@kwonye/mcpx 0.1.85 → 0.1.88

package/dist/{cli-8tdwfb4w.js → cli-vwnh1mqg.js}

@@ -2,11 +2,11 @@ import {
   loadConfig,
   loadMergedConfig,
   saveConfig
-} from "./cli-bq7zsrv6.js";
+} from "./cli-btx8jwra.js";
 import {
   SecretsManager,
   ensureGatewayToken
-} from "./cli-dvj5waat.js";
+} from "./cli-qfvawh8e.js";
 import {
   ensureDir,
   ensureParentDir,
@@ -290,6 +290,7 @@ function mapRegistryToSpec(_name, option, resolvedValues) {
 }
 
 // src/adapters/claude.ts
+import fs2 from "node:fs";
 import path2 from "node:path";
 import { z } from "zod";
 
@@ -352,6 +353,9 @@ function errorResult(clientId, configPath, message) {
     message
   };
 }
+function managedGatewayEntryName(serverName) {
+  return `${serverName} (mcpx)`;
+}
 function isManagedGatewayProjection(entryName) {
   return entryName.endsWith(" (mcpx)");
 }
@@ -419,6 +423,22 @@ function syncMcpExcludedArray(raw, managedNames, managedEntries) {
 }
 
 // src/adapters/claude.ts
+function normalizeProjectKey(p) {
+  try {
+    return fs2.realpathSync(path2.resolve(p));
+  } catch {
+    return path2.resolve(p);
+  }
+}
+function syncProjectDisabledArray(project, managedNames, disabledForThisProject) {
+  const existingNonManaged = (project.disabledMcpServers ?? []).filter((name) => !managedNames.includes(name));
+  const combined = [...existingNonManaged, ...disabledForThisProject];
+  if (combined.length > 0) {
+    project.disabledMcpServers = combined;
+  } else {
+    delete project.disabledMcpServers;
+  }
+}
 var stringMapSchema = z.record(z.string(), z.string());
 var claudeEntrySchema = z.object({
   type: z.string().optional(),
@@ -531,12 +551,26 @@ class ClaudeAdapter {
       }
       raw.mcpServers = topLevelServers;
       syncDisabledMcpServersArray(raw, managedNames, options.managedEntries);
+      const scopeByNormalizedPath = new Map;
+      for (const scope of options.projectScopes ?? []) {
+        scopeByNormalizedPath.set(normalizeProjectKey(scope.path), scope.disabledServerNames);
+      }
       const projects = raw.projects ?? {};
       for (const projectPath of Object.keys(projects)) {
         const project = projects[projectPath] ?? {};
-        syncDisabledMcpServersArray(project, managedNames, options.managedEntries);
+        const disabledForThis = scopeByNormalizedPath.get(normalizeProjectKey(projectPath)) ?? [];
+        syncProjectDisabledArray(project, managedNames, disabledForThis);
         projects[projectPath] = project;
       }
+      for (const scope of options.projectScopes ?? []) {
+        if (scope.disabledServerNames.length === 0)
+          continue;
+        const normalizedKey = normalizeProjectKey(scope.path);
+        const alreadyExists = Object.keys(projects).some((p) => normalizeProjectKey(p) === normalizedKey);
+        if (!alreadyExists) {
+          projects[scope.path] = { disabledMcpServers: [...scope.disabledServerNames] };
+        }
+      }
       raw.projects = projects;
       writeJsonAtomic(configPath, raw);
       setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(Object.entries(serverEntries).map(([name, entry]) => [name, JSON.stringify(entry)])));
@@ -680,7 +714,7 @@ class ClaudeDesktopAdapter {
 
 // src/adapters/codex.ts
 import path4 from "node:path";
-import fs2 from "node:fs";
+import fs3 from "node:fs";
 import { parse, stringify } from "@iarna/toml";
 import { z as z3 } from "zod";
 var stringMapSchema3 = z3.preprocess((value) => {
@@ -711,10 +745,10 @@ class CodexAdapter {
   scanForImports(_config, managedIndex) {
     const configPath = this.detectConfigPath();
     const result = emptyImportScan(this.id, configPath ?? undefined);
-    if (!configPath || !fs2.existsSync(configPath)) {
+    if (!configPath || !fs3.existsSync(configPath)) {
       return result;
     }
-    const existing = fs2.readFileSync(configPath, "utf8");
+    const existing = fs3.readFileSync(configPath, "utf8");
     const doc = existing.trim().length > 0 ? parse(existing) : {};
     const mcpServers = doc.mcp_servers ?? {};
     for (const [name, rawEntry] of Object.entries(mcpServers)) {
@@ -769,7 +803,7 @@ class CodexAdapter {
       return errorResult(this.id, undefined, "Unable to resolve Codex config.toml path.");
     }
     try {
-      const existing = fs2.existsSync(configPath) ? fs2.readFileSync(configPath, "utf8") : "";
