@kwonye/mcpx 0.1.91 → 0.1.94

package/dist/{cli-b83jnbz7.js → cli-154shqmt.js}

@@ -1,73 +1,32 @@
+import {
+  getGatewayUrl,
+  persistSyncState,
+  syncAllClients
+} from "./cli-n8vt375e.js";
 import {
   loadConfig,
   loadMergedConfig,
   saveConfig
-} from "./cli-btx8jwra.js";
+} from "./cli-csfsg1yf.js";
 import {
   SecretsManager,
+  UpstreamError,
+  classifyUpstreamError,
   ensureGatewayToken
-} from "./cli-qfvawh8e.js";
+} from "./cli-tk8bggg5.js";
 import {
   ensureDir,
   ensureParentDir,
   getLogPath,
-  getManagedIndexPath,
   getPidPath,
-  getSkillsDir,
   getStagedVersionPath,
   getUpdateLockPath,
-  getUpdatesDir,
-  homeDir,
-  readJsonFile,
-  sha256,
-  writeJsonAtomic
-} from "./cli-zbbeadz8.js";
+  getUpdatesDir
+} from "./cli-zjepj3sj.js";
 import {
   isServerEnabled
 } from "./cli-s4gspqdf.js";
 
-// src/core/skills.ts
-import fs from "node:fs";
-import path from "node:path";
-function listSkills() {
-  const skillsDir = getSkillsDir();
-  if (!fs.existsSync(skillsDir)) {
-    return [];
-  }
-  const files = fs.readdirSync(skillsDir);
-  const skills = [];
-  for (const file of files) {
-    if (file.endsWith(".md")) {
-      const id = path.basename(file, ".md");
-      const content = fs.readFileSync(path.join(skillsDir, file), "utf-8");
-      skills.push({ id, content });
-    }
-  }
-  return skills;
-}
-function getSkill(id) {
-  const skillsDir = getSkillsDir();
-  const filePath = path.join(skillsDir, `${id}.md`);
-  if (!fs.existsSync(filePath)) {
-    return null;
-  }
-  const content = fs.readFileSync(filePath, "utf-8");
-  return { id, content };
-}
-function saveSkill(id, content) {
-  const skillsDir = getSkillsDir();
-  ensureDir(skillsDir);
-  const filePath = path.join(skillsDir, `${id}.md`);
-  fs.writeFileSync(filePath, content, "utf-8");
-}
-function deleteSkill(id) {
-  const skillsDir = getSkillsDir();
-  const filePath = path.join(skillsDir, `${id}.md`);
-  if (fs.existsSync(filePath)) {
-    fs.unlinkSync(filePath);
-  }
-}
-
 // src/core/auth-probe.ts
 var JSON_RPC_VERSION = "2.0";
 var DEFAULT_AUTH_PROBE_TIMEOUT_MS = 8000;
@@ -289,1557 +248,6 @@ function mapRegistryToSpec(_name, option, resolvedValues) {
   };
 }
 
-// src/adapters/claude.ts
-import fs2 from "node:fs";
-import path2 from "node:path";
-import { z } from "zod";
-
-// src/adapters/utils/index.ts
-function getManagedEntryNames(managedIndex, clientId) {
-  return Object.keys(managedIndex.managed[clientId]?.entries ?? {});
-}
-function isManagedEntry(managedIndex, clientId, entryName) {
-  return Boolean(managedIndex.managed[clientId]?.entries?.[entryName]);
-}
-function pruneStaleManagedEntries(managedIndex, clientId, servers, keepEntryNames) {
-  const keep = new Set(keepEntryNames);
-  const managedNames = getManagedEntryNames(managedIndex, clientId);
-  for (const name of managedNames) {
-    if (!keep.has(name)) {
-      delete servers[name];
-    }
-  }
-  for (const name of Object.keys(servers)) {
-    if (!keep.has(name) && name.endsWith(" (mcpx)")) {
-      delete servers[name];
-    }
-  }
-}
-function ensureManagedEntryWritable(managedIndex, clientId, entryName, existingValue) {
-  if (existingValue === undefined || existingValue === null) {
-    return null;
-  }
-  if (isManagedEntry(managedIndex, clientId, entryName)) {
-    return null;
-  }
-  return `Cannot sync managed entry "${entryName}" because an unmanaged entry already exists.`;
-}
-function setManagedEntries(managedIndex, clientId, configPath, entries) {
-  if (!managedIndex.managed[clientId]) {
-    managedIndex.managed[clientId] = {
-      configPath,
-      entries: {}
-    };
-  }
-  managedIndex.managed[clientId].configPath = configPath;
-  managedIndex.managed[clientId].entries = Object.fromEntries(Object.entries(entries).map(([entryName, serializedEntry]) => [entryName, {
-    fingerprint: sha256(serializedEntry),
-    lastSyncedAt: new Date().toISOString()
-  }]));
-}
-function okResult(clientId, configPath, message) {
-  return {
-    clientId,
-    status: "SYNCED",
-    configPath,
-    message
-  };
-}
-function errorResult(clientId, configPath, message) {
-  return {
-    clientId,
-    status: "ERROR",
-    configPath,
-    message
-  };
-}
-function managedGatewayEntryName(serverName) {
-  return `${serverName} (mcpx)`;
-}
-function isManagedGatewayProjection(entryName) {
-  return entryName.endsWith(" (mcpx)");
-}
-function sortRecord(record) {
-  if (!record || Object.keys(record).length === 0) {
-    return;
-  }
-  return Object.fromEntries(Object.entries(record).sort(([left], [right]) => left.localeCompare(right)));
-}
-function normalizeServerSpec(spec) {
-  if (spec.transport === "http") {
-    return {
-      transport: "http",
-      url: spec.url,
-      headers: sortRecord(spec.headers)
-    };
-  }
-  return {
-    transport: "stdio",
-    command: spec.command,
-    args: spec.args && spec.args.length > 0 ? [...spec.args] : undefined,
-    env: sortRecord(spec.env),
-    cwd: spec.cwd
-  };
-}
-function serializeServerSpec(spec) {
-  return JSON.stringify(normalizeServerSpec(spec));
-}
-function serverSpecsEqual(left, right) {
-  return serializeServerSpec(left) === serializeServerSpec(right);
-}
-function emptyImportScan(clientId, configPath) {
-  return {
-    clientId,
-    configPath,
-    candidates: [],
-    skipped: []
-  };
-}
-function buildImportSkip(clientId, sourceEntryName, reason, configPath, serverName = sourceEntryName) {
-  return {
-    clientId,
-    configPath,
-    sourceEntryName,
-    serverName,
-    reason
-  };
-}
-function removeSourceEntries(entries, names) {
-  for (const name of names ?? []) {
-    delete entries[name];
-  }
-}
-function syncDisabledMcpServersArray(raw, managedNames, managedEntries) {
-  const existingDisabled = (raw.disabledMcpServers ?? []).filter((name) => !managedNames.includes(name));
-  const disabledManaged = managedEntries.filter((entry) => !entry.enabled).map((entry) => entry.name);
-  raw.disabledMcpServers = [...existingDisabled, ...disabledManaged];
-}
-function syncMcpExcludedArray(raw, managedNames, managedEntries) {
-  const mcp = raw.mcp ?? {};
-  const existingExcluded = (mcp.excluded ?? []).filter((name) => !managedNames.includes(name));
-  const disabledManaged = managedEntries.filter((entry) => !entry.enabled).map((entry) => entry.name);
-  mcp.excluded = [...existingExcluded, ...disabledManaged];
-  raw.mcp = mcp;
-}
-
-// src/adapters/claude.ts
-function normalizeProjectKey(p) {
-  try {
-    return fs2.realpathSync(path2.resolve(p));
-  } catch {
-    return path2.resolve(p);
-  }
-}
-function syncProjectDisabledArray(project, managedNames, disabledForThisProject) {
-  const existingNonManaged = (project.disabledMcpServers ?? []).filter((name) => !managedNames.includes(name));
-  const combined = [...existingNonManaged, ...disabledForThisProject];
-  if (combined.length > 0) {
-    project.disabledMcpServers = combined;
-  } else {
-    delete project.disabledMcpServers;
-  }
-}
-var stringMapSchema = z.record(z.string(), z.string());
-var claudeEntrySchema = z.object({
-  type: z.string().optional(),
-  url: z.string().min(1).optional(),
-  headers: stringMapSchema.optional(),
-  command: z.string().min(1).optional(),
-  args: z.array(z.string()).optional(),
-  env: stringMapSchema.optional(),
-  cwd: z.string().min(1).optional(),
-  disabled: z.boolean().optional()
-}).passthrough();
-
-class ClaudeAdapter {
-  id = "claude";
-  detectConfigPath() {
-    return path2.join(homeDir(), ".claude.json");
-  }
-  supportsHttp() {
-    return true;
-  }
-  scanForImports(_config, managedIndex) {
-    const configPath = this.detectConfigPath();
-    const result = emptyImportScan(this.id, configPath ?? undefined);
-    if (!configPath) {
-      return result;
-    }
-    const raw = readJsonFile(configPath, {});
-    const topLevelServers = raw.mcpServers ?? {};
-    const disabledMcpServers = new Set(raw.disabledMcpServers ?? []);
-    const projects = raw.projects ?? {};
-    for (const project of Object.values(projects)) {
-      const projectDisabled = project?.disabledMcpServers ?? [];
-      for (const name of projectDisabled) {
-        disabledMcpServers.add(name);
-      }
-    }
-    for (const [name, rawEntry] of Object.entries(topLevelServers)) {
-      if (isManagedGatewayProjection(name) || managedIndex.managed[this.id]?.entries?.[name]) {
-        continue;
-      }
-      const parsed = claudeEntrySchema.safeParse(rawEntry);
-      if (!parsed.success) {
-        result.skipped.push(buildImportSkip(this.id, name, "Entry could not be mapped to an mcpx server.", configPath));
-        continue;
-      }
-      const entry = parsed.data;
-      const isDisabled = entry.disabled === true || disabledMcpServers.has(name);
-      if ((entry.type === undefined || entry.type === "http" || entry.type === "streamable-http") && entry.url && !entry.command) {
-        result.candidates.push({
-          clientId: this.id,
-          configPath,
-          sourceEntryName: name,
-          serverName: name,
-          spec: {
-            transport: "http",
-            url: entry.url,
-            headers: entry.headers,
-            enabled: !isDisabled
-          }
-        });
-        continue;
-      }
-      if ((entry.type === undefined || entry.type === "stdio") && entry.command && !entry.url) {
-        result.candidates.push({
-          clientId: this.id,
-          configPath,
-          sourceEntryName: name,
-          serverName: name,
-          spec: {
-            transport: "stdio",
-            command: entry.command,
-            args: entry.args,
-            env: entry.env,
-            cwd: entry.cwd,
-            enabled: !isDisabled
-          }
-        });
-        continue;
-      }
-      result.skipped.push(buildImportSkip(this.id, name, "Entry must define exactly one transport that mcpx supports.", configPath));
-    }
-    return result;
-  }
-  syncGateway(_config, options) {
-    const configPath = this.detectConfigPath();
-    if (!configPath) {
-      return errorResult(this.id, undefined, "Unable to resolve Claude config path.");
-    }
-    try {
-      const raw = readJsonFile(configPath, {});
-      const managedNames = options.managedEntries.map((entry) => entry.name);
-      const enabledEntries = options.managedEntries.filter((entry) => entry.enabled);
-      const serverEntries = Object.fromEntries(enabledEntries.map((entry) => [entry.name, {
-        type: "http",
-        url: entry.url,
-        headers: entry.headers
-      }]));
-      const enabledManagedNames = enabledEntries.map((entry) => entry.name);
-      const topLevelServers = raw.mcpServers ?? {};
-      removeSourceEntries(topLevelServers, options.sourceEntriesToRemove);
-      for (const name of enabledManagedNames) {
-        const topLevelConflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, topLevelServers[name]);
-        if (topLevelConflict) {
-          return errorResult(this.id, configPath, topLevelConflict);
-        }
-      }
-      pruneStaleManagedEntries(options.managedIndex, this.id, topLevelServers, enabledManagedNames);
-      for (const [name, entry] of Object.entries(serverEntries)) {
-        topLevelServers[name] = entry;
-      }
-      raw.mcpServers = topLevelServers;
-      syncDisabledMcpServersArray(raw, managedNames, options.managedEntries);
-      const scopeByNormalizedPath = new Map;
-      for (const scope of options.projectScopes ?? []) {
-        scopeByNormalizedPath.set(normalizeProjectKey(scope.path), scope.disabledServerNames);
-      }
-      const projects = raw.projects ?? {};
