@humain/terminal 0.1.1 → 0.2.1

package/dist/humain/mcp-adapter/vendor/mcp-status.ts

@@ -24,6 +24,10 @@ export function createMcpStatusSnapshot(state: McpExtensionState): McpStatusSnap
     const activeFailure = !disabled && isServerInActiveFailureBackoff(state, name);
     const metadata = disabled || activeFailure ? undefined : state.toolMetadata.get(name);
     const toolCount = metadata?.length ?? (connection?.status === "connected" ? connection.tools.length : 0);
+    // This is the last active direct-tool sync result, rather than a fresh
+    // resolution. A frozen direct surface may intentionally retain its
+    // registrations while the server is in failure backoff.
+    const directToolCount = disabled ? 0 : state.directToolCounts?.get(name) ?? 0;
     const resourceCount = disabled || activeFailure
       ? undefined
       : state.resourceCounts?.get(name) ?? (connection?.status === "connected" ? connection.resources.length : undefined);
@@ -50,6 +54,7 @@ export function createMcpStatusSnapshot(state: McpExtensionState): McpStatusSnap
       status,
       listenState: connection?.status === "connected" ? connection.listenState : "disconnected",
       toolCount,
+      directToolCount,
       ...(connection?.status === "connected" && connection.listenCatalogStale ? { catalogStale: true } : {}),
       ...(resourceCount !== undefined ? { resourceCount } : {}),
       ...(status === "failed" && failedAgoSeconds !== null ? { failedAgoSeconds } : {}),

package/dist/humain/mcp-adapter/vendor/metadata-cache.ts

@@ -3,6 +3,7 @@ import { existsSync, readFileSync, writeFileSync, renameSync, mkdirSync } from "
 import { dirname } from "node:path";
 import { getAgentPath } from "./agent-dir.ts";
 import { createHash } from "node:crypto";
+import { isBuiltInAgentPlugin } from "./agent-plugin-provenance.ts";
 import { getToolUiResourceUri } from "./ui-app-bridge-helpers.ts";
 import type {
   CachedPrompt,
@@ -28,6 +29,7 @@ import {
   resolveBearerToken,
   resolveConfigPath,
   resolveServerUrl,
+  stableStringify,
 } from "./utils.ts";
 import { extractUiToolVisibility, isUiToolVisibleToModel } from "./ui-tool-visibility.ts";
 
@@ -87,10 +89,10 @@ export function computeServerHash(definition: ServerEntry, environment: NodeJS.P
     command: definition.command,
     args: definition.args,
     socket: resolveConfigPath(definition.socket, environment),
-    env: interpolateEnvRecord(definition.env, environment),
-    cwd: resolveConfigPath(definition.cwd, environment),
+    env: isBuiltInAgentPlugin(definition, "env") ? definition.env : interpolateEnvRecord(definition.env, environment),
+    cwd: isBuiltInAgentPlugin(definition, "cwd") ? definition.cwd : resolveConfigPath(definition.cwd, environment),
     url: resolveServerUrl(definition, environment),
-    headers: interpolateEnvRecord(definition.headers, environment),
+    headers: isBuiltInAgentPlugin(definition, "headers") ? definition.headers : interpolateEnvRecord(definition.headers, environment),
     requestHeadersCommand: definition.requestHeadersCommand
       ? {
           command: interpolateEnvVars(definition.requestHeadersCommand.command, environment),
@@ -231,6 +233,7 @@ export function reconstructToolMetadata(
       originalName: tool.name,
       description: tool.description ?? "",
       ...(tool.inputSchema !== undefined ? { inputSchema: tool.inputSchema } : {}),
+      ...(tool.outputSchema !== undefined ? { outputSchema: tool.outputSchema } : {}),
       ...(tool.uiResourceUri !== undefined ? { uiResourceUri: tool.uiResourceUri } : {}),
       ...(tool.uiVisibility !== undefined ? { uiVisibility: tool.uiVisibility } : {}),
       ...(tool.uiStreamMode !== undefined ? { uiStreamMode: tool.uiStreamMode } : {}),
@@ -298,6 +301,7 @@ export function serializeTools(tools: McpTool[]): CachedTool[] {
         name: t.name,
         ...(t.description !== undefined ? { description: t.description } : {}),
         ...(t.inputSchema !== undefined ? { inputSchema: t.inputSchema } : {}),
+        ...(t.outputSchema !== undefined ? { outputSchema: t.outputSchema } : {}),
         ...(uiResourceUri !== undefined ? { uiResourceUri } : {}),
         ...(uiVisibility !== undefined ? { uiVisibility } : {}),
         ...(uiStreamMode !== undefined ? { uiStreamMode } : {}),
@@ -360,19 +364,6 @@ export function reconstructPromptMetadata(
   });
 }
 