+      const existing = fs3.existsSync(configPath) ? fs3.readFileSync(configPath, "utf8") : "";
       const doc = existing.trim().length > 0 ? parse(existing) : {};
       const mcpServers = doc.mcp_servers ?? {};
       removeSourceEntries(mcpServers, options.sourceEntriesToRemove);
@@ -790,10 +824,10 @@ class CodexAdapter {
         mcpServers[name] = entry;
       }
       doc.mcp_servers = mcpServers;
-      fs2.mkdirSync(path4.dirname(configPath), { recursive: true });
+      fs3.mkdirSync(path4.dirname(configPath), { recursive: true });
       const tmpPath = `${configPath}.tmp-${process.pid}-${Date.now()}`;
-      fs2.writeFileSync(tmpPath, stringify(doc), { mode: 384 });
-      fs2.renameSync(tmpPath, configPath);
+      fs3.writeFileSync(tmpPath, stringify(doc), { mode: 384 });
+      fs3.renameSync(tmpPath, configPath);
       setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(Object.entries(serverEntries).map(([name, entry]) => [name, JSON.stringify(entry)])));
       return okResult(this.id, configPath);
     } catch (error) {
@@ -933,7 +967,7 @@ class CursorAdapter {
 
 // src/adapters/cline.ts
 import path6 from "node:path";
-import fs3 from "node:fs";
+import fs4 from "node:fs";
 import { z as z5 } from "zod";
 var stringMapSchema5 = z5.record(z5.string(), z5.string());
 var clineEntrySchema = z5.object({
@@ -970,7 +1004,7 @@ class ClineAdapter {
   detectConfigPath() {
     const candidates = getCandidatePaths();
     for (const candidate of candidates) {
-      if (fs3.existsSync(candidate)) {
+      if (fs4.existsSync(candidate)) {
         return candidate;
       }
     }
@@ -982,7 +1016,7 @@ class ClineAdapter {
   scanForImports(_config, managedIndex) {
     const configPath = this.detectConfigPath();
     const result = emptyImportScan(this.id, configPath ?? undefined);
-    if (!configPath || !fs3.existsSync(configPath)) {
+    if (!configPath || !fs4.existsSync(configPath)) {
       return result;
     }
     const raw = readJsonFile(configPath, {});
@@ -1040,7 +1074,7 @@ class ClineAdapter {
     if (!configPath) {
       return errorResult(this.id, undefined, "Unable to resolve Cline MCP config path.");
     }
-    if (!fs3.existsSync(configPath)) {
+    if (!fs4.existsSync(configPath)) {
       return okResult(this.id, configPath, "Cline config not found; skipping sync.");
     }
     try {
@@ -1080,7 +1114,7 @@ class ClineAdapter {
 }
 
 // src/adapters/kiro.ts
-import fs4 from "node:fs";
+import fs5 from "node:fs";
 import path7 from "node:path";
 import { z as z6 } from "zod";
 var stringMapSchema6 = z6.record(z6.string(), z6.string());
@@ -1198,22 +1232,22 @@ class KiroAdapter {
   }
   syncSkills(skills) {
     const skillsDir = path7.join(homeDir(), ".kiro", "skills");
-    if (!fs4.existsSync(skillsDir)) {
-      fs4.mkdirSync(skillsDir, { recursive: true });
+    if (!fs5.existsSync(skillsDir)) {
+      fs5.mkdirSync(skillsDir, { recursive: true });
     }
-    const existingFiles = fs4.readdirSync(skillsDir);
+    const existingFiles = fs5.readdirSync(skillsDir);
     const managedIds = new Set(skills.map((s) => s.id));
     for (const file of existingFiles) {
       if (file.endsWith(".md")) {
         const id = path7.basename(file, ".md");
         if (!managedIds.has(id)) {
-          fs4.unlinkSync(path7.join(skillsDir, file));
+          fs5.unlinkSync(path7.join(skillsDir, file));
         }
       }
     }
     for (const skill of skills) {
       const targetPath = path7.join(skillsDir, `${skill.id}.md`);
-      fs4.writeFileSync(targetPath, skill.content, "utf-8");
+      fs5.writeFileSync(targetPath, skill.content, "utf-8");
     }
   }
 }
@@ -1468,7 +1502,7 @@ class VsCodeAdapter {
 }
 
 // src/adapters/qwen.ts
-import fs5 from "node:fs";
+import fs6 from "node:fs";
 import path10 from "node:path";
 import { z as z9 } from "zod";
 var stringMapSchema9 = z9.record(z9.string(), z9.string());
@@ -1583,22 +1617,22 @@ class QwenAdapter {
   }
   syncSkills(skills) {
     const skillsDir = path10.join(homeDir(), ".qwen", "skills");
-    if (!fs5.existsSync(skillsDir)) {
-      fs5.mkdirSync(skillsDir, { recursive: true });
+    if (!fs6.existsSync(skillsDir)) {
+      fs6.mkdirSync(skillsDir, { recursive: true });
     }
-    const existingFiles = fs5.readdirSync(skillsDir);
+    const existingFiles = fs6.readdirSync(skillsDir);
