@kwonye/mcpx 0.1.68 → 0.1.74

package/dist/cli-ezvj44tr.js

@@ -0,0 +1,3292 @@
+import {
+  isServerEnabled,
+  normalizeServerSpecEnabled
+} from "./cli-q8de7zb0.js";
+
+// src/core/paths.ts
+import os from "node:os";
+import path from "node:path";
+import fs from "node:fs";
+function envOrDefault(value, fallback) {
+  if (value && value.trim().length > 0) {
+    return value;
+  }
+  return fallback;
+}
+function homeDir() {
+  return process.env.HOME ?? os.homedir();
+}
+function getConfigRoot() {
+  return envOrDefault(process.env.MCPX_CONFIG_HOME ?? process.env.XDG_CONFIG_HOME, path.join(homeDir(), ".config"));
+}
+function getDataRoot() {
+  return envOrDefault(process.env.MCPX_DATA_HOME ?? process.env.XDG_DATA_HOME, path.join(homeDir(), ".local", "share"));
+}
+function getStateRoot() {
+  return envOrDefault(process.env.MCPX_STATE_HOME ?? process.env.XDG_STATE_HOME, path.join(homeDir(), ".local", "state"));
+}
+function getConfigPath() {
+  return path.join(getConfigRoot(), "mcpx", "config.json");
+}
+function getManagedIndexPath() {
+  return path.join(getDataRoot(), "mcpx", "managed-index.json");
+}
+function getSecretNamesPath() {
+  return path.join(getDataRoot(), "mcpx", "secret-names.json");
+}
+function getRuntimeDir() {
+  return path.join(getStateRoot(), "mcpx", "runtime");
+}
+function getLogDir() {
+  return path.join(getStateRoot(), "mcpx", "logs");
+}
+function getPidPath() {
+  return path.join(getRuntimeDir(), "daemon.pid");
+}
+function getLogPath() {
+  return path.join(getLogDir(), "daemon.log");
+}
+function getUpdatesDir() {
+  return path.join(getDataRoot(), "mcpx", "updates");
+}
+function getStagedVersionPath() {
+  return path.join(getUpdatesDir(), "staged-version.json");
+}
+function getUpdateLockPath() {
+  return path.join(getUpdatesDir(), ".update.lock");
+}
+function ensureDir(dirPath) {
+  fs.mkdirSync(dirPath, { recursive: true });
+}
+function ensureParentDir(filePath) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+}
+
+// src/core/config.ts
+import { z } from "zod";
+
+// src/util/fs.ts
+import fs2 from "node:fs";
+import path2 from "node:path";
+import crypto from "node:crypto";
+function readJsonFile(filePath, fallback) {
+  if (!fs2.existsSync(filePath)) {
+    return fallback;
+  }
+  try {
+    const raw = fs2.readFileSync(filePath, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return fallback;
+  }
+}
+function writeJsonAtomic(filePath, data) {
+  fs2.mkdirSync(path2.dirname(filePath), { recursive: true });
+  const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
+  const content = `${JSON.stringify(data, null, 2)}
+`;
+  fs2.writeFileSync(tempPath, content, { mode: 384 });
+  fs2.renameSync(tempPath, filePath);
+}
+function sha256(value) {
+  return crypto.createHash("sha256").update(value).digest("hex");
+}
+
+// src/core/config.ts
+var clientStateSchema = z.object({
+  status: z.enum(["SYNCED", "UNSUPPORTED_HTTP", "ERROR", "SKIPPED"]),
+  lastSyncAt: z.string().optional(),
+  message: z.string().optional(),
+  configPath: z.string().optional()
+});
+var httpServerSchema = z.object({
+  transport: z.literal("http"),
+  url: z.url(),
+  headers: z.record(z.string(), z.string()).optional(),
+  enabled: z.boolean().default(true)
+});
+var stdioServerSchema = z.object({
+  transport: z.literal("stdio"),
+  command: z.string().min(1),
+  args: z.array(z.string()).optional(),
+  env: z.record(z.string(), z.string()).optional(),
+  cwd: z.string().min(1).optional(),
+  enabled: z.boolean().default(true)
+});
+var serverSchema = z.discriminatedUnion("transport", [httpServerSchema, stdioServerSchema]);
+var configSchema = z.object({
+  schemaVersion: z.literal(1).default(1),
+  gateway: z.object({
+    port: z.number().int().min(1).max(65535).default(37373),
+    tokenRef: z.string().default("secret://local_gateway_token"),
+    autoStart: z.boolean().default(true)
+  }).default({
+    port: 37373,
+    tokenRef: "secret://local_gateway_token",
+    autoStart: true
+  }),
+  servers: z.record(z.string(), serverSchema).default({}),
+  clients: z.record(z.string(), clientStateSchema).default({})
+});
+function defaultConfig() {
+  return {
+    schemaVersion: 1,
+    gateway: {
+      port: 37373,
+      tokenRef: "secret://local_gateway_token",
+      autoStart: true
+    },
+    servers: {},
+    clients: {}
+  };
+}
+function loadConfig(configPath = getConfigPath()) {
+  const raw = readJsonFile(configPath, defaultConfig());
+  const parsed = configSchema.safeParse(raw);
+  if (!parsed.success) {
+    return defaultConfig();
+  }
+  const clientEntries = {};
+  for (const [key, value] of Object.entries(parsed.data.clients)) {
+    if (["claude", "claude-desktop", "codex", "cursor", "cline", "opencode", "kiro", "vscode", "qwen"].includes(key)) {
+      clientEntries[key] = value;
+    }
+  }
+  const servers = Object.fromEntries(Object.entries(parsed.data.servers).map(([name, spec]) => [name, normalizeServerSpecEnabled(spec)]));
+  return {
+    schemaVersion: 1,
+    gateway: parsed.data.gateway,
+    servers,
+    clients: clientEntries
+  };
+}
+function saveConfig(config, configPath = getConfigPath()) {
+  config.servers = Object.fromEntries(Object.entries(config.servers).map(([name, spec]) => [name, normalizeServerSpecEnabled(spec)]));
+  writeJsonAtomic(configPath, config);
+}
+
+// src/core/registry.ts
+function validateServerName(name) {
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,62}$/.test(name)) {
+    throw new Error("Invalid server name. Use 1-63 chars: letters, numbers, '.', '-', '_' and start with alphanumeric.");
+  }
+}
+function addServer(config, name, spec, force = false) {
+  validateServerName(name);
+  if (config.servers[name] && !force) {
+    throw new Error(`Server "${name}" already exists. Use --force to overwrite.`);
+  }
+  config.servers[name] = normalizeServerSpecEnabled(spec);
+}
+function removeServer(config, name, force = false) {
+  if (!config.servers[name] && !force) {
+    throw new Error(`Server "${name}" does not exist.`);
+  }
+  delete config.servers[name];
+}
+function updateServer(config, name, spec) {
+  validateServerName(name);
+  if (!config.servers[name]) {
+    throw new Error(`Server "${name}" does not exist.`);
+  }
+  config.servers[name] = normalizeServerSpecEnabled(spec);
+}
+function setServerEnabled(config, name, enabled) {
+  const existing = config.servers[name];
+  if (!existing) {
+    throw new Error(`Server "${name}" does not exist.`);
+  }
+  config.servers[name] = {
+    ...existing,
+    enabled
+  };
+}
+function getGatewayTokenSecretName(config) {
+  if (!config.gateway.tokenRef.startsWith("secret://")) {
+    return "local_gateway_token";
+  }
+  return config.gateway.tokenRef.slice("secret://".length) || "local_gateway_token";
+}
+function ensureGatewayToken(config, secrets) {
+  const secretName = getGatewayTokenSecretName(config);
+  const existing = secrets.getSecret(secretName);
+  if (existing) {
+    return existing;
+  }
+  return secrets.rotateLocalToken(secretName);
+}
+
+// src/core/secrets.ts
+import { execFileSync } from "node:child_process";
+import crypto2 from "node:crypto";
+import fs3 from "node:fs";
+function parseSecretRef(ref) {
+  if (!ref.startsWith("secret://")) {
+    return null;
+  }
+  const name = ref.slice("secret://".length);
+  return name.length > 0 ? name : null;
+}
+
+class SecretsManager {
+  service;
+  nameIndexPath;
+  constructor(service = "mcpx", nameIndexPath = getSecretNamesPath()) {
+    this.service = service;
+    this.nameIndexPath = nameIndexPath;
+  }
+  loadNameIndex() {
+    return readJsonFile(this.nameIndexPath, { names: [] });
+  }
+  saveNameIndex(index) {
+    const deduped = Array.from(new Set(index.names)).sort();
+    writeJsonAtomic(this.nameIndexPath, { names: deduped });
+  }
+  trackSecretName(name) {
+    const index = this.loadNameIndex();
+    if (!index.names.includes(name)) {
+      index.names.push(name);
+      this.saveNameIndex(index);
+    }
+  }
+  untrackSecretName(name) {
+    const index = this.loadNameIndex();
+    index.names = index.names.filter((entry) => entry !== name);
+    this.saveNameIndex(index);
+  }
+  listSecretNames() {
+    return this.loadNameIndex().names;
+  }
+  setSecret(name, value) {
+    if (process.platform !== "darwin") {
+      throw new Error("OS keychain integration is currently implemented for macOS only.");
+    }
+    execFileSync("security", ["add-generic-password", "-U", "-a", name, "-s", this.service, "-w", value], {
+      stdio: "ignore"
+    });
+    this.trackSecretName(name);
+  }
+  removeSecret(name) {
+    if (process.platform === "darwin") {
+      try {
+        execFileSync("security", ["delete-generic-password", "-a", name, "-s", this.service], {
+          stdio: "ignore"
+        });
+      } catch {}
+    }
+    this.untrackSecretName(name);
+  }
+  getSecret(name) {
+    const envOverride = process.env[`MCPX_SECRET_${name}`];
+    if (envOverride && envOverride.length > 0) {
+      return envOverride;
+    }
+    if (process.platform !== "darwin") {
+      return null;
+    }
+    try {
+      return execFileSync("security", ["find-generic-password", "-w", "-a", name, "-s", this.service], {
+        encoding: "utf8"
+      }).trim();
+    } catch {
+      return null;
+    }
+  }
+  resolveMaybeSecret(value) {
+    const secretName = parseSecretRef(value);
+    if (!secretName) {
+      return value;
+    }
+    const secret = this.getSecret(secretName);
+    if (!secret) {
+      throw new Error(`Secret not found: ${secretName}`);
+    }
+    return secret;
+  }
+  rotateLocalToken(secretName = "local_gateway_token") {
+    const token = crypto2.randomBytes(32).toString("base64url");
+    this.setSecret(secretName, token);
+    return token;
+  }
+}
+function readSecretValueFromStdin() {
+  if (process.stdin.isTTY) {
+    throw new Error("No value provided. Use --value or pipe a value via stdin.");
+  }
+  const content = fs3.readFileSync(process.stdin.fd, "utf8").trim();
+  if (content.length === 0) {
+    throw new Error("Empty secret value provided.");
+  }
+  return content;
+}
+
+// src/core/auth-probe.ts
+var JSON_RPC_VERSION = "2.0";
+var DEFAULT_AUTH_PROBE_TIMEOUT_MS = 8000;
+function resolveHeaders(spec, secrets) {
+  const headers = {
+    "content-type": "application/json",
+    accept: "application/json, text/event-stream"
+  };
+  for (const [key, value] of Object.entries(spec.headers ?? {})) {
+    headers[key] = secrets.resolveMaybeSecret(value);
+  }
+  return headers;
+}
+async function probeHttpAuthRequirement(spec, secrets, timeoutMs = DEFAULT_AUTH_PROBE_TIMEOUT_MS) {
+  const timeoutController = new AbortController;
+  const timeoutHandle = setTimeout(() => timeoutController.abort(), timeoutMs);
+  try {
+    const headers = resolveHeaders(spec, secrets);
+    const response = await fetch(spec.url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        jsonrpc: JSON_RPC_VERSION,
+        id: "mcpx-auth-probe",
+        method: "tools/list",
+        params: {}
+      }),
+      signal: timeoutController.signal
+    });
+    if (response.status === 401 || response.status === 403) {
+      return {
+        authRequired: true,
+        status: response.status,
+        wwwAuthenticate: response.headers.get("www-authenticate") ?? undefined
+      };
+    }
+    return {
+      authRequired: false,
+      status: response.status
+    };
+  } catch (error) {
+    const isAbort = error.name === "AbortError";
+    return {
+      authRequired: false,
+      error: isAbort ? `Auth probe timed out after ${timeoutMs}ms.` : error.message
+    };
+  } finally {
+    clearTimeout(timeoutHandle);
+  }
+}
+
+// src/adapters/claude.ts
+import path3 from "node:path";
+import { z as z2 } from "zod";
+
+// src/adapters/utils/index.ts
+function getManagedEntryNames(managedIndex, clientId) {
+  return Object.keys(managedIndex.managed[clientId]?.entries ?? {});
+}
+function isManagedEntry(managedIndex, clientId, entryName) {
+  return Boolean(managedIndex.managed[clientId]?.entries?.[entryName]);
+}
+function pruneStaleManagedEntries(managedIndex, clientId, servers, keepEntryNames) {
+  const keep = new Set(keepEntryNames);
+  const managedNames = getManagedEntryNames(managedIndex, clientId);
+  for (const name of managedNames) {
+    if (!keep.has(name)) {
+      delete servers[name];
+    }
+  }
+}
+function ensureManagedEntryWritable(managedIndex, clientId, entryName, existingValue) {
+  if (existingValue === undefined || existingValue === null) {
+    return null;
+  }
+  if (isManagedEntry(managedIndex, clientId, entryName)) {
+    return null;
+  }
+  return `Cannot sync managed entry "${entryName}" because an unmanaged entry already exists.`;
+}
+function setManagedEntries(managedIndex, clientId, configPath, entries) {
+  if (!managedIndex.managed[clientId]) {
+    managedIndex.managed[clientId] = {
+      configPath,
+      entries: {}
+    };
+  }
+  managedIndex.managed[clientId].configPath = configPath;
+  managedIndex.managed[clientId].entries = Object.fromEntries(Object.entries(entries).map(([entryName, serializedEntry]) => [entryName, {
+    fingerprint: sha256(serializedEntry),
+    lastSyncedAt: new Date().toISOString()
+  }]));
+}
+function okResult(clientId, configPath, message) {
+  return {
+    clientId,
+    status: "SYNCED",
+    configPath,
+    message
+  };
+}
+function errorResult(clientId, configPath, message) {
+  return {
+    clientId,
+    status: "ERROR",
+    configPath,
+    message
+  };
+}
+function isManagedGatewayProjection(entryName) {
+  return entryName.endsWith(" (mcpx)");
+}
+function sortRecord(record) {
+  if (!record || Object.keys(record).length === 0) {
+    return;
+  }
+  return Object.fromEntries(Object.entries(record).sort(([left], [right]) => left.localeCompare(right)));
+}
+function normalizeServerSpec(spec) {
+  if (spec.transport === "http") {
+    return {
+      transport: "http",
+      url: spec.url,
+      headers: sortRecord(spec.headers)
+    };
+  }
+  return {
+    transport: "stdio",
+    command: spec.command,
+    args: spec.args && spec.args.length > 0 ? [...spec.args] : undefined,
+    env: sortRecord(spec.env),
+    cwd: spec.cwd
+  };
+}
+function serializeServerSpec(spec) {
+  return JSON.stringify(normalizeServerSpec(spec));
+}
+function serverSpecsEqual(left, right) {
+  return serializeServerSpec(left) === serializeServerSpec(right);
+}
+function emptyImportScan(clientId, configPath) {
+  return {
+    clientId,
+    configPath,
+    candidates: [],
+    skipped: []
+  };
+}
+function buildImportSkip(clientId, sourceEntryName, reason, configPath, serverName = sourceEntryName) {
+  return {
+    clientId,
+    configPath,
+    sourceEntryName,
+    serverName,
+    reason
+  };
+}
+function removeSourceEntries(entries, names) {
+  for (const name of names ?? []) {
+    delete entries[name];
+  }
+}
+function syncDisabledMcpServersArray(raw, managedNames, managedEntries) {
