@kwonye/mcpx 0.1.93 → 0.1.95

package/dist/{cli-y7ba5qvr.js → cli-28fsxhe3.js}

@@ -1,19 +1,27 @@
 import {
+  APP_VERSION,
   getGatewayUrl,
+  persistSyncState,
   syncAllClients
-} from "./cli-kwyp9ywh.js";
+} from "./cli-wxw1t3rr.js";
 import {
   loadConfig,
   loadMergedConfig,
-  saveConfig
-} from "./cli-np0wwh6m.js";
+  loadProjectConfig,
+  saveConfig,
+  saveProjectConfig
+} from "./cli-v27bt25d.js";
 import {
   SecretsManager,
+  UpstreamError,
+  classifyUpstreamError,
   ensureGatewayToken
-} from "./cli-8vxva0cb.js";
+} from "./cli-tk8bggg5.js";
 import {
   ensureDir,
   ensureParentDir,
+  findProjectConfigPath,
+  getConfigPath,
   getLogPath,
   getPidPath,
   getStagedVersionPath,
@@ -24,6 +32,114 @@ import {
   isServerEnabled
 } from "./cli-s4gspqdf.js";
 
+// src/core/config-store.ts
+import fs from "node:fs";
+import path from "node:path";
+var LOCK_STALE_MS = 5000;
+var LOCK_RETRY_MS = 50;
+var LOCK_MAX_RETRIES = 40;
+var inProcessQueues = new Map;
+function getLockPath(filePath) {
+  return `${filePath}.lock`;
+}
+function acquireLock(filePath) {
+  const lockPath = getLockPath(filePath);
+  try {
+    fs.mkdirSync(path.dirname(lockPath), { recursive: true });
+    const fd = fs.openSync(lockPath, "wx");
+    fs.writeSync(fd, String(process.pid));
+    fs.closeSync(fd);
+    return true;
+  } catch (err) {
+    if (err.code !== "EEXIST") {
+      return false;
+    }
+    try {
+      const stat = fs.statSync(lockPath);
+      if (Date.now() - stat.mtimeMs > LOCK_STALE_MS) {
+        fs.unlinkSync(lockPath);
+        return acquireLock(filePath);
+      }
+    } catch {
+      return acquireLock(filePath);
+    }
+    return false;
+  }
+}
+function releaseLock(filePath) {
+  try {
+    fs.unlinkSync(getLockPath(filePath));
+  } catch {}
+}
+function mutateFile(filePath, load, save, fn) {
+  const prevQueue = inProcessQueues.get(filePath) ?? Promise.resolve();
+  const nextQueue = prevQueue.then(() => executeWithLock(filePath, load, save, fn), () => executeWithLock(filePath, load, save, fn));
+  inProcessQueues.set(filePath, nextQueue.catch(() => {
+    return;
+  }));
+  return nextQueue;
+}
+async function executeWithLock(filePath, load, save, fn) {
+  let acquired = false;
+  for (let attempt = 0;attempt < LOCK_MAX_RETRIES; attempt++) {
+    acquired = acquireLock(filePath);
+    if (acquired)
+      break;
+    await new Promise((r) => setTimeout(r, LOCK_RETRY_MS));
+  }
+  if (!acquired) {
+    throw new Error(`Could not acquire lock for ${filePath}.`);
+  }
+  try {
+    const data = load(filePath);
+    const result = await fn(data);
+    save(data, filePath);
+    return result;
+  } finally {
+    releaseLock(filePath);
+  }
+}
+function mutateConfig(fn, configPath) {
+  return mutateFile(configPath ?? getConfigPath(), loadConfig, saveConfig, fn);
+}
+function mutateProjectConfig(projectConfigPath, fn) {
+  return mutateFile(projectConfigPath, (p) => loadProjectConfig(p), saveProjectConfig, fn);
+}
+async function mutateActiveConfig(options, mutator) {
+  const globalPath = getConfigPath();
+  if (!options.global) {
+    const projectConfigPath = findProjectConfigPath();
+    if (options.local) {
+      const projectPath = projectConfigPath ? path.dirname(projectConfigPath) : process.cwd();
+      const localPath = path.join(projectPath, ".mcpx.json");
+      const globalConfig = loadConfig(globalPath);
+      const result2 = await mutateProjectConfig(localPath, async (projectConfig) => {
+        const mergedConfig = {
+          ...globalConfig,
+          servers: { ...globalConfig.servers, ...projectConfig.servers }
+        };
+        const mutatorResult = await mutator(mergedConfig, { type: "project", projectPath });
+        const localServers = {};
+        for (const [name, spec] of Object.entries(mergedConfig.servers)) {
+          if (!(name in globalConfig.servers)) {
+            localServers[name] = spec;
+          }
+        }
+        projectConfig.servers = localServers;
+        return mutatorResult;
+      });
+      return { type: "project", configPath: localPath, projectPath, result: result2 };
+    }
+    if (projectConfigPath) {
+      const projectPath = path.dirname(projectConfigPath);
+      const result2 = await mutateConfig((config) => mutator(config, { type: "project", projectPath }), globalPath);
+      return { type: "project", configPath: globalPath, projectPath, result: result2 };
+    }
+  }
+  const result = await mutateConfig((config) => mutator(config, { type: "global" }), globalPath);
+  return { type: "global", configPath: globalPath, result };
+}
+
 // src/core/auth-probe.ts
 var JSON_RPC_VERSION = "2.0";
 var DEFAULT_AUTH_PROBE_TIMEOUT_MS = 8000;
@@ -344,6 +460,7 @@ function listAuthBindings(spec) {
     value
   }));
 }
+var TOKEN68 = /^[A-Za-z0-9\-._~+/]+=*$/;
 function maybePrefixBearer(target, value, raw = false) {
   if (raw || target.kind !== "header" || target.key.toLowerCase() !== "authorization") {
     return value;
@@ -351,25 +468,28 @@ function maybePrefixBearer(target, value, raw = false) {
   if (/^\S+\s+\S+/.test(value)) {
     return value;
   }
-  return `Bearer ${value}`;
+  if (TOKEN68.test(value)) {
+    return `Bearer ${value}`;
+  }
+  return value;
 }
 
