@kwonye/mcpx 0.1.100 → 0.1.102

package/dist/{cli-etmrz2c4.js → cli-qzzjkt0q.js}

@@ -1,735 +1,1066 @@
 import {
   refreshAutoUpdateMarketplaces
-} from "./cli-ct7asw78.js";
+} from "./cli-aawpvhhe.js";
 import {
   APP_VERSION,
   getGatewayUrl,
+  mutateConfig,
   persistSyncState,
   syncAllClients
-} from "./cli-b0xrqsjc.js";
+} from "./cli-9k3wmag6.js";
 import {
   loadConfig,
   loadMergedConfig,
   saveConfig
-} from "./cli-dy7x0zrg.js";
+} from "./cli-6zq2fd6h.js";
 import {
   SecretsManager,
   UpstreamError,
   classifyUpstreamError,
   ensureGatewayToken
-} from "./cli-1ewrsfj4.js";
+} from "./cli-hh7rthhx.js";
 import {
   ensureDir,
   ensureParentDir,
   getLogPath,
   getMarketplaceUpdateLockPath,
   getMarketplaceUpdateStatePath,
+  getOAuthLockPath,
   getPidPath,
   getStagedVersionPath,
   getUpdateLockPath,
   getUpdatesDir
-} from "./cli-28g7x9rn.js";
+} from "./cli-6wh8qx2y.js";
 import {
   isServerEnabled
 } from "./cli-s4gspqdf.js";
 
-// src/core/auth-probe.ts
-var JSON_RPC_VERSION = "2.0";
-var DEFAULT_AUTH_PROBE_TIMEOUT_MS = 8000;
-var AUTH_KEYWORDS = [
-  "unauthorized",
-  "unauthenticated",
-  "forbidden",
-  "authentication",
-  "authorization",
-  "api key",
-  "api_key",
-  "apikey",
-  "credentials",
-  "access denied",
-  "auth required",
-  "x-api-key",
-  "invalid key",
-  "missing header",
-  "not authenticated",
-  "auth token"
-];
-function isAuthRelatedMessage(message) {
-  const lower = message.toLowerCase();
-  return AUTH_KEYWORDS.some((kw) => lower.includes(kw));
+// src/core/oauth.ts
+import fs from "node:fs";
+import path from "node:path";
+import http from "node:http";
+import crypto from "node:crypto";
+import {
+  auth,
+  discoverOAuthServerInfo,
+  discoverOAuthProtectedResourceMetadata,
+  discoverAuthorizationServerMetadata,
+  refreshAuthorization
+} from "@modelcontextprotocol/sdk/client/auth.js";
+import { InvalidClientError, InvalidGrantError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+function oauthSecretName(serverName, suffix) {
+  const safe = serverName.toLowerCase().replace(/[^a-z0-9._-]/g, "_").slice(0, 32);
+  const hash = crypto.createHash("sha256").update(serverName).digest("hex").slice(0, 12);
+  return `oauth_${safe}_${hash}_${suffix}`;
 }
-function resolveHeaders(spec, secrets) {
-  const headers = {
-    "content-type": "application/json",
-    accept: "application/json, text/event-stream"
+function legacyOAuthSecretName(serverName, suffix) {
+  return `oauth_${serverName.toLowerCase().replace(/[^a-z0-9._-]/g, "_")}_${suffix}`;
+}
+function readJsonSecret(secrets, name) {
+  let raw = secrets.getSecret(name);
+  if (!raw) {
+    const match = name.match(/^oauth_(.+)_([0-9a-f]{12})_(client|tokens|verifier|discovery)$/);
+    if (match) {
+      const suffix = match[3];
+      const withoutHash = name.replace(/_[0-9a-f]{12}_/, "_");
+      raw = secrets.getSecret(withoutHash);
+      if (!raw) {}
+    }
+  }
+  if (!raw) {
+    return;
+  }
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return;
+  }
+}
+function getOAuthSecretWithFallback(secrets, serverName, suffix) {
+  const name = oauthSecretName(serverName, suffix);
+  let raw = secrets.getSecret(name);
+  if (raw)
+    return raw;
+  return secrets.getSecret(legacyOAuthSecretName(serverName, suffix));
+}
+function writeJsonSecret(secrets, name, value) {
+  secrets.setSecret(name, JSON.stringify(value));
+  const match = name.match(/^oauth_(.+)_([0-9a-f]{12})_(client|tokens|verifier|discovery)$/);
+  if (match) {
+    const withoutHash = name.replace(/_[0-9a-f]{12}_/, "_");
+    secrets.setSecret(withoutHash, JSON.stringify(value));
+  }
+}
+function isOAuthReference(value) {
+  return value.startsWith("oauth://");
+}
+function oauthReferenceServerName(value) {
+  if (!isOAuthReference(value)) {
+    throw new Error(`Not an OAuth reference: ${value}`);
+  }
+  return decodeURIComponent(value.slice("oauth://".length));
+}
+var DEFAULT_OAUTH_SUPPORT_TIMEOUT_MS = 5000;
+var OAUTH_SUPPORT_SUPPORTED_TTL_MS = 5 * 60000;
+var OAUTH_SUPPORT_NEGATIVE_TTL_MS = 60000;
+var oauthSupportCache = new Map;
+function __resetOAuthSupportCache() {
+  oauthSupportCache.clear();
+}
+async function probeOAuthSupport(serverUrl, options = {}) {
+  const cached = oauthSupportCache.get(serverUrl);
+  if (!options.force && cached) {
+    const ttl = cached.probe.support === "supported" ? OAUTH_SUPPORT_SUPPORTED_TTL_MS : OAUTH_SUPPORT_NEGATIVE_TTL_MS;
+    if (Date.now() - cached.at < ttl) {
+      return cached.probe;
+    }
+  }
+  const timeoutMs = options.timeoutMs ?? DEFAULT_OAUTH_SUPPORT_TIMEOUT_MS;
+  let sawResponse = false;
+  const timeoutFetch = async (input, init) => {
+    const controller = new AbortController;
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      const response = await fetch(input, { ...init, signal: controller.signal });
+      sawResponse = true;
+      return response;
+    } finally {
+      clearTimeout(timeout);
+    }
   };
-  for (const [key, value] of Object.entries(spec.headers ?? {})) {
-    headers[key] = secrets.resolveMaybeSecret(value);
+  let resourceMetadataFound = false;
+  let authorizationServerUrl;
+  try {
+    const resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, {}, timeoutFetch);
+    resourceMetadataFound = true;
+    authorizationServerUrl = resourceMetadata.authorization_servers?.[0];
+  } catch {}
+  let authServerMetadataFound = false;
+  if (!resourceMetadataFound) {
+    try {
+      const fallbackAuthServerUrl = new URL("/", serverUrl);
+      const metadata = await discoverAuthorizationServerMetadata(fallbackAuthServerUrl, { fetchFn: timeoutFetch });
+      authServerMetadataFound = metadata != null;
+      if (authServerMetadataFound) {
+        authorizationServerUrl = fallbackAuthServerUrl.toString();
+      }
+    } catch {}
   }
-  return headers;
+  let probe;
+  if (resourceMetadataFound || authServerMetadataFound) {
+    probe = {
+      support: "supported",
+      authorizationServerUrl,
+      resourceMetadata: resourceMetadataFound,
+      authorizationServerMetadata: authServerMetadataFound
+    };
+  } else if (sawResponse) {
+    probe = { support: "unsupported", resourceMetadata: false, authorizationServerMetadata: false };
+  } else {
+    probe = {
+      support: "unknown",
+      resourceMetadata: false,
+      authorizationServerMetadata: false,
+      error: "Could not reach the server to check for OAuth support."
+    };
+  }
+  oauthSupportCache.set(serverUrl, { at: Date.now(), probe });
+  return probe;
 }
-function isOAuthLikelyChallenge(wwwAuthenticate) {
-  if (!wwwAuthenticate) {
+function tokensAreExpiring(tokens) {
+  if (!tokens.tokens.expires_in) {
     return false;
   }
-  const lower = wwwAuthenticate.toLowerCase();
-  return lower.includes("bearer") || lower.includes("authorization_uri") || lower.includes("resource_metadata");
+  const expiresAt = tokens.obtainedAt + tokens.tokens.expires_in * 1000;
+  return Date.now() >= expiresAt - 60000;
 }
-async function probeHttpAuthRequirement(spec, secrets, timeoutMs = DEFAULT_AUTH_PROBE_TIMEOUT_MS) {
-  const timeoutController = new AbortController;
-  const timeoutHandle = setTimeout(() => timeoutController.abort(), timeoutMs);
-  try {
-    const headers = resolveHeaders(spec, secrets);
-    const response = await fetch(spec.url, {
-      method: "POST",
-      headers,
-      body: JSON.stringify({
-        jsonrpc: JSON_RPC_VERSION,
-        id: "mcpx-auth-probe",
-        method: "tools/list",
-        params: {}
-      }),
-      signal: timeoutController.signal
-    });
-    if (response.status === 401 || response.status === 403) {
-      const wwwAuthenticate = response.headers.get("www-authenticate");
+
+class McpxOAuthProvider {
+  #serverName;
+  #secrets;
+  #redirectUrlValue;
+  #stateValue;
+  constructor(serverName, secrets, redirectUrl, state = crypto.randomUUID()) {
+    this.#serverName = serverName;
+    this.#secrets = secrets;
+    this.#redirectUrlValue = redirectUrl;
+    this.#stateValue = state;
+  }
+  get redirectUrl() {
+    return this.#redirectUrlValue;
+  }
+  get clientMetadata() {
+    if (!this.#redirectUrlValue) {
       return {
-        authRequired: true,
-        oauthLikely: isOAuthLikelyChallenge(wwwAuthenticate),
-        status: response.status,
-        wwwAuthenticate: wwwAuthenticate ?? undefined
+        redirect_uris: [],
+        token_endpoint_auth_method: "none",
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        client_name: "mcpx"
       };
     }
-    if (response.status === 200) {
-      try {
-        const body = await response.json();
-        const err = body?.error;
-        if (err && typeof err === "object" && !("result" in body)) {
-          const message = typeof err.message === "string" ? err.message : "";
-          if (message && isAuthRelatedMessage(message)) {
-            return {
-              authRequired: true,
-              status: response.status,
-              error: `JSON-RPC error: ${message}`
-            };
-          }
-        }
-      } catch {}
-    }
     return {
-      authRequired: false,
-      status: response.status
-    };
-  } catch (error) {
-    const isAbort = error.name === "AbortError";
-    return {
-      authRequired: false,
-      error: isAbort ? `Auth probe timed out after ${timeoutMs}ms.` : error.message
+      redirect_uris: [this.#redirectUrlValue],
+      token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      client_name: "mcpx"
     };
-  } finally {
-    clearTimeout(timeoutHandle);
   }
-}
-
-// src/core/registry-client.ts
-var REGISTRY_BASE = "https://registry.modelcontextprotocol.io";
-async function fetchRegistryServerDetail(name) {
-  const encoded = encodeURIComponent(name);
-  const response = await fetch(`${REGISTRY_BASE}/v0.1/servers/${encoded}/versions/latest`, {
-    headers: { accept: "application/json" }
-  });
-  if (!response.ok) {
-    throw new Error(`Registry API error: ${response.status}`);
+  state() {
+    return this.#stateValue;
   }
-  const data = await response.json();
-  return data.server;
-}
-var PACKAGE_PRIORITY = {
-  npm: 1,
-  pypi: 2,
-  nuget: 3,
-  oci: 4,
-  mcpb: 5
-};
-var RUNTIME_HINT = {
-  npm: "npx",
-  pypi: "uvx",
-  nuget: "dnx"
-};
-function selectBestPackage(packages = [], remotes = []) {
-  const stdioPkgs = packages.filter((p) => p.transport.type === "stdio").sort((a, b) => (PACKAGE_PRIORITY[a.registryType] ?? 99) - (PACKAGE_PRIORITY[b.registryType] ?? 99));
-  if (stdioPkgs.length > 0) {
-    return { kind: "package", package: stdioPkgs[0] };
+  clientInformation() {
+    return readJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "client"));
   }
-  const httpRemotes = remotes.filter((r) => r.type === "streamable-http" || r.type === "sse");
-  if (httpRemotes.length > 0) {
-    return { kind: "remote", remote: httpRemotes[0] };
+  saveClientInformation(clientInformation) {
+    writeJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "client"), clientInformation);
   }
-  if (packages.length > 0) {
-    return { kind: "package", package: packages[0] };
+  tokens() {
+    return readJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "tokens"))?.tokens;
   }
-  if (remotes.length > 0) {