+  const existingDisabled = (raw.disabledMcpServers ?? []).filter((name) => !managedNames.includes(name));
+  const disabledManaged = managedEntries.filter((entry) => !entry.enabled).map((entry) => entry.name);
+  raw.disabledMcpServers = [...existingDisabled, ...disabledManaged];
+}
+function syncMcpExcludedArray(raw, managedNames, managedEntries) {
+  const mcp = raw.mcp ?? {};
+  const existingExcluded = (mcp.excluded ?? []).filter((name) => !managedNames.includes(name));
+  const disabledManaged = managedEntries.filter((entry) => !entry.enabled).map((entry) => entry.name);
+  mcp.excluded = [...existingExcluded, ...disabledManaged];
+  raw.mcp = mcp;
+}
+
+// src/adapters/claude.ts
+var stringMapSchema = z2.record(z2.string(), z2.string());
+var claudeEntrySchema = z2.object({
+  type: z2.string().optional(),
+  url: z2.string().min(1).optional(),
+  headers: stringMapSchema.optional(),
+  command: z2.string().min(1).optional(),
+  args: z2.array(z2.string()).optional(),
+  env: stringMapSchema.optional(),
+  cwd: z2.string().min(1).optional(),
+  disabled: z2.boolean().optional()
+}).passthrough();
+
+class ClaudeAdapter {
+  id = "claude";
+  detectConfigPath() {
+    return path3.join(homeDir(), ".claude.json");
+  }
+  supportsHttp() {
+    return true;
+  }
+  scanForImports(_config, managedIndex) {
+    const configPath = this.detectConfigPath();
+    const result = emptyImportScan(this.id, configPath ?? undefined);
+    if (!configPath) {
+      return result;
+    }
+    const raw = readJsonFile(configPath, {});
+    const topLevelServers = raw.mcpServers ?? {};
+    const disabledMcpServers = new Set(raw.disabledMcpServers ?? []);
+    const projects = raw.projects ?? {};
+    for (const project of Object.values(projects)) {
+      const projectDisabled = project?.disabledMcpServers ?? [];
+      for (const name of projectDisabled) {
+        disabledMcpServers.add(name);
+      }
+    }
+    for (const [name, rawEntry] of Object.entries(topLevelServers)) {
+      if (isManagedGatewayProjection(name) || managedIndex.managed[this.id]?.entries?.[name]) {
+        continue;
+      }
+      const parsed = claudeEntrySchema.safeParse(rawEntry);
+      if (!parsed.success) {
+        result.skipped.push(buildImportSkip(this.id, name, "Entry could not be mapped to an mcpx server.", configPath));
+        continue;
+      }
+      const entry = parsed.data;
+      const isDisabled = entry.disabled === true || disabledMcpServers.has(name);
+      if ((entry.type === undefined || entry.type === "http") && entry.url && !entry.command) {
+        result.candidates.push({
+          clientId: this.id,
+          configPath,
+          sourceEntryName: name,
+          serverName: name,
+          spec: {
+            transport: "http",
+            url: entry.url,
+            headers: entry.headers,
+            enabled: !isDisabled
+          }
+        });
+        continue;
+      }
+      if ((entry.type === undefined || entry.type === "stdio") && entry.command && !entry.url) {
+        result.candidates.push({
+          clientId: this.id,
+          configPath,
+          sourceEntryName: name,
+          serverName: name,
+          spec: {
+            transport: "stdio",
+            command: entry.command,
+            args: entry.args,
+            env: entry.env,
+            cwd: entry.cwd,
+            enabled: !isDisabled
+          }
+        });
+        continue;
+      }
+      result.skipped.push(buildImportSkip(this.id, name, "Entry must define exactly one transport that mcpx supports.", configPath));
+    }
+    return result;
+  }
+  syncGateway(_config, options) {
+    const configPath = this.detectConfigPath();
+    if (!configPath) {
+      return errorResult(this.id, undefined, "Unable to resolve Claude config path.");
+    }
+    try {
+      const raw = readJsonFile(configPath, {});
+      const managedNames = options.managedEntries.map((entry) => entry.name);
+      const serverEntries = Object.fromEntries(options.managedEntries.map((entry) => [entry.name, {
+        type: "http",
+        url: entry.url,
+        headers: entry.headers
+      }]));
+      const topLevelServers = raw.mcpServers ?? {};
+      removeSourceEntries(topLevelServers, options.sourceEntriesToRemove);
+      for (const name of managedNames) {
+        const topLevelConflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, topLevelServers[name]);
+        if (topLevelConflict) {
+          return errorResult(this.id, configPath, topLevelConflict);
+        }
+      }
+      pruneStaleManagedEntries(options.managedIndex, this.id, topLevelServers, managedNames);
+      for (const [name, entry] of Object.entries(serverEntries)) {
+        topLevelServers[name] = entry;
+      }
+      raw.mcpServers = topLevelServers;
+      syncDisabledMcpServersArray(raw, managedNames, options.managedEntries);
+      const projects = raw.projects ?? {};
+      for (const projectPath of Object.keys(projects)) {
+        const project = projects[projectPath] ?? {};
+        syncDisabledMcpServersArray(project, managedNames, options.managedEntries);
+        projects[projectPath] = project;
+      }
+      raw.projects = projects;
+      writeJsonAtomic(configPath, raw);
+      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(Object.entries(serverEntries).map(([name, entry]) => [name, JSON.stringify(entry)])));
+      return okResult(this.id, configPath);
+    } catch (error) {
+      return errorResult(this.id, configPath, error.message);
+    }
+  }
+}
+
+// src/adapters/claude-desktop.ts
+import path4 from "node:path";
+import { z as z3 } from "zod";
+var stringMapSchema2 = z3.record(z3.string(), z3.string());
+var claudeDesktopEntrySchema = z3.object({
+  type: z3.string().optional(),
+  url: z3.string().min(1).optional(),
+  headers: stringMapSchema2.optional(),
+  command: z3.string().min(1).optional(),
+  args: z3.array(z3.string()).optional(),
+  env: stringMapSchema2.optional(),
+  cwd: z3.string().min(1).optional(),
+  disabled: z3.boolean().optional()
+}).passthrough();
+
+class ClaudeDesktopAdapter {
+  id = "claude-desktop";
+  detectConfigPath() {
+    return path4.join(homeDir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
+  }
+  supportsHttp() {
+    return true;
+  }
+  scanForImports(_config, managedIndex) {
+    const configPath = this.detectConfigPath();
+    const result = emptyImportScan(this.id, configPath ?? undefined);
+    if (!configPath) {
+      return result;
+    }
+    const raw = readJsonFile(configPath, {});
+    const topLevelServers = raw.mcpServers ?? {};
+    for (const [name, rawEntry] of Object.entries(topLevelServers)) {
+      if (isManagedGatewayProjection(name) || managedIndex.managed[this.id]?.entries?.[name]) {
+        continue;
+      }
+      const parsed = claudeDesktopEntrySchema.safeParse(rawEntry);
+      if (!parsed.success) {
+        result.skipped.push(buildImportSkip(this.id, name, "Entry could not be mapped to an mcpx server.", configPath));
+        continue;
+      }
+      const entry = parsed.data;
+      if ((entry.type === undefined || entry.type === "http") && entry.url && !entry.command) {
+        result.candidates.push({
+          clientId: this.id,
+          configPath,
+          sourceEntryName: name,
+          serverName: name,
+          spec: {
+            transport: "http",
+            url: entry.url,
+            headers: entry.headers,
+            enabled: entry.disabled !== true
+          }
+        });
+        continue;
+      }
+      if ((entry.type === undefined || entry.type === "stdio") && entry.command && !entry.url) {
+        result.candidates.push({
+          clientId: this.id,
+          configPath,
+          sourceEntryName: name,
+          serverName: name,
+          spec: {
+            transport: "stdio",
+            command: entry.command,
+            args: entry.args,
+            env: entry.env,
+            cwd: entry.cwd,
+            enabled: entry.disabled !== true
+          }
+        });
+        continue;
+      }
+      result.skipped.push(buildImportSkip(this.id, name, "Entry must define exactly one transport that mcpx supports.", configPath));
+    }
+    return result;
+  }
+  syncGateway(_config, options) {
+    const configPath = this.detectConfigPath();
+    if (!configPath) {
+      return errorResult(this.id, undefined, "Unable to resolve Claude Desktop config path.");
+    }
+    try {
+      const raw = readJsonFile(configPath, {});
+      const enabledEntries = options.managedEntries.filter((entry) => entry.enabled);
+      const serverEntries = Object.fromEntries(enabledEntries.map((entry) => [entry.name, {
+        type: "http",
+        url: entry.url,
+        headers: entry.headers
+      }]));
+      const enabledManagedNames = enabledEntries.map((entry) => entry.name);
+      const topLevelServers = raw.mcpServers ?? {};
+      removeSourceEntries(topLevelServers, options.sourceEntriesToRemove);
+      for (const name of enabledManagedNames) {
+        const topLevelConflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, topLevelServers[name]);
+        if (topLevelConflict) {
+          return errorResult(this.id, configPath, topLevelConflict);
+        }
+      }
+      pruneStaleManagedEntries(options.managedIndex, this.id, topLevelServers, enabledManagedNames);
+      for (const [name, entry] of Object.entries(serverEntries)) {
+        topLevelServers[name] = entry;
+      }
+      raw.mcpServers = topLevelServers;
+      writeJsonAtomic(configPath, raw);
+      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(options.managedEntries.map((entry) => [
+        entry.name,
+        JSON.stringify({ type: "http", url: entry.url, headers: entry.headers, enabled: entry.enabled })
+      ])));
+      return okResult(this.id, configPath);
+    } catch (error) {
+      return errorResult(this.id, configPath, error.message);
+    }
+  }
+}
+
+// src/adapters/codex.ts
+import path5 from "node:path";
+import fs4 from "node:fs";
+import { parse, stringify } from "@iarna/toml";
+import { z as z4 } from "zod";
+var stringMapSchema3 = z4.preprocess((value) => {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return value;
+  }
+  return Object.fromEntries(Object.entries(value));
+}, z4.record(z4.string(), z4.string()));
+var codexEntrySchema = z4.object({
+  enabled: z4.boolean().optional(),
+  url: z4.string().min(1).optional(),
+  headers: stringMapSchema3.optional(),
+  http_headers: stringMapSchema3.optional(),
+  command: z4.string().min(1).optional(),
+  args: z4.array(z4.string()).optional(),
+  env: stringMapSchema3.optional(),
+  cwd: z4.string().min(1).optional()
+}).passthrough();
+
+class CodexAdapter {
+  id = "codex";
+  detectConfigPath() {
+    return path5.join(homeDir(), ".codex", "config.toml");
+  }
+  supportsHttp() {
+    return true;
+  }
+  scanForImports(_config, managedIndex) {
+    const configPath = this.detectConfigPath();
+    const result = emptyImportScan(this.id, configPath ?? undefined);
+    if (!configPath || !fs4.existsSync(configPath)) {
+      return result;
+    }
+    const existing = fs4.readFileSync(configPath, "utf8");
+    const doc = existing.trim().length > 0 ? parse(existing) : {};
+    const mcpServers = doc.mcp_servers ?? {};
+    for (const [name, rawEntry] of Object.entries(mcpServers)) {
+      if (isManagedGatewayProjection(name) || managedIndex.managed[this.id]?.entries?.[name]) {
+        continue;
+      }
+      const parsed = codexEntrySchema.safeParse(rawEntry);
+      if (!parsed.success) {
+        result.skipped.push(buildImportSkip(this.id, name, "Entry could not be mapped to an mcpx server.", configPath));
+        continue;
+      }
+      const entry = parsed.data;
+      if (entry.url && !entry.command) {
+        result.candidates.push({
+          clientId: this.id,
+          configPath,
+          sourceEntryName: name,
+          serverName: name,
+          spec: {
+            transport: "http",
+            url: entry.url,
+            headers: entry.http_headers ?? entry.headers,
+            enabled: entry.enabled !== false
+          }
+        });
+        continue;
+      }
+      if (entry.command && !entry.url) {
+        result.candidates.push({
+          clientId: this.id,
+          configPath,
+          sourceEntryName: name,
+          serverName: name,
+          spec: {
+            transport: "stdio",
+            command: entry.command,
+            args: entry.args,
+            env: entry.env,
+            cwd: entry.cwd,
+            enabled: entry.enabled !== false
+          }
+        });
+        continue;
+      }
+      result.skipped.push(buildImportSkip(this.id, name, "Entry must define exactly one transport that mcpx supports.", configPath));
+    }
+    return result;
+  }
+  syncGateway(_config, options) {
+    const configPath = this.detectConfigPath();
+    if (!configPath) {
+      return errorResult(this.id, undefined, "Unable to resolve Codex config.toml path.");
+    }
+    try {
+      const existing = fs4.existsSync(configPath) ? fs4.readFileSync(configPath, "utf8") : "";
+      const doc = existing.trim().length > 0 ? parse(existing) : {};
+      const mcpServers = doc.mcp_servers ?? {};
+      removeSourceEntries(mcpServers, options.sourceEntriesToRemove);
+      const managedNames = options.managedEntries.map((entry) => entry.name);
+      const serverEntries = Object.fromEntries(options.managedEntries.map((entry) => [entry.name, {
+        enabled: entry.enabled,
+        url: entry.url,
+        http_headers: entry.headers
+      }]));
+      for (const name of managedNames) {
+        const conflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, mcpServers[name]);
+        if (conflict) {
+          return errorResult(this.id, configPath, conflict);
+        }
+      }
+      pruneStaleManagedEntries(options.managedIndex, this.id, mcpServers, managedNames);
+      for (const [name, entry] of Object.entries(serverEntries)) {
+        mcpServers[name] = entry;
+      }
+      doc.mcp_servers = mcpServers;
+      fs4.mkdirSync(path5.dirname(configPath), { recursive: true });
+      const tmpPath = `${configPath}.tmp-${process.pid}-${Date.now()}`;
+      fs4.writeFileSync(tmpPath, stringify(doc), { mode: 384 });
+      fs4.renameSync(tmpPath, configPath);
+      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(Object.entries(serverEntries).map(([name, entry]) => [name, JSON.stringify(entry)])));
+      return okResult(this.id, configPath);
+    } catch (error) {
+      return errorResult(this.id, configPath, error.message);
+    }
+  }
+}
+
+// src/adapters/cursor.ts
+import path6 from "node:path";
+import { z as z5 } from "zod";
+var stringMapSchema4 = z5.record(z5.string(), z5.string());
+var cursorEntrySchema = z5.object({
+  type: z5.string().optional(),
+  url: z5.string().min(1).optional(),
+  headers: stringMapSchema4.optional(),
