@kwonye/mcpx 0.1.77 → 0.1.80

package/dist/{cli-htm5cf82.js → cli-f2a6pkds.js}

@@ -1,12 +1,12 @@
 import {
+  loadConfig,
   loadMergedConfig,
   saveConfig
-} from "./cli-7bsf6akp.js";
+} from "./cli-0ztrmp65.js";
 import {
   SecretsManager,
-  ensureGatewayToken,
-  getGatewayTokenSecretName
-} from "./cli-s4py8ckf.js";
+  ensureGatewayToken
+} from "./cli-ma89vavk.js";
 import {
   ensureDir,
   ensureParentDir,
@@ -21,7 +21,7 @@ import {
   readJsonFile,
   sha256,
   writeJsonAtomic
-} from "./cli-fsf33sgp.js";
+} from "./cli-08mgt3c8.js";
 import {
   isServerEnabled
 } from "./cli-s4gspqdf.js";
@@ -103,6 +103,13 @@ function resolveHeaders(spec, secrets) {
   }
   return headers;
 }
+function isOAuthLikelyChallenge(wwwAuthenticate) {
+  if (!wwwAuthenticate) {
+    return false;
+  }
+  const lower = wwwAuthenticate.toLowerCase();
+  return lower.includes("bearer") || lower.includes("authorization_uri") || lower.includes("resource_metadata");
+}
 async function probeHttpAuthRequirement(spec, secrets, timeoutMs = DEFAULT_AUTH_PROBE_TIMEOUT_MS) {
   const timeoutController = new AbortController;
   const timeoutHandle = setTimeout(() => timeoutController.abort(), timeoutMs);
@@ -120,10 +127,12 @@ async function probeHttpAuthRequirement(spec, secrets, timeoutMs = DEFAULT_AUTH_
       signal: timeoutController.signal
     });
     if (response.status === 401 || response.status === 403) {
+      const wwwAuthenticate = response.headers.get("www-authenticate");
       return {
         authRequired: true,
+        oauthLikely: isOAuthLikelyChallenge(wwwAuthenticate),
         status: response.status,
-        wwwAuthenticate: response.headers.get("www-authenticate") ?? undefined
+        wwwAuthenticate: wwwAuthenticate ?? undefined
       };
     }
     if (response.status === 200) {
@@ -501,20 +510,22 @@ class ClaudeAdapter {
     try {
       const raw = readJsonFile(configPath, {});
       const managedNames = options.managedEntries.map((entry) => entry.name);
-      const serverEntries = Object.fromEntries(options.managedEntries.map((entry) => [entry.name, {
+      const enabledEntries = options.managedEntries.filter((entry) => entry.enabled);
+      const serverEntries = Object.fromEntries(enabledEntries.map((entry) => [entry.name, {
         type: "http",
         url: entry.url,
         headers: entry.headers
       }]));
+      const enabledManagedNames = enabledEntries.map((entry) => entry.name);
       const topLevelServers = raw.mcpServers ?? {};
       removeSourceEntries(topLevelServers, options.sourceEntriesToRemove);
-      for (const name of managedNames) {
+      for (const name of enabledManagedNames) {
         const topLevelConflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, topLevelServers[name]);
         if (topLevelConflict) {
           return errorResult(this.id, configPath, topLevelConflict);
         }
       }
-      pruneStaleManagedEntries(options.managedIndex, this.id, topLevelServers, managedNames);
+      pruneStaleManagedEntries(options.managedIndex, this.id, topLevelServers, enabledManagedNames);
       for (const [name, entry] of Object.entries(serverEntries)) {
         topLevelServers[name] = entry;
       }
@@ -656,9 +667,9 @@ class ClaudeDesktopAdapter {
       }
       raw.mcpServers = topLevelServers;
       writeJsonAtomic(configPath, raw);
-      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(options.managedEntries.map((entry) => {
+      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(enabledEntries.map((entry) => {
         const { command, args } = buildProxyEntry(entry);
-        return [entry.name, JSON.stringify({ command, args, enabled: entry.enabled })];
+        return [entry.name, JSON.stringify({ command, args })];
       })));
       return okResult(this.id, configPath);
     } catch (error) {
@@ -1029,6 +1040,9 @@ class ClineAdapter {
     if (!configPath) {
       return errorResult(this.id, undefined, "Unable to resolve Cline MCP config path.");
     }
+    if (!fs3.existsSync(configPath)) {
+      return okResult(this.id, configPath, "Cline config not found; skipping sync.");
+    }
     try {
       const raw = readJsonFile(configPath, {});
       const servers = {
@@ -1640,6 +1654,9 @@ function buildManagedEntries(config, gatewayUrl, localToken) {
     enabled: isServerEnabled(spec)
   }));
 }
+function isClientInternalServerCommand(candidate) {
+  return candidate.spec.transport === "stdio" && /\.app\/Contents\//.test(candidate.spec.command ?? "");
+}
 function syncAllClients(config, secrets, targetClients) {
   const adapters = getAdapters();
   const managedIndexPath = getManagedIndexPath();
@@ -1658,6 +1675,16 @@ function syncAllClients(config, secrets, targetClients) {
       const scan = adapter.scanForImports(config, managedIndex);
       imports.skipped.push(...scan.skipped);
       for (const candidate of scan.candidates) {
+        if (isClientInternalServerCommand(candidate)) {
+          imports.skipped.push({
+            clientId: candidate.clientId,
+            configPath: candidate.configPath,
+            sourceEntryName: candidate.sourceEntryName,
+            serverName: candidate.serverName,
+            reason: "client-internal server"
+          });
+          continue;
+        }
