON.stringify(serverName)}`);
     }
-    return `sha256-${createHash('sha256').update(serverName, 'utf8').digest('hex')}`;
+    return `sha256-${createHash("sha256").update(serverName, "utf8").digest("hex")}`;
 }
 /**
  * Get the legacy plaintext tokens file path for a server.
  */
 export function getAuthEntryFilePath(serverName, options) {
-    return join(getServerDir(serverName, options), 'tokens.json');
+    return join(getServerDir(serverName, options), "tokens.json");
 }
 function parseJsonPayload(serverName, payload, source) {
     try {
         return JSON.parse(payload);
     }
     catch (error) {
-        throw new Error(`Failed to parse OAuth credentials for ${serverName} from ${source}`, { cause: error });
+        throw new Error(`Failed to parse OAuth credentials for ${serverName} from ${source}`, {
+            cause: error,
+        });
     }
 }
 function parseAuthEntryPayload(serverName, payload, source) {
     return parseJsonPayload(serverName, payload, source);
 }
 function isAuthEntryChunkManifest(value) {
-    if (typeof value !== 'object' || value === null)
+    if (typeof value !== "object" || value === null) {
         return false;
+    }
     const manifest = value;
-    return manifest[AUTH_CHUNK_MANIFEST_KEY] === 1
-        && typeof manifest.chunkCount === 'number'
-        && Number.isInteger(manifest.chunkCount)
-        && manifest.chunkCount > 0
-        && typeof manifest.chunkDigest === 'string'
-        && /^[a-f0-9]{16}$/.test(manifest.chunkDigest);
+    return (manifest[AUTH_CHUNK_MANIFEST_KEY] === 1 &&
+        typeof manifest.chunkCount === "number" &&
+        Number.isInteger(manifest.chunkCount) &&
+        manifest.chunkCount > 0 &&
+        typeof manifest.chunkDigest === "string" &&
+        /^[a-f0-9]{16}$/.test(manifest.chunkDigest));
 }
 function getAuthEntryChunkAccount(account, manifest, index) {
     return `${account}.chunk.${manifest.chunkDigest}.${index}`;
@@ -335,7 +365,9 @@ function readChunkManifestFromPayload(serverName, payload, source) {
 function readExistingChunkManifest(store, serverName, account) {
     try {
         const payload = store.read(account);
-        return payload === undefined ? undefined : readChunkManifestFromPayload(serverName, payload, 'OS secure credential store');
+        return payload === undefined
+            ? undefined
+            : readChunkManifestFromPayload(serverName, payload, "OS secure credential store");
     }
     catch {
         return undefined;
@@ -347,8 +379,9 @@ function removeChunkPayloads(store, account, manifest) {
     }
 }
 function tryRemoveChunkPayloads(store, account, manifest) {
-    if (!manifest)
+    if (!manifest) {
         return;
+    }
     try {
         removeChunkPayloads(store, account, manifest);
     }
@@ -360,7 +393,7 @@ function createChunkManifest(payload) {
     return {
         [AUTH_CHUNK_MANIFEST_KEY]: 1,
         chunkCount: Math.ceil(payload.length / AUTH_SECRET_CHUNK_SIZE),
-        chunkDigest: createHash('sha256').update(payload, 'utf8').digest('hex').slice(0, 16),
+        chunkDigest: createHash("sha256").update(payload, "utf8").digest("hex").slice(0, 16),
     };
 }
 function readChunkedAuthEntry(store, serverName, account, manifest) {
@@ -373,22 +406,24 @@ function readChunkedAuthEntry(store, serverName, account, manifest) {
             return chunk;
         }
         catch (error) {
-            throw new OAuthCredentialStoreError(`Failed to read OAuth credentials for ${serverName} from the OS secure credential store`, 'read', error);
+            throw new OAuthCredentialStoreError(`Failed to read OAuth credentials for ${serverName} from the OS secure credential store`, "read", error);
         }
     });
-    return parseAuthEntryPayload(serverName, chunks.join(''), 'OS secure credential store chunks');
+    return parseAuthEntryPayload(serverName, chunks.join(""), "OS secure credential store chunks");
 }
 function readLegacyAuthEntry(serverName, options) {
     const filePath = getAuthEntryFilePath(serverName, options);
-    if (!existsSync(filePath))
+    if (!existsSync(filePath)) {
         return undefined;
-    const data = readFileSync(filePath, 'utf-8');
+    }
+    const data = readFileSync(filePath, "utf-8");
     return parseAuthEntryPayload(serverName, data, filePath);
 }
 function removeLegacyAuthEntry(serverName, options) {
     const filePath = getAuthEntryFilePath(serverName, options);
-    if (!existsSync(filePath))
+    if (!existsSync(filePath)) {
         return;
+    }
     try {
         rmSync(filePath, { force: true });
     }
@@ -426,7 +461,7 @@ function writeSecureAuthEntryToStore(store, serverName, entry) {