+  command: z5.string().min(1).optional(),
+  args: z5.array(z5.string()).optional(),
+  env: stringMapSchema4.optional(),
+  cwd: z5.string().min(1).optional(),
+  disabled: z5.boolean().optional()
+}).passthrough();
+
+class CursorAdapter {
+  id = "cursor";
+  detectConfigPath() {
+    return path6.join(homeDir(), "Library", "Application Support", "Cursor", "User", "mcp.json");
+  }
+  supportsHttp() {
+    return true;
+  }
+  scanForImports(_config, managedIndex) {
+    const configPath = this.detectConfigPath();
+    const result = emptyImportScan(this.id, configPath ?? undefined);
+    if (!configPath) {
+      return result;
+    }
+    const raw = readJsonFile(configPath, {});
+    const servers = {
+      ...raw.servers ?? {}
+    };
+    for (const [name, rawEntry] of Object.entries(servers)) {
+      if (isManagedGatewayProjection(name) || managedIndex.managed[this.id]?.entries?.[name]) {
+        continue;
+      }
+      const parsed = cursorEntrySchema.safeParse(rawEntry);
+      if (!parsed.success) {
+        result.skipped.push(buildImportSkip(this.id, name, "Entry could not be mapped to an mcpx server.", configPath));
+        continue;
+      }
+      const entry = parsed.data;
+      if ((entry.type === undefined || entry.type === "http") && entry.url && !entry.command) {
+        result.candidates.push({
+          clientId: this.id,
+          configPath,
+          sourceEntryName: name,
+          serverName: name,
+          spec: {
+            transport: "http",
+            url: entry.url,
+            headers: entry.headers,
+            enabled: entry.disabled !== true
+          }
+        });
+        continue;
+      }
+      if ((entry.type === undefined || entry.type === "stdio") && entry.command && !entry.url) {
+        result.candidates.push({
+          clientId: this.id,
+          configPath,
+          sourceEntryName: name,
+          serverName: name,
+          spec: {
+            transport: "stdio",
+            command: entry.command,
+            args: entry.args,
+            env: entry.env,
+            cwd: entry.cwd,
+            enabled: entry.disabled !== true
+          }
+        });
+        continue;
+      }
+      result.skipped.push(buildImportSkip(this.id, name, "Entry must define exactly one transport that mcpx supports.", configPath));
+    }
+    return result;
+  }
+  syncGateway(_config, options) {
+    const configPath = this.detectConfigPath();
+    if (!configPath) {
+      return errorResult(this.id, undefined, "Unable to resolve Cursor MCP config path.");
+    }
+    try {
+      const raw = readJsonFile(configPath, {});
+      const servers = {
+        ...raw.servers ?? {}
+      };
+      removeSourceEntries(servers, options.sourceEntriesToRemove);
+      const enabledEntries = options.managedEntries.filter((entry) => entry.enabled);
+      const serverEntries = Object.fromEntries(enabledEntries.map((entry) => [entry.name, {
+        type: "http",
+        url: entry.url,
+        headers: entry.headers
+      }]));
+      const enabledManagedNames = enabledEntries.map((entry) => entry.name);
+      for (const name of enabledManagedNames) {
+        const conflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, servers[name]);
+        if (conflict) {
+          return errorResult(this.id, configPath, conflict);
+        }
+      }
+      pruneStaleManagedEntries(options.managedIndex, this.id, servers, enabledManagedNames);
+      for (const [name, entry] of Object.entries(serverEntries)) {
+        servers[name] = entry;
+      }
+      const next = {
+        ...raw,
+        servers
+      };
+      writeJsonAtomic(configPath, next);
+      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(options.managedEntries.map((entry) => [
+        entry.name,
+        JSON.stringify({ type: "http", url: entry.url, headers: entry.headers, enabled: entry.enabled })
+      ])));
+      return okResult(this.id, configPath);
+    } catch (error) {
+      return errorResult(this.id, configPath, error.message);
+    }
+  }
+}
+
+// src/adapters/cline.ts
+import path7 from "node:path";
+import fs5 from "node:fs";
+import { z as z6 } from "zod";
+var stringMapSchema5 = z6.record(z6.string(), z6.string());
+var clineEntrySchema = z6.object({
+  transportType: z6.string().optional(),
+  url: z6.string().min(1).optional(),
+  headers: stringMapSchema5.optional(),
+  command: z6.string().min(1).optional(),
+  args: z6.array(z6.string()).optional(),
+  env: stringMapSchema5.optional(),
+  cwd: z6.string().min(1).optional(),
+  disabled: z6.boolean().optional()
+}).passthrough();
+function getCandidatePaths() {
+  return [
+    path7.join(homeDir(), "Library", "Application Support", "Code", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
+    path7.join(homeDir(), "Library", "Application Support", "Cursor", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json")
+  ];
+}
+
+class ClineAdapter {
+  id = "cline";
+  detectConfigPath() {
+    const candidates = getCandidatePaths();
+    for (const candidate of candidates) {
+      if (fs5.existsSync(candidate)) {
+        return candidate;
+      }
+    }
+    return candidates[0] ?? null;
+  }
+  supportsHttp() {
+    return true;
+  }
+  scanForImports(_config, managedIndex) {
+    const configPath = this.detectConfigPath();
+    const result = emptyImportScan(this.id, configPath ?? undefined);
+    if (!configPath || !fs5.existsSync(configPath)) {
+      return result;
+    }
+    const raw = readJsonFile(configPath, {});
+    const servers = {
+      ...raw.mcpServers ?? {}
+    };
+    for (const [name, rawEntry] of Object.entries(servers)) {
+      if (isManagedGatewayProjection(name) || managedIndex.managed[this.id]?.entries?.[name]) {
+        continue;
+      }
+      const parsed = clineEntrySchema.safeParse(rawEntry);
+      if (!parsed.success) {
+        result.skipped.push(buildImportSkip(this.id, name, "Entry could not be mapped to an mcpx server.", configPath));
+        continue;
+      }
+      const entry = parsed.data;
+      if ((entry.transportType === undefined || entry.transportType === "http") && entry.url && !entry.command) {
+        result.candidates.push({
+          clientId: this.id,
+          configPath,
+          sourceEntryName: name,
+          serverName: name,
+          spec: {
+            transport: "http",
+            url: entry.url,
+            headers: entry.headers,
+            enabled: entry.disabled !== true
+          }
+        });
+        continue;
+      }
+      if ((entry.transportType === undefined || entry.transportType === "stdio") && entry.command && !entry.url) {
+        result.candidates.push({
+          clientId: this.id,
+          configPath,
+          sourceEntryName: name,
+          serverName: name,
+          spec: {
+            transport: "stdio",
+            command: entry.command,
+            args: entry.args,
+            env: entry.env,
+            cwd: entry.cwd,
+            enabled: entry.disabled !== true
+          }
+        });
+        continue;
+      }
+      result.skipped.push(buildImportSkip(this.id, name, "Entry must define exactly one transport that mcpx supports.", configPath));
+    }
+    return result;
+  }
+  syncGateway(_config, options) {
+    const configPath = this.detectConfigPath();
+    if (!configPath) {
+      return errorResult(this.id, undefined, "Unable to resolve Cline MCP config path.");
+    }
+    try {
+      const raw = readJsonFile(configPath, {});
+      const servers = {
+        ...raw.mcpServers ?? {}
+      };
+      removeSourceEntries(servers, options.sourceEntriesToRemove);
+      const managedNames = options.managedEntries.map((entry) => entry.name);
+      const serverEntries = Object.fromEntries(options.managedEntries.map((entry) => [entry.name, {
+        transportType: "http",
+        url: entry.url,
+        headers: entry.headers,
+        disabled: !entry.enabled
+      }]));
+      for (const name of managedNames) {
+        const conflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, servers[name]);
+        if (conflict) {
+          return errorResult(this.id, configPath, conflict);
+        }
+      }
+      pruneStaleManagedEntries(options.managedIndex, this.id, servers, managedNames);
+      for (const [name, entry] of Object.entries(serverEntries)) {
+        servers[name] = entry;
+      }
+      const next = {
+        ...raw,
+        mcpServers: servers
+      };
+      writeJsonAtomic(configPath, next);
+      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(Object.entries(serverEntries).map(([name, entry]) => [name, JSON.stringify(entry)])));
+      return okResult(this.id, configPath);
+    } catch (error) {
+      return errorResult(this.id, configPath, error.message);
+    }
+  }
+}
+
+// src/adapters/kiro.ts
+import path8 from "node:path";
+import { z as z7 } from "zod";
+var stringMapSchema6 = z7.record(z7.string(), z7.string());
+var kiroEntrySchema = z7.object({
+  url: z7.string().min(1).optional(),
+  headers: stringMapSchema6.optional(),
+  command: z7.string().min(1).optional(),
+  args: z7.array(z7.string()).optional(),
+  env: stringMapSchema6.optional(),
+  cwd: z7.string().min(1).optional(),
+  disabled: z7.boolean().optional()
+}).passthrough();
+
+class KiroAdapter {
+  id = "kiro";
+  detectConfigPath() {
+    return path8.join(homeDir(), ".kiro", "settings", "mcp.json");
+  }
+  supportsHttp() {
+    return true;
+  }
+  scanForImports(_config, managedIndex) {
+    const configPath = this.detectConfigPath();
+    const result = emptyImportScan(this.id, configPath ?? undefined);
+    if (!configPath) {
+      return result;
+    }
+    const raw = readJsonFile(configPath, {});
+    const servers = {
+      ...raw.mcpServers ?? {}
+    };
+    for (const [name, rawEntry] of Object.entries(servers)) {
+      if (isManagedGatewayProjection(name) || managedIndex.managed[this.id]?.entries?.[name]) {
+        continue;
+      }
+      const parsed = kiroEntrySchema.safeParse(rawEntry);
+      if (!parsed.success) {
+        result.skipped.push(buildImportSkip(this.id, name, "Entry could not be mapped to an mcpx server.", configPath));
+        continue;
+      }
+      const entry = parsed.data;
+      if (entry.url && !entry.command) {
+        result.candidates.push({
+          clientId: this.id,
+          configPath,
+          sourceEntryName: name,
+          serverName: name,
+          spec: {
+            transport: "http",
+            url: entry.url,
+            headers: entry.headers,
+            enabled: entry.disabled !== true
+          }
+        });
+        continue;
+      }
+      if (entry.command && !entry.url) {
+        result.candidates.push({
+          clientId: this.id,
+          configPath,
+          sourceEntryName: name,
+          serverName: name,
+          spec: {
+            transport: "stdio",
+            command: entry.command,
+            args: entry.args,
+            env: entry.env,
+            cwd: entry.cwd,
+            enabled: entry.disabled !== true
+          }
+        });
+        continue;
+      }
+      result.skipped.push(buildImportSkip(this.id, name, "Entry must define exactly one transport that mcpx supports.", configPath));
+    }
+    return result;
+  }
+  syncGateway(_config, options) {
+    const configPath = this.detectConfigPath();
+    if (!configPath) {
+      return errorResult(this.id, undefined, "Unable to resolve Kiro MCP config path.");
+    }
+    try {
+      const raw = readJsonFile(configPath, {});
+      const servers = {
+        ...raw.mcpServers ?? {}
+      };
+      removeSourceEntries(servers, options.sourceEntriesToRemove);
+      const managedNames = options.managedEntries.map((entry) => entry.name);
+      const serverEntries = Object.fromEntries(options.managedEntries.map((entry) => [entry.name, {
+        url: entry.url,
+        headers: entry.headers,
+        disabled: !entry.enabled
+      }]));
+      for (const name of managedNames) {
+        const conflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, servers[name]);
+        if (conflict) {
+          return errorResult(this.id, configPath, conflict);
+        }
+      }
+      pruneStaleManagedEntries(options.managedIndex, this.id, servers, managedNames);
+      for (const [name, entry] of Object.entries(serverEntries)) {
+        servers[name] = entry;
+      }
+      const next = {
+        ...raw,
+        mcpServers: servers
+      };
+      writeJsonAtomic(configPath, next);
+      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(Object.entries(serverEntries).map(([name, entry]) => [name, JSON.stringify(entry)])));
+      return okResult(this.id, configPath);
+    } catch (error) {
+      return errorResult(this.id, configPath, error.message);
+    }
+  }
+}
+
+// src/adapters/opencode.ts
+import path9 from "node:path";
+import { z as z8 } from "zod";
+var stringMapSchema7 = z8.record(z8.string(), z8.string());
+var openCodeEntrySchema = z8.object({
+  type: z8.string().optional(),
+  url: z8.string().min(1).optional(),
+  headers: stringMapSchema7.optional(),
+  command: z8.string().min(1).optional(),
+  args: z8.array(z8.string()).optional(),
+  env: stringMapSchema7.optional(),
+  cwd: z8.string().min(1).optional(),
+  enabled: z8.boolean().optional()
+}).passthrough();
+
+class OpenCodeAdapter {
+  id = "opencode";
+  detectConfigPath() {
+    return path9.join(homeDir(), ".config", "opencode", "opencode.json");
+  }
+  supportsHttp() {
+    return true;
+  }
+  scanForImports(_config, managedIndex) {
+    const configPath = this.detectConfigPath();
+    const result = emptyImportScan(this.id, configPath ?? undefined);
+    if (!configPath) {
+      return result;
+    }
+    const raw = readJsonFile(configPath, {});
+    const mcp = {
+      ...raw.mcp ?? {}
+    };
+    for (const [name, rawEntry] of Object.entries(mcp)) {
+      if (isManagedGatewayProjection(name) || managedIndex.managed[this.id]?.entries?.[name]) {
+        continue;
+      }
+      const parsed = openCodeEntrySchema.safeParse(rawEntry);
+      if (!parsed.success) {
+        result.skipped.push(buildImportSkip(this.id, name, "Entry could not be mapped to an mcpx server.", configPath));
+        continue;
+      }
+      const entry = parsed.data;
+      if ((entry.type === undefined || entry.type === "remote" || entry.type === "http") && entry.url && !entry.command) {
+        result.candidates.push({
+          clientId: this.id,
+          configPath,
+          sourceEntryName: name,
+          serverName: name,
+          spec: {
+            transport: "http",
+            url: entry.url,
+            headers: entry.headers,
+            enabled: entry.enabled !== false
+          }
+        });
+        continue;
+      }
+      if ((entry.type === undefined || entry.type === "stdio") && entry.command && !entry.url) {
+        result.candidates.push({
+          clientId: this.id,
