@kwonye/mcpx 0.1.102 → 0.1.103

package/dist/cli-qzzjkt0q.js

@@ -1,2860 +0,0 @@
-import {
-  refreshAutoUpdateMarketplaces
-} from "./cli-aawpvhhe.js";
-import {
-  APP_VERSION,
-  getGatewayUrl,
-  mutateConfig,
-  persistSyncState,
-  syncAllClients
-} from "./cli-9k3wmag6.js";
-import {
-  loadConfig,
-  loadMergedConfig,
-  saveConfig
-} from "./cli-6zq2fd6h.js";
-import {
-  SecretsManager,
-  UpstreamError,
-  classifyUpstreamError,
-  ensureGatewayToken
-} from "./cli-hh7rthhx.js";
-import {
-  ensureDir,
-  ensureParentDir,
-  getLogPath,
-  getMarketplaceUpdateLockPath,
-  getMarketplaceUpdateStatePath,
-  getOAuthLockPath,
-  getPidPath,
-  getStagedVersionPath,
-  getUpdateLockPath,
-  getUpdatesDir
-} from "./cli-6wh8qx2y.js";
-import {
-  isServerEnabled
-} from "./cli-s4gspqdf.js";
-
-// src/core/oauth.ts
-import fs from "node:fs";
-import path from "node:path";
-import http from "node:http";
-import crypto from "node:crypto";
-import {
-  auth,
-  discoverOAuthServerInfo,
-  discoverOAuthProtectedResourceMetadata,
-  discoverAuthorizationServerMetadata,
-  refreshAuthorization
-} from "@modelcontextprotocol/sdk/client/auth.js";
-import { InvalidClientError, InvalidGrantError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
-function oauthSecretName(serverName, suffix) {
-  const safe = serverName.toLowerCase().replace(/[^a-z0-9._-]/g, "_").slice(0, 32);
-  const hash = crypto.createHash("sha256").update(serverName).digest("hex").slice(0, 12);
-  return `oauth_${safe}_${hash}_${suffix}`;
-}
-function legacyOAuthSecretName(serverName, suffix) {
-  return `oauth_${serverName.toLowerCase().replace(/[^a-z0-9._-]/g, "_")}_${suffix}`;
-}
-function readJsonSecret(secrets, name) {
-  let raw = secrets.getSecret(name);
-  if (!raw) {
-    const match = name.match(/^oauth_(.+)_([0-9a-f]{12})_(client|tokens|verifier|discovery)$/);
-    if (match) {
-      const suffix = match[3];
-      const withoutHash = name.replace(/_[0-9a-f]{12}_/, "_");
-      raw = secrets.getSecret(withoutHash);
-      if (!raw) {}
-    }
-  }
-  if (!raw) {
-    return;
-  }
-  try {
-    return JSON.parse(raw);
-  } catch {
-    return;
-  }
-}
-function getOAuthSecretWithFallback(secrets, serverName, suffix) {
-  const name = oauthSecretName(serverName, suffix);
-  let raw = secrets.getSecret(name);
-  if (raw)
-    return raw;
-  return secrets.getSecret(legacyOAuthSecretName(serverName, suffix));
-}
-function writeJsonSecret(secrets, name, value) {
-  secrets.setSecret(name, JSON.stringify(value));
-  const match = name.match(/^oauth_(.+)_([0-9a-f]{12})_(client|tokens|verifier|discovery)$/);
-  if (match) {
-    const withoutHash = name.replace(/_[0-9a-f]{12}_/, "_");
-    secrets.setSecret(withoutHash, JSON.stringify(value));
-  }
-}
-function isOAuthReference(value) {
-  return value.startsWith("oauth://");
-}
-function oauthReferenceServerName(value) {
-  if (!isOAuthReference(value)) {
-    throw new Error(`Not an OAuth reference: ${value}`);
-  }
-  return decodeURIComponent(value.slice("oauth://".length));
-}
-var DEFAULT_OAUTH_SUPPORT_TIMEOUT_MS = 5000;
-var OAUTH_SUPPORT_SUPPORTED_TTL_MS = 5 * 60000;
-var OAUTH_SUPPORT_NEGATIVE_TTL_MS = 60000;
-var oauthSupportCache = new Map;
-function __resetOAuthSupportCache() {
-  oauthSupportCache.clear();
-}
-async function probeOAuthSupport(serverUrl, options = {}) {
-  const cached = oauthSupportCache.get(serverUrl);
-  if (!options.force && cached) {
-    const ttl = cached.probe.support === "supported" ? OAUTH_SUPPORT_SUPPORTED_TTL_MS : OAUTH_SUPPORT_NEGATIVE_TTL_MS;
-    if (Date.now() - cached.at < ttl) {
-      return cached.probe;
-    }
-  }
-  const timeoutMs = options.timeoutMs ?? DEFAULT_OAUTH_SUPPORT_TIMEOUT_MS;
-  let sawResponse = false;
-  const timeoutFetch = async (input, init) => {
-    const controller = new AbortController;
-    const timeout = setTimeout(() => controller.abort(), timeoutMs);
-    try {
-      const response = await fetch(input, { ...init, signal: controller.signal });
-      sawResponse = true;
-      return response;
-    } finally {
-      clearTimeout(timeout);
-    }
-  };
-  let resourceMetadataFound = false;
-  let authorizationServerUrl;
-  try {
-    const resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, {}, timeoutFetch);
-    resourceMetadataFound = true;
-    authorizationServerUrl = resourceMetadata.authorization_servers?.[0];
-  } catch {}
-  let authServerMetadataFound = false;
-  if (!resourceMetadataFound) {
-    try {
-      const fallbackAuthServerUrl = new URL("/", serverUrl);
-      const metadata = await discoverAuthorizationServerMetadata(fallbackAuthServerUrl, { fetchFn: timeoutFetch });
-      authServerMetadataFound = metadata != null;
-      if (authServerMetadataFound) {
-        authorizationServerUrl = fallbackAuthServerUrl.toString();
-      }
-    } catch {}
-  }
-  let probe;
-  if (resourceMetadataFound || authServerMetadataFound) {
-    probe = {
-      support: "supported",
-      authorizationServerUrl,
-      resourceMetadata: resourceMetadataFound,
-      authorizationServerMetadata: authServerMetadataFound
-    };
-  } else if (sawResponse) {
-    probe = { support: "unsupported", resourceMetadata: false, authorizationServerMetadata: false };
-  } else {
-    probe = {
-      support: "unknown",
-      resourceMetadata: false,
-      authorizationServerMetadata: false,
-      error: "Could not reach the server to check for OAuth support."
-    };
-  }
-  oauthSupportCache.set(serverUrl, { at: Date.now(), probe });
-  return probe;
-}
-function tokensAreExpiring(tokens) {
-  if (!tokens.tokens.expires_in) {
-    return false;
-  }
-  const expiresAt = tokens.obtainedAt + tokens.tokens.expires_in * 1000;
-  return Date.now() >= expiresAt - 60000;
-}
-
-class McpxOAuthProvider {
-  #serverName;
-  #secrets;
-  #redirectUrlValue;
-  #stateValue;
-  constructor(serverName, secrets, redirectUrl, state = crypto.randomUUID()) {
-    this.#serverName = serverName;
-    this.#secrets = secrets;
-    this.#redirectUrlValue = redirectUrl;
-    this.#stateValue = state;
-  }
-  get redirectUrl() {
-    return this.#redirectUrlValue;
-  }
-  get clientMetadata() {
-    if (!this.#redirectUrlValue) {
-      return {
-        redirect_uris: [],
-        token_endpoint_auth_method: "none",
-        grant_types: ["authorization_code", "refresh_token"],
-        response_types: ["code"],
-        client_name: "mcpx"
-      };
-    }
-    return {
-      redirect_uris: [this.#redirectUrlValue],
-      token_endpoint_auth_method: "none",
-      grant_types: ["authorization_code", "refresh_token"],
-      response_types: ["code"],
-      client_name: "mcpx"
-    };
-  }
-  state() {
-    return this.#stateValue;
-  }
-  clientInformation() {
-    return readJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "client"));
-  }
-  saveClientInformation(clientInformation) {
-    writeJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "client"), clientInformation);
-  }
-  tokens() {
-    return readJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "tokens"))?.tokens;
-  }
-  saveTokens(tokens) {
-    writeJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "tokens"), {
-      tokens,
-      obtainedAt: Date.now()
-    });
-  }
-  redirectToAuthorization(_authorizationUrl) {}
-  saveCodeVerifier(codeVerifier) {
-    this.#secrets.setSecret(oauthSecretName(this.#serverName, "verifier"), codeVerifier);
-  }
-  codeVerifier() {
-    const verifier = getOAuthSecretWithFallback(this.#secrets, this.#serverName, "verifier");
-    if (!verifier) {
-      throw new Error(`Missing OAuth code verifier for "${this.#serverName}".`);
-    }
-    return verifier;
-  }
-  saveDiscoveryState(state) {
-    writeJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "discovery"), state);
-  }
-  discoveryState() {
-    return readJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "discovery"));
-  }
-  invalidateCredentials(scope) {
-    const suffixes = scope === "all" ? ["client", "tokens", "verifier", "discovery"] : [scope];
-    for (const suffix of suffixes) {
-      this.#secrets.removeSecret(oauthSecretName(this.#serverName, suffix));
-      this.#secrets.removeSecret(legacyOAuthSecretName(this.#serverName, suffix));
-    }
-  }
-}
-
-class InteractiveOAuthProvider extends McpxOAuthProvider {
-  #openUrl;
-  #cachedClientInfo;
-  #cachedCodeVerifier;
-  constructor(serverName, secrets, redirectUrl, state, openUrl) {
-    super(serverName, secrets, redirectUrl, state);
-    this.#openUrl = openUrl;
-  }
-  async redirectToAuthorization(authorizationUrl) {
-    await this.#openUrl(authorizationUrl.toString());
-  }
-  clientInformation() {
-    this.#cachedClientInfo ??= super.clientInformation();
-    return this.#cachedClientInfo;
-  }
-  saveClientInformation(clientInformation) {
-    super.saveClientInformation(clientInformation);
-    this.#cachedClientInfo = clientInformation;
-  }
-  codeVerifier() {
-    if (this.#cachedCodeVerifier !== undefined) {
-      return this.#cachedCodeVerifier;
-    }
-    return super.codeVerifier();
-  }
-  saveCodeVerifier(codeVerifier) {
-    super.saveCodeVerifier(codeVerifier);
-    this.#cachedCodeVerifier = codeVerifier;
-  }
-  invalidateCredentials(scope) {
-    super.invalidateCredentials(scope);
-    if (scope === "all" || scope === "client") {
-      this.#cachedClientInfo = undefined;
-    }
-  }
-}
-function listen(server) {
-  return new Promise((resolve, reject) => {
-    server.once("error", reject);
-    server.listen(0, "127.0.0.1", () => {
-      const address = server.address();
-      if (!address || typeof address === "string") {
-        reject(new Error("Failed to start OAuth callback server."));
-        return;
-      }
-      resolve(address.port);
-    });
-  });
-}
-function closeServer(server) {
-  return new Promise((resolve) => {
-    server.close(() => resolve());
-  });
-}
-var OAUTH_LOGIN_TIMEOUT_MS = 120000;
-function renderCallbackPage(kind, detail) {
-  const title = kind === "success" ? "Signed in" : "Sign-in failed";
-  const message = kind === "success" ? "You're signed in. You can close this window and return to mcpx." : detail ?? "Something went wrong. You can close this window and try again in mcpx.";
-  const icon = kind === "success" ? "&#10003;" : "&#10007;";
-  const closeScript = kind === "success" ? "<script>setTimeout(() => window.close(), 1500);</script>" : "";
-  return `<!doctype html>
-<html>
-<head>
-<meta charset="utf-8">
-<title>${title} — mcpx</title>
-<style>
-  :root { color-scheme: light dark; }
-  body {
-    margin: 0; min-height: 100vh; display: flex; align-items: center; justify-content: center;
-    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
-    background: #f5f5f7; color: #1d1d1f;
-  }
-  @media (prefers-color-scheme: dark) {
-    body { background: #1c1c1e; color: #f5f5f7; }
-    .card { background: #2c2c2e !important; box-shadow: none !important; }
-  }
-  .card {
-    background: #fff; border-radius: 16px; padding: 40px 48px; text-align: center;
-    box-shadow: 0 8px 30px rgba(0,0,0,0.12); max-width: 360px;
-  }
-  .icon {
-    width: 48px; height: 48px; border-radius: 50%; margin: 0 auto 16px;
-    display: flex; align-items: center; justify-content: center; font-size: 22px;
-    background: ${kind === "success" ? "#34c759" : "#ff3b30"}; color: #fff;
-  }
-  h1 { font-size: 17px; margin: 0 0 8px; }
-  p { font-size: 14px; margin: 0; opacity: 0.7; }
-</style>
-</head>
-<body>
-  <div class="card">
-    <div class="icon">${icon}</div>
-    <h1>${title}</h1>
-    <p>${message}</p>
-  </div>
-  ${closeScript}
-</body>
-</html>`;
-}
-
-class OAuthCancelledError extends Error {
-  code = "oauth_cancelled";
-  constructor(serverName) {
-    super(`OAuth login for "${serverName}" was cancelled.`);
-    this.name = "OAuthCancelledError";
-  }
-}
-
-class OAuthLoginInProgressError extends Error {
-  code = "oauth_in_progress";
-  constructor(serverName, holderPid) {
-    super(holderPid ? `OAuth login for "${serverName}" is already in progress (pid ${holderPid}).` : `OAuth login for "${serverName}" is already in progress.`);
-    this.name = "OAuthLoginInProgressError";
-  }
-}
-function waitForAuthorizationCode(server, serverName, expectedState, options = {}) {
-  const timeoutMs = options.timeoutMs ?? OAUTH_LOGIN_TIMEOUT_MS;
-  const { signal } = options;
-  return new Promise((resolve, reject) => {
-    let settled = false;
-    function settle(fn) {
-      if (settled) {
-        return;
-      }
-      settled = true;
-      clearTimeout(timeout);
-      signal?.removeEventListener("abort", onAbort);
-      fn();
-    }
-    function onAbort() {
-      settle(() => reject(new OAuthCancelledError(serverName)));
-    }
-    const timeout = setTimeout(() => {
-      settle(() => reject(new Error(`OAuth login timed out after ${timeoutMs}ms.`)));
-    }, timeoutMs);
-    if (signal) {