-function stableStringify(value: unknown): string {
-  if (value === null || value === undefined || typeof value !== "object") {
-    const serialized = JSON.stringify(value);
-    return serialized === undefined ? "undefined" : serialized;
-  }
-  if (Array.isArray(value)) {
-    return `[${value.map(v => stableStringify(v)).join(",")}]`;
-  }
-  const obj = value as Record<string, unknown>;
-  const keys = Object.keys(obj).sort();
-  return `{${keys.map(k => `${JSON.stringify(k)}:${stableStringify(obj[k])}`).join(",")}}`;
-}
-
 function tryGetToolUiResourceUri(tool: McpTool): string | undefined {
   try {
     return getToolUiResourceUri({ _meta: tool._meta });

package/dist/humain/mcp-adapter/vendor/namespace-tools.ts

@@ -3,7 +3,6 @@ import { Type } from "typebox";
 import type { McpExtensionState } from "./state.ts";
 import { isServerDisabled, type McpConfig } from "./types.ts";
 import { isServerCacheValid, type MetadataCache } from "./metadata-cache.ts";
-import { executeCall } from "./proxy-modes.ts";
 import { createMcpProxyToolCallRenderer, createMcpToolResultRenderer, resolveMcpToolRenderOptions, type McpToolRenderOptions, type RenderTheme, type McpToolRenderContext } from "./tool-result-renderer.ts";
 export { namespaceProxyName } from "./mcp-references.ts";
 import { hasCallableCachedTargets, isMcpServerDirectlyRegistered, namespaceProxyName, type DirectToolSelectorOverride } from "./mcp-references.ts";
@@ -95,10 +94,22 @@ function resolveNamespaceProxyTools(
 export type GetState = () => McpExtensionState | null;
 export type GetInitPromise = () => Promise<McpExtensionState> | null;
 export type GetPiTools = () => ToolInfo[];
+export type EnsureNamespaceRuntime = (ctx: unknown) => Promise<McpExtensionState | null>;
+export type ExecuteNamespaceCall = (
+  state: McpExtensionState,
+  toolName: string,
+  args: Record<string, unknown>,
+  serverName: string,
+  getPiTools: GetPiTools,
+  signal: AbortSignal | undefined,
+  origin: "proxy",
+) => Promise<AgentToolResult<Record<string, unknown>>>;
 
 function namespaceExecute(
   getState: GetState,
   getInitPromise: GetInitPromise,
+  ensureRuntime: EnsureNamespaceRuntime | undefined,
+  executeCall: ExecuteNamespaceCall,
   serverName: string,
   getPiTools: GetPiTools,
 ) {
@@ -106,6 +117,8 @@ function namespaceExecute(
     _toolCallId: string,
     params: { tool?: string; args?: Record<string, unknown> },
     signal: AbortSignal | undefined,
+    _onUpdate: unknown,
+    ctx: unknown,
   ): Promise<AgentToolResult<Record<string, unknown>>> => {
     if (typeof params.tool !== "string" || params.tool.length === 0) {
       return {
@@ -114,6 +127,17 @@ function namespaceExecute(
       };
     }
     let state = getState();
+    if (!state && ensureRuntime) {
+      try {
+        state = await ensureRuntime(ctx);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text" as const, text: `MCP initialization failed for ${serverName}: ${message}` }],
+          details: { error: "init_failed", server: serverName, message },
+        };
+      }
+    }
     if (!state) {
       const initPromise = getInitPromise();
       if (initPromise) {
@@ -150,7 +174,7 @@ const parameters = Type.Object({
   tool: Type.String({ description: "Underlying MCP tool name to call on this server." }),
   args: Type.Optional(Type.Object({}, {
     additionalProperties: true,
-    description: "Arguments for the underlying tool. The exact shape depends on the tool being called; use mcp({ describe: 'server/tool' }) to inspect.",
+    description: "Arguments for the underlying tool. When mcp is available, use mcp({ search: '...' }) to inspect schemas; for unique names use mcp({ describe: 'tool_name' }) with the exact tool name returned by search.",
   })),
 });
 