+          configPath,
+          sourceEntryName: name,
+          serverName: name,
+          spec: {
+            transport: "stdio",
+            command: entry.command,
+            args: entry.args,
+            env: entry.env,
+            cwd: entry.cwd,
+            enabled: entry.enabled !== false
+          }
+        });
+        continue;
+      }
+      result.skipped.push(buildImportSkip(this.id, name, "Entry must define exactly one transport that mcpx supports.", configPath));
+    }
+    return result;
+  }
+  syncGateway(_config, options) {
+    const configPath = this.detectConfigPath();
+    if (!configPath) {
+      return errorResult(this.id, undefined, "Unable to resolve OpenCode config path.");
+    }
+    try {
+      const raw = readJsonFile(configPath, {});
+      const mcp = {
+        ...raw.mcp ?? {}
+      };
+      removeSourceEntries(mcp, options.sourceEntriesToRemove);
+      const managedNames = options.managedEntries.map((entry) => entry.name);
+      const serverEntries = Object.fromEntries(options.managedEntries.map((entry) => [entry.name, {
+        type: "remote",
+        url: entry.url,
+        headers: entry.headers,
+        enabled: entry.enabled
+      }]));
+      for (const name of managedNames) {
+        const conflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, mcp[name]);
+        if (conflict) {
+          return errorResult(this.id, configPath, conflict);
+        }
+      }
+      pruneStaleManagedEntries(options.managedIndex, this.id, mcp, managedNames);
+      for (const [name, entry] of Object.entries(serverEntries)) {
+        mcp[name] = entry;
+      }
+      const next = {
+        ...raw,
+        mcp
+      };
+      writeJsonAtomic(configPath, next);
+      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(Object.entries(serverEntries).map(([name, entry]) => [name, JSON.stringify(entry)])));
+      return okResult(this.id, configPath);
+    } catch (error) {
+      return errorResult(this.id, configPath, error.message);
+    }
+  }
+}
+
+// src/adapters/vscode.ts
+import path10 from "node:path";
+import { z as z9 } from "zod";
+var stringMapSchema8 = z9.record(z9.string(), z9.string());
+var vscodeEntrySchema = z9.object({
+  type: z9.string().optional(),
+  url: z9.string().min(1).optional(),
+  headers: stringMapSchema8.optional(),
+  command: z9.string().min(1).optional(),
+  args: z9.array(z9.string()).optional(),
+  env: stringMapSchema8.optional(),
+  cwd: z9.string().min(1).optional(),
+  disabled: z9.boolean().optional()
+}).passthrough();
+
+class VsCodeAdapter {
+  id = "vscode";
+  detectConfigPath() {
+    return path10.join(homeDir(), "Library", "Application Support", "Code", "User", "mcp.json");
+  }
+  supportsHttp() {
+    return true;
+  }
+  scanForImports(_config, managedIndex) {
+    const configPath = this.detectConfigPath();
+    const result = emptyImportScan(this.id, configPath ?? undefined);
+    if (!configPath) {
+      return result;
+    }
+    const raw = readJsonFile(configPath, {});
+    const servers = {
+      ...raw.servers ?? {}
+    };
+    for (const [name, rawEntry] of Object.entries(servers)) {
+      if (isManagedGatewayProjection(name) || managedIndex.managed[this.id]?.entries?.[name]) {
+        continue;
+      }
+      const parsed = vscodeEntrySchema.safeParse(rawEntry);
+      if (!parsed.success) {
+        result.skipped.push(buildImportSkip(this.id, name, "Entry could not be mapped to an mcpx server.", configPath));
+        continue;
+      }
+      const entry = parsed.data;
+      if ((entry.type === undefined || entry.type === "http") && entry.url && !entry.command) {
+        result.candidates.push({
+          clientId: this.id,
+          configPath,
+          sourceEntryName: name,
+          serverName: name,
+          spec: {
+            transport: "http",
+            url: entry.url,
+            headers: entry.headers,
+            enabled: entry.disabled !== true
+          }
+        });
+        continue;
+      }
+      if ((entry.type === undefined || entry.type === "stdio") && entry.command && !entry.url) {
+        result.candidates.push({
+          clientId: this.id,
+          configPath,
+          sourceEntryName: name,
+          serverName: name,
+          spec: {
+            transport: "stdio",
+            command: entry.command,
+            args: entry.args,
+            env: entry.env,
+            cwd: entry.cwd,
+            enabled: entry.disabled !== true
+          }
+        });
+        continue;
+      }
+      result.skipped.push(buildImportSkip(this.id, name, "Entry must define exactly one transport that mcpx supports.", configPath));
+    }
+    return result;
+  }
+  syncGateway(_config, options) {
+    const configPath = this.detectConfigPath();
+    if (!configPath) {
+      return errorResult(this.id, undefined, "Unable to resolve VS Code MCP config path.");
+    }
+    try {
+      const raw = readJsonFile(configPath, {});
+      const servers = {
+        ...raw.servers ?? {}
+      };
+      removeSourceEntries(servers, options.sourceEntriesToRemove);
+      const enabledEntries = options.managedEntries.filter((entry) => entry.enabled);
+      const serverEntries = Object.fromEntries(enabledEntries.map((entry) => [entry.name, {
+        type: "http",
+        url: entry.url,
+        headers: entry.headers
+      }]));
+      const enabledManagedNames = enabledEntries.map((entry) => entry.name);
+      for (const name of enabledManagedNames) {
+        const conflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, servers[name]);
+        if (conflict) {
+          return errorResult(this.id, configPath, conflict);
+        }
+      }
+      pruneStaleManagedEntries(options.managedIndex, this.id, servers, enabledManagedNames);
+      for (const [name, entry] of Object.entries(serverEntries)) {
+        servers[name] = entry;
+      }
+      const next = {
+        ...raw,
+        servers
+      };
+      writeJsonAtomic(configPath, next);
+      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(options.managedEntries.map((entry) => [
+        entry.name,
+        JSON.stringify({ type: "http", url: entry.url, headers: entry.headers, enabled: entry.enabled })
+      ])));
+      return okResult(this.id, configPath);
+    } catch (error) {
+      return errorResult(this.id, configPath, error.message);
+    }
+  }
+}
+
+// src/adapters/qwen.ts
+import path11 from "node:path";
+import { z as z10 } from "zod";
+var stringMapSchema9 = z10.record(z10.string(), z10.string());
+var qwenEntrySchema = z10.object({
+  httpUrl: z10.string().min(1).optional(),
+  headers: stringMapSchema9.optional(),
+  command: z10.string().min(1).optional(),
+  args: z10.array(z10.string()).optional(),
+  env: stringMapSchema9.optional(),
+  cwd: z10.string().min(1).optional(),
+  disabled: z10.boolean().optional()
+}).passthrough();
+
+class QwenAdapter {
+  id = "qwen";
+  detectConfigPath() {
+    return path11.join(homeDir(), ".qwen", "settings.json");
+  }
+  supportsHttp() {
+    return true;
+  }
+  scanForImports(_config, managedIndex) {
+    const configPath = this.detectConfigPath();
+    const result = emptyImportScan(this.id, configPath ?? undefined);
+    if (!configPath) {
+      return result;
+    }
+    const raw = readJsonFile(configPath, {});
+    const excludedSet = new Set(raw.mcp?.excluded ?? []);
+    const topLevelServers = raw.mcpServers ?? {};
+    for (const [name, rawEntry] of Object.entries(topLevelServers)) {
+      if (isManagedGatewayProjection(name) || managedIndex.managed[this.id]?.entries?.[name]) {
+        continue;
+      }
+      const parsed = qwenEntrySchema.safeParse(rawEntry);
+      if (!parsed.success) {
+        result.skipped.push(buildImportSkip(this.id, name, "Entry could not be mapped to an mcpx server.", configPath));
+        continue;
+      }
+      const entry = parsed.data;
+      if (entry.httpUrl && !entry.command) {
+        result.candidates.push({
+          clientId: this.id,
+          configPath,
+          sourceEntryName: name,
+          serverName: name,
+          spec: {
+            transport: "http",
+            url: entry.httpUrl,
+            headers: entry.headers,
+            enabled: !(entry.disabled === true || excludedSet.has(name))
+          }
+        });
+        continue;
+      }
+      if (entry.command && !entry.httpUrl) {
+        result.candidates.push({
+          clientId: this.id,
+          configPath,
+          sourceEntryName: name,
+          serverName: name,
+          spec: {
+            transport: "stdio",
+            command: entry.command,
+            args: entry.args,
+            env: entry.env,
+            cwd: entry.cwd,
+            enabled: !(entry.disabled === true || excludedSet.has(name))
+          }
+        });
+        continue;
+      }
+      result.skipped.push(buildImportSkip(this.id, name, "Entry must define exactly one transport that mcpx supports.", configPath));
+    }
+    return result;
+  }
+  syncGateway(_config, options) {
+    const configPath = this.detectConfigPath();
+    if (!configPath) {
+      return errorResult(this.id, undefined, "Unable to resolve Qwen config path.");
+    }
+    try {
+      const raw = readJsonFile(configPath, {});
+      const managedNames = options.managedEntries.map((entry) => entry.name);
+      const serverEntries = Object.fromEntries(options.managedEntries.map((entry) => [entry.name, {
+        httpUrl: entry.url,
+        headers: entry.headers
+      }]));
+      const topLevelServers = raw.mcpServers ?? {};
+      removeSourceEntries(topLevelServers, options.sourceEntriesToRemove);
+      for (const name of managedNames) {
+        const topLevelConflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, topLevelServers[name]);
+        if (topLevelConflict) {
+          return errorResult(this.id, configPath, topLevelConflict);
+        }
+      }
+      pruneStaleManagedEntries(options.managedIndex, this.id, topLevelServers, managedNames);
+      for (const [name, entry] of Object.entries(serverEntries)) {
+        topLevelServers[name] = entry;
+      }
+      raw.mcpServers = topLevelServers;
+      syncMcpExcludedArray(raw, managedNames, options.managedEntries);
+      writeJsonAtomic(configPath, raw);
+      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(options.managedEntries.map((entry) => [
+        entry.name,
+        JSON.stringify({ httpUrl: entry.url, headers: entry.headers, enabled: entry.enabled })
+      ])));
+      return okResult(this.id, configPath);
+    } catch (error) {
+      return errorResult(this.id, configPath, error.message);
+    }
+  }
+}
+
+// src/adapters/index.ts
+function getAdapters() {
+  return [
+    new ClaudeAdapter,
+    new ClaudeDesktopAdapter,
+    new CodexAdapter,
+    new CursorAdapter,
+    new ClineAdapter,
+    new OpenCodeAdapter,
+    new KiroAdapter,
+    new VsCodeAdapter,
+    new QwenAdapter
+  ];
+}
+
+// src/core/managed-index.ts
+function defaultManagedIndex() {
+  return {
+    schemaVersion: 1,
+    managed: {}
+  };
+}
+function loadManagedIndex(filePath = getManagedIndexPath()) {
+  const raw = readJsonFile(filePath, defaultManagedIndex());
+  if (!raw || typeof raw !== "object") {
+    return defaultManagedIndex();
+  }
+  if (raw.schemaVersion !== 1) {
+    return defaultManagedIndex();
+  }
+  return raw;
+}
+function saveManagedIndex(index, filePath = getManagedIndexPath()) {
+  writeJsonAtomic(filePath, index);
+}
+
+// src/core/sync.ts
+function getGatewayUrl(config) {
+  return `http://127.0.0.1:${config.gateway.port}/mcp`;
+}
+function buildManagedEntries(config, gatewayUrl, localToken) {
+  const entries = Object.entries(config.servers);
+  return entries.map(([name, spec]) => ({
+    name: `${name} (mcpx)`,
+    url: `${gatewayUrl}?upstream=${encodeURIComponent(name)}`,
+    headers: {
+      Authorization: `Bearer ${localToken}`
+    },
+    enabled: isServerEnabled(spec)
+  }));
+}
+function syncAllClients(config, secrets, targetClients) {
+  const adapters = getAdapters();
+  const managedIndexPath = getManagedIndexPath();
+  const managedIndex = loadManagedIndex(managedIndexPath);
+  const filteredAdapters = targetClients && targetClients.length > 0 ? adapters.filter((adapter) => targetClients.includes(adapter.id)) : adapters;
+  const imports = {
+    imported: [],
+    duplicates: [],
+    skipped: [],
+    conflicts: [],
+    errors: []
+  };
+  const sourceEntriesToRemove = new Map;
+  for (const adapter of filteredAdapters) {
+    try {
+      const scan = adapter.scanForImports(config, managedIndex);
+      imports.skipped.push(...scan.skipped);
+      for (const candidate of scan.candidates) {
+        const existing = config.servers[candidate.serverName];
+        if (!existing) {
+          config.servers[candidate.serverName] = candidate.spec;
+          imports.imported.push({
+            clientId: candidate.clientId,
+            configPath: candidate.configPath,
+            sourceEntryName: candidate.sourceEntryName,
+            serverName: candidate.serverName
+          });
+          if (!sourceEntriesToRemove.has(candidate.clientId)) {
+            sourceEntriesToRemove.set(candidate.clientId, new Set);
+          }
+          sourceEntriesToRemove.get(candidate.clientId)?.add(candidate.sourceEntryName);
+          continue;
+        }
+        if (serverSpecsEqual(existing, candidate.spec)) {
+          imports.duplicates.push({
+            clientId: candidate.clientId,
+            configPath: candidate.configPath,
+            sourceEntryName: candidate.sourceEntryName,
+            serverName: candidate.serverName
+          });
+          if (!sourceEntriesToRemove.has(candidate.clientId)) {
+            sourceEntriesToRemove.set(candidate.clientId, new Set);
+          }
+          sourceEntriesToRemove.get(candidate.clientId)?.add(candidate.sourceEntryName);
+          continue;
+        }
+        imports.conflicts.push({
+          clientId: candidate.clientId,
+          configPath: candidate.configPath,
+          sourceEntryName: candidate.sourceEntryName,
+          serverName: candidate.serverName,
+          message: `Server "${candidate.serverName}" already exists in mcpx with a different configuration.`
+        });
+      }
+    } catch (error) {
+      imports.errors.push({
+        clientId: adapter.id,
+        configPath: adapter.detectConfigPath() ?? undefined,
+        message: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  const localToken = ensureGatewayToken(config, secrets);
+  const gatewayUrl = getGatewayUrl(config);
+  const managedEntries = buildManagedEntries(config, gatewayUrl, localToken);
+  const results = [];
+  for (const adapter of filteredAdapters) {
+    if (!adapter.supportsHttp()) {
+      results.push({
+        clientId: adapter.id,
+        status: "UNSUPPORTED_HTTP",
+        message: "Client adapter does not support MCP over HTTP."