-    return { kind: "remote", remote: remotes[0] };
+  saveTokens(tokens) {
+    writeJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "tokens"), {
+      tokens,
+      obtainedAt: Date.now()
+    });
   }
-  throw new Error("Server has no packages or remotes");
-}
-function extractRequiredInputs(option) {
-  const inputs = [];
-  if (option.kind === "package" && option.package?.environmentVariables) {
-    for (const env of option.package.environmentVariables) {
-      if (env.isRequired && !env.default) {
-        inputs.push({
-          name: env.name,
-          description: env.description,
-          isSecret: env.isSecret ?? false,
-          kind: "env"
-        });
-      }
-    }
-    for (const arg of option.package.packageArguments ?? []) {
-      if (arg.isRequired && !arg.value && !arg.default) {
-        inputs.push({
-          name: arg.name ?? arg.valueHint ?? "arg",
-          description: arg.description,
-          isSecret: false,
-          kind: "arg"
-        });
-      }
+  redirectToAuthorization(_authorizationUrl) {}
+  saveCodeVerifier(codeVerifier) {
+    this.#secrets.setSecret(oauthSecretName(this.#serverName, "verifier"), codeVerifier);
+  }
+  codeVerifier() {
+    const verifier = getOAuthSecretWithFallback(this.#secrets, this.#serverName, "verifier");
+    if (!verifier) {
+      throw new Error(`Missing OAuth code verifier for "${this.#serverName}".`);
     }
+    return verifier;
   }
-  if (option.kind === "remote" && option.remote?.headers) {
-    for (const header of option.remote.headers) {
-      if (header.isRequired && !header.default) {
-        inputs.push({
-          name: header.name,
-          description: header.description,
-          isSecret: header.isSecret ?? false,
-          kind: "header"
-        });
-      }
+  saveDiscoveryState(state) {
+    writeJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "discovery"), state);
+  }
+  discoveryState() {
+    return readJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "discovery"));
+  }
+  invalidateCredentials(scope) {
+    const suffixes = scope === "all" ? ["client", "tokens", "verifier", "discovery"] : [scope];
+    for (const suffix of suffixes) {
+      this.#secrets.removeSecret(oauthSecretName(this.#serverName, suffix));
+      this.#secrets.removeSecret(legacyOAuthSecretName(this.#serverName, suffix));
     }
   }
-  return inputs;
 }
-function mapRegistryToSpec(_name, option, resolvedValues) {
-  if (option.kind === "remote") {
-    const headers = {};
-    for (const header of option.remote?.headers ?? []) {
-      const value = resolvedValues[header.name] ?? header.default;
-      if (value)
-        headers[header.name] = value;
-    }
-    return {
-      transport: "http",
-      url: option.remote.url,
-      ...Object.keys(headers).length > 0 ? { headers } : {}
-    };
+
+class InteractiveOAuthProvider extends McpxOAuthProvider {
+  #openUrl;
+  #cachedClientInfo;
+  #cachedCodeVerifier;
+  constructor(serverName, secrets, redirectUrl, state, openUrl) {
+    super(serverName, secrets, redirectUrl, state);
+    this.#openUrl = openUrl;
   }
-  const pkg = option.package;
-  const runtime = pkg.runtimeHint ?? RUNTIME_HINT[pkg.registryType] ?? "npx";
-  const args = [];
-  const identifier = pkg.version ? `${pkg.identifier}@${pkg.version}` : pkg.identifier;
-  args.push(identifier);
-  for (const arg of pkg.packageArguments ?? []) {
-    const value = arg.value ?? resolvedValues[arg.name ?? arg.valueHint ?? ""] ?? arg.default;
-    if (!value)
-      continue;
-    if (arg.type === "named" && arg.name) {
-      args.push(arg.name, value);
-    } else {
-      args.push(value);
+  async redirectToAuthorization(authorizationUrl) {
+    await this.#openUrl(authorizationUrl.toString());
+  }
+  clientInformation() {
+    this.#cachedClientInfo ??= super.clientInformation();
+    return this.#cachedClientInfo;
+  }
+  saveClientInformation(clientInformation) {
+    super.saveClientInformation(clientInformation);
+    this.#cachedClientInfo = clientInformation;
+  }
+  codeVerifier() {
+    if (this.#cachedCodeVerifier !== undefined) {
+      return this.#cachedCodeVerifier;
     }
+    return super.codeVerifier();
   }
-  const env = {};
-  for (const envVar of pkg.environmentVariables ?? []) {
-    const value = resolvedValues[envVar.name] ?? envVar.default;
-    if (value)
-      env[envVar.name] = value;
+  saveCodeVerifier(codeVerifier) {
+    super.saveCodeVerifier(codeVerifier);
+    this.#cachedCodeVerifier = codeVerifier;
+  }
+  invalidateCredentials(scope) {
+    super.invalidateCredentials(scope);
+    if (scope === "all" || scope === "client") {
+      this.#cachedClientInfo = undefined;
+    }
   }
-  return {
-    transport: "stdio",
-    command: runtime,
-    args,
-    ...Object.keys(env).length > 0 ? { env } : {}
-  };
 }
-
-// src/core/server-auth.ts
-function normalizeNamePart(value) {
-  return value.trim().toLowerCase().replace(/[^a-z0-9._-]+/g, "_").replace(/^_+|_+$/g, "") || "value";
+function listen(server) {
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        reject(new Error("Failed to start OAuth callback server."));
+        return;
+      }
+      resolve(address.port);
+    });
+  });
 }
-function requireNonEmpty(value, label) {
-  const normalized = value?.trim();
-  if (!normalized) {
-    throw new Error(`${label} must be non-empty.`);
-  }
-  return normalized;
+function closeServer(server) {
+  return new Promise((resolve) => {
+    server.close(() => resolve());
+  });
 }
-function toSecretRef(secretName) {
-  return `secret://${secretName}`;
+var OAUTH_LOGIN_TIMEOUT_MS = 120000;
+function renderCallbackPage(kind, detail) {
+  const title = kind === "success" ? "Signed in" : "Sign-in failed";
+  const message = kind === "success" ? "You're signed in. You can close this window and return to mcpx." : detail ?? "Something went wrong. You can close this window and try again in mcpx.";
+  const icon = kind === "success" ? "&#10003;" : "&#10007;";
+  const closeScript = kind === "success" ? "<script>setTimeout(() => window.close(), 1500);</script>" : "";
+  return `<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<title>${title} — mcpx</title>
+<style>
+  :root { color-scheme: light dark; }
+  body {
+    margin: 0; min-height: 100vh; display: flex; align-items: center; justify-content: center;
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+    background: #f5f5f7; color: #1d1d1f;
+  }
+  @media (prefers-color-scheme: dark) {
+    body { background: #1c1c1e; color: #f5f5f7; }
+    .card { background: #2c2c2e !important; box-shadow: none !important; }
+  }
+  .card {
+    background: #fff; border-radius: 16px; padding: 40px 48px; text-align: center;
+    box-shadow: 0 8px 30px rgba(0,0,0,0.12); max-width: 360px;
+  }
+  .icon {
+    width: 48px; height: 48px; border-radius: 50%; margin: 0 auto 16px;
+    display: flex; align-items: center; justify-content: center; font-size: 22px;
+    background: ${kind === "success" ? "#34c759" : "#ff3b30"}; color: #fff;
+  }
+  h1 { font-size: 17px; margin: 0 0 8px; }
+  p { font-size: 14px; margin: 0; opacity: 0.7; }
+</style>
+</head>
+<body>
+  <div class="card">
+    <div class="icon">${icon}</div>
+    <h1>${title}</h1>
+    <p>${message}</p>
+  </div>
+  ${closeScript}
+</body>
+</html>`;
 }
-function secretRefName(ref) {
-  if (!ref.startsWith("secret://")) {
-    return null;
+
+class OAuthCancelledError extends Error {
+  code = "oauth_cancelled";
+  constructor(serverName) {
+    super(`OAuth login for "${serverName}" was cancelled.`);
+    this.name = "OAuthCancelledError";
   }
-  const name = ref.slice("secret://".length).trim();
-  return name.length > 0 ? name : null;
 }
-function defaultAuthSecretName(serverName, target) {
-  return `auth_${normalizeNamePart(serverName)}_${target.kind}_${normalizeNamePart(target.key)}`;
+
+class OAuthLoginInProgressError extends Error {
+  code = "oauth_in_progress";
+  constructor(serverName, holderPid) {
+    super(holderPid ? `OAuth login for "${serverName}" is already in progress (pid ${holderPid}).` : `OAuth login for "${serverName}" is already in progress.`);
+    this.name = "OAuthLoginInProgressError";
+  }
 }
-function resolveAuthTarget(spec, header, env) {
-  if (spec.transport === "http") {
-    if (env) {
-      throw new Error("--env is only valid for stdio upstreams.");
+function waitForAuthorizationCode(server, serverName, expectedState, options = {}) {
+  const timeoutMs = options.timeoutMs ?? OAUTH_LOGIN_TIMEOUT_MS;
+  const { signal } = options;
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    function settle(fn) {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      clearTimeout(timeout);
+      signal?.removeEventListener("abort", onAbort);
+      fn();
     }
-    return {
-      kind: "header",
-      key: requireNonEmpty(header ?? "Authorization", "Header name")
-    };
+    function onAbort() {
+      settle(() => reject(new OAuthCancelledError(serverName)));
+    }
+    const timeout = setTimeout(() => {
+      settle(() => reject(new Error(`OAuth login timed out after ${timeoutMs}ms.`)));
+    }, timeoutMs);
+    if (signal) {
+      if (signal.aborted) {
+        settle(() => reject(new OAuthCancelledError(serverName)));
+        return;
+      }
+      signal.addEventListener("abort", onAbort);
+    }
+    server.on("request", (request, response) => {
+      const url = new URL(request.url ?? "/", "http://127.0.0.1");
+      if (settled) {
+        response.statusCode = 404;
+        response.end();
+        return;
+      }
+      if (url.pathname === "/favicon.ico") {
+        response.statusCode = 204;
+        response.end();
+        return;
+      }
+      if (url.pathname !== "/callback") {
+        response.statusCode = 404;
+        response.end();
+        return;
+      }
+      const code = url.searchParams.get("code");
+      const state = url.searchParams.get("state");
+      const error = url.searchParams.get("error");
+      response.setHeader("content-type", "text/html; charset=utf-8");
+      if (error) {
+        response.statusCode = 400;
+        response.end(renderCallbackPage("error", `Authorization failed: ${error}`));
+        settle(() => reject(new Error(`OAuth authorization failed: ${error}`)));
+        return;
+      }
+      if (!code) {
+        response.statusCode = 400;
+        response.end(renderCallbackPage("error", "Missing authorization code."));
+        return;
+      }
+      if (state !== expectedState) {
+        response.statusCode = 400;
+        response.end(renderCallbackPage("error", "This sign-in link is no longer valid."));
+        settle(() => reject(new Error("OAuth state mismatch.")));
+        return;
+      }
+      response.end(renderCallbackPage("success"));
+      settle(() => resolve(code));
+    });
+  });
+}
+function bindOAuthReference(config, serverName) {
+  const spec = config.servers[serverName];
+  if (!spec) {
+    throw new Error(`Server "${serverName}" not found.`);
   }
-  if (header) {
-    throw new Error("--header is only valid for HTTP upstreams.");
+  if (spec.transport !== "http") {
+    throw new Error(`OAuth login only supports HTTP servers.`);
   }