 // src/core/spawn-env.ts
 import os from "node:os";
-import path from "node:path";
-import fs from "node:fs";
+import path2 from "node:path";
+import fs2 from "node:fs";
 function existingNvmCurrentBin() {
-  const nvmDir = process.env.NVM_DIR ?? path.join(os.homedir(), ".nvm");
-  const current = path.join(nvmDir, "current", "bin");
-  return fs.existsSync(current) ? current : null;
+  const nvmDir = process.env.NVM_DIR ?? path2.join(os.homedir(), ".nvm");
+  const current = path2.join(nvmDir, "current", "bin");
+  return fs2.existsSync(current) ? current : null;
 }
 function buildEnrichedPath(current = process.env.PATH ?? "") {
   const candidates = [
     ...current.split(":"),
     "/opt/homebrew/bin",
     "/usr/local/bin",
-    path.join(os.homedir(), ".bun", "bin"),
-    path.join(os.homedir(), ".local", "bin"),
+    path2.join(os.homedir(), ".bun", "bin"),
+    path2.join(os.homedir(), ".local", "bin"),
     existingNvmCurrentBin()
   ].filter((entry) => Boolean(entry));
   const seen = new Set;
@@ -605,7 +725,12 @@ function bindOAuthReference(config, serverName) {
   };
 }
 async function runOAuthLogin(serverName, spec, secrets, openUrl, configPath, codeReceiver) {
-  new McpxOAuthProvider(serverName, secrets).invalidateCredentials("all");
+  const oauthName = oauthSecretName(serverName, "tokens");
+  const clientName = oauthSecretName(serverName, "client");
+  const backupTokens = secrets.getSecret(oauthName);
+  const backupClient = secrets.getSecret(clientName);
+  new McpxOAuthProvider(serverName, secrets).invalidateCredentials("verifier");
+  new McpxOAuthProvider(serverName, secrets).invalidateCredentials("discovery");
   const state = crypto.randomUUID();
   let callbackServer;
   let redirectUrl;
@@ -638,8 +763,18 @@ async function runOAuthLogin(serverName, spec, secrets, openUrl, configPath, cod
     const config = loadConfig(configPath);
     bindOAuthReference(config, serverName);
     saveConfig(config, configPath);
-    syncAllClients(config, secrets);
+    const summary = syncAllClients(config, secrets);
+    persistSyncState(summary, config);
+    saveConfig(config, configPath);
+    new McpxOAuthProvider(serverName, secrets).invalidateCredentials("verifier");
     return { serverName, authorized: true };
+  } catch (error) {
+    if (backupTokens)
+      secrets.setSecret(oauthName, backupTokens);
+    if (backupClient)
+      secrets.setSecret(clientName, backupClient);
+    new McpxOAuthProvider(serverName, secrets).invalidateCredentials("verifier");
+    throw error;
   } finally {
     if (callbackServer) {
       await closeServer(callbackServer);
@@ -649,40 +784,57 @@ async function runOAuthLogin(serverName, spec, secrets, openUrl, configPath, cod
 async function getOAuthAccessToken(serverName, spec, secrets, options = {}) {
   const stored = readJsonSecret(secrets, oauthSecretName(serverName, "tokens"));
   if (!stored) {
-    throw new Error(`No OAuth tokens stored for "${serverName}". Run mcpx auth login ${serverName}.`);
+    throw new UpstreamError(serverName, "auth_required", `No OAuth tokens stored for "${serverName}".`);
   }
-  if (!options.forceRefresh && !tokensAreExpiring(stored)) {
-    return stored.tokens.access_token;
-  }
-  if (!stored.tokens.refresh_token) {
-    if (!options.forceRefresh) {
-      return stored.tokens.access_token;
+  if (options.forceRefresh || tokensAreExpiring(stored)) {
+    if (!stored.tokens.refresh_token) {
+      if (!options.forceRefresh) {
+        return stored.tokens.access_token;
+      }
+      throw new UpstreamError(serverName, "auth_expired", `No refresh token for "${serverName}". Re-authentication required.`);
+    }
+    const provider = new McpxOAuthProvider(serverName, secrets);
+    const clientInformation = provider.clientInformation();
+    if (!clientInformation) {
+      throw new UpstreamError(serverName, "auth_expired", `No OAuth client info for "${serverName}". Re-authentication required.`);
+    }
+    let serverInfo;
+    try {
+      const cachedDiscovery = provider.discoveryState();
+      serverInfo = cachedDiscovery ?? await discoverOAuthServerInfo(spec.url);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (/ECONNREFUSED|ENOTFOUND|EAI_AGAIN|fetch failed/i.test(message)) {
+        throw new UpstreamError(serverName, "unreachable", `OAuth discovery failed: ${message}`);
+      }
+      throw new UpstreamError(serverName, "upstream_error", `OAuth discovery failed: ${message}`);
+    }
+    try {
+      const refreshed = await refreshAuthorization(serverInfo.authorizationServerUrl, {
+        metadata: serverInfo.authorizationServerMetadata,
+        clientInformation,
+        refreshToken: stored.tokens.refresh_token,
+        resource: serverInfo.resourceMetadata?.resource ? new URL(serverInfo.resourceMetadata.resource) : undefined
+      });
+      provider.saveTokens(refreshed);
+      return refreshed.access_token;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (/invalid_grant|invalid_client|4\d{2}/i.test(message)) {
+        throw new UpstreamError(serverName, "auth_expired", `OAuth refresh failed: ${message}`);
+      }
+      if (/ECONNREFUSED|ENOTFOUND|EAI_AGAIN|fetch failed/i.test(message)) {
