@kwonye/mcpx 0.1.93 → 0.1.94

package/dist/adapters/cline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cline.d.ts","sourceRoot":"","sources":["../../src/adapters/cline.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA2D1G,qBAAa,YAAa,YAAW,aAAa;IAChD,QAAQ,CAAC,EAAE,EAAG,OAAO,CAAU;IAE/B,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAWjC,YAAY,IAAI,OAAO;IAIvB,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY;IAmE9D,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,GAAG,UAAU;CAgEzE"}
+{"version":3,"file":"cline.d.ts","sourceRoot":"","sources":["../../src/adapters/cline.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA2D1G,qBAAa,YAAa,YAAW,aAAa;IAChD,QAAQ,CAAC,EAAE,EAAG,OAAO,CAAU;IAE/B,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAWjC,YAAY,IAAI,OAAO;IAIvB,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY;IAmE9D,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,GAAG,UAAU;CA2DzE"}

package/dist/adapters/codex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../src/adapters/codex.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,UAAU,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAoC7I,qBAAa,YAAa,YAAW,aAAa;IAChD,QAAQ,CAAC,EAAE,EAAG,OAAO,CAAU;IAE/B,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAIjC,YAAY,IAAI,OAAO;IAIvB,WAAW,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,gBAAgB;IAIzD,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY;IA+D9D,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,GAAG,UAAU;CAwDzE"}
+{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../src/adapters/codex.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,UAAU,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAoC7I,qBAAa,YAAa,YAAW,aAAa;IAChD,QAAQ,CAAC,EAAE,EAAG,OAAO,CAAU;IAE/B,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAIjC,YAAY,IAAI,OAAO;IAIvB,WAAW,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,gBAAgB;IAIzD,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY;IA+D9D,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,GAAG,UAAU;CAyDzE"}

package/dist/adapters/kiro.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kiro.d.ts","sourceRoot":"","sources":["../../src/adapters/kiro.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAqCpJ,qBAAa,WAAY,YAAW,aAAa;IAC/C,QAAQ,CAAC,EAAE,EAAG,MAAM,CAAU;IAE9B,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAIjC,YAAY,IAAI,OAAO;IAIvB,WAAW,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,gBAAgB;IAIzD,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY;IAgE9D,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,GAAG,UAAU;IAwDxE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI;CAyBlC"}
+{"version":3,"file":"kiro.d.ts","sourceRoot":"","sources":["../../src/adapters/kiro.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAqCpJ,qBAAa,WAAY,YAAW,aAAa;IAC/C,QAAQ,CAAC,EAAE,EAAG,MAAM,CAAU;IAE9B,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAIjC,YAAY,IAAI,OAAO;IAIvB,WAAW,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,gBAAgB;IAIzD,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY;IAgE9D,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,GAAG,UAAU;IAyDxE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI;CAyBlC"}

package/dist/adapters/opencode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opencode.d.ts","sourceRoot":"","sources":["../../src/adapters/opencode.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA+B1G,qBAAa,eAAgB,YAAW,aAAa;IACnD,QAAQ,CAAC,EAAE,EAAG,UAAU,CAAU;IAElC,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAIjC,YAAY,IAAI,OAAO;IAIvB,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY;IAuE9D,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,GAAG,UAAU;CAwDzE"}
+{"version":3,"file":"opencode.d.ts","sourceRoot":"","sources":["../../src/adapters/opencode.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA+B1G,qBAAa,eAAgB,YAAW,aAAa;IACnD,QAAQ,CAAC,EAAE,EAAG,UAAU,CAAU;IAElC,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAIjC,YAAY,IAAI,OAAO;IAIvB,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY;IAuE9D,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,GAAG,UAAU;CAyDzE"}

package/dist/adapters/utils/index.d.ts

@@ -1,4 +1,4 @@
