@mastra/code-sdk 0.0.0-esbuild-bundle-worker-20260807173433

package/dist/mcp/config.js

@@ -0,0 +1,240 @@
+import { DEFAULT_CONFIG_DIR } from "../constants.js";
+import * as fs$1 from "fs";
+import * as os$1 from "os";
+import * as path$1 from "path";
+//#region src/mcp/config.ts
+/**
+* MCP server configuration loading from filesystem.
+* Loads from:
+*   1. .claude/settings.local.json  (Claude Code compat — lowest priority)
+*   2. ~/.mastracode/mcp.json       (global)
+*   3. .mcp.json                    (project root — Claude Code compatible)
+*   4. .mastracode/mcp.json         (project — highest priority)
+*
+* Higher-priority configs override lower ones by server name. The project root
+* `.mcp.json` is read so a project that already keeps MCP servers there for
+* Claude Code does not need to duplicate them under `.mastracode/`.
+*/
+/**
+* Default OAuth redirect URL for servers that do not configure one.
+* Port 1458 is stable across sessions so persisted tokens keep the same
+* storage fingerprint; it sits clear of the ports the Codex login flow
+* reserves (1455/1457). When 1458 is busy the callback server falls back
+* to the next sequential port, which stays covered by the client
+* registration (see `@mastra/mcp`'s `getCallbackUrlCandidates`).
+*/
+const DEFAULT_OAUTH_REDIRECT_URL = "http://127.0.0.1:1458/oauth/callback";
+const LOOPBACK_IPV4 = /^127\.(?:\d{1,3})\.(?:\d{1,3})\.(?:\d{1,3})$/;
+function isLoopbackHostname(hostname) {
+	return hostname === "localhost" || hostname === "[::1]" || hostname === "::1" || LOOPBACK_IPV4.test(hostname);
+}
+/**
+* Resolve the effective OAuth redirect URL for a server config.
+*
+* `callbackPort` (the Claude Code / Codex convention) takes precedence and
+* synthesizes `http://localhost:<port>/callback`. Config-file entries are
+* normalized by `parseOAuthConfig` (which also enforces that `callbackPort`
+* and `redirectUrl` are mutually exclusive), but programmatically registered
+* servers bypass the parser, so every consumer of the redirect URL must
+* resolve it through this helper rather than reading `redirectUrl` directly.
+*/
+function resolveOAuthRedirectUrl(oauth) {
+	if (oauth?.callbackPort !== void 0) return `http://localhost:${oauth.callbackPort}/callback`;
+	return oauth?.redirectUrl ?? "http://127.0.0.1:1458/oauth/callback";
+}
+function loadMcpConfig(projectDir, configDirName = DEFAULT_CONFIG_DIR) {
+	return mergeConfigs(loadClaudeSettings(projectDir), loadSingleConfig(getGlobalMcpPath(configDirName)), loadSingleConfig(getRootMcpPath(projectDir)), loadSingleConfig(getProjectMcpPath(projectDir, configDirName)));
+}
+function getProjectMcpPath(projectDir, configDirName = DEFAULT_CONFIG_DIR) {
+	return path$1.join(projectDir, configDirName, "mcp.json");
+}
+function getRootMcpPath(projectDir) {
+	return path$1.join(projectDir, ".mcp.json");
+}
+function getGlobalMcpPath(configDirName = DEFAULT_CONFIG_DIR) {
+	return path$1.join(os$1.homedir(), configDirName, "mcp.json");
+}
+function getClaudeSettingsPath(projectDir) {
+	return path$1.join(projectDir, ".claude", "settings.local.json");
+}
+function loadSingleConfig(filePath) {
+	try {
+		if (!fs$1.existsSync(filePath)) return {};
+		const raw = fs$1.readFileSync(filePath, "utf-8");
+		return validateConfig(JSON.parse(raw));
+	} catch {
+		return {};
+	}
+}
+function loadClaudeSettings(projectDir) {
+	try {
+		const filePath = getClaudeSettingsPath(projectDir);
+		if (!fs$1.existsSync(filePath)) return {};
+		const raw = fs$1.readFileSync(filePath, "utf-8");
+		const parsed = JSON.parse(raw);
+		if (parsed?.mcpServers && typeof parsed.mcpServers === "object") return validateConfig({ mcpServers: parsed.mcpServers });
+		return {};
+	} catch {
+		return {};
+	}
+}
+/**
+* Expand `${VAR}` and `${VAR:-default}` references in a string from the
+* environment, matching how Claude Code resolves values in `.mcp.json`.
+* A referenced variable that is unset or empty falls back to its default,
+* or to an empty string when no default is given.
+*/
+function expandEnvVars(value, env = process.env) {
+	return value.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}|\$([A-Za-z_][A-Za-z0-9_]*)/g, (_match, bracedName, fallback, bareName) => {
+		const resolved = env[bracedName ?? bareName];
+		if (resolved !== void 0 && resolved !== "") return resolved;
+		return fallback ?? "";
+	});
+}
+/**
+* Expand `${VAR}` and `$VAR` references in every string-valued HTTP header so that
+* secrets like API keys can be referenced from the environment instead of
+* being hardcoded in `mcp.json`.
