@kwonye/mcpx 0.1.75 → 0.1.79

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAm/CA,wBAAsB,MAAM,CAAC,IAAI,WAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAkE/D"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAo2DA,wBAAsB,MAAM,CAAC,IAAI,WAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAmE/D"}

package/dist/cli.js

@@ -2,54 +2,72 @@
 import {
   APP_VERSION,
   STATUS_CLIENTS,
-  SecretsManager,
-  addServer,
   applyAuthReference,
   buildStatusReport,
   checkForUpdates,
   defaultAuthSecretName,
   deleteSkill,
-  ensureGatewayToken,
+  extractRequiredInputs,
+  fetchRegistryServerDetail,
   getAdapters,
-  getConfigPath,
   getDaemonStatus,
   getGatewayUrl,
-  getManagedIndexPath,
   getSkill,
   getStagedCliPath,
   getStagedUpdate,
   listAuthBindings,
   listSkills,
-  loadConfig,
   loadManagedIndex,
+  mapRegistryToSpec,
   maybePrefixBearer,
   performRollback,
   performUpdate,
   probeHttpAuthRequirement,
   readDaemonLogs,
-  readSecretValueFromStdin,
   removeAuthReference,
-  removeServer,
   resolveAuthTarget,
   restartDaemon,
   runBackgroundUpdate,
   runDaemonForeground,
-  saveConfig,
+  runOAuthLogin,
   saveSkill,
   secretRefName,
-  setServerEnabled,
+  selectBestPackage,
   startDaemon,
   stopDaemon,
   syncAllClients,
   toSecretRef
-} from "./cli-fh6jh7fs.js";
+} from "./cli-ydr75jw4.js";
 import {
+  loadConfig,
+  loadMergedConfig,
+  loadProjectConfig,
+  resolveActiveConfig,
+  saveConfig,
+  saveProjectConfig
+} from "./cli-7edpy4nk.js";
+import {
+  SecretsManager,
+  addServer,
+  ensureGatewayToken,
+  readSecretValueFromStdin,
+  registerProject,
+  removeServer,
+  setServerEnabled
+} from "./cli-s4py8ckf.js";
+import {
+  getConfigPath,
+  getManagedIndexPath
+} from "./cli-fsf33sgp.js";
+import {
+  __require,
   isServerEnabled
-} from "./cli-q8de7zb0.js";
+} from "./cli-s4gspqdf.js";
 
 // src/cli.ts
 import { Command } from "commander";
 import fs from "node:fs";
+import path from "node:path";
 import { execFileSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
 import { emitKeypressEvents } from "node:readline";
@@ -880,6 +898,7 @@ async function runStdioProxy(serverName) {
 }
 
 // src/cli.ts
+var __dirname = "/home/runner/work/mcpx/mcpx/cli/src";
 var VALID_CLIENTS = STATUS_CLIENTS;
 function parseKeyValueFlag(value, label) {
   const split = value.indexOf("=");
@@ -1049,7 +1068,8 @@ async function ensureDaemonIfEnabled(cliPath, secrets) {
 async function autoSyncManagedEntries(config, cliPath) {
   const secrets = new SecretsManager;
   await ensureDaemonIfEnabled(cliPath, secrets);
-  const summary = syncAllClients(config, secrets);
+  const mergedConfig = loadMergedConfig();
+  const summary = syncAllClients(mergedConfig, secrets);
   printSyncSummary(summary, false);
   ensureExitCodeForSyncFailures(summary.hasErrors);
 }
@@ -1058,9 +1078,13 @@ function isNegativeChoice(value) {
   return normalized === "n" || normalized === "no";
 }
 async function maybeAutoConfigureAuthForAddedServer(serverName, spec, secrets) {
-  if (spec.transport !== "http") {
-    return;
+  if (spec.transport === "http") {
+    await maybeConfigureHttpAuth(serverName, spec, secrets);
+  } else {
+    await maybeConfigureStdioAuth(serverName, spec, secrets);
   }
+}
+async function maybeConfigureHttpAuth(serverName, spec, secrets) {
   const probe = await probeHttpAuthRequirement(spec, secrets);
   if (!probe.authRequired) {
     return;
@@ -1133,9 +1157,48 @@ async function maybeAutoConfigureAuthForAddedServer(serverName, spec, secrets) {
 `);
   }
 }
-function loadStatusReport() {
-  const config = loadConfig();
-  return buildStatusReport(config, loadManagedIndex(), getDaemonStatus(config));
+async function maybeConfigureStdioAuth(serverName, spec, secrets) {
+  const binds = listAuthBindings(spec);
+  const plainEnvVars = binds.filter((b) => b.kind === "env" && !secretRefName(b.value));
+  if (plainEnvVars.length === 0) {
+    return;
+  }
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    process.stdout.write(`Server "${serverName}" has plain-text env vars. Run \`mcpx auth set ${serverName} --env KEY=VALUE --value "<token>"\` to store them securely.