-import type { ClientId, ClientImportScanResult, ClientImportSkippedEntry, ManagedGatewayEntry, ManagedIndex, SyncResult, UpstreamServerSpec } from "../../types.js";
+import type { ClientId, ClientImportScanResult, ClientImportSkippedEntry, ManagedIndex, SyncResult, UpstreamServerSpec } from "../../types.js";
 export declare function getManagedEntryNames(managedIndex: ManagedIndex, clientId: ClientId): string[];
 export declare function isManagedEntry(managedIndex: ManagedIndex, clientId: ClientId, entryName: string): boolean;
 export declare function pruneStaleManagedEntries(managedIndex: ManagedIndex, clientId: ClientId, servers: Record<string, unknown>, keepEntryNames: string[]): void;
@@ -16,6 +16,14 @@ export declare function serverSpecsEqual(left: UpstreamServerSpec, right: Upstre
 export declare function emptyImportScan(clientId: ClientId, configPath?: string): ClientImportScanResult;
 export declare function buildImportSkip(clientId: ClientId, sourceEntryName: string, reason: string, configPath?: string, serverName?: string): ClientImportSkippedEntry;
 export declare function removeSourceEntries(entries: Record<string, unknown>, names: string[] | undefined): void;
-export declare function syncDisabledMcpServersArray(raw: Record<string, unknown>, managedNames: string[], managedEntries: ManagedGatewayEntry[]): void;
-export declare function syncMcpExcludedArray(raw: Record<string, unknown>, managedNames: string[], managedEntries: ManagedGatewayEntry[]): void;
+/**
+ * Purge managed entry names from the native disabledMcpServers array.
+ * Disabled managed servers are simply absent from the client config (no entry written).
+ */
+export declare function purgeManagedFromDisabledArray(raw: Record<string, unknown>, managedNames: string[]): void;
+/**
+ * Purge managed entry names from the mcp.excluded array.
+ * Disabled managed servers are simply absent from the client config (no entry written).
+ */
+export declare function purgeManagedFromExcludedArray(raw: Record<string, unknown>, managedNames: string[]): void;
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,QAAQ,EACR,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AAGxB,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,GAAG,MAAM,EAAE,CAE7F;AAED,wBAAgB,cAAc,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAEzG;AAED,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,cAAc,EAAE,MAAM,EAAE,GACvB,IAAI,CAcN;AAED,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,OAAO,GACrB,MAAM,GAAG,IAAI,CAUf;AAED,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,IAAI,CAeN;AAED,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,UAAU,CAO7F;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,CAMjF;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,CAO3G;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,CAM7E;AAED,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAErE;AAaD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,kBAAkB,GAAG,kBAAkB,CAgBhF;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAEpE;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAE7F;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,sBAAsB,CAO/F;AAED,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,QAAQ,EAClB,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,UAAU,CAAC,EAAE,MAAM,EACnB,UAAU,SAAkB,GAC3B,wBAAwB,CAQ1B;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,IAAI,CAIvG;AAED,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,YAAY,EAAE,MAAM,EAAE,EACtB,cAAc,EAAE,mBAAmB,EAAE,GACpC,IAAI,CAON;AAED,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,YAAY,EAAE,MAAM,EAAE,EACtB,cAAc,EAAE,mBAAmB,EAAE,GACpC,IAAI,CASN"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,QAAQ,EACR,sBAAsB,EACtB,wBAAwB,EAExB,YAAY,EACZ,UAAU,EACV,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AAGxB,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,GAAG,MAAM,EAAE,CAE7F;AAED,wBAAgB,cAAc,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAEzG;AAED,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,cAAc,EAAE,MAAM,EAAE,GACvB,IAAI,CAcN;AAED,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,OAAO,GACrB,MAAM,GAAG,IAAI,CAUf;AAED,