-      for (const projectPath of Object.keys(projects)) {
-        const project = projects[projectPath] ?? {};
-        const disabledForThis = scopeByNormalizedPath.get(normalizeProjectKey(projectPath)) ?? [];
-        syncProjectDisabledArray(project, managedNames, disabledForThis);
-        projects[projectPath] = project;
-      }
-      for (const scope of options.projectScopes ?? []) {
-        if (scope.disabledServerNames.length === 0)
-          continue;
-        const normalizedKey = normalizeProjectKey(scope.path);
-        const alreadyExists = Object.keys(projects).some((p) => normalizeProjectKey(p) === normalizedKey);
-        if (!alreadyExists) {
-          projects[scope.path] = { disabledMcpServers: [...scope.disabledServerNames] };
-        }
-      }
-      raw.projects = projects;
-      writeJsonAtomic(configPath, raw);
-      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(Object.entries(serverEntries).map(([name, entry]) => [name, JSON.stringify(entry)])));
-      return okResult(this.id, configPath);
-    } catch (error) {
-      return errorResult(this.id, configPath, error.message);
-    }
-  }
-}
-
-// src/adapters/claude-desktop.ts
-import { execFileSync } from "node:child_process";
-import path3 from "node:path";
-import { z as z2 } from "zod";
-var stringMapSchema2 = z2.record(z2.string(), z2.string());
-var claudeDesktopEntrySchema = z2.object({
-  type: z2.string().optional(),
-  url: z2.string().min(1).optional(),
-  headers: stringMapSchema2.optional(),
-  command: z2.string().min(1).optional(),
-  args: z2.array(z2.string()).optional(),
-  env: stringMapSchema2.optional(),
-  cwd: z2.string().min(1).optional(),
-  disabled: z2.boolean().optional()
-}).passthrough();
-function buildProxyEntry(entry) {
-  const upstreamName = entry.name.replace(/ \(mcpx\)$/, "");
-  try {
-    const mcpxPath = execFileSync("which", ["mcpx"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
-    if (mcpxPath)
-      return { command: mcpxPath, args: ["proxy", upstreamName] };
-  } catch {}
-  return { command: "npx", args: ["-y", "@kwonye/mcpx@latest", "proxy", upstreamName] };
-}
-
-class ClaudeDesktopAdapter {
-  id = "claude-desktop";
-  detectConfigPath() {
-    if (process.platform === "linux") {
-      return path3.join(homeDir(), ".config", "Claude", "claude_desktop_config.json");
-    }
-    if (process.platform === "win32") {
-      return path3.join(process.env.APPDATA ?? "", "Claude", "claude_desktop_config.json");
-    }
-    return path3.join(homeDir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
-  }
-  supportsHttp() {
-    return true;
-  }
-  scanForImports(_config, managedIndex) {
-    const configPath = this.detectConfigPath();
-    const result = emptyImportScan(this.id, configPath ?? undefined);
-    if (!configPath) {
-      return result;
-    }
-    const raw = readJsonFile(configPath, {});
-    const topLevelServers = raw.mcpServers ?? {};
-    for (const [name, rawEntry] of Object.entries(topLevelServers)) {
-      if (isManagedGatewayProjection(name) || managedIndex.managed[this.id]?.entries?.[name]) {
-        continue;
-      }
-      const parsed = claudeDesktopEntrySchema.safeParse(rawEntry);
-      if (!parsed.success) {
-        result.skipped.push(buildImportSkip(this.id, name, "Entry could not be mapped to an mcpx server.", configPath));
-        continue;
-      }
-      const entry = parsed.data;
-      if ((entry.type === undefined || entry.type === "http" || entry.type === "streamable-http") && entry.url && !entry.command) {
-        result.candidates.push({
-          clientId: this.id,
-          configPath,
-          sourceEntryName: name,
-          serverName: name,
-          spec: {
-            transport: "http",
-            url: entry.url,
-            headers: entry.headers,
-            enabled: entry.disabled !== true
-          }
-        });
-        continue;
-      }
-      if ((entry.type === undefined || entry.type === "stdio") && entry.command && !entry.url) {
-        result.candidates.push({
-          clientId: this.id,
-          configPath,
-          sourceEntryName: name,
-          serverName: name,
-          spec: {
-            transport: "stdio",
-            command: entry.command,
-            args: entry.args,
-            env: entry.env,
-            cwd: entry.cwd,
-            enabled: entry.disabled !== true
-          }
-        });
-        continue;
-      }
-      result.skipped.push(buildImportSkip(this.id, name, "Entry must define exactly one transport that mcpx supports.", configPath));
-    }
-    return result;
-  }
-  syncGateway(_config, options) {
-    const configPath = this.detectConfigPath();
-    if (!configPath) {
-      return errorResult(this.id, undefined, "Unable to resolve Claude Desktop config path.");
-    }
-    try {
-      const raw = readJsonFile(configPath, {});
-      const enabledEntries = options.managedEntries.filter((entry) => entry.enabled);
-      const serverEntries = Object.fromEntries(enabledEntries.map((entry) => {
-        const { command, args } = buildProxyEntry(entry);
-        return [entry.name, { command, args }];
-      }));
-      const enabledManagedNames = enabledEntries.map((entry) => entry.name);
-      const topLevelServers = raw.mcpServers ?? {};
-      removeSourceEntries(topLevelServers, options.sourceEntriesToRemove);
-      for (const name of enabledManagedNames) {
-        const topLevelConflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, topLevelServers[name]);
-        if (topLevelConflict) {
-          return errorResult(this.id, configPath, topLevelConflict);
-        }
-      }
-      pruneStaleManagedEntries(options.managedIndex, this.id, topLevelServers, enabledManagedNames);
-      for (const [name, entry] of Object.entries(serverEntries)) {
-        topLevelServers[name] = entry;
-      }
-      raw.mcpServers = topLevelServers;
-      writeJsonAtomic(configPath, raw);
-      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(enabledEntries.map((entry) => {
-        const { command, args } = buildProxyEntry(entry);
-        return [entry.name, JSON.stringify({ command, args })];
-      })));
-      return okResult(this.id, configPath);
-    } catch (error) {
-      return errorResult(this.id, configPath, error.message);
-    }
-  }
-}
-
-// src/adapters/codex.ts
-import path4 from "node:path";
-import fs3 from "node:fs";
-import { parse, stringify } from "@iarna/toml";
-import { z as z3 } from "zod";
-var stringMapSchema3 = z3.preprocess((value) => {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return value;
-  }
-  return Object.fromEntries(Object.entries(value));
-}, z3.record(z3.string(), z3.string()));
-var codexEntrySchema = z3.object({
-  enabled: z3.boolean().optional(),
-  url: z3.string().min(1).optional(),
-  headers: stringMapSchema3.optional(),
-  http_headers: stringMapSchema3.optional(),
-  command: z3.string().min(1).optional(),
-  args: z3.array(z3.string()).optional(),
-  env: stringMapSchema3.optional(),
-  cwd: z3.string().min(1).optional()
-}).passthrough();
-
-class CodexAdapter {
-  id = "codex";
-  detectConfigPath() {
-    return path4.join(homeDir(), ".codex", "config.toml");
-  }
-  supportsHttp() {
-    return true;
-  }
-  scanForImports(_config, managedIndex) {
-    const configPath = this.detectConfigPath();
-    const result = emptyImportScan(this.id, configPath ?? undefined);
-    if (!configPath || !fs3.existsSync(configPath)) {
-      return result;
-    }
-    const existing = fs3.readFileSync(configPath, "utf8");
-    const doc = existing.trim().length > 0 ? parse(existing) : {};
-    const mcpServers = doc.mcp_servers ?? {};
-    for (const [name, rawEntry] of Object.entries(mcpServers)) {
-      if (isManagedGatewayProjection(name) || managedIndex.managed[this.id]?.entries?.[name]) {
-        continue;
-      }
-      const parsed = codexEntrySchema.safeParse(rawEntry);
-      if (!parsed.success) {
-        result.skipped.push(buildImportSkip(this.id, name, "Entry could not be mapped to an mcpx server.", configPath));
-        continue;
-      }
-      const entry = parsed.data;
-      if (entry.url && !entry.command) {
-        result.candidates.push({
-          clientId: this.id,
-          configPath,
-          sourceEntryName: name,
-          serverName: name,
-          spec: {
-            transport: "http",
-            url: entry.url,
-            headers: entry.http_headers ?? entry.headers,
-            enabled: entry.enabled !== false
-          }
-        });
-        continue;
-      }
-      if (entry.command && !entry.url) {
-        result.candidates.push({
-          clientId: this.id,
-          configPath,
-          sourceEntryName: name,
-          serverName: name,
-          spec: {
-            transport: "stdio",
-            command: entry.command,
-            args: entry.args,
-            env: entry.env,
-            cwd: entry.cwd,
-            enabled: entry.enabled !== false
-          }
-        });
-        continue;
-      }
-      result.skipped.push(buildImportSkip(this.id, name, "Entry must define exactly one transport that mcpx supports.", configPath));
-    }
-    return result;
-  }
-  syncGateway(_config, options) {
-    const configPath = this.detectConfigPath();
-    if (!configPath) {
-      return errorResult(this.id, undefined, "Unable to resolve Codex config.toml path.");
-    }
-    try {
-      const existing = fs3.existsSync(configPath) ? fs3.readFileSync(configPath, "utf8") : "";
-      const doc = existing.trim().length > 0 ? parse(existing) : {};
-      const mcpServers = doc.mcp_servers ?? {};
-      removeSourceEntries(mcpServers, options.sourceEntriesToRemove);
-      const managedNames = options.managedEntries.map((entry) => entry.name);
-      const serverEntries = Object.fromEntries(options.managedEntries.map((entry) => [entry.name, {
-        enabled: entry.enabled,
-        url: entry.url,
-        http_headers: entry.headers
-      }]));
-      for (const name of managedNames) {
-        const conflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, mcpServers[name]);
-        if (conflict) {
-          return errorResult(this.id, configPath, conflict);
-        }
-      }
-      pruneStaleManagedEntries(options.managedIndex, this.id, mcpServers, managedNames);
-      for (const [name, entry] of Object.entries(serverEntries)) {
-        mcpServers[name] = entry;
-      }
-      doc.mcp_servers = mcpServers;
-      fs3.mkdirSync(path4.dirname(configPath), { recursive: true });
-      const tmpPath = `${configPath}.tmp-${process.pid}-${Date.now()}`;
-      fs3.writeFileSync(tmpPath, stringify(doc), { mode: 384 });
-      fs3.renameSync(tmpPath, configPath);
-      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(Object.entries(serverEntries).map(([name, entry]) => [name, JSON.stringify(entry)])));
-      return okResult(this.id, configPath);
-    } catch (error) {
-      return errorResult(this.id, configPath, error.message);
-    }
-  }
-}
-
-// src/adapters/cursor.ts
-import path5 from "node:path";
-import { z as z4 } from "zod";
-var stringMapSchema4 = z4.record(z4.string(), z4.string());
-var cursorEntrySchema = z4.object({
-  type: z4.string().optional(),
-  url: z4.string().min(1).optional(),
-  headers: stringMapSchema4.optional(),
-  command: z4.string().min(1).optional(),
-  args: z4.array(z4.string()).optional(),
-  env: stringMapSchema4.optional(),
-  cwd: z4.string().min(1).optional(),
-  disabled: z4.boolean().optional()
-}).passthrough();
-
-class CursorAdapter {
-  id = "cursor";
-  detectConfigPath() {