+      });
+      continue;
+    }
+    const result = adapter.syncGateway(config, {
+      managedEntries,
+      managedIndex,
+      managedIndexPath,
+      sourceEntriesToRemove: Array.from(sourceEntriesToRemove.get(adapter.id) ?? [])
+    });
+    results.push(result);
+  }
+  for (const result of results) {
+    config.clients[result.clientId] = {
+      status: result.status,
+      configPath: result.configPath,
+      message: result.message,
+      lastSyncAt: new Date().toISOString()
+    };
+  }
+  saveManagedIndex(managedIndex, managedIndexPath);
+  saveConfig(config);
+  const hasErrors = results.some((result) => result.status === "ERROR") || imports.conflicts.length > 0 || imports.errors.length > 0;
+  return {
+    gatewayUrl,
+    imports,
+    results,
+    hasErrors
+  };
+}
+
+// src/core/server-auth.ts
+function normalizeNamePart(value) {
+  return value.trim().toLowerCase().replace(/[^a-z0-9._-]+/g, "_").replace(/^_+|_+$/g, "") || "value";
+}
+function requireNonEmpty(value, label) {
+  const normalized = value?.trim();
+  if (!normalized) {
+    throw new Error(`${label} must be non-empty.`);
+  }
+  return normalized;
+}
+function toSecretRef(secretName) {
+  return `secret://${secretName}`;
+}
+function secretRefName(ref) {
+  if (!ref.startsWith("secret://")) {
+    return null;
+  }
+  const name = ref.slice("secret://".length).trim();
+  return name.length > 0 ? name : null;
+}
+function defaultAuthSecretName(serverName, target) {
+  return `auth_${normalizeNamePart(serverName)}_${target.kind}_${normalizeNamePart(target.key)}`;
+}
+function resolveAuthTarget(spec, header, env) {
+  if (spec.transport === "http") {
+    if (env) {
+      throw new Error("--env is only valid for stdio upstreams.");
+    }
+    return {
+      kind: "header",
+      key: requireNonEmpty(header ?? "Authorization", "Header name")
+    };
+  }
+  if (header) {
+    throw new Error("--header is only valid for HTTP upstreams.");
+  }
+  return {
+    kind: "env",
+    key: requireNonEmpty(env, "Env var name")
+  };
+}
+function applyAuthReference(spec, target, secretRef) {
+  if (target.kind === "header") {
+    if (spec.transport !== "http") {
+      throw new Error(`Cannot set header auth on ${spec.transport} upstream.`);
+    }
+    const headers = { ...spec.headers ?? {} };
+    headers[target.key] = secretRef;
+    spec.headers = headers;
+    return;
+  }
+  if (spec.transport !== "stdio") {
+    throw new Error(`Cannot set env auth on ${spec.transport} upstream.`);
+  }
+  const env = { ...spec.env ?? {} };
+  env[target.key] = secretRef;
+  spec.env = env;
+}
+function removeAuthReference(spec, target) {
+  if (target.kind === "header") {
+    if (spec.transport !== "http") {
+      throw new Error(`Cannot remove header auth from ${spec.transport} upstream.`);
+    }
+    if (!spec.headers || !(target.key in spec.headers)) {
+      return null;
+    }
+    const previous2 = spec.headers[target.key] ?? null;
+    const next2 = { ...spec.headers };
+    delete next2[target.key];
+    spec.headers = Object.keys(next2).length > 0 ? next2 : undefined;
+    return previous2;
+  }
+  if (spec.transport !== "stdio") {
+    throw new Error(`Cannot remove env auth from ${spec.transport} upstream.`);
+  }
+  if (!spec.env || !(target.key in spec.env)) {
+    return null;
+  }
+  const previous = spec.env[target.key] ?? null;
+  const next = { ...spec.env };
+  delete next[target.key];
+  spec.env = Object.keys(next).length > 0 ? next : undefined;
+  return previous;
+}
+function listAuthBindings(spec) {
+  if (spec.transport === "http") {
+    return Object.entries(spec.headers ?? {}).map(([key, value]) => ({
+      kind: "header",
+      key,
+      value
+    }));
+  }
+  return Object.entries(spec.env ?? {}).map(([key, value]) => ({
+    kind: "env",
+    key,
+    value
+  }));
+}
+function maybePrefixBearer(target, value, raw = false) {
+  if (raw || target.kind !== "header" || target.key.toLowerCase() !== "authorization") {
+    return value;
+  }
+  if (/^\S+\s+\S+/.test(value)) {
+    return value;
+  }
+  return `Bearer ${value}`;
+}
+
+// src/version.ts
+var APP_VERSION = "0.1.3";
+
+// src/core/update.ts
+import fs6 from "node:fs";
+import path12 from "node:path";
+import { execFileSync as execFileSync2 } from "node:child_process";
+function compareVersions(a, b) {
+  const partsA = a.split(".").map(Number);
+  const partsB = b.split(".").map(Number);
+  for (let i = 0;i < 3; i += 1) {
+    const numA = partsA[i] ?? 0;
+    const numB = partsB[i] ?? 0;
+    if (numA > numB)
+      return 1;
+    if (numA < numB)
+      return -1;
+  }
+  return 0;
+}
+async function checkForUpdates() {
+  try {
+    const output = execFileSync2("npm", ["view", "@kwonye/mcpx", "version"], {
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+    const latestVersion = output;
+    const updateAvailable = compareVersions(latestVersion, APP_VERSION) > 0;
+    return {
+      currentVersion: APP_VERSION,
+      latestVersion,
+      updateAvailable
+    };
+  } catch (error) {
+    return {
+      currentVersion: APP_VERSION,
+      latestVersion: null,
+      updateAvailable: false,
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+function getStagedUpdate() {
+  const stagedPath = getStagedVersionPath();
+  if (!fs6.existsSync(stagedPath)) {
+    return null;
+  }
+  try {
+    const raw = fs6.readFileSync(stagedPath, "utf8");
+    const info = JSON.parse(raw);
+    if (!info.version || !info.cliPath) {
+      return null;
+    }
+    const absoluteCliPath = path12.isAbsolute(info.cliPath) ? info.cliPath : path12.join(getUpdatesDir(), info.cliPath);
+    if (!fs6.existsSync(absoluteCliPath)) {
+      return null;
+    }
+    return {
+      ...info,
+      cliPath: absoluteCliPath
+    };
+  } catch {
+    return null;
+  }
+}
+function stageUpdate(version, cliPath) {
+  const updatesDir = getUpdatesDir();
+  ensureDir(updatesDir);
+  const stagedInfo = {
+    version,
+    cliPath: path12.isAbsolute(cliPath) ? path12.relative(updatesDir, cliPath) : cliPath,
+    stagedAt: new Date().toISOString()
+  };
+  fs6.writeFileSync(getStagedVersionPath(), JSON.stringify(stagedInfo, null, 2), "utf8");
+}
+function clearStagedUpdate() {
+  const stagedPath = getStagedVersionPath();
+  if (fs6.existsSync(stagedPath)) {
+    fs6.unlinkSync(stagedPath);
+  }
+}
+function getStagedCliPath() {
+  const staged = getStagedUpdate();
+  return staged?.cliPath ?? null;
+}
+function removeOldVersions(keepCount = 2) {
+  const updatesDir = getUpdatesDir();
+  if (!fs6.existsSync(updatesDir)) {
+    return;
+  }
+  const entries = fs6.readdirSync(updatesDir, { withFileTypes: true });
+  const versionDirs = entries.filter((entry) => entry.isDirectory() && entry.name.startsWith("v")).map((entry) => entry.name).sort((a, b) => compareVersions(b.slice(1), a.slice(1)));
+  if (versionDirs.length <= keepCount) {
+    return;
+  }
+  for (const oldVersion of versionDirs.slice(keepCount)) {
+    const oldPath = path12.join(updatesDir, oldVersion);
+    try {
+      fs6.rmSync(oldPath, { recursive: true, force: true });
+    } catch {}
+  }
+}
+
+// src/core/update-manager.ts
+import fs7 from "node:fs";
+import path13 from "node:path";
+import { execSync, spawn } from "node:child_process";
+function acquireLock() {
+  const lockPath = getUpdateLockPath();
+  try {
+    ensureDir(path13.dirname(lockPath));
+    fs7.writeFileSync(lockPath, `${process.pid}
+`, { flag: "wx" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function releaseLock() {
+  const lockPath = getUpdateLockPath();
+  try {
+    fs7.unlinkSync(lockPath);
+  } catch {}
+}
+function isUpdateInProgress() {
+  const lockPath = getUpdateLockPath();
+  if (!fs7.existsSync(lockPath)) {
+    return false;
+  }
+  try {
+    const raw = fs7.readFileSync(lockPath, "utf8").trim();
+    const pid = Number(raw);
+    if (!Number.isFinite(pid) || pid <= 0) {
+      fs7.unlinkSync(lockPath);
+      return false;
+    }
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    fs7.unlinkSync(lockPath);
+    return false;
+  }
+}
+async function downloadAndStageUpdate() {
+  const updateStatus = await checkForUpdates();
+  if (!updateStatus.latestVersion || !updateStatus.updateAvailable) {
+    return { success: false, error: "No update available" };
+  }
+  const targetVersion = updateStatus.latestVersion;
+  const updatesDir = getUpdatesDir();
+  const versionDir = path13.join(updatesDir, `v${targetVersion}`);
+  if (fs7.existsSync(versionDir)) {
+    const existingStaged = getStagedUpdate();
+    if (existingStaged?.version === targetVersion) {
+      return { success: false, error: `Version ${targetVersion} already staged` };
+    }
+  }
+  try {
+    ensureDir(versionDir);
+    execSync(`npm pack @kwonye/mcpx@${targetVersion} --json`, {
+      cwd: versionDir,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const tarballPath = path13.join(versionDir, `kwonye-mcpx-${targetVersion}.tgz`);
+    if (!fs7.existsSync(tarballPath)) {
+      throw new Error("Downloaded tarball not found");
+    }
+    execSync(`tar -xzf ${tarballPath} --strip-components=1`, {
+      cwd: versionDir,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    execSync("npm install --production --ignore-scripts", {
+      cwd: versionDir,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const cliPath = path13.join(versionDir, "dist", "cli.js");
+    if (!fs7.existsSync(cliPath)) {
+      throw new Error("CLI entry point not found in downloaded package");
+    }
+    stageUpdate(targetVersion, cliPath);
+    removeOldVersions(2);
+    return { success: true, version: targetVersion };
+  } catch (error) {
+    try {
+      fs7.rmSync(versionDir, { recursive: true, force: true });
+    } catch {}
+    return {
+      success: false,
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+function startBackgroundUpdateCheck() {
+  if (isUpdateInProgress()) {
+    return;
+  }
+  if (!acquireLock()) {
+    return;
+  }
+  const child = spawn(process.execPath, [
+    process.argv[1] ?? "",
+    "update",
+    "--background"
+  ], {
+    detached: true,
+    stdio: ["ignore", "ignore", "ignore"],
+    env: {
+      ...process.env,
+      MCPX_UPDATE_CHILD: "1"
+    }
+  });
+  child.unref();
+  setTimeout(() => {
+    releaseLock();
+  }, 60000);
+}
+async function runBackgroundUpdate() {
+  try {
+    const result = await downloadAndStageUpdate();
+    if (result.success && result.version) {
+      console.error(`[update-manager] Update staged: v${result.version}. Will activate on next run.`);
+    } else if (result.error && result.error !== "No update available") {
+      console.error(`[update-manager] Update check failed: ${result.error}`);
+    }
+  } catch (error) {
+    console.error(`[update-manager] Background update failed: ${error instanceof Error ? error.message : String(error)}`);
+  } finally {
+    releaseLock();
+  }
+}
+async function performUpdate() {
+  if (isUpdateInProgress()) {
+    return { success: false, message: "Another update is already in progress." };
+  }
+  const result = await downloadAndStageUpdate();
+  if (result.success && result.version) {
+    return {
+      success: true,
+      message: `Update to v${result.version} ready! Will activate on next run.`
+    };
+  }
+  if (result.error === "No update available") {
+    return { success: true, message: "Already on latest version." };
+  }
+  return {
+    success: false,
+    message: result.error ?? "Update failed"
+  };
+}
+function performRollback() {
+  const currentStaged = getStagedUpdate();
+  if (!currentStaged) {
+    return { success: false, message: "No staged update to roll back." };
+  }
+  clearStagedUpdate();
+  return {
+    success: true,
+    message: `Rolled back from v${currentStaged.version}. Using installed version.`
+  };
+}
+
+// src/core/daemon.ts
+import fs8 from "node:fs";
+import net from "node:net";
+import { spawn as spawn2 } from "node:child_process";
+
+// src/gateway/server.ts
+import http from "node:http";
+import { URL } from "node:url";
+import crypto3 from "node:crypto";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import {
+  StdioClientTransport,
+  getDefaultEnvironment
+} from "@modelcontextprotocol/sdk/client/stdio.js";
+var JSON_RPC_VERSION2 = "2.0";
+var SERVER_VERSION = APP_VERSION;
+var DEFAULT_UPSTREAM_TIMEOUT_MS = 60000;
+var DEFAULT_CONNECT_TIMEOUT_MS = 1e4;
+var OAUTH_WELL_KNOWN_PREFIXES = [
+  "/.well-known/oauth-protected-resource",
+  "/.well-known/oauth-authorization-server",
+  "/.well-known/openid-configuration"
+];
+
+class UpstreamHttpError extends Error {
+  status;
+  wwwAuthenticate;
+  bodyText;
+  constructor(upstreamName, status, bodyText, wwwAuthenticate) {
+    super(`Upstream ${upstreamName} returned HTTP ${status}: ${bodyText.slice(0, 400)}`);
+    this.name = "UpstreamHttpError";
+    this.status = status;
+    this.bodyText = bodyText;
+    this.wwwAuthenticate = wwwAuthenticate;
+  }
+}
+function makeError(id, code, message, data) {
+  return {
+    jsonrpc: "2.0",
+    id,
+    error: {
+      code,
+      message,
+      data
+    }
+  };
+}
+function makeResult(id, result) {
+  return {
+    jsonrpc: "2.0",
+    id,
+    result
+  };
+}
+function listUpstreams(config, upstreamFilter) {