         const existing = config.servers[candidate.serverName];
         if (!existing) {
           config.servers[candidate.serverName] = candidate.spec;
@@ -1857,12 +1884,298 @@ function maybePrefixBearer(target, value, raw = false) {
   return `Bearer ${value}`;
 }
 
+// src/core/spawn-env.ts
+import os from "node:os";
+import path11 from "node:path";
+import fs6 from "node:fs";
+function existingNvmCurrentBin() {
+  const nvmDir = process.env.NVM_DIR ?? path11.join(os.homedir(), ".nvm");
+  const current = path11.join(nvmDir, "current", "bin");
+  return fs6.existsSync(current) ? current : null;
+}
+function buildEnrichedPath(current = process.env.PATH ?? "") {
+  const candidates = [
+    ...current.split(":"),
+    "/opt/homebrew/bin",
+    "/usr/local/bin",
+    path11.join(os.homedir(), ".bun", "bin"),
+    path11.join(os.homedir(), ".local", "bin"),
+    existingNvmCurrentBin()
+  ].filter((entry) => Boolean(entry));
+  const seen = new Set;
+  const entries = [];
+  for (const candidate of candidates) {
+    if (!candidate || seen.has(candidate)) {
+      continue;
+    }
+    seen.add(candidate);
+    entries.push(candidate);
+  }
+  return entries.join(":");
+}
+
+// src/core/oauth.ts
+import http from "node:http";
+import crypto from "node:crypto";
+import {
+  auth,
+  discoverOAuthServerInfo,
+  refreshAuthorization
+} from "@modelcontextprotocol/sdk/client/auth.js";
+function oauthSecretName(serverName, suffix) {
+  return `oauth_${serverName.toLowerCase().replace(/[^a-z0-9._-]/g, "_")}_${suffix}`;
+}
+function readJsonSecret(secrets, name) {
+  const raw = secrets.getSecret(name);
+  if (!raw) {
+    return;
+  }
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return;
+  }
+}
+function writeJsonSecret(secrets, name, value) {
+  secrets.setSecret(name, JSON.stringify(value));
+}
+function isOAuthReference(value) {
+  return value.startsWith("oauth://");
+}
+function oauthReferenceServerName(value) {
+  if (!isOAuthReference(value)) {
+    throw new Error(`Not an OAuth reference: ${value}`);
+  }
+  return decodeURIComponent(value.slice("oauth://".length));
+}
+function tokensAreExpiring(tokens) {
+  if (!tokens.tokens.expires_in) {
+    return false;
+  }
+  const expiresAt = tokens.obtainedAt + tokens.tokens.expires_in * 1000;
+  return Date.now() >= expiresAt - 60000;
+}
+
+class McpxOAuthProvider {
+  #serverName;
+  #secrets;
+  #redirectUrlValue;
+  #stateValue;
+  constructor(serverName, secrets, redirectUrl, state = crypto.randomUUID()) {
+    this.#serverName = serverName;
+    this.#secrets = secrets;
+    this.#redirectUrlValue = redirectUrl;
+    this.#stateValue = state;
+  }
+  get redirectUrl() {
+    return this.#redirectUrlValue;
+  }
+  get clientMetadata() {
+    if (!this.#redirectUrlValue) {
+      return {
+        redirect_uris: [],
+        token_endpoint_auth_method: "none",
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        client_name: "mcpx"
+      };
+    }
+    return {
+      redirect_uris: [this.#redirectUrlValue],
+      token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      client_name: "mcpx"
+    };
+  }
+  state() {
+    return this.#stateValue;
+  }
+  clientInformation() {
+    return readJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "client"));
+  }
+  saveClientInformation(clientInformation) {
+    writeJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "client"), clientInformation);
+  }
+  tokens() {
+    return readJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "tokens"))?.tokens;
+  }
+  saveTokens(tokens) {
+    writeJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "tokens"), {
+      tokens,
+      obtainedAt: Date.now()
+    });
+  }
+  redirectToAuthorization(_authorizationUrl) {}
+  saveCodeVerifier(codeVerifier) {
+    this.#secrets.setSecret(oauthSecretName(this.#serverName, "verifier"), codeVerifier);
+  }
+  codeVerifier() {
+    const verifier = this.#secrets.getSecret(oauthSecretName(this.#serverName, "verifier"));
+    if (!verifier) {
+      throw new Error(`Missing OAuth code verifier for "${this.#serverName}".`);
+    }
+    return verifier;
+  }
+  saveDiscoveryState(state) {
+    writeJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "discovery"), state);
+  }
+  discoveryState() {
+    return readJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "discovery"));
+  }
+  invalidateCredentials(scope) {
+    const suffixes = scope === "all" ? ["client", "tokens", "verifier", "discovery"] : [scope];
+    for (const suffix of suffixes) {
+      this.#secrets.removeSecret(oauthSecretName(this.#serverName, suffix));
+    }
+  }
+}
+
+class InteractiveOAuthProvider extends McpxOAuthProvider {
+  #openUrl;
+  constructor(serverName, secrets, redirectUrl, state, openUrl) {
+    super(serverName, secrets, redirectUrl, state);
+    this.#openUrl = openUrl;
+  }
+  async redirectToAuthorization(authorizationUrl) {
+    await this.#openUrl(authorizationUrl.toString());
+  }
+}
+function listen(server) {
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        reject(new Error("Failed to start OAuth callback server."));
+        return;
+      }
+      resolve(address.port);
+    });
+  });
+}
+function closeServer(server) {
+  return new Promise((resolve) => {
+    server.close(() => resolve());