-    return path5.join(homeDir(), ".cursor", "mcp.json");
-  }
-  supportsHttp() {
-    return true;
-  }
-  scanForImports(_config, managedIndex) {
-    const configPath = this.detectConfigPath();
-    const result = emptyImportScan(this.id, configPath ?? undefined);
-    if (!configPath) {
-      return result;
-    }
-    const raw = readJsonFile(configPath, {});
-    const servers = {
-      ...raw.mcpServers ?? {}
-    };
-    for (const [name, rawEntry] of Object.entries(servers)) {
-      if (isManagedGatewayProjection(name) || managedIndex.managed[this.id]?.entries?.[name]) {
-        continue;
-      }
-      const parsed = cursorEntrySchema.safeParse(rawEntry);
-      if (!parsed.success) {
-        result.skipped.push(buildImportSkip(this.id, name, "Entry could not be mapped to an mcpx server.", configPath));
-        continue;
-      }
-      const entry = parsed.data;
-      if ((entry.type === undefined || entry.type === "http" || entry.type === "streamable-http") && entry.url && !entry.command) {
-        result.candidates.push({
-          clientId: this.id,
-          configPath,
-          sourceEntryName: name,
-          serverName: name,
-          spec: {
-            transport: "http",
-            url: entry.url,
-            headers: entry.headers,
-            enabled: entry.disabled !== true
-          }
-        });
-        continue;
-      }
-      if ((entry.type === undefined || entry.type === "stdio") && entry.command && !entry.url) {
-        result.candidates.push({
-          clientId: this.id,
-          configPath,
-          sourceEntryName: name,
-          serverName: name,
-          spec: {
-            transport: "stdio",
-            command: entry.command,
-            args: entry.args,
-            env: entry.env,
-            cwd: entry.cwd,
-            enabled: entry.disabled !== true
-          }
-        });
-        continue;
-      }
-      result.skipped.push(buildImportSkip(this.id, name, "Entry must define exactly one transport that mcpx supports.", configPath));
-    }
-    return result;
-  }
-  syncGateway(_config, options) {
-    const configPath = this.detectConfigPath();
-    if (!configPath) {
-      return errorResult(this.id, undefined, "Unable to resolve Cursor MCP config path.");
-    }
-    try {
-      const raw = readJsonFile(configPath, {});
-      const servers = {
-        ...raw.mcpServers ?? {}
-      };
-      removeSourceEntries(servers, options.sourceEntriesToRemove);
-      const enabledEntries = options.managedEntries.filter((entry) => entry.enabled);
-      const serverEntries = Object.fromEntries(enabledEntries.map((entry) => [entry.name, {
-        type: "http",
-        url: entry.url,
-        headers: entry.headers
-      }]));
-      const enabledManagedNames = enabledEntries.map((entry) => entry.name);
-      for (const name of enabledManagedNames) {
-        const conflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, servers[name]);
-        if (conflict) {
-          return errorResult(this.id, configPath, conflict);
-        }
-      }
-      pruneStaleManagedEntries(options.managedIndex, this.id, servers, enabledManagedNames);
-      for (const [name, entry] of Object.entries(serverEntries)) {
-        servers[name] = entry;
-      }
-      const next = {
-        ...raw,
-        mcpServers: servers
-      };
-      writeJsonAtomic(configPath, next);
-      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(options.managedEntries.map((entry) => [
-        entry.name,
-        JSON.stringify({ type: "http", url: entry.url, headers: entry.headers, enabled: entry.enabled })
-      ])));
-      return okResult(this.id, configPath);
-    } catch (error) {
-      return errorResult(this.id, configPath, error.message);
-    }
-  }
-}
-
-// src/adapters/cline.ts
-import path6 from "node:path";
-import fs4 from "node:fs";
-import { z as z5 } from "zod";
-var HTTP_TRANSPORT_TYPES = new Set(["http", "sse", "streamableHttp"]);
-var stringMapSchema5 = z5.record(z5.string(), z5.string());
-var clineEntrySchema = z5.object({
-  type: z5.string().optional(),
-  transportType: z5.string().optional(),
-  url: z5.string().min(1).optional(),
-  headers: stringMapSchema5.optional(),
-  command: z5.string().min(1).optional(),
-  args: z5.array(z5.string()).optional(),
-  env: stringMapSchema5.optional(),
-  cwd: z5.string().min(1).optional(),
-  disabled: z5.boolean().optional()
-}).passthrough();
-function getCandidatePaths() {
-  if (process.platform === "linux") {
-    return [
-      path6.join(homeDir(), ".config", "Code", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
-      path6.join(homeDir(), ".config", "Cursor", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
-      path6.join(homeDir(), ".cline", "settings", "cline_mcp_settings.json")
-    ];
-  }
-  if (process.platform === "win32") {
-    return [
-      path6.join(process.env.APPDATA ?? "", "Code", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
-      path6.join(process.env.APPDATA ?? "", "Cursor", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
-      path6.join(homeDir(), ".cline", "settings", "cline_mcp_settings.json")
-    ];
-  }
-  return [
-    path6.join(homeDir(), "Library", "Application Support", "Code", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
-    path6.join(homeDir(), "Library", "Application Support", "Cursor", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
-    path6.join(homeDir(), ".cline", "settings", "cline_mcp_settings.json")
-  ];
-}
-
-class ClineAdapter {
-  id = "cline";
-  detectConfigPath() {
-    const candidates = getCandidatePaths();
-    for (const candidate of candidates) {
-      if (fs4.existsSync(candidate)) {
-        return candidate;
-      }
-    }
-    return candidates[0] ?? null;
-  }
-  supportsHttp() {
-    return true;
-  }
-  scanForImports(_config, managedIndex) {
-    const configPath = this.detectConfigPath();
-    const result = emptyImportScan(this.id, configPath ?? undefined);
-    if (!configPath || !fs4.existsSync(configPath)) {
-      return result;
-    }
-    const raw = readJsonFile(configPath, {});
-    const servers = {
-      ...raw.mcpServers ?? {}
-    };
-    for (const [name, rawEntry] of Object.entries(servers)) {
-      if (isManagedGatewayProjection(name) || managedIndex.managed[this.id]?.entries?.[name]) {
-        continue;
-      }
-      const parsed = clineEntrySchema.safeParse(rawEntry);
-      if (!parsed.success) {
-        result.skipped.push(buildImportSkip(this.id, name, "Entry could not be mapped to an mcpx server.", configPath));
-        continue;
-      }
-      const entry = parsed.data;
-      const transport = entry.type ?? entry.transportType;
-      if ((transport === undefined || HTTP_TRANSPORT_TYPES.has(transport)) && entry.url && !entry.command) {
-        result.candidates.push({
-          clientId: this.id,
-          configPath,
-          sourceEntryName: name,
-          serverName: name,
-          spec: {
-            transport: "http",
-            url: entry.url,
-            headers: entry.headers,
-            enabled: entry.disabled !== true
-          }
-        });
-        continue;
-      }
-      if ((transport === undefined || transport === "stdio") && entry.command && !entry.url) {
-        result.candidates.push({
-          clientId: this.id,
-          configPath,
-          sourceEntryName: name,
-          serverName: name,
-          spec: {
-            transport: "stdio",
-            command: entry.command,
-            args: entry.args,
-            env: entry.env,
-            cwd: entry.cwd,
-            enabled: entry.disabled !== true
-          }
-        });
-        continue;
-      }
-      result.skipped.push(buildImportSkip(this.id, name, "Entry must define exactly one transport that mcpx supports.", configPath));
-    }
-    return result;
-  }
-  syncGateway(_config, options) {
-    const configPath = this.detectConfigPath();
-    if (!configPath) {
-      return errorResult(this.id, undefined, "Unable to resolve Cline MCP config path.");
-    }
-    if (!fs4.existsSync(configPath)) {
-      return okResult(this.id, configPath, "Cline config not found; skipping sync.");
-    }
-    try {
-      const raw = readJsonFile(configPath, {});
-      const servers = {
-        ...raw.mcpServers ?? {}
-      };
-      removeSourceEntries(servers, options.sourceEntriesToRemove);
-      const managedNames = options.managedEntries.map((entry) => entry.name);
-      const serverEntries = Object.fromEntries(options.managedEntries.map((entry) => [entry.name, {
-        type: "streamableHttp",
-        url: entry.url,
-        headers: entry.headers,
-        disabled: !entry.enabled
-      }]));
-      for (const name of managedNames) {
-        const conflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, servers[name]);
-        if (conflict) {
-          return errorResult(this.id, configPath, conflict);
-        }
-      }
-      pruneStaleManagedEntries(options.managedIndex, this.id, servers, managedNames);
-      for (const [name, entry] of Object.entries(serverEntries)) {
-        servers[name] = entry;
-      }
-      const next = {
-        ...raw,
-        mcpServers: servers
-      };
-      writeJsonAtomic(configPath, next);
-      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(Object.entries(serverEntries).map(([name, entry]) => [name, JSON.stringify(entry)])));
-      return okResult(this.id, configPath);
-    } catch (error) {
-      return errorResult(this.id, configPath, error.message);
-    }
-  }
-}
-
-// src/adapters/kiro.ts
-import fs5 from "node:fs";
-import path7 from "node:path";
-import { z as z6 } from "zod";
-var stringMapSchema6 = z6.record(z6.string(), z6.string());
-var kiroEntrySchema = z6.object({
-  type: z6.string().optional(),
-  url: z6.string().min(1).optional(),
-  headers: stringMapSchema6.optional(),
-  command: z6.string().min(1).optional(),
-  args: z6.array(z6.string()).optional(),
-  env: stringMapSchema6.optional(),
-  cwd: z6.string().min(1).optional(),
-  disabled: z6.boolean().optional()
-}).passthrough();
-
-class KiroAdapter {
-  id = "kiro";
-  detectConfigPath() {
-    return path7.join(homeDir(), ".kiro", "settings", "mcp.json");
-  }
-  supportsHttp() {
-    return true;
-  }
-  scanForImports(_config, managedIndex) {
-    const configPath = this.detectConfigPath();
-    const result = emptyImportScan(this.id, configPath ?? undefined);
-    if (!configPath) {
-      return result;
-    }
-    const raw = readJsonFile(configPath, {});
-    const servers = {
-      ...raw.mcpServers ?? {}
-    };
-    for (const [name, rawEntry] of Object.entries(servers)) {
-      if (isManagedGatewayProjection(name) || managedIndex.managed[this.id]?.entries?.[name]) {
-        continue;
-      }
-      const parsed = kiroEntrySchema.safeParse(rawEntry);
-      if (!parsed.success) {
-        result.skipped.push(buildImportSkip(this.id, name, "Entry could not be mapped to an mcpx server.", configPath));
-        continue;
-      }
-      const entry = parsed.data;
-      if ((entry.type === undefined || entry.type === "http" || entry.type === "streamable-http" || entry.type === "sse") && entry.url && !entry.command) {
-        result.candidates.push({
-          clientId: this.id,
-          configPath,
-          sourceEntryName: name,
-          serverName: name,
-          spec: {
-            transport: "http",
-            url: entry.url,
-            headers: entry.headers,
-            enabled: entry.disabled !== true
-          }
-        });
-        continue;
-      }