     }
     catch (error) {
         tryRemoveChunkPayloads(store, account, manifest);
-        throw new OAuthCredentialStoreError(`Failed to write OAuth credentials for ${serverName} to the OS secure credential store`, 'write', error);
+        throw new OAuthCredentialStoreError(`Failed to write OAuth credentials for ${serverName} to the OS secure credential store`, "write", error);
     }
 }
 function writeSecureAuthEntry(serverName, entry) {
@@ -434,8 +469,9 @@ function writeSecureAuthEntry(serverName, entry) {
         writeSecureAuthEntryToStore(getAuthSecretStore(), serverName, entry);
     }
     catch (error) {
-        if (!shouldAttemptLinuxKeyringRecovery(error))
+        if (!shouldAttemptLinuxKeyringRecovery(error)) {
             throw error;
+        }
         writeSecureAuthEntryToStore(linuxKeyringRecoveryAuthSecretStore(), serverName, entry);
     }
 }
@@ -446,58 +482,64 @@ function readSecureAuthEntryFromStore(store, serverName) {
         payload = store.read(account);
     }
     catch (error) {
-        throw new OAuthCredentialStoreError(`Failed to read OAuth credentials for ${serverName} from the OS secure credential store`, 'read', error);
+        throw new OAuthCredentialStoreError(`Failed to read OAuth credentials for ${serverName} from the OS secure credential store`, "read", error);
     }
-    if (payload === undefined)
+    if (payload === undefined) {
         return undefined;
-    const manifest = readChunkManifestFromPayload(serverName, payload, 'OS secure credential store');
+    }
+    const manifest = readChunkManifestFromPayload(serverName, payload, "OS secure credential store");
     return manifest
         ? readChunkedAuthEntry(store, serverName, account, manifest)
-        : parseAuthEntryPayload(serverName, payload, 'OS secure credential store');
+        : parseAuthEntryPayload(serverName, payload, "OS secure credential store");
 }
 function readSecureAuthEntry(serverName, service = AUTH_SECRET_SERVICE) {
     try {
         return readSecureAuthEntryFromStore(getAuthSecretStore(service), serverName);
     }
     catch (error) {
-        if (!shouldAttemptLinuxKeyringRecovery(error))
+        if (!shouldAttemptLinuxKeyringRecovery(error)) {
             throw error;
+        }
         return readSecureAuthEntryFromStore(linuxKeyringRecoveryAuthSecretStore(service), serverName);
     }
 }
 function readAuthEntry(serverName, options, behavior = {}) {
     const entry = readSecureAuthEntry(serverName);
     if (entry !== undefined) {
-        if (behavior.migrateLegacy !== false)
+        if (behavior.migrateLegacy !== false) {
             removeLegacyAuthEntry(serverName, options);
+        }
         return entry;
     }
     const legacyEntry = readLegacyAuthEntry(serverName, options);
-    if (!legacyEntry || behavior.migrateLegacy === false)
+    if (!legacyEntry || behavior.migrateLegacy === false) {
         return legacyEntry;
+    }
     writeSecureAuthEntry(serverName, legacyEntry);
     removeLegacyAuthEntry(serverName, options);
     return legacyEntry;
 }
 /** Explicit copy-only upgrade. Normal reads and logout never access the old service. */
-export function migrateLegacyAuthEntry(serverName, legacyDirectory = process.env.MCP_OAUTH_DIR?.trim() || getAgentPath('mcp-oauth')) {
-    if (readSecureAuthEntry(serverName) !== undefined)
-        return 'existing';
+export function migrateLegacyAuthEntry(serverName, legacyDirectory = process.env.MCP_OAUTH_DIR?.trim() || getAgentPath("mcp-oauth")) {
+    if (readSecureAuthEntry(serverName) !== undefined) {
+        return "existing";
+    }
     let entry = readSecureAuthEntry(serverName, LEGACY_AUTH_SECRET_SERVICE);
     if (entry === undefined) {
-        const path = join(legacyDirectory, getAuthEntryAccount(serverName), 'tokens.json');
-        if (!existsSync(path))
-            return 'absent';
-        entry = parseAuthEntryPayload(serverName, readFileSync(path, 'utf8'), path);
+        const path = join(legacyDirectory, getAuthEntryAccount(serverName), "tokens.json");
+        if (!existsSync(path)) {
+            return "absent";
+        }
+        entry = parseAuthEntryPayload(serverName, readFileSync(path, "utf8"), path);
     }
-    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
         throw new Error(`Invalid legacy OAuth entry for ${serverName}`);
     }
     writeSecureAuthEntry(serverName, entry);
     if (JSON.stringify(readSecureAuthEntry(serverName)) !== JSON.stringify(entry)) {
         throw new Error(`Failed to verify migrated OAuth credentials for ${serverName}`);
     }
-    return 'copied';
+    return "copied";
 }
 /**
  * Get auth entry for a server.