+  });
+}
+function waitForAuthorizationCode(server, expectedState, timeoutMs = 120000) {
+  return new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      reject(new Error(`OAuth login timed out after ${timeoutMs}ms.`));
+    }, timeoutMs);
+    server.on("request", (request, response) => {
+      const url = new URL(request.url ?? "/", "http://127.0.0.1");
+      const code = url.searchParams.get("code");
+      const state = url.searchParams.get("state");
+      const error = url.searchParams.get("error");
+      response.setHeader("content-type", "text/html; charset=utf-8");
+      if (error) {
+        response.statusCode = 400;
+        response.end("<html><body><h1>mcpx OAuth failed</h1><p>You can close this window.</p></body></html>");
+        clearTimeout(timeout);
+        reject(new Error(`OAuth authorization failed: ${error}`));
+        return;
+      }
+      if (!code) {
+        response.statusCode = 400;
+        response.end("<html><body><h1>Missing OAuth code</h1><p>You can close this window.</p></body></html>");
+        return;
+      }
+      if (state !== expectedState) {
+        response.statusCode = 400;
+        response.end("<html><body><h1>OAuth state mismatch</h1><p>You can close this window.</p></body></html>");
+        clearTimeout(timeout);
+        reject(new Error("OAuth state mismatch."));
+        return;
+      }
+      response.end("<html><body><h1>mcpx OAuth complete</h1><p>You can close this window.</p></body></html>");
+      clearTimeout(timeout);
+      resolve(code);
+    });
+  });
+}
+function bindOAuthReference(config, serverName) {
+  const spec = config.servers[serverName];
+  if (!spec) {
+    throw new Error(`Server "${serverName}" not found.`);
+  }
+  if (spec.transport !== "http") {
+    throw new Error(`OAuth login only supports HTTP servers.`);
+  }
+  spec.headers = {
+    ...spec.headers ?? {},
+    Authorization: `oauth://${encodeURIComponent(serverName)}`
+  };
+}
+async function runOAuthLogin(serverName, spec, secrets, openUrl, configPath) {
+  const state = crypto.randomUUID();
+  const callbackServer = http.createServer();
+  const port = await listen(callbackServer);
+  const redirectUrl = `http://127.0.0.1:${port}/callback`;
+  const provider = new InteractiveOAuthProvider(serverName, secrets, redirectUrl, state, openUrl);
+  const codePromise = waitForAuthorizationCode(callbackServer, state);
+  try {
+    const initial = await auth(provider, {
+      serverUrl: spec.url
+    });
+    if (initial !== "REDIRECT") {
+      throw new Error(`Expected OAuth redirect for "${serverName}", got ${initial}.`);
+    }
+    const authorizationCode = await codePromise;
+    const result = await auth(provider, {
+      serverUrl: spec.url,
+      authorizationCode
+    });
+    if (result !== "AUTHORIZED") {
+      throw new Error(`OAuth login did not authorize "${serverName}".`);
+    }
+    const config = loadConfig(configPath);
+    bindOAuthReference(config, serverName);
+    saveConfig(config, configPath);
+    syncAllClients(config, secrets);
+    return { serverName, authorized: true };
+  } finally {
+    await closeServer(callbackServer);
+  }
+}
+async function getOAuthAccessToken(serverName, spec, secrets, options = {}) {
+  const stored = readJsonSecret(secrets, oauthSecretName(serverName, "tokens"));
+  if (!stored) {
+    throw new Error(`No OAuth tokens stored for "${serverName}". Run mcpx auth login ${serverName}.`);
+  }
+  if (!options.forceRefresh && !tokensAreExpiring(stored)) {
+    return stored.tokens.access_token;
+  }
+  if (!stored.tokens.refresh_token) {
+    if (!options.forceRefresh) {
+      return stored.tokens.access_token;
+    }
+    throw new Error(`No OAuth refresh token stored for "${serverName}". Re-authentication required.`);
+  }
+  const provider = new McpxOAuthProvider(serverName, secrets);
+  const clientInformation = provider.clientInformation();
+  if (!clientInformation) {
+    throw new Error(`No OAuth client information stored for "${serverName}". Re-authentication required.`);
+  }
+  const cachedDiscovery = provider.discoveryState();
+  const serverInfo = cachedDiscovery ?? await discoverOAuthServerInfo(spec.url);
+  const refreshed = await refreshAuthorization(serverInfo.authorizationServerUrl, {
+    metadata: serverInfo.authorizationServerMetadata,
+    clientInformation,
+    refreshToken: stored.tokens.refresh_token,
+    resource: serverInfo.resourceMetadata?.resource ? new URL(serverInfo.resourceMetadata.resource) : undefined
+  });
+  provider.saveTokens(refreshed);
+  return refreshed.access_token;
+}
+
 // src/version.ts
 var APP_VERSION = "0.1.3";
 
 // src/core/update.ts
-import fs6 from "node:fs";
-import path11 from "node:path";
+import fs7 from "node:fs";
+import path12 from "node:path";
 import { execFileSync as execFileSync2 } from "node:child_process";
 function compareVersions(a, b) {
   const partsA = a.split(".").map(Number);
@@ -1901,17 +2214,17 @@ async function checkForUpdates() {
 }
 function getStagedUpdate() {
   const stagedPath = getStagedVersionPath();
-  if (!fs6.existsSync(stagedPath)) {
+  if (!fs7.existsSync(stagedPath)) {
     return null;
   }
   try {
-    const raw = fs6.readFileSync(stagedPath, "utf8");