+        throw new UpstreamError(serverName, "unreachable", `OAuth refresh failed: ${message}`);
+      }
+      throw new UpstreamError(serverName, "upstream_error", `OAuth refresh failed: ${message}`);
     }
-    throw new Error(`No OAuth refresh token stored for "${serverName}". Re-authentication required.`);
-  }
-  const provider = new McpxOAuthProvider(serverName, secrets);
-  const clientInformation = provider.clientInformation();
-  if (!clientInformation) {
-    throw new Error(`No OAuth client information stored for "${serverName}". Re-authentication required.`);
   }
-  const cachedDiscovery = provider.discoveryState();
-  const serverInfo = cachedDiscovery ?? await discoverOAuthServerInfo(spec.url);
-  const refreshed = await refreshAuthorization(serverInfo.authorizationServerUrl, {
-    metadata: serverInfo.authorizationServerMetadata,
-    clientInformation,
-    refreshToken: stored.tokens.refresh_token,
-    resource: serverInfo.resourceMetadata?.resource ? new URL(serverInfo.resourceMetadata.resource) : undefined
-  });
-  provider.saveTokens(refreshed);
-  return refreshed.access_token;
+  return stored.tokens.access_token;
 }
 
-// src/version.ts
-var APP_VERSION = "0.1.3";
-
 // src/core/update.ts
-import fs2 from "node:fs";
-import path2 from "node:path";
+import fs3 from "node:fs";
+import path3 from "node:path";
 import { execFileSync } from "node:child_process";
 function compareVersions(a, b) {
   const partsA = a.split(".").map(Number);
@@ -721,17 +873,17 @@ async function checkForUpdates() {
 }
 function getStagedUpdate() {
   const stagedPath = getStagedVersionPath();
-  if (!fs2.existsSync(stagedPath)) {
+  if (!fs3.existsSync(stagedPath)) {
     return null;
   }
   try {
-    const raw = fs2.readFileSync(stagedPath, "utf8");
+    const raw = fs3.readFileSync(stagedPath, "utf8");
     const info = JSON.parse(raw);
     if (!info.version || !info.cliPath) {
       return null;
     }
-    const absoluteCliPath = path2.isAbsolute(info.cliPath) ? info.cliPath : path2.join(getUpdatesDir(), info.cliPath);
-    if (!fs2.existsSync(absoluteCliPath)) {
+    const absoluteCliPath = path3.isAbsolute(info.cliPath) ? info.cliPath : path3.join(getUpdatesDir(), info.cliPath);
+    if (!fs3.existsSync(absoluteCliPath)) {
       return null;
     }
     return {
@@ -747,18 +899,18 @@ function stageUpdate(version, cliPath) {
   ensureDir(updatesDir);
   const stagedInfo = {
     version,
-    cliPath: path2.isAbsolute(cliPath) ? path2.relative(updatesDir, cliPath) : cliPath,
+    cliPath: path3.isAbsolute(cliPath) ? path3.relative(updatesDir, cliPath) : cliPath,
     stagedAt: new Date().toISOString()
   };
-  fs2.writeFileSync(getStagedVersionPath(), JSON.stringify(stagedInfo, null, 2), "utf8");
+  fs3.writeFileSync(getStagedVersionPath(), JSON.stringify(stagedInfo, null, 2), "utf8");
 }
 function shouldUseStagedCli(stagedVersion, currentVersion) {
   return compareVersions(stagedVersion, currentVersion) > 0;
 }
 function clearStagedUpdate() {
   const stagedPath = getStagedVersionPath();
-  if (fs2.existsSync(stagedPath)) {
-    fs2.unlinkSync(stagedPath);
+  if (fs3.existsSync(stagedPath)) {
+    fs3.unlinkSync(stagedPath);
   }
 }
 function getStagedCliPath() {
@@ -767,59 +919,59 @@ function getStagedCliPath() {
 }
 function removeOldVersions(keepCount = 2) {
   const updatesDir = getUpdatesDir();
-  if (!fs2.existsSync(updatesDir)) {
+  if (!fs3.existsSync(updatesDir)) {
     return;
   }
-  const entries = fs2.readdirSync(updatesDir, { withFileTypes: true });
+  const entries = fs3.readdirSync(updatesDir, { withFileTypes: true });
   const versionDirs = entries.filter((entry) => entry.isDirectory() && entry.name.startsWith("v")).map((entry) => entry.name).sort((a, b) => compareVersions(b.slice(1), a.slice(1)));
   if (versionDirs.length <= keepCount) {
     return;
   }
   for (const oldVersion of versionDirs.slice(keepCount)) {
-    const oldPath = path2.join(updatesDir, oldVersion);
+    const oldPath = path3.join(updatesDir, oldVersion);
     try {
-      fs2.rmSync(oldPath, { recursive: true, force: true });
+      fs3.rmSync(oldPath, { recursive: true, force: true });
     } catch {}
   }
 }
 
 // src/core/update-manager.ts
-import fs3 from "node:fs";
-import path3 from "node:path";
+import fs4 from "node:fs";
+import path4 from "node:path";
 import { execSync, spawn } from "node:child_process";
-function acquireLock() {
+function acquireLock2() {
   const lockPath = getUpdateLockPath();
   try {
-    ensureDir(path3.dirname(lockPath));
-    fs3.writeFileSync(lockPath, `${process.pid}
+    ensureDir(path4.dirname(lockPath));
+    fs4.writeFileSync(lockPath, `${process.pid}
 `, { flag: "wx" });
     return true;
   } catch {
     return false;
   }
 }
-function releaseLock() {
+function releaseLock2() {
   const lockPath = getUpdateLockPath();
   try {
-    fs3.unlinkSync(lockPath);
+    fs4.unlinkSync(lockPath);
   } catch {}
 }
 function isUpdateInProgress() {
   const lockPath = getUpdateLockPath();
-  if (!fs3.existsSync(lockPath)) {
+  if (!fs4.existsSync(lockPath)) {
     return false;
   }
   try {
-    const raw = fs3.readFileSync(lockPath, "utf8").trim();
+    const raw = fs4.readFileSync(lockPath, "utf8").trim();
     const pid = Number(raw);
