@kwonye/mcpx 0.1.93 → 0.1.94

package/dist/{cli-np0wwh6m.js → cli-csfsg1yf.js}

@@ -317,6 +317,14 @@ function repairConfig(config) {
       servers[name] = repaired;
     }
   }
+  const existingNames = new Set(Object.keys(servers));
+  if (config.projects) {
+    for (const project of Object.values(config.projects)) {
+      if (project.disabledServers) {
+        project.disabledServers = project.disabledServers.filter((s) => existingNames.has(s));
+      }
+    }
+  }
   return {
     ...config,
     servers
@@ -324,6 +332,17 @@ function repairConfig(config) {
 }
 
 // src/core/config.ts
+class ConfigLoadError extends Error {
+  configPath;
+  backupPath;
+  issues;
+  constructor(configPath, message, issues) {
+    super(message);
+    this.name = "ConfigLoadError";
+    this.configPath = configPath;
+    this.issues = issues;
+  }
+}
 var clientStateSchema = z.object({
   status: z.enum(["SYNCED", "UNSUPPORTED_HTTP", "ERROR", "SKIPPED"]),
   lastSyncAt: z.string().optional(),
@@ -436,10 +455,30 @@ function defaultConfig() {
   };
 }
 function loadConfig(configPath = getConfigPath()) {
-  const raw = readJsonFile(configPath, defaultConfig());
+  if (!fs.existsSync(configPath)) {
+    return defaultConfig();
+  }
+  let raw;
+  try {
+    const content = fs.readFileSync(configPath, "utf8");
+    raw = JSON.parse(content);
+  } catch (err) {
+    const backupPath = `${configPath}.invalid-${Date.now()}`;
+    try {
+      fs.copyFileSync(configPath, backupPath);
+    } catch {}
+    const message = `Failed to parse config file at ${configPath}.`;
+    throw new ConfigLoadError(configPath, `${message} Backed up to ${backupPath}.`, [`JSON parse error: ${err.message}`]);
+  }
   const parsed = configSchema.safeParse(raw);
   if (!parsed.success) {
-    return defaultConfig();
+    const backupPath = `${configPath}.invalid-${Date.now()}`;
+    try {
+      fs.copyFileSync(configPath, backupPath);
+    } catch {}
+    const issues = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`);
+    const message = `Config file at ${configPath} has validation errors.`;
+    throw new ConfigLoadError(configPath, `${message} Backed up to ${backupPath}.`, issues);
   }
   const clientEntries = {};
   for (const [key, value] of Object.entries(parsed.data.clients)) {
@@ -461,7 +500,18 @@ function saveConfig(config, configPath = getConfigPath()) {
   config.servers = Object.fromEntries(Object.entries(config.servers).map(([name, spec]) => [name, normalizeServerSpecEnabled(spec)]));
   writeJsonAtomic(configPath, config);
 }
-function loadProjectConfig(projectConfigPath) {
+function loadProjectConfig(projectConfigPath, options) {
+  if (options?.strict) {
+    const raw2 = readJsonFile(projectConfigPath, null);
+    if (raw2 === null) {
+      return { servers: {} };
+    }
+    const parsed2 = projectConfigSchema.safeParse(raw2);
+    if (!parsed2.success) {
+      throw new ConfigLoadError(projectConfigPath, `Project config at ${projectConfigPath} has validation errors.`, parsed2.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`));
+    }
+    return parsed2.data;
+  }
   const raw = readJsonFile(projectConfigPath, { servers: {} });
   const parsed = projectConfigSchema.safeParse(raw);
   if (!parsed.success) {
@@ -498,6 +548,30 @@ function loadMergedConfig(configPath = getConfigPath()) {
   }
   return config;
 }
+function migrateProjectServers(config, projectPath) {
+  const localConfigPath = path.join(projectPath, ".mcpx.json");
+  if (!fs.existsSync(localConfigPath)) {
+    return { migrated: [], conflicts: [] };
+  }
+  const migrated = [];
+  const conflicts = [];
+  try {
+    const localConfig = loadProjectConfig(localConfigPath);