+    const raw = fs7.readFileSync(stagedPath, "utf8");
     const info = JSON.parse(raw);
     if (!info.version || !info.cliPath) {
       return null;
     }
-    const absoluteCliPath = path11.isAbsolute(info.cliPath) ? info.cliPath : path11.join(getUpdatesDir(), info.cliPath);
-    if (!fs6.existsSync(absoluteCliPath)) {
+    const absoluteCliPath = path12.isAbsolute(info.cliPath) ? info.cliPath : path12.join(getUpdatesDir(), info.cliPath);
+    if (!fs7.existsSync(absoluteCliPath)) {
       return null;
     }
     return {
@@ -1927,15 +2240,18 @@ function stageUpdate(version, cliPath) {
   ensureDir(updatesDir);
   const stagedInfo = {
     version,
-    cliPath: path11.isAbsolute(cliPath) ? path11.relative(updatesDir, cliPath) : cliPath,
+    cliPath: path12.isAbsolute(cliPath) ? path12.relative(updatesDir, cliPath) : cliPath,
     stagedAt: new Date().toISOString()
   };
-  fs6.writeFileSync(getStagedVersionPath(), JSON.stringify(stagedInfo, null, 2), "utf8");
+  fs7.writeFileSync(getStagedVersionPath(), JSON.stringify(stagedInfo, null, 2), "utf8");
+}
+function shouldUseStagedCli(stagedVersion, currentVersion) {
+  return compareVersions(stagedVersion, currentVersion) > 0;
 }
 function clearStagedUpdate() {
   const stagedPath = getStagedVersionPath();
-  if (fs6.existsSync(stagedPath)) {
-    fs6.unlinkSync(stagedPath);
+  if (fs7.existsSync(stagedPath)) {
+    fs7.unlinkSync(stagedPath);
   }
 }
 function getStagedCliPath() {
@@ -1944,31 +2260,31 @@ function getStagedCliPath() {
 }
 function removeOldVersions(keepCount = 2) {
   const updatesDir = getUpdatesDir();
-  if (!fs6.existsSync(updatesDir)) {
+  if (!fs7.existsSync(updatesDir)) {
     return;
   }
-  const entries = fs6.readdirSync(updatesDir, { withFileTypes: true });
+  const entries = fs7.readdirSync(updatesDir, { withFileTypes: true });
   const versionDirs = entries.filter((entry) => entry.isDirectory() && entry.name.startsWith("v")).map((entry) => entry.name).sort((a, b) => compareVersions(b.slice(1), a.slice(1)));
   if (versionDirs.length <= keepCount) {
     return;
   }
   for (const oldVersion of versionDirs.slice(keepCount)) {
-    const oldPath = path11.join(updatesDir, oldVersion);
+    const oldPath = path12.join(updatesDir, oldVersion);
     try {
-      fs6.rmSync(oldPath, { recursive: true, force: true });
+      fs7.rmSync(oldPath, { recursive: true, force: true });
     } catch {}
   }
 }
 
 // src/core/update-manager.ts
-import fs7 from "node:fs";
-import path12 from "node:path";
+import fs8 from "node:fs";
+import path13 from "node:path";
 import { execSync, spawn } from "node:child_process";
 function acquireLock() {
   const lockPath = getUpdateLockPath();
   try {
-    ensureDir(path12.dirname(lockPath));
-    fs7.writeFileSync(lockPath, `${process.pid}
+    ensureDir(path13.dirname(lockPath));
+    fs8.writeFileSync(lockPath, `${process.pid}
 `, { flag: "wx" });
     return true;
   } catch {
@@ -1978,25 +2294,25 @@ function acquireLock() {
 function releaseLock() {
   const lockPath = getUpdateLockPath();
   try {
-    fs7.unlinkSync(lockPath);
+    fs8.unlinkSync(lockPath);
   } catch {}
 }
 function isUpdateInProgress() {
   const lockPath = getUpdateLockPath();
-  if (!fs7.existsSync(lockPath)) {
+  if (!fs8.existsSync(lockPath)) {
     return false;
   }
   try {
-    const raw = fs7.readFileSync(lockPath, "utf8").trim();
+    const raw = fs8.readFileSync(lockPath, "utf8").trim();
     const pid = Number(raw);
     if (!Number.isFinite(pid) || pid <= 0) {
-      fs7.unlinkSync(lockPath);
+      fs8.unlinkSync(lockPath);
       return false;
     }
     process.kill(pid, 0);
     return true;
   } catch {
-    fs7.unlinkSync(lockPath);
+    fs8.unlinkSync(lockPath);
     return false;
   }
 }
@@ -2007,8 +2323,8 @@ async function downloadAndStageUpdate() {
   }
   const targetVersion = updateStatus.latestVersion;
   const updatesDir = getUpdatesDir();
-  const versionDir = path12.join(updatesDir, `v${targetVersion}`);
-  if (fs7.existsSync(versionDir)) {
+  const versionDir = path13.join(updatesDir, `v${targetVersion}`);
+  if (fs8.existsSync(versionDir)) {
     const existingStaged = getStagedUpdate();
     if (existingStaged?.version === targetVersion) {
       return { success: false, error: `Version ${targetVersion} already staged` };
@@ -2020,8 +2336,8 @@ async function downloadAndStageUpdate() {
       cwd: versionDir,
       stdio: ["pipe", "pipe", "pipe"]
     });
-    const tarballPath = path12.join(versionDir, `kwonye-mcpx-${targetVersion}.tgz`);
-    if (!fs7.existsSync(tarballPath)) {
+    const tarballPath = path13.join(versionDir, `kwonye-mcpx-${targetVersion}.tgz`);
+    if (!fs8.existsSync(tarballPath)) {
       throw new Error("Downloaded tarball not found");
     }
     execSync(`tar -xzf ${tarballPath} --strip-components=1`, {
@@ -2032,8 +2348,8 @@ async function downloadAndStageUpdate() {
       cwd: versionDir,
       stdio: ["pipe", "pipe", "pipe"]
     });
-    const cliPath = path12.join(versionDir, "dist", "cli.js");
-    if (!fs7.existsSync(cliPath)) {
+    const cliPath = path13.join(versionDir, "dist", "cli.js");
+    if (!fs8.existsSync(cliPath)) {
       throw new Error("CLI entry point not found in downloaded package");
     }
     stageUpdate(targetVersion, cliPath);