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,IAAI,CAeN;AAED,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,UAAU,CAO7F;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,CAMjF;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,CAO3G;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,CAM7E;AAED,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAErE;AAaD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,kBAAkB,GAAG,kBAAkB,CAgBhF;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAEpE;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAE7F;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,sBAAsB,CAO/F;AAED,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,QAAQ,EAClB,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,UAAU,CAAC,EAAE,MAAM,EACnB,UAAU,SAAkB,GAC3B,wBAAwB,CAQ1B;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,IAAI,CAIvG;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,YAAY,EAAE,MAAM,EAAE,GACrB,IAAI,CAMN;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,YAAY,EAAE,MAAM,EAAE,GACrB,IAAI,CAQN"}

package/dist/{cli-y7ba5qvr.js → cli-154shqmt.js}

@@ -1,16 +1,19 @@
 import {
   getGatewayUrl,
+  persistSyncState,
   syncAllClients
-} from "./cli-kwyp9ywh.js";
+} from "./cli-n8vt375e.js";
 import {
   loadConfig,
   loadMergedConfig,
   saveConfig
-} from "./cli-np0wwh6m.js";
+} from "./cli-csfsg1yf.js";
 import {
   SecretsManager,
+  UpstreamError,
+  classifyUpstreamError,
   ensureGatewayToken
-} from "./cli-8vxva0cb.js";
+} from "./cli-tk8bggg5.js";
 import {
   ensureDir,
   ensureParentDir,
@@ -344,6 +347,7 @@ function listAuthBindings(spec) {
     value
   }));
 }
+var TOKEN68 = /^[A-Za-z0-9\-._~+/]+=*$/;
 function maybePrefixBearer(target, value, raw = false) {
   if (raw || target.kind !== "header" || target.key.toLowerCase() !== "authorization") {
     return value;
@@ -351,7 +355,10 @@ function maybePrefixBearer(target, value, raw = false) {
   if (/^\S+\s+\S+/.test(value)) {
     return value;
   }
-  return `Bearer ${value}`;
+  if (TOKEN68.test(value)) {
+    return `Bearer ${value}`;
+  }
+  return value;
 }
 
 // src/core/spawn-env.ts
@@ -605,7 +612,12 @@ function bindOAuthReference(config, serverName) {
   };
 }
 async function runOAuthLogin(serverName, spec, secrets, openUrl, configPath, codeReceiver) {
-  new McpxOAuthProvider(serverName, secrets).invalidateCredentials("all");
+  const oauthName = oauthSecretName(serverName, "tokens");
+  const clientName = oauthSecretName(serverName, "client");
+  const backupTokens = secrets.getSecret(oauthName);
+  const backupClient = secrets.getSecret(clientName);
+  new McpxOAuthProvider(serverName, secrets).invalidateCredentials("verifier");
+  new McpxOAuthProvider(serverName, secrets).invalidateCredentials("discovery");
   const state = crypto.randomUUID();
   let callbackServer;
   let redirectUrl;
@@ -638,8 +650,16 @@ async function runOAuthLogin(serverName, spec, secrets, openUrl, configPath, cod
     const config = loadConfig(configPath);
     bindOAuthReference(config, serverName);
     saveConfig(config, configPath);
-    syncAllClients(config, secrets);
+    const summary = syncAllClients(config, secrets);
+    persistSyncState(summary, config);
+    saveConfig(config, configPath);
     return { serverName, authorized: true };
+  } catch (error) {
+    if (backupTokens)
+      secrets.setSecret(oauthName, backupTokens);
+    if (backupClient)
+      secrets.setSecret(clientName, backupClient);
+    throw error;
   } finally {
     if (callbackServer) {
       await closeServer(callbackServer);
@@ -649,32 +669,52 @@ async function runOAuthLogin(serverName, spec, secrets, openUrl, configPath, cod
 async function getOAuthAccessToken(serverName, spec, secrets, options = {}) {
   const stored = readJsonSecret(secrets, oauthSecretName(serverName, "tokens"));
   if (!stored) {
-    throw new Error(`No OAuth tokens stored for "${serverName}". Run mcpx auth login ${serverName}.`);
-  }
-  if (!options.forceRefresh && !tokensAreExpiring(stored)) {
-    return stored.tokens.access_token;
+    throw new UpstreamError(serverName, "auth_required", `No OAuth tokens stored for "${serverName}".`);
   }
-  if (!stored.tokens.refresh_token) {