-      if (signal.aborted) {
-        settle(() => reject(new OAuthCancelledError(serverName)));
-        return;
-      }
-      signal.addEventListener("abort", onAbort);
-    }
-    server.on("request", (request, response) => {
-      const url = new URL(request.url ?? "/", "http://127.0.0.1");
-      if (settled) {
-        response.statusCode = 404;
-        response.end();
-        return;
-      }
-      if (url.pathname === "/favicon.ico") {
-        response.statusCode = 204;
-        response.end();
-        return;
-      }
-      if (url.pathname !== "/callback") {
-        response.statusCode = 404;
-        response.end();
-        return;
-      }
-      const code = url.searchParams.get("code");
-      const state = url.searchParams.get("state");
-      const error = url.searchParams.get("error");
-      response.setHeader("content-type", "text/html; charset=utf-8");
-      if (error) {
-        response.statusCode = 400;
-        response.end(renderCallbackPage("error", `Authorization failed: ${error}`));
-        settle(() => reject(new Error(`OAuth authorization failed: ${error}`)));
-        return;
-      }
-      if (!code) {
-        response.statusCode = 400;
-        response.end(renderCallbackPage("error", "Missing authorization code."));
-        return;
-      }
-      if (state !== expectedState) {
-        response.statusCode = 400;
-        response.end(renderCallbackPage("error", "This sign-in link is no longer valid."));
-        settle(() => reject(new Error("OAuth state mismatch.")));
-        return;
-      }
-      response.end(renderCallbackPage("success"));
-      settle(() => resolve(code));
-    });
-  });
-}
-function bindOAuthReference(config, serverName) {
-  const spec = config.servers[serverName];
-  if (!spec) {
-    throw new Error(`Server "${serverName}" not found.`);
-  }
-  if (spec.transport !== "http") {
-    throw new Error(`OAuth login only supports HTTP servers.`);
-  }
-  spec.headers = {
-    ...spec.headers ?? {},
-    Authorization: `oauth://${encodeURIComponent(serverName)}`
-  };
-}
-var OAUTH_LOCK_STALE_MS = 5 * 60000;
-function isProcessAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function releaseOAuthLoginLock(lockPath) {
-  try {
-    fs.unlinkSync(lockPath);
-  } catch {}
-}
-function acquireOAuthLoginLock(serverName) {
-  const lockPath = getOAuthLockPath(serverName);
-  ensureDir(path.dirname(lockPath));
-  const tryCreate = () => {
-    try {
-      fs.writeFileSync(lockPath, `${process.pid}
-`, { flag: "wx" });
-      return true;
-    } catch (err) {
-      if (err.code !== "EEXIST") {
-        throw err;
-      }
-      return false;
-    }
-  };
-  if (tryCreate()) {
-    return () => releaseOAuthLoginLock(lockPath);
-  }
-  let holderPid;
-  try {
-    const raw = fs.readFileSync(lockPath, "utf8").trim();
-    const pid = Number(raw);
-    const stat = fs.statSync(lockPath);
-    const stale = Date.now() - stat.mtimeMs > OAUTH_LOCK_STALE_MS;
-    const holderAlive = Number.isFinite(pid) && pid > 0 && isProcessAlive(pid);
-    if (!holderAlive || stale) {
-      fs.unlinkSync(lockPath);
-      if (tryCreate()) {
-        return () => releaseOAuthLoginLock(lockPath);
-      }
-    }
-    holderPid = holderAlive ? pid : undefined;
-  } catch {
-    if (tryCreate()) {
-      return () => releaseOAuthLoginLock(lockPath);
-    }
-  }
-  throw new OAuthLoginInProgressError(serverName, holderPid);
-}
-async function runOAuthLogin(serverName, spec, secrets, openUrl, configPath, codeReceiver, options = {}) {
-  const { signal, onProgress } = options;
-  const timeoutMs = options.timeoutMs ?? OAUTH_LOGIN_TIMEOUT_MS;
-  if (signal?.aborted) {
-    throw new OAuthCancelledError(serverName);
-  }
-  const releaseLock = acquireOAuthLoginLock(serverName);
-  try {
-    const oauthName = oauthSecretName(serverName, "tokens");
-    const clientName = oauthSecretName(serverName, "client");
-    const backupTokens = secrets.getSecret(oauthName);
-    const backupClient = secrets.getSecret(clientName);
-    new McpxOAuthProvider(serverName, secrets).invalidateCredentials("verifier");
-    new McpxOAuthProvider(serverName, secrets).invalidateCredentials("discovery");
-    const state = crypto.randomUUID();
-    let callbackServer;
-    let redirectUrl;
-    let codePromise;
-    if (codeReceiver) {
-      redirectUrl = codeReceiver.redirectUrl;
-      codePromise = codeReceiver.waitForCode(state, timeoutMs);
-    } else {
-      callbackServer = http.createServer();
-      const port = await listen(callbackServer);
-      redirectUrl = `http://127.0.0.1:${port}/callback`;
-      codePromise = waitForAuthorizationCode(callbackServer, serverName, state, { timeoutMs, signal });
-    }
-    codePromise.catch(() => {});
-    const wrappedOpenUrl = async (url) => {
-      onProgress?.({ phase: "awaiting-browser", authorizationUrl: url, expiresAt: Date.now() + timeoutMs });
-      await openUrl(url);
-    };
-    const provider = new InteractiveOAuthProvider(serverName, secrets, redirectUrl, state, wrappedOpenUrl);
-    try {
-      onProgress?.({ phase: "discovering" });
-      const initial = await auth(provider, {
-        serverUrl: spec.url
-      });
-      if (initial !== "REDIRECT") {
-        throw new Error(`Expected OAuth redirect for "${serverName}", got ${initial}.`);
-      }
-      if (signal?.aborted) {
-        throw new OAuthCancelledError(serverName);
-      }
-      const authorizationCode = await codePromise;
-      onProgress?.({ phase: "exchanging" });
-      const result = await auth(provider, {
-        serverUrl: spec.url,
-        authorizationCode
-      });
-      if (result !== "AUTHORIZED") {
-        throw new Error(`OAuth login did not authorize "${serverName}".`);
-      }
-      onProgress?.({ phase: "syncing" });
-      await mutateConfig((config2) => {
-        bindOAuthReference(config2, serverName);
-      }, configPath);
-      const config = loadConfig(configPath);
-      const summary = syncAllClients(config, secrets);
-      await mutateConfig((freshConfig) => {
-        persistSyncState(summary, freshConfig);
-      }, configPath);
-      new McpxOAuthProvider(serverName, secrets).invalidateCredentials("verifier");
-      return { serverName, authorized: true };
-    } catch (error) {
-      if (backupTokens)
-        secrets.setSecret(oauthName, backupTokens);
-      if (backupClient)
-        secrets.setSecret(clientName, backupClient);
-      new McpxOAuthProvider(serverName, secrets).invalidateCredentials("verifier");
-      throw error;
-    } finally {
-      if (callbackServer) {
-        await closeServer(callbackServer);
-      }
-    }
-  } finally {
-    releaseLock();
-  }
-}
-async function getOAuthAccessToken(serverName, spec, secrets, options = {}) {
-  const stored = readJsonSecret(secrets, oauthSecretName(serverName, "tokens"));
-  if (!stored) {
-    throw new UpstreamError(serverName, "auth_required", `No OAuth tokens stored for "${serverName}".`);
-  }
-  if (options.forceRefresh || tokensAreExpiring(stored)) {
-    if (!stored.tokens.refresh_token) {
-      if (!options.forceRefresh) {
-        return stored.tokens.access_token;
-      }
-      throw new UpstreamError(serverName, "auth_expired", `No refresh token for "${serverName}". Re-authentication required.`);
-    }
-    const provider = new McpxOAuthProvider(serverName, secrets);
-    const clientInformation = provider.clientInformation();
-    if (!clientInformation) {
-      throw new UpstreamError(serverName, "auth_expired", `No OAuth client info for "${serverName}". Re-authentication required.`);
-    }
-    let serverInfo;
-    try {
-      const cachedDiscovery = provider.discoveryState();
-      serverInfo = cachedDiscovery ?? await discoverOAuthServerInfo(spec.url);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      if (/ECONNREFUSED|ENOTFOUND|EAI_AGAIN|fetch failed/i.test(message)) {
-        throw new UpstreamError(serverName, "unreachable", `OAuth discovery failed: ${message}`);
-      }
-      throw new UpstreamError(serverName, "upstream_error", `OAuth discovery failed: ${message}`);
-    }
-    try {
-      const refreshed = await refreshAuthorization(serverInfo.authorizationServerUrl, {
-        metadata: serverInfo.authorizationServerMetadata,
-        clientInformation,
-        refreshToken: stored.tokens.refresh_token,
-        resource: serverInfo.resourceMetadata?.resource ? new URL(serverInfo.resourceMetadata.resource) : undefined
-      });
-      provider.saveTokens(refreshed);
-      return refreshed.access_token;
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      if (err instanceof InvalidGrantError || err instanceof InvalidClientError || /invalid_grant|invalid_client|4\d{2}/i.test(message)) {
-        throw new UpstreamError(serverName, "auth_expired", `OAuth refresh failed: ${message}`);
-      }
-      if (/ECONNREFUSED|ENOTFOUND|EAI_AGAIN|fetch failed/i.test(message)) {
-        throw new UpstreamError(serverName, "unreachable", `OAuth refresh failed: ${message}`);
-      }
-      throw new UpstreamError(serverName, "upstream_error", `OAuth refresh failed: ${message}`);
-    }
-  }
-  return stored.tokens.access_token;
-}
-function oauthSecretNames(serverName) {
-  return {
-    client: oauthSecretName(serverName, "client"),
-    tokens: oauthSecretName(serverName, "tokens"),
-    verifier: oauthSecretName(serverName, "verifier"),
-    discovery: oauthSecretName(serverName, "discovery")
-  };
-}
-function clearOAuthCredentials(serverName, secrets) {
-  const removed = [];
-  const candidates = [
-    ...Object.values(oauthSecretNames(serverName)),
-    ...Object.values({
-      client: legacyOAuthSecretName(serverName, "client"),
-      tokens: legacyOAuthSecretName(serverName, "tokens"),
-      verifier: legacyOAuthSecretName(serverName, "verifier"),
-      discovery: legacyOAuthSecretName(serverName, "discovery")
-    })
-  ];
-  for (const name of candidates) {
-    if (secrets.getSecret(name) !== null) {
-      secrets.removeSecret(name);
-      removed.push(name);
-    }
-  }
-  return removed;
-}
-function getOAuthCredentialStatus(serverName, spec, secrets) {
-  const bound = spec.transport === "http" && Object.values(spec.headers ?? {}).some((value) => isOAuthReference(value) && oauthReferenceServerName(value) === serverName);
-  const clientInfo = readJsonSecret(secrets, oauthSecretName(serverName, "client"));
-  const clientRegistered = clientInfo != null;
-  const stored = readJsonSecret(secrets, oauthSecretName(serverName, "tokens"));
-  if (!stored) {
-    return { bound, signedIn: false, expired: false, hasRefreshToken: false, clientRegistered };
-  }
-  const expiresAt = stored.tokens.expires_in ? stored.obtainedAt + stored.tokens.expires_in * 1000 : undefined;
-  const expired = expiresAt != null && Date.now() >= expiresAt;
-  return {
-    bound,
-    signedIn: true,
-    obtainedAt: stored.obtainedAt,
-    expiresAt,
-    expired,
-    hasRefreshToken: Boolean(stored.tokens.refresh_token),
-    clientRegistered
-  };
-}
-
-// src/core/auth-probe.ts
-var JSON_RPC_VERSION = "2.0";
-var DEFAULT_AUTH_PROBE_TIMEOUT_MS = 8000;
-var AUTH_KEYWORDS = [
-  "unauthorized",
-  "unauthenticated",
-  "forbidden",
-  "authentication",
-  "authorization",
-  "api key",
-  "api_key",
-  "apikey",
-  "credentials",
-  "access denied",
-  "auth required",
-  "x-api-key",
-  "invalid key",
-  "missing header",
-  "not authenticated",
-  "auth token"
-];
-function isAuthRelatedMessage(message) {
-  const lower = message.toLowerCase();
-  return AUTH_KEYWORDS.some((kw) => lower.includes(kw));
-}
-function resolveHeaders(spec, secrets) {
-  const headers = {
-    "content-type": "application/json",
-    accept: "application/json, text/event-stream"
-  };
-  for (const [key, value] of Object.entries(spec.headers ?? {})) {
-    headers[key] = secrets.resolveMaybeSecret(value);
-  }
-  return headers;
-}
-function isOAuthLikelyChallenge(wwwAuthenticate) {
-  if (!wwwAuthenticate) {
-    return false;
-  }
-  const lower = wwwAuthenticate.toLowerCase();
-  return lower.includes("bearer") || lower.includes("authorization_uri") || lower.includes("resource_metadata");
-}
-async function probeHttpAuthRequirement(spec, secrets, timeoutMs = DEFAULT_AUTH_PROBE_TIMEOUT_MS, options = {}) {
-  const timeoutController = new AbortController;
-  const timeoutHandle = setTimeout(() => timeoutController.abort(), timeoutMs);
-  const discoverOAuth = options.discoverOAuth ?? true;
-  async function withOAuthSupport(result) {
-    if (!discoverOAuth) {
-      return result;
-    }
-    const support = await probeOAuthSupport(spec.url).catch(() => {
-      return;
-    });
-    return {
-      ...result,
-      oauthSupport: support?.support,
-      oauthLikely: result.oauthLikely || support?.support === "supported"
-    };
-  }
-  try {
-    const headers = resolveHeaders(spec, secrets);