@@ -2041,7 +2357,7 @@ async function downloadAndStageUpdate() {
     return { success: true, version: targetVersion };
   } catch (error) {
     try {
-      fs7.rmSync(versionDir, { recursive: true, force: true });
+      fs8.rmSync(versionDir, { recursive: true, force: true });
     } catch {}
     return {
       success: false,
@@ -2119,14 +2435,14 @@ function performRollback() {
 }
 
 // src/core/daemon.ts
-import fs8 from "node:fs";
+import fs9 from "node:fs";
 import net from "node:net";
 import { spawn as spawn2 } from "node:child_process";
 
 // src/gateway/server.ts
-import http from "node:http";
-import { URL } from "node:url";
-import crypto from "node:crypto";
+import http2 from "node:http";
+import { URL as URL2 } from "node:url";
+import crypto2 from "node:crypto";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import {
   StdioClientTransport,
@@ -2215,16 +2531,16 @@ function getWellKnownPrefix(pathname) {
   return null;
 }
 function getUpstreamPathSuffixForWellKnown(upstream) {
-  const upstreamUrl = new URL(upstream.spec.url);
+  const upstreamUrl = new URL2(upstream.spec.url);
   if (upstreamUrl.pathname === "/") {
     return "";
   }
   return upstreamUrl.pathname.endsWith("/") ? upstreamUrl.pathname.slice(0, -1) : upstreamUrl.pathname;
 }
 function buildWellKnownUpstreamUrl(upstream, prefix) {
-  const upstreamUrl = new URL(upstream.spec.url);
+  const upstreamUrl = new URL2(upstream.spec.url);
   const suffix = getUpstreamPathSuffixForWellKnown(upstream);
-  return new URL(`${prefix}${suffix}`, upstreamUrl.origin);
+  return new URL2(`${prefix}${suffix}`, upstreamUrl.origin);
 }
 function getLocalOriginFromRequest(request) {
   return `http://${request.headers.host ?? "127.0.0.1"}`;
@@ -2240,7 +2556,7 @@ function appendUpstreamQuery(url, upstream) {
   if (!upstream) {
     return url;
   }
-  const parsed = new URL(url);
+  const parsed = new URL2(url);
   parsed.searchParams.set("upstream", upstream);
   return parsed.toString();
 }
@@ -2312,51 +2628,52 @@ async function getUpstreamTokenCounts(config, secrets, runtime) {
   const results = {};
   const upstreams = listUpstreams(config);
   for (const upstream of upstreams) {
-    if (runtime.tokenCache.has(upstream.name)) {
-      results[upstream.name] = runtime.tokenCache.get(upstream.name);
+    const fingerprint = specFingerprint(upstream.spec);
+    const cached = runtime.tokenCache.get(upstream.name);
+    if (cached?.fingerprint === fingerprint) {
+      results[upstream.name] = cached.count;
       continue;
     }
+    let toolsCount = 0;
+    let resourcesCount = 0;
+    let promptsCount = 0;
+    const errors = [];
     try {
-      const prevTimeout = process.env.MCPX_UPSTREAM_TIMEOUT_MS;
-      process.env.MCPX_UPSTREAM_TIMEOUT_MS = "3000";
-      let toolsCount = 0;
-      let resourcesCount = 0;
-      let promptsCount = 0;
-      try {
-        const toolsResult = await callUpstream(upstream, "tools/list", {}, "token-tools", secrets, runtime);
-        if (toolsResult && toolsResult.tools) {
-          toolsCount = Math.ceil(JSON.stringify(toolsResult.tools).length / 4);
-        }
-      } catch (err) {}
-      try {
-        const resourcesResult = await callUpstream(upstream, "resources/list", {}, "token-resources", secrets, runtime);
-        if (resourcesResult && resourcesResult.resources) {
-          resourcesCount = Math.ceil(JSON.stringify(resourcesResult.resources).length / 4);
-        }
-      } catch (err) {}
-      try {
-        const promptsResult = await callUpstream(upstream, "prompts/list", {}, "token-prompts", secrets, runtime);
-        if (promptsResult && promptsResult.prompts) {
-          promptsCount = Math.ceil(JSON.stringify(promptsResult.prompts).length / 4);
-        }
-      } catch (err) {}
-      if (prevTimeout !== undefined) {
-        process.env.MCPX_UPSTREAM_TIMEOUT_MS = prevTimeout;
-      } else {
-        delete process.env.MCPX_UPSTREAM_TIMEOUT_MS;
-      }
-      const total = toolsCount + resourcesCount + promptsCount;
-      const countObj = {
-        tools: toolsCount,
-        resources: resourcesCount,
-        prompts: promptsCount,
-        total
-      };
-      runtime.tokenCache.set(upstream.name, countObj);
-      results[upstream.name] = countObj;
+      const toolsResult = await callUpstream(upstream, "tools/list", {}, "token-tools", secrets, runtime);
+      if (toolsResult && toolsResult.tools) {
+        toolsCount = Math.ceil(JSON.stringify(toolsResult.tools).length / 4);
+      }
+    } catch (error) {
+      errors.push(`tools/list: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    try {
+      const resourcesResult = await callUpstream(upstream, "resources/list", {}, "token-resources", secrets, runtime);
+      if (resourcesResult && resourcesResult.resources) {
+        resourcesCount = Math.ceil(JSON.stringify(resourcesResult.resources).length / 4);
+      }
+    } catch (error) {
+      errors.push(`resources/list: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    try {
+      const promptsResult = await callUpstream(upstream, "prompts/list", {}, "token-prompts", secrets, runtime);
+      if (promptsResult && promptsResult.prompts) {
+        promptsCount = Math.ceil(JSON.stringify(promptsResult.prompts).length / 4);
+      }
     } catch (error) {