     if (!Number.isFinite(pid) || pid <= 0) {
-      fs3.unlinkSync(lockPath);
+      fs4.unlinkSync(lockPath);
       return false;
     }
     process.kill(pid, 0);
     return true;
   } catch {
-    fs3.unlinkSync(lockPath);
+    fs4.unlinkSync(lockPath);
     return false;
   }
 }
@@ -830,8 +982,8 @@ async function downloadAndStageUpdate() {
   }
   const targetVersion = updateStatus.latestVersion;
   const updatesDir = getUpdatesDir();
-  const versionDir = path3.join(updatesDir, `v${targetVersion}`);
-  if (fs3.existsSync(versionDir)) {
+  const versionDir = path4.join(updatesDir, `v${targetVersion}`);
+  if (fs4.existsSync(versionDir)) {
     const existingStaged = getStagedUpdate();
     if (existingStaged?.version === targetVersion) {
       return { success: false, error: `Version ${targetVersion} already staged` };
@@ -843,8 +995,8 @@ async function downloadAndStageUpdate() {
       cwd: versionDir,
       stdio: ["pipe", "pipe", "pipe"]
     });
-    const tarballPath = path3.join(versionDir, `kwonye-mcpx-${targetVersion}.tgz`);
-    if (!fs3.existsSync(tarballPath)) {
+    const tarballPath = path4.join(versionDir, `kwonye-mcpx-${targetVersion}.tgz`);
+    if (!fs4.existsSync(tarballPath)) {
       throw new Error("Downloaded tarball not found");
     }
     execSync(`tar -xzf ${tarballPath} --strip-components=1`, {
@@ -855,16 +1007,24 @@ async function downloadAndStageUpdate() {
       cwd: versionDir,
       stdio: ["pipe", "pipe", "pipe"]
     });
-    const cliPath = path3.join(versionDir, "dist", "cli.js");
-    if (!fs3.existsSync(cliPath)) {
+    const cliPath = path4.join(versionDir, "dist", "cli.js");
+    if (!fs4.existsSync(cliPath)) {
       throw new Error("CLI entry point not found in downloaded package");
     }
+    try {
+      execSync(`${process.execPath} ${JSON.stringify(cliPath)} --version`, {
+        stdio: ["ignore", "pipe", "pipe"],
+        timeout: 1e4
+      });
+    } catch (smokeTestError) {
+      throw new Error(`Downloaded CLI failed smoke test (--version): ${smokeTestError instanceof Error ? smokeTestError.message : String(smokeTestError)}`);
+    }
     stageUpdate(targetVersion, cliPath);
     removeOldVersions(2);
     return { success: true, version: targetVersion };
   } catch (error) {
     try {
-      fs3.rmSync(versionDir, { recursive: true, force: true });
+      fs4.rmSync(versionDir, { recursive: true, force: true });
     } catch {}
     return {
       success: false,
@@ -873,10 +1033,13 @@ async function downloadAndStageUpdate() {
   }
 }
 function startBackgroundUpdateCheck() {
+  if (process.env.MCPX_NO_UPDATE === "1") {
+    return;
+  }
   if (isUpdateInProgress()) {
     return;
   }
-  if (!acquireLock()) {
+  if (!acquireLock2()) {
     return;
   }
   const child = spawn(process.execPath, [
@@ -893,7 +1056,7 @@ function startBackgroundUpdateCheck() {
   });
   child.unref();
   setTimeout(() => {
-    releaseLock();
+    releaseLock2();
   }, 60000);
 }
 async function runBackgroundUpdate() {
@@ -907,27 +1070,34 @@ async function runBackgroundUpdate() {
   } catch (error) {
     console.error(`[update-manager] Background update failed: ${error instanceof Error ? error.message : String(error)}`);
   } finally {
-    releaseLock();
+    releaseLock2();
   }
 }
 async function performUpdate() {
   if (isUpdateInProgress()) {
     return { success: false, message: "Another update is already in progress." };
   }
-  const result = await downloadAndStageUpdate();
-  if (result.success && result.version) {
+  if (!acquireLock2()) {
+    return { success: false, message: "Another update is already in progress." };
+  }
+  try {
+    const result = await downloadAndStageUpdate();
+    if (result.success && result.version) {
+      return {
+        success: true,
+        message: `Update to v${result.version} ready! Will activate on next run.`
+      };
+    }
+    if (result.error === "No update available") {
+      return { success: true, message: "Already on latest version." };
+    }
     return {
-      success: true,
-      message: `Update to v${result.version} ready! Will activate on next run.`
+      success: false,
+      message: result.error ?? "Update failed"
     };
+  } finally {
+    releaseLock2();
   }
-  if (result.error === "No update available") {
-    return { success: true, message: "Already on latest version." };
-  }
-  return {
-    success: false,
-    message: result.error ?? "Update failed"
-  };
 }
 function performRollback() {
   const currentStaged = getStagedUpdate();
@@ -942,9 +1112,9 @@ function performRollback() {
 }
 
 // src/core/daemon.ts
-import fs4 from "node:fs";
+import fs5 from "node:fs";
 import net from "node:net";
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn2, execFileSync as execFileSync2 } from "node:child_process";
 
 // src/gateway/server.ts
 import http2 from "node:http";
@@ -964,19 +1134,6 @@ var OAUTH_WELL_KNOWN_PREFIXES = [
   "/.well-known/oauth-authorization-server",
   "/.well-known/openid-configuration"
 ];
-
-class UpstreamHttpError extends Error {
-  status;
-  wwwAuthenticate;
-  bodyText;
-  constructor(upstreamName, status, bodyText, wwwAuthenticate) {
-    super(`Upstream ${upstreamName} returned HTTP ${status}: ${bodyText.slice(0, 400)}`);