@@ -511,14 +553,17 @@ export function getAuthEntry(serverName, options) {
  */
 export function getAuthForUrl(serverName, serverUrl, options) {
     const entry = getAuthEntry(serverName, options);
-    if (!entry)
+    if (!entry) {
         return undefined;
+    }
     // If no serverUrl is stored, this is from an old version - consider it invalid
-    if (!entry.serverUrl)
+    if (!entry.serverUrl) {
         return undefined;
+    }
     // If URL has changed, credentials are invalid
-    if (entry.serverUrl !== serverUrl)
+    if (entry.serverUrl !== serverUrl) {
         return undefined;
+    }
     return entry;
 }
 /**
@@ -529,14 +574,16 @@ export function getAuthForUrl(serverName, serverUrl, options) {
 export function inspectAuthForUrl(serverName, serverUrl, options) {
     try {
         const entry = readAuthEntry(serverName, options, { migrateLegacy: false });
-        if (!entry?.serverUrl || entry.serverUrl !== serverUrl)
-            return { status: 'absent' };
-        return { status: 'present', entry };
+        if (!entry?.serverUrl || entry.serverUrl !== serverUrl) {
+            return { status: "absent" };
+        }
+        return { status: "present", entry };
     }
     catch (error) {
-        if (!(error instanceof OAuthCredentialStoreError))
+        if (!(error instanceof OAuthCredentialStoreError)) {
             throw error;
-        return { status: 'unavailable', message: formatOAuthCredentialStoreUnavailable(error) };
+        }
+        return { status: "unavailable", message: formatOAuthCredentialStoreUnavailable(error) };
     }
 }
 /**
@@ -557,13 +604,16 @@ function removeAuthEntryFromStore(store, serverName) {
     const account = getAuthEntryAccount(serverName);
     try {
         const payload = store.read(account);
-        const manifest = payload === undefined ? undefined : readChunkManifestFromPayload(serverName, payload, 'OS secure credential store');
-        if (manifest)
+        const manifest = payload === undefined
+            ? undefined
+            : readChunkManifestFromPayload(serverName, payload, "OS secure credential store");
+        if (manifest) {
             removeChunkPayloads(store, account, manifest);
+        }
         store.remove(account);
     }
     catch (error) {
-        throw new OAuthCredentialStoreError(`Failed to remove OAuth credentials for ${serverName} from the OS secure credential store`, 'remove', error);
+        throw new OAuthCredentialStoreError(`Failed to remove OAuth credentials for ${serverName} from the OS secure credential store`, "remove", error);
     }
 }
 export function removeAuthEntry(serverName, options) {
@@ -571,8 +621,9 @@ export function removeAuthEntry(serverName, options) {
         removeAuthEntryFromStore(getAuthSecretStore(), serverName);
     }
     catch (error) {
-        if (!shouldAttemptLinuxKeyringRecovery(error))
+        if (!shouldAttemptLinuxKeyringRecovery(error)) {
             throw error;
+        }
         removeAuthEntryFromStore(linuxKeyringRecoveryAuthSecretStore(), serverName);
     }
     removeLegacyAuthEntry(serverName, options);