@@ -165,10 +189,14 @@ export interface SyncNamespaceProxyToolsInput {
   pi: ExtensionAPI;
   getState: GetState;
   getInitPromise: GetInitPromise;
+  ensureRuntime?: EnsureNamespaceRuntime;
+  executeCall?: ExecuteNamespaceCall;
   getPiTools: GetPiTools;
   renderOptions?: McpToolRenderOptions;
   renderShell?: "self" | "default";
   renderResult?: unknown;
+  guardReentrant?: () => void;
+  onToolRegistered?: (name: string) => void;
 }
 
 export interface SyncNamespaceProxyToolsResult {
@@ -187,6 +215,15 @@ function createNamespaceRenderCall(renderOptions: McpToolRenderOptions, serverNa
   }, theme, context);
 }
 
+let defaultProxyModesPromise: Promise<typeof import("./proxy-modes.ts")> | null = null;
+async function loadDefaultExecuteCall(): Promise<(typeof import("./proxy-modes.ts"))["executeCall"]> {
+  defaultProxyModesPromise ??= import("./proxy-modes.ts").catch((error) => {
+    defaultProxyModesPromise = null;
+    throw error;
+  });
+  return (await defaultProxyModesPromise).executeCall;
+}
+
 function registerNamespaceProxyTool(
   input: SyncNamespaceProxyToolsInput,
   spec: NamespaceProxySpec,
@@ -194,6 +231,17 @@ function registerNamespaceProxyTool(
   renderShell: "self" | "default",
   renderResult: unknown,
 ): void {
+  const executeCall = input.executeCall ?? (async (...args: Parameters<ExecuteNamespaceCall>) => {
+    const expectedState = args[0];
+    const loadedExecuteCall = await loadDefaultExecuteCall();
+    if (input.getState() !== expectedState || expectedState.owner?.isActive() === false) {
+      throw expectedState.owner?.signal.reason ?? new Error("MCP namespace operation belongs to a stale session");
+    }
+    return loadedExecuteCall(...args);
+  });
+
+  input.onToolRegistered?.(spec.toolName);
+  input.guardReentrant?.();
   (input.pi.registerTool as (tool: unknown) => unknown)({
     name: spec.toolName,
     label: `MCP: ${spec.serverName}`,
@@ -206,10 +254,13 @@ function registerNamespaceProxyTool(
     execute: namespaceExecute(
       input.getState,
       input.getInitPromise,
+      input.ensureRuntime,
+      executeCall,
       spec.serverName,
       input.getPiTools,
     ),
   });
+  input.guardReentrant?.();
 }
 
 function getActiveToolsForStaleCleanup(pi: ExtensionAPI, staleNames: string[]): string[] | undefined {
@@ -232,16 +283,23 @@ function deactivateStaleNamespaceTools(input: SyncNamespaceProxyToolsInput, next
     unregisterTool?: (name: string) => boolean;
   }).unregisterTool;
   for (const stale of staleNames) {
-    if (unregisterTool?.(stale)) deactivated.push(stale);
+    input.guardReentrant?.();
+    const removed = unregisterTool?.(stale);
+    input.guardReentrant?.();
+    if (removed) deactivated.push(stale);
   }
+  input.guardReentrant?.();
   const activeTools = getActiveToolsForStaleCleanup(input.pi, staleNames);
+  input.guardReentrant?.();
   if (!activeTools) return deactivated;
 
   const stale = new Set(staleNames);
   const nextActiveTools = activeTools.filter((name) => !stale.has(name));
   if (nextActiveTools.length === activeTools.length) return deactivated;
 