+    for (const [serverName, spec] of Object.entries(localConfig.servers)) {
+      if (config.servers[serverName]) {
+        conflicts.push(serverName);
+        continue;
+      }
+      const normalized = normalizeServerSpecEnabled(spec);
+      if (normalized.transport === "stdio" && !normalized.cwd) {
+        normalized.cwd = projectPath;
+      }
+      config.servers[serverName] = normalized;
+      migrated.push(serverName);
+    }
+  } catch {}
+  return { migrated, conflicts };
+}
 function resolveActiveConfig(options = {}) {
   const globalPath = getConfigPath();
   const config = loadConfig(globalPath);
@@ -522,4 +596,4 @@ function resolveActiveConfig(options = {}) {
   };
 }
 
-export { tokenizeCommandLine, parseCliAddCommand, defaultConfig, loadConfig, saveConfig, loadProjectConfig, saveProjectConfig, loadMergedConfig, resolveActiveConfig };
+export { tokenizeCommandLine, parseCliAddCommand, ConfigLoadError, defaultConfig, loadConfig, saveConfig, loadProjectConfig, saveProjectConfig, loadMergedConfig, migrateProjectServers, resolveActiveConfig };

package/dist/{cli-m2645syd.js → cli-mxmgxdm2.js}

@@ -1,16 +1,19 @@
 import {
   getGatewayUrl,
+  persistSyncState,
   syncAllClients
-} from "./cli-kwyp9ywh.js";
+} from "./cli-n8vt375e.js";
 import {
   loadConfig,
   loadMergedConfig,
   saveConfig
-} from "./cli-np0wwh6m.js";
+} from "./cli-csfsg1yf.js";
 import {
   SecretsManager,
+  UpstreamError,
+  classifyUpstreamError,
   ensureGatewayToken
-} from "./cli-8vxva0cb.js";
+} from "./cli-tk8bggg5.js";
 import {
   ensureDir,
   ensureParentDir,
@@ -344,6 +347,7 @@ function listAuthBindings(spec) {
     value
   }));
 }
+var TOKEN68 = /^[A-Za-z0-9\-._~+/]+=*$/;
 function maybePrefixBearer(target, value, raw = false) {
   if (raw || target.kind !== "header" || target.key.toLowerCase() !== "authorization") {
     return value;
@@ -351,7 +355,10 @@ function maybePrefixBearer(target, value, raw = false) {
   if (/^\S+\s+\S+/.test(value)) {
     return value;
   }
-  return `Bearer ${value}`;
+  if (TOKEN68.test(value)) {
+    return `Bearer ${value}`;
+  }
+  return value;
 }
 
 // src/core/spawn-env.ts
@@ -605,7 +612,12 @@ function bindOAuthReference(config, serverName) {
   };
 }
 async function runOAuthLogin(serverName, spec, secrets, openUrl, configPath, codeReceiver) {
-  new McpxOAuthProvider(serverName, secrets).invalidateCredentials("all");
+  const oauthName = oauthSecretName(serverName, "tokens");
+  const clientName = oauthSecretName(serverName, "client");
+  const backupTokens = secrets.getSecret(oauthName);
+  const backupClient = secrets.getSecret(clientName);
+  new McpxOAuthProvider(serverName, secrets).invalidateCredentials("verifier");
+  new McpxOAuthProvider(serverName, secrets).invalidateCredentials("discovery");
   const state = crypto.randomUUID();
   let callbackServer;
   let redirectUrl;
@@ -638,8 +650,16 @@ async function runOAuthLogin(serverName, spec, secrets, openUrl, configPath, cod
     const config = loadConfig(configPath);
     bindOAuthReference(config, serverName);
     saveConfig(config, configPath);
-    syncAllClients(config, secrets);
+    const summary = syncAllClients(config, secrets);
+    persistSyncState(summary, config);
+    saveConfig(config, configPath);
     return { serverName, authorized: true };
+  } catch (error) {
+    if (backupTokens)
+      secrets.setSecret(oauthName, backupTokens);
+    if (backupClient)
+      secrets.setSecret(clientName, backupClient);
+    throw error;
   } finally {
     if (callbackServer) {
       await closeServer(callbackServer);
@@ -649,36 +669,56 @@ async function runOAuthLogin(serverName, spec, secrets, openUrl, configPath, cod