-      if ((entry.type === undefined || entry.type === "stdio") && entry.command && !entry.url) {
-        result.candidates.push({
-          clientId: this.id,
-          configPath,
-          sourceEntryName: name,
-          serverName: name,
-          spec: {
-            transport: "stdio",
-            command: entry.command,
-            args: entry.args,
-            env: entry.env,
-            cwd: entry.cwd,
-            enabled: entry.disabled !== true
-          }
-        });
-        continue;
-      }
-      result.skipped.push(buildImportSkip(this.id, name, "Entry must define exactly one transport that mcpx supports.", configPath));
-    }
-    return result;
-  }
-  syncGateway(_config, options) {
-    const configPath = this.detectConfigPath();
-    if (!configPath) {
-      return errorResult(this.id, undefined, "Unable to resolve Kiro MCP config path.");
-    }
-    try {
-      const raw = readJsonFile(configPath, {});
-      const servers = {
-        ...raw.mcpServers ?? {}
-      };
-      removeSourceEntries(servers, options.sourceEntriesToRemove);
-      const managedNames = options.managedEntries.map((entry) => entry.name);
-      const serverEntries = Object.fromEntries(options.managedEntries.map((entry) => [entry.name, {
-        url: entry.url,
-        headers: entry.headers,
-        disabled: !entry.enabled
-      }]));
-      for (const name of managedNames) {
-        const conflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, servers[name]);
-        if (conflict) {
-          return errorResult(this.id, configPath, conflict);
-        }
-      }
-      pruneStaleManagedEntries(options.managedIndex, this.id, servers, managedNames);
-      for (const [name, entry] of Object.entries(serverEntries)) {
-        servers[name] = entry;
-      }
-      const next = {
-        ...raw,
-        mcpServers: servers
-      };
-      writeJsonAtomic(configPath, next);
-      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(Object.entries(serverEntries).map(([name, entry]) => [name, JSON.stringify(entry)])));
-      return okResult(this.id, configPath);
-    } catch (error) {
-      return errorResult(this.id, configPath, error.message);
-    }
-  }
-  syncSkills(skills) {
-    const skillsDir = path7.join(homeDir(), ".kiro", "skills");
-    if (!fs5.existsSync(skillsDir)) {
-      fs5.mkdirSync(skillsDir, { recursive: true });
-    }
-    const existingFiles = fs5.readdirSync(skillsDir);
-    const managedIds = new Set(skills.map((s) => s.id));
-    for (const file of existingFiles) {
-      if (file.endsWith(".md")) {
-        const id = path7.basename(file, ".md");
-        if (!managedIds.has(id)) {
-          fs5.unlinkSync(path7.join(skillsDir, file));
-        }
-      }
-    }
-    for (const skill of skills) {
-      const targetPath = path7.join(skillsDir, `${skill.id}.md`);
-      fs5.writeFileSync(targetPath, skill.content, "utf-8");
-    }
-  }
-}
-
-// src/adapters/opencode.ts
-import path8 from "node:path";
-import { z as z7 } from "zod";
-var stringMapSchema7 = z7.record(z7.string(), z7.string());
-var openCodeEntrySchema = z7.object({
-  type: z7.string().optional(),
-  url: z7.string().min(1).optional(),
-  headers: stringMapSchema7.optional(),
-  command: z7.union([z7.string().min(1), z7.array(z7.string())]).optional(),
-  args: z7.array(z7.string()).optional(),
-  env: stringMapSchema7.optional(),
-  environment: stringMapSchema7.optional(),
-  cwd: z7.string().min(1).optional(),
-  enabled: z7.boolean().optional()
-}).passthrough();
-
-class OpenCodeAdapter {
-  id = "opencode";
-  detectConfigPath() {
-    return path8.join(homeDir(), ".config", "opencode", "opencode.json");
-  }
-  supportsHttp() {
-    return true;
-  }
-  scanForImports(_config, managedIndex) {
-    const configPath = this.detectConfigPath();
-    const result = emptyImportScan(this.id, configPath ?? undefined);
-    if (!configPath) {
-      return result;
-    }
-    const raw = readJsonFile(configPath, {});
-    const mcp = {
-      ...raw.mcp ?? {}
-    };
-    for (const [name, rawEntry] of Object.entries(mcp)) {
-      if (isManagedGatewayProjection(name) || managedIndex.managed[this.id]?.entries?.[name]) {
-        continue;
-      }
-      const parsed = openCodeEntrySchema.safeParse(rawEntry);
-      if (!parsed.success) {
-        result.skipped.push(buildImportSkip(this.id, name, "Entry could not be mapped to an mcpx server.", configPath));
-        continue;
-      }
-      const entry = parsed.data;
-      if ((entry.type === undefined || entry.type === "remote" || entry.type === "http" || entry.type === "streamable-http") && entry.url && !entry.command) {
-        result.candidates.push({
-          clientId: this.id,
-          configPath,
-          sourceEntryName: name,
-          serverName: name,
-          spec: {
-            transport: "http",
-            url: entry.url,
-            headers: entry.headers,
-            enabled: entry.enabled !== false
-          }
-        });
-        continue;
-      }
-      if ((entry.type === undefined || entry.type === "local" || entry.type === "stdio") && entry.command && !entry.url) {
-        const commandParts = Array.isArray(entry.command) ? entry.command : [entry.command, ...entry.args ?? []];
-        if (commandParts.length === 0) {
-          result.skipped.push(buildImportSkip(this.id, name, "Entry could not be mapped to an mcpx server.", configPath));
-          continue;
-        }
-        result.candidates.push({
-          clientId: this.id,
-          configPath,
-          sourceEntryName: name,
-          serverName: name,
-          spec: {
-            transport: "stdio",
-            command: commandParts[0],
-            args: commandParts.slice(1),
-            env: entry.environment ?? entry.env,
-            cwd: entry.cwd,
-            enabled: entry.enabled !== false
-          }
-        });
-        continue;
-      }
-      result.skipped.push(buildImportSkip(this.id, name, "Entry must define exactly one transport that mcpx supports.", configPath));
-    }
-    return result;
-  }
-  syncGateway(_config, options) {
-    const configPath = this.detectConfigPath();
-    if (!configPath) {
-      return errorResult(this.id, undefined, "Unable to resolve OpenCode config path.");
-    }
-    try {
-      const raw = readJsonFile(configPath, {});
-      const mcp = {
-        ...raw.mcp ?? {}
-      };
-      removeSourceEntries(mcp, options.sourceEntriesToRemove);
-      const managedNames = options.managedEntries.map((entry) => entry.name);
-      const serverEntries = Object.fromEntries(options.managedEntries.map((entry) => [entry.name, {
-        type: "remote",
-        url: entry.url,
-        headers: entry.headers,
-        enabled: entry.enabled
-      }]));
-      for (const name of managedNames) {
-        const conflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, mcp[name]);
-        if (conflict) {
-          return errorResult(this.id, configPath, conflict);
-        }
-      }
-      pruneStaleManagedEntries(options.managedIndex, this.id, mcp, managedNames);
-      for (const [name, entry] of Object.entries(serverEntries)) {
-        mcp[name] = entry;
-      }
-      const next = {
-        ...raw,
-        mcp
-      };
-      writeJsonAtomic(configPath, next);
-      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(Object.entries(serverEntries).map(([name, entry]) => [name, JSON.stringify(entry)])));
-      return okResult(this.id, configPath);
-    } catch (error) {
-      return errorResult(this.id, configPath, error.message);
-    }
-  }
-}
-
-// src/adapters/vscode.ts
-import path9 from "node:path";
-import { z as z8 } from "zod";
-var stringMapSchema8 = z8.record(z8.string(), z8.string());
-var vscodeEntrySchema = z8.object({
-  type: z8.string().optional(),
-  url: z8.string().min(1).optional(),
-  headers: stringMapSchema8.optional(),
-  command: z8.string().min(1).optional(),
-  args: z8.array(z8.string()).optional(),
-  env: stringMapSchema8.optional(),
-  cwd: z8.string().min(1).optional(),
-  disabled: z8.boolean().optional()
-}).passthrough();
-
-class VsCodeAdapter {
-  id = "vscode";
-  detectConfigPath() {
-    if (process.platform === "linux") {
-      return path9.join(homeDir(), ".config", "Code", "User", "mcp.json");
-    }
-    if (process.platform === "win32") {
-      return path9.join(process.env.APPDATA ?? "", "Code", "User", "mcp.json");
-    }
-    return path9.join(homeDir(), "Library", "Application Support", "Code", "User", "mcp.json");
-  }
-  supportsHttp() {
-    return true;
-  }
-  scanForImports(_config, managedIndex) {
-    const configPath = this.detectConfigPath();
-    const result = emptyImportScan(this.id, configPath ?? undefined);
-    if (!configPath) {
-      return result;
-    }
-    const raw = readJsonFile(configPath, {});
-    const servers = {
-      ...raw.servers ?? {}
-    };
-    for (const [name, rawEntry] of Object.entries(servers)) {
-      if (isManagedGatewayProjection(name) || managedIndex.managed[this.id]?.entries?.[name]) {
-        continue;
-      }
-      const parsed = vscodeEntrySchema.safeParse(rawEntry);
-      if (!parsed.success) {
-        result.skipped.push(buildImportSkip(this.id, name, "Entry could not be mapped to an mcpx server.", configPath));
-        continue;
-      }
-      const entry = parsed.data;
-      if ((entry.type === undefined || entry.type === "http" || entry.type === "streamable-http") && entry.url && !entry.command) {
-        result.candidates.push({
-          clientId: this.id,
-          configPath,
-          sourceEntryName: name,
-          serverName: name,
-          spec: {
-            transport: "http",
-            url: entry.url,
-            headers: entry.headers,
-            enabled: entry.disabled !== true
-          }
-        });
-        continue;
-      }
-      if ((entry.type === undefined || entry.type === "stdio") && entry.command && !entry.url) {
-        result.candidates.push({
-          clientId: this.id,
-          configPath,
-          sourceEntryName: name,
-          serverName: name,
-          spec: {
-            transport: "stdio",
-            command: entry.command,
-            args: entry.args,
-            env: entry.env,
-            cwd: entry.cwd,
-            enabled: entry.disabled !== true
-          }
-        });
-        continue;
-      }
-      result.skipped.push(buildImportSkip(this.id, name, "Entry must define exactly one transport that mcpx supports.", configPath));
-    }
-    return result;
-  }
-  syncGateway(_config, options) {
-    const configPath = this.detectConfigPath();
-    if (!configPath) {
-      return errorResult(this.id, undefined, "Unable to resolve VS Code MCP config path.");
-    }
-    try {
-      const raw = readJsonFile(configPath, {});
-      const servers = {
-        ...raw.servers ?? {}
-      };
-      removeSourceEntries(servers, options.sourceEntriesToRemove);
-      const enabledEntries = options.managedEntries.filter((entry) => entry.enabled);
-      const serverEntries = Object.fromEntries(enabledEntries.map((entry) => [entry.name, {
-        type: "http",
-        url: entry.url,
-        headers: entry.headers
-      }]));
-      const enabledManagedNames = enabledEntries.map((entry) => entry.name);
-      for (const name of enabledManagedNames) {
-        const conflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, servers[name]);
-        if (conflict) {
-          return errorResult(this.id, configPath, conflict);
-        }
-      }
-      pruneStaleManagedEntries(options.managedIndex, this.id, servers, enabledManagedNames);