+`);
+    return;
+  }
+  process.stdout.write(`Server "${serverName}" has ${plainEnvVars.length} env var(s) stored in plain text.
+`);
+  const rl = createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  try {
+    const shouldMigrate = await promptLine(rl, "Store them in the system keychain instead? (Y/n): ");
+    if (isNegativeChoice(shouldMigrate)) {
+      process.stdout.write(`Skipping keychain migration.
+`);
+      return;
+    }
+    for (const binding of plainEnvVars) {
+      const target = { kind: "env", key: binding.key };
+      const secretName = defaultAuthSecretName(serverName, target);
+      secrets.setSecret(secretName, binding.value);
+      applyAuthReference(spec, target, toSecretRef(secretName));
+      process.stdout.write(`Stored ${binding.key} as secret://${secretName}
+`);
+    }
+  } catch (error) {
+    process.stdout.write(`Keychain migration skipped: ${error.message}
+`);
+  } finally {
+    rl.close();
+  }
+}
+async function loadStatusReport() {
+  const config = loadMergedConfig();
+  return await buildStatusReport(config, loadManagedIndex(), getDaemonStatus(config));
 }
 function daemonEmoji(running) {
   return running ? "✅" : "⚠️";
@@ -1192,6 +1255,16 @@ function printSyncedConfigBullets(server, indent) {
 `);
   }
 }
+function formatTokenApprox(tokens) {
+  if (tokens === 0)
+    return "0";
+  if (tokens > 0 && tokens < 500)
+    return "<1k";
+  const thousands = Math.round(tokens / 1000);
+  if (thousands === 0)
+    return "<1k";
+  return `~${thousands}k`;
+}
 function printStatusReportText(report) {
   process.stdout.write(`Gateway URL: ${report.gatewayUrl}
 `);
@@ -1199,12 +1272,17 @@ function printStatusReportText(report) {
 `);
   process.stdout.write(`Upstream servers: ${report.upstreamCount}
 `);
+  if (report.daemon.running) {
+    process.stdout.write(`Global active tokens: ${formatTokenApprox(report.totalGlobalTokens ?? 0)}
+`);
+  }
   if (report.servers.length === 0) {
     process.stdout.write(`⚠️ No upstream servers configured.