+*/
+function expandHeaderEnvVars(headers) {
+	const expanded = {};
+	for (const [key, value] of Object.entries(headers)) if (typeof value === "string") expanded[key] = expandEnvVars(value);
+	return expanded;
+}
+/**
+* Expand `${VAR}` and `$VAR` references in every string-valued environment
+* variable passed to a stdio server, so that secrets can be referenced from the
+* host environment instead of being hardcoded in `mcp.json`.
+*/
+function expandEnvValues(env) {
+	const expanded = {};
+	for (const [key, value] of Object.entries(env)) if (typeof value === "string") expanded[key] = expandEnvVars(value);
+	return expanded;
+}
+/**
+* Classify a raw server entry as stdio, http, or skip (with reason).
+*/
+function classifyServerEntry(raw) {
+	if (!raw || typeof raw !== "object") return {
+		kind: "skip",
+		reason: "Invalid entry: expected an object"
+	};
+	const obj = raw;
+	const hasCommand = typeof obj.command === "string";
+	const hasUrl = typeof obj.url === "string";
+	if (hasCommand && hasUrl) return {
+		kind: "skip",
+		reason: "Cannot specify both \"command\" and \"url\""
+	};
+	if (hasCommand) return { kind: "stdio" };
+	if (hasUrl) {
+		try {
+			new URL(expandEnvVars(obj.url));
+		} catch {
+			return {
+				kind: "skip",
+				reason: `Invalid URL: "${obj.url}"`
+			};
+		}
+		return { kind: "http" };
+	}
+	return {
+		kind: "skip",
+		reason: "Missing required field: \"command\" (stdio) or \"url\" (http)"
+	};
+}
+function validateConfig(raw) {
+	if (!raw || typeof raw !== "object") return {};
+	const obj = raw;
+	if (!obj.mcpServers || typeof obj.mcpServers !== "object") return {};
+	const servers = {};
+	const skippedServers = [];
+	const rawServers = obj.mcpServers;
+	for (const [name, entry] of Object.entries(rawServers)) {
+		const classification = classifyServerEntry(entry);
+		if (classification.kind === "stdio") {
+			const e = entry;
+			servers[name] = {
+				command: e.command,
+				args: Array.isArray(e.args) ? e.args : void 0,
+				env: typeof e.env === "object" && e.env !== null ? expandEnvValues(e.env) : void 0
+			};
+		} else if (classification.kind === "http") {
+			const e = entry;
+			const oauthResult = parseOAuthConfig(e.oauth);
+			if (oauthResult.reason) {
+				skippedServers.push({
+					name,
+					reason: oauthResult.reason
+				});
+				continue;
+			}
+			servers[name] = {
+				url: expandEnvVars(e.url),
+				headers: typeof e.headers === "object" && e.headers !== null ? expandHeaderEnvVars(e.headers) : void 0,
+				oauth: oauthResult.config
+			};
+		} else skippedServers.push({
+			name,
+			reason: classification.reason
+		});
+	}
+	const result = {};
+	if (Object.keys(servers).length > 0) result.mcpServers = servers;
+	if (skippedServers.length > 0) result.skippedServers = skippedServers;
+	return result;
+}
+function parseOAuthConfig(raw) {
+	if (raw === void 0) return {};
+	if (!raw || typeof raw !== "object") return { reason: "Invalid OAuth config: expected an object" };
+	const obj = raw;
+	if (obj.redirectUrl !== void 0 && typeof obj.redirectUrl !== "string") return { reason: "Invalid OAuth config: \"redirectUrl\" must be a string" };
+	let callbackPortRedirectUrl;
+	if (obj.callbackPort !== void 0) {
+		if (obj.redirectUrl !== void 0) return { reason: "Invalid OAuth config: set either \"redirectUrl\" or \"callbackPort\", not both" };
+		if (typeof obj.callbackPort !== "number" || !Number.isInteger(obj.callbackPort) || obj.callbackPort < 1 || obj.callbackPort > 65535) return { reason: "Invalid OAuth config: \"callbackPort\" must be an integer between 1 and 65535" };
+		callbackPortRedirectUrl = resolveOAuthRedirectUrl({ callbackPort: obj.callbackPort });
+	}
+	const rawRedirectUrl = callbackPortRedirectUrl ?? obj.redirectUrl ?? "http://127.0.0.1:1458/oauth/callback";
+	try {
+		const redirectUrl = new URL(rawRedirectUrl);
+		const isLoopback = isLoopbackHostname(redirectUrl.hostname);
+		if (redirectUrl.protocol !== "https:" && !(redirectUrl.protocol === "http:" && isLoopback)) return { reason: "Invalid OAuth redirectUrl: must use HTTPS unless it is a loopback HTTP URL" };
+	} catch {
+		return { reason: `Invalid OAuth redirectUrl: "${rawRedirectUrl}"` };
+	}
+	if (obj.scopes !== void 0 && (!Array.isArray(obj.scopes) || obj.scopes.some((scope) => typeof scope !== "string"))) return { reason: "Invalid OAuth config: \"scopes\" must be an array of strings" };
+	return { config: {
+		redirectUrl: rawRedirectUrl,
+		clientName: typeof obj.clientName === "string" ? obj.clientName : void 0,
+		scopes: obj.scopes,
+		clientId: typeof obj.clientId === "string" ? obj.clientId : void 0,
+		clientSecret: typeof obj.clientSecret === "string" ? obj.clientSecret : void 0
+	} };
+}
+/**
+* Merge configs: claude (lowest priority) < global < project (highest).