-      for (const [name, entry] of Object.entries(serverEntries)) {
-        servers[name] = entry;
-      }
-      const next = {
-        ...raw,
-        servers
-      };
-      writeJsonAtomic(configPath, next);
-      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(options.managedEntries.map((entry) => [
-        entry.name,
-        JSON.stringify({ type: "http", url: entry.url, headers: entry.headers, enabled: entry.enabled })
-      ])));
-      return okResult(this.id, configPath);
-    } catch (error) {
-      return errorResult(this.id, configPath, error.message);
-    }
-  }
-}
-
-// src/adapters/qwen.ts
-import fs6 from "node:fs";
-import path10 from "node:path";
-import { z as z9 } from "zod";
-var stringMapSchema9 = z9.record(z9.string(), z9.string());
-var qwenEntrySchema = z9.object({
-  httpUrl: z9.string().min(1).optional(),
-  url: z9.string().min(1).optional(),
-  headers: stringMapSchema9.optional(),
-  command: z9.string().min(1).optional(),
-  args: z9.array(z9.string()).optional(),
-  env: stringMapSchema9.optional(),
-  cwd: z9.string().min(1).optional(),
-  disabled: z9.boolean().optional()
-}).passthrough();
-
-class QwenAdapter {
-  id = "qwen";
-  detectConfigPath() {
-    return path10.join(homeDir(), ".qwen", "settings.json");
-  }
-  supportsHttp() {
-    return true;
-  }
-  scanForImports(_config, managedIndex) {
-    const configPath = this.detectConfigPath();
-    const result = emptyImportScan(this.id, configPath ?? undefined);
-    if (!configPath) {
-      return result;
-    }
-    const raw = readJsonFile(configPath, {});
-    const excludedSet = new Set(raw.mcp?.excluded ?? []);
-    const topLevelServers = raw.mcpServers ?? {};
-    for (const [name, rawEntry] of Object.entries(topLevelServers)) {
-      if (isManagedGatewayProjection(name) || managedIndex.managed[this.id]?.entries?.[name]) {
-        continue;
-      }
-      const parsed = qwenEntrySchema.safeParse(rawEntry);
-      if (!parsed.success) {
-        result.skipped.push(buildImportSkip(this.id, name, "Entry could not be mapped to an mcpx server.", configPath));
-        continue;
-      }
-      const entry = parsed.data;
-      if (entry.httpUrl && !entry.command) {
-        result.candidates.push({
-          clientId: this.id,
-          configPath,
-          sourceEntryName: name,
-          serverName: name,
-          spec: {
-            transport: "http",
-            url: entry.httpUrl,
-            headers: entry.headers,
-            enabled: !(entry.disabled === true || excludedSet.has(name))
-          }
-        });
-        continue;
-      }
-      if (entry.url && !entry.httpUrl && !entry.command) {
-        result.candidates.push({
-          clientId: this.id,
-          configPath,
-          sourceEntryName: name,
-          serverName: name,
-          spec: {
-            transport: "http",
-            url: entry.url,
-            headers: entry.headers,
-            enabled: !(entry.disabled === true || excludedSet.has(name))
-          }
-        });
-        continue;
-      }
-      if (entry.command && !entry.httpUrl) {
-        result.candidates.push({
-          clientId: this.id,
-          configPath,
-          sourceEntryName: name,
-          serverName: name,
-          spec: {
-            transport: "stdio",
-            command: entry.command,
-            args: entry.args,
-            env: entry.env,
-            cwd: entry.cwd,
-            enabled: !(entry.disabled === true || excludedSet.has(name))
-          }
-        });
-        continue;
-      }
-      result.skipped.push(buildImportSkip(this.id, name, "Entry must define exactly one transport that mcpx supports.", configPath));
-    }
-    return result;
-  }
-  syncGateway(_config, options) {
-    const configPath = this.detectConfigPath();
-    if (!configPath) {
-      return errorResult(this.id, undefined, "Unable to resolve Qwen config path.");
-    }
-    try {
-      const raw = readJsonFile(configPath, {});
-      const managedNames = options.managedEntries.map((entry) => entry.name);
-      const serverEntries = Object.fromEntries(options.managedEntries.map((entry) => [entry.name, {
-        httpUrl: entry.url,
-        headers: entry.headers
-      }]));
-      const topLevelServers = raw.mcpServers ?? {};
-      removeSourceEntries(topLevelServers, options.sourceEntriesToRemove);
-      for (const name of managedNames) {
-        const topLevelConflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, topLevelServers[name]);
-        if (topLevelConflict) {
-          return errorResult(this.id, configPath, topLevelConflict);
-        }
-      }
-      pruneStaleManagedEntries(options.managedIndex, this.id, topLevelServers, managedNames);
-      for (const [name, entry] of Object.entries(serverEntries)) {
-        topLevelServers[name] = entry;
-      }
-      raw.mcpServers = topLevelServers;
-      syncMcpExcludedArray(raw, managedNames, options.managedEntries);
-      writeJsonAtomic(configPath, raw);
-      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(options.managedEntries.map((entry) => [
-        entry.name,
-        JSON.stringify({ httpUrl: entry.url, headers: entry.headers, enabled: entry.enabled })
-      ])));
-      return okResult(this.id, configPath);
-    } catch (error) {
-      return errorResult(this.id, configPath, error.message);
-    }
-  }
-  syncSkills(skills) {
-    const skillsDir = path10.join(homeDir(), ".qwen", "skills");
-    if (!fs6.existsSync(skillsDir)) {
-      fs6.mkdirSync(skillsDir, { recursive: true });
-    }
-    const existingFiles = fs6.readdirSync(skillsDir);
-    const managedIds = new Set(skills.map((s) => s.id));
-    for (const file of existingFiles) {
-      if (file.endsWith(".md")) {
-        const id = path10.basename(file, ".md");
-        if (!managedIds.has(id)) {
-          fs6.unlinkSync(path10.join(skillsDir, file));
-        }
-      }
-    }
-    for (const skill of skills) {
-      const targetPath = path10.join(skillsDir, `${skill.id}.md`);
-      fs6.writeFileSync(targetPath, skill.content, "utf-8");
-    }
-  }
-}
-
-// src/adapters/index.ts
-function getAdapters() {
-  return [
-    new ClaudeAdapter,
-    new ClaudeDesktopAdapter,
-    new CodexAdapter,
-    new CursorAdapter,
-    new ClineAdapter,
-    new OpenCodeAdapter,
-    new KiroAdapter,
-    new VsCodeAdapter,
-    new QwenAdapter
-  ];
-}
-
-// src/core/managed-index.ts
-function defaultManagedIndex() {
-  return {
-    schemaVersion: 1,
-    managed: {}
-  };
-}
-function loadManagedIndex(filePath = getManagedIndexPath()) {
-  const raw = readJsonFile(filePath, defaultManagedIndex());
-  if (!raw || typeof raw !== "object") {
-    return defaultManagedIndex();
-  }
-  if (raw.schemaVersion !== 1) {
-    return defaultManagedIndex();
-  }
-  return raw;
-}
-function saveManagedIndex(index, filePath = getManagedIndexPath()) {
-  writeJsonAtomic(filePath, index);
-}
-
-// src/core/sync.ts
-function getGatewayUrl(config) {
-  return `http://127.0.0.1:${config.gateway.port}/mcp`;
-}
-function buildProjectScopes(config) {
-  const globallyEnabled = new Set(Object.entries(config.servers).filter(([, spec]) => isServerEnabled(spec)).map(([name]) => name));
-  return Object.values(config.projects ?? {}).map((project) => {
-    const disabledServerNames = (project.disabledServers ?? []).filter((name) => globallyEnabled.has(name)).map((name) => managedGatewayEntryName(name));
-    return { path: project.path, disabledServerNames };
-  });
-}
-function buildManagedEntries(config, gatewayUrl, localToken) {
-  const entries = Object.entries(config.servers);
-  return entries.map(([name, spec]) => ({
-    name: `${name} (mcpx)`,
-    url: `${gatewayUrl}?upstream=${encodeURIComponent(name)}`,
-    headers: {
-      Authorization: `Bearer ${localToken}`
-    },
-    enabled: isServerEnabled(spec)
-  }));
-}
-function isClientInternalServerCommand(candidate) {
-  return candidate.spec.transport === "stdio" && /\.app\/Contents\//.test(candidate.spec.command ?? "");
-}
-function syncAllClients(config, secrets, targetClients) {
-  const adapters = getAdapters();
-  const managedIndexPath = getManagedIndexPath();
-  const managedIndex = loadManagedIndex(managedIndexPath);
-  const filteredAdapters = targetClients && targetClients.length > 0 ? adapters.filter((adapter) => targetClients.includes(adapter.id)) : adapters;
-  const imports = {
-    imported: [],
-    duplicates: [],
-    skipped: [],
-    conflicts: [],
-    errors: []
-  };
-  const sourceEntriesToRemove = new Map;
-  for (const adapter of filteredAdapters) {
-    try {
-      const scan = adapter.scanForImports(config, managedIndex);
-      imports.skipped.push(...scan.skipped);
-      for (const candidate of scan.candidates) {
-        if (isClientInternalServerCommand(candidate)) {
-          imports.skipped.push({
-            clientId: candidate.clientId,
-            configPath: candidate.configPath,
-            sourceEntryName: candidate.sourceEntryName,
-            serverName: candidate.serverName,
-            reason: "client-internal server"
-          });
-          continue;
-        }
-        const existing = config.servers[candidate.serverName];
-        if (!existing) {
-          config.servers[candidate.serverName] = candidate.spec;
-          imports.imported.push({
-            clientId: candidate.clientId,
-            configPath: candidate.configPath,
-            sourceEntryName: candidate.sourceEntryName,
-            serverName: candidate.serverName
-          });
-          if (!sourceEntriesToRemove.has(candidate.clientId)) {
-            sourceEntriesToRemove.set(candidate.clientId, new Set);
-          }
-          sourceEntriesToRemove.get(candidate.clientId)?.add(candidate.sourceEntryName);
-          continue;
-        }
-        if (serverSpecsEqual(existing, candidate.spec)) {
-          imports.duplicates.push({
-            clientId: candidate.clientId,
-            configPath: candidate.configPath,
-            sourceEntryName: candidate.sourceEntryName,
-            serverName: candidate.serverName
-          });
-          if (!sourceEntriesToRemove.has(candidate.clientId)) {
-            sourceEntriesToRemove.set(candidate.clientId, new Set);
-          }
-          sourceEntriesToRemove.get(candidate.clientId)?.add(candidate.sourceEntryName);
-          continue;
-        }
-        imports.conflicts.push({
-          clientId: candidate.clientId,
-          configPath: candidate.configPath,
-          sourceEntryName: candidate.sourceEntryName,
-          serverName: candidate.serverName,
-          message: `Server "${candidate.serverName}" already exists in mcpx with a different configuration.`
-        });
-      }
-    } catch (error) {
-      imports.errors.push({
-        clientId: adapter.id,
-        configPath: adapter.detectConfigPath() ?? undefined,
-        message: error instanceof Error ? error.message : String(error)
-      });
-    }
-  }
-  const localToken = ensureGatewayToken(config, secrets);
-  const gatewayUrl = getGatewayUrl(config);
-  const managedEntries = buildManagedEntries(config, gatewayUrl, localToken);
-  const skills = listSkills();
-  const results = [];
-  for (const adapter of filteredAdapters) {
-    if (adapter.syncSkills) {
-      try {
-        adapter.syncSkills(skills);
-      } catch (error) {}
-    }
-    if (!adapter.supportsHttp()) {
-      results.push({
-        clientId: adapter.id,
-        status: "UNSUPPORTED_HTTP",
-        message: "Client adapter does not support MCP over HTTP."