-  return {
-    kind: "env",
-    key: requireNonEmpty(env, "Env var name")
+  spec.headers = {
+    ...spec.headers ?? {},
+    Authorization: `oauth://${encodeURIComponent(serverName)}`
   };
 }
-function applyAuthReference(spec, target, secretRef) {
-  if (target.kind === "header") {
-    if (spec.transport !== "http") {
-      throw new Error(`Cannot set header auth on ${spec.transport} upstream.`);
-    }
-    const headers = { ...spec.headers ?? {} };
-    headers[target.key] = secretRef;
-    spec.headers = headers;
-    return;
-  }
-  if (spec.transport !== "stdio") {
-    throw new Error(`Cannot set env auth on ${spec.transport} upstream.`);
+var OAUTH_LOCK_STALE_MS = 5 * 60000;
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
   }
-  const env = { ...spec.env ?? {} };
-  env[target.key] = secretRef;
-  spec.env = env;
 }
-function removeAuthReference(spec, target) {
-  if (target.kind === "header") {
-    if (spec.transport !== "http") {
-      throw new Error(`Cannot remove header auth from ${spec.transport} upstream.`);
-    }
-    if (!spec.headers || !(target.key in spec.headers)) {
-      return null;
+function releaseOAuthLoginLock(lockPath) {
+  try {
+    fs.unlinkSync(lockPath);
+  } catch {}
+}
+function acquireOAuthLoginLock(serverName) {
+  const lockPath = getOAuthLockPath(serverName);
+  ensureDir(path.dirname(lockPath));
+  const tryCreate = () => {
+    try {
+      fs.writeFileSync(lockPath, `${process.pid}
+`, { flag: "wx" });
+      return true;
+    } catch (err) {
+      if (err.code !== "EEXIST") {
+        throw err;
+      }
+      return false;
     }
-    const previous2 = spec.headers[target.key] ?? null;
-    const next2 = { ...spec.headers };
-    delete next2[target.key];
-    spec.headers = Object.keys(next2).length > 0 ? next2 : undefined;
-    return previous2;
-  }
-  if (spec.transport !== "stdio") {
-    throw new Error(`Cannot remove env auth from ${spec.transport} upstream.`);
+  };
+  if (tryCreate()) {
+    return () => releaseOAuthLoginLock(lockPath);
   }
-  if (!spec.env || !(target.key in spec.env)) {
-    return null;
+  let holderPid;
+  try {
+    const raw = fs.readFileSync(lockPath, "utf8").trim();
+    const pid = Number(raw);
+    const stat = fs.statSync(lockPath);
+    const stale = Date.now() - stat.mtimeMs > OAUTH_LOCK_STALE_MS;
+    const holderAlive = Number.isFinite(pid) && pid > 0 && isProcessAlive(pid);
+    if (!holderAlive || stale) {
+      fs.unlinkSync(lockPath);
+      if (tryCreate()) {
+        return () => releaseOAuthLoginLock(lockPath);
+      }
+    }
+    holderPid = holderAlive ? pid : undefined;
+  } catch {
+    if (tryCreate()) {
+      return () => releaseOAuthLoginLock(lockPath);
+    }
   }
-  const previous = spec.env[target.key] ?? null;
-  const next = { ...spec.env };
-  delete next[target.key];
-  spec.env = Object.keys(next).length > 0 ? next : undefined;
-  return previous;
+  throw new OAuthLoginInProgressError(serverName, holderPid);
 }
-function listAuthBindings(spec) {
-  if (spec.transport === "http") {
-    return Object.entries(spec.headers ?? {}).map(([key, value]) => ({
-      kind: "header",
-      key,
-      value
-    }));
+async function runOAuthLogin(serverName, spec, secrets, openUrl, configPath, codeReceiver, options = {}) {
+  const { signal, onProgress } = options;
+  const timeoutMs = options.timeoutMs ?? OAUTH_LOGIN_TIMEOUT_MS;
+  if (signal?.aborted) {
+    throw new OAuthCancelledError(serverName);
   }
-  return Object.entries(spec.env ?? {}).map(([key, value]) => ({
-    kind: "env",
-    key,
-    value
-  }));
-}
-var TOKEN68 = /^[A-Za-z0-9\-._~+/]+=*$/;
-function maybePrefixBearer(target, value, raw = false) {
-  if (raw || target.kind !== "header" || target.key.toLowerCase() !== "authorization") {
-    return value;
+  const releaseLock = acquireOAuthLoginLock(serverName);
+  try {
+    const oauthName = oauthSecretName(serverName, "tokens");
+    const clientName = oauthSecretName(serverName, "client");
+    const backupTokens = secrets.getSecret(oauthName);
+    const backupClient = secrets.getSecret(clientName);
+    new McpxOAuthProvider(serverName, secrets).invalidateCredentials("verifier");
+    new McpxOAuthProvider(serverName, secrets).invalidateCredentials("discovery");
+    const state = crypto.randomUUID();
+    let callbackServer;
+    let redirectUrl;
+    let codePromise;
+    if (codeReceiver) {
+      redirectUrl = codeReceiver.redirectUrl;
+      codePromise = codeReceiver.waitForCode(state, timeoutMs);
+    } else {
+      callbackServer = http.createServer();
+      const port = await listen(callbackServer);
+      redirectUrl = `http://127.0.0.1:${port}/callback`;
+      codePromise = waitForAuthorizationCode(callbackServer, serverName, state, { timeoutMs, signal });
+    }
+    codePromise.catch(() => {});
+    const wrappedOpenUrl = async (url) => {
+      onProgress?.({ phase: "awaiting-browser", authorizationUrl: url, expiresAt: Date.now() + timeoutMs });
+      await openUrl(url);
+    };
+    const provider = new InteractiveOAuthProvider(serverName, secrets, redirectUrl, state, wrappedOpenUrl);
+    try {
+      onProgress?.({ phase: "discovering" });
+      const initial = await auth(provider, {
+        serverUrl: spec.url
+      });
+      if (initial !== "REDIRECT") {
+        throw new Error(`Expected OAuth redirect for "${serverName}", got ${initial}.`);
+      }
+      if (signal?.aborted) {
+        throw new OAuthCancelledError(serverName);
+      }
+      const authorizationCode = await codePromise;
+      onProgress?.({ phase: "exchanging" });
+      const result = await auth(provider, {
+        serverUrl: spec.url,
+        authorizationCode
+      });
+      if (result !== "AUTHORIZED") {
+        throw new Error(`OAuth login did not authorize "${serverName}".`);
+      }
+      onProgress?.({ phase: "syncing" });
+      await mutateConfig((config2) => {
+        bindOAuthReference(config2, serverName);
+      }, configPath);
+      const config = loadConfig(configPath);
+      const summary = syncAllClients(config, secrets);
+      await mutateConfig((freshConfig) => {
+        persistSyncState(summary, freshConfig);
+      }, configPath);
+      new McpxOAuthProvider(serverName, secrets).invalidateCredentials("verifier");
+      return { serverName, authorized: true };
+    } catch (error) {
+      if (backupTokens)
+        secrets.setSecret(oauthName, backupTokens);
+      if (backupClient)
+        secrets.setSecret(clientName, backupClient);
+      new McpxOAuthProvider(serverName, secrets).invalidateCredentials("verifier");
+      throw error;
+    } finally {
+      if (callbackServer) {
+        await closeServer(callbackServer);
+      }
+    }
+  } finally {
+    releaseLock();
   }
-  if (/^\S+\s+\S+/.test(value)) {
-    return value;
+}
+async function getOAuthAccessToken(serverName, spec, secrets, options = {}) {
+  const stored = readJsonSecret(secrets, oauthSecretName(serverName, "tokens"));
+  if (!stored) {
+    throw new UpstreamError(serverName, "auth_required", `No OAuth tokens stored for "${serverName}".`);
   }
-  if (TOKEN68.test(value)) {
-    return `Bearer ${value}`;
+  if (options.forceRefresh || tokensAreExpiring(stored)) {
+    if (!stored.tokens.refresh_token) {
+      if (!options.forceRefresh) {
+        return stored.tokens.access_token;
+      }
+      throw new UpstreamError(serverName, "auth_expired", `No refresh token for "${serverName}". Re-authentication required.`);
+    }
+    const provider = new McpxOAuthProvider(serverName, secrets);
+    const clientInformation = provider.clientInformation();
+    if (!clientInformation) {
+      throw new UpstreamError(serverName, "auth_expired", `No OAuth client info for "${serverName}". Re-authentication required.`);
+    }
+    let serverInfo;
+    try {
+      const cachedDiscovery = provider.discoveryState();
+      serverInfo = cachedDiscovery ?? await discoverOAuthServerInfo(spec.url);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (/ECONNREFUSED|ENOTFOUND|EAI_AGAIN|fetch failed/i.test(message)) {
+        throw new UpstreamError(serverName, "unreachable", `OAuth discovery failed: ${message}`);
+      }
+      throw new UpstreamError(serverName, "upstream_error", `OAuth discovery failed: ${message}`);
+    }
+    try {
+      const refreshed = await refreshAuthorization(serverInfo.authorizationServerUrl, {
+        metadata: serverInfo.authorizationServerMetadata,
+        clientInformation,
+        refreshToken: stored.tokens.refresh_token,
+        resource: serverInfo.resourceMetadata?.resource ? new URL(serverInfo.resourceMetadata.resource) : undefined
+      });
+      provider.saveTokens(refreshed);
+      return refreshed.access_token;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (err instanceof InvalidGrantError || err instanceof InvalidClientError || /invalid_grant|invalid_client|4\d{2}/i.test(message)) {
+        throw new UpstreamError(serverName, "auth_expired", `OAuth refresh failed: ${message}`);
+      }
+      if (/ECONNREFUSED|ENOTFOUND|EAI_AGAIN|fetch failed/i.test(message)) {
+        throw new UpstreamError(serverName, "unreachable", `OAuth refresh failed: ${message}`);
+      }
+      throw new UpstreamError(serverName, "upstream_error", `OAuth refresh failed: ${message}`);
+    }
   }
-  return value;
+  return stored.tokens.access_token;
 }
-
-// src/core/spawn-env.ts
-import os from "node:os";
-import path from "node:path";
-import fs from "node:fs";
-function existingNvmCurrentBin() {
-  const nvmDir = process.env.NVM_DIR ?? path.join(os.homedir(), ".nvm");
-  const current = path.join(nvmDir, "current", "bin");
-  return fs.existsSync(current) ? current : null;
+function oauthSecretNames(serverName) {
+  return {
+    client: oauthSecretName(serverName, "client"),
+    tokens: oauthSecretName(serverName, "tokens"),
+    verifier: oauthSecretName(serverName, "verifier"),
+    discovery: oauthSecretName(serverName, "discovery")
+  };
 }
-function buildEnrichedPath(current = process.env.PATH ?? "") {
+function clearOAuthCredentials(serverName, secrets) {
+  const removed = [];
   const candidates = [
-    ...current.split(":"),
-    "/opt/homebrew/bin",
-    "/usr/local/bin",
-    path.join(os.homedir(), ".bun", "bin"),
-    path.join(os.homedir(), ".local", "bin"),
-    existingNvmCurrentBin()
-  ].filter((entry) => Boolean(entry));
-  const seen = new Set;
-  const entries = [];
-  for (const candidate of candidates) {
-    if (!candidate || seen.has(candidate)) {
-      continue;
-    }
-    seen.add(candidate);
-    entries.push(candidate);
+    ...Object.values(oauthSecretNames(serverName)),
+    ...Object.values({
+      client: legacyOAuthSecretName(serverName, "client"),
+      tokens: legacyOAuthSecretName(serverName, "tokens"),
+      verifier: legacyOAuthSecretName(serverName, "verifier"),
+      discovery: legacyOAuthSecretName(serverName, "discovery")
+    })
+  ];
+  for (const name of candidates) {
+    if (secrets.getSecret(name) !== null) {
+      secrets.removeSecret(name);
+      removed.push(name);
+    }
+  }
+  return removed;
+}
+function getOAuthCredentialStatus(serverName, spec, secrets) {