+  input.guardReentrant?.();
   input.pi.setActiveTools(nextActiveTools);
+  input.guardReentrant?.();
   for (const name of staleNames) {
     if (!deactivated.includes(name)) deactivated.push(name);
   }

package/dist/humain/mcp-adapter/vendor/oauth.ts

@@ -6,12 +6,16 @@ import {
   type StoredTokens,
 } from "./mcp-auth.ts";
 
+import type { ServerEntry } from "./types.ts";
+
 export type McpOAuthTokens = StoredTokens;
 export type McpOAuthStorageOptions = AuthStorageOptions;
 export interface McpOAuthTokenOptions {
   authStorageOptions?: McpOAuthStorageOptions;
   signal?: AbortSignal;
   skipIssuerMetadataValidation?: boolean;
+  /** Explicit refresh configuration; never loaded from ambient config or stored with tokens. */
+  definition?: Pick<ServerEntry, "headers" | "oauth">;
 }
 export type McpOAuthTokenStatus =
   | { status: "present"; tokens: McpOAuthTokens }
@@ -38,11 +42,11 @@ export function inspectMcpOAuthTokensForUrl(
     : { status: "absent" };
 }
 
-export function updateMcpOAuthTokensForUrl(
+export async function updateMcpOAuthTokensForUrl(
   serverName: string,
   serverUrl: string,
   tokens: McpOAuthTokens,
   options?: McpOAuthStorageOptions,
-): void {
+): Promise<void> {
   updateTokens(serverName, tokens, serverUrl, options);
 }

package/dist/humain/mcp-adapter/vendor/package-mcp-loader.ts

@@ -1,8 +1,8 @@
-import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
-import { isAbsolute, join, relative, resolve, sep } from "node:path";
-import stripJsonComments from "strip-json-comments";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { isAbsolute, join, resolve } from "node:path";
 import { getAgentDir, getConfigDirName } from "./agent-dir.ts";
 import type { McpConfig, ServerEntry } from "./types.ts";
+import { parseJsonWithComments, resolveContainedPath, resolveRealContainedPath } from "./utils.ts";
 
 interface PackageSetting {
   source: string;
@@ -130,7 +130,7 @@ function readMcpConfig(path: string, packageName: string): McpConfig | null {
 
 function readRequiredJson(path: string, description: string): unknown {
   try {
-    return JSON.parse(stripJsonComments(readFileSync(path, "utf8"), { trailingCommas: true }));
+    return parseJsonWithComments(readFileSync(path, "utf8"));
   } catch (error) {
     throw new Error(`${description} ${path} contains invalid JSON: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
   }
@@ -141,22 +141,10 @@ function readOptionalJson(path: string, description: string): unknown | undefine
   return readRequiredJson(path, description);
 }
 
-function resolveContainedPath(root: string, path: string): string | null {
-  const resolved = resolve(root, path);
-  const rel = relative(root, resolved);
-  return rel === "" || (!rel.startsWith("..") && !rel.startsWith(sep) && !isAbsolute(rel)) ? resolved : null;
-}
-
 function resolvePackageConfigPath(packageRoot: string, path: string): string | null {
   const lexicalPath = resolveContainedPath(packageRoot, path);
   if (!lexicalPath || !existsSync(lexicalPath) || !statSync(lexicalPath).isFile()) return null;
-  try {
-    const realPackageRoot = realpathSync(packageRoot);
-    const realConfigPath = realpathSync(lexicalPath);
-    return resolveContainedPath(realPackageRoot, realConfigPath);
-  } catch {
-    return null;
-  }
+  return resolveRealContainedPath(packageRoot, lexicalPath);
 }
 