-    const response = await fetch(spec.url, {
-      method: "POST",
-      headers,
-      body: JSON.stringify({
-        jsonrpc: JSON_RPC_VERSION,
-        id: "mcpx-auth-probe",
-        method: "tools/list",
-        params: {}
-      }),
-      signal: timeoutController.signal
-    });
-    if (response.status === 401 || response.status === 403) {
-      const wwwAuthenticate = response.headers.get("www-authenticate");
-      return await withOAuthSupport({
-        authRequired: true,
-        oauthLikely: isOAuthLikelyChallenge(wwwAuthenticate),
-        status: response.status,
-        wwwAuthenticate: wwwAuthenticate ?? undefined
-      });
-    }
-    if (response.status === 200) {
-      try {
-        const body = await response.json();
-        const err = body?.error;
-        if (err && typeof err === "object" && !("result" in body)) {
-          const message = typeof err.message === "string" ? err.message : "";
-          if (message && isAuthRelatedMessage(message)) {
-            return await withOAuthSupport({
-              authRequired: true,
-              status: response.status,
-              error: `JSON-RPC error: ${message}`
-            });
-          }
-        }
-      } catch {}
-    }
-    return {
-      authRequired: false,
-      status: response.status
-    };
-  } catch (error) {
-    const isAbort = error.name === "AbortError";
-    return {
-      authRequired: false,
-      error: isAbort ? `Auth probe timed out after ${timeoutMs}ms.` : error.message
-    };
-  } finally {
-    clearTimeout(timeoutHandle);
-  }
-}
-
-// src/core/registry-client.ts
-var REGISTRY_BASE = "https://registry.modelcontextprotocol.io";
-async function fetchRegistryServerDetail(name) {
-  const encoded = encodeURIComponent(name);
-  const response = await fetch(`${REGISTRY_BASE}/v0.1/servers/${encoded}/versions/latest`, {
-    headers: { accept: "application/json" }
-  });
-  if (!response.ok) {
-    throw new Error(`Registry API error: ${response.status}`);
-  }
-  const data = await response.json();
-  return data.server;
-}
-var PACKAGE_PRIORITY = {
-  npm: 1,
-  pypi: 2,
-  nuget: 3,
-  oci: 4,
-  mcpb: 5
-};
-var RUNTIME_HINT = {
-  npm: "npx",
-  pypi: "uvx",
-  nuget: "dnx"
-};
-function selectBestPackage(packages = [], remotes = []) {
-  const stdioPkgs = packages.filter((p) => p.transport.type === "stdio").sort((a, b) => (PACKAGE_PRIORITY[a.registryType] ?? 99) - (PACKAGE_PRIORITY[b.registryType] ?? 99));
-  if (stdioPkgs.length > 0) {
-    return { kind: "package", package: stdioPkgs[0] };
-  }
-  const httpRemotes = remotes.filter((r) => r.type === "streamable-http" || r.type === "sse");
-  if (httpRemotes.length > 0) {
-    return { kind: "remote", remote: httpRemotes[0] };
-  }
-  if (packages.length > 0) {
-    return { kind: "package", package: packages[0] };
-  }
-  if (remotes.length > 0) {
-    return { kind: "remote", remote: remotes[0] };
-  }
-  throw new Error("Server has no packages or remotes");
-}
-function extractRequiredInputs(option) {
-  const inputs = [];
-  if (option.kind === "package" && option.package?.environmentVariables) {
-    for (const env of option.package.environmentVariables) {
-      if (env.isRequired && !env.default) {
-        inputs.push({
-          name: env.name,
-          description: env.description,
-          isSecret: env.isSecret ?? false,
-          kind: "env"
-        });
-      }
-    }
-    for (const arg of option.package.packageArguments ?? []) {
-      if (arg.isRequired && !arg.value && !arg.default) {
-        inputs.push({
-          name: arg.name ?? arg.valueHint ?? "arg",
-          description: arg.description,
-          isSecret: false,
-          kind: "arg"
-        });
-      }
-    }
-  }
-  if (option.kind === "remote" && option.remote?.headers) {
-    for (const header of option.remote.headers) {
-      if (header.isRequired && !header.default) {
-        inputs.push({
-          name: header.name,
-          description: header.description,
-          isSecret: header.isSecret ?? false,
-          kind: "header"
-        });
-      }
-    }
-  }
-  return inputs;
-}
-function mapRegistryToSpec(_name, option, resolvedValues) {
-  if (option.kind === "remote") {
-    const headers = {};
-    for (const header of option.remote?.headers ?? []) {
-      const value = resolvedValues[header.name] ?? header.default;
-      if (value)
-        headers[header.name] = value;
-    }
-    return {
-      transport: "http",
-      url: option.remote.url,
-      ...Object.keys(headers).length > 0 ? { headers } : {}
-    };
-  }
-  const pkg = option.package;
-  const runtime = pkg.runtimeHint ?? RUNTIME_HINT[pkg.registryType] ?? "npx";
-  const args = [];
-  const identifier = pkg.version ? `${pkg.identifier}@${pkg.version}` : pkg.identifier;
-  args.push(identifier);
-  for (const arg of pkg.packageArguments ?? []) {
-    const value = arg.value ?? resolvedValues[arg.name ?? arg.valueHint ?? ""] ?? arg.default;
-    if (!value)
-      continue;
-    if (arg.type === "named" && arg.name) {
-      args.push(arg.name, value);
-    } else {
-      args.push(value);
-    }
-  }
-  const env = {};
-  for (const envVar of pkg.environmentVariables ?? []) {
-    const value = resolvedValues[envVar.name] ?? envVar.default;
-    if (value)
-      env[envVar.name] = value;
-  }
-  return {
-    transport: "stdio",
-    command: runtime,
-    args,
-    ...Object.keys(env).length > 0 ? { env } : {}
-  };
-}
-
-// src/core/server-auth.ts
-function normalizeNamePart(value) {
-  return value.trim().toLowerCase().replace(/[^a-z0-9._-]+/g, "_").replace(/^_+|_+$/g, "") || "value";
-}
-function requireNonEmpty(value, label) {
-  const normalized = value?.trim();
-  if (!normalized) {
-    throw new Error(`${label} must be non-empty.`);
-  }
-  return normalized;
-}
-function toSecretRef(secretName) {
-  return `secret://${secretName}`;
-}
-function secretRefName(ref) {
-  if (!ref.startsWith("secret://")) {
-    return null;
-  }
-  const name = ref.slice("secret://".length).trim();
-  return name.length > 0 ? name : null;
-}
-function defaultAuthSecretName(serverName, target) {
-  return `auth_${normalizeNamePart(serverName)}_${target.kind}_${normalizeNamePart(target.key)}`;
-}
-function resolveAuthTarget(spec, header, env) {
-  if (spec.transport === "http") {
-    if (env) {
-      throw new Error("--env is only valid for stdio upstreams.");
-    }
-    return {
-      kind: "header",
-      key: requireNonEmpty(header ?? "Authorization", "Header name")
-    };
-  }
-  if (header) {
-    throw new Error("--header is only valid for HTTP upstreams.");
-  }
-  return {
-    kind: "env",
-    key: requireNonEmpty(env, "Env var name")
-  };
-}
-function applyAuthReference(spec, target, secretRef) {
-  if (target.kind === "header") {
-    if (spec.transport !== "http") {
-      throw new Error(`Cannot set header auth on ${spec.transport} upstream.`);
-    }
-    const headers = { ...spec.headers ?? {} };
-    headers[target.key] = secretRef;
-    spec.headers = headers;
-    return;
-  }
-  if (spec.transport !== "stdio") {
-    throw new Error(`Cannot set env auth on ${spec.transport} upstream.`);
-  }
-  const env = { ...spec.env ?? {} };
-  env[target.key] = secretRef;
-  spec.env = env;
-}
-function removeAuthReference(spec, target) {
-  if (target.kind === "header") {
-    if (spec.transport !== "http") {
-      throw new Error(`Cannot remove header auth from ${spec.transport} upstream.`);
-    }
-    if (!spec.headers || !(target.key in spec.headers)) {
-      return null;
-    }
-    const previous2 = spec.headers[target.key] ?? null;
-    const next2 = { ...spec.headers };
-    delete next2[target.key];
-    spec.headers = Object.keys(next2).length > 0 ? next2 : undefined;
-    return previous2;
-  }
-  if (spec.transport !== "stdio") {
-    throw new Error(`Cannot remove env auth from ${spec.transport} upstream.`);
-  }
-  if (!spec.env || !(target.key in spec.env)) {
-    return null;
-  }
-  const previous = spec.env[target.key] ?? null;
-  const next = { ...spec.env };
-  delete next[target.key];
-  spec.env = Object.keys(next).length > 0 ? next : undefined;
-  return previous;
-}
-function listAuthBindings(spec) {
-  if (spec.transport === "http") {
-    return Object.entries(spec.headers ?? {}).map(([key, value]) => ({
-      kind: "header",
-      key,
-      value
-    }));
-  }
-  return Object.entries(spec.env ?? {}).map(([key, value]) => ({
-    kind: "env",
-    key,
-    value
-  }));
-}
-var TOKEN68 = /^[A-Za-z0-9\-._~+/]+=*$/;
-function maybePrefixBearer(target, value, raw = false) {
-  if (raw || target.kind !== "header" || target.key.toLowerCase() !== "authorization") {
-    return value;
-  }
-  if (/^\S+\s+\S+/.test(value)) {
-    return value;
-  }
-  if (TOKEN68.test(value)) {
-    return `Bearer ${value}`;
-  }
-  return value;
-}
-
-// src/core/spawn-env.ts
-import os from "node:os";
-import path2 from "node:path";
-import fs2 from "node:fs";
-function existingNvmCurrentBin() {
-  const nvmDir = process.env.NVM_DIR ?? path2.join(os.homedir(), ".nvm");
-  const current = path2.join(nvmDir, "current", "bin");
-  return fs2.existsSync(current) ? current : null;
-}
-function buildEnrichedPath(current = process.env.PATH ?? "") {
-  const candidates = [
-    ...current.split(":"),
-    "/opt/homebrew/bin",
-    "/usr/local/bin",
-    path2.join(os.homedir(), ".bun", "bin"),
-    path2.join(os.homedir(), ".local", "bin"),
-    existingNvmCurrentBin()
-  ].filter((entry) => Boolean(entry));
-  const seen = new Set;
-  const entries = [];
-  for (const candidate of candidates) {
-    if (!candidate || seen.has(candidate)) {
-      continue;
-    }
-    seen.add(candidate);
-    entries.push(candidate);
-  }
-  return entries.join(":");
-}
-
-// src/core/update.ts
-import fs3 from "node:fs";
-import path3 from "node:path";
-import { execFileSync } from "node:child_process";
-function compareVersions(a, b) {
-  const partsA = a.split(".").map(Number);
-  const partsB = b.split(".").map(Number);
-  for (let i = 0;i < 3; i += 1) {
-    const numA = partsA[i] ?? 0;
-    const numB = partsB[i] ?? 0;
-    if (numA > numB)
-      return 1;
-    if (numA < numB)
-      return -1;
-  }
-  return 0;
-}
-async function checkForUpdates() {
-  try {
-    const output = execFileSync("npm", ["view", "@kwonye/mcpx", "version"], {
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
-    const latestVersion = output;
-    const updateAvailable = compareVersions(latestVersion, APP_VERSION) > 0;
-    return {
-      currentVersion: APP_VERSION,
-      latestVersion,
-      updateAvailable
-    };
-  } catch (error) {
-    return {
-      currentVersion: APP_VERSION,
-      latestVersion: null,
-      updateAvailable: false,
-      error: error instanceof Error ? error.message : String(error)
-    };
-  }
-}
-function getStagedUpdate() {
-  const stagedPath = getStagedVersionPath();
-  if (!fs3.existsSync(stagedPath)) {
-    return null;
-  }
-  try {
-    const raw = fs3.readFileSync(stagedPath, "utf8");
-    const info = JSON.parse(raw);
-    if (!info.version || !info.cliPath) {
-      return null;
-    }
-    const absoluteCliPath = path3.isAbsolute(info.cliPath) ? info.cliPath : path3.join(getUpdatesDir(), info.cliPath);
-    if (!fs3.existsSync(absoluteCliPath)) {
-      return null;
-    }
-    return {
-      ...info,
-      cliPath: absoluteCliPath
-    };
-  } catch {
-    return null;
-  }
-}
-function stageUpdate(version, cliPath) {
-  const updatesDir = getUpdatesDir();
-  ensureDir(updatesDir);
-  const stagedInfo = {
-    version,
-    cliPath: path3.isAbsolute(cliPath) ? path3.relative(updatesDir, cliPath) : cliPath,
-    stagedAt: new Date().toISOString()
-  };
-  fs3.writeFileSync(getStagedVersionPath(), JSON.stringify(stagedInfo, null, 2), "utf8");
-}
-function shouldUseStagedCli(stagedVersion, currentVersion) {
-  return compareVersions(stagedVersion, currentVersion) > 0;
-}
-function clearStagedUpdate() {
-  const stagedPath = getStagedVersionPath();
-  if (fs3.existsSync(stagedPath)) {
-    fs3.unlinkSync(stagedPath);
-  }
-}
-function getStagedCliPath() {
-  const staged = getStagedUpdate();
-  return staged?.cliPath ?? null;
-}
-function removeOldVersions(keepCount = 2) {
-  const updatesDir = getUpdatesDir();
-  if (!fs3.existsSync(updatesDir)) {
-    return;
-  }
-  const entries = fs3.readdirSync(updatesDir, { withFileTypes: true });
-  const versionDirs = entries.filter((entry) => entry.isDirectory() && entry.name.startsWith("v")).map((entry) => entry.name).sort((a, b) => compareVersions(b.slice(1), a.slice(1)));
-  if (versionDirs.length <= keepCount) {
-    return;
-  }
-  for (const oldVersion of versionDirs.slice(keepCount)) {
-    const oldPath = path3.join(updatesDir, oldVersion);
-    try {
-      fs3.rmSync(oldPath, { recursive: true, force: true });
-    } catch {}
-  }
-}
-