+  const all = Object.entries(config.servers).filter(([, spec]) => isServerEnabled(spec)).map(([name, spec]) => ({ name, spec }));
+  if (!upstreamFilter) {
+    return all;
+  }
+  return all.filter((upstream) => upstream.name === upstreamFilter);
+}
+function getSingleUpstream(config) {
+  const upstreams = listUpstreams(config);
+  if (upstreams.length !== 1) {
+    return null;
+  }
+  return upstreams[0] ?? null;
+}
+function getSingleHttpUpstream(config) {
+  const upstream = getSingleUpstream(config);
+  if (!upstream || upstream.spec.transport !== "http") {
+    return null;
+  }
+  return upstream;
+}
+function getScopedHttpUpstream(config, upstreamFilter) {
+  if (upstreamFilter) {
+    const selected = config.servers[upstreamFilter];
+    if (!selected || !isServerEnabled(selected) || selected.transport !== "http") {
+      return null;
+    }
+    return {
+      name: upstreamFilter,
+      spec: selected
+    };
+  }
+  return getSingleHttpUpstream(config);
+}
+function getWellKnownPrefix(pathname) {
+  for (const prefix of OAUTH_WELL_KNOWN_PREFIXES) {
+    if (pathname === prefix || pathname.startsWith(`${prefix}/`)) {
+      return prefix;
+    }
+  }
+  return null;
+}
+function getUpstreamPathSuffixForWellKnown(upstream) {
+  const upstreamUrl = new URL(upstream.spec.url);
+  if (upstreamUrl.pathname === "/") {
+    return "";
+  }
+  return upstreamUrl.pathname.endsWith("/") ? upstreamUrl.pathname.slice(0, -1) : upstreamUrl.pathname;
+}
+function buildWellKnownUpstreamUrl(upstream, prefix) {
+  const upstreamUrl = new URL(upstream.spec.url);
+  const suffix = getUpstreamPathSuffixForWellKnown(upstream);
+  return new URL(`${prefix}${suffix}`, upstreamUrl.origin);
+}
+function getLocalOriginFromRequest(request) {
+  return `http://${request.headers.host ?? "127.0.0.1"}`;
+}
+function getRequestedUpstream(requestUrl) {
+  const value = requestUrl.searchParams.get("upstream");
+  if (!value) {
+    return;
+  }
+  return value.trim() || undefined;
+}
+function appendUpstreamQuery(url, upstream) {
+  if (!upstream) {
+    return url;
+  }
+  const parsed = new URL(url);
+  parsed.searchParams.set("upstream", upstream);
+  return parsed.toString();
+}
+function rewriteWwwAuthenticateResourceMetadata(headerValue, localResourceMetadataUrl) {
+  if (headerValue.includes("resource_metadata=")) {
+    return headerValue.replace(/resource_metadata="[^"]*"/, `resource_metadata="${localResourceMetadataUrl}"`);
+  }
+  return `${headerValue}, resource_metadata="${localResourceMetadataUrl}"`;
+}
+function isOAuthCapableServer(spec) {
+  if (spec.transport !== "http") {
+    return false;
+  }
+  const headers = spec.headers ?? {};
+  for (const headerName of Object.keys(headers)) {
+    if (headerName.toLowerCase() === "authorization") {
+      return true;
+    }
+  }
+  return false;
+}
+function splitNamespacedName(value) {
+  const split = value.indexOf(".");
+  if (split <= 0 || split >= value.length - 1) {
+    return null;
+  }
+  return {
+    serverName: value.slice(0, split),
+    upstreamName: value.slice(split + 1)
+  };
+}
+function parseNamespacedUri(uri) {
+  if (uri.startsWith("mcpx://")) {
+    const rest = uri.slice("mcpx://".length);
+    const slashIndex = rest.indexOf("/");
+    if (slashIndex <= 0 || slashIndex >= rest.length - 1) {
+      return null;
+    }
+    const serverName = rest.slice(0, slashIndex);
+    const encoded = rest.slice(slashIndex + 1);
+    try {
+      return {
+        serverName,
+        upstreamUri: decodeURIComponent(encoded)
+      };
+    } catch {
+      return null;
+    }
+  }
+  const nameSplit = splitNamespacedName(uri);
+  if (!nameSplit) {
+    return null;
+  }
+  return {
+    serverName: nameSplit.serverName,
+    upstreamUri: nameSplit.upstreamName
+  };
+}
+async function callUpstream(upstream, method, params, id, secrets, runtime, passthroughAuthorizationHeader) {
+  if (upstream.spec.transport === "stdio") {
+    return callStdioUpstream(upstream, method, params, secrets, runtime);
+  }
+  return callHttpUpstream(upstream, method, params, id, secrets, passthroughAuthorizationHeader);
+}
+function getConfiguredTimeoutMs() {
+  const configuredTimeout = Number(process.env.MCPX_UPSTREAM_TIMEOUT_MS ?? DEFAULT_UPSTREAM_TIMEOUT_MS);
+  return Number.isFinite(configuredTimeout) && configuredTimeout > 0 ? configuredTimeout : DEFAULT_UPSTREAM_TIMEOUT_MS;
+}
+function withTimeout(work, timeoutMs, timeoutMessage) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error(timeoutMessage)), timeoutMs);
+    work.then((value) => {
+      clearTimeout(timer);
+      resolve(value);
+    }, (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+  });
+}
+function specFingerprint(spec) {
+  return JSON.stringify(spec);
+}
+function resolveStdioEnv(spec, secrets) {
+  if (!spec.env || Object.keys(spec.env).length === 0) {
+    return;
+  }
+  const env = getDefaultEnvironment();
+  for (const [key, value] of Object.entries(spec.env)) {
+    env[key] = secrets.resolveMaybeSecret(value);
+  }
+  return env;
+}
+function buildStdioServerParameters(spec, secrets) {
+  return {
+    command: spec.command,
+    args: spec.args ?? [],
+    cwd: spec.cwd,
+    env: resolveStdioEnv(spec, secrets)
+  };
+}
+async function closeStdioConnection(entry) {
+  try {
+    const connection = await entry.promise;
+    await connection.transport.close();
+  } catch {}
+}
+async function reconcileStdioConnections(config, runtime) {
+  const activeSpecs = new Map(Object.entries(config.servers).filter(([, spec]) => isServerEnabled(spec)).map(([name, spec]) => [name, specFingerprint(spec)]));
+  const staleNames = [];
+  for (const [name, entry] of runtime.stdioConnections.entries()) {
+    const expectedFingerprint = activeSpecs.get(name);
+    if (!expectedFingerprint || expectedFingerprint !== entry.fingerprint) {
+      staleNames.push(name);
+    }
+  }
+  for (const name of staleNames) {
+    const entry = runtime.stdioConnections.get(name);
+    if (!entry) {
+      continue;
+    }
+    runtime.stdioConnections.delete(name);
+    await closeStdioConnection(entry);
+  }
+}
+function invalidateStdioConnection(name, runtime) {
+  const existing = runtime.stdioConnections.get(name);
+  if (!existing) {
+    return;
+  }
+  runtime.stdioConnections.delete(name);
+  closeStdioConnection(existing);
+}
+async function getStdioConnection(upstream, secrets, runtime) {
+  const fingerprint = specFingerprint(upstream.spec);
+  const existing = runtime.stdioConnections.get(upstream.name);
+  if (existing) {
+    if (existing.fingerprint === fingerprint) {
+      return existing.promise;
+    }
+    runtime.stdioConnections.delete(upstream.name);
+    closeStdioConnection(existing);
+  }
+  const promise = (async () => {
+    const transport = new StdioClientTransport(buildStdioServerParameters(upstream.spec, secrets));
+    const client = new Client({
+      name: "mcpx",
+      version: SERVER_VERSION
+    });
+    await withTimeout(client.connect(transport), DEFAULT_CONNECT_TIMEOUT_MS, `Upstream ${upstream.name} failed to connect within ${DEFAULT_CONNECT_TIMEOUT_MS}ms.`);
+    return {
+      fingerprint,
+      client,
+      transport
+    };
+  })();
+  runtime.stdioConnections.set(upstream.name, {
+    fingerprint,
+    promise
+  });
+  try {
+    return await promise;
+  } catch (error) {
+    runtime.stdioConnections.delete(upstream.name);
+    throw error;
+  }
+}
+async function callStdioUpstream(upstream, method, params, secrets, runtime) {
+  try {
+    const connection = await getStdioConnection(upstream, secrets, runtime);
+    const timeoutMs = getConfiguredTimeoutMs();
+    const timeoutMessage = `Upstream ${upstream.name} timed out after ${timeoutMs}ms for method ${method}.`;
+    if (method === "tools/list") {
+      return withTimeout(connection.client.listTools(params), timeoutMs, timeoutMessage);
+    }
+    if (method === "resources/list") {
+      return withTimeout(connection.client.listResources(params), timeoutMs, timeoutMessage);
+    }
+    if (method === "prompts/list") {
+      return withTimeout(connection.client.listPrompts(params), timeoutMs, timeoutMessage);
+    }
+    if (method === "tools/call") {
+      return withTimeout(connection.client.callTool(params), timeoutMs, timeoutMessage);
+    }
+    if (method === "resources/read") {
+      return withTimeout(connection.client.readResource(params), timeoutMs, timeoutMessage);
+    }
+    if (method === "prompts/get") {
+      return withTimeout(connection.client.getPrompt(params), timeoutMs, timeoutMessage);
+    }
+    throw new Error(`Unsupported stdio passthrough method: ${method}`);
+  } catch (error) {
+    invalidateStdioConnection(upstream.name, runtime);
+    throw error;
+  }
+}
+async function callHttpUpstream(upstream, method, params, id, secrets, passthroughAuthorizationHeader) {
+  const headers = {
+    "content-type": "application/json",
+    accept: "application/json, text/event-stream"
+  };
+  for (const [key, value] of Object.entries(upstream.spec.headers ?? {})) {
+    headers[key] = secrets.resolveMaybeSecret(value);
+  }
+  if (passthroughAuthorizationHeader) {
+    headers.Authorization = passthroughAuthorizationHeader;
+  }
+  const timeoutMs = getConfiguredTimeoutMs();
+  const timeoutController = new AbortController;
+  const timeoutHandle = setTimeout(() => timeoutController.abort(), timeoutMs);
+  let response;
+  try {
+    response = await fetch(upstream.spec.url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        jsonrpc: JSON_RPC_VERSION2,
+        id,
+        method,
+        params
+      }),
+      signal: timeoutController.signal
+    });
+  } catch (error) {
+    const name = error.name;
+    if (name === "AbortError") {
+      throw new Error(`Upstream ${upstream.name} timed out after ${timeoutMs}ms for method ${method}.`);
+    }
+    throw error;
+  } finally {
+    clearTimeout(timeoutHandle);
+  }
+  if (!response.ok) {
+    const responseText = await response.text();
+    throw new UpstreamHttpError(upstream.name, response.status, responseText, response.headers.get("www-authenticate") ?? undefined);
+  }
+  let payload = null;
+  const contentType = response.headers.get("content-type") ?? "";
+  if (contentType.includes("application/json")) {
+    payload = JSON.parse(await response.text());
+  } else if (contentType.includes("text/event-stream")) {
+    payload = await readSseJsonRpcResponse(response, id);
+  } else {
+    try {
+      payload = JSON.parse(await response.text());
+    } catch {
+      payload = null;
+    }
+  }
+  if (!payload) {
+    throw new Error(`Upstream ${upstream.name} response could not be parsed as JSON-RPC payload.`);
+  }
+  if (payload.error) {
+    throw new Error(`Upstream ${upstream.name} error: ${payload.error.message}`);
+  }
+  return payload.result;
+}
+async function readSseJsonRpcResponse(response, expectedId) {
+  if (!response.body) {
+    return null;
+  }
+  const decoder = new TextDecoder;
+  const reader = response.body.getReader();
+  let buffer = "";
+  let dataLines = [];
+  let latestPayload = null;
+  const consumeEvent = () => {
+    if (dataLines.length === 0) {
+      return null;
+    }
+    const combined = dataLines.join(`
+`).trim();
+    dataLines = [];
+    if (!combined || combined === "[DONE]") {
+      return null;
+    }
+    try {
+      const parsed = JSON.parse(combined);
+      latestPayload = parsed;
+      const parsedId = parsed.id ?? null;
+      if (parsedId === expectedId) {
+        return parsed;
+      }
+      return null;
+    } catch {
+      return null;
+    }
+  };
+  try {
+    while (true) {
+      const { value, done } = await reader.read();
+      if (done) {
+        break;
+      }
+      buffer += decoder.decode(value, { stream: true });
+      while (true) {
+        const newlineIndex = buffer.indexOf(`
+`);
+        if (newlineIndex < 0) {
+          break;
+        }
+        let line = buffer.slice(0, newlineIndex);
+        buffer = buffer.slice(newlineIndex + 1);
+        if (line.endsWith("\r")) {
+          line = line.slice(0, -1);
+        }
+        if (line.startsWith("data:")) {
+          dataLines.push(line.slice("data:".length).trimStart());
+          continue;
+        }
+        if (line === "") {
+          const matched = consumeEvent();
+          if (matched) {
+            return matched;
+          }
+        }
+      }
+    }
+    buffer += decoder.decode();
+    if (buffer.length > 0) {
+      let finalLine = buffer;
+      if (finalLine.endsWith("\r")) {
+        finalLine = finalLine.slice(0, -1);
+      }
+      if (finalLine.startsWith("data:")) {
+        dataLines.push(finalLine.slice("data:".length).trimStart());
+      }
+    }
+    return consumeEvent() ?? latestPayload;
+  } finally {
+    try {
+      await reader.cancel();
+    } catch {}
+  }
+}
+function authHeaderIsValid(request, expectedToken) {
+  const localTokenHeader = request.headers["x-mcpx-local-token"];
+  if (typeof localTokenHeader === "string" && localTokenHeader === expectedToken) {
+    return true;
+  }
+  if (Array.isArray(localTokenHeader) && localTokenHeader.includes(expectedToken)) {
+    return true;
+  }
+  const authHeader = request.headers.authorization;
+  if (!authHeader) {
+    return false;