 async function getOAuthAccessToken(serverName, spec, secrets, options = {}) {
   const stored = readJsonSecret(secrets, oauthSecretName(serverName, "tokens"));
   if (!stored) {
-    throw new Error(`No OAuth tokens stored for "${serverName}". Run mcpx auth login ${serverName}.`);
-  }
-  if (!options.forceRefresh && !tokensAreExpiring(stored)) {
-    return stored.tokens.access_token;
+    throw new UpstreamError(serverName, "auth_required", `No OAuth tokens stored for "${serverName}".`);
   }
-  if (!stored.tokens.refresh_token) {
-    if (!options.forceRefresh) {
-      return stored.tokens.access_token;
+  if (options.forceRefresh || tokensAreExpiring(stored)) {
+    if (!stored.tokens.refresh_token) {
+      if (!options.forceRefresh) {
+        return stored.tokens.access_token;
+      }
+      throw new UpstreamError(serverName, "auth_expired", `No refresh token for "${serverName}". Re-authentication required.`);
+    }
+    const provider = new McpxOAuthProvider(serverName, secrets);
+    const clientInformation = provider.clientInformation();
+    if (!clientInformation) {
+      throw new UpstreamError(serverName, "auth_expired", `No OAuth client info for "${serverName}". Re-authentication required.`);
+    }
+    let serverInfo;
+    try {
+      const cachedDiscovery = provider.discoveryState();
+      serverInfo = cachedDiscovery ?? await discoverOAuthServerInfo(spec.url);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (/ECONNREFUSED|ENOTFOUND|EAI_AGAIN|fetch failed/i.test(message)) {
+        throw new UpstreamError(serverName, "unreachable", `OAuth discovery failed: ${message}`);
+      }
+      throw new UpstreamError(serverName, "upstream_error", `OAuth discovery failed: ${message}`);
+    }
+    try {
+      const refreshed = await refreshAuthorization(serverInfo.authorizationServerUrl, {
+        metadata: serverInfo.authorizationServerMetadata,
+        clientInformation,
+        refreshToken: stored.tokens.refresh_token,
+        resource: serverInfo.resourceMetadata?.resource ? new URL(serverInfo.resourceMetadata.resource) : undefined
+      });
+      provider.saveTokens(refreshed);
+      return refreshed.access_token;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (/invalid_grant|invalid_client|4\d{2}/i.test(message)) {
+        throw new UpstreamError(serverName, "auth_expired", `OAuth refresh failed: ${message}`);
+      }
+      if (/ECONNREFUSED|ENOTFOUND|EAI_AGAIN|fetch failed/i.test(message)) {
+        throw new UpstreamError(serverName, "unreachable", `OAuth refresh failed: ${message}`);
+      }
+      throw new UpstreamError(serverName, "upstream_error", `OAuth refresh failed: ${message}`);
     }
-    throw new Error(`No OAuth refresh token stored for "${serverName}". Re-authentication required.`);
-  }
-  const provider = new McpxOAuthProvider(serverName, secrets);
-  const clientInformation = provider.clientInformation();
-  if (!clientInformation) {
-    throw new Error(`No OAuth client information stored for "${serverName}". Re-authentication required.`);
   }
-  const cachedDiscovery = provider.discoveryState();
-  const serverInfo = cachedDiscovery ?? await discoverOAuthServerInfo(spec.url);
-  const refreshed = await refreshAuthorization(serverInfo.authorizationServerUrl, {
-    metadata: serverInfo.authorizationServerMetadata,
-    clientInformation,
-    refreshToken: stored.tokens.refresh_token,
-    resource: serverInfo.resourceMetadata?.resource ? new URL(serverInfo.resourceMetadata.resource) : undefined
-  });
-  provider.saveTokens(refreshed);
-  return refreshed.access_token;
+  return stored.tokens.access_token;
 }
 
 // src/version.ts