+  const bound = spec.transport === "http" && Object.values(spec.headers ?? {}).some((value) => isOAuthReference(value) && oauthReferenceServerName(value) === serverName);
+  const clientInfo = readJsonSecret(secrets, oauthSecretName(serverName, "client"));
+  const clientRegistered = clientInfo != null;
+  const stored = readJsonSecret(secrets, oauthSecretName(serverName, "tokens"));
+  if (!stored) {
+    return { bound, signedIn: false, expired: false, hasRefreshToken: false, clientRegistered };
   }
-  return entries.join(":");
+  const expiresAt = stored.tokens.expires_in ? stored.obtainedAt + stored.tokens.expires_in * 1000 : undefined;
+  const expired = expiresAt != null && Date.now() >= expiresAt;
+  return {
+    bound,
+    signedIn: true,
+    obtainedAt: stored.obtainedAt,
+    expiresAt,
+    expired,
+    hasRefreshToken: Boolean(stored.tokens.refresh_token),
+    clientRegistered
+  };
 }
 
-// src/core/oauth.ts
-import http from "node:http";
-import crypto from "node:crypto";
-import {
-  auth,
-  discoverOAuthServerInfo,
-  refreshAuthorization
-} from "@modelcontextprotocol/sdk/client/auth.js";
-import { InvalidClientError, InvalidGrantError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
-function oauthSecretName(serverName, suffix) {
-  return `oauth_${serverName.toLowerCase().replace(/[^a-z0-9._-]/g, "_")}_${suffix}`;
-}
-function readJsonSecret(secrets, name) {
-  const raw = secrets.getSecret(name);
-  if (!raw) {
-    return;
-  }
-  try {
-    return JSON.parse(raw);
-  } catch {
-    return;
-  }
-}
-function writeJsonSecret(secrets, name, value) {
-  secrets.setSecret(name, JSON.stringify(value));
-}
-function isOAuthReference(value) {
-  return value.startsWith("oauth://");
+// src/core/auth-probe.ts
+var JSON_RPC_VERSION = "2.0";
+var DEFAULT_AUTH_PROBE_TIMEOUT_MS = 8000;
+var AUTH_KEYWORDS = [
+  "unauthorized",
+  "unauthenticated",
+  "forbidden",
+  "authentication",
+  "authorization",
+  "api key",
+  "api_key",
+  "apikey",
+  "credentials",
+  "access denied",
+  "auth required",
+  "x-api-key",
+  "invalid key",
+  "missing header",
+  "not authenticated",
+  "auth token"
+];
+function isAuthRelatedMessage(message) {
+  const lower = message.toLowerCase();
+  return AUTH_KEYWORDS.some((kw) => lower.includes(kw));
 }
-function oauthReferenceServerName(value) {
-  if (!isOAuthReference(value)) {
-    throw new Error(`Not an OAuth reference: ${value}`);
+function resolveHeaders(spec, secrets) {
+  const headers = {
+    "content-type": "application/json",
+    accept: "application/json, text/event-stream"
+  };
+  for (const [key, value] of Object.entries(spec.headers ?? {})) {
+    headers[key] = secrets.resolveMaybeSecret(value);
   }
-  return decodeURIComponent(value.slice("oauth://".length));
+  return headers;
 }
-function tokensAreExpiring(tokens) {
-  if (!tokens.tokens.expires_in) {
+function isOAuthLikelyChallenge(wwwAuthenticate) {
+  if (!wwwAuthenticate) {
     return false;
   }
-  const expiresAt = tokens.obtainedAt + tokens.tokens.expires_in * 1000;
-  return Date.now() >= expiresAt - 60000;
+  const lower = wwwAuthenticate.toLowerCase();
+  return lower.includes("bearer") || lower.includes("authorization_uri") || lower.includes("resource_metadata");
 }
-
-class McpxOAuthProvider {
-  #serverName;
-  #secrets;
-  #redirectUrlValue;
-  #stateValue;
-  constructor(serverName, secrets, redirectUrl, state = crypto.randomUUID()) {
-    this.#serverName = serverName;
-    this.#secrets = secrets;
-    this.#redirectUrlValue = redirectUrl;
-    this.#stateValue = state;
-  }
-  get redirectUrl() {
-    return this.#redirectUrlValue;
-  }
-  get clientMetadata() {
-    if (!this.#redirectUrlValue) {
-      return {
-        redirect_uris: [],
-        token_endpoint_auth_method: "none",
-        grant_types: ["authorization_code", "refresh_token"],
-        response_types: ["code"],
-        client_name: "mcpx"
-      };
+async function probeHttpAuthRequirement(spec, secrets, timeoutMs = DEFAULT_AUTH_PROBE_TIMEOUT_MS, options = {}) {
+  const timeoutController = new AbortController;
+  const timeoutHandle = setTimeout(() => timeoutController.abort(), timeoutMs);
+  const discoverOAuth = options.discoverOAuth ?? true;
+  async function withOAuthSupport(result) {
+    if (!discoverOAuth) {
+      return result;
     }
+    const support = await probeOAuthSupport(spec.url).catch(() => {
+      return;
+    });
     return {
-      redirect_uris: [this.#redirectUrlValue],
-      token_endpoint_auth_method: "none",
-      grant_types: ["authorization_code", "refresh_token"],
-      response_types: ["code"],
-      client_name: "mcpx"
+      ...result,
+      oauthSupport: support?.support,
+      oauthLikely: result.oauthLikely || support?.support === "supported"
     };
   }
-  state() {
-    return this.#stateValue;
+  try {
+    const headers = resolveHeaders(spec, secrets);
+    const response = await fetch(spec.url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        jsonrpc: JSON_RPC_VERSION,
+        id: "mcpx-auth-probe",
+        method: "tools/list",
+        params: {}
+      }),
+      signal: timeoutController.signal
+    });
+    if (response.status === 401 || response.status === 403) {
+      const wwwAuthenticate = response.headers.get("www-authenticate");
+      return await withOAuthSupport({
+        authRequired: true,
+        oauthLikely: isOAuthLikelyChallenge(wwwAuthenticate),
+        status: response.status,
+        wwwAuthenticate: wwwAuthenticate ?? undefined
+      });
+    }
+    if (response.status === 200) {
+      try {
+        const body = await response.json();
+        const err = body?.error;
+        if (err && typeof err === "object" && !("result" in body)) {
+          const message = typeof err.message === "string" ? err.message : "";
+          if (message && isAuthRelatedMessage(message)) {
+            return await withOAuthSupport({
+              authRequired: true,
+              status: response.status,
+              error: `JSON-RPC error: ${message}`
+            });
+          }
+        }
+      } catch {}
+    }
+    return {
+      authRequired: false,
+      status: response.status
+    };
+  } catch (error) {
+    const isAbort = error.name === "AbortError";
+    return {
+      authRequired: false,
+      error: isAbort ? `Auth probe timed out after ${timeoutMs}ms.` : error.message
+    };
+  } finally {
+    clearTimeout(timeoutHandle);
   }
-  clientInformation() {
-    return readJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "client"));
+}
+
+// src/core/registry-client.ts
+var REGISTRY_BASE = "https://registry.modelcontextprotocol.io";
+async function fetchRegistryServerDetail(name) {
+  const encoded = encodeURIComponent(name);
+  const response = await fetch(`${REGISTRY_BASE}/v0.1/servers/${encoded}/versions/latest`, {
+    headers: { accept: "application/json" }
+  });
+  if (!response.ok) {
+    throw new Error(`Registry API error: ${response.status}`);
   }
-  saveClientInformation(clientInformation) {
-    writeJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "client"), clientInformation);
+  const data = await response.json();
+  return data.server;
+}
+var PACKAGE_PRIORITY = {
+  npm: 1,
+  pypi: 2,
+  nuget: 3,
+  oci: 4,
+  mcpb: 5
+};
+var RUNTIME_HINT = {
+  npm: "npx",
+  pypi: "uvx",
+  nuget: "dnx"
+};
+function selectBestPackage(packages = [], remotes = []) {
+  const stdioPkgs = packages.filter((p) => p.transport.type === "stdio").sort((a, b) => (PACKAGE_PRIORITY[a.registryType] ?? 99) - (PACKAGE_PRIORITY[b.registryType] ?? 99));
+  if (stdioPkgs.length > 0) {
+    return { kind: "package", package: stdioPkgs[0] };
   }
-  tokens() {
-    return readJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "tokens"))?.tokens;
+  const httpRemotes = remotes.filter((r) => r.type === "streamable-http" || r.type === "sse");
+  if (httpRemotes.length > 0) {
+    return { kind: "remote", remote: httpRemotes[0] };
   }
-  saveTokens(tokens) {
-    writeJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "tokens"), {
-      tokens,
-      obtainedAt: Date.now()
-    });
+  if (packages.length > 0) {
+    return { kind: "package", package: packages[0] };
   }
-  redirectToAuthorization(_authorizationUrl) {}
-  saveCodeVerifier(codeVerifier) {
-    this.#secrets.setSecret(oauthSecretName(this.#serverName, "verifier"), codeVerifier);
+  if (remotes.length > 0) {
+    return { kind: "remote", remote: remotes[0] };
   }
-  codeVerifier() {
-    const verifier = this.#secrets.getSecret(oauthSecretName(this.#serverName, "verifier"));
-    if (!verifier) {
-      throw new Error(`Missing OAuth code verifier for "${this.#serverName}".`);
+  throw new Error("Server has no packages or remotes");
+}
+function extractRequiredInputs(option) {
+  const inputs = [];
+  if (option.kind === "package" && option.package?.environmentVariables) {
+    for (const env of option.package.environmentVariables) {
+      if (env.isRequired && !env.default) {
+        inputs.push({
+          name: env.name,
+          description: env.description,
+          isSecret: env.isSecret ?? false,
+          kind: "env"
+        });
+      }
+    }
+    for (const arg of option.package.packageArguments ?? []) {
+      if (arg.isRequired && !arg.value && !arg.default) {
+        inputs.push({
+          name: arg.name ?? arg.valueHint ?? "arg",
+          description: arg.description,
+          isSecret: false,
+          kind: "arg"
+        });
+      }
     }
-    return verifier;
-  }
-  saveDiscoveryState(state) {
-    writeJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "discovery"), state);
-  }
-  discoveryState() {
-    return readJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "discovery"));
   }
-  invalidateCredentials(scope) {
-    const suffixes = scope === "all" ? ["client", "tokens", "verifier", "discovery"] : [scope];
-    for (const suffix of suffixes) {
-      this.#secrets.removeSecret(oauthSecretName(this.#serverName, suffix));
+  if (option.kind === "remote" && option.remote?.headers) {
+    for (const header of option.remote.headers) {
+      if (header.isRequired && !header.default) {
+        inputs.push({
+          name: header.name,
+          description: header.description,
+          isSecret: header.isSecret ?? false,
+          kind: "header"
+        });
+      }
     }
   }
+  return inputs;
 }
-
-class InteractiveOAuthProvider extends McpxOAuthProvider {
-  #openUrl;
-  #cachedClientInfo;
-  #cachedCodeVerifier;
-  constructor(serverName, secrets, redirectUrl, state, openUrl) {
-    super(serverName, secrets, redirectUrl, state);
-    this.#openUrl = openUrl;
-  }
-  async redirectToAuthorization(authorizationUrl) {
-    await this.#openUrl(authorizationUrl.toString());
-  }
-  clientInformation() {
-    this.#cachedClientInfo ??= super.clientInformation();
-    return this.#cachedClientInfo;
-  }
-  saveClientInformation(clientInformation) {
-    super.saveClientInformation(clientInformation);
-    this.#cachedClientInfo = clientInformation;
+function mapRegistryToSpec(_name, option, resolvedValues) {
+  if (option.kind === "remote") {
+    const headers = {};
+    for (const header of option.remote?.headers ?? []) {