 function formatPackageName(name: string): string {

package/dist/humain/mcp-adapter/vendor/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-mcp-adapter",
-	"version": "2.32.1",
+	"version": "2.34.0",
 	"description": "MCP (Model Context Protocol) adapter extension for Pi coding agent",
 	"type": "module",
 	"types": "./index.ts",
@@ -48,7 +48,7 @@
 		"test:public-exports": "npm run build:public && node --test public-exports.test.mjs",
 		"test:watch": "vitest",
 		"test:coverage": "vitest run --coverage",
-		"test:oauth": "PI_MCP_ADAPTER_TEST_AUTH_STORE=memory PI_MCP_ADAPTER_DISABLE_AUTH_CACHE=1 node --import tsx --test --test-concurrency=1 oauth-public-api.test.ts mcp-auth.test.ts mcp-auth-flow.test.ts mcp-callback-server.test.ts mcp-oauth-provider.test.ts",
+		"test:oauth": "PI_MCP_ADAPTER_TEST_AUTH_STORE=memory PI_MCP_ADAPTER_DISABLE_AUTH_CACHE=1 node --import tsx --test --test-concurrency=1 oauth-public-api.test.ts mcp-auth.test.ts mcp-auth-flow.test.ts mcp-auth-flow-timeout.test.ts mcp-auth-fetch.test.ts mcp-callback-server.test.ts mcp-oauth-provider.test.ts mcp-local-oauth-flow.test.ts",
 		"test:oauth-provider": "PI_MCP_ADAPTER_TEST_AUTH_STORE=memory PI_MCP_ADAPTER_DISABLE_AUTH_CACHE=1 node --import tsx --test mcp-oauth-provider.test.ts",
 		"test:conformance": "bash conformance/run.sh"
 	},
@@ -89,11 +89,14 @@
 		"ts-shape.ts",
 		"search-ranking.ts",
 		"tool-approval.ts",
+		"session-approvals.ts",
 		"init.ts",
 		"failure-backoff.ts",
 		"ui-session.ts",
 		"proxy-modes.ts",
 		"direct-tools.ts",
+		"direct-tool-surface.ts",
+		"lazy-loader.ts",
 		"namespace-tools.ts",
 		"mcp-references.ts",
 		"commands.ts",
@@ -105,8 +108,10 @@
 		"ui-tool-visibility.ts",
 		"ui-app-bridge-helpers.ts",
 		"config.ts",
+		"claude-plugin-loader.ts",
 		"package-mcp-loader.ts",
 		"server-manager.ts",
+		"http-ca.ts",
 		"request-headers-command.ts",
 		"unix-socket-transport.ts",
 		"json-schema-validator.ts",
@@ -119,7 +124,9 @@
 		"mcp-code.ts",
 		"mcp-script-worker.mjs",
 		"mcp-probe.ts",
+		"mcp-install.ts",
 		"agent-plugin-loader.ts",
+		"agent-plugin-provenance.ts",
 		"resource-tools.ts",
 		"lifecycle.ts",
 		"mcp-status.ts",
@@ -139,7 +146,9 @@
 		"mcp-oauth-provider.ts",
 		"mcp-callback-server.ts",
 		"mcp-auth-flow.ts",
+		"mcp-auth-fetch.ts",
 		"mcp-panel.ts",
+		"mcp-panel-theme.ts",
 		"panel-keys.ts",
 		"mcp-trace.ts",
 		"logger.ts",
@@ -164,10 +173,11 @@
 		"recheck": "^4.5.0",
 		"smol-toml": "^1.6.1",
 		"strip-json-comments": "^5.0.3",
+		"undici": "^6.28.1",
 		"zod": "^3.25.0 || ^4.0.0"
 	},
 	"peerDependencies": {
-		"@earendil-works/pi-ai": "^0.84.1",
+		"@earendil-works/pi-ai": "^0.84.1 || ^0.85.0",
 		"@earendil-works/pi-tui": "*",
 		"typebox": "*",
 		"zod": "^3.25.0 || ^4.0.0"