-var APP_VERSION = "0.1.93";
+var APP_VERSION = "0.1.94";
 
 // src/core/update.ts
 import fs2 from "node:fs";
@@ -944,7 +984,7 @@ function performRollback() {
 // src/core/daemon.ts
 import fs4 from "node:fs";
 import net from "node:net";
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn2, execFileSync as execFileSync2 } from "node:child_process";
 
 // src/gateway/server.ts
 import http2 from "node:http";
@@ -964,19 +1004,6 @@ var OAUTH_WELL_KNOWN_PREFIXES = [
   "/.well-known/oauth-authorization-server",
   "/.well-known/openid-configuration"
 ];
-
-class UpstreamHttpError extends Error {
-  status;
-  wwwAuthenticate;
-  bodyText;
-  constructor(upstreamName, status, bodyText, wwwAuthenticate) {
-    super(`Upstream ${upstreamName} returned HTTP ${status}: ${bodyText.slice(0, 400)}`);
-    this.name = "UpstreamHttpError";
-    this.status = status;
-    this.bodyText = bodyText;
-    this.wwwAuthenticate = wwwAuthenticate;
-  }
-}
 function makeError(id, code, message, data) {
   return {
     jsonrpc: "2.0",
@@ -1135,8 +1162,8 @@ async function getUpstreamTokenCounts(config, secrets, runtime) {
     const fingerprint = specFingerprint(upstream.spec);
     const cached = runtime.tokenCache.get(upstream.name);
     if (cached?.fingerprint === fingerprint) {
-      const runtimeError2 = runtime.upstreamErrors?.get(upstream.name);
-      results[upstream.name] = runtimeError2 ? { ...cached.count, runtimeError: runtimeError2 } : cached.count;
+      const runtimeErr2 = runtime.upstreamErrors?.get(upstream.name);
+      results[upstream.name] = runtimeErr2 ? { ...cached.count, runtimeError: runtimeErr2.message, runtimeErrorCode: runtimeErr2.code } : cached.count;
       continue;
     }
     let toolsCount = 0;
@@ -1178,8 +1205,8 @@ async function getUpstreamTokenCounts(config, secrets, runtime) {
     if (errors.length === 0) {
       runtime.tokenCache.set(upstream.name, { fingerprint, count: countObj });
     }
-    const runtimeError = runtime.upstreamErrors?.get(upstream.name);
-    results[upstream.name] = runtimeError ? { ...countObj, runtimeError } : countObj;
+    const runtimeErr = runtime.upstreamErrors?.get(upstream.name);
+    results[upstream.name] = runtimeErr ? { ...countObj, runtimeError: runtimeErr.message, runtimeErrorCode: runtimeErr.code } : countObj;
   }
   return results;
 }
@@ -1348,11 +1375,8 @@ async function callUpstreamOnce(upstream, method, params, secrets, runtime, pass
     if (!forceOAuthRefresh && hasOAuth && error instanceof StreamableHTTPError && (error.code === 401 || error.code === 403)) {
       return callUpstreamOnce(upstream, method, params, secrets, runtime, passthroughAuthorizationHeader, true);
     }
-    if (upstream.spec.transport === "http" && error instanceof StreamableHTTPError && error.code) {
-      const wwwAuthenticate = runtime.lastWwwAuthenticate?.get(upstream.name);
-      throw new UpstreamHttpError(upstream.name, error.code, error.message ?? "", wwwAuthenticate);
-    }
-    throw error;
+    const wwwAuthenticate = runtime.lastWwwAuthenticate?.get(upstream.name);
+    throw classifyUpstreamError(upstream.name, error, wwwAuthenticate);
   }
 }
 function authHeaderIsValid(request, expectedToken) {
@@ -1371,7 +1395,7 @@ function authHeaderIsValid(request, expectedToken) {
   return scheme === "Bearer" && token === expectedToken;
 }
 function isAuthChallenge(error) {
-  return error instanceof UpstreamHttpError && (error.status === 401 || error.status === 403);
+  return error instanceof UpstreamError && (error.code === "auth_required" || error.code === "auth_expired");
 }
 function getClientAuthorizationForUpstream(request, expectedToken) {