-// src/core/update-manager.ts
-import fs4 from "node:fs";
-import path4 from "node:path";
-import { execFile, spawn } from "node:child_process";
-import { promisify } from "node:util";
-var execFileAsync = promisify(execFile);
-function acquireLock() {
-  const lockPath = getUpdateLockPath();
-  try {
-    ensureDir(path4.dirname(lockPath));
-    fs4.writeFileSync(lockPath, `${process.pid}
-`, { flag: "wx" });
-    return true;
-  } catch {
-    return false;
-  }
-}
-function releaseLock() {
-  const lockPath = getUpdateLockPath();
-  try {
-    fs4.unlinkSync(lockPath);
-  } catch {}
-}
-function isUpdateInProgress() {
-  const lockPath = getUpdateLockPath();
-  if (!fs4.existsSync(lockPath)) {
-    return false;
-  }
-  try {
-    const raw = fs4.readFileSync(lockPath, "utf8").trim();
-    const pid = Number(raw);
-    if (!Number.isFinite(pid) || pid <= 0) {
-      fs4.unlinkSync(lockPath);
-      return false;
-    }
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    fs4.unlinkSync(lockPath);
-    return false;
-  }
-}
-async function downloadAndStageUpdate() {
-  const updateStatus = await checkForUpdates();
-  if (!updateStatus.latestVersion || !updateStatus.updateAvailable) {
-    return { success: false, error: "No update available" };
-  }
-  const targetVersion = updateStatus.latestVersion;
-  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(targetVersion)) {
-    return { success: false, error: "Update returned an invalid version" };
-  }
-  const updatesDir = getUpdatesDir();
-  const versionDir = path4.join(updatesDir, `v${targetVersion}`);
-  if (fs4.existsSync(versionDir)) {
-    const existingStaged = getStagedUpdate();
-    if (existingStaged?.version === targetVersion) {
-      return { success: false, error: `Version ${targetVersion} already staged` };
-    }
-  }
-  try {
-    ensureDir(versionDir);
-    await execFileAsync("npm", ["pack", `@kwonye/mcpx@${targetVersion}`, "--json"], { cwd: versionDir });
-    const tarballPath = path4.join(versionDir, `kwonye-mcpx-${targetVersion}.tgz`);
-    if (!fs4.existsSync(tarballPath)) {
-      throw new Error("Downloaded tarball not found");
-    }
-    await execFileAsync("tar", ["-xzf", tarballPath, "--strip-components=1"], { cwd: versionDir });
-    await execFileAsync("npm", ["install", "--production", "--ignore-scripts"], { cwd: versionDir });
-    const cliPath = path4.join(versionDir, "dist", "cli.js");
-    if (!fs4.existsSync(cliPath)) {
-      throw new Error("CLI entry point not found in downloaded package");
-    }
-    try {
-      await execFileAsync(process.execPath, [cliPath, "--version"], { timeout: 1e4 });
-    } catch (smokeTestError) {
-      throw new Error(`Downloaded CLI failed smoke test (--version): ${smokeTestError instanceof Error ? smokeTestError.message : String(smokeTestError)}`);
-    }
-    stageUpdate(targetVersion, cliPath);
-    removeOldVersions(2);
-    return { success: true, version: targetVersion };
-  } catch (error) {
-    try {
-      fs4.rmSync(versionDir, { recursive: true, force: true });
-    } catch {}
-    return {
-      success: false,
-      error: error instanceof Error ? error.message : String(error)
-    };
-  }
-}
-function startBackgroundUpdateCheck() {
-  if (process.env.MCPX_NO_UPDATE === "1") {
-    return;
-  }
-  if (isUpdateInProgress()) {
-    return;
-  }
-  if (!acquireLock()) {
-    return;
-  }
-  const child = spawn(process.execPath, [
-    process.argv[1] ?? "",
-    "update",
-    "--background"
-  ], {
-    detached: true,
-    stdio: ["ignore", "ignore", "ignore"],
-    env: {
-      ...process.env,
-      MCPX_UPDATE_CHILD: "1"
-    }
-  });
-  child.unref();
-  const releaseTimer = setTimeout(() => {
-    releaseLock();
-  }, 60000);
-  releaseTimer.unref?.();
-}
-async function runBackgroundUpdate() {
-  try {
-    const result = await downloadAndStageUpdate();
-    if (result.success && result.version) {
-      console.error(`[update-manager] Update staged: v${result.version}. Will activate on next run.`);
-    } else if (result.error && result.error !== "No update available") {
-      console.error(`[update-manager] Update check failed: ${result.error}`);
-    }
-  } catch (error) {
-    console.error(`[update-manager] Background update failed: ${error instanceof Error ? error.message : String(error)}`);
-  } finally {
-    releaseLock();
-  }
-}
-async function performUpdate() {
-  if (isUpdateInProgress()) {
-    return { success: false, message: "Another update is already in progress." };
-  }
-  if (!acquireLock()) {
-    return { success: false, message: "Another update is already in progress." };
-  }
-  try {
-    const result = await downloadAndStageUpdate();
-    if (result.success && result.version) {
-      return {
-        success: true,
-        message: `Update to v${result.version} ready! Will activate on next run.`
-      };
-    }
-    if (result.error === "No update available") {
-      return { success: true, message: "Already on latest version." };
-    }
-    return {
-      success: false,
-      message: result.error ?? "Update failed"
-    };
-  } finally {
-    releaseLock();
-  }
-}
-function performRollback() {
-  const currentStaged = getStagedUpdate();
-  if (!currentStaged) {
-    return { success: false, message: "No staged update to roll back." };
-  }
-  clearStagedUpdate();
-  return {
-    success: true,
-    message: `Rolled back from v${currentStaged.version}. Using installed version.`
-  };
-}
-
-// src/core/marketplace-updater.ts
-import fs5 from "node:fs";
-var MARKETPLACE_UPDATE_INTERVAL_MS = 6 * 60 * 60 * 1000;
-var INITIAL_DELAY_MS = 30000;
-var LOCK_STALE_MS = 30 * 60 * 1000;
-function readState() {
-  try {
-    return JSON.parse(fs5.readFileSync(getMarketplaceUpdateStatePath(), "utf8"));
-  } catch {
-    return {};
-  }
-}
-function writeState(state) {
-  const target = getMarketplaceUpdateStatePath();
-  ensureParentDir(target);
-  fs5.writeFileSync(target, JSON.stringify(state, null, 2), { mode: 384 });
-}
-function due(now = Date.now()) {
-  const last = readState().lastRunAt;
-  return !last || !Number.isFinite(Date.parse(last)) || now - Date.parse(last) >= MARKETPLACE_UPDATE_INTERVAL_MS;
-}
-function acquireLock2() {
-  const target = getMarketplaceUpdateLockPath();
-  ensureParentDir(target);
-  try {
-    fs5.writeFileSync(target, `${process.pid}
-`, { flag: "wx", mode: 384 });
-    return true;
-  } catch {
-    try {
-      if (Date.now() - fs5.statSync(target).mtimeMs > LOCK_STALE_MS) {
-        fs5.unlinkSync(target);
-        return acquireLock2();
-      }
-    } catch {
-      return acquireLock2();
-    }
-    return false;
-  }
-}
-function releaseLock2() {
-  try {
-    fs5.unlinkSync(getMarketplaceUpdateLockPath());
-  } catch {}
-}
-async function runMarketplaceAutoUpdate(options) {
-  if (process.env.MCPX_NO_UPDATE === "1")
-    return { checked: [], errors: [], skipped: true };
-  if (!options?.force && !due())
-    return { checked: [], errors: [], skipped: true };
-  if (!acquireLock2())
-    return { checked: [], errors: [], skipped: true };
-  try {
-    const result = await refreshAutoUpdateMarketplaces();
-    writeState({ lastRunAt: new Date().toISOString() });
-    return result;
-  } finally {
-    releaseLock2();
-  }
-}
-function startMarketplaceAutoUpdater() {
-  if (process.env.MCPX_NO_UPDATE === "1")
-    return () => {};
-  let stopped = false;
-  const run = () => {
-    if (!stopped)
-      runMarketplaceAutoUpdate().catch(() => {
-        return;
-      });
-  };
-  const initial = setTimeout(run, INITIAL_DELAY_MS);
-  initial.unref?.();
-  const interval = setInterval(run, MARKETPLACE_UPDATE_INTERVAL_MS);
-  interval.unref?.();
-  return () => {
-    stopped = true;
-    clearTimeout(initial);
-    clearInterval(interval);
-  };
-}
-
-// src/core/daemon.ts
-import fs6 from "node:fs";
-import net from "node:net";
-import { spawn as spawn2, execFileSync as execFileSync2 } from "node:child_process";
-
-// src/gateway/server.ts
-import http2 from "node:http";
-import { URL as URL2 } from "node:url";
-import crypto2 from "node:crypto";
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import {
-  StdioClientTransport,
-  getDefaultEnvironment
-} from "@modelcontextprotocol/sdk/client/stdio.js";
-import { StreamableHTTPClientTransport, StreamableHTTPError } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-var SERVER_VERSION = APP_VERSION;
-var DEFAULT_UPSTREAM_TIMEOUT_MS = 60000;
-var DEFAULT_CONNECT_TIMEOUT_MS = 1e4;
-var OAUTH_WELL_KNOWN_PREFIXES = [
-  "/.well-known/oauth-protected-resource",
-  "/.well-known/oauth-authorization-server",
-  "/.well-known/openid-configuration"
-];
-function makeError(id, code, message, data) {
-  return {
-    jsonrpc: "2.0",
-    id,
-    error: {
-      code,
-      message,
-      data
-    }
-  };
-}
-function makeResult(id, result) {
-  return {
-    jsonrpc: "2.0",
-    id,
-    result
-  };
-}
-function listUpstreams(config, upstreamFilter) {
-  const all = Object.entries(config.servers).filter(([, spec]) => isServerEnabled(spec)).map(([name, spec]) => ({ name, spec }));
-  if (!upstreamFilter) {
-    return all;
-  }
-  return all.filter((upstream) => upstream.name === upstreamFilter);
-}
-function getSingleUpstream(config) {
-  const upstreams = listUpstreams(config);
-  if (upstreams.length !== 1) {
-    return null;
-  }
-  return upstreams[0] ?? null;
-}
-function getSingleHttpUpstream(config) {
-  const upstream = getSingleUpstream(config);
-  if (!upstream || upstream.spec.transport !== "http") {
-    return null;
-  }
-  return upstream;
-}
-function getScopedHttpUpstream(config, upstreamFilter) {
-  if (upstreamFilter) {
-    const selected = config.servers[upstreamFilter];
-    if (!selected || !isServerEnabled(selected) || selected.transport !== "http") {
-      return null;
-    }
-    return {
-      name: upstreamFilter,
-      spec: selected
-    };
-  }
-  return getSingleHttpUpstream(config);
-}
-function getWellKnownPrefix(pathname) {
-  for (const prefix of OAUTH_WELL_KNOWN_PREFIXES) {
-    if (pathname === prefix || pathname.startsWith(`${prefix}/`)) {
-      return prefix;
-    }
-  }
-  return null;
-}
-function getUpstreamPathSuffixForWellKnown(upstream) {
-  const upstreamUrl = new URL2(upstream.spec.url);
-  if (upstreamUrl.pathname === "/") {
-    return "";
-  }
-  return upstreamUrl.pathname.endsWith("/") ? upstreamUrl.pathname.slice(0, -1) : upstreamUrl.pathname;
-}
-function buildWellKnownUpstreamUrl(upstream, prefix) {
-  const upstreamUrl = new URL2(upstream.spec.url);
-  const suffix = getUpstreamPathSuffixForWellKnown(upstream);
-  return new URL2(`${prefix}${suffix}`, upstreamUrl.origin);
-}
-function getLocalOriginFromRequest(request) {
-  return `http://${request.headers.host ?? "127.0.0.1"}`;
-}
-function getRequestedUpstream(requestUrl) {
-  const value = requestUrl.searchParams.get("upstream");
-  if (!value) {
-    return;
-  }
-  return value.trim() || undefined;
-}
-function appendUpstreamQuery(url, upstream) {
-  if (!upstream) {
-    return url;
-  }
-  const parsed = new URL2(url);
-  parsed.searchParams.set("upstream", upstream);
-  return parsed.toString();
-}
-function rewriteWwwAuthenticateResourceMetadata(headerValue, localResourceMetadataUrl) {
-  if (headerValue.includes("resource_metadata=")) {
-    return headerValue.replace(/resource_metadata="[^"]*"/, `resource_metadata="${localResourceMetadataUrl}"`);
-  }
-  return `${headerValue}, resource_metadata="${localResourceMetadataUrl}"`;
-}
-function isOAuthCapableServer(spec) {
-  if (spec.transport !== "http") {
-    return false;
-  }
-  const headers = spec.headers ?? {};
-  for (const headerName of Object.keys(headers)) {
-    if (headerName.toLowerCase() === "authorization") {
-      return true;
-    }
-  }
-  return false;
-}
-function splitNamespacedName(value) {
-  const split = value.indexOf(".");
-  if (split <= 0 || split >= value.length - 1) {
-    return null;
-  }
-  return {
-    serverName: value.slice(0, split),
-    upstreamName: value.slice(split + 1)
-  };
-}
-function parseNamespacedUri(uri) {
-  if (uri.startsWith("mcpx://")) {
-    const rest = uri.slice("mcpx://".length);
-    const slashIndex = rest.indexOf("/");
-    if (slashIndex <= 0 || slashIndex >= rest.length - 1) {
-      return null;
-    }
-    const serverName = rest.slice(0, slashIndex);
-    const encoded = rest.slice(slashIndex + 1);
-    try {
-      return {
-        serverName,
-        upstreamUri: decodeURIComponent(encoded)
-      };
-    } catch {
-      return null;
-    }
-  }
-  const nameSplit = splitNamespacedName(uri);
-  if (!nameSplit) {
-    return null;
-  }
-  return {
-    serverName: nameSplit.serverName,
-    upstreamUri: nameSplit.upstreamName
-  };
-}
-async function callUpstream(upstream, method, params, id, secrets, runtime, passthroughAuthorizationHeader) {