     const managedIds = new Set(skills.map((s) => s.id));
     for (const file of existingFiles) {
       if (file.endsWith(".md")) {
         const id = path10.basename(file, ".md");
         if (!managedIds.has(id)) {
-          fs5.unlinkSync(path10.join(skillsDir, file));
+          fs6.unlinkSync(path10.join(skillsDir, file));
         }
       }
     }
     for (const skill of skills) {
       const targetPath = path10.join(skillsDir, `${skill.id}.md`);
-      fs5.writeFileSync(targetPath, skill.content, "utf-8");
+      fs6.writeFileSync(targetPath, skill.content, "utf-8");
     }
   }
 }
@@ -1643,6 +1677,13 @@ function saveManagedIndex(index, filePath = getManagedIndexPath()) {
 function getGatewayUrl(config) {
   return `http://127.0.0.1:${config.gateway.port}/mcp`;
 }
+function buildProjectScopes(config) {
+  const globallyEnabled = new Set(Object.entries(config.servers).filter(([, spec]) => isServerEnabled(spec)).map(([name]) => name));
+  return Object.values(config.projects ?? {}).map((project) => {
+    const disabledServerNames = (project.disabledServers ?? []).filter((name) => globallyEnabled.has(name)).map((name) => managedGatewayEntryName(name));
+    return { path: project.path, disabledServerNames };
+  });
+}
 function buildManagedEntries(config, gatewayUrl, localToken) {
   const entries = Object.entries(config.servers);
   return entries.map(([name, spec]) => ({
@@ -1752,7 +1793,8 @@ function syncAllClients(config, secrets, targetClients) {
       managedEntries,
       managedIndex,
       managedIndexPath,
-      sourceEntriesToRemove: Array.from(sourceEntriesToRemove.get(adapter.id) ?? [])
+      sourceEntriesToRemove: Array.from(sourceEntriesToRemove.get(adapter.id) ?? []),
+      projectScopes: buildProjectScopes(config)
     });
     results.push(result);
   }
@@ -1887,11 +1929,11 @@ function maybePrefixBearer(target, value, raw = false) {
 // src/core/spawn-env.ts
 import os from "node:os";
 import path11 from "node:path";
-import fs6 from "node:fs";
+import fs7 from "node:fs";
 function existingNvmCurrentBin() {
   const nvmDir = process.env.NVM_DIR ?? path11.join(os.homedir(), ".nvm");
   const current = path11.join(nvmDir, "current", "bin");
-  return fs6.existsSync(current) ? current : null;
+  return fs7.existsSync(current) ? current : null;
 }
 function buildEnrichedPath(current = process.env.PATH ?? "") {
   const candidates = [
@@ -2211,7 +2253,7 @@ async function getOAuthAccessToken(serverName, spec, secrets, options = {}) {
 var APP_VERSION = "0.1.3";
 
 // src/core/update.ts
-import fs7 from "node:fs";
+import fs8 from "node:fs";
 import path12 from "node:path";
 import { execFileSync as execFileSync2 } from "node:child_process";
 function compareVersions(a, b) {
@@ -2251,17 +2293,17 @@ async function checkForUpdates() {
 }
 function getStagedUpdate() {
   const stagedPath = getStagedVersionPath();
-  if (!fs7.existsSync(stagedPath)) {
+  if (!fs8.existsSync(stagedPath)) {
     return null;
   }
   try {
-    const raw = fs7.readFileSync(stagedPath, "utf8");
+    const raw = fs8.readFileSync(stagedPath, "utf8");
     const info = JSON.parse(raw);
     if (!info.version || !info.cliPath) {
       return null;
     }
     const absoluteCliPath = path12.isAbsolute(info.cliPath) ? info.cliPath : path12.join(getUpdatesDir(), info.cliPath);
-    if (!fs7.existsSync(absoluteCliPath)) {
+    if (!fs8.existsSync(absoluteCliPath)) {
       return null;
     }
     return {
@@ -2280,15 +2322,15 @@ function stageUpdate(version, cliPath) {
     cliPath: path12.isAbsolute(cliPath) ? path12.relative(updatesDir, cliPath) : cliPath,
     stagedAt: new Date().toISOString()
   };
-  fs7.writeFileSync(getStagedVersionPath(), JSON.stringify(stagedInfo, null, 2), "utf8");
+  fs8.writeFileSync(getStagedVersionPath(), JSON.stringify(stagedInfo, null, 2), "utf8");
 }
 function shouldUseStagedCli(stagedVersion, currentVersion) {
   return compareVersions(stagedVersion, currentVersion) > 0;
 }
 function clearStagedUpdate() {
   const stagedPath = getStagedVersionPath();
-  if (fs7.existsSync(stagedPath)) {
-    fs7.unlinkSync(stagedPath);
+  if (fs8.existsSync(stagedPath)) {
+    fs8.unlinkSync(stagedPath);
   }
 }
 function getStagedCliPath() {
@@ -2297,10 +2339,10 @@ function getStagedCliPath() {
 }
 function removeOldVersions(keepCount = 2) {