-    if (!options.forceRefresh) {
-      return stored.tokens.access_token;
+  if (options.forceRefresh || tokensAreExpiring(stored)) {
+    if (!stored.tokens.refresh_token) {
+      if (!options.forceRefresh) {
+        return stored.tokens.access_token;
+      }
+      throw new UpstreamError(serverName, "auth_expired", `No refresh token for "${serverName}". Re-authentication required.`);
+    }
+    const provider = new McpxOAuthProvider(serverName, secrets);
+    const clientInformation = provider.clientInformation();
+    if (!clientInformation) {
+      throw new UpstreamError(serverName, "auth_expired", `No OAuth client info for "${serverName}". Re-authentication required.`);
+    }
+    let serverInfo;
+    try {
+      const cachedDiscovery = provider.discoveryState();
+      serverInfo = cachedDiscovery ?? await discoverOAuthServerInfo(spec.url);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (/ECONNREFUSED|ENOTFOUND|EAI_AGAIN|fetch failed/i.test(message)) {
+        throw new UpstreamError(serverName, "unreachable", `OAuth discovery failed: ${message}`);
+      }
+      throw new UpstreamError(serverName, "upstream_error", `OAuth discovery failed: ${message}`);
+    }
+    try {
+      const refreshed = await refreshAuthorization(serverInfo.authorizationServerUrl, {
+        metadata: serverInfo.authorizationServerMetadata,
+        clientInformation,
+        refreshToken: stored.tokens.refresh_token,
+        resource: serverInfo.resourceMetadata?.resource ? new URL(serverInfo.resourceMetadata.resource) : undefined
+      });
+      provider.saveTokens(refreshed);
+      return refreshed.access_token;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (/invalid_grant|invalid_client|4\d{2}/i.test(message)) {
+        throw new UpstreamError(serverName, "auth_expired", `OAuth refresh failed: ${message}`);
+      }
+      if (/ECONNREFUSED|ENOTFOUND|EAI_AGAIN|fetch failed/i.test(message)) {
+        throw new UpstreamError(serverName, "unreachable", `OAuth refresh failed: ${message}`);
+      }
+      throw new UpstreamError(serverName, "upstream_error", `OAuth refresh failed: ${message}`);
     }
-    throw new Error(`No OAuth refresh token stored for "${serverName}". Re-authentication required.`);
-  }
-  const provider = new McpxOAuthProvider(serverName, secrets);
-  const clientInformation = provider.clientInformation();
-  if (!clientInformation) {
-    throw new Error(`No OAuth client information stored for "${serverName}". Re-authentication required.`);
   }
-  const cachedDiscovery = provider.discoveryState();
-  const serverInfo = cachedDiscovery ?? await discoverOAuthServerInfo(spec.url);
-  const refreshed = await refreshAuthorization(serverInfo.authorizationServerUrl, {
-    metadata: serverInfo.authorizationServerMetadata,
-    clientInformation,
-    refreshToken: stored.tokens.refresh_token,
-    resource: serverInfo.resourceMetadata?.resource ? new URL(serverInfo.resourceMetadata.resource) : undefined
-  });
-  provider.saveTokens(refreshed);
-  return refreshed.access_token;
+  return stored.tokens.access_token;
 }
 
 // src/version.ts
@@ -944,7 +984,7 @@ function performRollback() {
 // src/core/daemon.ts
 import fs4 from "node:fs";
 import net from "node:net";
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn2, execFileSync as execFileSync2 } from "node:child_process";
 
 // src/gateway/server.ts
 import http2 from "node:http";
@@ -964,19 +1004,6 @@ var OAUTH_WELL_KNOWN_PREFIXES = [
   "/.well-known/oauth-authorization-server",
   "/.well-known/openid-configuration"
 ];
-
-class UpstreamHttpError extends Error {
-  status;
-  wwwAuthenticate;
-  bodyText;
-  constructor(upstreamName, status, bodyText, wwwAuthenticate) {
-    super(`Upstream ${upstreamName} returned HTTP ${status}: ${bodyText.slice(0, 400)}`);
-    this.name = "UpstreamHttpError";
-    this.status = status;
-    this.bodyText = bodyText;
-    this.wwwAuthenticate = wwwAuthenticate;
-  }
-}
 function makeError(id, code, message, data) {
   return {
     jsonrpc: "2.0",
@@ -1135,8 +1162,8 @@ async function getUpstreamTokenCounts(config, secrets, runtime) {
     const fingerprint = specFingerprint(upstream.spec);