+* Later configs override earlier by server name.
+* Skipped entries are accumulated, but if a higher-priority config provides
+* a valid entry for a skipped name, the skip is removed.
+*/
+function mergeConfigs(...configs) {
+	const merged = {};
+	const allSkipped = [];
+	for (const config of configs) {
+		if (config.mcpServers) for (const [name, server] of Object.entries(config.mcpServers)) merged[name] = server;
+		if (config.skippedServers) allSkipped.push(...config.skippedServers);
+	}
+	const validNames = new Set(Object.keys(merged));
+	const filteredSkipped = allSkipped.filter((s) => !validNames.has(s.name));
+	const skippedMap = /* @__PURE__ */ new Map();
+	for (const s of filteredSkipped) skippedMap.set(s.name, s);
+	const result = {};
+	if (Object.keys(merged).length > 0) result.mcpServers = merged;
+	if (skippedMap.size > 0) result.skippedServers = Array.from(skippedMap.values());
+	return result;
+}
+//#endregion
+export { DEFAULT_OAUTH_REDIRECT_URL, classifyServerEntry, expandEnvVars, getClaudeSettingsPath, getGlobalMcpPath, getProjectMcpPath, getRootMcpPath, loadMcpConfig, resolveOAuthRedirectUrl, validateConfig };
+
+//# sourceMappingURL=config.js.map

package/dist/mcp/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","names":["path","os","fs"],"sources":["../../src/mcp/config.ts"],"sourcesContent":["/**\n * MCP server configuration loading from filesystem.\n * Loads from:\n *   1. .claude/settings.local.json  (Claude Code compat — lowest priority)\n *   2. ~/.mastracode/mcp.json       (global)\n *   3. .mcp.json                    (project root — Claude Code compatible)\n *   4. .mastracode/mcp.json         (project — highest priority)\n *\n * Higher-priority configs override lower ones by server name. The project root\n * `.mcp.json` is read so a project that already keeps MCP servers there for\n * Claude Code does not need to duplicate them under `.mastracode/`.\n */\n\nimport * as fs from 'node:fs';\nimport * as os from 'node:os';\nimport * as path from 'node:path';\nimport { DEFAULT_CONFIG_DIR } from '../constants.js';\nimport type { McpConfig, McpHttpOAuthConfig, McpServerConfig, McpSkippedServer } from './types.js';\n\n/**\n * Default OAuth redirect URL for servers that do not configure one.\n * Port 1458 is stable across sessions so persisted tokens keep the same\n * storage fingerprint; it sits clear of the ports the Codex login flow\n * reserves (1455/1457). When 1458 is busy the callback server falls back\n * to the next sequential port, which stays covered by the client\n * registration (see `@mastra/mcp`'s `getCallbackUrlCandidates`).\n */\nexport const DEFAULT_OAUTH_REDIRECT_URL = 'http://127.0.0.1:1458/oauth/callback';\n\n// Matches the entire 127.0.0.0/8 range in dotted-quad form. `URL` normalizes\n// IPv4 hosts to four octets (so `127.1` becomes `127.0.0.1`), so anchoring the\n// pattern is enough — and it rejects lookalikes like `127.evil.com` that a\n// `startsWith('127.')` check would wrongly accept.\nconst LOOPBACK_IPV4 = /^127\\.(?:\\d{1,3})\\.(?:\\d{1,3})\\.(?:\\d{1,3})$/;\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  return hostname === 'localhost' || hostname === '[::1]' || hostname === '::1' || LOOPBACK_IPV4.test(hostname);\n}\n\n/**\n * Resolve the effective OAuth redirect URL for a server config.