   const updatesDir = getUpdatesDir();
-  if (!fs7.existsSync(updatesDir)) {
+  if (!fs8.existsSync(updatesDir)) {
     return;
   }
-  const entries = fs7.readdirSync(updatesDir, { withFileTypes: true });
+  const entries = fs8.readdirSync(updatesDir, { withFileTypes: true });
   const versionDirs = entries.filter((entry) => entry.isDirectory() && entry.name.startsWith("v")).map((entry) => entry.name).sort((a, b) => compareVersions(b.slice(1), a.slice(1)));
   if (versionDirs.length <= keepCount) {
     return;
@@ -2308,20 +2350,20 @@ function removeOldVersions(keepCount = 2) {
   for (const oldVersion of versionDirs.slice(keepCount)) {
     const oldPath = path12.join(updatesDir, oldVersion);
     try {
-      fs7.rmSync(oldPath, { recursive: true, force: true });
+      fs8.rmSync(oldPath, { recursive: true, force: true });
     } catch {}
   }
 }
 
 // src/core/update-manager.ts
-import fs8 from "node:fs";
+import fs9 from "node:fs";
 import path13 from "node:path";
 import { execSync, spawn } from "node:child_process";
 function acquireLock() {
   const lockPath = getUpdateLockPath();
   try {
     ensureDir(path13.dirname(lockPath));
-    fs8.writeFileSync(lockPath, `${process.pid}
+    fs9.writeFileSync(lockPath, `${process.pid}
 `, { flag: "wx" });
     return true;
   } catch {
@@ -2331,25 +2373,25 @@ function acquireLock() {
 function releaseLock() {
   const lockPath = getUpdateLockPath();
   try {
-    fs8.unlinkSync(lockPath);
+    fs9.unlinkSync(lockPath);
   } catch {}
 }
 function isUpdateInProgress() {
   const lockPath = getUpdateLockPath();
-  if (!fs8.existsSync(lockPath)) {
+  if (!fs9.existsSync(lockPath)) {
     return false;
   }
   try {
-    const raw = fs8.readFileSync(lockPath, "utf8").trim();
+    const raw = fs9.readFileSync(lockPath, "utf8").trim();
     const pid = Number(raw);
     if (!Number.isFinite(pid) || pid <= 0) {
-      fs8.unlinkSync(lockPath);
+      fs9.unlinkSync(lockPath);
       return false;
     }
     process.kill(pid, 0);
     return true;
   } catch {
-    fs8.unlinkSync(lockPath);
+    fs9.unlinkSync(lockPath);
     return false;
   }
 }
@@ -2361,7 +2403,7 @@ async function downloadAndStageUpdate() {
   const targetVersion = updateStatus.latestVersion;
   const updatesDir = getUpdatesDir();
   const versionDir = path13.join(updatesDir, `v${targetVersion}`);
-  if (fs8.existsSync(versionDir)) {
+  if (fs9.existsSync(versionDir)) {
     const existingStaged = getStagedUpdate();
     if (existingStaged?.version === targetVersion) {
       return { success: false, error: `Version ${targetVersion} already staged` };
@@ -2374,7 +2416,7 @@ async function downloadAndStageUpdate() {
       stdio: ["pipe", "pipe", "pipe"]
     });
     const tarballPath = path13.join(versionDir, `kwonye-mcpx-${targetVersion}.tgz`);
-    if (!fs8.existsSync(tarballPath)) {
+    if (!fs9.existsSync(tarballPath)) {
       throw new Error("Downloaded tarball not found");
     }
     execSync(`tar -xzf ${tarballPath} --strip-components=1`, {
@@ -2386,7 +2428,7 @@ async function downloadAndStageUpdate() {
       stdio: ["pipe", "pipe", "pipe"]
     });
     const cliPath = path13.join(versionDir, "dist", "cli.js");
-    if (!fs8.existsSync(cliPath)) {
+    if (!fs9.existsSync(cliPath)) {
       throw new Error("CLI entry point not found in downloaded package");
     }
     stageUpdate(targetVersion, cliPath);
@@ -2394,7 +2436,7 @@ async function downloadAndStageUpdate() {
     return { success: true, version: targetVersion };
   } catch (error) {
     try {
-      fs8.rmSync(versionDir, { recursive: true, force: true });
+      fs9.rmSync(versionDir, { recursive: true, force: true });
     } catch {}
     return {
       success: false,
@@ -2472,7 +2514,7 @@ function performRollback() {
 }
 
 // src/core/daemon.ts
-import fs9 from "node:fs";
+import fs10 from "node:fs";
 import net from "node:net";
 import { spawn as spawn2 } from "node:child_process";
 
@@ -2485,7 +2527,7 @@ import {
   StdioClientTransport,
   getDefaultEnvironment
 } from "@modelcontextprotocol/sdk/client/stdio.js";
-var JSON_RPC_VERSION2 = "2.0";
+import { StreamableHTTPClientTransport, StreamableHTTPError } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 var SERVER_VERSION = APP_VERSION;
 var DEFAULT_UPSTREAM_TIMEOUT_MS = 60000;
 var DEFAULT_CONNECT_TIMEOUT_MS = 1e4;