package/dist/humain/mcp-adapter/vendor/prompts.ts

@@ -6,7 +6,6 @@ import type {
 import type { McpExtensionState } from "./state.ts";
 import { isServerDisabled, type McpConfig, type PromptMetadata } from "./types.ts";
 import { formatPromptCommandName } from "./types.ts";
-import { lazyConnect } from "./init.ts";
 import { isServerCacheValid, loadMetadataCache, reconstructPromptMetadata } from "./metadata-cache.ts";
 import { logger } from "./logger.ts";
 import { truncateAtWord } from "./utils.ts";
@@ -226,17 +225,41 @@ function extractMessageText(message: PromptMessage): string {
  * per prompt at extension load time from the metadata cache; the same
  * factory is reused by tests to invoke the handler without a running pi.
  */
+export interface PromptRuntimeDependencies {
+  ensureState?: (ctx: ExtensionCommandContext) => Promise<McpExtensionState | null>;
+  lazyConnect?: (state: McpExtensionState, serverName: string, signal?: AbortSignal) => Promise<boolean>;
+  isStateCurrent?: (state: McpExtensionState) => boolean;
+}
+
+let defaultRuntimePromise: Promise<typeof import("./init.ts")> | null = null;
+function loadDefaultRuntime(): Promise<typeof import("./init.ts")> {
+  return defaultRuntimePromise ??= import("./init.ts").catch((error) => {
+    defaultRuntimePromise = null;
+    throw error;
+  });
+}
+
 export function createPromptCommand(
   pi: ExtensionAPI,
   getState: () => McpExtensionState | null,
   metadata: PromptMetadata,
+  runtime: PromptRuntimeDependencies = {},
 ) {
   const description = buildCommandDescription(metadata);
 
   return {
     description,
     handler: async (args: string, ctx: ExtensionCommandContext) => {
-      const state = getState();
+      let state = getState();
+      if (!state && runtime.ensureState) {
+        try {
+          state = await runtime.ensureState(ctx);
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          if (ctx.hasUI) ctx.ui.notify(`MCP initialization failed: ${message}`, "error");
+          return;
+        }
+      }
       if (!state) {
         if (ctx.hasUI) ctx.ui.notify("MCP not initialized", "error");
         return;
@@ -271,7 +294,14 @@ export function createPromptCommand(
         return;
       }
 
-      const connected = await lazyConnect(state, metadata.serverName, ctx.signal);
+      const expectedState = state;
+      const isStateCurrent = () => runtime.isStateCurrent
+        ? runtime.isStateCurrent(expectedState)
+        : getState() === expectedState;
+      const lazyConnect = runtime.lazyConnect ?? (await loadDefaultRuntime()).lazyConnect;
+      if (!isStateCurrent()) return;
+      const connected = await lazyConnect(expectedState, metadata.serverName, ctx.signal);
+      if (!isStateCurrent()) return;
       if (!connected) {
         if (ctx.hasUI) {
           const conn = state.manager.getConnection(metadata.serverName);
@@ -305,12 +335,14 @@ export function createPromptCommand(
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);
         logger.debug(`MCP prompt "${live.originalName}" on ${metadata.serverName} failed: ${message}`);
+        if (!isStateCurrent()) return;
         if (ctx.hasUI) {
           ctx.ui.notify(`MCP prompt "${live.originalName}" failed: ${message}`, "error");
         }
         return;
       }
 
+      if (!isStateCurrent()) return;
       const text = formatPromptResult(result);
       if (!text) {
         if (ctx.hasUI) {