\n *\n * `callbackPort` (the Claude Code / Codex convention) takes precedence and\n * synthesizes `http://localhost:<port>/callback`. Config-file entries are\n * normalized by `parseOAuthConfig` (which also enforces that `callbackPort`\n * and `redirectUrl` are mutually exclusive), but programmatically registered\n * servers bypass the parser, so every consumer of the redirect URL must\n * resolve it through this helper rather than reading `redirectUrl` directly.\n */\nexport function resolveOAuthRedirectUrl(oauth: McpHttpOAuthConfig | undefined): string {\n  if (oauth?.callbackPort !== undefined) {\n    return `http://localhost:${oauth.callbackPort}/callback`;\n  }\n  return oauth?.redirectUrl ?? DEFAULT_OAUTH_REDIRECT_URL;\n}\n\nexport function loadMcpConfig(projectDir: string, configDirName = DEFAULT_CONFIG_DIR): McpConfig {\n  const claudeConfig = loadClaudeSettings(projectDir);\n  const globalConfig = loadSingleConfig(getGlobalMcpPath(configDirName));\n  const rootConfig = loadSingleConfig(getRootMcpPath(projectDir));\n  const projectConfig = loadSingleConfig(getProjectMcpPath(projectDir, configDirName));\n\n  return mergeConfigs(claudeConfig, globalConfig, rootConfig, projectConfig);\n}\n\nexport function getProjectMcpPath(projectDir: string, configDirName = DEFAULT_CONFIG_DIR): string {\n  return path.join(projectDir, configDirName, 'mcp.json');\n}\n\nexport function getRootMcpPath(projectDir: string): string {\n  return path.join(projectDir, '.mcp.json');\n}\n\nexport function getGlobalMcpPath(configDirName = DEFAULT_CONFIG_DIR): string {\n  return path.join(os.homedir(), configDirName, 'mcp.json');\n}\n\nexport function getClaudeSettingsPath(projectDir: string): string {\n  return path.join(projectDir, '.claude', 'settings.local.json');\n}\n\nfunction loadSingleConfig(filePath: string): McpConfig {\n  try {\n    if (!fs.existsSync(filePath)) return {};\n    const raw = fs.readFileSync(filePath, 'utf-8');\n    return validateConfig(JSON.parse(raw));\n  } catch {\n    return {};\n  }\n}\n\nfunction loadClaudeSettings(projectDir: string): McpConfig {\n  try {\n    const filePath = getClaudeSettingsPath(projectDir);\n    if (!fs.existsSync(filePath)) return {};\n    const raw = fs.readFileSync(filePath, 'utf-8');\n    const parsed = JSON.parse(raw);\n    // Claude Code stores mcpServers at the top level of settings\n    if (parsed?.mcpServers && typeof parsed.mcpServers === 'object') {\n      return validateConfig({ mcpServers: parsed.mcpServers });\n    }\n    return {};\n  } catch {\n    return {};\n  }\n}\n\n/**\n * Expand `${VAR}` and `${VAR:-default}` references in a string from the\n * environment, matching how Claude Code resolves values in `.mcp.json`.\n * A referenced variable that is unset or empty falls back to its default,\n * or to an empty string when no default is given.\n */\nexport function expandEnvVars(value: string, env: NodeJS.ProcessEnv = process.env): string {\n  return value.replace(\n    /\\$\\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\\}|\\$([A-Za-z_][A-Za-z0-9_]*)/g,\n    (_match, bracedName, fallback, bareName) => {\n      const name = bracedName ?? bareName;\n      const resolved = env[name];\n      if (resolved !== undefined && resolved !== '') return resolved;\n      return fallback ?? '';\n    },\n  );\n}\n\n/**\n * Expand `${VAR}` and `$VAR` references in every string-valued HTTP header so that\n * secrets like API keys can be referenced from the environment instead of\n * being hardcoded in `mcp.json`.