+  }
+  const [scheme, token] = authHeader.split(" ");
+  return scheme === "Bearer" && token === expectedToken;
+}
+function isAuthChallenge(error) {
+  return error instanceof UpstreamHttpError && (error.status === 401 || error.status === 403);
+}
+function getClientAuthorizationForUpstream(request, expectedToken) {
+  const authHeader = request.headers.authorization;
+  if (!authHeader) {
+    return;
+  }
+  const [scheme, token] = authHeader.split(" ");
+  if (scheme === "Bearer" && token === expectedToken) {
+    return;
+  }
+  return authHeader;
+}
+async function handleListTools(config, secrets, runtime, upstreamFilter, clientAuthorizationHeader) {
+  const tools = [];
+  const flattenedUpstream = listUpstreams(config, upstreamFilter).length === 1;
+  const flattenNames = Boolean(flattenedUpstream);
+  const upstreams = listUpstreams(config, upstreamFilter);
+  for (const upstream of upstreams) {
+    try {
+      const result = await callUpstream(upstream, "tools/list", {}, `list-tools-${upstream.name}`, secrets, runtime, clientAuthorizationHeader);
+      for (const tool of result.tools ?? []) {
+        const name = typeof tool.name === "string" ? tool.name : "tool";
+        tools.push({
+          ...tool,
+          name: flattenNames ? name : `${upstream.name}.${name}`
+        });
+      }
+    } catch (error) {
+      if (upstreams.length === 1 && isAuthChallenge(error)) {
+        throw error;
+      }
+    }
+  }
+  return { tools };
+}
+async function handleListResources(config, secrets, runtime, upstreamFilter, clientAuthorizationHeader) {
+  const resources = [];
+  const flattenedUpstream = listUpstreams(config, upstreamFilter).length === 1;
+  const flattenNames = Boolean(flattenedUpstream);
+  const upstreams = listUpstreams(config, upstreamFilter);
+  for (const upstream of upstreams) {
+    try {
+      const result = await callUpstream(upstream, "resources/list", {}, `list-resources-${upstream.name}`, secrets, runtime, clientAuthorizationHeader);
+      for (const resource of result.resources ?? []) {
+        const originalUri = typeof resource.uri === "string" ? resource.uri : "";
+        const originalName = typeof resource.name === "string" ? resource.name : originalUri;
+        resources.push({
+          ...resource,
+          name: flattenNames ? originalName : `${upstream.name}.${originalName}`,
+          uri: flattenNames ? originalUri : `mcpx://${upstream.name}/${encodeURIComponent(originalUri)}`
+        });
+      }
+    } catch (error) {
+      if (upstreams.length === 1 && isAuthChallenge(error)) {
+        throw error;
+      }
+    }
+  }
+  return { resources };
+}
+async function handleListPrompts(config, secrets, runtime, upstreamFilter, clientAuthorizationHeader) {
+  const prompts = [];
+  const flattenedUpstream = listUpstreams(config, upstreamFilter).length === 1;
+  const flattenNames = Boolean(flattenedUpstream);
+  const upstreams = listUpstreams(config, upstreamFilter);
+  for (const upstream of upstreams) {
+    try {
+      const result = await callUpstream(upstream, "prompts/list", {}, `list-prompts-${upstream.name}`, secrets, runtime, clientAuthorizationHeader);
+      for (const prompt of result.prompts ?? []) {
+        const name = typeof prompt.name === "string" ? prompt.name : "prompt";
+        prompts.push({
+          ...prompt,
+          name: flattenNames ? name : `${upstream.name}.${name}`
+        });
+      }
+    } catch (error) {
+      if (upstreams.length === 1 && isAuthChallenge(error)) {
+        throw error;
+      }
+    }
+  }
+  return { prompts };
+}
+async function routeNamespacedCall(config, method, params, id, secrets, runtime, upstreamFilter, clientAuthorizationHeader) {
+  if (!params || typeof params !== "object") {
+    return makeError(id, -32602, "Missing params object.");
+  }
+  const upstreamEntries = listUpstreams(config, upstreamFilter);
+  const upstreams = new Map(upstreamEntries.map((entry) => [entry.name, entry]));
+  const flattenedUpstream = upstreamEntries.length === 1 ? upstreamEntries[0] : null;
+  if (method === "tools/call") {
+    const toolName = typeof params.name === "string" ? params.name : "";
+    const split = splitNamespacedName(toolName);
+    if (split && upstreamFilter && split.serverName !== upstreamFilter) {
+      return makeError(id, -32602, `Tool belongs to upstream ${split.serverName}, but request is scoped to ${upstreamFilter}.`);
+    }
+    let upstream2;
+    let upstreamToolName = toolName;
+    if (split && upstreams.has(split.serverName)) {
+      upstream2 = upstreams.get(split.serverName);
+      upstreamToolName = split.upstreamName;
+    } else if (flattenedUpstream) {
+      upstream2 = flattenedUpstream;
+    }
+    if (!upstream2) {
+      return makeError(id, -32602, "Tool name must be namespaced as <server>.<tool>.");
+    }
+    const upstreamParams2 = {
+      ...params,
+      name: upstreamToolName
+    };
+    try {
+      const result = await callUpstream(upstream2, method, upstreamParams2, id, secrets, runtime, clientAuthorizationHeader);
+      return makeResult(id, result);
+    } catch (error) {
+      if (isAuthChallenge(error)) {
+        throw error;
+      }
+      return makeError(id, -32000, error.message);
+    }
+  }
+  if (method === "prompts/get") {
+    const promptName = typeof params.name === "string" ? params.name : "";
+    const split = splitNamespacedName(promptName);
+    if (split && upstreamFilter && split.serverName !== upstreamFilter) {
+      return makeError(id, -32602, `Prompt belongs to upstream ${split.serverName}, but request is scoped to ${upstreamFilter}.`);
+    }
+    let upstream2;
+    let upstreamPromptName = promptName;
+    if (split && upstreams.has(split.serverName)) {
+      upstream2 = upstreams.get(split.serverName);
+      upstreamPromptName = split.upstreamName;
+    } else if (flattenedUpstream) {
+      upstream2 = flattenedUpstream;
+    }
+    if (!upstream2) {
+      return makeError(id, -32602, "Prompt name must be namespaced as <server>.<prompt>.");
+    }
+    const upstreamParams2 = {
+      ...params,
+      name: upstreamPromptName
+    };
+    try {
+      const result = await callUpstream(upstream2, method, upstreamParams2, id, secrets, runtime, clientAuthorizationHeader);
+      return makeResult(id, result);
+    } catch (error) {
+      if (isAuthChallenge(error)) {
+        throw error;
+      }
+      return makeError(id, -32000, error.message);
+    }
+  }
+  const uri = typeof params.uri === "string" ? params.uri : "";
+  const parsed = parseNamespacedUri(uri);
+  if (parsed && upstreamFilter && parsed.serverName !== upstreamFilter) {
+    return makeError(id, -32602, `Resource belongs to upstream ${parsed.serverName}, but request is scoped to ${upstreamFilter}.`);
+  }
+  let upstream;
+  let upstreamUri = uri;
+  if (parsed && upstreams.has(parsed.serverName)) {
+    upstream = upstreams.get(parsed.serverName);
+    upstreamUri = parsed.upstreamUri;
+  } else if (flattenedUpstream) {
+    upstream = flattenedUpstream;
+  }
+  if (!upstream) {
+    return makeError(id, -32602, "Resource URI must be namespaced (mcpx://<server>/<encoded-uri>).", { uri });
+  }
+  const upstreamParams = {
+    ...params,
+    uri: upstreamUri
+  };
+  try {
+    const result = await callUpstream(upstream, method, upstreamParams, id, secrets, runtime, clientAuthorizationHeader);
+    return makeResult(id, result);
+  } catch (error) {
+    if (isAuthChallenge(error)) {
+      throw error;
+    }
+    return makeError(id, -32000, error.message);
+  }
+}
+async function handleRequestObject(request, secrets, runtime, upstreamFilter, clientAuthorizationHeader) {
+  const id = request.id ?? null;
+  if (!request.method || typeof request.method !== "string") {
+    return makeError(id, -32600, "Invalid JSON-RPC request: missing method.");
+  }
+  if (request.method === "initialize") {
+    const requestedProtocol = request.params?.protocolVersion;
+    const protocolVersion = typeof requestedProtocol === "string" && requestedProtocol.length > 0 ? requestedProtocol : "2025-11-25";
+    return makeResult(id, {
+      protocolVersion,
+      capabilities: {
+        tools: {},
+        resources: {},
+        prompts: {}
+      },
+      serverInfo: {
+        name: "mcpx",
+        version: SERVER_VERSION
+      }
+    });
+  }
+  if (request.method === "notifications/initialized") {
+    return null;
+  }
+  if (request.method === "ping") {
+    return makeResult(id, { ok: true });
+  }
+  const config = loadConfig();
+  if (upstreamFilter && listUpstreams(config, upstreamFilter).length === 0) {
+    return makeError(id, -32602, `Unknown upstream: ${upstreamFilter}`);
+  }
+  await reconcileStdioConnections(config, runtime);
+  if (request.method === "tools/list") {
+    const result = await handleListTools(config, secrets, runtime, upstreamFilter, clientAuthorizationHeader);
+    return makeResult(id, result);
+  }
+  if (request.method === "resources/list") {
+    const result = await handleListResources(config, secrets, runtime, upstreamFilter, clientAuthorizationHeader);
+    return makeResult(id, result);
+  }
+  if (request.method === "prompts/list") {
+    const result = await handleListPrompts(config, secrets, runtime, upstreamFilter, clientAuthorizationHeader);
+    return makeResult(id, result);
+  }
+  if (request.method === "tools/call" || request.method === "resources/read" || request.method === "prompts/get") {
+    return routeNamespacedCall(config, request.method, request.params, id, secrets, runtime, upstreamFilter, clientAuthorizationHeader);
+  }
+  return makeError(id, -32601, `Unsupported method: ${request.method}`);
+}
+async function maybeHandleWellKnownOAuthRequest(request, response, requestUrl, secrets) {
+  const pathname = requestUrl.pathname;
+  const wellKnownPrefix = getWellKnownPrefix(pathname);
+  if (!wellKnownPrefix) {
+    return false;
+  }
+  if (request.method !== "GET") {
+    response.statusCode = 405;
+    response.setHeader("content-type", "application/json");
+    response.end(JSON.stringify({ error: "method_not_allowed" }));
+    return true;
+  }
+  const config = loadConfig();
+  const requestedUpstream = getRequestedUpstream(requestUrl);
+  const upstream = getScopedHttpUpstream(config, requestedUpstream);
+  if (!upstream) {
+    response.statusCode = 404;
+    response.setHeader("content-type", "application/json");
+    response.end(JSON.stringify({ error: "not_found" }));
+    return true;
+  }
+  if (!isOAuthCapableServer(upstream.spec)) {
+    response.statusCode = 404;
+    response.setHeader("content-type", "application/json");
+    response.end(JSON.stringify({ error: "not_found" }));
+    return true;
+  }
+  const upstreamWellKnownUrl = buildWellKnownUpstreamUrl(upstream, wellKnownPrefix);
+  const headers = {
+    accept: "application/json"
+  };
+  const protocolVersion = request.headers["mcp-protocol-version"];
+  if (typeof protocolVersion === "string" && protocolVersion.length > 0) {
+    headers["mcp-protocol-version"] = protocolVersion;
+  }
+  for (const [key, value] of Object.entries(upstream.spec.headers ?? {})) {
+    headers[key] = secrets.resolveMaybeSecret(value);
+  }
+  const upstreamResponse = await fetch(upstreamWellKnownUrl, {
+    method: "GET",
+    headers
+  });
+  let bodyText = await upstreamResponse.text();
+  response.statusCode = upstreamResponse.status;
+  const contentType = upstreamResponse.headers.get("content-type");
+  if (contentType) {
+    response.setHeader("content-type", contentType);
+  }
+  const cacheControl = upstreamResponse.headers.get("cache-control");
+  if (cacheControl) {
+    response.setHeader("cache-control", cacheControl);
+  }
+  const wwwAuthenticate = upstreamResponse.headers.get("www-authenticate");
+  if (wwwAuthenticate) {
+    response.setHeader("www-authenticate", wwwAuthenticate);
+  }
+  if (wellKnownPrefix === "/.well-known/oauth-protected-resource" && contentType?.includes("application/json") && upstreamResponse.ok) {
+    try {
+      const parsed = JSON.parse(bodyText);
+      parsed.resource = appendUpstreamQuery(`${getLocalOriginFromRequest(request)}/mcp`, requestedUpstream);
+      bodyText = JSON.stringify(parsed);
+    } catch {}
+  }
+  response.end(bodyText);
+  return true;
+}
+function createGatewayServer(options) {
+  const debug = process.env.MCPX_GATEWAY_DEBUG === "1";
+  const runtime = {
+    stdioConnections: new Map
+  };
+  const server = http.createServer(async (request, response) => {
+    let requestUrl = new URL(request.url ?? "/", `http://${request.headers.host ?? "127.0.0.1"}`);
+    try {
+      requestUrl = new URL(request.url ?? "/", `http://${request.headers.host ?? "127.0.0.1"}`);
+      const upstreamFilter = getRequestedUpstream(requestUrl);
+      if (debug) {
+        console.error(`[mcpx gateway] ${request.method ?? "?"} ${requestUrl.pathname} auth=${request.headers.authorization ? "yes" : "no"} accept=${request.headers.accept ?? ""}`);
+        console.error(`[mcpx gateway] headers=${JSON.stringify(request.headers)}`);
+      }
+      if (await maybeHandleWellKnownOAuthRequest(request, response, requestUrl, options.secrets)) {
+        if (debug) {
+          console.error(`[mcpx gateway] -> ${response.statusCode} (well-known oauth)`);