-  return callUpstreamOnce(upstream, method, params, secrets, runtime, passthroughAuthorizationHeader, false);
-}
-var ERROR_CODE_PRIORITY = [
-  "auth_expired",
-  "auth_required",
-  "secret_missing",
-  "unreachable",
-  "timeout",
-  "upstream_error"
-];
-function pickPrimaryErrorCode(errors) {
-  let best;
-  let bestRank = Number.POSITIVE_INFINITY;
-  for (const { code } of errors) {
-    if (!code)
-      continue;
-    const rank = ERROR_CODE_PRIORITY.indexOf(code);
-    const effectiveRank = rank === -1 ? ERROR_CODE_PRIORITY.length : rank;
-    if (effectiveRank < bestRank) {
-      bestRank = effectiveRank;
-      best = code;
-    }
-  }
-  return best;
-}
-async function getUpstreamTokenCounts(config, secrets, runtime) {
-  if (!runtime.tokenCache) {
-    runtime.tokenCache = new Map;
-  }
-  const results = {};
-  const upstreams = listUpstreams(config);
-  for (const upstream of upstreams) {
-    let recordError = function(label, error) {
-      const message = error instanceof Error ? error.message : String(error);
-      errors.push({ label, message, code: error instanceof UpstreamError ? error.code : undefined });
-    };
-    const fingerprint = specFingerprint(upstream.spec, secrets);
-    const cached = runtime.tokenCache.get(upstream.name);
-    if (cached?.fingerprint === fingerprint) {
-      const runtimeErr2 = runtime.upstreamErrors?.get(upstream.name);
-      results[upstream.name] = runtimeErr2 ? { ...cached.count, runtimeError: runtimeErr2.message, runtimeErrorCode: runtimeErr2.code } : cached.count;
-      continue;
-    }
-    let toolsCount = 0;
-    let resourcesCount = 0;
-    let promptsCount = 0;
-    const errors = [];
-    try {
-      const toolsResult = await callUpstream(upstream, "tools/list", {}, "token-tools", secrets, runtime);
-      if (toolsResult && toolsResult.tools) {
-        toolsCount = Math.ceil(JSON.stringify(toolsResult.tools).length / 4);
-      }
-    } catch (error) {
-      recordError("tools/list", error);
-    }
-    try {
-      const resourcesResult = await callUpstream(upstream, "resources/list", {}, "token-resources", secrets, runtime);
-      if (resourcesResult && resourcesResult.resources) {
-        resourcesCount = Math.ceil(JSON.stringify(resourcesResult.resources).length / 4);
-      }
-    } catch (error) {
-      recordError("resources/list", error);
-    }
-    try {
-      const promptsResult = await callUpstream(upstream, "prompts/list", {}, "token-prompts", secrets, runtime);
-      if (promptsResult && promptsResult.prompts) {
-        promptsCount = Math.ceil(JSON.stringify(promptsResult.prompts).length / 4);
-      }
-    } catch (error) {
-      recordError("prompts/list", error);
-    }
-    const total = toolsCount + resourcesCount + promptsCount;
-    const countObj = {
-      tools: toolsCount,
-      resources: resourcesCount,
-      prompts: promptsCount,
-      total,
-      error: errors.length > 0 ? errors.map((e) => `${e.label}: ${e.message}`).join("; ") : undefined,
-      errorCode: pickPrimaryErrorCode(errors)
-    };
-    if (errors.length === 0) {
-      runtime.tokenCache.set(upstream.name, { fingerprint, count: countObj });
-    }
-    const runtimeErr = runtime.upstreamErrors?.get(upstream.name);
-    results[upstream.name] = runtimeErr ? { ...countObj, runtimeError: runtimeErr.message, runtimeErrorCode: runtimeErr.code } : countObj;
-  }
-  return results;
-}
-function getConfiguredTimeoutMs() {
-  const configuredTimeout = Number(process.env.MCPX_UPSTREAM_TIMEOUT_MS ?? DEFAULT_UPSTREAM_TIMEOUT_MS);
-  return Number.isFinite(configuredTimeout) && configuredTimeout > 0 ? configuredTimeout : DEFAULT_UPSTREAM_TIMEOUT_MS;
-}
-function withTimeout(work, timeoutMs, timeoutMessage) {
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => reject(new Error(timeoutMessage)), timeoutMs);
-    work.then((value) => {
-      clearTimeout(timer);
-      resolve(value);
-    }, (error) => {
-      clearTimeout(timer);
-      reject(error);
-    });
-  });
-}
-function specFingerprint(spec, secrets) {
-  if (!secrets)
-    return JSON.stringify(spec);
-  const resolvedMarkers = {};
-  const collect = (obj) => {
-    if (!obj)
-      return;
-    for (const [key, value] of Object.entries(obj)) {
-      if (isOAuthReference(value)) {
-        try {
-          const serverName = oauthReferenceServerName(value);
-          let storedTokens = secrets.getSecret(oauthSecretNames(serverName).tokens);
-          if (!storedTokens) {
-            const legacy = `oauth_${serverName.toLowerCase().replace(/[^a-z0-9._-]/g, "_")}_tokens`;
-            storedTokens = secrets.getSecret(legacy);
-          }
-          const obtainedAt = storedTokens ? JSON.parse(storedTokens).obtainedAt : undefined;
-          resolvedMarkers[key] = obtainedAt != null ? `oauth:${serverName}:${obtainedAt}` : value;
-        } catch {
-          resolvedMarkers[key] = value;
-        }
-      } else if (value.startsWith("secret://")) {
-        try {
-          resolvedMarkers[key] = secrets.resolveMaybeSecret(value);
-        } catch {
-          resolvedMarkers[key] = value;
-        }
-      }
-    }
-  };
-  if (spec.transport === "stdio")
-    collect(spec.env);
-  if (spec.transport === "http")
-    collect(spec.headers);
-  return JSON.stringify({ spec, resolvedMarkers });
-}
-function passthroughCacheSuffix(passthroughAuthorizationHeader) {
-  return `passthrough:${crypto2.createHash("sha256").update(passthroughAuthorizationHeader).digest("hex").slice(0, 16)}`;
-}
-var EXTRA_INHERITED_ENV = ["TMPDIR", "LANG"];
-function resolveStdioEnv(spec, secrets) {
-  const env = getDefaultEnvironment();
-  for (const key of EXTRA_INHERITED_ENV) {
-    const value = process.env[key];
-    if (value)
-      env[key] = value;
-  }
-  for (const [key, value] of Object.entries(process.env)) {
-    if (key.startsWith("LC_") && value)
-      env[key] = value;
-  }
-  env.PATH = buildEnrichedPath(env.PATH);
-  for (const [key, value] of Object.entries(spec.env ?? {})) {
-    env[key] = secrets.resolveMaybeSecret(value);
-  }
-  return env;
-}
-function buildStdioServerParameters(spec, secrets) {
-  return {
-    command: spec.command,
-    args: spec.args ?? [],
-    cwd: spec.cwd,
-    env: resolveStdioEnv(spec, secrets)
-  };
-}
-async function buildHttpHeaders(upstream, secrets, options) {
-  const headers = {};
-  for (const [key, value] of Object.entries(upstream.spec.headers ?? {})) {
-    if (key.toLowerCase() === "authorization" && isOAuthReference(value)) {
-      const oauthServerName = oauthReferenceServerName(value);
-      const accessToken = await getOAuthAccessToken(oauthServerName, upstream.spec, secrets, {
-        forceRefresh: options.forceOAuthRefresh
-      });
-      headers[key] = `Bearer ${accessToken}`;
-    } else {
-      headers[key] = secrets.resolveMaybeSecret(value);
-    }
-  }
-  if (options.passthroughAuthorizationHeader) {
-    headers.Authorization = options.passthroughAuthorizationHeader;
-  }
-  return headers;
-}
-async function closeUpstreamConnection(entry) {
-  try {
-    const connection = await entry.promise;
-    await connection.transport.close();
-  } catch {}
-}
-async function reconcileUpstreamConnections(config, secrets, runtime) {
-  const activeSpecs = new Map(Object.entries(config.servers).filter(([, spec]) => isServerEnabled(spec)).map(([name, spec]) => [name, specFingerprint(spec, secrets)]));
-  const staleKeys = [];
-  for (const [key, entry] of runtime.upstreamConnections.entries()) {
-    const upstreamName = key.includes(":") ? key.slice(0, key.indexOf(":")) : key;
-    const expectedFingerprint = activeSpecs.get(upstreamName);
-    if (!expectedFingerprint || expectedFingerprint !== entry.fingerprint) {
-      staleKeys.push(key);
-    }
-  }
-  for (const key of staleKeys) {
-    const entry = runtime.upstreamConnections.get(key);
-    if (!entry) {
-      continue;
-    }
-    runtime.upstreamConnections.delete(key);
-    await closeUpstreamConnection(entry);
-  }
-}
-function invalidateUpstreamConnection(upstreamName, passthroughAuthorizationHeader, runtime) {
-  const key = passthroughAuthorizationHeader ? `${upstreamName}:${passthroughCacheSuffix(passthroughAuthorizationHeader)}` : upstreamName;
-  const existing = runtime.upstreamConnections.get(key);
-  if (!existing) {
-    return;
-  }
-  runtime.upstreamConnections.delete(key);
-  closeUpstreamConnection(existing);
-}
-async function getUpstreamConnection(upstream, secrets, runtime, options = {}) {
-  const { forceOAuthRefresh = false, passthroughAuthorizationHeader } = options;
-  const cacheKey = passthroughAuthorizationHeader ? `${upstream.name}:${passthroughCacheSuffix(passthroughAuthorizationHeader)}` : upstream.name;
-  const fingerprint = specFingerprint(upstream.spec, secrets);
-  if (!forceOAuthRefresh) {
-    const existing = runtime.upstreamConnections.get(cacheKey);
-    if (existing) {
-      if (existing.fingerprint === fingerprint) {
-        return existing.promise;
-      }
-      runtime.upstreamConnections.delete(cacheKey);
-      closeUpstreamConnection(existing);
-    }
-  }
-  const promise = (async () => {
-    let transport;
-    if (upstream.spec.transport === "stdio") {
-      transport = new StdioClientTransport(buildStdioServerParameters(upstream.spec, secrets));
-    } else {
-      const headers = await buildHttpHeaders(upstream, secrets, { forceOAuthRefresh, passthroughAuthorizationHeader });
-      const capturingFetch = async (url, init) => {
-        const response = await fetch(url, init);
-        const wwwAuth = response.headers.get("www-authenticate");
-        if (wwwAuth) {
-          if (!runtime.lastWwwAuthenticate) {
-            runtime.lastWwwAuthenticate = new Map;
-          }
-          runtime.lastWwwAuthenticate.set(upstream.name, wwwAuth);
-        }
-        return response;
-      };
-      transport = new StreamableHTTPClientTransport(new URL2(upstream.spec.url), { requestInit: { headers }, fetch: capturingFetch });
-    }
-    const client = new Client({ name: "mcpx", version: SERVER_VERSION });
-    await withTimeout(client.connect(transport), DEFAULT_CONNECT_TIMEOUT_MS, `Upstream ${upstream.name} failed to connect within ${DEFAULT_CONNECT_TIMEOUT_MS}ms.`);
-    return { fingerprint, client, transport };
-  })();
-  runtime.upstreamConnections.set(cacheKey, { fingerprint, promise });
-  try {
-    return await promise;
-  } catch (error) {
-    runtime.upstreamConnections.delete(cacheKey);
-    throw error;
-  }
-}
-async function callUpstreamOnce(upstream, method, params, secrets, runtime, passthroughAuthorizationHeader, forceOAuthRefresh) {
-  const hasOAuth = upstream.spec.transport === "http" && Object.values(upstream.spec.headers ?? {}).some(isOAuthReference);
-  try {
-    const connection = await getUpstreamConnection(upstream, secrets, runtime, {
-      forceOAuthRefresh,
-      passthroughAuthorizationHeader
-    });
-    const timeoutMs = getConfiguredTimeoutMs();
-    const timeoutMessage = `Upstream ${upstream.name} timed out after ${timeoutMs}ms for method ${method}.`;
-    if (method === "tools/list") {
-      return withTimeout(connection.client.listTools(params), timeoutMs, timeoutMessage);
-    }
-    if (method === "resources/list") {
-      return withTimeout(connection.client.listResources(params), timeoutMs, timeoutMessage);
-    }
-    if (method === "prompts/list") {
-      return withTimeout(connection.client.listPrompts(params), timeoutMs, timeoutMessage);
-    }
-    if (method === "tools/call") {
-      return withTimeout(connection.client.callTool(params), timeoutMs, timeoutMessage);
-    }
-    if (method === "resources/read") {
-      return withTimeout(connection.client.readResource(params), timeoutMs, timeoutMessage);
-    }
-    if (method === "prompts/get") {
-      return withTimeout(connection.client.getPrompt(params), timeoutMs, timeoutMessage);
-    }
-    throw new Error(`Unsupported method: ${method}`);
-  } catch (error) {
-    invalidateUpstreamConnection(upstream.name, passthroughAuthorizationHeader, runtime);
-    if (!forceOAuthRefresh && hasOAuth && error instanceof StreamableHTTPError && (error.code === 401 || error.code === 403)) {
-      return callUpstreamOnce(upstream, method, params, secrets, runtime, passthroughAuthorizationHeader, true);
-    }
-    const wwwAuthenticate = runtime.lastWwwAuthenticate?.get(upstream.name);
-    throw classifyUpstreamError(upstream.name, error, wwwAuthenticate);
-  }
-}
-function tokensMatch(candidate, expectedToken) {
-  if (!candidate) {
-    return false;
-  }
-  const candidateBuf = Buffer.from(candidate);
-  const expectedBuf = Buffer.from(expectedToken);
-  return candidateBuf.length === expectedBuf.length && crypto2.timingSafeEqual(candidateBuf, expectedBuf);
-}
-function authHeaderIsValid(request, expectedToken) {
-  const localTokenHeader = request.headers["x-mcpx-local-token"];
-  if (typeof localTokenHeader === "string" && tokensMatch(localTokenHeader, expectedToken)) {