-    this.name = "UpstreamHttpError";
-    this.status = status;
-    this.bodyText = bodyText;
-    this.wwwAuthenticate = wwwAuthenticate;
-  }
-}
 function makeError(id, code, message, data) {
   return {
     jsonrpc: "2.0",
@@ -1135,8 +1292,8 @@ async function getUpstreamTokenCounts(config, secrets, runtime) {
     const fingerprint = specFingerprint(upstream.spec);
     const cached = runtime.tokenCache.get(upstream.name);
     if (cached?.fingerprint === fingerprint) {
-      const runtimeError2 = runtime.upstreamErrors?.get(upstream.name);
-      results[upstream.name] = runtimeError2 ? { ...cached.count, runtimeError: runtimeError2 } : cached.count;
+      const runtimeErr2 = runtime.upstreamErrors?.get(upstream.name);
+      results[upstream.name] = runtimeErr2 ? { ...cached.count, runtimeError: runtimeErr2.message, runtimeErrorCode: runtimeErr2.code } : cached.count;
       continue;
     }
     let toolsCount = 0;
@@ -1178,8 +1335,8 @@ async function getUpstreamTokenCounts(config, secrets, runtime) {
     if (errors.length === 0) {
       runtime.tokenCache.set(upstream.name, { fingerprint, count: countObj });
     }
-    const runtimeError = runtime.upstreamErrors?.get(upstream.name);
-    results[upstream.name] = runtimeError ? { ...countObj, runtimeError } : countObj;
+    const runtimeErr = runtime.upstreamErrors?.get(upstream.name);
+    results[upstream.name] = runtimeErr ? { ...countObj, runtimeError: runtimeErr.message, runtimeErrorCode: runtimeErr.code } : countObj;
   }
   return results;
 }
@@ -1199,11 +1356,41 @@ function withTimeout(work, timeoutMs, timeoutMessage) {
     });
   });
 }
-function specFingerprint(spec) {
-  return JSON.stringify(spec);
+function specFingerprint(spec, secrets) {
+  if (!secrets)
+    return JSON.stringify(spec);
+  const resolvedMarkers = {};
+  const collect = (obj) => {
+    if (!obj)
+      return;
+    for (const [key, value] of Object.entries(obj)) {
+      if (value.startsWith("secret://") || value.startsWith("oauth://")) {
+        try {
+          resolvedMarkers[key] = secrets.resolveMaybeSecret(value);
+        } catch {
+          resolvedMarkers[key] = value;
+        }
+      }
+    }
+  };
+  if (spec.transport === "stdio")
+    collect(spec.env);
+  if (spec.transport === "http")
+    collect(spec.headers);
+  return JSON.stringify({ spec, resolvedMarkers });
 }
+var EXTRA_INHERITED_ENV = ["TMPDIR", "LANG"];
 function resolveStdioEnv(spec, secrets) {
   const env = getDefaultEnvironment();
+  for (const key of EXTRA_INHERITED_ENV) {
+    const value = process.env[key];
+    if (value)
+      env[key] = value;
+  }
+  for (const [key, value] of Object.entries(process.env)) {
+    if (key.startsWith("LC_") && value)
+      env[key] = value;
+  }
   env.PATH = buildEnrichedPath(env.PATH);
   for (const [key, value] of Object.entries(spec.env ?? {})) {
     env[key] = secrets.resolveMaybeSecret(value);
@@ -1348,11 +1535,8 @@ async function callUpstreamOnce(upstream, method, params, secrets, runtime, pass
     if (!forceOAuthRefresh && hasOAuth && error instanceof StreamableHTTPError && (error.code === 401 || error.code === 403)) {
       return callUpstreamOnce(upstream, method, params, secrets, runtime, passthroughAuthorizationHeader, true);
     }
-    if (upstream.spec.transport === "http" && error instanceof StreamableHTTPError && error.code) {
-      const wwwAuthenticate = runtime.lastWwwAuthenticate?.get(upstream.name);
-      throw new UpstreamHttpError(upstream.name, error.code, error.message ?? "", wwwAuthenticate);
-    }
-    throw error;
+    const wwwAuthenticate = runtime.lastWwwAuthenticate?.get(upstream.name);
+    throw classifyUpstreamError(upstream.name, error, wwwAuthenticate);
   }
 }
 function authHeaderIsValid(request, expectedToken) {
@@ -1371,7 +1555,7 @@ function authHeaderIsValid(request, expectedToken) {
   return scheme === "Bearer" && token === expectedToken;
 }
 function isAuthChallenge(error) {
-  return error instanceof UpstreamHttpError && (error.status === 401 || error.status === 403);
+  return error instanceof UpstreamError && (error.code === "auth_required" || error.code === "auth_expired");
 }
 function getClientAuthorizationForUpstream(request, expectedToken) {
   const authHeader = request.headers.authorization;
@@ -1412,10 +1596,15 @@ async function handleListTools(config, secrets, runtime, upstreamFilter, clientA
       if (upstreams.length === 1) {
         throw error;
       }
-      runtime.upstreamErrors?.set(upstream.name, error instanceof Error ? error.message : String(error));
+      const code = error instanceof UpstreamError ? error.code : "upstream_error";
+      runtime.upstreamErrors?.set(upstream.name, { code, message: error instanceof Error ? error.message : String(error) });
     }
   }
-  return { tools };
+  const failedUpstreams = upstreams.filter((u) => runtime.upstreamErrors?.has(u.name)).map((u) => ({ name: u.name, ...runtime.upstreamErrors.get(u.name) }));
+  return {
+    tools,
+    ...failedUpstreams.length > 0 ? { _meta: { mcpxUpstreamErrors: failedUpstreams } } : {}
+  };
 }
 async function handleListResources(config, secrets, runtime, upstreamFilter, clientAuthorizationHeader) {
   const resources = [];