 `);
   } else {
     for (const server of report.servers) {
-      process.stdout.write(`- ${serverHealthEmoji(server)} ${server.name} (${server.transport})
+      const tokenSuffix = server.enabled && server.tokenCount ? ` [tokens: ${formatTokenApprox(server.tokenCount.total)} (tools: ${server.tokenCount.tools}, resources: ${server.tokenCount.resources}, prompts: ${server.tokenCount.prompts})]` : "";
+      process.stdout.write(`- ${serverHealthEmoji(server)} ${server.name} (${server.transport})${tokenSuffix}
 `);
       process.stdout.write(`  state: ${server.enabled ? "enabled" : "disabled"}
 `);
@@ -1219,6 +1297,15 @@ function printStatusReportText(report) {
       printSyncedConfigBullets(server, "  ");
     }
   }
+  if (report.projects && Object.keys(report.projects).length > 0 && report.daemon.running) {
+    process.stdout.write(`Project active tokens:
+`);
+    for (const project of Object.values(report.projects)) {
+      const projectTokens = report.totalProjectTokens?.[project.path] ?? 0;
+      process.stdout.write(`- ${project.name}: ${formatTokenApprox(projectTokens)} tokens (${project.path})
+`);
+    }
+  }
   process.stdout.write(`Client sync states:
 `);
   for (const client of STATUS_CLIENTS) {
@@ -1486,6 +1573,31 @@ async function setServerEnabledInteractively(rl, serverName, enabled, cliPath) {
 `);
     return false;
   }
+  if (serverName.includes(".")) {
+    const parts = serverName.split(".");
+    const projectName = parts[0];
+    const baseServerName = parts.slice(1).join(".");
+    const globalConfigForProjects = loadConfig();
+    if (globalConfigForProjects.projects) {
+      const projectEntry = Object.values(globalConfigForProjects.projects).find((p) => p.name === projectName);
+      if (projectEntry) {
+        const localPath = path.join(projectEntry.path, ".mcpx.json");
+        if (fs.existsSync(localPath)) {
+          const projectConfig = loadProjectConfig(localPath);
+          if (projectConfig.servers[baseServerName]) {
+            setServerEnabled(projectConfig, baseServerName, enabled);
+            saveProjectConfig(projectConfig, localPath);
+            process.stdout.write(`${enabled ? "Enabled" : "Disabled"} server: ${serverName}
+`);
+            process.stdout.write(`Auto-syncing managed gateway entries across all supported clients...
+`);
+            await autoSyncManagedEntries(loadMergedConfig(), cliPath);
+            return true;
+          }
+        }
+      }
+    }
+  }
   const config = loadConfig();
   setServerEnabled(config, serverName, enabled);
   saveConfig(config);
@@ -1493,7 +1605,7 @@ async function setServerEnabledInteractively(rl, serverName, enabled, cliPath) {
 `);
   process.stdout.write(`Auto-syncing managed gateway entries across all supported clients...
 `);
-  await autoSyncManagedEntries(config, cliPath);
+  await autoSyncManagedEntries(loadMergedConfig(), cliPath);
   return true;
 }
 function buildServerActionTitle(server) {
@@ -1530,7 +1642,7 @@ function buildServerMenuDetail(server) {
 }
 async function runServerActionsMenu(rl, serverName, cliPath) {
   while (true) {
-    const report = loadStatusReport();
+    const report = await loadStatusReport();
     const server = report.servers.find((entry) => entry.name === serverName);
     if (!server) {
       process.stdout.write(`Server "${serverName}" no longer exists.
@@ -1577,7 +1689,7 @@ async function runInteractiveStatusMenu(cliPath) {
   });
   try {
     while (true) {
-      const report = loadStatusReport();
+      const report = await loadStatusReport();
       if (report.servers.length === 0) {
         clearTerminalScreen();
         process.stdout.write(`mcpx status
@@ -1614,47 +1726,170 @@ async function runInteractiveStatusMenu(cliPath) {
   }
 }
 function registerEnabledCommand(parent, enabled, cliPath) {
-  parent.command(enabled ? "enable <name>" : "disable <name>").description(`${enabled ? "Enable" : "Disable"} an upstream MCP server`).action(async (name) => {
-    const config = loadConfig();
-    setServerEnabled(config, name, enabled);
-    saveConfig(config);
-    process.stdout.write(`${enabled ? "Enabled" : "Disabled"} server: ${name}
+  parent.command(enabled ? "enable <name>" : "disable <name>").option("-g, --global", "Force target the global configuration").option("-l, --local", "Force target (or initialize) a local `.mcpx.json` configuration").description(`${enabled ? "Enable" : "Disable"} an upstream MCP server`).action(async (name, options) => {
+    const context = resolveActiveConfig({ global: options.global, local: options.local });
+    setServerEnabled(context.config, name, enabled);
+    context.save();
+    if (context.type === "project" && context.projectPath) {
+      const globalConfig = loadConfig();
+      registerProject(globalConfig, context.projectPath);
+      saveConfig(globalConfig);
+    }
+    process.stdout.write(`${enabled ? "Enabled" : "Disabled"} server: ${name} (${context.type} config)
 `);
     process.stdout.write(`Auto-syncing managed gateway entries across all supported clients...