+        }
+        return;
+      }
+      if (requestUrl.pathname !== "/mcp") {
+        response.statusCode = 404;
+        response.setHeader("content-type", "application/json");
+        response.end(JSON.stringify({ error: "not_found" }));
+        if (debug) {
+          console.error(`[mcpx gateway] -> 404`);
+        }
+        return;
+      }
+      if (request.method === "GET") {
+        if (!authHeaderIsValid(request, options.expectedToken)) {
+          response.statusCode = 401;
+          response.setHeader("content-type", "application/json");
+          response.end(JSON.stringify(makeError(null, -32001, "Unauthorized")));
+          if (debug) {
+            console.error(`[mcpx gateway] -> 401 (GET unauthorized)`);
+          }
+          return;
+        }
+        response.statusCode = 200;
+        response.setHeader("content-type", "application/json");
+        response.end(JSON.stringify({ ok: true, server: "mcpx" }));
+        if (debug) {
+          console.error(`[mcpx gateway] -> 200 (GET ok)`);
+        }
+        return;
+      }
+      if (request.method !== "POST") {
+        response.statusCode = 405;
+        response.end("Method Not Allowed");
+        if (debug) {
+          console.error(`[mcpx gateway] -> 405`);
+        }
+        return;
+      }
+      if (!authHeaderIsValid(request, options.expectedToken)) {
+        response.statusCode = 401;
+        response.setHeader("content-type", "application/json");
+        response.end(JSON.stringify(makeError(null, -32001, "Unauthorized")));
+        if (debug) {
+          console.error(`[mcpx gateway] -> 401 (POST unauthorized)`);
+        }
+        return;
+      }
+      let body = "";
+      request.setEncoding("utf8");
+      for await (const chunk of request) {
+        body += chunk;
+        if (body.length > 1e7) {
+          response.statusCode = 413;
+          response.end("Payload Too Large");
+          if (debug) {
+            console.error(`[mcpx gateway] -> 413`);
+          }
+          return;
+        }
+      }
+      const parsed = JSON.parse(body);
+      const hasInitialize = Array.isArray(parsed) ? parsed.some((item) => item.method === "initialize") : parsed.method === "initialize";
+      const responses = [];
+      const clientAuthorizationHeader = getClientAuthorizationForUpstream(request, options.expectedToken);
+      if (Array.isArray(parsed)) {
+        for (const item of parsed) {
+          if (debug) {
+            console.error(`[mcpx gateway] rpc method=${item.method} id=${item.id ?? "null"}`);
+          }
+          const rpcResponse = await handleRequestObject(item, options.secrets, runtime, upstreamFilter, clientAuthorizationHeader);
+          if (debug && rpcResponse?.error) {
+            console.error(`[mcpx gateway] rpc error code=${rpcResponse.error.code} message=${rpcResponse.error.message}`);
+          }
+          if (rpcResponse) {
+            responses.push(rpcResponse);
+          }
+        }
+      } else {
+        if (debug) {
+          console.error(`[mcpx gateway] rpc method=${parsed.method} id=${parsed.id ?? "null"}`);
+          if (parsed.method === "initialize") {
+            console.error(`[mcpx gateway] rpc initialize params=${JSON.stringify(parsed.params ?? {})}`);
+          }
+        }
+        const rpcResponse = await handleRequestObject(parsed, options.secrets, runtime, upstreamFilter, clientAuthorizationHeader);
+        if (debug && rpcResponse?.error) {
+          console.error(`[mcpx gateway] rpc error code=${rpcResponse.error.code} message=${rpcResponse.error.message}`);
+        }
+        if (rpcResponse) {
+          responses.push(rpcResponse);
+        }
+      }
+      response.statusCode = 200;
+      const acceptsSse = (request.headers.accept ?? "").includes("text/event-stream");
+      if (acceptsSse) {
+        response.setHeader("content-type", "text/event-stream");
+        response.setHeader("cache-control", "no-cache");
+        response.setHeader("connection", "keep-alive");
+      } else {
+        response.setHeader("content-type", "application/json");
+      }
+      if (hasInitialize) {
+        const sessionId = crypto3.randomUUID();
+        response.setHeader("mcp-session-id", sessionId);
+        response.setHeader("MCP-Session-Id", sessionId);
+      }
+      if (debug) {
+        console.error(`[mcpx gateway] -> 200 (rpc)`);
+      }
+      if (acceptsSse) {
+        const payloads = responses.length > 0 ? responses : [];
+        for (const payload of payloads) {
+          response.write(`event: message
+`);
+          response.write(`data: ${JSON.stringify(payload)}
+
+`);
+        }
+        response.end();
+      } else if (responses.length === 1) {
+        response.end(JSON.stringify(responses[0]));
+      } else {
+        response.end(JSON.stringify(responses));
+      }
+    } catch (error) {
+      if (isAuthChallenge(error)) {
+        response.statusCode = error.status;
+        response.setHeader("content-type", "application/json");
+        if (error.wwwAuthenticate) {
+          const localResourceMetadataUrl = appendUpstreamQuery(`${getLocalOriginFromRequest(request)}/.well-known/oauth-protected-resource`, getRequestedUpstream(requestUrl));
+          response.setHeader("www-authenticate", rewriteWwwAuthenticateResourceMetadata(error.wwwAuthenticate, localResourceMetadataUrl));
+        }
+        response.end(error.bodyText.length > 0 ? error.bodyText : JSON.stringify({ error: "upstream_auth_required" }));
+        if (debug) {
+          console.error(`[mcpx gateway] -> ${error.status} upstream auth challenge`);
+        }
+        return;
+      }
+      response.statusCode = 500;
+      response.setHeader("content-type", "application/json");
+      response.end(JSON.stringify(makeError(null, -32000, error.message)));
+      if (debug) {
+        console.error(`[mcpx gateway] -> 500 ${error.message}`);
+      }
+    }
+  });
+  server.on("close", () => {
+    for (const entry of runtime.stdioConnections.values()) {
+      closeStdioConnection(entry);
+    }
+    runtime.stdioConnections.clear();
+  });
+  server.listen(options.port, "127.0.0.1");
+  return server;
+}
+
+// src/core/daemon.ts
+function readPidFromFile(pidPath = getPidPath()) {
+  if (!fs8.existsSync(pidPath)) {
+    return null;
+  }
+  const raw = fs8.readFileSync(pidPath, "utf8").trim();
+  if (!raw) {
+    return null;
+  }
+  const pid = Number(raw);
+  if (!Number.isFinite(pid) || pid <= 0) {
+    return null;
+  }
+  return pid;
+}
+function processExists(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function isPortAvailable(port) {
+  return new Promise((resolve) => {
+    const tester = net.createServer();
+    tester.once("error", () => {
+      resolve(false);
+    });
+    tester.once("listening", () => {
+      tester.close(() => resolve(true));
+    });
+    tester.listen(port, "127.0.0.1");
+  });
+}
+async function resolveGatewayPort(config) {
+  if (await isPortAvailable(config.gateway.port)) {
+    return config.gateway.port;
+  }
+  for (let offset = 1;offset <= 20; offset += 1) {
+    const candidate = config.gateway.port + offset;
+    if (candidate > 65535) {
+      break;
+    }
+    if (await isPortAvailable(candidate)) {
+      config.gateway.port = candidate;
+      saveConfig(config);
+      return candidate;
+    }
+  }
+  throw new Error(`No available local port found near ${config.gateway.port}.`);
+}
+function getDaemonStatus(config) {
+  const pidPath = getPidPath();
+  const pid = readPidFromFile(pidPath);
+  if (!pid) {
+    return {
+      running: false,
+      pidFile: pidPath,
+      logFile: getLogPath(),
+      port: config.gateway.port
+    };
+  }
+  return {
+    running: processExists(pid),
+    pid,
+    pidFile: pidPath,
+    logFile: getLogPath(),
+    port: config.gateway.port
+  };
+}
+async function startDaemon(config, cliPath, secrets) {
+  const existingStatus = getDaemonStatus(config);
+  if (existingStatus.running && existingStatus.pid) {
+    return {
+      started: false,
+      pid: existingStatus.pid,
+      port: config.gateway.port,
+      message: "mcpx daemon already running."
+    };
+  }
+  const port = await resolveGatewayPort(config);
+  ensureGatewayToken(config, secrets);
+  const pidPath = getPidPath();
+  const logPath = getLogPath();
+  ensureParentDir(pidPath);
+  ensureParentDir(logPath);
+  const logFd = fs8.openSync(logPath, "a", 384);
+  const child = spawn2(process.execPath, [cliPath, "daemon", "run", "--port", String(port)], {
+    detached: true,
+    stdio: ["ignore", logFd, logFd],
+    env: {
+      ...process.env,
+      MCPX_DAEMON_CHILD: "1"
+    }
+  });
+  child.unref();
+  fs8.writeFileSync(pidPath, `${child.pid}
+`, { mode: 384 });
+  startBackgroundUpdateCheck();
+  return {
+    started: true,
+    pid: child.pid ?? -1,
+    port,
+    message: "mcpx daemon started."
+  };
+}
+function stopDaemon() {
+  const pidPath = getPidPath();
+  const pid = readPidFromFile(pidPath);
+  if (!pid) {
+    return {
+      stopped: false,
+      message: "mcpx daemon is not running."
+    };
+  }
+  try {
+    process.kill(pid, "SIGTERM");
+  } catch {}
+  try {
+    fs8.unlinkSync(pidPath);
+  } catch {}
+  return {
+    stopped: true,
+    message: `Stopped mcpx daemon (pid ${pid}).`
+  };
+}
+async function restartDaemon(config, cliPath, secrets) {
+  stopDaemon();
+  return startDaemon(config, cliPath, secrets);
+}
+function readDaemonLogs(maxLines = 200) {
+  const logPath = getLogPath();
+  if (!fs8.existsSync(logPath)) {
+    return "";
+  }
+  const lines = fs8.readFileSync(logPath, "utf8").split(`
+`);
+  return lines.slice(Math.max(lines.length - maxLines, 0)).join(`
+`);
+}
+function runDaemonForeground(config, port, secrets) {
+  return new Promise((resolve, reject) => {
+    const tokenName = getGatewayTokenSecretName(config);
+    const token = secrets.getSecret(tokenName);
+    if (!token) {
+      reject(new Error(`Local gateway token not found: ${tokenName}`));
+      return;
+    }
+    const server = createGatewayServer({
+      port,
+      expectedToken: token,
+      secrets
+    });
+    const cleanup = () => {
+      server.close(() => resolve());
+    };
+    process.on("SIGINT", cleanup);
+    process.on("SIGTERM", cleanup);
+    server.on("error", (error) => {
+      reject(error);
+    });
+  });
+}
+
+// src/core/status.ts
+var STATUS_CLIENTS = ["claude", "claude-desktop", "codex", "cursor", "cline", "opencode", "kiro", "vscode", "qwen"];
+function describeServerTarget(spec) {
+  if (spec.transport === "http") {
+    return spec.url;
+  }
+  const args = (spec.args ?? []).join(" ");
+  const command = `${spec.command}${args ? ` ${args}` : ""}`;
+  return spec.cwd ? `${command} (cwd: ${spec.cwd})` : command;
+}
+function deriveClientStatus(managed, configured) {
+  if (configured) {
+    return configured;
+  }
+  return managed ? "SYNCED" : "SKIPPED";
+}
+function buildClientMappings(config, managedIndex, serverName) {
+  return STATUS_CLIENTS.map((clientId) => {
+    const configState = config.clients[clientId];
+    const managedClient = managedIndex.managed[clientId];
+    const managedEntry = managedClient?.entries?.[`${serverName} (mcpx)`];
+    const managed = Boolean(managedEntry);
+    return {
+      clientId,
+      managed,
+      status: deriveClientStatus(managed, configState?.status),
+      configPath: managedClient?.configPath ?? configState?.configPath,
+      message: configState?.message,
+      lastSyncAt: managedEntry?.lastSyncedAt ?? configState?.lastSyncAt
+    };
+  });
+}
+function buildAuthBindings(spec) {
+  return listAuthBindings(spec).map((binding) => ({
+    kind: binding.kind,
+    key: binding.key,
+    value: binding.value,
+    secretName: secretRefName(binding.value) ?? undefined
+  }));
+}
+function buildStatusReport(config, managedIndex, daemon = getDaemonStatus(config)) {
+  const serverNames = Object.keys(config.servers).sort((left, right) => left.localeCompare(right));
+  const servers = serverNames.map((name) => {
+    const spec = config.servers[name];
+    return {
+      name,
+      enabled: isServerEnabled(spec),
+      transport: spec.transport,
+      target: describeServerTarget(spec),
+      authBindings: buildAuthBindings(spec),
+      clients: buildClientMappings(config, managedIndex, name)
+    };
+  });
+  return {
+    gatewayUrl: getGatewayUrl(config),
+    daemon,
+    upstreamCount: servers.length,
+    servers,
+    clients: config.clients
+  };
+}
+
+export { getConfigPath, getManagedIndexPath, defaultConfig, loadConfig, saveConfig, addServer, removeServer, updateServer, setServerEnabled, SecretsManager, readSecretValueFromStdin, probeHttpAuthRequirement, getAdapters, loadManagedIndex, getGatewayUrl, syncAllClients, toSecretRef, secretRefName, defaultAuthSecretName, resolveAuthTarget, applyAuthReference, removeAuthReference, listAuthBindings, maybePrefixBearer, APP_VERSION, compareVersions, checkForUpdates, getStagedUpdate, clearStagedUpdate, getStagedCliPath, startBackgroundUpdateCheck, runBackgroundUpdate, performUpdate, performRollback, getDaemonStatus, startDaemon, stopDaemon, restartDaemon, readDaemonLogs, runDaemonForeground, STATUS_CLIENTS, buildStatusReport };