     const cached = runtime.tokenCache.get(upstream.name);
     if (cached?.fingerprint === fingerprint) {
-      const runtimeError2 = runtime.upstreamErrors?.get(upstream.name);
-      results[upstream.name] = runtimeError2 ? { ...cached.count, runtimeError: runtimeError2 } : cached.count;
+      const runtimeErr2 = runtime.upstreamErrors?.get(upstream.name);
+      results[upstream.name] = runtimeErr2 ? { ...cached.count, runtimeError: runtimeErr2.message, runtimeErrorCode: runtimeErr2.code } : cached.count;
       continue;
     }
     let toolsCount = 0;
@@ -1178,8 +1205,8 @@ async function getUpstreamTokenCounts(config, secrets, runtime) {
     if (errors.length === 0) {
       runtime.tokenCache.set(upstream.name, { fingerprint, count: countObj });
     }
-    const runtimeError = runtime.upstreamErrors?.get(upstream.name);
-    results[upstream.name] = runtimeError ? { ...countObj, runtimeError } : countObj;
+    const runtimeErr = runtime.upstreamErrors?.get(upstream.name);
+    results[upstream.name] = runtimeErr ? { ...countObj, runtimeError: runtimeErr.message, runtimeErrorCode: runtimeErr.code } : countObj;
   }
   return results;
 }
@@ -1348,11 +1375,8 @@ async function callUpstreamOnce(upstream, method, params, secrets, runtime, pass
     if (!forceOAuthRefresh && hasOAuth && error instanceof StreamableHTTPError && (error.code === 401 || error.code === 403)) {
       return callUpstreamOnce(upstream, method, params, secrets, runtime, passthroughAuthorizationHeader, true);
     }
-    if (upstream.spec.transport === "http" && error instanceof StreamableHTTPError && error.code) {
-      const wwwAuthenticate = runtime.lastWwwAuthenticate?.get(upstream.name);
-      throw new UpstreamHttpError(upstream.name, error.code, error.message ?? "", wwwAuthenticate);
-    }
-    throw error;
+    const wwwAuthenticate = runtime.lastWwwAuthenticate?.get(upstream.name);
+    throw classifyUpstreamError(upstream.name, error, wwwAuthenticate);
   }
 }
 function authHeaderIsValid(request, expectedToken) {
@@ -1371,7 +1395,7 @@ function authHeaderIsValid(request, expectedToken) {
   return scheme === "Bearer" && token === expectedToken;
 }
 function isAuthChallenge(error) {
-  return error instanceof UpstreamHttpError && (error.status === 401 || error.status === 403);
+  return error instanceof UpstreamError && (error.code === "auth_required" || error.code === "auth_expired");
 }
 function getClientAuthorizationForUpstream(request, expectedToken) {
   const authHeader = request.headers.authorization;
@@ -1412,7 +1436,8 @@ async function handleListTools(config, secrets, runtime, upstreamFilter, clientA
       if (upstreams.length === 1) {
         throw error;
       }
-      runtime.upstreamErrors?.set(upstream.name, error instanceof Error ? error.message : String(error));
+      const code = error instanceof UpstreamError ? error.code : "upstream_error";
+      runtime.upstreamErrors?.set(upstream.name, { code, message: error instanceof Error ? error.message : String(error) });
     }
   }
   return { tools };
@@ -1447,7 +1472,8 @@ async function handleListResources(config, secrets, runtime, upstreamFilter, cli
       if (upstreams.length === 1) {
         throw error;
       }
-      runtime.upstreamErrors?.set(upstream.name, error instanceof Error ? error.message : String(error));
+      const code = error instanceof UpstreamError ? error.code : "upstream_error";
+      runtime.upstreamErrors?.set(upstream.name, { code, message: error instanceof Error ? error.message : String(error) });
     }
   }
   return { resources };
@@ -1480,7 +1506,8 @@ async function handleListPrompts(config, secrets, runtime, upstreamFilter, clien
       if (upstreams.length === 1) {
         throw error;
       }
-      runtime.upstreamErrors?.set(upstream.name, error instanceof Error ? error.message : String(error));
+      const code = error instanceof UpstreamError ? error.code : "upstream_error";
+      runtime.upstreamErrors?.set(upstream.name, { code, message: error instanceof Error ? error.message : String(error) });
     }
   }
   return { prompts };
@@ -1521,8 +1548,9 @@ async function routeNamespacedCall(config, method, params, id, secrets, runtime,