 `);
-    await autoSyncManagedEntries(config, cliPath);
+    const mergedConfig = loadMergedConfig();
+    await autoSyncManagedEntries(mergedConfig, cliPath);
   });
 }
 function registerAddCommand(parent, cliPath) {
-  parent.command("add [values...]").allowUnknownOption(true).option("--transport <transport>", "MCP transport (auto|http|stdio)", "auto").option("--header <header>", "Header entry in KEY=VALUE form", (value, previous = []) => [...previous, value], []).option("--env <env>", "Env entry in KEY=VALUE form for stdio upstreams", (value, previous = []) => [...previous, value], []).option("--cwd <cwd>", "Working directory for stdio upstream").option("--force", "Overwrite existing server with same name").description("Add an upstream MCP server").action(async (values, options) => {
-    const config = loadConfig();
-    const parsed = parseAddServerSpec(values ?? [], options);
-    addServer(config, parsed.name, parsed.spec, options.force ?? false);
-    await maybeAutoConfigureAuthForAddedServer(parsed.name, parsed.spec, new SecretsManager);
-    saveConfig(config);
-    process.stdout.write(`Added server: ${parsed.name} (${parsed.spec.transport})
+  parent.command("add [values...]").allowUnknownOption(true).option("--transport <transport>", "MCP transport (auto|http|stdio)", "auto").option("--header <header>", "Header entry in KEY=VALUE form", (value, previous = []) => [...previous, value], []).option("--env <env>", "Env entry in KEY=VALUE form for stdio upstreams", (value, previous = []) => [...previous, value], []).option("--cwd <cwd>", "Working directory for stdio upstream").option("--force", "Overwrite existing server with same name").option("-g, --global", "Force saving to global configuration").option("-l, --local", "Force saving to local project configuration").description("Add an upstream MCP server").action(async (values, options) => {
+    const context = resolveActiveConfig({ global: options.global, local: options.local });
+    const safeValues = values ?? [];
+    const secrets = new SecretsManager;
+    if (safeValues.length === 1 && safeValues[0]?.includes("/")) {
+      const registryName = safeValues[0];
+      const shortName = registryName.split("/").pop() ?? registryName;
+      process.stdout.write(`Fetching "${registryName}" from registry...
+`);
+      const detail = await fetchRegistryServerDetail(registryName);
+      const option = selectBestPackage(detail.packages, detail.remotes);
+      const requiredInputs = extractRequiredInputs(option);
+      const resolvedValues = {};
+      if (requiredInputs.length > 0) {
+        if (!process.stdin.isTTY || !process.stdout.isTTY) {
+          throw new Error(`Server "${registryName}" requires inputs: ${requiredInputs.map((i) => `${i.name} (${i.kind})`).join(", ")}. Run in an interactive terminal.`);
+        }
+        const rl = createInterface({ input: process.stdin, output: process.stdout });
+        try {
+          for (const input of requiredInputs) {
+            const promptText = input.description ? `${input.name} (${input.kind}): ${input.description}
+Value: ` : `${input.name} (${input.kind}): `;
+            const value = await promptLine(rl, promptText);
+            if (!value) {
+              process.stdout.write(`Skipping ${input.name} (empty value).
+`);
+              continue;
+            }
+            resolvedValues[input.name] = value;
+          }
+        } finally {
+          rl.close();
+        }
+      } else {
+        process.stdout.write(`No required inputs.