-      });
-      continue;
-    }
-    const result = adapter.syncGateway(config, {
-      managedEntries,
-      managedIndex,
-      managedIndexPath,
-      sourceEntriesToRemove: Array.from(sourceEntriesToRemove.get(adapter.id) ?? []),
-      projectScopes: buildProjectScopes(config)
-    });
-    results.push(result);
-  }
-  for (const result of results) {
-    config.clients[result.clientId] = {
-      status: result.status,
-      configPath: result.configPath,
-      message: result.message,
-      lastSyncAt: new Date().toISOString()
-    };
-  }
-  saveManagedIndex(managedIndex, managedIndexPath);
-  saveConfig(config);
-  const hasErrors = results.some((result) => result.status === "ERROR") || imports.conflicts.length > 0 || imports.errors.length > 0;
-  return {
-    gatewayUrl,
-    imports,
-    results,
-    hasErrors
-  };
-}
-
 // src/core/server-auth.ts
 function normalizeNamePart(value) {
   return value.trim().toLowerCase().replace(/[^a-z0-9._-]+/g, "_").replace(/^_+|_+$/g, "") || "value";
@@ -1939,6 +347,7 @@ function listAuthBindings(spec) {
     value
   }));
 }
+var TOKEN68 = /^[A-Za-z0-9\-._~+/]+=*$/;
 function maybePrefixBearer(target, value, raw = false) {
   if (raw || target.kind !== "header" || target.key.toLowerCase() !== "authorization") {
     return value;
@@ -1946,25 +355,28 @@ function maybePrefixBearer(target, value, raw = false) {
   if (/^\S+\s+\S+/.test(value)) {
     return value;
   }
-  return `Bearer ${value}`;
+  if (TOKEN68.test(value)) {
+    return `Bearer ${value}`;
+  }
+  return value;
 }
 
 // src/core/spawn-env.ts
 import os from "node:os";
-import path11 from "node:path";
-import fs7 from "node:fs";
+import path from "node:path";
+import fs from "node:fs";
 function existingNvmCurrentBin() {
-  const nvmDir = process.env.NVM_DIR ?? path11.join(os.homedir(), ".nvm");
-  const current = path11.join(nvmDir, "current", "bin");
-  return fs7.existsSync(current) ? current : null;
+  const nvmDir = process.env.NVM_DIR ?? path.join(os.homedir(), ".nvm");
+  const current = path.join(nvmDir, "current", "bin");
+  return fs.existsSync(current) ? current : null;
 }
 function buildEnrichedPath(current = process.env.PATH ?? "") {
   const candidates = [
     ...current.split(":"),
     "/opt/homebrew/bin",
     "/usr/local/bin",
-    path11.join(os.homedir(), ".bun", "bin"),
-    path11.join(os.homedir(), ".local", "bin"),
+    path.join(os.homedir(), ".bun", "bin"),
+    path.join(os.homedir(), ".local", "bin"),
     existingNvmCurrentBin()
   ].filter((entry) => Boolean(entry));
   const seen = new Set;
@@ -2200,7 +612,12 @@ function bindOAuthReference(config, serverName) {
   };
 }
 async function runOAuthLogin(serverName, spec, secrets, openUrl, configPath, codeReceiver) {
-  new McpxOAuthProvider(serverName, secrets).invalidateCredentials("all");
+  const oauthName = oauthSecretName(serverName, "tokens");
+  const clientName = oauthSecretName(serverName, "client");
+  const backupTokens = secrets.getSecret(oauthName);
+  const backupClient = secrets.getSecret(clientName);
+  new McpxOAuthProvider(serverName, secrets).invalidateCredentials("verifier");
+  new McpxOAuthProvider(serverName, secrets).invalidateCredentials("discovery");
   const state = crypto.randomUUID();
   let callbackServer;
   let redirectUrl;
@@ -2233,8 +650,16 @@ async function runOAuthLogin(serverName, spec, secrets, openUrl, configPath, cod
     const config = loadConfig(configPath);
     bindOAuthReference(config, serverName);
     saveConfig(config, configPath);
-    syncAllClients(config, secrets);
+    const summary = syncAllClients(config, secrets);
+    persistSyncState(summary, config);
+    saveConfig(config, configPath);
     return { serverName, authorized: true };
+  } catch (error) {
+    if (backupTokens)
+      secrets.setSecret(oauthName, backupTokens);
+    if (backupClient)
+      secrets.setSecret(clientName, backupClient);
+    throw error;
   } finally {
     if (callbackServer) {
       await closeServer(callbackServer);
@@ -2244,41 +669,61 @@ async function runOAuthLogin(serverName, spec, secrets, openUrl, configPath, cod
 async function getOAuthAccessToken(serverName, spec, secrets, options = {}) {
   const stored = readJsonSecret(secrets, oauthSecretName(serverName, "tokens"));
   if (!stored) {
-    throw new Error(`No OAuth tokens stored for "${serverName}". Run mcpx auth login ${serverName}.`);
-  }
-  if (!options.forceRefresh && !tokensAreExpiring(stored)) {
-    return stored.tokens.access_token;
+    throw new UpstreamError(serverName, "auth_required", `No OAuth tokens stored for "${serverName}".`);
   }
-  if (!stored.tokens.refresh_token) {
-    if (!options.forceRefresh) {
-      return stored.tokens.access_token;
+  if (options.forceRefresh || tokensAreExpiring(stored)) {
+    if (!stored.tokens.refresh_token) {
+      if (!options.forceRefresh) {
+        return stored.tokens.access_token;
+      }
+      throw new UpstreamError(serverName, "auth_expired", `No refresh token for "${serverName}". Re-authentication required.`);
+    }
+    const provider = new McpxOAuthProvider(serverName, secrets);
+    const clientInformation = provider.clientInformation();
+    if (!clientInformation) {
+      throw new UpstreamError(serverName, "auth_expired", `No OAuth client info for "${serverName}". Re-authentication required.`);
+    }
+    let serverInfo;
+    try {
+      const cachedDiscovery = provider.discoveryState();
+      serverInfo = cachedDiscovery ?? await discoverOAuthServerInfo(spec.url);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (/ECONNREFUSED|ENOTFOUND|EAI_AGAIN|fetch failed/i.test(message)) {
+        throw new UpstreamError(serverName, "unreachable", `OAuth discovery failed: ${message}`);
+      }
+      throw new UpstreamError(serverName, "upstream_error", `OAuth discovery failed: ${message}`);
+    }
+    try {
+      const refreshed = await refreshAuthorization(serverInfo.authorizationServerUrl, {
+        metadata: serverInfo.authorizationServerMetadata,
+        clientInformation,
+        refreshToken: stored.tokens.refresh_token,
+        resource: serverInfo.resourceMetadata?.resource ? new URL(serverInfo.resourceMetadata.resource) : undefined
+      });
+      provider.saveTokens(refreshed);
+      return refreshed.access_token;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (/invalid_grant|invalid_client|4\d{2}/i.test(message)) {
+        throw new UpstreamError(serverName, "auth_expired", `OAuth refresh failed: ${message}`);
+      }
+      if (/ECONNREFUSED|ENOTFOUND|EAI_AGAIN|fetch failed/i.test(message)) {
+        throw new UpstreamError(serverName, "unreachable", `OAuth refresh failed: ${message}`);
+      }
+      throw new UpstreamError(serverName, "upstream_error", `OAuth refresh failed: ${message}`);
     }
-    throw new Error(`No OAuth refresh token stored for "${serverName}". Re-authentication required.`);
-  }
-  const provider = new McpxOAuthProvider(serverName, secrets);
-  const clientInformation = provider.clientInformation();
-  if (!clientInformation) {
-    throw new Error(`No OAuth client information stored for "${serverName}". Re-authentication required.`);
   }
-  const cachedDiscovery = provider.discoveryState();
-  const serverInfo = cachedDiscovery ?? await discoverOAuthServerInfo(spec.url);
-  const refreshed = await refreshAuthorization(serverInfo.authorizationServerUrl, {
-    metadata: serverInfo.authorizationServerMetadata,
-    clientInformation,
-    refreshToken: stored.tokens.refresh_token,
-    resource: serverInfo.resourceMetadata?.resource ? new URL(serverInfo.resourceMetadata.resource) : undefined
-  });
-  provider.saveTokens(refreshed);
-  return refreshed.access_token;
+  return stored.tokens.access_token;
 }
 
 // src/version.ts
 var APP_VERSION = "0.1.3";
 
 // src/core/update.ts
-import fs8 from "node:fs";
-import path12 from "node:path";
-import { execFileSync as execFileSync2 } from "node:child_process";
+import fs2 from "node:fs";
+import path2 from "node:path";
+import { execFileSync } from "node:child_process";
 function compareVersions(a, b) {
   const partsA = a.split(".").map(Number);
   const partsB = b.split(".").map(Number);
@@ -2294,7 +739,7 @@ function compareVersions(a, b) {
 }
 async function checkForUpdates() {
   try {
-    const output = execFileSync2("npm", ["view", "@kwonye/mcpx", "version"], {
+    const output = execFileSync("npm", ["view", "@kwonye/mcpx", "version"], {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"]
     }).trim();
@@ -2316,17 +761,17 @@ async function checkForUpdates() {
 }
 function getStagedUpdate() {
   const stagedPath = getStagedVersionPath();
-  if (!fs8.existsSync(stagedPath)) {
+  if (!fs2.existsSync(stagedPath)) {
     return null;
   }
   try {
-    const raw = fs8.readFileSync(stagedPath, "utf8");
+    const raw = fs2.readFileSync(stagedPath, "utf8");
     const info = JSON.parse(raw);
     if (!info.version || !info.cliPath) {
       return null;
     }
-    const absoluteCliPath = path12.isAbsolute(info.cliPath) ? info.cliPath : path12.join(getUpdatesDir(), info.cliPath);
-    if (!fs8.existsSync(absoluteCliPath)) {
+    const absoluteCliPath = path2.isAbsolute(info.cliPath) ? info.cliPath : path2.join(getUpdatesDir(), info.cliPath);
+    if (!fs2.existsSync(absoluteCliPath)) {
       return null;
     }
     return {
@@ -2342,18 +787,18 @@ function stageUpdate(version, cliPath) {
   ensureDir(updatesDir);
   const stagedInfo = {
     version,
-    cliPath: path12.isAbsolute(cliPath) ? path12.relative(updatesDir, cliPath) : cliPath,