-      results[upstream.name] = { tools: 0, resources: 0, prompts: 0, total: 0 };
+      errors.push(`prompts/list: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const total = toolsCount + resourcesCount + promptsCount;
+    const countObj = {
+      tools: toolsCount,
+      resources: resourcesCount,
+      prompts: promptsCount,
+      total,
+      error: errors.length > 0 ? errors.join("; ") : undefined
+    };
+    if (errors.length === 0) {
+      runtime.tokenCache.set(upstream.name, { fingerprint, count: countObj });
     }
+    results[upstream.name] = countObj;
   }
   return results;
 }
@@ -2380,11 +2697,9 @@ function specFingerprint(spec) {
   return JSON.stringify(spec);
 }
 function resolveStdioEnv(spec, secrets) {
-  if (!spec.env || Object.keys(spec.env).length === 0) {
-    return;
-  }
   const env = getDefaultEnvironment();
-  for (const [key, value] of Object.entries(spec.env)) {
+  env.PATH = buildEnrichedPath(env.PATH);
+  for (const [key, value] of Object.entries(spec.env ?? {})) {
     env[key] = secrets.resolveMaybeSecret(value);
   }
   return env;
@@ -2493,12 +2808,21 @@ async function callStdioUpstream(upstream, method, params, secrets, runtime) {
   }
 }
 async function callHttpUpstream(upstream, method, params, id, secrets, passthroughAuthorizationHeader) {
+  return callHttpUpstreamOnce(upstream, method, params, id, secrets, passthroughAuthorizationHeader, false);
+}
+async function callHttpUpstreamOnce(upstream, method, params, id, secrets, passthroughAuthorizationHeader, forceOAuthRefresh) {
   const headers = {
     "content-type": "application/json",
     accept: "application/json, text/event-stream"
   };
   for (const [key, value] of Object.entries(upstream.spec.headers ?? {})) {
-    headers[key] = secrets.resolveMaybeSecret(value);
+    if (key.toLowerCase() === "authorization" && isOAuthReference(value)) {
+      const oauthServerName = oauthReferenceServerName(value);
+      const accessToken = await getOAuthAccessToken(oauthServerName, upstream.spec, secrets, { forceRefresh: forceOAuthRefresh });
+      headers[key] = `Bearer ${accessToken}`;
+    } else {
+      headers[key] = secrets.resolveMaybeSecret(value);
+    }
   }
   if (passthroughAuthorizationHeader) {
     headers.Authorization = passthroughAuthorizationHeader;
@@ -2530,6 +2854,9 @@ async function callHttpUpstream(upstream, method, params, id, secrets, passthrou
   }
   if (!response.ok) {
     const responseText = await response.text();
+    if (!forceOAuthRefresh && (response.status === 401 || response.status === 403) && Object.values(upstream.spec.headers ?? {}).some((value) => isOAuthReference(value))) {
+      return callHttpUpstreamOnce(upstream, method, params, id, secrets, passthroughAuthorizationHeader, true);
+    }
     throw new UpstreamHttpError(upstream.name, response.status, responseText, response.headers.get("www-authenticate") ?? undefined);
   }
   let payload = null;
@@ -2671,10 +2998,12 @@ async function handleListTools(config, secrets, runtime, upstreamFilter, clientA
       if (!runtime.tokenCache) {
         runtime.tokenCache = new Map;
       }
-      const existing = runtime.tokenCache.get(upstream.name) ?? { tools: 0, resources: 0, prompts: 0, total: 0 };
+      const cached = runtime.tokenCache.get(upstream.name);
+      const existing = cached?.fingerprint === specFingerprint(upstream.spec) ? cached.count : { tools: 0, resources: 0, prompts: 0, total: 0 };
       existing.tools = Math.ceil(JSON.stringify(result.tools ?? []).length / 4);
       existing.total = existing.tools + existing.resources + existing.prompts;
-      runtime.tokenCache.set(upstream.name, existing);
+      delete existing.error;
+      runtime.tokenCache.set(upstream.name, { fingerprint: specFingerprint(upstream.spec), count: existing });
       for (const tool of result.tools ?? []) {
         const name = typeof tool.name === "string" ? tool.name : "tool";
         tools.push({
@@ -2683,9 +3012,10 @@ async function handleListTools(config, secrets, runtime, upstreamFilter, clientA
         });
       }
     } catch (error) {
-      if (upstreams.length === 1 && isAuthChallenge(error)) {
+      if (upstreams.length === 1) {
         throw error;
       }
+      runtime.upstreamErrors?.set(upstream.name, error instanceof Error ? error.message : String(error));
     }
   }
   return { tools };
@@ -2701,10 +3031,12 @@ async function handleListResources(config, secrets, runtime, upstreamFilter, cli
       if (!runtime.tokenCache) {
         runtime.tokenCache = new Map;
       }
-      const existing = runtime.tokenCache.get(upstream.name) ?? { tools: 0, resources: 0, prompts: 0, total: 0 };
+      const cached = runtime.tokenCache.get(upstream.name);
+      const existing = cached?.fingerprint === specFingerprint(upstream.spec) ? cached.count : { tools: 0, resources: 0, prompts: 0, total: 0 };
       existing.resources = Math.ceil(JSON.stringify(result.resources ?? []).length / 4);
       existing.total = existing.tools + existing.resources + existing.prompts;
-      runtime.tokenCache.set(upstream.name, existing);
+      delete existing.error;
+      runtime.tokenCache.set(upstream.name, { fingerprint: specFingerprint(upstream.spec), count: existing });