+`);
+      }
+      let spec = mapRegistryToSpec(shortName, option, resolvedValues);
+      for (const input of requiredInputs) {
+        if (!input.isSecret)
+          continue;
+        const rawValue = resolvedValues[input.name];
+        if (!rawValue)
+          continue;
+        const secretName = `auth_${shortName.toLowerCase().replace(/[^a-z0-9._-]/g, "_")}_${input.kind}_${input.name.toLowerCase().replace(/[^a-z0-9._-]/g, "_")}`;
+        secrets.setSecret(secretName, rawValue);
+        if (input.kind === "header" && spec.transport === "http") {
+          const headers = { ...spec.headers ?? {} };
+          headers[input.name] = `secret://${secretName}`;
+          spec.headers = Object.keys(headers).length > 0 ? headers : undefined;
+        } else if (input.kind === "env" && spec.transport === "stdio") {
+          const env = { ...spec.env ?? {} };
+          env[input.name] = `secret://${secretName}`;
+          spec.env = Object.keys(env).length > 0 ? env : undefined;
+        }
+      }
+      let resolvedServerName = shortName;
+      if (context.type === "project") {
+        const globalConfig = loadConfig();
+        registerProject(globalConfig, context.projectPath, context.config.name);
+        saveConfig(globalConfig);
+        const projectName = context.config.name || path.basename(context.projectPath);
+        resolvedServerName = `${projectName}.${shortName}`;
+      }
+      addServer(context.config, shortName, spec, options.force ?? false);
+      context.save();
+      process.stdout.write(`Added server: ${shortName} (${spec.transport}) from registry "${registryName}" ${context.type === "project" ? `to project: ${context.projectPath}` : "globally"}
+`);
+    } else {
+      const parsed = parseAddServerSpec(safeValues, options);
+      let resolvedServerName = parsed.name;
+      if (context.type === "project") {
+        const globalConfig = loadConfig();
+        registerProject(globalConfig, context.projectPath, context.config.name);
+        saveConfig(globalConfig);
+        const projectName = context.config.name || path.basename(context.projectPath);
+        resolvedServerName = `${projectName}.${parsed.name}`;
+      }
+      addServer(context.config, parsed.name, parsed.spec, options.force ?? false);
+      await maybeAutoConfigureAuthForAddedServer(resolvedServerName, parsed.spec, secrets);
+      context.save();
+      process.stdout.write(`Added server: ${parsed.name} (${parsed.spec.transport}) ${context.type === "project" ? `to project: ${context.projectPath}` : "globally"}
 `);
+    }
     process.stdout.write(`Auto-syncing managed gateway entries across all supported clients...
 `);
-    await autoSyncManagedEntries(config, cliPath);
+    const mergedConfig = loadMergedConfig();
+    await autoSyncManagedEntries(mergedConfig, cliPath);
   });
 }
 function registerRemoveCommand(parent, cliPath) {
-  parent.command("remove <name>").option("--force", "Do not error if server does not exist").description("Remove an upstream MCP server").action(async (name, options) => {
-    const config = loadConfig();
-    removeServer(config, name, options.force ?? false);
-    saveConfig(config);
-    process.stdout.write(`Removed server: ${name}
+  parent.command("remove <name>").option("--force", "Do not error if server does not exist").option("-g, --global", "Force target global configuration").option("-l, --local", "Force target local project configuration").description("Remove an upstream MCP server").action(async (name, options) => {
+    const context = resolveActiveConfig({ global: options.global, local: options.local });
+    removeServer(context.config, name, options.force ?? false);
+    context.save();
+    process.stdout.write(`Removed server: ${name} ${context.type === "project" ? `from project: ${context.projectPath}` : "globally"}
 `);
     process.stdout.write(`Auto-syncing managed gateway entries across all supported clients...