@@ -2653,10 +2695,7 @@ function parseNamespacedUri(uri) {
   };
 }
 async function callUpstream(upstream, method, params, id, secrets, runtime, passthroughAuthorizationHeader) {
-  if (upstream.spec.transport === "stdio") {
-    return callStdioUpstream(upstream, method, params, secrets, runtime);
-  }
-  return callHttpUpstream(upstream, method, params, id, secrets, passthroughAuthorizationHeader);
+  return callUpstreamOnce(upstream, method, params, secrets, runtime, passthroughAuthorizationHeader, false);
 }
 async function getUpstreamTokenCounts(config, secrets, runtime) {
   if (!runtime.tokenCache) {
@@ -2749,75 +2788,110 @@ function buildStdioServerParameters(spec, secrets) {
     env: resolveStdioEnv(spec, secrets)
   };
 }
-async function closeStdioConnection(entry) {
+async function buildHttpHeaders(upstream, secrets, options) {
+  const headers = {};
+  for (const [key, value] of Object.entries(upstream.spec.headers ?? {})) {
+    if (key.toLowerCase() === "authorization" && isOAuthReference(value)) {
+      const oauthServerName = oauthReferenceServerName(value);
+      const accessToken = await getOAuthAccessToken(oauthServerName, upstream.spec, secrets, {
+        forceRefresh: options.forceOAuthRefresh
+      });
+      headers[key] = `Bearer ${accessToken}`;
+    } else {
+      headers[key] = secrets.resolveMaybeSecret(value);
+    }
+  }
+  if (options.passthroughAuthorizationHeader) {
+    headers.Authorization = options.passthroughAuthorizationHeader;
+  }
+  return headers;
+}
+async function closeUpstreamConnection(entry) {
   try {
     const connection = await entry.promise;
     await connection.transport.close();
   } catch {}
 }
-async function reconcileStdioConnections(config, runtime) {
+async function reconcileUpstreamConnections(config, runtime) {
   const activeSpecs = new Map(Object.entries(config.servers).filter(([, spec]) => isServerEnabled(spec)).map(([name, spec]) => [name, specFingerprint(spec)]));
-  const staleNames = [];
-  for (const [name, entry] of runtime.stdioConnections.entries()) {
-    const expectedFingerprint = activeSpecs.get(name);
+  const staleKeys = [];
+  for (const [key, entry] of runtime.upstreamConnections.entries()) {
+    const upstreamName = key.includes(":") ? key.slice(0, key.indexOf(":")) : key;
+    const expectedFingerprint = activeSpecs.get(upstreamName);
     if (!expectedFingerprint || expectedFingerprint !== entry.fingerprint) {
-      staleNames.push(name);
+      staleKeys.push(key);
     }
   }
-  for (const name of staleNames) {
-    const entry = runtime.stdioConnections.get(name);
+  for (const key of staleKeys) {
+    const entry = runtime.upstreamConnections.get(key);
     if (!entry) {
       continue;
     }
-    runtime.stdioConnections.delete(name);
-    await closeStdioConnection(entry);
+    runtime.upstreamConnections.delete(key);
+    await closeUpstreamConnection(entry);
   }
 }
-function invalidateStdioConnection(name, runtime) {
-  const existing = runtime.stdioConnections.get(name);
+function invalidateUpstreamConnection(upstreamName, passthroughAuthorizationHeader, runtime) {
+  const key = passthroughAuthorizationHeader ? `${upstreamName}:passthrough` : upstreamName;
+  const existing = runtime.upstreamConnections.get(key);
   if (!existing) {
     return;
   }
-  runtime.stdioConnections.delete(name);
-  closeStdioConnection(existing);
+  runtime.upstreamConnections.delete(key);
+  closeUpstreamConnection(existing);
 }
-async function getStdioConnection(upstream, secrets, runtime) {
+async function getUpstreamConnection(upstream, secrets, runtime, options = {}) {
+  const { forceOAuthRefresh = false, passthroughAuthorizationHeader } = options;
+  const cacheKey = passthroughAuthorizationHeader ? `${upstream.name}:passthrough` : upstream.name;
   const fingerprint = specFingerprint(upstream.spec);
-  const existing = runtime.stdioConnections.get(upstream.name);
-  if (existing) {
-    if (existing.fingerprint === fingerprint) {
-      return existing.promise;
+  if (!forceOAuthRefresh) {
+    const existing = runtime.upstreamConnections.get(cacheKey);
+    if (existing) {
+      if (existing.fingerprint === fingerprint) {
+        return existing.promise;
+      }
+      runtime.upstreamConnections.delete(cacheKey);
+      closeUpstreamConnection(existing);
     }