+      const value = resolvedValues[header.name] ?? header.default;
+      if (value)
+        headers[header.name] = value;
+    }
+    return {
+      transport: "http",
+      url: option.remote.url,
+      ...Object.keys(headers).length > 0 ? { headers } : {}
+    };
   }
-  codeVerifier() {
-    if (this.#cachedCodeVerifier !== undefined) {
-      return this.#cachedCodeVerifier;
+  const pkg = option.package;
+  const runtime = pkg.runtimeHint ?? RUNTIME_HINT[pkg.registryType] ?? "npx";
+  const args = [];
+  const identifier = pkg.version ? `${pkg.identifier}@${pkg.version}` : pkg.identifier;
+  args.push(identifier);
+  for (const arg of pkg.packageArguments ?? []) {
+    const value = arg.value ?? resolvedValues[arg.name ?? arg.valueHint ?? ""] ?? arg.default;
+    if (!value)
+      continue;
+    if (arg.type === "named" && arg.name) {
+      args.push(arg.name, value);
+    } else {
+      args.push(value);
     }
-    return super.codeVerifier();
   }
-  saveCodeVerifier(codeVerifier) {
-    super.saveCodeVerifier(codeVerifier);
-    this.#cachedCodeVerifier = codeVerifier;
+  const env = {};
+  for (const envVar of pkg.environmentVariables ?? []) {
+    const value = resolvedValues[envVar.name] ?? envVar.default;
+    if (value)
+      env[envVar.name] = value;
   }
-  invalidateCredentials(scope) {
-    super.invalidateCredentials(scope);
-    if (scope === "all" || scope === "client") {
-      this.#cachedClientInfo = undefined;
-    }
+  return {
+    transport: "stdio",
+    command: runtime,
+    args,
+    ...Object.keys(env).length > 0 ? { env } : {}
+  };
+}
+
+// src/core/server-auth.ts
+function normalizeNamePart(value) {
+  return value.trim().toLowerCase().replace(/[^a-z0-9._-]+/g, "_").replace(/^_+|_+$/g, "") || "value";
+}
+function requireNonEmpty(value, label) {
+  const normalized = value?.trim();
+  if (!normalized) {
+    throw new Error(`${label} must be non-empty.`);
   }
+  return normalized;
 }
-function listen(server) {
-  return new Promise((resolve, reject) => {
-    server.once("error", reject);
-    server.listen(0, "127.0.0.1", () => {
-      const address = server.address();
-      if (!address || typeof address === "string") {
-        reject(new Error("Failed to start OAuth callback server."));
-        return;
-      }
-      resolve(address.port);
-    });
-  });
+function toSecretRef(secretName) {
+  return `secret://${secretName}`;
 }
-function closeServer(server) {
-  return new Promise((resolve) => {
-    server.close(() => resolve());
-  });
+function secretRefName(ref) {
+  if (!ref.startsWith("secret://")) {
+    return null;
+  }
+  const name = ref.slice("secret://".length).trim();
+  return name.length > 0 ? name : null;
 }
-function waitForAuthorizationCode(server, expectedState, timeoutMs = 120000) {
-  return new Promise((resolve, reject) => {
-    const timeout = setTimeout(() => {
-      reject(new Error(`OAuth login timed out after ${timeoutMs}ms.`));
-    }, timeoutMs);
-    server.on("request", (request, response) => {
-      const url = new URL(request.url ?? "/", "http://127.0.0.1");
-      const code = url.searchParams.get("code");
-      const state = url.searchParams.get("state");
-      const error = url.searchParams.get("error");
-      response.setHeader("content-type", "text/html; charset=utf-8");
-      if (error) {
-        response.statusCode = 400;
-        response.end("<html><body><h1>mcpx OAuth failed</h1><p>You can close this window.</p></body></html>");
-        clearTimeout(timeout);
-        reject(new Error(`OAuth authorization failed: ${error}`));
-        return;
-      }
-      if (!code) {
-        response.statusCode = 400;
-        response.end("<html><body><h1>Missing OAuth code</h1><p>You can close this window.</p></body></html>");
-        return;
-      }
-      if (state !== expectedState) {
-        response.statusCode = 400;
-        response.end("<html><body><h1>OAuth state mismatch</h1><p>You can close this window.</p></body></html>");
-        clearTimeout(timeout);
-        reject(new Error("OAuth state mismatch."));
-        return;
-      }
-      response.end("<html><body><h1>mcpx OAuth complete</h1><p>You can close this window.</p></body></html>");
-      clearTimeout(timeout);
-      resolve(code);
-    });
-  });
+function defaultAuthSecretName(serverName, target) {
+  return `auth_${normalizeNamePart(serverName)}_${target.kind}_${normalizeNamePart(target.key)}`;
 }
-function bindOAuthReference(config, serverName) {
-  const spec = config.servers[serverName];
-  if (!spec) {
-    throw new Error(`Server "${serverName}" not found.`);
+function resolveAuthTarget(spec, header, env) {
+  if (spec.transport === "http") {
+    if (env) {
+      throw new Error("--env is only valid for stdio upstreams.");
+    }
+    return {
+      kind: "header",
+      key: requireNonEmpty(header ?? "Authorization", "Header name")
+    };
   }
-  if (spec.transport !== "http") {
-    throw new Error(`OAuth login only supports HTTP servers.`);
+  if (header) {
+    throw new Error("--header is only valid for HTTP upstreams.");
   }
-  spec.headers = {
-    ...spec.headers ?? {},
-    Authorization: `oauth://${encodeURIComponent(serverName)}`
+  return {
+    kind: "env",
+    key: requireNonEmpty(env, "Env var name")
   };
 }
-async function runOAuthLogin(serverName, spec, secrets, openUrl, configPath, codeReceiver) {
-  const oauthName = oauthSecretName(serverName, "tokens");
-  const clientName = oauthSecretName(serverName, "client");
-  const backupTokens = secrets.getSecret(oauthName);
-  const backupClient = secrets.getSecret(clientName);
-  new McpxOAuthProvider(serverName, secrets).invalidateCredentials("verifier");
-  new McpxOAuthProvider(serverName, secrets).invalidateCredentials("discovery");
-  const state = crypto.randomUUID();
-  let callbackServer;
-  let redirectUrl;
-  let codePromise;
-  if (codeReceiver) {
-    redirectUrl = codeReceiver.redirectUrl;
-    codePromise = codeReceiver.waitForCode(state);
-  } else {
-    callbackServer = http.createServer();
-    const port = await listen(callbackServer);
-    redirectUrl = `http://127.0.0.1:${port}/callback`;
-    codePromise = waitForAuthorizationCode(callbackServer, state);
+function applyAuthReference(spec, target, secretRef) {
+  if (target.kind === "header") {
+    if (spec.transport !== "http") {
+      throw new Error(`Cannot set header auth on ${spec.transport} upstream.`);
+    }
+    const headers = { ...spec.headers ?? {} };
+    headers[target.key] = secretRef;
+    spec.headers = headers;
+    return;
   }
-  codePromise.catch(() => {});
-  const provider = new InteractiveOAuthProvider(serverName, secrets, redirectUrl, state, openUrl);
-  try {
-    const initial = await auth(provider, {
-      serverUrl: spec.url
-    });
-    if (initial !== "REDIRECT") {
-      throw new Error(`Expected OAuth redirect for "${serverName}", got ${initial}.`);
+  if (spec.transport !== "stdio") {
+    throw new Error(`Cannot set env auth on ${spec.transport} upstream.`);
+  }
+  const env = { ...spec.env ?? {} };
+  env[target.key] = secretRef;
+  spec.env = env;
+}
+function removeAuthReference(spec, target) {
+  if (target.kind === "header") {
+    if (spec.transport !== "http") {
+      throw new Error(`Cannot remove header auth from ${spec.transport} upstream.`);
     }
-    const authorizationCode = await codePromise;
-    const result = await auth(provider, {
-      serverUrl: spec.url,
-      authorizationCode
-    });
-    if (result !== "AUTHORIZED") {
-      throw new Error(`OAuth login did not authorize "${serverName}".`);
-    }
-    const config = loadConfig(configPath);
-    bindOAuthReference(config, serverName);
-    saveConfig(config, configPath);
-    const summary = syncAllClients(config, secrets);
-    persistSyncState(summary, config);
-    saveConfig(config, configPath);
-    new McpxOAuthProvider(serverName, secrets).invalidateCredentials("verifier");
-    return { serverName, authorized: true };
-  } catch (error) {
-    if (backupTokens)
-      secrets.setSecret(oauthName, backupTokens);
-    if (backupClient)
-      secrets.setSecret(clientName, backupClient);
-    new McpxOAuthProvider(serverName, secrets).invalidateCredentials("verifier");
-    throw error;
-  } finally {
-    if (callbackServer) {
-      await closeServer(callbackServer);
+    if (!spec.headers || !(target.key in spec.headers)) {
+      return null;
     }
+    const previous2 = spec.headers[target.key] ?? null;
+    const next2 = { ...spec.headers };
+    delete next2[target.key];
+    spec.headers = Object.keys(next2).length > 0 ? next2 : undefined;
+    return previous2;
+  }
+  if (spec.transport !== "stdio") {
+    throw new Error(`Cannot remove env auth from ${spec.transport} upstream.`);
+  }
+  if (!spec.env || !(target.key in spec.env)) {
+    return null;
   }
+  const previous = spec.env[target.key] ?? null;
+  const next = { ...spec.env };
+  delete next[target.key];
+  spec.env = Object.keys(next).length > 0 ? next : undefined;
+  return previous;
 }
-async function getOAuthAccessToken(serverName, spec, secrets, options = {}) {
-  const stored = readJsonSecret(secrets, oauthSecretName(serverName, "tokens"));
-  if (!stored) {
-    throw new UpstreamError(serverName, "auth_required", `No OAuth tokens stored for "${serverName}".`);
+function listAuthBindings(spec) {
+  if (spec.transport === "http") {
+    return Object.entries(spec.headers ?? {}).map(([key, value]) => ({
+      kind: "header",
+      key,
+      value
+    }));
   }
-  if (options.forceRefresh || tokensAreExpiring(stored)) {
-    if (!stored.tokens.refresh_token) {
-      if (!options.forceRefresh) {
-        return stored.tokens.access_token;
-      }
-      throw new UpstreamError(serverName, "auth_expired", `No refresh token for "${serverName}". Re-authentication required.`);
-    }
-    const provider = new McpxOAuthProvider(serverName, secrets);
-    const clientInformation = provider.clientInformation();
-    if (!clientInformation) {
-      throw new UpstreamError(serverName, "auth_expired", `No OAuth client info for "${serverName}". Re-authentication required.`);
-    }
-    let serverInfo;
-    try {
-      const cachedDiscovery = provider.discoveryState();
-      serverInfo = cachedDiscovery ?? await discoverOAuthServerInfo(spec.url);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      if (/ECONNREFUSED|ENOTFOUND|EAI_AGAIN|fetch failed/i.test(message)) {
-        throw new UpstreamError(serverName, "unreachable", `OAuth discovery failed: ${message}`);
-      }
-      throw new UpstreamError(serverName, "upstream_error", `OAuth discovery failed: ${message}`);
-    }
-    try {
-      const refreshed = await refreshAuthorization(serverInfo.authorizationServerUrl, {
-        metadata: serverInfo.authorizationServerMetadata,
-        clientInformation,
-        refreshToken: stored.tokens.refresh_token,
-        resource: serverInfo.resourceMetadata?.resource ? new URL(serverInfo.resourceMetadata.resource) : undefined
-      });
-      provider.saveTokens(refreshed);
-      return refreshed.access_token;
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      if (err instanceof InvalidGrantError || err instanceof InvalidClientError || /invalid_grant|invalid_client|4\d{2}/i.test(message)) {