       if (isAuthChallenge(error)) {
         throw error;
       }
-      runtime.upstreamErrors?.set(upstream2.name, error.message);
-      return makeError(id, -32000, error.message);
+      const errCode = error instanceof UpstreamError ? error.code : "upstream_error";
+      runtime.upstreamErrors?.set(upstream2.name, { code: errCode, message: error.message });
+      return makeError(id, -32000, error.message, { mcpxCode: errCode, upstream: upstream2.name });
     }
   }
   if (method === "prompts/get") {
@@ -1554,8 +1582,9 @@ async function routeNamespacedCall(config, method, params, id, secrets, runtime,
       if (isAuthChallenge(error)) {
         throw error;
       }
-      runtime.upstreamErrors?.set(upstream2.name, error.message);
-      return makeError(id, -32000, error.message);
+      const errCode = error instanceof UpstreamError ? error.code : "upstream_error";
+      runtime.upstreamErrors?.set(upstream2.name, { code: errCode, message: error.message });
+      return makeError(id, -32000, error.message, { mcpxCode: errCode, upstream: upstream2.name });
     }
   }
   const uri = typeof params.uri === "string" ? params.uri : "";
@@ -1586,8 +1615,9 @@ async function routeNamespacedCall(config, method, params, id, secrets, runtime,
     if (isAuthChallenge(error)) {
       throw error;
     }
-    runtime.upstreamErrors?.set(upstream.name, error.message);
-    return makeError(id, -32000, error.message);
+    const errCode = error instanceof UpstreamError ? error.code : "upstream_error";
+    runtime.upstreamErrors?.set(upstream.name, { code: errCode, message: error.message });
+    return makeError(id, -32000, error.message, { mcpxCode: errCode, upstream: upstream.name });
   }
 }
 async function handleRequestObject(request, secrets, runtime, upstreamFilter, clientAuthorizationHeader) {
@@ -1858,16 +1888,16 @@ function createGatewayServer(options) {
       }
     } catch (error) {
       if (isAuthChallenge(error)) {
-        response.statusCode = error.status;
+        response.statusCode = error.status ?? 401;
         response.setHeader("content-type", "application/json");
         if (error.wwwAuthenticate) {
           const localResourceMetadataUrl = appendUpstreamQuery(`${getLocalOriginFromRequest(request)}/.well-known/oauth-protected-resource`, getRequestedUpstream(requestUrl));
           response.setHeader("www-authenticate", rewriteWwwAuthenticateResourceMetadata(error.wwwAuthenticate, localResourceMetadataUrl));
         }
         response.end(JSON.stringify(makeError(null, -32001, "Upstream authentication required.", {
+          mcpxCode: error.code,
           status: error.status,
-          body: error.bodyText,
-          wwwAuthenticate: error.wwwAuthenticate
+          upstream: error.upstream
         })));
         if (debug) {
           console.error(`[mcpx gateway] -> ${error.status} upstream auth challenge`);
@@ -1927,7 +1957,7 @@ async function isPortAvailable(port) {
     tester.listen(port, "127.0.0.1");
   });
 }
-async function resolveGatewayPort(config) {
+async function resolveGatewayPort(config, secrets) {
   if (await isPortAvailable(config.gateway.port)) {
     return config.gateway.port;
   }
@@ -1937,8 +1967,16 @@ async function resolveGatewayPort(config) {
       break;
     }
     if (await isPortAvailable(candidate)) {
+      const oldPort = config.gateway.port;
       config.gateway.port = candidate;
       saveConfig(config);
+      if (secrets) {
+        try {
+          const summary = syncAllClients(config, secrets);
+          persistSyncState(summary, config);
+          saveConfig(config);
+        } catch {}
+      }
       return candidate;
     }
   }
@@ -2002,7 +2040,7 @@ async function startDaemon(config, cliPath, secrets) {
       fs4.unlinkSync(getPidPath());
     } catch {}
   }
-  const port = await resolveGatewayPort(config);
+  const port = await resolveGatewayPort(config, secrets);
   const token = ensureGatewayToken(config, secrets);
   const pidPath = getPidPath();
   const logPath = getLogPath();
@@ -2038,6 +2076,24 @@ function stopDaemon() {
       message: "mcpx daemon is not running."