 `);
-    await autoSyncManagedEntries(config, cliPath);
+    const mergedConfig = loadMergedConfig();
+    await autoSyncManagedEntries(mergedConfig, cliPath);
   });
 }
 function registerListCommand(parent) {
-  parent.command("list").option("--json", "Output JSON").description("List configured upstream MCP servers").action((options) => {
-    const config = loadConfig();
-    const servers = Object.entries(config.servers).map(([name, spec]) => ({ name, ...spec }));
+  parent.command("list").option("--json", "Output JSON").option("-g, --global", "Force target global configuration").option("-l, --local", "Force target local project configuration").description("List configured upstream MCP servers").action((options) => {
+    let servers = [];
+    if (options.global || options.local) {
+      const context = resolveActiveConfig({ global: options.global, local: options.local });
+      servers = Object.entries(context.config.servers).map(([name, spec]) => ({
+        name,
+        ...spec,
+        projectName: context.type === "project" ? context.config.name || path.basename(context.projectPath) : undefined
+      }));
+    } else {
+      const mergedConfig = loadMergedConfig();
+      const globalConfig = loadConfig();
+      const projectNamesMap = new Map;
+      if (globalConfig.projects) {
+        for (const [projectPath, entry] of Object.entries(globalConfig.projects)) {
+          const localPath = path.join(projectPath, ".mcpx.json");
+          if (fs.existsSync(localPath)) {
+            try {
+              const localConfig = loadProjectConfig(localPath);
+              const pName = localConfig.name || entry.name || path.basename(projectPath);
+              projectNamesMap.set(pName, projectPath);
+            } catch {}
+          }
+        }
+      }
+      servers = Object.entries(mergedConfig.servers).map(([name, spec]) => {
+        let projectName;
+        let baseName = name;
+        for (const pName of projectNamesMap.keys()) {
+          if (name.startsWith(`${pName}.`)) {
+            projectName = pName;
+            baseName = name.slice(pName.length + 1);
+            break;
+          }
+        }
+        return {
+          name: baseName,
+          ...spec,
+          projectName
+        };
+      });
+    }
     if (options.json) {
       process.stdout.write(`${JSON.stringify({ servers }, null, 2)}
 `);
@@ -1667,12 +1902,13 @@ function registerListCommand(parent) {
     }
     for (const server of servers) {
       const state = isServerEnabled(server) ? "enabled" : "disabled";
+      const scope = server.projectName ? `project: ${server.projectName}` : "global";
       if (server.transport === "http") {
-        process.stdout.write(`- ${server.name} (${state}, http) ${server.url}
+        process.stdout.write(`- ${server.name} (${state}, http, ${scope}) ${server.url}
 `);
       } else {
         const args = (server.args ?? []).join(" ");
-        process.stdout.write(`- ${server.name} (${state}, stdio) ${server.command}${args ? ` ${args}` : ""}
+        process.stdout.write(`- ${server.name} (${state}, stdio, ${scope}) ${server.command}${args ? ` ${args}` : ""}
 `);
       }
     }
@@ -1680,7 +1916,7 @@ function registerListCommand(parent) {
 }
 function registerSyncCommand(program, cliPath) {
   program.command("sync [clients...]").option("--client <id>", "Limit sync to specific client(s), comma-separated or repeated", (value, prev = []) => [...prev, value], []).option("--json", "Output JSON").description("Sync gateway configuration to supported clients (e.g. `mcpx sync claude`)").action(async (clients, options) => {
-    const config = loadConfig();
+    const config = loadMergedConfig();
     const targetClients = parseClientList([...clients ?? [], ...options.client ?? []]);
     const secrets = new SecretsManager;
     await ensureDaemonIfEnabled(cliPath, secrets);
@@ -1691,7 +1927,7 @@ function registerSyncCommand(program, cliPath) {
 }
 function registerStatusCommand(program, cliPath) {
   program.command("status").option("--no-interactive", "Disable interactive status menu").option("--json", "Output JSON").description("Show gateway, daemon, MCP inventory, and client sync status").action(async (options) => {
-    const report = loadStatusReport();
+    const report = await loadStatusReport();
     if (options.json) {
       process.stdout.write(`${JSON.stringify(report, null, 2)}
 `);
@@ -1720,15 +1956,22 @@ function registerDoctorCommand(program) {
       status: fs.existsSync(getManagedIndexPath()) ? "ok" : "warn",