@@ -1447,10 +1636,15 @@ async function handleListResources(config, secrets, runtime, upstreamFilter, cli
       if (upstreams.length === 1) {
         throw error;
       }
-      runtime.upstreamErrors?.set(upstream.name, error instanceof Error ? error.message : String(error));
+      const code = error instanceof UpstreamError ? error.code : "upstream_error";
+      runtime.upstreamErrors?.set(upstream.name, { code, message: error instanceof Error ? error.message : String(error) });
     }
   }
-  return { resources };
+  const failedUpstreams = upstreams.filter((u) => runtime.upstreamErrors?.has(u.name)).map((u) => ({ name: u.name, ...runtime.upstreamErrors.get(u.name) }));
+  return {
+    resources,
+    ...failedUpstreams.length > 0 ? { _meta: { mcpxUpstreamErrors: failedUpstreams } } : {}
+  };
 }
 async function handleListPrompts(config, secrets, runtime, upstreamFilter, clientAuthorizationHeader) {
   const prompts = [];
@@ -1480,10 +1674,15 @@ async function handleListPrompts(config, secrets, runtime, upstreamFilter, clien
       if (upstreams.length === 1) {
         throw error;
       }
-      runtime.upstreamErrors?.set(upstream.name, error instanceof Error ? error.message : String(error));
+      const code = error instanceof UpstreamError ? error.code : "upstream_error";
+      runtime.upstreamErrors?.set(upstream.name, { code, message: error instanceof Error ? error.message : String(error) });
     }
   }
-  return { prompts };
+  const failedUpstreams = upstreams.filter((u) => runtime.upstreamErrors?.has(u.name)).map((u) => ({ name: u.name, ...runtime.upstreamErrors.get(u.name) }));
+  return {
+    prompts,
+    ...failedUpstreams.length > 0 ? { _meta: { mcpxUpstreamErrors: failedUpstreams } } : {}
+  };
 }
 async function routeNamespacedCall(config, method, params, id, secrets, runtime, upstreamFilter, clientAuthorizationHeader) {
   if (!params || typeof params !== "object") {
@@ -1521,8 +1720,9 @@ async function routeNamespacedCall(config, method, params, id, secrets, runtime,
       if (isAuthChallenge(error)) {
         throw error;
       }
-      runtime.upstreamErrors?.set(upstream2.name, error.message);
-      return makeError(id, -32000, error.message);
+      const errCode = error instanceof UpstreamError ? error.code : "upstream_error";
+      runtime.upstreamErrors?.set(upstream2.name, { code: errCode, message: error.message });
+      return makeError(id, -32000, error.message, { mcpxCode: errCode, upstream: upstream2.name });
     }
   }
   if (method === "prompts/get") {
@@ -1554,8 +1754,9 @@ async function routeNamespacedCall(config, method, params, id, secrets, runtime,
       if (isAuthChallenge(error)) {
         throw error;
       }
-      runtime.upstreamErrors?.set(upstream2.name, error.message);
-      return makeError(id, -32000, error.message);
+      const errCode = error instanceof UpstreamError ? error.code : "upstream_error";
+      runtime.upstreamErrors?.set(upstream2.name, { code: errCode, message: error.message });
+      return makeError(id, -32000, error.message, { mcpxCode: errCode, upstream: upstream2.name });
     }
   }
   const uri = typeof params.uri === "string" ? params.uri : "";
@@ -1586,8 +1787,9 @@ async function routeNamespacedCall(config, method, params, id, secrets, runtime,
     if (isAuthChallenge(error)) {
       throw error;
     }
-    runtime.upstreamErrors?.set(upstream.name, error.message);
-    return makeError(id, -32000, error.message);
+    const errCode = error instanceof UpstreamError ? error.code : "upstream_error";
+    runtime.upstreamErrors?.set(upstream.name, { code: errCode, message: error.message });
+    return makeError(id, -32000, error.message, { mcpxCode: errCode, upstream: upstream.name });
   }
 }
 async function handleRequestObject(request, secrets, runtime, upstreamFilter, clientAuthorizationHeader) {
@@ -1754,6 +1956,16 @@ function createGatewayServer(options) {
           }
           return;
         }
+        const wantsStream = (request.headers.accept ?? "").includes("text/event-stream");
+        if (wantsStream && request.headers["mcp-session-id"]) {
+          response.statusCode = 405;
+          response.setHeader("content-type", "application/json");
+          response.end(JSON.stringify({ error: "get_stream_not_supported", message: "mcpx does not support server-initiated SSE streams over GET; use POST for all requests." }));
+          if (debug) {
+            console.error(`[mcpx gateway] -> 405 (GET stream not supported)`);
+          }
+          return;
+        }
         response.statusCode = 200;
         response.setHeader("content-type", "application/json");
         response.end(JSON.stringify({ ok: true, server: "mcpx" }));
@@ -1858,16 +2070,16 @@ function createGatewayServer(options) {
       }
     } catch (error) {
       if (isAuthChallenge(error)) {
-        response.statusCode = error.status;
+        response.statusCode = error.status ?? 401;
         response.setHeader("content-type", "application/json");
         if (error.wwwAuthenticate) {
           const localResourceMetadataUrl = appendUpstreamQuery(`${getLocalOriginFromRequest(request)}/.well-known/oauth-protected-resource`, getRequestedUpstream(requestUrl));