-        throw new UpstreamError(serverName, "auth_expired", `OAuth refresh failed: ${message}`);
-      }
-      if (/ECONNREFUSED|ENOTFOUND|EAI_AGAIN|fetch failed/i.test(message)) {
-        throw new UpstreamError(serverName, "unreachable", `OAuth refresh failed: ${message}`);
-      }
-      throw new UpstreamError(serverName, "upstream_error", `OAuth refresh failed: ${message}`);
+  return Object.entries(spec.env ?? {}).map(([key, value]) => ({
+    kind: "env",
+    key,
+    value
+  }));
+}
+var TOKEN68 = /^[A-Za-z0-9\-._~+/]+=*$/;
+function maybePrefixBearer(target, value, raw = false) {
+  if (raw || target.kind !== "header" || target.key.toLowerCase() !== "authorization") {
+    return value;
+  }
+  if (/^\S+\s+\S+/.test(value)) {
+    return value;
+  }
+  if (TOKEN68.test(value)) {
+    return `Bearer ${value}`;
+  }
+  return value;
+}
+
+// src/core/spawn-env.ts
+import os from "node:os";
+import path2 from "node:path";
+import fs2 from "node:fs";
+function existingNvmCurrentBin() {
+  const nvmDir = process.env.NVM_DIR ?? path2.join(os.homedir(), ".nvm");
+  const current = path2.join(nvmDir, "current", "bin");
+  return fs2.existsSync(current) ? current : null;
+}
+function buildEnrichedPath(current = process.env.PATH ?? "") {
+  const candidates = [
+    ...current.split(":"),
+    "/opt/homebrew/bin",
+    "/usr/local/bin",
+    path2.join(os.homedir(), ".bun", "bin"),
+    path2.join(os.homedir(), ".local", "bin"),
+    existingNvmCurrentBin()
+  ].filter((entry) => Boolean(entry));
+  const seen = new Set;
+  const entries = [];
+  for (const candidate of candidates) {
+    if (!candidate || seen.has(candidate)) {
+      continue;
     }
+    seen.add(candidate);
+    entries.push(candidate);
   }
-  return stored.tokens.access_token;
+  return entries.join(":");
 }
 
 // src/core/update.ts
-import fs2 from "node:fs";
-import path2 from "node:path";
+import fs3 from "node:fs";
+import path3 from "node:path";
 import { execFileSync } from "node:child_process";
 function compareVersions(a, b) {
   const partsA = a.split(".").map(Number);
@@ -768,17 +1099,17 @@ async function checkForUpdates() {
 }
 function getStagedUpdate() {
   const stagedPath = getStagedVersionPath();
-  if (!fs2.existsSync(stagedPath)) {
+  if (!fs3.existsSync(stagedPath)) {
     return null;
   }
   try {
-    const raw = fs2.readFileSync(stagedPath, "utf8");
+    const raw = fs3.readFileSync(stagedPath, "utf8");
     const info = JSON.parse(raw);
     if (!info.version || !info.cliPath) {
       return null;
     }
-    const absoluteCliPath = path2.isAbsolute(info.cliPath) ? info.cliPath : path2.join(getUpdatesDir(), info.cliPath);
-    if (!fs2.existsSync(absoluteCliPath)) {
+    const absoluteCliPath = path3.isAbsolute(info.cliPath) ? info.cliPath : path3.join(getUpdatesDir(), info.cliPath);
+    if (!fs3.existsSync(absoluteCliPath)) {
       return null;
     }
     return {
@@ -794,18 +1125,18 @@ function stageUpdate(version, cliPath) {
   ensureDir(updatesDir);
   const stagedInfo = {
     version,
-    cliPath: path2.isAbsolute(cliPath) ? path2.relative(updatesDir, cliPath) : cliPath,
+    cliPath: path3.isAbsolute(cliPath) ? path3.relative(updatesDir, cliPath) : cliPath,
     stagedAt: new Date().toISOString()
   };
-  fs2.writeFileSync(getStagedVersionPath(), JSON.stringify(stagedInfo, null, 2), "utf8");
+  fs3.writeFileSync(getStagedVersionPath(), JSON.stringify(stagedInfo, null, 2), "utf8");
 }
 function shouldUseStagedCli(stagedVersion, currentVersion) {
   return compareVersions(stagedVersion, currentVersion) > 0;
 }
 function clearStagedUpdate() {
   const stagedPath = getStagedVersionPath();
-  if (fs2.existsSync(stagedPath)) {
-    fs2.unlinkSync(stagedPath);
+  if (fs3.existsSync(stagedPath)) {
+    fs3.unlinkSync(stagedPath);
   }
 }
 function getStagedCliPath() {
@@ -814,31 +1145,33 @@ function getStagedCliPath() {
 }
 function removeOldVersions(keepCount = 2) {
   const updatesDir = getUpdatesDir();
-  if (!fs2.existsSync(updatesDir)) {
+  if (!fs3.existsSync(updatesDir)) {
     return;
   }
-  const entries = fs2.readdirSync(updatesDir, { withFileTypes: true });
+  const entries = fs3.readdirSync(updatesDir, { withFileTypes: true });
   const versionDirs = entries.filter((entry) => entry.isDirectory() && entry.name.startsWith("v")).map((entry) => entry.name).sort((a, b) => compareVersions(b.slice(1), a.slice(1)));
   if (versionDirs.length <= keepCount) {
     return;
   }
   for (const oldVersion of versionDirs.slice(keepCount)) {
-    const oldPath = path2.join(updatesDir, oldVersion);
+    const oldPath = path3.join(updatesDir, oldVersion);
     try {
-      fs2.rmSync(oldPath, { recursive: true, force: true });
+      fs3.rmSync(oldPath, { recursive: true, force: true });
     } catch {}
   }
 }
 
 // src/core/update-manager.ts
-import fs3 from "node:fs";
-import path3 from "node:path";
-import { execSync, spawn } from "node:child_process";
+import fs4 from "node:fs";
+import path4 from "node:path";
+import { execFile, spawn } from "node:child_process";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile);
 function acquireLock() {
   const lockPath = getUpdateLockPath();
   try {
-    ensureDir(path3.dirname(lockPath));
-    fs3.writeFileSync(lockPath, `${process.pid}
+    ensureDir(path4.dirname(lockPath));
+    fs4.writeFileSync(lockPath, `${process.pid}
 `, { flag: "wx" });
     return true;
   } catch {
@@ -848,25 +1181,25 @@ function acquireLock() {
 function releaseLock() {
   const lockPath = getUpdateLockPath();
   try {
-    fs3.unlinkSync(lockPath);
+    fs4.unlinkSync(lockPath);
   } catch {}
 }
 function isUpdateInProgress() {
   const lockPath = getUpdateLockPath();
-  if (!fs3.existsSync(lockPath)) {
+  if (!fs4.existsSync(lockPath)) {
     return false;
   }
   try {
-    const raw = fs3.readFileSync(lockPath, "utf8").trim();
+    const raw = fs4.readFileSync(lockPath, "utf8").trim();
     const pid = Number(raw);
     if (!Number.isFinite(pid) || pid <= 0) {
-      fs3.unlinkSync(lockPath);
+      fs4.unlinkSync(lockPath);
       return false;
     }
     process.kill(pid, 0);
     return true;
   } catch {
-    fs3.unlinkSync(lockPath);
+    fs4.unlinkSync(lockPath);
     return false;
   }
 }
@@ -876,9 +1209,12 @@ async function downloadAndStageUpdate() {
     return { success: false, error: "No update available" };
   }
   const targetVersion = updateStatus.latestVersion;
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(targetVersion)) {
+    return { success: false, error: "Update returned an invalid version" };
+  }
   const updatesDir = getUpdatesDir();
-  const versionDir = path3.join(updatesDir, `v${targetVersion}`);
-  if (fs3.existsSync(versionDir)) {
+  const versionDir = path4.join(updatesDir, `v${targetVersion}`);
+  if (fs4.existsSync(versionDir)) {
     const existingStaged = getStagedUpdate();
     if (existingStaged?.version === targetVersion) {
       return { success: false, error: `Version ${targetVersion} already staged` };
@@ -886,31 +1222,19 @@ async function downloadAndStageUpdate() {
   }
   try {
     ensureDir(versionDir);
-    execSync(`npm pack @kwonye/mcpx@${targetVersion} --json`, {
-      cwd: versionDir,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    const tarballPath = path3.join(versionDir, `kwonye-mcpx-${targetVersion}.tgz`);
-    if (!fs3.existsSync(tarballPath)) {
+    await execFileAsync("npm", ["pack", `@kwonye/mcpx@${targetVersion}`, "--json"], { cwd: versionDir });
+    const tarballPath = path4.join(versionDir, `kwonye-mcpx-${targetVersion}.tgz`);
+    if (!fs4.existsSync(tarballPath)) {
       throw new Error("Downloaded tarball not found");
     }
-    execSync(`tar -xzf ${tarballPath} --strip-components=1`, {
-      cwd: versionDir,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    execSync("npm install --production --ignore-scripts", {
-      cwd: versionDir,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    const cliPath = path3.join(versionDir, "dist", "cli.js");
-    if (!fs3.existsSync(cliPath)) {
+    await execFileAsync("tar", ["-xzf", tarballPath, "--strip-components=1"], { cwd: versionDir });
+    await execFileAsync("npm", ["install", "--production", "--ignore-scripts"], { cwd: versionDir });
+    const cliPath = path4.join(versionDir, "dist", "cli.js");
+    if (!fs4.existsSync(cliPath)) {
       throw new Error("CLI entry point not found in downloaded package");
     }
     try {
-      execSync(`${process.execPath} ${JSON.stringify(cliPath)} --version`, {
-        stdio: ["ignore", "pipe", "pipe"],
-        timeout: 1e4
-      });
+      await execFileAsync(process.execPath, [cliPath, "--version"], { timeout: 1e4 });
     } catch (smokeTestError) {
       throw new Error(`Downloaded CLI failed smoke test (--version): ${smokeTestError instanceof Error ? smokeTestError.message : String(smokeTestError)}`);
     }
@@ -919,7 +1243,7 @@ async function downloadAndStageUpdate() {
     return { success: true, version: targetVersion };
   } catch (error) {
     try {
-      fs3.rmSync(versionDir, { recursive: true, force: true });
+      fs4.rmSync(versionDir, { recursive: true, force: true });
     } catch {}
     return {
       success: false,
@@ -950,9 +1274,10 @@ function startBackgroundUpdateCheck() {
     }
   });
   child.unref();
-  setTimeout(() => {
+  const releaseTimer = setTimeout(() => {
     releaseLock();
   }, 60000);
+  releaseTimer.unref?.();
 }
 async function runBackgroundUpdate() {
   try {
@@ -1007,13 +1332,13 @@ function performRollback() {
 }
 
 // src/core/marketplace-updater.ts
-import fs4 from "node:fs";
+import fs5 from "node:fs";
 var MARKETPLACE_UPDATE_INTERVAL_MS = 6 * 60 * 60 * 1000;
 var INITIAL_DELAY_MS = 30000;
 var LOCK_STALE_MS = 30 * 60 * 1000;
 function readState() {
   try {
-    return JSON.parse(fs4.readFileSync(getMarketplaceUpdateStatePath(), "utf8"));
+    return JSON.parse(fs5.readFileSync(getMarketplaceUpdateStatePath(), "utf8"));
   } catch {
     return {};
   }
@@ -1021,7 +1346,7 @@ function readState() {
 function writeState(state) {
   const target = getMarketplaceUpdateStatePath();
   ensureParentDir(target);
-  fs4.writeFileSync(target, JSON.stringify(state, null, 2), { mode: 384 });
+  fs5.writeFileSync(target, JSON.stringify(state, null, 2), { mode: 384 });
 }
 function due(now = Date.now()) {
   const last = readState().lastRunAt;
@@ -1031,13 +1356,13 @@ function acquireLock2() {
   const target = getMarketplaceUpdateLockPath();
   ensureParentDir(target);
   try {
-    fs4.writeFileSync(target, `${process.pid}
+    fs5.writeFileSync(target, `${process.pid}
 `, { flag: "wx", mode: 384 });
     return true;
   } catch {
     try {
-      if (Date.now() - fs4.statSync(target).mtimeMs > LOCK_STALE_MS) {
-        fs4.unlinkSync(target);
+      if (Date.now() - fs5.statSync(target).mtimeMs > LOCK_STALE_MS) {
+        fs5.unlinkSync(target);
         return acquireLock2();
       }
     } catch {
@@ -1048,7 +1373,7 @@ function acquireLock2() {
 }
 function releaseLock2() {
   try {
-    fs4.unlinkSync(getMarketplaceUpdateLockPath());
+    fs5.unlinkSync(getMarketplaceUpdateLockPath());
   } catch {}
 }