+    cliPath: path2.isAbsolute(cliPath) ? path2.relative(updatesDir, cliPath) : cliPath,
     stagedAt: new Date().toISOString()
   };
-  fs8.writeFileSync(getStagedVersionPath(), JSON.stringify(stagedInfo, null, 2), "utf8");
+  fs2.writeFileSync(getStagedVersionPath(), JSON.stringify(stagedInfo, null, 2), "utf8");
 }
 function shouldUseStagedCli(stagedVersion, currentVersion) {
   return compareVersions(stagedVersion, currentVersion) > 0;
 }
 function clearStagedUpdate() {
   const stagedPath = getStagedVersionPath();
-  if (fs8.existsSync(stagedPath)) {
-    fs8.unlinkSync(stagedPath);
+  if (fs2.existsSync(stagedPath)) {
+    fs2.unlinkSync(stagedPath);
   }
 }
 function getStagedCliPath() {
@@ -2362,31 +807,31 @@ function getStagedCliPath() {
 }
 function removeOldVersions(keepCount = 2) {
   const updatesDir = getUpdatesDir();
-  if (!fs8.existsSync(updatesDir)) {
+  if (!fs2.existsSync(updatesDir)) {
     return;
   }
-  const entries = fs8.readdirSync(updatesDir, { withFileTypes: true });
+  const entries = fs2.readdirSync(updatesDir, { withFileTypes: true });
   const versionDirs = entries.filter((entry) => entry.isDirectory() && entry.name.startsWith("v")).map((entry) => entry.name).sort((a, b) => compareVersions(b.slice(1), a.slice(1)));
   if (versionDirs.length <= keepCount) {
     return;
   }
   for (const oldVersion of versionDirs.slice(keepCount)) {
-    const oldPath = path12.join(updatesDir, oldVersion);
+    const oldPath = path2.join(updatesDir, oldVersion);
     try {
-      fs8.rmSync(oldPath, { recursive: true, force: true });
+      fs2.rmSync(oldPath, { recursive: true, force: true });
     } catch {}
   }
 }
 
 // src/core/update-manager.ts
-import fs9 from "node:fs";
-import path13 from "node:path";
+import fs3 from "node:fs";
+import path3 from "node:path";
 import { execSync, spawn } from "node:child_process";
 function acquireLock() {
   const lockPath = getUpdateLockPath();
   try {
-    ensureDir(path13.dirname(lockPath));
-    fs9.writeFileSync(lockPath, `${process.pid}
+    ensureDir(path3.dirname(lockPath));
+    fs3.writeFileSync(lockPath, `${process.pid}
 `, { flag: "wx" });
     return true;
   } catch {
@@ -2396,25 +841,25 @@ function acquireLock() {
 function releaseLock() {
   const lockPath = getUpdateLockPath();
   try {
-    fs9.unlinkSync(lockPath);
+    fs3.unlinkSync(lockPath);
   } catch {}
 }
 function isUpdateInProgress() {
   const lockPath = getUpdateLockPath();
-  if (!fs9.existsSync(lockPath)) {
+  if (!fs3.existsSync(lockPath)) {
     return false;
   }
   try {
-    const raw = fs9.readFileSync(lockPath, "utf8").trim();
+    const raw = fs3.readFileSync(lockPath, "utf8").trim();
     const pid = Number(raw);
     if (!Number.isFinite(pid) || pid <= 0) {
-      fs9.unlinkSync(lockPath);
+      fs3.unlinkSync(lockPath);
       return false;
     }
     process.kill(pid, 0);
     return true;
   } catch {
-    fs9.unlinkSync(lockPath);
+    fs3.unlinkSync(lockPath);
     return false;
   }
 }
@@ -2425,8 +870,8 @@ async function downloadAndStageUpdate() {
   }
   const targetVersion = updateStatus.latestVersion;
   const updatesDir = getUpdatesDir();
-  const versionDir = path13.join(updatesDir, `v${targetVersion}`);
-  if (fs9.existsSync(versionDir)) {
+  const versionDir = path3.join(updatesDir, `v${targetVersion}`);
+  if (fs3.existsSync(versionDir)) {
     const existingStaged = getStagedUpdate();
     if (existingStaged?.version === targetVersion) {
       return { success: false, error: `Version ${targetVersion} already staged` };
@@ -2438,8 +883,8 @@ async function downloadAndStageUpdate() {
       cwd: versionDir,
       stdio: ["pipe", "pipe", "pipe"]
     });
-    const tarballPath = path13.join(versionDir, `kwonye-mcpx-${targetVersion}.tgz`);
-    if (!fs9.existsSync(tarballPath)) {
+    const tarballPath = path3.join(versionDir, `kwonye-mcpx-${targetVersion}.tgz`);
+    if (!fs3.existsSync(tarballPath)) {
       throw new Error("Downloaded tarball not found");
     }
     execSync(`tar -xzf ${tarballPath} --strip-components=1`, {
@@ -2450,8 +895,8 @@ async function downloadAndStageUpdate() {
       cwd: versionDir,
       stdio: ["pipe", "pipe", "pipe"]
     });
-    const cliPath = path13.join(versionDir, "dist", "cli.js");
-    if (!fs9.existsSync(cliPath)) {
+    const cliPath = path3.join(versionDir, "dist", "cli.js");
+    if (!fs3.existsSync(cliPath)) {
       throw new Error("CLI entry point not found in downloaded package");
     }
     stageUpdate(targetVersion, cliPath);
@@ -2459,7 +904,7 @@ async function downloadAndStageUpdate() {
     return { success: true, version: targetVersion };
   } catch (error) {
     try {
-      fs9.rmSync(versionDir, { recursive: true, force: true });
+      fs3.rmSync(versionDir, { recursive: true, force: true });
     } catch {}
     return {
       success: false,
@@ -2537,9 +982,9 @@ function performRollback() {
 }
 
 // src/core/daemon.ts
-import fs10 from "node:fs";
+import fs4 from "node:fs";
 import net from "node:net";
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn2, execFileSync as execFileSync2 } from "node:child_process";
 
 // src/gateway/server.ts
 import http2 from "node:http";
@@ -2559,19 +1004,6 @@ var OAUTH_WELL_KNOWN_PREFIXES = [
   "/.well-known/oauth-authorization-server",
   "/.well-known/openid-configuration"
 ];
-
-class UpstreamHttpError extends Error {
-  status;
-  wwwAuthenticate;
-  bodyText;
-  constructor(upstreamName, status, bodyText, wwwAuthenticate) {
-    super(`Upstream ${upstreamName} returned HTTP ${status}: ${bodyText.slice(0, 400)}`);
-    this.name = "UpstreamHttpError";
-    this.status = status;
-    this.bodyText = bodyText;
-    this.wwwAuthenticate = wwwAuthenticate;
-  }
-}
 function makeError(id, code, message, data) {
   return {
     jsonrpc: "2.0",
@@ -2730,8 +1162,8 @@ async function getUpstreamTokenCounts(config, secrets, runtime) {
     const fingerprint = specFingerprint(upstream.spec);
     const cached = runtime.tokenCache.get(upstream.name);
     if (cached?.fingerprint === fingerprint) {
-      const runtimeError2 = runtime.upstreamErrors?.get(upstream.name);
-      results[upstream.name] = runtimeError2 ? { ...cached.count, runtimeError: runtimeError2 } : cached.count;
+      const runtimeErr2 = runtime.upstreamErrors?.get(upstream.name);
+      results[upstream.name] = runtimeErr2 ? { ...cached.count, runtimeError: runtimeErr2.message, runtimeErrorCode: runtimeErr2.code } : cached.count;
       continue;
     }
     let toolsCount = 0;
@@ -2773,8 +1205,8 @@ async function getUpstreamTokenCounts(config, secrets, runtime) {
     if (errors.length === 0) {
       runtime.tokenCache.set(upstream.name, { fingerprint, count: countObj });
     }
-    const runtimeError = runtime.upstreamErrors?.get(upstream.name);
-    results[upstream.name] = runtimeError ? { ...countObj, runtimeError } : countObj;
+    const runtimeErr = runtime.upstreamErrors?.get(upstream.name);
+    results[upstream.name] = runtimeErr ? { ...countObj, runtimeError: runtimeErr.message, runtimeErrorCode: runtimeErr.code } : countObj;
   }
   return results;
 }
@@ -2943,11 +1375,8 @@ async function callUpstreamOnce(upstream, method, params, secrets, runtime, pass
     if (!forceOAuthRefresh && hasOAuth && error instanceof StreamableHTTPError && (error.code === 401 || error.code === 403)) {
       return callUpstreamOnce(upstream, method, params, secrets, runtime, passthroughAuthorizationHeader, true);
     }
-    if (upstream.spec.transport === "http" && error instanceof StreamableHTTPError && error.code) {
-      const wwwAuthenticate = runtime.lastWwwAuthenticate?.get(upstream.name);
-      throw new UpstreamHttpError(upstream.name, error.code, error.message ?? "", wwwAuthenticate);
-    }
-    throw error;
+    const wwwAuthenticate = runtime.lastWwwAuthenticate?.get(upstream.name);
+    throw classifyUpstreamError(upstream.name, error, wwwAuthenticate);
   }
 }
 function authHeaderIsValid(request, expectedToken) {
@@ -2966,7 +1395,7 @@ function authHeaderIsValid(request, expectedToken) {
   return scheme === "Bearer" && token === expectedToken;
 }
 function isAuthChallenge(error) {
-  return error instanceof UpstreamHttpError && (error.status === 401 || error.status === 403);
+  return error instanceof UpstreamError && (error.code === "auth_required" || error.code === "auth_expired");
 }
 function getClientAuthorizationForUpstream(request, expectedToken) {
   const authHeader = request.headers.authorization;
@@ -3007,7 +1436,8 @@ async function handleListTools(config, secrets, runtime, upstreamFilter, clientA
       if (upstreams.length === 1) {
         throw error;
       }
-      runtime.upstreamErrors?.set(upstream.name, error instanceof Error ? error.message : String(error));
+      const code = error instanceof UpstreamError ? error.code : "upstream_error";
+      runtime.upstreamErrors?.set(upstream.name, { code, message: error instanceof Error ? error.message : String(error) });
     }
   }
   return { tools };
@@ -3042,7 +1472,8 @@ async function handleListResources(config, secrets, runtime, upstreamFilter, cli
       if (upstreams.length === 1) {
         throw error;
       }
-      runtime.upstreamErrors?.set(upstream.name, error instanceof Error ? error.message : String(error));
+      const code = error instanceof UpstreamError ? error.code : "upstream_error";
+      runtime.upstreamErrors?.set(upstream.name, { code, message: error instanceof Error ? error.message : String(error) });
     }
   }