-    runtime.stdioConnections.delete(upstream.name);
-    closeStdioConnection(existing);
   }
   const promise = (async () => {
-    const transport = new StdioClientTransport(buildStdioServerParameters(upstream.spec, secrets));
-    const client = new Client({
-      name: "mcpx",
-      version: SERVER_VERSION
-    });
+    let transport;
+    if (upstream.spec.transport === "stdio") {
+      transport = new StdioClientTransport(buildStdioServerParameters(upstream.spec, secrets));
+    } else {
+      const headers = await buildHttpHeaders(upstream, secrets, { forceOAuthRefresh, passthroughAuthorizationHeader });
+      const capturingFetch = async (url, init) => {
+        const response = await fetch(url, init);
+        const wwwAuth = response.headers.get("www-authenticate");
+        if (wwwAuth) {
+          if (!runtime.lastWwwAuthenticate) {
+            runtime.lastWwwAuthenticate = new Map;
+          }
+          runtime.lastWwwAuthenticate.set(upstream.name, wwwAuth);
+        }
+        return response;
+      };
+      transport = new StreamableHTTPClientTransport(new URL2(upstream.spec.url), { requestInit: { headers }, fetch: capturingFetch });
+    }
+    const client = new Client({ name: "mcpx", version: SERVER_VERSION });
     await withTimeout(client.connect(transport), DEFAULT_CONNECT_TIMEOUT_MS, `Upstream ${upstream.name} failed to connect within ${DEFAULT_CONNECT_TIMEOUT_MS}ms.`);
-    return {
-      fingerprint,
-      client,
-      transport
-    };
+    return { fingerprint, client, transport };
   })();
-  runtime.stdioConnections.set(upstream.name, {
-    fingerprint,
-    promise
-  });
+  runtime.upstreamConnections.set(cacheKey, { fingerprint, promise });
   try {
     return await promise;
   } catch (error) {
-    runtime.stdioConnections.delete(upstream.name);
+    runtime.upstreamConnections.delete(cacheKey);
     throw error;
   }
 }
-async function callStdioUpstream(upstream, method, params, secrets, runtime) {
+async function callUpstreamOnce(upstream, method, params, secrets, runtime, passthroughAuthorizationHeader, forceOAuthRefresh) {
+  const hasOAuth = upstream.spec.transport === "http" && Object.values(upstream.spec.headers ?? {}).some(isOAuthReference);
   try {
-    const connection = await getStdioConnection(upstream, secrets, runtime);
+    const connection = await getUpstreamConnection(upstream, secrets, runtime, {
+      forceOAuthRefresh,
+      passthroughAuthorizationHeader
+    });
     const timeoutMs = getConfiguredTimeoutMs();
     const timeoutMessage = `Upstream ${upstream.name} timed out after ${timeoutMs}ms for method ${method}.`;
     if (method === "tools/list") {
@@ -2838,161 +2912,17 @@ async function callStdioUpstream(upstream, method, params, secrets, runtime) {
     if (method === "prompts/get") {
       return withTimeout(connection.client.getPrompt(params), timeoutMs, timeoutMessage);
     }
-    throw new Error(`Unsupported stdio passthrough method: ${method}`);
+    throw new Error(`Unsupported method: ${method}`);
   } catch (error) {
-    invalidateStdioConnection(upstream.name, runtime);
-    throw error;
-  }
-}
-async function callHttpUpstream(upstream, method, params, id, secrets, passthroughAuthorizationHeader) {
-  return callHttpUpstreamOnce(upstream, method, params, id, secrets, passthroughAuthorizationHeader, false);
-}
-async function callHttpUpstreamOnce(upstream, method, params, id, secrets, passthroughAuthorizationHeader, forceOAuthRefresh) {
-  const headers = {
-    "content-type": "application/json",
-    accept: "application/json, text/event-stream"
-  };
-  for (const [key, value] of Object.entries(upstream.spec.headers ?? {})) {
-    if (key.toLowerCase() === "authorization" && isOAuthReference(value)) {
-      const oauthServerName = oauthReferenceServerName(value);
-      const accessToken = await getOAuthAccessToken(oauthServerName, upstream.spec, secrets, { forceRefresh: forceOAuthRefresh });
-      headers[key] = `Bearer ${accessToken}`;
-    } else {
-      headers[key] = secrets.resolveMaybeSecret(value);
+    invalidateUpstreamConnection(upstream.name, passthroughAuthorizationHeader, runtime);
+    if (!forceOAuthRefresh && hasOAuth && error instanceof StreamableHTTPError && (error.code === 401 || error.code === 403)) {
+      return callUpstreamOnce(upstream, method, params, secrets, runtime, passthroughAuthorizationHeader, true);