\n */\nfunction expandHeaderEnvVars(headers: Record<string, unknown>): Record<string, string> {\n  const expanded: Record<string, string> = {};\n  for (const [key, value] of Object.entries(headers)) {\n    if (typeof value === 'string') expanded[key] = expandEnvVars(value);\n  }\n  return expanded;\n}\n\n/**\n * Expand `${VAR}` and `$VAR` references in every string-valued environment\n * variable passed to a stdio server, so that secrets can be referenced from the\n * host environment instead of being hardcoded in `mcp.json`.\n */\nfunction expandEnvValues(env: Record<string, unknown>): Record<string, string> {\n  const expanded: Record<string, string> = {};\n  for (const [key, value] of Object.entries(env)) {\n    if (typeof value === 'string') expanded[key] = expandEnvVars(value);\n  }\n  return expanded;\n}\n\n/**\n * Classify a raw server entry as stdio, http, or skip (with reason).\n */\nexport function classifyServerEntry(raw: unknown): { kind: 'stdio' | 'http' | 'skip'; reason?: string } {\n  if (!raw || typeof raw !== 'object') {\n    return { kind: 'skip', reason: 'Invalid entry: expected an object' };\n  }\n\n  const obj = raw as Record<string, unknown>;\n  const hasCommand = typeof obj.command === 'string';\n  const hasUrl = typeof obj.url === 'string';\n\n  if (hasCommand && hasUrl) {\n    return { kind: 'skip', reason: 'Cannot specify both \"command\" and \"url\"' };\n  }\n\n  if (hasCommand) {\n    return { kind: 'stdio' };\n  }\n\n  if (hasUrl) {\n    try {\n      new URL(expandEnvVars(obj.url as string));\n    } catch {\n      return { kind: 'skip', reason: `Invalid URL: \"${obj.url}\"` };\n    }\n    return { kind: 'http' };\n  }\n\n  return { kind: 'skip', reason: 'Missing required field: \"command\" (stdio) or \"url\" (http)' };\n}\n\nexport function validateConfig(raw: unknown): McpConfig {\n  if (!raw || typeof raw !== 'object') return {};\n  const obj = raw as Record<string, unknown>;\n\n  if (!obj.mcpServers || typeof obj.mcpServers !== 'object') return {};\n\n  const servers: Record<string, McpServerConfig> = {};\n  const skippedServers: McpSkippedServer[] = [];\n  const rawServers = obj.mcpServers as Record<string, unknown>;\n\n  for (const [name, entry] of Object.entries(rawServers)) {\n    const classification = classifyServerEntry(entry);\n\n    if (classification.kind === 'stdio') {\n      const e = entry as Record<string, unknown>;\n      servers[name] = {\n        command: e.command as string,\n        args: Array.isArray(e.args) ? (e.args as string[]) : undefined,\n        env:\n          typeof e.env === 'object' && e.env !== null ? expandEnvValues(e.env as Record<string, unknown>) : undefined,\n      };\n    } else if (classification.kind === 'http') {\n      const e = entry as Record<string, unknown>;\n      const oauthResult = parseOAuthConfig(e.oauth);\n      if (oauthResult.reason) {\n        skippedServers.push({ name, reason: oauthResult.reason });\n        continue;\n      }\n      servers[name] = {\n        url: expandEnvVars(e.url as string),\n        headers:\n          typeof e.headers === 'object' && e.headers !== null\n            ? expandHeaderEnvVars(e.headers as Record<string, unknown>)\n            : undefined,\n        oauth: oauthResult.config,\n      };\n    } else {\n      skippedServers.push({ name, reason: classification.reason! });\n    }\n  }\n\n  const result: McpConfig = {};\n  if (Object.keys(servers).length > 0) {\n    result.mcpServers = servers;\n  }\n  if (skippedServers.length > 0) {\n    result.skippedServers = skippedServers;\n  }\n  return result;\n}\n\nfunction parseOAuthConfig(raw: unknown): { config?: McpHttpOAuthConfig; reason?: string } {\n  if (raw === undefined) return {};\n  if (!raw || typeof raw !