package/dist/humain/mcp-adapter/vendor/proxy-modes.ts

@@ -3,7 +3,7 @@ import { UrlElicitationRequiredError, type Client, type Progress, type RequestOp
 import { createRequire } from "node:module";
 import type { McpExtensionState } from "./state.ts";
 import type { ToolMetadata, McpContent } from "./types.ts";
-import { getServerPrefix, isServerDisabled, parseUiPromptHandoff } from "./types.ts";
+import { getServerPrefix, isServerDisabled, parseUiPromptHandoff, type ServerEntry } from "./types.ts";
 import { lazyConnect, markKeepAliveAfterConnect, notifyToolMetadataUpdated, updateServerMetadata, updateMetadataCache, getFailureAgeSeconds, updateStatusBar, clearFailure, recordFailure } from "./init.ts";
 import { abortable, throwIfAborted } from "./abort.ts";
 import { combineAbortSignals, isAbortError } from "./runtime-owner.ts";
@@ -14,7 +14,7 @@ import { resolveMcpResultContent, transformMcpContent, transformMcpResourceConte
 import { guardMcpOutput, guardedMcpDetails, resolveMcpOutputGuardOptions } from "./mcp-output-guard.ts";
 import { maybeStartUiSession, summarizeUiSessionResult, type UiSessionRuntime } from "./ui-session.ts";
 import { formatAuthRequiredMessage, formatMcpStatus, normalizeToolArguments, resolveServerUrl, truncateAtWord } from "./utils.ts";
-import { authenticate, completeAuthFromInput, startAuth, supportsOAuth } from "./mcp-auth-flow.ts";
+import { authenticate, completeAuthFromInput, getAuthStatus, startAuth, supportsOAuth } from "./mcp-auth-flow.ts";
 import { SessionRecoveryAuthRequiredError, withSessionRecovery } from "./session-recovery.ts";
 import { paginate, rankSuggestions, rankToolMatches, resolveSearchKeywords } from "./search-ranking.ts";
 import { ensureToolCallApproved, isToolCallApprovalRequired } from "./tool-approval.ts";
@@ -34,6 +34,8 @@ const REGEX_SAFETY_CHECK_PARAMS = {
   timeout: 250,
 } as const;
 
+const backgroundAuthWatchers = new WeakMap<McpExtensionState, Map<string, Promise<void>>>();
+
 type AutoAuthResult =
   | { status: "skipped" }
   | { status: "success" }
@@ -128,6 +130,76 @@ function disabledResult(mode: string, serverName: string): ProxyToolResult {
   };
 }
 
+function emitAuthStatus(state: McpExtensionState, serverName: string, status: "authenticated" | "failed", message: string): void {
+  state.ui?.notify(message, status === "authenticated" ? "info" : "error");
+  state.sendMessage?.(
+    {
+      customType: "mcp-oauth-status",
+      content: [{ type: "text", text: message }],
+      display: message,
+      details: {
+        server: serverName,
+        status,
+        ...(status === "authenticated" ? { nextAction: { connect: serverName } } : {}),
+      },
+    },
+    { triggerTurn: true },
+  );
+}
+
+function ensureBackgroundAuthWatcher(
+  state: McpExtensionState,
+  serverName: string,
+  serverUrl: string,
+  definition: ServerEntry,
+): void {
+  let watchers = backgroundAuthWatchers.get(state);
+  if (!watchers) {
+    watchers = new Map();
+    backgroundAuthWatchers.set(state, watchers);
+  }
+  if (watchers.has(serverName)) return;
+
+  const authOptions = {
+    authStorageOptions: state.authStorageOptions,
+    runtime: state.oauthRuntime,
+    openAuthorizationUrl: state.openBrowser,
+  };
+  const watcher = authenticate(serverName, serverUrl, definition, authOptions).then(async (status) => {
+    throwIfAborted(state.owner.signal);
+    if (status !== "authenticated") throw new Error(`OAuth authentication ended with status: ${status}`);
+    await state.manager.close(serverName);
+    throwIfAborted(state.owner.signal);
+    clearFailure(state, serverName, "auth-background-complete");
+    updateStatusBar(state);
+    emitAuthStatus(
+      state,
+      serverName,
+      "authenticated",
+      `OAuth authentication completed for MCP server "${serverName}". Connect it now to load and verify its tools.`,
+    );
+  });
+  watchers.set(serverName, watcher);
+
+  void watcher.catch(async (error) => {
+    if (isAbortError(error, state.owner.signal)) return;
+    try {
+      if (await getAuthStatus(serverName, authOptions) === "authenticated") return;
+    } catch (statusError) {
+      if (isAbortError(statusError, state.owner.signal)) return;
+    }
+    if (state.owner.signal.aborted) return;
+    emitAuthStatus(
+      state,
+      serverName,
+      "failed",
+      `OAuth authentication failed for MCP server "${serverName}". Start authorization again or inspect trusted logs.`,
+    );
+  }).finally(() => {
+    if (watchers?.get(serverName) === watcher) watchers.delete(serverName);
+  });
+}
+
 function getAuthRequiredMessage(
   state: McpExtensionState,
   serverName: string,
@@ -165,18 +237,20 @@ function formatManualAuthInstructions(serverName: string, authorizationUrl: stri
   const redirect = getRedirectDetails(authorizationUrl);
   const redirectNote = redirect.remote
     ? "The provider uses a pre-registered HTTPS callback. Copy its full URL from the browser address bar, even if the destination page reports an error."
-    : redirect.port
-      ? `The redirect URL will use local port ${redirect.port}. On a remote server it is expected for that localhost page to fail locally; copy the address bar URL anyway.`
-      : "";
+    : `The adapter is watching${redirect.port ? ` local port ${redirect.port}` : " the local callback"} and will report when authentication completes.`;
 