     };
   }
+  try {
+    const cmd = execFileSync2("ps", ["-p", String(pid), "-o", "command="], { encoding: "utf8", timeout: 2000 }).trim();
+    if (!cmd.includes("mcpx") && !cmd.includes("daemon") && !cmd.includes("cli.js")) {
+      fs4.unlinkSync(pidPath);
+      return {
+        stopped: false,
+        message: `PID ${pid} is not a mcpx daemon (command: ${cmd.slice(0, 80)}). Pidfile cleaned up.`
+      };
+    }
+  } catch {
+    try {
+      fs4.unlinkSync(pidPath);
+    } catch {}
+    return {
+      stopped: false,
+      message: `PID ${pid} not found. Pidfile cleaned up.`
+    };
+  }
   try {
     process.kill(pid, "SIGTERM");
   } catch {}
@@ -2165,6 +2221,7 @@ async function buildStatusReport(config, managedIndex, daemon = getDaemonStatus(
     if (tokenCount?.error && buildAuthBindings(spec).length > 0 && tokenCount.total > 0) {
       tokenCount = { ...tokenCount, error: undefined };
     }
+    const health = tokenCount ? tokenCount.error || tokenCount.runtimeError ? "error" : "ok" : "unknown";
     const serverEntry = {
       name,
       enabled: isServerEnabled(spec),
@@ -2172,7 +2229,8 @@ async function buildStatusReport(config, managedIndex, daemon = getDaemonStatus(
       target: describeServerTarget(spec),
       authBindings: buildAuthBindings(spec),
       clients: buildClientMappings(config, managedIndex, name),
-      tokenCount
+      tokenCount,
+      health
     };
     if (serverEntry.enabled && tokenCount) {
       totalGlobalTokens += tokenCount.total;

package/dist/{cli-qvkpwy9w.js → cli-9fmn9y72.js}

@@ -1,14 +1,14 @@
 import {
+  persistSyncState,
   syncAllClients
-} from "./cli-kwyp9ywh.js";
+} from "./cli-n8vt375e.js";
 import {
   loadConfig,
-  loadMergedConfig,
   saveConfig
-} from "./cli-np0wwh6m.js";
+} from "./cli-csfsg1yf.js";
 import {
   SecretsManager
-} from "./cli-8vxva0cb.js";
+} from "./cli-tk8bggg5.js";
 import {
   ensureDir,
   getConfigPath,
@@ -691,11 +691,18 @@ class PluginManager {
     if (config.plugins[pluginId]) {
       throw new Error(`Plugin ${pluginId} is already installed`);
     }
+    const serverNames = info.components.mcpServers.map((s) => `${pluginName}__${s.id}`);
+    for (const existing of Object.values(config.plugins)) {
+      for (const sn of serverNames) {
+        if (existing.serverNames.includes(sn)) {
+          throw new Error(`Server name collision: "${sn}" is already claimed by plugin "${existing.name}". Use --name to specify a different plugin name.`);
+        }
+      }
+    }
     const dataDir = path5.join(getPluginDataRoot(), pluginId);
     ensureDir(dataDir);
     const enabled = options?.enabled ?? true;
     const discovered = info.components;
-    const serverNames = discovered.mcpServers.map((s) => `${pluginName}__${s.id}`);
     const plugin = {
       id: pluginId,
       name: pluginName,
@@ -736,8 +743,10 @@ class PluginManager {
     }
     saveConfig(config, this.configPath);
     this.lifecycle.initData(pluginId);
-    const mergedConfig = loadMergedConfig(this.configPath);