           response.setHeader("www-authenticate", rewriteWwwAuthenticateResourceMetadata(error.wwwAuthenticate, localResourceMetadataUrl));
         }
         response.end(JSON.stringify(makeError(null, -32001, "Upstream authentication required.", {
+          mcpxCode: error.code,
           status: error.status,
-          body: error.bodyText,
-          wwwAuthenticate: error.wwwAuthenticate
+          upstream: error.upstream
         })));
         if (debug) {
           console.error(`[mcpx gateway] -> ${error.status} upstream auth challenge`);
@@ -1893,19 +2105,24 @@ function createGatewayServer(options) {
 }
 
 // src/core/daemon.ts
-function readPidFromFile(pidPath = getPidPath()) {
-  if (!fs4.existsSync(pidPath)) {
+function readPidRecordFromFile(pidPath = getPidPath()) {
+  if (!fs5.existsSync(pidPath)) {
     return null;
   }
-  const raw = fs4.readFileSync(pidPath, "utf8").trim();
+  const raw = fs5.readFileSync(pidPath, "utf8").trim();
   if (!raw) {
     return null;
   }
-  const pid = Number(raw);
+  const [pidRaw, portRaw] = raw.split(":");
+  const pid = Number(pidRaw);
   if (!Number.isFinite(pid) || pid <= 0) {
     return null;
   }
-  return pid;
+  const port = portRaw ? Number(portRaw) : null;
+  return { pid, port: Number.isFinite(port) && port > 0 ? port : null };
+}
+function readPidFromFile(pidPath = getPidPath()) {
+  return readPidRecordFromFile(pidPath)?.pid ?? null;
 }
 function processExists(pid) {
   try {
@@ -1927,9 +2144,9 @@ async function isPortAvailable(port) {
     tester.listen(port, "127.0.0.1");
   });
 }
-async function resolveGatewayPort(config) {
+async function resolveGatewayPort(config, secrets) {
   if (await isPortAvailable(config.gateway.port)) {
-    return config.gateway.port;
+    return { port: config.gateway.port };
   }
   for (let offset = 1;offset <= 20; offset += 1) {
     const candidate = config.gateway.port + offset;
@@ -1937,9 +2154,17 @@ async function resolveGatewayPort(config) {
       break;
     }
     if (await isPortAvailable(candidate)) {
+      const oldPort = config.gateway.port;
       config.gateway.port = candidate;
       saveConfig(config);
-      return candidate;
+      if (secrets) {
+        try {
+          const summary = syncAllClients(config, secrets);
+          persistSyncState(summary, config);
+          saveConfig(config);
+        } catch {}
+      }
+      return { port: candidate, fellBackFrom: oldPort };
     }
   }
   throw new Error(`No available local port found near ${config.gateway.port}.`);
@@ -1969,8 +2194,8 @@ async function waitForGatewayReady(port, token, timeoutMs = 5000) {
 }
 function getDaemonStatus(config) {
   const pidPath = getPidPath();
-  const pid = readPidFromFile(pidPath);
-  if (!pid) {
+  const record = readPidRecordFromFile(pidPath);
+  if (!record) {
     return {
       running: false,
       pidFile: pidPath,
@@ -1978,12 +2203,15 @@ function getDaemonStatus(config) {
       port: config.gateway.port
     };
   }
+  const running = processExists(record.pid);
+  const port = record.port ?? config.gateway.port;
   return {
-    running: processExists(pid),
-    pid,
+    running,
+    pid: record.pid,
     pidFile: pidPath,
     logFile: getLogPath(),
-    port: config.gateway.port
+    port,
+    portMismatch: running && record.port !== null && record.port !== config.gateway.port
   };
 }
 async function startDaemon(config, cliPath, secrets) {
@@ -1999,16 +2227,38 @@ async function startDaemon(config, cliPath, secrets) {
       };
     }
     try {
-      fs4.unlinkSync(getPidPath());
+      fs5.unlinkSync(getPidPath());
     } catch {}
   }
-  const port = await resolveGatewayPort(config);
+  const { port, fellBackFrom } = await resolveGatewayPort(config, secrets);
+  if (fellBackFrom) {
+    process.stderr.write(`mcpx: port ${fellBackFrom} was unavailable; gateway started on ${port} instead. All client configs were re-synced to the new port.
+`);
+  }
   const token = ensureGatewayToken(config, secrets);
   const pidPath = getPidPath();
   const logPath = getLogPath();
   ensureParentDir(pidPath);
   ensureParentDir(logPath);
-  const logFd = fs4.openSync(logPath, "a", 384);
+  let logFd = fs5.openSync(logPath, "a", 384);
+  const logStat = fs5.fstatSync(logFd);
+  if (logStat.size > 10 * 1024 * 1024) {
+    fs5.closeSync(logFd);
+    const log1 = `${logPath}.1`;
+    const log2 = `${logPath}.2`;
+    try {
+      if (fs5.existsSync(log2))
+        fs5.unlinkSync(log2);
+    } catch {}
+    try {
+      if (fs5.existsSync(log1))
+        fs5.renameSync(log1, log2);
+    } catch {}
+    try {
+      fs5.renameSync(logPath, log1);
+    } catch {}
+    logFd = fs5.openSync(logPath, "a", 384);
+  }
   const child = spawn2(process.execPath, [cliPath, "daemon", "run", "--port", String(port)], {
     detached: true,
     stdio: ["ignore", logFd, logFd],
@@ -2018,7 +2268,7 @@ async function startDaemon(config, cliPath, secrets) {
     }
   });
   child.unref();
-  fs4.writeFileSync(pidPath, `${child.pid}
+  fs5.writeFileSync(pidPath, `${child.pid}:${port}
 `, { mode: 384 });
   startBackgroundUpdateCheck();
   await waitForGatewayReady(port, token);
@@ -2038,11 +2288,30 @@ function stopDaemon() {
       message: "mcpx daemon is not running."