       for (const resource of result.resources ?? []) {
         const originalUri = typeof resource.uri === "string" ? resource.uri : "";
         const originalName = typeof resource.name === "string" ? resource.name : originalUri;
@@ -2715,9 +3047,10 @@ async function handleListResources(config, secrets, runtime, upstreamFilter, cli
         });
       }
     } catch (error) {
-      if (upstreams.length === 1 && isAuthChallenge(error)) {
+      if (upstreams.length === 1) {
         throw error;
       }
+      runtime.upstreamErrors?.set(upstream.name, error instanceof Error ? error.message : String(error));
     }
   }
   return { resources };
@@ -2733,10 +3066,12 @@ async function handleListPrompts(config, secrets, runtime, upstreamFilter, clien
       if (!runtime.tokenCache) {
         runtime.tokenCache = new Map;
       }
-      const existing = runtime.tokenCache.get(upstream.name) ?? { tools: 0, resources: 0, prompts: 0, total: 0 };
+      const cached = runtime.tokenCache.get(upstream.name);
+      const existing = cached?.fingerprint === specFingerprint(upstream.spec) ? cached.count : { tools: 0, resources: 0, prompts: 0, total: 0 };
       existing.prompts = Math.ceil(JSON.stringify(result.prompts ?? []).length / 4);
       existing.total = existing.tools + existing.resources + existing.prompts;
-      runtime.tokenCache.set(upstream.name, existing);
+      delete existing.error;
+      runtime.tokenCache.set(upstream.name, { fingerprint: specFingerprint(upstream.spec), count: existing });
       for (const prompt of result.prompts ?? []) {
         const name = typeof prompt.name === "string" ? prompt.name : "prompt";
         prompts.push({
@@ -2745,9 +3080,10 @@ async function handleListPrompts(config, secrets, runtime, upstreamFilter, clien
         });
       }
     } catch (error) {
-      if (upstreams.length === 1 && isAuthChallenge(error)) {
+      if (upstreams.length === 1) {
         throw error;
       }
+      runtime.upstreamErrors?.set(upstream.name, error instanceof Error ? error.message : String(error));
     }
   }
   return { prompts };
@@ -2887,6 +3223,11 @@ async function handleRequestObject(request, secrets, runtime, upstreamFilter, cl
     const result = await getUpstreamTokenCounts(config, secrets, runtime);
     return makeResult(id, result);
   }
+  if (request.method === "custom/refreshTokenCounts") {
+    runtime.tokenCache?.clear();
+    const result = await getUpstreamTokenCounts(config, secrets, runtime);
+    return makeResult(id, result);
+  }
   if (request.method === "tools/list") {
     const result = await handleListTools(config, secrets, runtime, upstreamFilter, clientAuthorizationHeader);
     return makeResult(id, result);
@@ -2973,12 +3314,13 @@ async function maybeHandleWellKnownOAuthRequest(request, response, requestUrl, s
 function createGatewayServer(options) {
   const debug = process.env.MCPX_GATEWAY_DEBUG === "1";
   const runtime = {
-    stdioConnections: new Map
+    stdioConnections: new Map,
+    upstreamErrors: new Map
   };
-  const server = http.createServer(async (request, response) => {
-    let requestUrl = new URL(request.url ?? "/", `http://${request.headers.host ?? "127.0.0.1"}`);
+  const server = http2.createServer(async (request, response) => {
+    let requestUrl = new URL2(request.url ?? "/", `http://${request.headers.host ?? "127.0.0.1"}`);
     try {
-      requestUrl = new URL(request.url ?? "/", `http://${request.headers.host ?? "127.0.0.1"}`);
+      requestUrl = new URL2(request.url ?? "/", `http://${request.headers.host ?? "127.0.0.1"}`);
       const upstreamFilter = getRequestedUpstream(requestUrl);
       if (debug) {
         console.error(`[mcpx gateway] ${request.method ?? "?"} ${requestUrl.pathname} auth=${request.headers.authorization ? "yes" : "no"} accept=${request.headers.accept ?? ""}`);
@@ -3089,7 +3431,7 @@ function createGatewayServer(options) {
         response.setHeader("content-type", "application/json");
       }
       if (hasInitialize) {
-        const sessionId = crypto.randomUUID();
+        const sessionId = crypto2.randomUUID();
         response.setHeader("mcp-session-id", sessionId);
         response.setHeader("MCP-Session-Id", sessionId);
       }
@@ -3119,7 +3461,11 @@ function createGatewayServer(options) {
           const localResourceMetadataUrl = appendUpstreamQuery(`${getLocalOriginFromRequest(request)}/.well-known/oauth-protected-resource`, getRequestedUpstream(requestUrl));
           response.setHeader("www-authenticate", rewriteWwwAuthenticateResourceMetadata(error.wwwAuthenticate, localResourceMetadataUrl));
         }
-        response.end(error.bodyText.length > 0 ? error.bodyText : JSON.stringify({ error: "upstream_auth_required" }));
+        response.end(JSON.stringify(makeError(null, -32001, "Upstream authentication required.", {
+          status: error.status,
+          body: error.bodyText,
+          wwwAuthenticate: error.wwwAuthenticate
+        })));
         if (debug) {
           console.error(`[mcpx gateway] -> ${error.status} upstream auth challenge`);
         }
@@ -3145,10 +3491,10 @@ function createGatewayServer(options) {
 
 // src/core/daemon.ts
 function readPidFromFile(pidPath = getPidPath()) {
-  if (!fs8.existsSync(pidPath)) {
+  if (!fs9.existsSync(pidPath)) {