-    syncAllClients(mergedConfig, this.secrets);
+    const syncConfig = loadConfig(this.configPath);
+    const summary = syncAllClients(syncConfig, this.secrets);
+    persistSyncState(summary, syncConfig);
+    saveConfig(syncConfig, this.configPath);
     return plugin;
   }
   async updatePlugin(pluginId) {
@@ -772,8 +781,10 @@ class PluginManager {
     current.approvals = {};
     config.plugins[pluginId] = current;
     saveConfig(config, this.configPath);
-    const mergedConfig = loadMergedConfig(this.configPath);
-    syncAllClients(mergedConfig, this.secrets);
+    const syncConfig = loadConfig(this.configPath);
+    const summary = syncAllClients(syncConfig, this.secrets);
+    persistSyncState(summary, syncConfig);
+    saveConfig(syncConfig, this.configPath);
     return current;
   }
   async uninstallPlugin(pluginId, keepData = false) {
@@ -791,8 +802,10 @@ class PluginManager {
     if (!keepData) {
       await this.lifecycle.removeData(pluginId);
     }
-    const mergedConfig = loadMergedConfig(this.configPath);
-    syncAllClients(mergedConfig, this.secrets);
+    const syncConfig = loadConfig(this.configPath);
+    const summary = syncAllClients(syncConfig, this.secrets);
+    persistSyncState(summary, syncConfig);
+    saveConfig(syncConfig, this.configPath);
   }
   async enablePlugin(pluginId) {
     const config = loadConfig(this.configPath);
@@ -803,8 +816,10 @@ class PluginManager {
       throw new Error(`Plugin ${pluginId} not found`);
     plugin.enabled = true;
     saveConfig(config, this.configPath);
-    const mergedConfig = loadMergedConfig(this.configPath);
-    syncAllClients(mergedConfig, this.secrets);
+    const syncConfig = loadConfig(this.configPath);
+    const summary = syncAllClients(syncConfig, this.secrets);
+    persistSyncState(summary, syncConfig);
+    saveConfig(syncConfig, this.configPath);
   }
   async disablePlugin(pluginId) {
     const config = loadConfig(this.configPath);
@@ -815,8 +830,10 @@ class PluginManager {
       throw new Error(`Plugin ${pluginId} not found`);
     plugin.enabled = false;
     saveConfig(config, this.configPath);
-    const mergedConfig = loadMergedConfig(this.configPath);
-    syncAllClients(mergedConfig, this.secrets);
+    const syncConfig = loadConfig(this.configPath);
+    const summary = syncAllClients(syncConfig, this.secrets);
+    persistSyncState(summary, syncConfig);
+    saveConfig(syncConfig, this.configPath);
   }
   async approveComponent(pluginId, component) {
     const config = loadConfig(this.configPath);
@@ -836,8 +853,10 @@ class PluginManager {
       }
     }
     saveConfig(config, this.configPath);
-    const mergedConfig = loadMergedConfig(this.configPath);
-    syncAllClients(mergedConfig, this.secrets);
+    const syncConfig = loadConfig(this.configPath);
+    const summary = syncAllClients(syncConfig, this.secrets);
+    persistSyncState(summary, syncConfig);
+    saveConfig(syncConfig, this.configPath);
   }
   async getPluginStatus(pluginId) {
     const config = loadConfig(this.configPath);