     };
   }
+  try {
+    const cmd = execFileSync2("ps", ["-p", String(pid), "-o", "command="], { encoding: "utf8", timeout: 2000 }).trim();
+    const looksLikeMcpxDaemon = cmd.includes("daemon run") && (cmd.includes("mcpx") || cmd.includes("cli.js"));
+    if (!looksLikeMcpxDaemon) {
+      fs5.unlinkSync(pidPath);
+      return {
+        stopped: false,
+        message: `PID ${pid} is not a mcpx daemon (command: ${cmd.slice(0, 80)}). Pidfile cleaned up.`
+      };
+    }
+  } catch {
+    try {
+      fs5.unlinkSync(pidPath);
+    } catch {}
+    return {
+      stopped: false,
+      message: `PID ${pid} not found. Pidfile cleaned up.`
+    };
+  }
   try {
     process.kill(pid, "SIGTERM");
   } catch {}
   try {
-    fs4.unlinkSync(pidPath);
+    fs5.unlinkSync(pidPath);
   } catch {}
   return {
     stopped: true,
@@ -2055,10 +2324,10 @@ async function restartDaemon(config, cliPath, secrets) {
 }
 function readDaemonLogs(maxLines = 200) {
   const logPath = getLogPath();
-  if (!fs4.existsSync(logPath)) {
+  if (!fs5.existsSync(logPath)) {
     return "";
   }
-  const lines = fs4.readFileSync(logPath, "utf8").split(`
+  const lines = fs5.readFileSync(logPath, "utf8").split(`
 `);
   return lines.slice(Math.max(lines.length - maxLines, 0)).join(`
 `);
@@ -2083,7 +2352,7 @@ function runDaemonForeground(config, port, secrets) {
 }
 
 // src/core/status.ts
-var STATUS_CLIENTS = ["claude", "claude-desktop", "codex", "cursor", "cline", "opencode", "kiro", "vscode", "qwen"];
+var STATUS_CLIENTS = ["claude", "claude-desktop", "codex", "cursor", "cline", "opencode", "kiro", "vscode", "qwen", "openclaw", "hermes"];
 function describeServerTarget(spec) {
   if (spec.transport === "http") {
     return spec.url;
@@ -2136,15 +2405,15 @@ async function fetchTokenCounts(gatewayUrl, token) {
         method: "custom/tokenCounts",
         params: {}
       }),
-      signal: AbortSignal.timeout(4000)
+      signal: AbortSignal.timeout(65000)
     });
     if (!res.ok) {
-      return {};
+      return { counts: {}, fetchError: `HTTP ${res.status}` };
     }
     const data = await res.json();
-    return data?.result ?? {};
+    return { counts: data?.result ?? {} };
   } catch (error) {
-    return {};
+    return { counts: {}, fetchError: error instanceof Error ? error.message : String(error) };
   }
 }
 async function buildStatusReport(config, managedIndex, daemon = getDaemonStatus(config)) {
@@ -2152,8 +2421,11 @@ async function buildStatusReport(config, managedIndex, daemon = getDaemonStatus(
   const token = ensureGatewayToken(config, secrets);
   const gatewayUrl = getGatewayUrl(config);
   let tokenCounts = {};
+  let tokenCountFetchError;
   if (daemon.running) {
-    tokenCounts = await fetchTokenCounts(gatewayUrl, token);
+    const result = await fetchTokenCounts(gatewayUrl, token);
+    tokenCounts = result.counts;
+    tokenCountFetchError = result.fetchError;
   }
   const projectEntries = Object.values(config.projects ?? {});
   let totalGlobalTokens = 0;
@@ -2165,6 +2437,7 @@ async function buildStatusReport(config, managedIndex, daemon = getDaemonStatus(
     if (tokenCount?.error && buildAuthBindings(spec).length > 0 && tokenCount.total > 0) {
       tokenCount = { ...tokenCount, error: undefined };
     }
+    const health = tokenCount ? tokenCount.error || tokenCount.runtimeError ? "error" : "ok" : "unknown";
     const serverEntry = {
       name,
       enabled: isServerEnabled(spec),
@@ -2172,7 +2445,8 @@ async function buildStatusReport(config, managedIndex, daemon = getDaemonStatus(
       target: describeServerTarget(spec),
       authBindings: buildAuthBindings(spec),
       clients: buildClientMappings(config, managedIndex, name),
-      tokenCount
+      tokenCount,
+      health
     };
     if (serverEntry.enabled && tokenCount) {
       totalGlobalTokens += tokenCount.total;
@@ -2196,4 +2470,4 @@ async function buildStatusReport(config, managedIndex, daemon = getDaemonStatus(
   };
 }
 
-export { probeHttpAuthRequirement, fetchRegistryServerDetail, selectBestPackage, extractRequiredInputs, mapRegistryToSpec, toSecretRef, secretRefName, defaultAuthSecretName, resolveAuthTarget, applyAuthReference, removeAuthReference, listAuthBindings, maybePrefixBearer, buildEnrichedPath, isOAuthReference, oauthReferenceServerName, runOAuthLogin, getOAuthAccessToken, APP_VERSION, compareVersions, checkForUpdates, getStagedUpdate, shouldUseStagedCli, clearStagedUpdate, getStagedCliPath, startBackgroundUpdateCheck, runBackgroundUpdate, performUpdate, performRollback, getDaemonStatus, startDaemon, stopDaemon, restartDaemon, readDaemonLogs, runDaemonForeground, STATUS_CLIENTS, buildStatusReport };
+export { mutateConfig, mutateProjectConfig, mutateActiveConfig, probeHttpAuthRequirement, fetchRegistryServerDetail, selectBestPackage, extractRequiredInputs, mapRegistryToSpec, toSecretRef, secretRefName, defaultAuthSecretName, resolveAuthTarget, applyAuthReference, removeAuthReference, listAuthBindings, maybePrefixBearer, buildEnrichedPath, isOAuthReference, oauthReferenceServerName, runOAuthLogin, getOAuthAccessToken, compareVersions, checkForUpdates, getStagedUpdate, shouldUseStagedCli, clearStagedUpdate, getStagedCliPath, startBackgroundUpdateCheck, runBackgroundUpdate, performUpdate, performRollback, getDaemonStatus, startDaemon, stopDaemon, restartDaemon, readDaemonLogs, runDaemonForeground, STATUS_CLIENTS, buildStatusReport };