     return null;
   }
-  const raw = fs8.readFileSync(pidPath, "utf8").trim();
+  const raw = fs9.readFileSync(pidPath, "utf8").trim();
   if (!raw) {
     return null;
   }
@@ -3195,6 +3541,29 @@ async function resolveGatewayPort(config) {
   }
   throw new Error(`No available local port found near ${config.gateway.port}.`);
 }
+async function waitForGatewayReady(port, token, timeoutMs = 5000) {
+  const deadline = Date.now() + timeoutMs;
+  let lastError;
+  while (Date.now() < deadline) {
+    try {
+      const response = await fetch(`http://127.0.0.1:${port}/mcp`, {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${token}`
+        },
+        signal: AbortSignal.timeout(500)
+      });
+      if (response.ok) {
+        return;
+      }
+      lastError = new Error(`Gateway returned HTTP ${response.status}.`);
+    } catch (error) {
+      lastError = error;
+    }
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  }
+  throw new Error(`Gateway did not become ready within ${timeoutMs}ms: ${lastError instanceof Error ? lastError.message : String(lastError)}`);
+}
 function getDaemonStatus(config) {
   const pidPath = getPidPath();
   const pid = readPidFromFile(pidPath);
@@ -3227,16 +3596,16 @@ async function startDaemon(config, cliPath, secrets) {
       };
     }
     try {
-      fs8.unlinkSync(getPidPath());
+      fs9.unlinkSync(getPidPath());
     } catch {}
   }
   const port = await resolveGatewayPort(config);
-  ensureGatewayToken(config, secrets);
+  const token = ensureGatewayToken(config, secrets);
   const pidPath = getPidPath();
   const logPath = getLogPath();
   ensureParentDir(pidPath);
   ensureParentDir(logPath);
-  const logFd = fs8.openSync(logPath, "a", 384);
+  const logFd = fs9.openSync(logPath, "a", 384);
   const child = spawn2(process.execPath, [cliPath, "daemon", "run", "--port", String(port)], {
     detached: true,
     stdio: ["ignore", logFd, logFd],
@@ -3246,9 +3615,10 @@ async function startDaemon(config, cliPath, secrets) {
     }
   });
   child.unref();
-  fs8.writeFileSync(pidPath, `${child.pid}
+  fs9.writeFileSync(pidPath, `${child.pid}
 `, { mode: 384 });
   startBackgroundUpdateCheck();
+  await waitForGatewayReady(port, token);
   return {
     started: true,
     pid: child.pid ?? -1,
@@ -3269,7 +3639,7 @@ function stopDaemon() {
     process.kill(pid, "SIGTERM");
   } catch {}
   try {
-    fs8.unlinkSync(pidPath);
+    fs9.unlinkSync(pidPath);
   } catch {}
   return {
     stopped: true,
@@ -3282,22 +3652,17 @@ async function restartDaemon(config, cliPath, secrets) {
 }
 function readDaemonLogs(maxLines = 200) {
   const logPath = getLogPath();
-  if (!fs8.existsSync(logPath)) {
+  if (!fs9.existsSync(logPath)) {
     return "";
   }
-  const lines = fs8.readFileSync(logPath, "utf8").split(`
+  const lines = fs9.readFileSync(logPath, "utf8").split(`
 `);
   return lines.slice(Math.max(lines.length - maxLines, 0)).join(`
 `);
 }
 function runDaemonForeground(config, port, secrets) {
   return new Promise((resolve, reject) => {
-    const tokenName = getGatewayTokenSecretName(config);
-    const token = secrets.getSecret(tokenName);
-    if (!token) {
-      reject(new Error(`Local gateway token not found: ${tokenName}`));
-      return;
-    }
+    const token = ensureGatewayToken(config, secrets);
     const server = createGatewayServer({
       port,
       expectedToken: token,
@@ -3367,7 +3732,8 @@ async function fetchTokenCounts(gatewayUrl, token) {
         id: "status-tokens",
         method: "custom/tokenCounts",
         params: {}
-      })
+      }),
+      signal: AbortSignal.timeout(4000)
     });
     if (!res.ok) {
       return {};
@@ -3424,4 +3790,4 @@ async function buildStatusReport(config, managedIndex, daemon = getDaemonStatus(
   };
 }
 
-export { listSkills, getSkill, saveSkill, deleteSkill, probeHttpAuthRequirement, fetchRegistryServerDetail, selectBestPackage, extractRequiredInputs, mapRegistryToSpec, getAdapters, loadManagedIndex, getGatewayUrl, syncAllClients, toSecretRef, secretRefName, defaultAuthSecretName, resolveAuthTarget, applyAuthReference, removeAuthReference, listAuthBindings, maybePrefixBearer, APP_VERSION, compareVersions, checkForUpdates, getStagedUpdate, clearStagedUpdate, getStagedCliPath, startBackgroundUpdateCheck, runBackgroundUpdate, performUpdate, performRollback, getDaemonStatus, startDaemon, stopDaemon, restartDaemon, readDaemonLogs, runDaemonForeground, STATUS_CLIENTS, buildStatusReport };
+export { listSkills, getSkill, saveSkill, deleteSkill, probeHttpAuthRequirement, fetchRegistryServerDetail, selectBestPackage, extractRequiredInputs, mapRegistryToSpec, getAdapters, loadManagedIndex, getGatewayUrl, syncAllClients, toSecretRef, secretRefName, defaultAuthSecretName, resolveAuthTarget, applyAuthReference, removeAuthReference, listAuthBindings, maybePrefixBearer, buildEnrichedPath, isOAuthReference, oauthReferenceServerName, runOAuthLogin, getOAuthAccessToken, APP_VERSION, compareVersions, checkForUpdates, getStagedUpdate, shouldUseStagedCli, clearStagedUpdate, getStagedCliPath, startBackgroundUpdateCheck, runBackgroundUpdate, performUpdate, performRollback, getDaemonStatus, startDaemon, stopDaemon, restartDaemon, readDaemonLogs, runDaemonForeground, STATUS_CLIENTS, buildStatusReport };