== 'object') {\n    return { reason: 'Invalid OAuth config: expected an object' };\n  }\n\n  const obj = raw as Record<string, unknown>;\n  if (obj.redirectUrl !== undefined && typeof obj.redirectUrl !== 'string') {\n    return { reason: 'Invalid OAuth config: \"redirectUrl\" must be a string' };\n  }\n  // `callbackPort` is a shorthand for a loopback redirect URL. It synthesizes\n  // `http://localhost:<port>/callback` — the convention Claude Code and Codex\n  // emit — so those clients' config (e.g. Slack's official MCP plugin config)\n  // can be pasted verbatim. `redirectUrl` stays as the full-control escape\n  // hatch (any loopback host/path). The two are mutually exclusive to avoid\n  // an ambiguous redirect.\n  let callbackPortRedirectUrl: string | undefined;\n  if (obj.callbackPort !== undefined) {\n    if (obj.redirectUrl !== undefined) {\n      return { reason: 'Invalid OAuth config: set either \"redirectUrl\" or \"callbackPort\", not both' };\n    }\n    if (\n      typeof obj.callbackPort !== 'number' ||\n      !Number.isInteger(obj.callbackPort) ||\n      obj.callbackPort < 1 ||\n      obj.callbackPort > 65535\n    ) {\n      return { reason: 'Invalid OAuth config: \"callbackPort\" must be an integer between 1 and 65535' };\n    }\n    callbackPortRedirectUrl = resolveOAuthRedirectUrl({ callbackPort: obj.callbackPort });\n  }\n\n  const rawRedirectUrl = callbackPortRedirectUrl ?? obj.redirectUrl ?? DEFAULT_OAUTH_REDIRECT_URL;\n  try {\n    const redirectUrl = new URL(rawRedirectUrl);\n    const isLoopback = isLoopbackHostname(redirectUrl.hostname);\n    if (redirectUrl.protocol !== 'https:' && !(redirectUrl.protocol === 'http:' && isLoopback)) {\n      return { reason: 'Invalid OAuth redirectUrl: must use HTTPS unless it is a loopback HTTP URL' };\n    }\n  } catch {\n    return { reason: `Invalid OAuth redirectUrl: \"${rawRedirectUrl}\"` };\n  }\n\n  if (obj.scopes !== undefined && (!Array.isArray(obj.scopes) || obj.scopes.some(scope => typeof scope !== 'string'))) {\n    return { reason: 'Invalid OAuth config: \"scopes\" must be an array of strings' };\n  }\n\n  return {\n    config: {\n      redirectUrl: rawRedirectUrl,\n      clientName: typeof obj.clientName === 'string' ? obj.clientName : undefined,\n      scopes: obj.scopes as string[] | undefined,\n      clientId: typeof obj.clientId === 'string' ? obj.clientId : undefined,\n      clientSecret: typeof obj.clientSecret === 'string' ? obj.clientSecret : undefined,\n    },\n  };\n}\n\n/**\n * Merge configs: claude (lowest priority) < global < project (highest).\n * Later configs override earlier by server name.\n * Skipped entries are accumulated, but if a higher-priority config provides\n * a valid entry for a skipped name, the skip is removed.\n */\nfunction mergeConfigs(...configs: McpConfig[]): McpConfig {\n  const merged: Record<string, McpServerConfig> = {};\n  const allSkipped: McpSkippedServer[] = [];\n\n  for (const config of configs) {\n    if (config.mcpServers) {\n      for (const [name, server] of Object.entries(config.mcpServers)) {\n        merged[name] = server;\n      }\n    }\n    if (config.skippedServers) {\n      allSkipped.push(...config.skippedServers);\n    }\n  }\n\n  // Remove skipped entries that were resolved by a valid config at any priority\n  const validNames = new Set(Object.keys(merged));\n  const filteredSkipped = allSkipped.filter(s => !validNames.has(s.name));\n\n  // Deduplicate skipped entries