   return { resources };
@@ -3075,7 +1506,8 @@ async function handleListPrompts(config, secrets, runtime, upstreamFilter, clien
       if (upstreams.length === 1) {
         throw error;
       }
-      runtime.upstreamErrors?.set(upstream.name, error instanceof Error ? error.message : String(error));
+      const code = error instanceof UpstreamError ? error.code : "upstream_error";
+      runtime.upstreamErrors?.set(upstream.name, { code, message: error instanceof Error ? error.message : String(error) });
     }
   }
   return { prompts };
@@ -3116,8 +1548,9 @@ async function routeNamespacedCall(config, method, params, id, secrets, runtime,
       if (isAuthChallenge(error)) {
         throw error;
       }
-      runtime.upstreamErrors?.set(upstream2.name, error.message);
-      return makeError(id, -32000, error.message);
+      const errCode = error instanceof UpstreamError ? error.code : "upstream_error";
+      runtime.upstreamErrors?.set(upstream2.name, { code: errCode, message: error.message });
+      return makeError(id, -32000, error.message, { mcpxCode: errCode, upstream: upstream2.name });
     }
   }
   if (method === "prompts/get") {
@@ -3149,8 +1582,9 @@ async function routeNamespacedCall(config, method, params, id, secrets, runtime,
       if (isAuthChallenge(error)) {
         throw error;
       }
-      runtime.upstreamErrors?.set(upstream2.name, error.message);
-      return makeError(id, -32000, error.message);
+      const errCode = error instanceof UpstreamError ? error.code : "upstream_error";
+      runtime.upstreamErrors?.set(upstream2.name, { code: errCode, message: error.message });
+      return makeError(id, -32000, error.message, { mcpxCode: errCode, upstream: upstream2.name });
     }
   }
   const uri = typeof params.uri === "string" ? params.uri : "";
@@ -3181,8 +1615,9 @@ async function routeNamespacedCall(config, method, params, id, secrets, runtime,
     if (isAuthChallenge(error)) {
       throw error;
     }
-    runtime.upstreamErrors?.set(upstream.name, error.message);
-    return makeError(id, -32000, error.message);
+    const errCode = error instanceof UpstreamError ? error.code : "upstream_error";
+    runtime.upstreamErrors?.set(upstream.name, { code: errCode, message: error.message });
+    return makeError(id, -32000, error.message, { mcpxCode: errCode, upstream: upstream.name });
   }
 }
 async function handleRequestObject(request, secrets, runtime, upstreamFilter, clientAuthorizationHeader) {
@@ -3453,16 +1888,16 @@ function createGatewayServer(options) {
       }
     } catch (error) {
       if (isAuthChallenge(error)) {
-        response.statusCode = error.status;
+        response.statusCode = error.status ?? 401;
         response.setHeader("content-type", "application/json");
         if (error.wwwAuthenticate) {
           const localResourceMetadataUrl = appendUpstreamQuery(`${getLocalOriginFromRequest(request)}/.well-known/oauth-protected-resource`, getRequestedUpstream(requestUrl));
           response.setHeader("www-authenticate", rewriteWwwAuthenticateResourceMetadata(error.wwwAuthenticate, localResourceMetadataUrl));
         }
         response.end(JSON.stringify(makeError(null, -32001, "Upstream authentication required.", {
+          mcpxCode: error.code,
           status: error.status,
-          body: error.bodyText,
-          wwwAuthenticate: error.wwwAuthenticate
+          upstream: error.upstream
         })));
         if (debug) {
           console.error(`[mcpx gateway] -> ${error.status} upstream auth challenge`);
@@ -3489,10 +1924,10 @@ function createGatewayServer(options) {
 
 // src/core/daemon.ts
 function readPidFromFile(pidPath = getPidPath()) {
-  if (!fs10.existsSync(pidPath)) {
+  if (!fs4.existsSync(pidPath)) {
     return null;
   }
-  const raw = fs10.readFileSync(pidPath, "utf8").trim();
+  const raw = fs4.readFileSync(pidPath, "utf8").trim();
   if (!raw) {
     return null;
   }
@@ -3522,7 +1957,7 @@ async function isPortAvailable(port) {
     tester.listen(port, "127.0.0.1");
   });
 }
-async function resolveGatewayPort(config) {
+async function resolveGatewayPort(config, secrets) {
   if (await isPortAvailable(config.gateway.port)) {
     return config.gateway.port;
   }
@@ -3532,8 +1967,16 @@ async function resolveGatewayPort(config) {
       break;
     }
     if (await isPortAvailable(candidate)) {
+      const oldPort = config.gateway.port;
       config.gateway.port = candidate;
       saveConfig(config);
+      if (secrets) {
+        try {
+          const summary = syncAllClients(config, secrets);
+          persistSyncState(summary, config);
+          saveConfig(config);
+        } catch {}
+      }
       return candidate;
     }
   }
@@ -3594,16 +2037,16 @@ async function startDaemon(config, cliPath, secrets) {
       };
     }
     try {
-      fs10.unlinkSync(getPidPath());
+      fs4.unlinkSync(getPidPath());
     } catch {}
   }
-  const port = await resolveGatewayPort(config);
+  const port = await resolveGatewayPort(config, secrets);
   const token = ensureGatewayToken(config, secrets);
   const pidPath = getPidPath();
   const logPath = getLogPath();
   ensureParentDir(pidPath);
   ensureParentDir(logPath);
-  const logFd = fs10.openSync(logPath, "a", 384);
+  const logFd = fs4.openSync(logPath, "a", 384);
   const child = spawn2(process.execPath, [cliPath, "daemon", "run", "--port", String(port)], {
     detached: true,
     stdio: ["ignore", logFd, logFd],
@@ -3613,7 +2056,7 @@ async function startDaemon(config, cliPath, secrets) {
     }
   });
   child.unref();
-  fs10.writeFileSync(pidPath, `${child.pid}
+  fs4.writeFileSync(pidPath, `${child.pid}
 `, { mode: 384 });
   startBackgroundUpdateCheck();
   await waitForGatewayReady(port, token);
@@ -3633,11 +2076,29 @@ function stopDaemon() {
       message: "mcpx daemon is not running."
     };
   }
+  try {
+    const cmd = execFileSync2("ps", ["-p", String(pid), "-o", "command="], { encoding: "utf8", timeout: 2000 }).trim();
+    if (!cmd.includes("mcpx") && !cmd.includes("daemon") && !cmd.includes("cli.js")) {
+      fs4.unlinkSync(pidPath);
+      return {
+        stopped: false,
+        message: `PID ${pid} is not a mcpx daemon (command: ${cmd.slice(0, 80)}). Pidfile cleaned up.`
+      };
+    }
+  } catch {
+    try {
+      fs4.unlinkSync(pidPath);
+    } catch {}
+    return {
+      stopped: false,
+      message: `PID ${pid} not found. Pidfile cleaned up.`
+    };
+  }
   try {
     process.kill(pid, "SIGTERM");
   } catch {}
   try {
-    fs10.unlinkSync(pidPath);
+    fs4.unlinkSync(pidPath);
   } catch {}
   return {
     stopped: true,
@@ -3650,10 +2111,10 @@ async function restartDaemon(config, cliPath, secrets) {
 }
 function readDaemonLogs(maxLines = 200) {
   const logPath = getLogPath();
-  if (!fs10.existsSync(logPath)) {
+  if (!fs4.existsSync(logPath)) {
     return "";
   }
-  const lines = fs10.readFileSync(logPath, "utf8").split(`
+  const lines = fs4.readFileSync(logPath, "utf8").split(`
 `);
   return lines.slice(Math.max(lines.length - maxLines, 0)).join(`
 `);
@@ -3760,6 +2221,7 @@ async function buildStatusReport(config, managedIndex, daemon = getDaemonStatus(
     if (tokenCount?.error && buildAuthBindings(spec).length > 0 && tokenCount.total > 0) {
       tokenCount = { ...tokenCount, error: undefined };
     }
+    const health = tokenCount ? tokenCount.error || tokenCount.runtimeError ? "error" : "ok" : "unknown";
     const serverEntry = {
       name,
       enabled: isServerEnabled(spec),
@@ -3767,7 +2229,8 @@ async function buildStatusReport(config, managedIndex, daemon = getDaemonStatus(
       target: describeServerTarget(spec),
       authBindings: buildAuthBindings(spec),
       clients: buildClientMappings(config, managedIndex, name),
-      tokenCount
+      tokenCount,
+      health
     };
     if (serverEntry.enabled && tokenCount) {
       totalGlobalTokens += tokenCount.total;
@@ -3791,4 +2254,4 @@ async function buildStatusReport(config, managedIndex, daemon = getDaemonStatus(
   };
 }
 
-export { listSkills, getSkill, saveSkill, deleteSkill, probeHttpAuthRequirement, fetchRegistryServerDetail, selectBestPackage, extractRequiredInputs, mapRegistryToSpec, getAdapters, loadManagedIndex, getGatewayUrl, syncAllClients, toSecretRef, secretRefName, defaultAuthSecretName, resolveAuthTarget, applyAuthReference, removeAuthReference, listAuthBindings, maybePrefixBearer, buildEnrichedPath, isOAuthReference, oauthReferenceServerName, runOAuthLogin, getOAuthAccessToken, APP_VERSION, compareVersions, checkForUpdates, getStagedUpdate, shouldUseStagedCli, clearStagedUpdate, getStagedCliPath, startBackgroundUpdateCheck, runBackgroundUpdate, performUpdate, performRollback, getDaemonStatus, startDaemon, stopDaemon, restartDaemon, readDaemonLogs, runDaemonForeground, STATUS_CLIENTS, buildStatusReport };
+export { probeHttpAuthRequirement, fetchRegistryServerDetail, selectBestPackage, extractRequiredInputs, mapRegistryToSpec, toSecretRef, secretRefName, defaultAuthSecretName, resolveAuthTarget, applyAuthReference, removeAuthReference, listAuthBindings, maybePrefixBearer, buildEnrichedPath, isOAuthReference, oauthReferenceServerName, runOAuthLogin, getOAuthAccessToken, APP_VERSION, compareVersions, checkForUpdates, getStagedUpdate, shouldUseStagedCli, clearStagedUpdate, getStagedCliPath, startBackgroundUpdateCheck, runBackgroundUpdate, performUpdate, performRollback, getDaemonStatus, startDaemon, stopDaemon, restartDaemon, readDaemonLogs, runDaemonForeground, STATUS_CLIENTS, buildStatusReport };