       details: getManagedIndexPath()
     });
-    if (process.platform === "darwin") {
+    try {
+      const keytar = __require(path.join(__dirname, "..", "node_modules", "keytar", "lib", "keytar.js"));
       try {
-        execFileSync("security", ["help"], { stdio: "ignore" });
-        checks.push({ check: "macos_keychain", status: "ok", details: "security CLI available" });
-      } catch {
-        checks.push({ check: "macos_keychain", status: "fail", details: "security CLI unavailable" });
+        keytar.getPassword("mcpx-doctor-check", "__probe__");
+      } catch {}
+      checks.push({ check: "keyring", status: "ok", details: "keytar native addon loaded" });
+    } catch {
+      if (process.platform === "linux") {
+        checks.push({ check: "keyring", status: "warn", details: "keytar native addon unavailable; install libsecret-1-dev and reinstall dependencies" });
+      } else if (process.platform === "win32") {
+        checks.push({ check: "keyring", status: "warn", details: "keytar native addon unavailable; rebuild keytar with 'npx node-gyp rebuild' in app/node_modules/keytar" });
+      } else if (process.platform === "darwin") {
+        checks.push({ check: "keyring", status: "warn", details: "keytar native addon unavailable; reinstall dependencies or check Xcode CLI tools" });
+      } else {
+        checks.push({ check: "keyring", status: "warn", details: "keytar native addon unavailable" });
       }
-    } else {
-      checks.push({ check: "macos_keychain", status: "warn", details: "Non-macOS platform; keychain integration unavailable" });
     }
     const daemon = getDaemonStatus(config);
     checks.push({
@@ -1839,6 +2082,27 @@ function registerSecretsCommands(program) {
 }
 function registerAuthCommands(program) {
   const auth = program.command("auth").description("Auth utilities");
+  auth.command("login <server>").description("Run browser OAuth login for an HTTP upstream server").action(async (server) => {
+    const config = loadConfig();
+    const spec = getServerSpecOrThrow(config, server);
+    if (spec.transport !== "http") {
+      throw new Error(`OAuth login only supports HTTP servers.`);
+    }
+    const secrets = new SecretsManager;
+    await runOAuthLogin(server, spec, secrets, (url) => {
+      if (process.platform === "darwin") {
+        execFileSync("open", [url], { stdio: "ignore" });
+        return;
+      }
+      if (process.platform === "win32") {
+        execFileSync("cmd", ["/c", "start", "", url], { stdio: "ignore" });
+        return;
+      }
+      execFileSync("xdg-open", [url], { stdio: "ignore" });
+    });
+    process.stdout.write(`OAuth login complete for "${server}".
+`);
+  });
   auth.command("set <server>").option("--header <name>", "HTTP header name (default for HTTP servers: Authorization)").option("--env <name>", "Env var name (required for stdio servers)").option("--value <value>", "Auth value/token (if omitted, read from stdin)").option("--secret-name <name>", "Override keychain secret name").option("--raw", "Do not auto-prefix Authorization values with Bearer").description("Store auth in keychain and bind it to an upstream server").action((server, options) => {
     const config = loadConfig();
     const spec = getServerSpecOrThrow(config, server);
@@ -2043,6 +2307,66 @@ function registerUpdateCommand(program) {
     }
   });
 }
+function registerProjectCommands(program, cliPath) {
+  const projectCmd = program.command("project").description("Manage project-based MCP configurations");
+  projectCmd.command("init [name]").description("Initialize a local .mcpx.json configuration in the current directory").action(async (name) => {
+    const targetPath = path.join(process.cwd(), ".mcpx.json");
+    if (fs.existsSync(targetPath)) {
+      process.stderr.write(`Local project configuration already exists at: ${targetPath}
+`);
+      process.exit(1);
+    }
+    const projectName = name?.trim() || path.basename(process.cwd());
+    const localConfig = {
+      name: projectName,
+      servers: {}
+    };
+    const { saveProjectConfig: saveProjectConfig2 } = await import("./config-79j3jpra.js");
+    saveProjectConfig2(localConfig, targetPath);
+    process.stdout.write(`Initialized project configuration at: ${targetPath}
+`);
+    const { registerProject: registerProject2 } = await import("./registry-1s14wd58.js");
+    const globalConfig = loadConfig();
+    registerProject2(globalConfig, process.cwd(), projectName);
+    saveConfig(globalConfig);
+    process.stdout.write(`Registered project "${projectName}" globally.