 async function runMarketplaceAutoUpdate(options) {
@@ -1088,7 +1413,7 @@ function startMarketplaceAutoUpdater() {
 }
 
 // src/core/daemon.ts
-import fs5 from "node:fs";
+import fs6 from "node:fs";
 import net from "node:net";
 import { spawn as spawn2, execFileSync as execFileSync2 } from "node:child_process";
 
@@ -1258,6 +1583,29 @@ function parseNamespacedUri(uri) {
 async function callUpstream(upstream, method, params, id, secrets, runtime, passthroughAuthorizationHeader) {
   return callUpstreamOnce(upstream, method, params, secrets, runtime, passthroughAuthorizationHeader, false);
 }
+var ERROR_CODE_PRIORITY = [
+  "auth_expired",
+  "auth_required",
+  "secret_missing",
+  "unreachable",
+  "timeout",
+  "upstream_error"
+];
+function pickPrimaryErrorCode(errors) {
+  let best;
+  let bestRank = Number.POSITIVE_INFINITY;
+  for (const { code } of errors) {
+    if (!code)
+      continue;
+    const rank = ERROR_CODE_PRIORITY.indexOf(code);
+    const effectiveRank = rank === -1 ? ERROR_CODE_PRIORITY.length : rank;
+    if (effectiveRank < bestRank) {
+      bestRank = effectiveRank;
+      best = code;
+    }
+  }
+  return best;
+}
 async function getUpstreamTokenCounts(config, secrets, runtime) {
   if (!runtime.tokenCache) {
     runtime.tokenCache = new Map;
@@ -1265,7 +1613,11 @@ async function getUpstreamTokenCounts(config, secrets, runtime) {
   const results = {};
   const upstreams = listUpstreams(config);
   for (const upstream of upstreams) {
-    const fingerprint = specFingerprint(upstream.spec);
+    let recordError = function(label, error) {
+      const message = error instanceof Error ? error.message : String(error);
+      errors.push({ label, message, code: error instanceof UpstreamError ? error.code : undefined });
+    };
+    const fingerprint = specFingerprint(upstream.spec, secrets);
     const cached = runtime.tokenCache.get(upstream.name);
     if (cached?.fingerprint === fingerprint) {
       const runtimeErr2 = runtime.upstreamErrors?.get(upstream.name);
@@ -1282,7 +1634,7 @@ async function getUpstreamTokenCounts(config, secrets, runtime) {
         toolsCount = Math.ceil(JSON.stringify(toolsResult.tools).length / 4);
       }
     } catch (error) {
-      errors.push(`tools/list: ${error instanceof Error ? error.message : String(error)}`);
+      recordError("tools/list", error);
     }
     try {
       const resourcesResult = await callUpstream(upstream, "resources/list", {}, "token-resources", secrets, runtime);
@@ -1290,7 +1642,7 @@ async function getUpstreamTokenCounts(config, secrets, runtime) {
         resourcesCount = Math.ceil(JSON.stringify(resourcesResult.resources).length / 4);
       }
     } catch (error) {
-      errors.push(`resources/list: ${error instanceof Error ? error.message : String(error)}`);
+      recordError("resources/list", error);
     }
     try {
       const promptsResult = await callUpstream(upstream, "prompts/list", {}, "token-prompts", secrets, runtime);
@@ -1298,7 +1650,7 @@ async function getUpstreamTokenCounts(config, secrets, runtime) {
         promptsCount = Math.ceil(JSON.stringify(promptsResult.prompts).length / 4);
       }
     } catch (error) {
-      errors.push(`prompts/list: ${error instanceof Error ? error.message : String(error)}`);
+      recordError("prompts/list", error);
     }
     const total = toolsCount + resourcesCount + promptsCount;
     const countObj = {
@@ -1306,7 +1658,8 @@ async function getUpstreamTokenCounts(config, secrets, runtime) {
       resources: resourcesCount,
       prompts: promptsCount,
       total,
-      error: errors.length > 0 ? errors.join("; ") : undefined
+      error: errors.length > 0 ? errors.map((e) => `${e.label}: ${e.message}`).join("; ") : undefined,
+      errorCode: pickPrimaryErrorCode(errors)
     };
     if (errors.length === 0) {
       runtime.tokenCache.set(upstream.name, { fingerprint, count: countObj });
@@ -1340,7 +1693,20 @@ function specFingerprint(spec, secrets) {
     if (!obj)
       return;
     for (const [key, value] of Object.entries(obj)) {
-      if (value.startsWith("secret://") || value.startsWith("oauth://")) {
+      if (isOAuthReference(value)) {
+        try {
+          const serverName = oauthReferenceServerName(value);
+          let storedTokens = secrets.getSecret(oauthSecretNames(serverName).tokens);
+          if (!storedTokens) {
+            const legacy = `oauth_${serverName.toLowerCase().replace(/[^a-z0-9._-]/g, "_")}_tokens`;
+            storedTokens = secrets.getSecret(legacy);
+          }
+          const obtainedAt = storedTokens ? JSON.parse(storedTokens).obtainedAt : undefined;
+          resolvedMarkers[key] = obtainedAt != null ? `oauth:${serverName}:${obtainedAt}` : value;
+        } catch {
+          resolvedMarkers[key] = value;
+        }
+      } else if (value.startsWith("secret://")) {
         try {
           resolvedMarkers[key] = secrets.resolveMaybeSecret(value);
         } catch {
@@ -1355,6 +1721,9 @@ function specFingerprint(spec, secrets) {
     collect(spec.headers);
   return JSON.stringify({ spec, resolvedMarkers });
 }
+function passthroughCacheSuffix(passthroughAuthorizationHeader) {
+  return `passthrough:${crypto2.createHash("sha256").update(passthroughAuthorizationHeader).digest("hex").slice(0, 16)}`;
+}
 var EXTRA_INHERITED_ENV = ["TMPDIR", "LANG"];
 function resolveStdioEnv(spec, secrets) {
   const env = getDefaultEnvironment();
@@ -1405,8 +1774,8 @@ async function closeUpstreamConnection(entry) {
     await connection.transport.close();
   } catch {}
 }
-async function reconcileUpstreamConnections(config, runtime) {
-  const activeSpecs = new Map(Object.entries(config.servers).filter(([, spec]) => isServerEnabled(spec)).map(([name, spec]) => [name, specFingerprint(spec)]));
+async function reconcileUpstreamConnections(config, secrets, runtime) {
+  const activeSpecs = new Map(Object.entries(config.servers).filter(([, spec]) => isServerEnabled(spec)).map(([name, spec]) => [name, specFingerprint(spec, secrets)]));
   const staleKeys = [];
   for (const [key, entry] of runtime.upstreamConnections.entries()) {
     const upstreamName = key.includes(":") ? key.slice(0, key.indexOf(":")) : key;
@@ -1425,7 +1794,7 @@ async function reconcileUpstreamConnections(config, runtime) {
   }
 }
 function invalidateUpstreamConnection(upstreamName, passthroughAuthorizationHeader, runtime) {
-  const key = passthroughAuthorizationHeader ? `${upstreamName}:passthrough` : upstreamName;
+  const key = passthroughAuthorizationHeader ? `${upstreamName}:${passthroughCacheSuffix(passthroughAuthorizationHeader)}` : upstreamName;
   const existing = runtime.upstreamConnections.get(key);
   if (!existing) {
     return;
@@ -1435,8 +1804,8 @@ function invalidateUpstreamConnection(upstreamName, passthroughAuthorizationHead
 }
 async function getUpstreamConnection(upstream, secrets, runtime, options = {}) {
   const { forceOAuthRefresh = false, passthroughAuthorizationHeader } = options;
-  const cacheKey = passthroughAuthorizationHeader ? `${upstream.name}:passthrough` : upstream.name;
-  const fingerprint = specFingerprint(upstream.spec);
+  const cacheKey = passthroughAuthorizationHeader ? `${upstream.name}:${passthroughCacheSuffix(passthroughAuthorizationHeader)}` : upstream.name;
+  const fingerprint = specFingerprint(upstream.spec, secrets);
   if (!forceOAuthRefresh) {
     const existing = runtime.upstreamConnections.get(cacheKey);
     if (existing) {
@@ -1515,12 +1884,20 @@ async function callUpstreamOnce(upstream, method, params, secrets, runtime, pass
     throw classifyUpstreamError(upstream.name, error, wwwAuthenticate);
   }
 }
+function tokensMatch(candidate, expectedToken) {
+  if (!candidate) {
+    return false;
+  }
+  const candidateBuf = Buffer.from(candidate);
+  const expectedBuf = Buffer.from(expectedToken);
+  return candidateBuf.length === expectedBuf.length && crypto2.timingSafeEqual(candidateBuf, expectedBuf);
+}
 function authHeaderIsValid(request, expectedToken) {
   const localTokenHeader = request.headers["x-mcpx-local-token"];
-  if (typeof localTokenHeader === "string" && localTokenHeader === expectedToken) {
+  if (typeof localTokenHeader === "string" && tokensMatch(localTokenHeader, expectedToken)) {
     return true;
   }
-  if (Array.isArray(localTokenHeader) && localTokenHeader.includes(expectedToken)) {
+  if (Array.isArray(localTokenHeader) && localTokenHeader.some((value) => tokensMatch(value, expectedToken))) {
     return true;
   }
   const authHeader = request.headers.authorization;
@@ -1528,7 +1905,7 @@ function authHeaderIsValid(request, expectedToken) {
     return false;
   }
   const [scheme, token] = authHeader.split(" ");
-  return scheme === "Bearer" && token === expectedToken;
+  return scheme === "Bearer" && tokensMatch(token, expectedToken);
 }
 function isAuthChallenge(error) {
   return error instanceof UpstreamError && (error.code === "auth_required" || error.code === "auth_expired");
@@ -1539,7 +1916,7 @@ function getClientAuthorizationForUpstream(request, expectedToken) {
     return;
   }
   const [scheme, token] = authHeader.split(" ");
-  if (scheme === "Bearer" && token === expectedToken) {
+  if (scheme === "Bearer" && tokensMatch(token, expectedToken)) {
     return;
   }
   return authHeader;
@@ -1556,11 +1933,11 @@ async function handleListTools(config, secrets, runtime, upstreamFilter, clientA
         runtime.tokenCache = new Map;
       }
       const cached = runtime.tokenCache.get(upstream.name);
-      const existing = cached?.fingerprint === specFingerprint(upstream.spec) ? cached.count : { tools: 0, resources: 0, prompts: 0, total: 0 };
+      const existing = cached?.fingerprint === specFingerprint(upstream.spec, secrets) ? cached.count : { tools: 0, resources: 0, prompts: 0, total: 0 };
       existing.tools = Math.ceil(JSON.stringify(result.tools ?? []).length / 4);
       existing.total = existing.tools + existing.resources + existing.prompts;
       delete existing.error;
-      runtime.tokenCache.set(upstream.name, { fingerprint: specFingerprint(upstream.spec), count: existing });
+      runtime.tokenCache.set(upstream.name, { fingerprint: specFingerprint(upstream.spec, secrets), count: existing });
       for (const tool of result.tools ?? []) {
         const name = typeof tool.name === "string" ? tool.name : "tool";
         tools.push({
@@ -1594,11 +1971,11 @@ async function handleListResources(config, secrets, runtime, upstreamFilter, cli
         runtime.tokenCache = new Map;
       }
       const cached = runtime.tokenCache.get(upstream.name);
-      const existing = cached?.fingerprint === specFingerprint(upstream.spec) ? cached.count : { tools: 0, resources: 0, prompts: 0, total: 0 };
+      const existing = cached?.fingerprint === specFingerprint(upstream.spec, secrets) ? cached.count : { tools: 0, resources: 0, prompts: 0, total: 0 };
       existing.resources = Math.ceil(JSON.stringify(result.resources ?? []).length / 4);
       existing.total = existing.tools + existing.resources + existing.prompts;
       delete existing.error;
-      runtime.tokenCache.set(upstream.name, { fingerprint: specFingerprint(upstream.spec), count: existing });