   const authHeader = request.headers.authorization;
@@ -1412,7 +1436,8 @@ async function handleListTools(config, secrets, runtime, upstreamFilter, clientA
       if (upstreams.length === 1) {
         throw error;
       }
-      runtime.upstreamErrors?.set(upstream.name, error instanceof Error ? error.message : String(error));
+      const code = error instanceof UpstreamError ? error.code : "upstream_error";
+      runtime.upstreamErrors?.set(upstream.name, { code, message: error instanceof Error ? error.message : String(error) });
     }
   }
   return { tools };
@@ -1447,7 +1472,8 @@ async function handleListResources(config, secrets, runtime, upstreamFilter, cli
       if (upstreams.length === 1) {
         throw error;
       }
-      runtime.upstreamErrors?.set(upstream.name, error instanceof Error ? error.message : String(error));
+      const code = error instanceof UpstreamError ? error.code : "upstream_error";
+      runtime.upstreamErrors?.set(upstream.name, { code, message: error instanceof Error ? error.message : String(error) });
     }
   }
   return { resources };
@@ -1480,7 +1506,8 @@ async function handleListPrompts(config, secrets, runtime, upstreamFilter, clien
       if (upstreams.length === 1) {
         throw error;
       }
-      runtime.upstreamErrors?.set(upstream.name, error instanceof Error ? error.message : String(error));
+      const code = error instanceof UpstreamError ? error.code : "upstream_error";
+      runtime.upstreamErrors?.set(upstream.name, { code, message: error instanceof Error ? error.message : String(error) });
     }
   }
   return { prompts };
@@ -1521,8 +1548,9 @@ async function routeNamespacedCall(config, method, params, id, secrets, runtime,
       if (isAuthChallenge(error)) {
         throw error;
       }
-      runtime.upstreamErrors?.set(upstream2.name, error.message);
-      return makeError(id, -32000, error.message);
+      const errCode = error instanceof UpstreamError ? error.code : "upstream_error";
+      runtime.upstreamErrors?.set(upstream2.name, { code: errCode, message: error.message });
+      return makeError(id, -32000, error.message, { mcpxCode: errCode, upstream: upstream2.name });
     }
   }
   if (method === "prompts/get") {
@@ -1554,8 +1582,9 @@ async function routeNamespacedCall(config, method, params, id, secrets, runtime,
       if (isAuthChallenge(error)) {
         throw error;
       }
-      runtime.upstreamErrors?.set(upstream2.name, error.message);
-      return makeError(id, -32000, error.message);
+      const errCode = error instanceof UpstreamError ? error.code : "upstream_error";
+      runtime.upstreamErrors?.set(upstream2.name, { code: errCode, message: error.message });
+      return makeError(id, -32000, error.message, { mcpxCode: errCode, upstream: upstream2.name });
     }
   }
   const uri = typeof params.uri === "string" ? params.uri : "";
@@ -1586,8 +1615,9 @@ async function routeNamespacedCall(config, method, params, id, secrets, runtime,
     if (isAuthChallenge(error)) {
       throw error;
     }
-    runtime.upstreamErrors?.set(upstream.name, error.message);
-    return makeError(id, -32000, error.message);
+    const errCode = error instanceof UpstreamError ? error.code : "upstream_error";
+    runtime.upstreamErrors?.set(upstream.name, { code: errCode, message: error.message });
+    return makeError(id, -32000, error.message, { mcpxCode: errCode, upstream: upstream.name });
   }
 }
 async function handleRequestObject(request, secrets, runtime, upstreamFilter, clientAuthorizationHeader) {
@@ -1858,16 +1888,16 @@ function createGatewayServer(options) {
       }
     } catch (error) {
       if (isAuthChallenge(error)) {