+`);
+  });
+  projectCmd.command("list").description("List all globally registered project paths").action(() => {
+    const globalConfig = loadConfig();
+    const projects = Object.entries(globalConfig.projects ?? {});
+    if (projects.length === 0) {
+      process.stdout.write(`No projects currently registered.
+`);
+      return;
+    }
+    process.stdout.write(`Registered Projects:
+`);
+    for (const [projectPath, entry] of projects) {
+      process.stdout.write(`- ${entry.name}: ${projectPath}
+`);
+    }
+  });
+  projectCmd.command("remove <path>").description("Unregister a project path from the global configuration").action(async (projectPath) => {
+    const resolvedPath = path.resolve(projectPath);
+    const globalConfig = loadConfig();
+    if (!globalConfig.projects || !globalConfig.projects[resolvedPath]) {
+      process.stderr.write(`No registered project found at path: ${resolvedPath}
+`);
+      process.exit(1);
+    }
+    const entry = globalConfig.projects[resolvedPath];
+    const { unregisterProject: unregisterProject2 } = await import("./registry-1s14wd58.js");
+    unregisterProject2(globalConfig, resolvedPath);
+    saveConfig(globalConfig);
+    process.stdout.write(`Unregistered project "${entry.name}" (${resolvedPath}) from the global configuration.
+`);
+    process.stdout.write(`Auto-syncing managed gateway entries across all supported clients...
+`);
+    const mergedConfig = loadMergedConfig();
+    await autoSyncManagedEntries(mergedConfig, cliPath);
+  });
+}
 function registerProxyCommand(program) {
   program.command("proxy <name>").description("Run a stdio MCP proxy bridging to the local mcpx HTTP gateway for the given upstream server").action(async (name) => {
     await runStdioProxy(name);
@@ -2107,6 +2431,7 @@ async function runCli(argv = process.argv) {
   registerProxyCommand(program);
   registerMcpCompat(program, cliPath);
   registerUpdateCommand(program);
+  registerProjectCommands(program, cliPath);
   await program.parseAsync(argv);
 }
 if (process.argv[1] && import.meta.url === pathToFileURL(fs.realpathSync(process.argv[1])).href) {

package/dist/config-79j3jpra.js

@@ -0,0 +1,20 @@
+import {
+  defaultConfig,
+  loadConfig,
+  loadMergedConfig,
+  loadProjectConfig,
+  resolveActiveConfig,
+  saveConfig,
+  saveProjectConfig
+} from "./cli-7edpy4nk.js";
+import"./cli-fsf33sgp.js";
+import"./cli-s4gspqdf.js";
+export {
+  saveProjectConfig,
+  saveConfig,
+  resolveActiveConfig,
+  loadProjectConfig,
+  loadMergedConfig,
+  loadConfig,
+  defaultConfig
+};

package/dist/core/add-command.d.ts

@@ -0,0 +1,7 @@
+import type { UpstreamServerSpec } from "../types.js";
+export declare function tokenizeCommandLine(command: string): string[];
+export declare function parseCliAddCommand(command: string): {
+    name: string;
+    spec: UpstreamServerSpec;
+};
+//# sourceMappingURL=add-command.d.ts.map