-    return true;
-  }
-  if (Array.isArray(localTokenHeader) && localTokenHeader.some((value) => tokensMatch(value, expectedToken))) {
-    return true;
-  }
-  const authHeader = request.headers.authorization;
-  if (!authHeader) {
-    return false;
-  }
-  const [scheme, token] = authHeader.split(" ");
-  return scheme === "Bearer" && tokensMatch(token, expectedToken);
-}
-function isAuthChallenge(error) {
-  return error instanceof UpstreamError && (error.code === "auth_required" || error.code === "auth_expired");
-}
-function getClientAuthorizationForUpstream(request, expectedToken) {
-  const authHeader = request.headers.authorization;
-  if (!authHeader) {
-    return;
-  }
-  const [scheme, token] = authHeader.split(" ");
-  if (scheme === "Bearer" && tokensMatch(token, expectedToken)) {
-    return;
-  }
-  return authHeader;
-}
-async function handleListTools(config, secrets, runtime, upstreamFilter, clientAuthorizationHeader) {
-  const tools = [];
-  const flattenedUpstream = listUpstreams(config, upstreamFilter).length === 1;
-  const flattenNames = Boolean(flattenedUpstream);
-  const upstreams = listUpstreams(config, upstreamFilter);
-  for (const upstream of upstreams) {
-    try {
-      const result = await callUpstream(upstream, "tools/list", {}, `list-tools-${upstream.name}`, secrets, runtime, clientAuthorizationHeader);
-      if (!runtime.tokenCache) {
-        runtime.tokenCache = new Map;
-      }
-      const cached = runtime.tokenCache.get(upstream.name);
-      const existing = cached?.fingerprint === specFingerprint(upstream.spec, secrets) ? cached.count : { tools: 0, resources: 0, prompts: 0, total: 0 };
-      existing.tools = Math.ceil(JSON.stringify(result.tools ?? []).length / 4);
-      existing.total = existing.tools + existing.resources + existing.prompts;
-      delete existing.error;
-      runtime.tokenCache.set(upstream.name, { fingerprint: specFingerprint(upstream.spec, secrets), count: existing });
-      for (const tool of result.tools ?? []) {
-        const name = typeof tool.name === "string" ? tool.name : "tool";
-        tools.push({
-          ...tool,
-          name: flattenNames ? name : `${upstream.name}.${name}`
-        });
-      }
-    } catch (error) {
-      if (upstreams.length === 1) {
-        throw error;
-      }
-      const code = error instanceof UpstreamError ? error.code : "upstream_error";
-      runtime.upstreamErrors?.set(upstream.name, { code, message: error instanceof Error ? error.message : String(error) });
-    }
-  }
-  const failedUpstreams = upstreams.filter((u) => runtime.upstreamErrors?.has(u.name)).map((u) => ({ name: u.name, ...runtime.upstreamErrors.get(u.name) }));
-  return {
-    tools,
-    ...failedUpstreams.length > 0 ? { _meta: { mcpxUpstreamErrors: failedUpstreams } } : {}
-  };
-}
-async function handleListResources(config, secrets, runtime, upstreamFilter, clientAuthorizationHeader) {
-  const resources = [];
-  const flattenedUpstream = listUpstreams(config, upstreamFilter).length === 1;
-  const flattenNames = Boolean(flattenedUpstream);
-  const upstreams = listUpstreams(config, upstreamFilter);
-  for (const upstream of upstreams) {
-    try {
-      const result = await callUpstream(upstream, "resources/list", {}, `list-resources-${upstream.name}`, secrets, runtime, clientAuthorizationHeader);
-      if (!runtime.tokenCache) {
-        runtime.tokenCache = new Map;
-      }
-      const cached = runtime.tokenCache.get(upstream.name);
-      const existing = cached?.fingerprint === specFingerprint(upstream.spec, secrets) ? cached.count : { tools: 0, resources: 0, prompts: 0, total: 0 };
-      existing.resources = Math.ceil(JSON.stringify(result.resources ?? []).length / 4);
-      existing.total = existing.tools + existing.resources + existing.prompts;
-      delete existing.error;
-      runtime.tokenCache.set(upstream.name, { fingerprint: specFingerprint(upstream.spec, secrets), count: existing });
-      for (const resource of result.resources ?? []) {
-        const originalUri = typeof resource.uri === "string" ? resource.uri : "";
-        const originalName = typeof resource.name === "string" ? resource.name : originalUri;
-        resources.push({
-          ...resource,
-          name: flattenNames ? originalName : `${upstream.name}.${originalName}`,
-          uri: flattenNames ? originalUri : `mcpx://${upstream.name}/${encodeURIComponent(originalUri)}`
-        });
-      }
-    } catch (error) {
-      if (upstreams.length === 1) {
-        throw error;
-      }
-      const code = error instanceof UpstreamError ? error.code : "upstream_error";
-      runtime.upstreamErrors?.set(upstream.name, { code, message: error instanceof Error ? error.message : String(error) });
-    }
-  }
-  const failedUpstreams = upstreams.filter((u) => runtime.upstreamErrors?.has(u.name)).map((u) => ({ name: u.name, ...runtime.upstreamErrors.get(u.name) }));
-  return {
-    resources,
-    ...failedUpstreams.length > 0 ? { _meta: { mcpxUpstreamErrors: failedUpstreams } } : {}
-  };
-}
-async function handleListPrompts(config, secrets, runtime, upstreamFilter, clientAuthorizationHeader) {
-  const prompts = [];
-  const flattenedUpstream = listUpstreams(config, upstreamFilter).length === 1;
-  const flattenNames = Boolean(flattenedUpstream);
-  const upstreams = listUpstreams(config, upstreamFilter);
-  for (const upstream of upstreams) {
-    try {
-      const result = await callUpstream(upstream, "prompts/list", {}, `list-prompts-${upstream.name}`, secrets, runtime, clientAuthorizationHeader);
-      if (!runtime.tokenCache) {
-        runtime.tokenCache = new Map;
-      }
-      const cached = runtime.tokenCache.get(upstream.name);
-      const existing = cached?.fingerprint === specFingerprint(upstream.spec, secrets) ? cached.count : { tools: 0, resources: 0, prompts: 0, total: 0 };
-      existing.prompts = Math.ceil(JSON.stringify(result.prompts ?? []).length / 4);
-      existing.total = existing.tools + existing.resources + existing.prompts;
-      delete existing.error;
-      runtime.tokenCache.set(upstream.name, { fingerprint: specFingerprint(upstream.spec, secrets), count: existing });
-      for (const prompt of result.prompts ?? []) {
-        const name = typeof prompt.name === "string" ? prompt.name : "prompt";
-        prompts.push({
-          ...prompt,
-          name: flattenNames ? name : `${upstream.name}.${name}`
-        });
-      }
-    } catch (error) {
-      if (upstreams.length === 1) {
-        throw error;
-      }
-      const code = error instanceof UpstreamError ? error.code : "upstream_error";
-      runtime.upstreamErrors?.set(upstream.name, { code, message: error instanceof Error ? error.message : String(error) });
-    }
-  }
-  const failedUpstreams = upstreams.filter((u) => runtime.upstreamErrors?.has(u.name)).map((u) => ({ name: u.name, ...runtime.upstreamErrors.get(u.name) }));
-  return {
-    prompts,
-    ...failedUpstreams.length > 0 ? { _meta: { mcpxUpstreamErrors: failedUpstreams } } : {}
-  };
-}
-async function routeNamespacedCall(config, method, params, id, secrets, runtime, upstreamFilter, clientAuthorizationHeader) {
-  if (!params || typeof params !== "object") {
-    return makeError(id, -32602, "Missing params object.");
-  }
-  const upstreamEntries = listUpstreams(config, upstreamFilter);
-  const upstreams = new Map(upstreamEntries.map((entry) => [entry.name, entry]));
-  const flattenedUpstream = upstreamEntries.length === 1 ? upstreamEntries[0] : null;
-  if (method === "tools/call") {
-    const toolName = typeof params.name === "string" ? params.name : "";
-    const split = splitNamespacedName(toolName);
-    if (split && upstreamFilter && split.serverName !== upstreamFilter) {
-      return makeError(id, -32602, `Tool belongs to upstream ${split.serverName}, but request is scoped to ${upstreamFilter}.`);
-    }
-    let upstream2;
-    let upstreamToolName = toolName;
-    if (split && upstreams.has(split.serverName)) {
-      upstream2 = upstreams.get(split.serverName);
-      upstreamToolName = split.upstreamName;
-    } else if (flattenedUpstream) {
-      upstream2 = flattenedUpstream;
-    }
-    if (!upstream2) {
-      return makeError(id, -32602, "Tool name must be namespaced as <server>.<tool>.");
-    }
-    const upstreamParams2 = {
-      ...params,
-      name: upstreamToolName
-    };
-    try {
-      const result = await callUpstream(upstream2, method, upstreamParams2, id, secrets, runtime, clientAuthorizationHeader);
-      runtime.upstreamErrors?.delete(upstream2.name);
-      return makeResult(id, result);
-    } catch (error) {
-      if (isAuthChallenge(error)) {
-        throw error;
-      }
-      const errCode = error instanceof UpstreamError ? error.code : "upstream_error";
-      runtime.upstreamErrors?.set(upstream2.name, { code: errCode, message: error.message });
-      return makeError(id, -32000, error.message, { mcpxCode: errCode, upstream: upstream2.name });
-    }
-  }
-  if (method === "prompts/get") {
-    const promptName = typeof params.name === "string" ? params.name : "";
-    const split = splitNamespacedName(promptName);
-    if (split && upstreamFilter && split.serverName !== upstreamFilter) {
-      return makeError(id, -32602, `Prompt belongs to upstream ${split.serverName}, but request is scoped to ${upstreamFilter}.`);
-    }
-    let upstream2;
-    let upstreamPromptName = promptName;
-    if (split && upstreams.has(split.serverName)) {
-      upstream2 = upstreams.get(split.serverName);
-      upstreamPromptName = split.upstreamName;
-    } else if (flattenedUpstream) {
-      upstream2 = flattenedUpstream;
-    }
-    if (!upstream2) {
-      return makeError(id, -32602, "Prompt name must be namespaced as <server>.<prompt>.");
-    }
-    const upstreamParams2 = {
-      ...params,
-      name: upstreamPromptName
-    };
-    try {
-      const result = await callUpstream(upstream2, method, upstreamParams2, id, secrets, runtime, clientAuthorizationHeader);
-      runtime.upstreamErrors?.delete(upstream2.name);
-      return makeResult(id, result);
-    } catch (error) {
-      if (isAuthChallenge(error)) {
-        throw error;
-      }
-      const errCode = error instanceof UpstreamError ? error.code : "upstream_error";
-      runtime.upstreamErrors?.set(upstream2.name, { code: errCode, message: error.message });
-      return makeError(id, -32000, error.message, { mcpxCode: errCode, upstream: upstream2.name });
-    }
-  }
-  const uri = typeof params.uri === "string" ? params.uri : "";
-  const parsed = parseNamespacedUri(uri);
-  if (parsed && upstreamFilter && parsed.serverName !== upstreamFilter) {
-    return makeError(id, -32602, `Resource belongs to upstream ${parsed.serverName}, but request is scoped to ${upstreamFilter}.`);
-  }
-  let upstream;
-  let upstreamUri = uri;
-  if (parsed && upstreams.has(parsed.serverName)) {
-    upstream = upstreams.get(parsed.serverName);
-    upstreamUri = parsed.upstreamUri;
-  } else if (flattenedUpstream) {
-    upstream = flattenedUpstream;
-  }
-  if (!upstream) {
-    return makeError(id, -32602, "Resource URI must be namespaced (mcpx://<server>/<encoded-uri>).", { uri });
-  }
-  const upstreamParams = {
-    ...params,
-    uri: upstreamUri
-  };
-  try {
-    const result = await callUpstream(upstream, method, upstreamParams, id, secrets, runtime, clientAuthorizationHeader);
-    runtime.upstreamErrors?.delete(upstream.name);
-    return makeResult(id, result);
-  } catch (error) {
-    if (isAuthChallenge(error)) {
-      throw error;
-    }
-    const errCode = error instanceof UpstreamError ? error.code : "upstream_error";
-    runtime.upstreamErrors?.set(upstream.name, { code: errCode, message: error.message });
-    return makeError(id, -32000, error.message, { mcpxCode: errCode, upstream: upstream.name });
-  }
-}
-async function handleRequestObject(request, secrets, runtime, upstreamFilter, clientAuthorizationHeader) {
-  const id = request.id ?? null;
-  if (!request.method || typeof request.method !== "string") {
-    return makeError(id, -32600, "Invalid JSON-RPC request: missing method.");
-  }
-  if (request.method === "initialize") {
-    const requestedProtocol = request.params?.protocolVersion;
-    const protocolVersion = typeof requestedProtocol === "string" && requestedProtocol.length > 0 ? requestedProtocol : "2025-11-25";
-    return makeResult(id, {
-      protocolVersion,
-      capabilities: {
-        tools: {},
-        resources: {},
-        prompts: {}
-      },
-      serverInfo: {
-        name: "mcpx",
-        version: SERVER_VERSION
-      }
-    });
-  }
-  if (request.method === "notifications/initialized") {
-    return null;
-  }
-  if (request.method === "ping") {
-    return makeResult(id, { ok: true });
-  }
-  const config = loadMergedConfig();