     }
-  }
-  if (passthroughAuthorizationHeader) {
-    headers.Authorization = passthroughAuthorizationHeader;
-  }
-  const timeoutMs = getConfiguredTimeoutMs();
-  const timeoutController = new AbortController;
-  const timeoutHandle = setTimeout(() => timeoutController.abort(), timeoutMs);
-  let response;
-  try {
-    response = await fetch(upstream.spec.url, {
-      method: "POST",
-      headers,
-      body: JSON.stringify({
-        jsonrpc: JSON_RPC_VERSION2,
-        id,
-        method,
-        params
-      }),
-      signal: timeoutController.signal
-    });
-  } catch (error) {
-    const name = error.name;
-    if (name === "AbortError") {
-      throw new Error(`Upstream ${upstream.name} timed out after ${timeoutMs}ms for method ${method}.`);
+    if (upstream.spec.transport === "http" && error instanceof StreamableHTTPError && error.code) {
+      const wwwAuthenticate = runtime.lastWwwAuthenticate?.get(upstream.name);
+      throw new UpstreamHttpError(upstream.name, error.code, error.message ?? "", wwwAuthenticate);
     }
     throw error;
-  } finally {
-    clearTimeout(timeoutHandle);
-  }
-  if (!response.ok) {
-    const responseText = await response.text();
-    if (!forceOAuthRefresh && (response.status === 401 || response.status === 403) && Object.values(upstream.spec.headers ?? {}).some((value) => isOAuthReference(value))) {
-      return callHttpUpstreamOnce(upstream, method, params, id, secrets, passthroughAuthorizationHeader, true);
-    }
-    throw new UpstreamHttpError(upstream.name, response.status, responseText, response.headers.get("www-authenticate") ?? undefined);
-  }
-  let payload = null;
-  const contentType = response.headers.get("content-type") ?? "";
-  if (contentType.includes("application/json")) {
-    payload = JSON.parse(await response.text());
-  } else if (contentType.includes("text/event-stream")) {
-    payload = await readSseJsonRpcResponse(response, id);
-  } else {
-    try {
-      payload = JSON.parse(await response.text());
-    } catch {
-      payload = null;
-    }
-  }
-  if (!payload) {
-    throw new Error(`Upstream ${upstream.name} response could not be parsed as JSON-RPC payload.`);
-  }
-  if (payload.error) {
-    throw new Error(`Upstream ${upstream.name} error: ${payload.error.message}`);
-  }
-  return payload.result;
-}
-async function readSseJsonRpcResponse(response, expectedId) {
-  if (!response.body) {
-    return null;
-  }
-  const decoder = new TextDecoder;
-  const reader = response.body.getReader();
-  let buffer = "";
-  let dataLines = [];
-  let latestPayload = null;
-  const consumeEvent = () => {
-    if (dataLines.length === 0) {
-      return null;
-    }
-    const combined = dataLines.join(`
-`).trim();
-    dataLines = [];
-    if (!combined || combined === "[DONE]") {
-      return null;
-    }
-    try {
-      const parsed = JSON.parse(combined);
-      latestPayload = parsed;
-      const parsedId = parsed.id ?? null;
-      if (parsedId === expectedId) {
-        return parsed;
-      }
-      return null;
-    } catch {
-      return null;
-    }
-  };
-  try {
-    while (true) {
-      const { value, done } = await reader.read();
-      if (done) {
-        break;
-      }
-      buffer += decoder.decode(value, { stream: true });
-      while (true) {
-        const newlineIndex = buffer.indexOf(`
-`);
-        if (newlineIndex < 0) {
-          break;
-        }
-        let line = buffer.slice(0, newlineIndex);
-        buffer = buffer.slice(newlineIndex + 1);
-        if (line.endsWith("\r")) {
-          line = line.slice(0, -1);
-        }
-        if (line.startsWith("data:")) {
-          dataLines.push(line.slice("data:".length).trimStart());
-          continue;
-        }
-        if (line === "") {
-          const matched = consumeEvent();
-          if (matched) {
-            return matched;
-          }
-        }
-      }
-    }
-    buffer += decoder.decode();
-    if (buffer.length > 0) {
-      let finalLine = buffer;
-      if (finalLine.endsWith("\r")) {
-        finalLine = finalLine.slice(0, -1);
-      }
-      if (finalLine.startsWith("data:")) {
-        dataLines.push(finalLine.slice("data:".length).trimStart());
-      }
-    }
-    return consumeEvent() ?? latestPayload;
-  } finally {