-        response.statusCode = error.status;
+        response.statusCode = error.status ?? 401;
         response.setHeader("content-type", "application/json");
         if (error.wwwAuthenticate) {
           const localResourceMetadataUrl = appendUpstreamQuery(`${getLocalOriginFromRequest(request)}/.well-known/oauth-protected-resource`, getRequestedUpstream(requestUrl));
           response.setHeader("www-authenticate", rewriteWwwAuthenticateResourceMetadata(error.wwwAuthenticate, localResourceMetadataUrl));
         }
         response.end(JSON.stringify(makeError(null, -32001, "Upstream authentication required.", {
+          mcpxCode: error.code,
           status: error.status,
-          body: error.bodyText,
-          wwwAuthenticate: error.wwwAuthenticate
+          upstream: error.upstream
         })));
         if (debug) {
           console.error(`[mcpx gateway] -> ${error.status} upstream auth challenge`);
@@ -1927,7 +1957,7 @@ async function isPortAvailable(port) {
     tester.listen(port, "127.0.0.1");
   });
 }
-async function resolveGatewayPort(config) {
+async function resolveGatewayPort(config, secrets) {
   if (await isPortAvailable(config.gateway.port)) {
     return config.gateway.port;
   }
@@ -1937,8 +1967,16 @@ async function resolveGatewayPort(config) {
       break;
     }
     if (await isPortAvailable(candidate)) {
+      const oldPort = config.gateway.port;
       config.gateway.port = candidate;
       saveConfig(config);
+      if (secrets) {
+        try {
+          const summary = syncAllClients(config, secrets);
+          persistSyncState(summary, config);
+          saveConfig(config);
+        } catch {}
+      }
       return candidate;
     }
   }
@@ -2002,7 +2040,7 @@ async function startDaemon(config, cliPath, secrets) {
       fs4.unlinkSync(getPidPath());
     } catch {}
   }
-  const port = await resolveGatewayPort(config);
+  const port = await resolveGatewayPort(config, secrets);
   const token = ensureGatewayToken(config, secrets);
   const pidPath = getPidPath();
   const logPath = getLogPath();
@@ -2038,6 +2076,24 @@ function stopDaemon() {
       message: "mcpx daemon is not running."
     };
   }
+  try {
+    const cmd = execFileSync2("ps", ["-p", String(pid), "-o", "command="], { encoding: "utf8", timeout: 2000 }).trim();
+    if (!cmd.includes("mcpx") && !cmd.includes("daemon") && !cmd.includes("cli.js")) {
+      fs4.unlinkSync(pidPath);
+      return {
+        stopped: false,
+        message: `PID ${pid} is not a mcpx daemon (command: ${cmd.slice(0, 80)}). Pidfile cleaned up.`
+      };
+    }
+  } catch {
+    try {
+      fs4.unlinkSync(pidPath);
+    } catch {}
+    return {
+      stopped: false,
+      message: `PID ${pid} not found. Pidfile cleaned up.`
+    };
+  }
   try {
     process.kill(pid, "SIGTERM");
   } catch {}
@@ -2165,6 +2221,7 @@ async function buildStatusReport(config, managedIndex, daemon = getDaemonStatus(
     if (tokenCount?.error && buildAuthBindings(spec).length > 0 && tokenCount.total > 0) {
       tokenCount = { ...tokenCount, error: undefined };
     }
+    const health = tokenCount ? tokenCount.error || tokenCount.runtimeError ? "error" : "ok" : "unknown";
     const serverEntry = {
       name,
       enabled: isServerEnabled(spec),
@@ -2172,7 +2229,8 @@ async function buildStatusReport(config, managedIndex, daemon = getDaemonStatus(
       target: describeServerTarget(spec),
       authBindings: buildAuthBindings(spec),
       clients: buildClientMappings(config, managedIndex, name),
-      tokenCount
+      tokenCount,
+      health
     };
     if (serverEntry.enabled && tokenCount) {
       totalGlobalTokens += tokenCount.total;