-  if (upstreamFilter && listUpstreams(config, upstreamFilter).length === 0) {
-    return makeError(id, -32602, `Unknown upstream: ${upstreamFilter}`);
-  }
-  await reconcileUpstreamConnections(config, secrets, runtime);
-  if (request.method === "custom/tokenCounts") {
-    const result = await getUpstreamTokenCounts(config, secrets, runtime);
-    return makeResult(id, result);
-  }
-  if (request.method === "custom/refreshTokenCounts") {
-    runtime.tokenCache?.clear();
-    const result = await getUpstreamTokenCounts(config, secrets, runtime);
-    return makeResult(id, result);
-  }
-  if (request.method === "tools/list") {
-    const result = await handleListTools(config, secrets, runtime, upstreamFilter, clientAuthorizationHeader);
-    return makeResult(id, result);
-  }
-  if (request.method === "resources/list") {
-    const result = await handleListResources(config, secrets, runtime, upstreamFilter, clientAuthorizationHeader);
-    return makeResult(id, result);
-  }
-  if (request.method === "prompts/list") {
-    const result = await handleListPrompts(config, secrets, runtime, upstreamFilter, clientAuthorizationHeader);
-    return makeResult(id, result);
-  }
-  if (request.method === "tools/call" || request.method === "resources/read" || request.method === "prompts/get") {
-    return routeNamespacedCall(config, request.method, request.params, id, secrets, runtime, upstreamFilter, clientAuthorizationHeader);
-  }
-  return makeError(id, -32601, `Unsupported method: ${request.method}`);
-}
-async function maybeHandleWellKnownOAuthRequest(request, response, requestUrl, secrets) {
-  const pathname = requestUrl.pathname;
-  const wellKnownPrefix = getWellKnownPrefix(pathname);
-  if (!wellKnownPrefix) {
-    return false;
-  }
-  if (request.method !== "GET") {
-    response.statusCode = 405;
-    response.setHeader("content-type", "application/json");
-    response.end(JSON.stringify({ error: "method_not_allowed" }));
-    return true;
-  }
-  const config = loadMergedConfig();
-  const requestedUpstream = getRequestedUpstream(requestUrl);
-  const upstream = getScopedHttpUpstream(config, requestedUpstream);
-  if (!upstream) {
-    response.statusCode = 404;
-    response.setHeader("content-type", "application/json");
-    response.end(JSON.stringify({ error: "not_found" }));
-    return true;
-  }
-  if (!isOAuthCapableServer(upstream.spec)) {
-    response.statusCode = 404;
-    response.setHeader("content-type", "application/json");
-    response.end(JSON.stringify({ error: "not_found" }));
-    return true;
-  }
-  const upstreamWellKnownUrl = buildWellKnownUpstreamUrl(upstream, wellKnownPrefix);
-  const headers = {
-    accept: "application/json"
-  };
-  const protocolVersion = request.headers["mcp-protocol-version"];
-  if (typeof protocolVersion === "string" && protocolVersion.length > 0) {
-    headers["mcp-protocol-version"] = protocolVersion;
-  }
-  for (const [key, value] of Object.entries(upstream.spec.headers ?? {})) {
-    if (key.toLowerCase() === "authorization" && isOAuthReference(value)) {
-      try {
-        const accessToken = await getOAuthAccessToken(oauthReferenceServerName(value), upstream.spec, secrets);
-        headers[key] = `Bearer ${accessToken}`;
-      } catch {}
-    } else {
-      headers[key] = secrets.resolveMaybeSecret(value);
-    }
-  }
-  const timeoutController = new AbortController;
-  const timeoutHandle = setTimeout(() => timeoutController.abort(), DEFAULT_CONNECT_TIMEOUT_MS);
-  let upstreamResponse;
-  try {
-    upstreamResponse = await fetch(upstreamWellKnownUrl, {
-      method: "GET",
-      headers,
-      signal: timeoutController.signal
-    });
-  } catch (error) {
-    const isAbort = error.name === "AbortError";
-    response.statusCode = 502;
-    response.setHeader("content-type", "application/json");
-    response.end(JSON.stringify({
-      error: "upstream_unreachable",
-      message: isAbort ? `Well-known request timed out after ${DEFAULT_CONNECT_TIMEOUT_MS}ms.` : error instanceof Error ? error.message : String(error)
-    }));
-    return true;
-  } finally {
-    clearTimeout(timeoutHandle);
-  }
-  let bodyText = await upstreamResponse.text();
-  response.statusCode = upstreamResponse.status;
-  const contentType = upstreamResponse.headers.get("content-type");
-  if (contentType) {
-    response.setHeader("content-type", contentType);
-  }
-  const cacheControl = upstreamResponse.headers.get("cache-control");
-  if (cacheControl) {
-    response.setHeader("cache-control", cacheControl);
-  }
-  const wwwAuthenticate = upstreamResponse.headers.get("www-authenticate");
-  if (wwwAuthenticate) {
-    response.setHeader("www-authenticate", wwwAuthenticate);
-  }
-  if (wellKnownPrefix === "/.well-known/oauth-protected-resource" && contentType?.includes("application/json") && upstreamResponse.ok) {
-    try {
-      const parsed = JSON.parse(bodyText);
-      parsed.resource = appendUpstreamQuery(`${getLocalOriginFromRequest(request)}/mcp`, requestedUpstream);
-      bodyText = JSON.stringify(parsed);
-    } catch {}
-  }
-  response.end(bodyText);
-  return true;
-}
-var SENSITIVE_HEADER_NAMES = new Set(["authorization", "x-mcpx-local-token"]);
-function redactSensitiveHeaders(headers) {
-  const redacted = { ...headers };
-  for (const name of Object.keys(redacted)) {
-    if (SENSITIVE_HEADER_NAMES.has(name.toLowerCase())) {
-      redacted[name] = "[redacted]";
-    }
-  }
-  return redacted;
-}
-function createGatewayServer(options) {
-  const debug = process.env.MCPX_GATEWAY_DEBUG === "1";
-  const runtime = {
-    upstreamConnections: new Map,
-    upstreamErrors: new Map
-  };
-  const server = http2.createServer(async (request, response) => {
-    let requestUrl = new URL2(request.url ?? "/", `http://${request.headers.host ?? "127.0.0.1"}`);
-    try {
-      requestUrl = new URL2(request.url ?? "/", `http://${request.headers.host ?? "127.0.0.1"}`);
-      const upstreamFilter = getRequestedUpstream(requestUrl);
-      if (debug) {
-        console.error(`[mcpx gateway] ${request.method ?? "?"} ${requestUrl.pathname} auth=${request.headers.authorization ? "yes" : "no"} accept=${request.headers.accept ?? ""}`);
-        console.error(`[mcpx gateway] headers=${JSON.stringify(redactSensitiveHeaders(request.headers))}`);
-      }
-      if (await maybeHandleWellKnownOAuthRequest(request, response, requestUrl, options.secrets)) {
-        if (debug) {
-          console.error(`[mcpx gateway] -> ${response.statusCode} (well-known oauth)`);
-        }
-        return;
-      }
-      if (requestUrl.pathname !== "/mcp") {
-        response.statusCode = 404;
-        response.setHeader("content-type", "application/json");
-        response.end(JSON.stringify({ error: "not_found" }));
-        if (debug) {
-          console.error(`[mcpx gateway] -> 404`);
-        }
-        return;
-      }
-      if (request.method === "GET") {
-        if (!authHeaderIsValid(request, options.expectedToken)) {
-          response.statusCode = 401;
-          response.setHeader("content-type", "application/json");
-          response.end(JSON.stringify(makeError(null, -32001, "Unauthorized")));
-          if (debug) {
-            console.error(`[mcpx gateway] -> 401 (GET unauthorized)`);
-          }
-          return;
-        }
-        const wantsStream = (request.headers.accept ?? "").includes("text/event-stream");
-        if (wantsStream && request.headers["mcp-session-id"]) {
-          response.statusCode = 405;
-          response.setHeader("content-type", "application/json");
-          response.end(JSON.stringify({ error: "get_stream_not_supported", message: "mcpx does not support server-initiated SSE streams over GET; use POST for all requests." }));
-          if (debug) {
-            console.error(`[mcpx gateway] -> 405 (GET stream not supported)`);
-          }
-          return;
-        }
-        response.statusCode = 200;
-        response.setHeader("content-type", "application/json");
-        response.end(JSON.stringify({ ok: true, server: "mcpx" }));
-        if (debug) {
-          console.error(`[mcpx gateway] -> 200 (GET ok)`);
-        }
-        return;
-      }
-      if (request.method !== "POST") {
-        response.statusCode = 405;
-        response.end("Method Not Allowed");
-        if (debug) {
-          console.error(`[mcpx gateway] -> 405`);
-        }
-        return;
-      }
-      if (!authHeaderIsValid(request, options.expectedToken)) {
-        response.statusCode = 401;
-        response.setHeader("content-type", "application/json");
-        response.end(JSON.stringify(makeError(null, -32001, "Unauthorized")));
-        if (debug) {
-          console.error(`[mcpx gateway] -> 401 (POST unauthorized)`);
-        }
-        return;
-      }
-      let body = "";
-      request.setEncoding("utf8");
-      for await (const chunk of request) {
-        body += chunk;
-        if (body.length > 1e7) {
-          response.statusCode = 413;
-          response.end("Payload Too Large");
-          if (debug) {
-            console.error(`[mcpx gateway] -> 413`);
-          }
-          return;
-        }
-      }
-      const parsed = JSON.parse(body);
-      const hasInitialize = Array.isArray(parsed) ? parsed.some((item) => item.method === "initialize") : parsed.method === "initialize";
-      const responses = [];
-      const clientAuthorizationHeader = getClientAuthorizationForUpstream(request, options.expectedToken);
-      if (Array.isArray(parsed)) {
-        for (const item of parsed) {
-          if (debug) {
-            console.error(`[mcpx gateway] rpc method=${item.method} id=${item.id ?? "null"}`);
-          }
-          const rpcResponse = await handleRequestObject(item, options.secrets, runtime, upstreamFilter, clientAuthorizationHeader);
-          if (debug && rpcResponse?.error) {
-            console.error(`[mcpx gateway] rpc error code=${rpcResponse.error.code} message=${rpcResponse.error.message}`);
-          }
-          if (rpcResponse) {
-            responses.push(rpcResponse);
-          }
-        }
-      } else {
-        if (debug) {
-          console.error(`[mcpx gateway] rpc method=${parsed.method} id=${parsed.id ?? "null"}`);
-          if (parsed.method === "initialize") {
-            console.error(`[mcpx gateway] rpc initialize params=${JSON.stringify(parsed.params ?? {})}`);
-          }
-        }
-        const rpcResponse = await handleRequestObject(parsed, options.secrets, runtime, upstreamFilter, clientAuthorizationHeader);
-        if (debug && rpcResponse?.error) {
-          console.error(`[mcpx gateway] rpc error code=${rpcResponse.error.code} message=${rpcResponse.error.message}`);
-        }
-        if (rpcResponse) {
-          responses.push(rpcResponse);
-        }
-      }
-      response.statusCode = 200;
-      const acceptsSse = (request.headers.accept ?? "").includes("text/event-stream");
-      if (acceptsSse) {
-        response.setHeader("content-type", "text/event-stream");
-        response.setHeader("cache-control", "no-cache");
-        response.setHeader("connection", "keep-alive");
-      } else {
-        response.setHeader("content-type", "application/json");
-      }
-      if (hasInitialize) {
-        const sessionId = crypto2.randomUUID();
-        response.setHeader("mcp-session-id", sessionId);
-        response.setHeader("MCP-Session-Id", sessionId);
-      }
-      if (debug) {
-        console.error(`[mcpx gateway] -> 200 (rpc)`);
-      }
-      if (acceptsSse) {
-        const payloads = responses.length > 0 ? responses : [];
-        for (const payload of payloads) {
-          response.write(`event: message
-`);
-          response.write(`data: ${JSON.stringify(payload)}
-
-`);
-        }
-        response.end();
-      } else if (responses.length === 1) {
-        response.end(JSON.stringify(responses[0]));
-      } else {
-        response.end(JSON.stringify(responses));
-      }
-    } catch (error) {
-      if (isAuthChallenge(error)) {
-        response.statusCode = error.status ?? 401;
-        response.setHeader("content-type", "application/json");
-        if (error.wwwAuthenticate) {
-          const localResourceMetadataUrl = appendUpstreamQuery(`${getLocalOriginFromRequest(request)}/.well-known/oauth-protected-resource`, getRequestedUpstream(requestUrl));
-          response.setHeader("www-authenticate", rewriteWwwAuthenticateResourceMetadata(error.wwwAuthenticate, localResourceMetadataUrl));
-        }
-        response.end(JSON.stringify(makeError(null, -32001, "Upstream authentication required.", {
-          mcpxCode: error.code,
-          status: error.status,
-          upstream: error.upstream
-        })));
-        if (debug) {
-          console.error(`[mcpx gateway] -> ${error.status} upstream auth challenge`);
-        }
-        return;
-      }
-      response.statusCode = 500;