-    try {
-      await reader.cancel();
-    } catch {}
   }
 }
 function authHeaderIsValid(request, expectedToken) {
@@ -3255,7 +3185,7 @@ async function handleRequestObject(request, secrets, runtime, upstreamFilter, cl
   if (upstreamFilter && listUpstreams(config, upstreamFilter).length === 0) {
     return makeError(id, -32602, `Unknown upstream: ${upstreamFilter}`);
   }
-  await reconcileStdioConnections(config, runtime);
+  await reconcileUpstreamConnections(config, runtime);
   if (request.method === "custom/tokenCounts") {
     const result = await getUpstreamTokenCounts(config, secrets, runtime);
     return makeResult(id, result);
@@ -3351,7 +3281,7 @@ async function maybeHandleWellKnownOAuthRequest(request, response, requestUrl, s
 function createGatewayServer(options) {
   const debug = process.env.MCPX_GATEWAY_DEBUG === "1";
   const runtime = {
-    stdioConnections: new Map,
+    upstreamConnections: new Map,
     upstreamErrors: new Map
   };
   const server = http2.createServer(async (request, response) => {
@@ -3517,10 +3447,10 @@ function createGatewayServer(options) {
     }
   });
   server.on("close", () => {
-    for (const entry of runtime.stdioConnections.values()) {
-      closeStdioConnection(entry);
+    for (const entry of runtime.upstreamConnections.values()) {
+      closeUpstreamConnection(entry);
     }
-    runtime.stdioConnections.clear();
+    runtime.upstreamConnections.clear();
   });
   server.listen(options.port, "127.0.0.1");
   return server;
@@ -3528,10 +3458,10 @@ function createGatewayServer(options) {
 
 // src/core/daemon.ts
 function readPidFromFile(pidPath = getPidPath()) {
-  if (!fs9.existsSync(pidPath)) {
+  if (!fs10.existsSync(pidPath)) {
     return null;
   }
-  const raw = fs9.readFileSync(pidPath, "utf8").trim();
+  const raw = fs10.readFileSync(pidPath, "utf8").trim();
   if (!raw) {
     return null;
   }
@@ -3633,7 +3563,7 @@ async function startDaemon(config, cliPath, secrets) {
       };
     }
     try {
-      fs9.unlinkSync(getPidPath());
+      fs10.unlinkSync(getPidPath());
     } catch {}
   }
   const port = await resolveGatewayPort(config);
@@ -3642,7 +3572,7 @@ async function startDaemon(config, cliPath, secrets) {
   const logPath = getLogPath();
   ensureParentDir(pidPath);
   ensureParentDir(logPath);
-  const logFd = fs9.openSync(logPath, "a", 384);
+  const logFd = fs10.openSync(logPath, "a", 384);
   const child = spawn2(process.execPath, [cliPath, "daemon", "run", "--port", String(port)], {
     detached: true,
     stdio: ["ignore", logFd, logFd],
@@ -3652,7 +3582,7 @@ async function startDaemon(config, cliPath, secrets) {
     }
   });
   child.unref();
-  fs9.writeFileSync(pidPath, `${child.pid}
+  fs10.writeFileSync(pidPath, `${child.pid}
 `, { mode: 384 });
   startBackgroundUpdateCheck();
   await waitForGatewayReady(port, token);
@@ -3676,7 +3606,7 @@ function stopDaemon() {
     process.kill(pid, "SIGTERM");
   } catch {}
   try {
-    fs9.unlinkSync(pidPath);
+    fs10.unlinkSync(pidPath);
   } catch {}
   return {
     stopped: true,
@@ -3689,10 +3619,10 @@ async function restartDaemon(config, cliPath, secrets) {
 }
 function readDaemonLogs(maxLines = 200) {
   const logPath = getLogPath();
-  if (!fs9.existsSync(logPath)) {
+  if (!fs10.existsSync(logPath)) {
     return "";
   }
-  const lines = fs9.readFileSync(logPath, "utf8").split(`
+  const lines = fs10.readFileSync(logPath, "utf8").split(`
 `);
   return lines.slice(Math.max(lines.length - maxLines, 0)).join(`
 `);
@@ -3809,11 +3739,11 @@ async function buildStatusReport(config, managedIndex, daemon = getDaemonStatus(
       tokenCount
     };
     if (serverEntry.enabled && tokenCount) {
-      const matchingProject = projectEntries.find((p) => name.startsWith(`${p.name}.`));
-      if (matchingProject) {
-        totalProjectTokens[matchingProject.path] = (totalProjectTokens[matchingProject.path] ?? 0) + tokenCount.total;
-      } else {
-        totalGlobalTokens += tokenCount.total;
+      totalGlobalTokens += tokenCount.total;
+      for (const projectEntry of projectEntries) {
+        if (!(projectEntry.disabledServers ?? []).includes(name)) {
+          totalProjectTokens[projectEntry.path] = (totalProjectTokens[projectEntry.path] ?? 0) + tokenCount.total;
+        }
       }
     }
     return serverEntry;