   return [
     `MCP OAuth required for "${serverName}".`,
     "",
-    "Open this URL in your local browser:",
+    redirect.remote
+      ? "The adapter is attempting to open this authorization URL in your local browser:"
+      : "The adapter is attempting to open this authorization URL and watching for its callback:",
     "",
     authorizationUrl,
     "",
-    "After approving, copy the full callback URL from your browser address bar and send it back with:",
+    redirect.remote
+      ? "After approving, copy the full callback URL from your browser address bar and send it back with:"
+      : "If the browser does not open or the callback is not detected, open the URL above and complete manually with:",
     `mcp({ action: "auth-complete", server: "${serverName}", args: { redirectUrl: "PASTE_REDIRECT_URL_HERE" } })`,
     "",
     redirect.remote
@@ -466,6 +540,16 @@ export async function executeAuthStart(state: McpExtensionState, serverName: str
       };
     }
 
+    if (getRedirectDetails(authorizationUrl).remote) {
+      try {
+        await state.openBrowser(authorizationUrl);
+      } catch (error) {
+        if (isAbortError(error, ownedSignal)) throw error;
+      }
+    } else {
+      ensureBackgroundAuthWatcher(state, serverName, serverUrl, definition);
+    }
+
     return {
       content: [{ type: "text" as const, text: formatManualAuthInstructions(serverName, authorizationUrl) }],
       details: { mode: "auth-start", server: serverName, authorizationUrl },
@@ -926,6 +1010,8 @@ export async function executeCall(
   getPiTools?: () => ToolInfo[],
   signal?: AbortSignal,
   origin?: "proxy" | "script",
+  // Internal consumers own successful data delivery; origin remains approval metadata only.
+  internalDelivery?: { onSuccess: (data: unknown) => void },
 ): Promise<ProxyToolResult> {
   const ownedSignal = combineAbortSignals(state.owner?.signal, signal);
   throwIfAborted(ownedSignal);
@@ -1345,6 +1431,13 @@ export async function executeCall(
         },
       );
       const content = transformMcpResourceContents(result.contents ?? [], state.owner?.signal);
+      if (internalDelivery) {
+        throwIfAborted(ownedSignal);
+        internalDelivery.onSuccess(content.length > 0
+          ? content.filter(block => block.type === "text").map(block => block.text).join("\n")
+          : "(empty resource)");
+        return { content: [], details: { mode: "call", ...callIdentity } };
+      }
       const guarded = await guardMcpOutput(content.length > 0 ? content : [{ type: "text" as const, text: "(empty resource)" }], outputGuardOptions);
       return {
         content: guarded.content,
@@ -1384,7 +1477,15 @@ export async function executeCall(
 
     if (toolMeta.uiResourceUri) {
       uiSession?.sendToolResult(result as unknown as import("@modelcontextprotocol/client").CallToolResult);
+    }
+
+    if (!result.isError && internalDelivery) {
+      throwIfAborted(ownedSignal);
+      internalDelivery.onSuccess(result);
+      return { content: [], details: { mode: "call", ...callIdentity } };
+    }
 
+    if (toolMeta.uiResourceUri) {
       if (result.isError) {
         const mcpContent = (result.content ?? []) as McpContent[];
         const content = transformMcpContent(mcpContent, state.owner?.signal);