-      response.setHeader("content-type", "application/json");
-      response.end(JSON.stringify(makeError(null, -32000, error.message)));
-      if (debug) {
-        console.error(`[mcpx gateway] -> 500 ${error.message}`);
-      }
-    }
-  });
-  server.on("close", () => {
-    for (const entry of runtime.upstreamConnections.values()) {
-      closeUpstreamConnection(entry);
-    }
-    runtime.upstreamConnections.clear();
-  });
-  server.listen(options.port, "127.0.0.1");
-  return server;
-}
-
-// src/core/daemon.ts
-function buildDaemonChildEnv(baseEnv = process.env, electronRuntime = typeof process.versions.electron === "string") {
-  return {
-    ...baseEnv,
-    MCPX_DAEMON_CHILD: "1",
-    ...electronRuntime ? { ELECTRON_RUN_AS_NODE: "1" } : {}
-  };
-}
-function readPidRecordFromFile(pidPath = getPidPath()) {
-  if (!fs6.existsSync(pidPath)) {
-    return null;
-  }
-  const raw = fs6.readFileSync(pidPath, "utf8").trim();
-  if (!raw) {
-    return null;
-  }
-  const [pidRaw, portRaw] = raw.split(":");
-  const pid = Number(pidRaw);
-  if (!Number.isFinite(pid) || pid <= 0) {
-    return null;
-  }
-  const port = portRaw ? Number(portRaw) : null;
-  return { pid, port: Number.isFinite(port) && port > 0 ? port : null };
-}
-function readPidFromFile(pidPath = getPidPath()) {
-  return readPidRecordFromFile(pidPath)?.pid ?? null;
-}
-function processExists(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function isPortAvailable(port) {
-  return new Promise((resolve) => {
-    const tester = net.createServer();
-    tester.once("error", () => {
-      resolve(false);
-    });
-    tester.once("listening", () => {
-      tester.close(() => resolve(true));
-    });
-    tester.listen(port, "127.0.0.1");
-  });
-}
-async function resolveGatewayPort(config, secrets) {
-  if (await isPortAvailable(config.gateway.port)) {
-    return { port: config.gateway.port };
-  }
-  for (let offset = 1;offset <= 20; offset += 1) {
-    const candidate = config.gateway.port + offset;
-    if (candidate > 65535) {
-      break;
-    }
-    if (await isPortAvailable(candidate)) {
-      const oldPort = config.gateway.port;
-      config.gateway.port = candidate;
-      saveConfig(config);
-      if (secrets) {
-        try {
-          const summary = syncAllClients(config, secrets);
-          persistSyncState(summary, config);
-          saveConfig(config);
-        } catch {}
-      }
-      return { port: candidate, fellBackFrom: oldPort };
-    }
-  }
-  throw new Error(`No available local port found near ${config.gateway.port}.`);
-}
-async function waitForGatewayReady(port, token, timeoutMs = 15000) {
-  const deadline = Date.now() + timeoutMs;
-  let lastError;
-  while (Date.now() < deadline) {
-    try {
-      const response = await fetch(`http://127.0.0.1:${port}/mcp`, {
-        method: "GET",
-        headers: {
-          Authorization: `Bearer ${token}`
-        },
-        signal: AbortSignal.timeout(500)
-      });
-      if (response.ok) {
-        return;
-      }
-      lastError = new Error(`Gateway returned HTTP ${response.status}.`);
-    } catch (error) {
-      lastError = error;
-    }
-    await new Promise((resolve) => setTimeout(resolve, 100));
-  }
-  throw new Error(`Gateway did not become ready within ${timeoutMs}ms: ${lastError instanceof Error ? lastError.message : String(lastError)}`);
-}
-function getDaemonStatus(config) {
-  const pidPath = getPidPath();
-  const record = readPidRecordFromFile(pidPath);
-  if (!record) {
-    return {
-      running: false,
-      pidFile: pidPath,
-      logFile: getLogPath(),
-      port: config.gateway.port
-    };
-  }
-  const running = processExists(record.pid);
-  const port = record.port ?? config.gateway.port;
-  return {
-    running,
-    pid: record.pid,
-    pidFile: pidPath,
-    logFile: getLogPath(),
-    port,
-    portMismatch: running && record.port !== null && record.port !== config.gateway.port
-  };
-}
-async function startDaemon(config, cliPath, secrets) {
-  const existingStatus = getDaemonStatus(config);
-  if (existingStatus.running && existingStatus.pid) {
-    return {
-      started: false,
-      pid: existingStatus.pid,
-      port: existingStatus.port ?? config.gateway.port,
-      message: "mcpx daemon already running."
-    };
-  }
-  const { port, fellBackFrom } = await resolveGatewayPort(config, secrets);
-  if (fellBackFrom) {
-    process.stderr.write(`mcpx: port ${fellBackFrom} was unavailable; gateway started on ${port} instead. All client configs were re-synced to the new port.
-`);
-  }
-  const token = ensureGatewayToken(config, secrets);
-  const pidPath = getPidPath();
-  const logPath = getLogPath();
-  ensureParentDir(pidPath);
-  ensureParentDir(logPath);
-  let logFd = fs6.openSync(logPath, "a", 384);
-  const logStat = fs6.fstatSync(logFd);
-  if (logStat.size > 10 * 1024 * 1024) {
-    fs6.closeSync(logFd);
-    const log1 = `${logPath}.1`;
-    const log2 = `${logPath}.2`;
-    try {
-      if (fs6.existsSync(log2))
-        fs6.unlinkSync(log2);
-    } catch {}
-    try {
-      if (fs6.existsSync(log1))
-        fs6.renameSync(log1, log2);
-    } catch {}
-    try {
-      fs6.renameSync(logPath, log1);
-    } catch {}
-    logFd = fs6.openSync(logPath, "a", 384);
-  }
-  const child = spawn2(process.execPath, [cliPath, "daemon", "run", "--port", String(port)], {
-    detached: true,
-    stdio: ["ignore", logFd, logFd],
-    env: buildDaemonChildEnv()
-  });
-  child.unref();
-  fs6.writeFileSync(pidPath, `${child.pid}:${port}
-`, { mode: 384 });
-  startBackgroundUpdateCheck();
-  await waitForGatewayReady(port, token);
-  return {
-    started: true,
-    pid: child.pid ?? -1,
-    port,
-    message: "mcpx daemon started."
-  };
-}
-function stopDaemon() {
-  const pidPath = getPidPath();
-  const pid = readPidFromFile(pidPath);
-  if (!pid) {
-    return {
-      stopped: false,
-      message: "mcpx daemon is not running."
-    };
-  }
-  try {
-    const cmd = execFileSync2("ps", ["-p", String(pid), "-o", "command="], { encoding: "utf8", timeout: 2000 }).trim();
-    const looksLikeMcpxDaemon = cmd.includes("daemon run") && (cmd.includes("mcpx") || cmd.includes("cli.js"));
-    if (!looksLikeMcpxDaemon) {
-      fs6.unlinkSync(pidPath);
-      return {
-        stopped: false,
-        message: `PID ${pid} is not a mcpx daemon (command: ${cmd.slice(0, 80)}). Pidfile cleaned up.`
-      };
-    }
-  } catch {
-    try {
-      fs6.unlinkSync(pidPath);
-    } catch {}
-    return {
-      stopped: false,
-      message: `PID ${pid} not found. Pidfile cleaned up.`
-    };
-  }
-  try {
-    process.kill(pid, "SIGTERM");
-  } catch {}
-  try {
-    fs6.unlinkSync(pidPath);
-  } catch {}
-  return {
-    stopped: true,
-    message: `Stopped mcpx daemon (pid ${pid}).`
-  };
-}
-async function restartDaemon(config, cliPath, secrets) {
-  stopDaemon();
-  return startDaemon(config, cliPath, secrets);
-}
-function readDaemonLogs(maxLines = 200) {
-  const logPath = getLogPath();
-  if (!fs6.existsSync(logPath)) {
-    return "";
-  }
-  const lines = fs6.readFileSync(logPath, "utf8").split(`
-`);
-  return lines.slice(Math.max(lines.length - maxLines, 0)).join(`
-`);
-}
-function runDaemonForeground(config, port, secrets) {
-  return new Promise((resolve, reject) => {
-    const token = ensureGatewayToken(config, secrets);
-    const server = createGatewayServer({
-      port,
-      expectedToken: token,
-      secrets
-    });
-    const stopMarketplaceUpdater = startMarketplaceAutoUpdater();
-    const cleanup = () => {
-      stopMarketplaceUpdater();
-      server.close(() => resolve());
-    };
-    process.on("SIGINT", cleanup);
-    process.on("SIGTERM", cleanup);
-    server.on("error", (error) => {
-      reject(error);
-    });
-  });
-}
-
-// src/core/status.ts
-var STATUS_CLIENTS = ["claude", "claude-desktop", "codex", "cursor", "cline", "opencode", "kiro", "vscode", "qwen", "openclaw", "hermes"];
-function describeServerTarget(spec) {
-  if (spec.transport === "http") {
-    return spec.url;
-  }
-  const args = (spec.args ?? []).join(" ");
-  const command = `${spec.command}${args ? ` ${args}` : ""}`;
-  return spec.cwd ? `${command} (cwd: ${spec.cwd})` : command;
-}
-function deriveClientStatus(managed, configured) {
-  if (configured) {
-    return configured;
-  }
-  return managed ? "SYNCED" : "SKIPPED";
-}
-function buildClientMappings(config, managedIndex, serverName) {
-  return STATUS_CLIENTS.map((clientId) => {
-    const configState = config.clients[clientId];
-    const managedClient = managedIndex.managed[clientId];
-    const managedEntry = managedClient?.entries?.[`${serverName} (mcpx)`];
-    const managed = Boolean(managedEntry);
-    return {
-      clientId,
-      managed,
-      status: deriveClientStatus(managed, configState?.status),
-      configPath: managedClient?.configPath ?? configState?.configPath,
-      message: configState?.message,
-      lastSyncAt: managedEntry?.lastSyncedAt ?? configState?.lastSyncAt
-    };
-  });
-}
-function buildAuthBindings(spec) {
-  return listAuthBindings(spec).map((binding) => ({
-    kind: binding.kind,
-    key: binding.key,
-    value: binding.value,
-    secretName: secretRefName(binding.value) ?? undefined
-  }));
-}
-async function fetchTokenCounts(gatewayUrl, token) {
-  try {
-    const res = await fetch(gatewayUrl, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        authorization: `Bearer ${token}`
-      },
-      body: JSON.stringify({
-        jsonrpc: "2.0",
-        id: "status-tokens",
-        method: "custom/tokenCounts",
-        params: {}
-      }),
-      signal: AbortSignal.timeout(65000)
-    });
-    if (!res.ok) {
-      return { counts: {}, fetchError: `HTTP ${res.status}` };
-    }
-    const data = await res.json();
-    return { counts: data?.result ?? {} };
-  } catch (error) {
-    return { counts: {}, fetchError: error instanceof Error ? error.message : String(error) };
-  }
-}
-async function buildStatusReport(config, managedIndex, daemon = getDaemonStatus(config)) {
-  const secrets = new SecretsManager;
-  const token = ensureGatewayToken(config, secrets);
-  const gatewayUrl = getGatewayUrl(config);
-  let tokenCounts = {};
-  let tokenCountFetchError;
-  if (daemon.running) {
-    const result = await fetchTokenCounts(gatewayUrl, token);
-    tokenCounts = result.counts;
-    tokenCountFetchError = result.fetchError;
-  }
-  const projectEntries = Object.values(config.projects ?? {});
-  let totalGlobalTokens = 0;
-  const totalProjectTokens = {};
-  const serverNames = Object.keys(config.servers).sort((left, right) => left.localeCompare(right));
-  const servers = serverNames.map((name) => {
-    const spec = config.servers[name];
-    let tokenCount = tokenCounts[name];
-    if (tokenCount?.error && buildAuthBindings(spec).length > 0 && tokenCount.total > 0) {
-      tokenCount = { ...tokenCount, error: undefined };
-    }
-    const health = tokenCount ? tokenCount.error || tokenCount.runtimeError ? "error" : "ok" : "unknown";
-    const serverEntry = {
-      name,
-      enabled: isServerEnabled(spec),
-      transport: spec.transport,
-      target: describeServerTarget(spec),
-      authBindings: buildAuthBindings(spec),
-      clients: buildClientMappings(config, managedIndex, name),
-      tokenCount,
-      health
-    };
-    if (serverEntry.enabled && tokenCount) {
-      totalGlobalTokens += tokenCount.total;
-      for (const projectEntry of projectEntries) {
-        if (!(projectEntry.disabledServers ?? []).includes(name)) {
-          totalProjectTokens[projectEntry.path] = (totalProjectTokens[projectEntry.path] ?? 0) + tokenCount.total;
-        }
-      }
-    }
-    return serverEntry;
-  });
-  return {
-    gatewayUrl,
-    daemon,
-    upstreamCount: servers.length,
-    servers,
-    clients: config.clients,
-    projects: config.projects,
-    totalGlobalTokens,
-    totalProjectTokens
-  };
-}
-
-export { isOAuthReference, oauthReferenceServerName, __resetOAuthSupportCache, probeOAuthSupport, OAUTH_LOGIN_TIMEOUT_MS, OAuthCancelledError, OAuthLoginInProgressError, runOAuthLogin, getOAuthAccessToken, oauthSecretNames, clearOAuthCredentials, getOAuthCredentialStatus, probeHttpAuthRequirement, fetchRegistryServerDetail, selectBestPackage, extractRequiredInputs, mapRegistryToSpec, toSecretRef, secretRefName, defaultAuthSecretName, resolveAuthTarget, applyAuthReference, removeAuthReference, listAuthBindings, maybePrefixBearer, buildEnrichedPath, compareVersions, checkForUpdates, getStagedUpdate, shouldUseStagedCli, clearStagedUpdate, getStagedCliPath, startBackgroundUpdateCheck, runBackgroundUpdate, performUpdate, performRollback, runMarketplaceAutoUpdate, startMarketplaceAutoUpdater, getDaemonStatus, startDaemon, stopDaemon, restartDaemon, readDaemonLogs, runDaemonForeground, STATUS_CLIENTS, buildStatusReport };