+      runtime.tokenCache.set(upstream.name, { fingerprint: specFingerprint(upstream.spec, secrets), count: existing });
       for (const resource of result.resources ?? []) {
         const originalUri = typeof resource.uri === "string" ? resource.uri : "";
         const originalName = typeof resource.name === "string" ? resource.name : originalUri;
@@ -1634,11 +2011,11 @@ async function handleListPrompts(config, secrets, runtime, upstreamFilter, clien
         runtime.tokenCache = new Map;
       }
       const cached = runtime.tokenCache.get(upstream.name);
-      const existing = cached?.fingerprint === specFingerprint(upstream.spec) ? cached.count : { tools: 0, resources: 0, prompts: 0, total: 0 };
+      const existing = cached?.fingerprint === specFingerprint(upstream.spec, secrets) ? cached.count : { tools: 0, resources: 0, prompts: 0, total: 0 };
       existing.prompts = Math.ceil(JSON.stringify(result.prompts ?? []).length / 4);
       existing.total = existing.tools + existing.resources + existing.prompts;
       delete existing.error;
-      runtime.tokenCache.set(upstream.name, { fingerprint: specFingerprint(upstream.spec), count: existing });
+      runtime.tokenCache.set(upstream.name, { fingerprint: specFingerprint(upstream.spec, secrets), count: existing });
       for (const prompt of result.prompts ?? []) {
         const name = typeof prompt.name === "string" ? prompt.name : "prompt";
         prompts.push({
@@ -1799,7 +2176,7 @@ async function handleRequestObject(request, secrets, runtime, upstreamFilter, cl
   if (upstreamFilter && listUpstreams(config, upstreamFilter).length === 0) {
     return makeError(id, -32602, `Unknown upstream: ${upstreamFilter}`);
   }
-  await reconcileUpstreamConnections(config, runtime);
+  await reconcileUpstreamConnections(config, secrets, runtime);
   if (request.method === "custom/tokenCounts") {
     const result = await getUpstreamTokenCounts(config, secrets, runtime);
     return makeResult(id, result);
@@ -1862,12 +2239,36 @@ async function maybeHandleWellKnownOAuthRequest(request, response, requestUrl, s
     headers["mcp-protocol-version"] = protocolVersion;
   }
   for (const [key, value] of Object.entries(upstream.spec.headers ?? {})) {
-    headers[key] = secrets.resolveMaybeSecret(value);
+    if (key.toLowerCase() === "authorization" && isOAuthReference(value)) {
+      try {
+        const accessToken = await getOAuthAccessToken(oauthReferenceServerName(value), upstream.spec, secrets);
+        headers[key] = `Bearer ${accessToken}`;
+      } catch {}
+    } else {
+      headers[key] = secrets.resolveMaybeSecret(value);
+    }
+  }
+  const timeoutController = new AbortController;
+  const timeoutHandle = setTimeout(() => timeoutController.abort(), DEFAULT_CONNECT_TIMEOUT_MS);
+  let upstreamResponse;
+  try {
+    upstreamResponse = await fetch(upstreamWellKnownUrl, {
+      method: "GET",
+      headers,
+      signal: timeoutController.signal
+    });
+  } catch (error) {
+    const isAbort = error.name === "AbortError";
+    response.statusCode = 502;
+    response.setHeader("content-type", "application/json");
+    response.end(JSON.stringify({
+      error: "upstream_unreachable",
+      message: isAbort ? `Well-known request timed out after ${DEFAULT_CONNECT_TIMEOUT_MS}ms.` : error instanceof Error ? error.message : String(error)
+    }));
+    return true;
+  } finally {
+    clearTimeout(timeoutHandle);
   }
-  const upstreamResponse = await fetch(upstreamWellKnownUrl, {
-    method: "GET",
-    headers
-  });
   let bodyText = await upstreamResponse.text();
   response.statusCode = upstreamResponse.status;
   const contentType = upstreamResponse.headers.get("content-type");
@@ -1892,6 +2293,16 @@ async function maybeHandleWellKnownOAuthRequest(request, response, requestUrl, s
   response.end(bodyText);
   return true;
 }
+var SENSITIVE_HEADER_NAMES = new Set(["authorization", "x-mcpx-local-token"]);
+function redactSensitiveHeaders(headers) {
+  const redacted = { ...headers };
+  for (const name of Object.keys(redacted)) {
+    if (SENSITIVE_HEADER_NAMES.has(name.toLowerCase())) {
+      redacted[name] = "[redacted]";
+    }
+  }
+  return redacted;
+}
 function createGatewayServer(options) {
   const debug = process.env.MCPX_GATEWAY_DEBUG === "1";
   const runtime = {
@@ -1905,7 +2316,7 @@ function createGatewayServer(options) {
       const upstreamFilter = getRequestedUpstream(requestUrl);
       if (debug) {
         console.error(`[mcpx gateway] ${request.method ?? "?"} ${requestUrl.pathname} auth=${request.headers.authorization ? "yes" : "no"} accept=${request.headers.accept ?? ""}`);
-        console.error(`[mcpx gateway] headers=${JSON.stringify(request.headers)}`);
+        console.error(`[mcpx gateway] headers=${JSON.stringify(redactSensitiveHeaders(request.headers))}`);
       }
       if (await maybeHandleWellKnownOAuthRequest(request, response, requestUrl, options.secrets)) {
         if (debug) {
@@ -2089,10 +2500,10 @@ function buildDaemonChildEnv(baseEnv = process.env, electronRuntime = typeof pro
   };
 }
 function readPidRecordFromFile(pidPath = getPidPath()) {
-  if (!fs5.existsSync(pidPath)) {
+  if (!fs6.existsSync(pidPath)) {
     return null;
   }
-  const raw = fs5.readFileSync(pidPath, "utf8").trim();
+  const raw = fs6.readFileSync(pidPath, "utf8").trim();
   if (!raw) {
     return null;
   }
@@ -2152,7 +2563,7 @@ async function resolveGatewayPort(config, secrets) {
   }
   throw new Error(`No available local port found near ${config.gateway.port}.`);
 }
-async function waitForGatewayReady(port, token, timeoutMs = 5000) {
+async function waitForGatewayReady(port, token, timeoutMs = 15000) {
   const deadline = Date.now() + timeoutMs;
   let lastError;
   while (Date.now() < deadline) {
@@ -2200,18 +2611,12 @@ function getDaemonStatus(config) {
 async function startDaemon(config, cliPath, secrets) {
   const existingStatus = getDaemonStatus(config);
   if (existingStatus.running && existingStatus.pid) {
-    const portAvailable = await isPortAvailable(config.gateway.port);
-    if (!portAvailable) {
-      return {
-        started: false,
-        pid: existingStatus.pid,
-        port: config.gateway.port,
-        message: "mcpx daemon already running."
-      };
-    }
-    try {
-      fs5.unlinkSync(getPidPath());
-    } catch {}
+    return {
+      started: false,
+      pid: existingStatus.pid,
+      port: existingStatus.port ?? config.gateway.port,
+      message: "mcpx daemon already running."
+    };
   }
   const { port, fellBackFrom } = await resolveGatewayPort(config, secrets);
   if (fellBackFrom) {
@@ -2223,24 +2628,24 @@ async function startDaemon(config, cliPath, secrets) {
   const logPath = getLogPath();
   ensureParentDir(pidPath);
   ensureParentDir(logPath);
-  let logFd = fs5.openSync(logPath, "a", 384);
-  const logStat = fs5.fstatSync(logFd);
+  let logFd = fs6.openSync(logPath, "a", 384);
+  const logStat = fs6.fstatSync(logFd);
   if (logStat.size > 10 * 1024 * 1024) {
-    fs5.closeSync(logFd);
+    fs6.closeSync(logFd);
     const log1 = `${logPath}.1`;
     const log2 = `${logPath}.2`;
     try {
-      if (fs5.existsSync(log2))
-        fs5.unlinkSync(log2);
+      if (fs6.existsSync(log2))
+        fs6.unlinkSync(log2);
     } catch {}
     try {
-      if (fs5.existsSync(log1))
-        fs5.renameSync(log1, log2);
+      if (fs6.existsSync(log1))
+        fs6.renameSync(log1, log2);
     } catch {}
     try {
-      fs5.renameSync(logPath, log1);
+      fs6.renameSync(logPath, log1);
     } catch {}
-    logFd = fs5.openSync(logPath, "a", 384);
+    logFd = fs6.openSync(logPath, "a", 384);
   }
   const child = spawn2(process.execPath, [cliPath, "daemon", "run", "--port", String(port)], {
     detached: true,
@@ -2248,7 +2653,7 @@ async function startDaemon(config, cliPath, secrets) {
     env: buildDaemonChildEnv()
   });
   child.unref();
-  fs5.writeFileSync(pidPath, `${child.pid}:${port}
+  fs6.writeFileSync(pidPath, `${child.pid}:${port}
 `, { mode: 384 });
   startBackgroundUpdateCheck();
   await waitForGatewayReady(port, token);
@@ -2272,7 +2677,7 @@ function stopDaemon() {
     const cmd = execFileSync2("ps", ["-p", String(pid), "-o", "command="], { encoding: "utf8", timeout: 2000 }).trim();
     const looksLikeMcpxDaemon = cmd.includes("daemon run") && (cmd.includes("mcpx") || cmd.includes("cli.js"));
     if (!looksLikeMcpxDaemon) {
-      fs5.unlinkSync(pidPath);
+      fs6.unlinkSync(pidPath);
       return {
         stopped: false,
         message: `PID ${pid} is not a mcpx daemon (command: ${cmd.slice(0, 80)}). Pidfile cleaned up.`
@@ -2280,7 +2685,7 @@ function stopDaemon() {
     }
   } catch {
     try {
-      fs5.unlinkSync(pidPath);
+      fs6.unlinkSync(pidPath);
     } catch {}
     return {
       stopped: false,
@@ -2291,7 +2696,7 @@ function stopDaemon() {
     process.kill(pid, "SIGTERM");
   } catch {}
   try {
-    fs5.unlinkSync(pidPath);
+    fs6.unlinkSync(pidPath);
   } catch {}
   return {
     stopped: true,
@@ -2304,10 +2709,10 @@ async function restartDaemon(config, cliPath, secrets) {
 }
 function readDaemonLogs(maxLines = 200) {
   const logPath = getLogPath();
-  if (!fs5.existsSync(logPath)) {
+  if (!fs6.existsSync(logPath)) {
     return "";
   }
-  const lines = fs5.readFileSync(logPath, "utf8").split(`
+  const lines = fs6.readFileSync(logPath, "utf8").split(`
 `);
   return lines.slice(Math.max(lines.length - maxLines, 0)).join(`
 `);
@@ -2452,4 +2857,4 @@ async function buildStatusReport(config, managedIndex, daemon = getDaemonStatus(
   };
 }
 
-export { probeHttpAuthRequirement, fetchRegistryServerDetail, selectBestPackage, extractRequiredInputs, mapRegistryToSpec, toSecretRef, secretRefName, defaultAuthSecretName, resolveAuthTarget, applyAuthReference, removeAuthReference, listAuthBindings, maybePrefixBearer, buildEnrichedPath, isOAuthReference, oauthReferenceServerName, runOAuthLogin, getOAuthAccessToken, compareVersions, checkForUpdates, getStagedUpdate, shouldUseStagedCli, clearStagedUpdate, getStagedCliPath, startBackgroundUpdateCheck, runBackgroundUpdate, performUpdate, performRollback, runMarketplaceAutoUpdate, startMarketplaceAutoUpdater, getDaemonStatus, startDaemon, stopDaemon, restartDaemon, readDaemonLogs, runDaemonForeground, STATUS_CLIENTS, buildStatusReport };
+export { isOAuthReference, oauthReferenceServerName, __resetOAuthSupportCache, probeOAuthSupport, OAUTH_LOGIN_TIMEOUT_MS, OAuthCancelledError, OAuthLoginInProgressError, runOAuthLogin, getOAuthAccessToken, oauthSecretNames, clearOAuthCredentials, getOAuthCredentialStatus, probeHttpAuthRequirement, fetchRegistryServerDetail, selectBestPackage, extractRequiredInputs, mapRegistryToSpec, toSecretRef, secretRefName, defaultAuthSecretName, resolveAuthTarget, applyAuthReference, removeAuthReference, listAuthBindings, maybePrefixBearer, buildEnrichedPath, compareVersions, checkForUpdates, getStagedUpdate, shouldUseStagedCli, clearStagedUpdate, getStagedCliPath, startBackgroundUpdateCheck, runBackgroundUpdate, performUpdate, performRollback, runMarketplaceAutoUpdate, startMarketplaceAutoUpdater, getDaemonStatus, startDaemon, stopDaemon, restartDaemon, readDaemonLogs, runDaemonForeground, STATUS_CLIENTS, buildStatusReport };