by name (keep last occurrence — highest priority reason)\n  const skippedMap = new Map<string, McpSkippedServer>();\n  for (const s of filteredSkipped) {\n    skippedMap.set(s.name, s);\n  }\n\n  const result: McpConfig = {};\n  if (Object.keys(merged).length > 0) {\n    result.mcpServers = merged;\n  }\n  if (skippedMap.size > 0) {\n    result.skippedServers = Array.from(skippedMap.values());\n  }\n  return result;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,MAAa,6BAA6B;AAM1C,MAAM,gBAAgB;AAEtB,SAAS,mBAAmB,UAA2B;CACrD,OAAO,aAAa,eAAe,aAAa,WAAW,aAAa,SAAS,cAAc,KAAK,QAAQ;AAC9G;;;;;;;;;;;AAYA,SAAgB,wBAAwB,OAA+C;CACrF,IAAI,OAAO,iBAAiB,KAAA,GAC1B,OAAO,oBAAoB,MAAM,aAAa;CAEhD,OAAO,OAAO,eAAA;AAChB;AAEA,SAAgB,cAAc,YAAoB,gBAAgB,oBAA+B;CAM/F,OAAO,aALc,mBAAmB,UAKT,GAJV,iBAAiB,iBAAiB,aAAa,CAIvB,GAH1B,iBAAiB,eAAe,UAAU,CAGJ,GAFnC,iBAAiB,kBAAkB,YAAY,aAAa,CAEV,CAAC;AAC3E;AAEA,SAAgB,kBAAkB,YAAoB,gBAAgB,oBAA4B;CAChG,OAAOA,OAAK,KAAK,YAAY,eAAe,UAAU;AACxD;AAEA,SAAgB,eAAe,YAA4B;CACzD,OAAOA,OAAK,KAAK,YAAY,WAAW;AAC1C;AAEA,SAAgB,iBAAiB,gBAAgB,oBAA4B;CAC3E,OAAOA,OAAK,KAAKC,KAAG,QAAQ,GAAG,eAAe,UAAU;AAC1D;AAEA,SAAgB,sBAAsB,YAA4B;CAChE,OAAOD,OAAK,KAAK,YAAY,WAAW,qBAAqB;AAC/D;AAEA,SAAS,iBAAiB,UAA6B;CACrD,IAAI;EACF,IAAI,CAACE,KAAG,WAAW,QAAQ,GAAG,OAAO,CAAC;EACtC,MAAM,MAAMA,KAAG,aAAa,UAAU,OAAO;EAC7C,OAAO,eAAe,KAAK,MAAM,GAAG,CAAC;CACvC,QAAQ;EACN,OAAO,CAAC;CACV;AACF;AAEA,SAAS,mBAAmB,YAA+B;CACzD,IAAI;EACF,MAAM,WAAW,sBAAsB,UAAU;EACjD,IAAI,CAACA,KAAG,WAAW,QAAQ,GAAG,OAAO,CAAC;EACtC,MAAM,MAAMA,KAAG,aAAa,UAAU,OAAO;EAC7C,MAAM,SAAS,KAAK,MAAM,GAAG;EAE7B,IAAI,QAAQ,cAAc,OAAO,OAAO,eAAe,UACrD,OAAO,eAAe,EAAE,YAAY,OAAO,WAAW,CAAC;EAEzD,OAAO,CAAC;CACV,QAAQ;EACN,OAAO,CAAC;CACV;AACF;;;;;;;AAQA,SAAgB,cAAc,OAAe,MAAyB,QAAQ,KAAa;CACzF,OAAO,MAAM,QACX,6EACC,QAAQ,YAAY,UAAU,aAAa;EAE1C,MAAM,WAAW,IADJ,cAAc;EAE3B,IAAI,aAAa,KAAA,KAAa,aAAa,IAAI,OAAO;EACtD,OAAO,YAAY;CACrB,CACF;AACF;;;;;;AAOA,SAAS,oBAAoB,SAA0D;CACrF,MAAM,WAAmC,CAAC;CAC1C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAC/C,IAAI,OAAO,UAAU,UAAU,SAAS,OAAO,cAAc,KAAK;CAEpE,OAAO;AACT;;;;;;AAOA,SAAS,gBAAgB,KAAsD;CAC7E,MAAM,WAAmC,CAAC;CAC1C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,GAAG,GAC3C,IAAI,OAAO,UAAU,UAAU,SAAS,OAAO,cAAc,KAAK;CAEpE,OAAO;AACT;;;;AAKA,SAAgB,oBAAoB,KAAoE;CACtG,IAAI,CAAC,OAAO,OAAO,QAAQ,UACzB,OAAO;EAAE,MAAM;EAAQ,QAAQ;CAAoC;CAGrE,MAAM,MAAM;CACZ,MAAM,aAAa,OAAO,IAAI,YAAY;CAC1C,MAAM,SAAS,OAAO,IAAI,QAAQ;CAElC,IAAI,cAAc,QAChB,OAAO;EAAE,MAAM;EAAQ,QAAQ;CAA0C;CAG3E,IAAI,YACF,OAAO,EAAE,MAAM,QAAQ;CAGzB,IAAI,QAAQ;EACV,IAAI;GACF,IAAI,IAAI,cAAc,IAAI,GAAa,CAAC;EAC1C,QAAQ;GACN,OAAO;IAAE,MAAM;IAAQ,QAAQ,iBAAiB,IAAI,IAAI;GAAG;EAC7D;EACA,OAAO,EAAE,MAAM,OAAO;CACxB;CAEA,OAAO;EAAE,MAAM;EAAQ,QAAQ;CAA4D;AAC7F;AAEA,SAAgB,eAAe,KAAyB;CACtD,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO,CAAC;CAC7C,MAAM,MAAM;CAEZ,IAAI,CAAC,IAAI,cAAc,OAAO,IAAI,eAAe,UAAU,OAAO,CAAC;CAEnE,MAAM,UAA2C,CAAC;CAClD,MAAM,iBAAqC,CAAC;CAC5C,MAAM,aAAa,IAAI;CAEvB,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,UAAU,GAAG;EACtD,MAAM,iBAAiB,oBAAoB,KAAK;EAEhD,IAAI,eAAe,SAAS,SAAS;GACnC,MAAM,IAAI;GACV,QAAQ,QAAQ;IACd,SAAS,EAAE;IACX,MAAM,MAAM,QAAQ,EAAE,IAAI,IAAK,EAAE,OAAoB,KAAA;IACrD,KACE,OAAO,EAAE,QAAQ,YAAY,EAAE,QAAQ,OAAO,gBAAgB,EAAE,GAA8B,IAAI,KAAA;GACtG;EACF,OAAO,IAAI,eAAe,SAAS,QAAQ;GACzC,MAAM,IAAI;GACV,MAAM,cAAc,iBAAiB,EAAE,KAAK;GAC5C,IAAI,YAAY,QAAQ;IACtB,eAAe,KAAK;KAAE;KAAM,QAAQ,YAAY;IAAO,CAAC;IACxD;GACF;GACA,QAAQ,QAAQ;IACd,KAAK,cAAc,EAAE,GAAa;IAClC,SACE,OAAO,EAAE,YAAY,YAAY,EAAE,YAAY,OAC3C,oBAAoB,EAAE,OAAkC,IACxD,KAAA;IACN,OAAO,YAAY;GACrB;EACF,OACE,eAAe,KAAK;GAAE;GAAM,QAAQ,eAAe;EAAQ,CAAC;CAEhE;CAEA,MAAM,SAAoB,CAAC;CAC3B,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,GAChC,OAAO,aAAa;CAEtB,IAAI,eAAe,SAAS,GAC1B,OAAO,iBAAiB;CAE1B,OAAO;AACT;AAEA,SAAS,iBAAiB,KAAgE;CACxF,IAAI,QAAQ,KAAA,GAAW,OAAO,CAAC;CAC/B,IAAI,CAAC,OAAO,OAAO,QAAQ,UACzB,OAAO,EAAE,QAAQ,2CAA2C;CAG9D,MAAM,MAAM;CACZ,IAAI,IAAI,gBAAgB,KAAA,KAAa,OAAO,IAAI,gBAAgB,UAC9D,OAAO,EAAE,QAAQ,yDAAuD;CAQ1E,IAAI;CACJ,IAAI,IAAI,iBAAiB,KAAA,GAAW;EAClC,IAAI,IAAI,gBAAgB,KAAA,GACtB,OAAO,EAAE,QAAQ,iFAA6E;EAEhG,IACE,OAAO,IAAI,iBAAiB,YAC5B,CAAC,OAAO,UAAU,IAAI,YAAY,KAClC,IAAI,eAAe,KACnB,IAAI,eAAe,OAEnB,OAAO,EAAE,QAAQ,gFAA8E;EAEjG,0BAA0B,wBAAwB,EAAE,cAAc,IAAI,aAAa,CAAC;CACtF;CAEA,MAAM,iBAAiB,2BAA2B,IAAI,eAAA;CACtD,IAAI;EACF,MAAM,cAAc,IAAI,IAAI,cAAc;EAC1C,MAAM,aAAa,mBAAmB,YAAY,QAAQ;EAC1D,IAAI,YAAY,aAAa,YAAY,EAAE,YAAY,aAAa,WAAW,aAC7E,OAAO,EAAE,QAAQ,6EAA6E;CAElG,QAAQ;EACN,OAAO,EAAE,QAAQ,+BAA+B,eAAe,GAAG;CACpE;CAEA,IAAI,IAAI,WAAW,KAAA,MAAc,CAAC,MAAM,QAAQ,IAAI,MAAM,KAAK,IAAI,OAAO,MAAK,UAAS,OAAO,UAAU,QAAQ,IAC/G,OAAO,EAAE,QAAQ,+DAA6D;CAGhF,OAAO,EACL,QAAQ;EACN,aAAa;EACb,YAAY,OAAO,IAAI,eAAe,WAAW,IAAI,aAAa,KAAA;EAClE,QAAQ,IAAI;EACZ,UAAU,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW,KAAA;EAC5D,cAAc,OAAO,IAAI,iBAAiB,WAAW,IAAI,eAAe,KAAA;CAC1E,EACF;AACF;;;;;;;AAQA,SAAS,aAAa,GAAG,SAAiC;CACxD,MAAM,SAA0C,CAAC;CACjD,MAAM,aAAiC,CAAC;CAExC,KAAK,MAAM,UAAU,SAAS;EAC5B,IAAI,OAAO,YACT,KAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,OAAO,UAAU,GAC3D,OAAO,QAAQ;EAGnB,IAAI,OAAO,gBACT,WAAW,KAAK,GAAG,OAAO,cAAc;CAE5C;CAGA,MAAM,aAAa,IAAI,IAAI,OAAO,KAAK,MAAM,CAAC;CAC9C,MAAM,kBAAkB,WAAW,QAAO,MAAK,CAAC,WAAW,IAAI,EAAE,IAAI,CAAC;CAGtE,MAAM,6BAAa,IAAI,IAA8B;CACrD,KAAK,MAAM,KAAK,iBACd,WAAW,IAAI,EAAE,MAAM,CAAC;CAG1B,MAAM,SAAoB,CAAC;CAC3B,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,SAAS,GAC/B,OAAO,aAAa;CAEtB,IAAI,WAAW,OAAO,GACpB,OAAO,iBAAiB,MAAM,KAAK,WAAW,OAAO,CAAC;CAExD,OAAO;AACT"}

package/dist/mcp/index.d.ts

@@ -0,0 +1,5 @@
+export { createMcpManager } from './manager.js';
+export type { McpManager, McpInitResult } from './manager.js';
+export { loadMcpConfig, getProjectMcpPath, getGlobalMcpPath, getClaudeSettingsPath } from './config.js';
+export type { McpConfig, McpServerConfig, McpStdioServerConfig, McpHttpServerConfig, McpSkippedServer, McpServerStatus, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/mcp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACxG,YAAY,EACV,SAAS,EACT,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC"}

package/dist/mcp/index.js

@@ -0,0 +1,3 @@
+import { getClaudeSettingsPath, getGlobalMcpPath, getProjectMcpPath, loadMcpConfig } from "./config.js";
+import { createMcpManager } from "./manager.js";
+export { createMcpManager, getClaudeSettingsPath, getGlobalMcpPath, getProjectMcpPath, loadMcpConfig };

package/dist/mcp/manager.d.ts

@@ -0,0 +1,98 @@
+/**
+ * MCP manager — orchestrates MCP server connections using MCPClient directly.
+ * Created once at startup, provides tools from connected MCP servers.
+ */
+import type { McpConfig, McpServerConfig, McpServerStatus, McpSkippedServer } from './types.js';
+/** Summary of MCP initialization result. */
+export interface McpInitResult {
+    connected: McpServerStatus[];
+    failed: McpServerStatus[];
+    skipped: McpSkippedServer[];
+    totalTools: number;
+}
+/** Public interface for the MCP manager returned by createMcpManager(). */
+export interface McpManager {
+    /** Connect to all configured MCP servers and collect their tools. */
+    init(): Promise<void>;
+    /** Start init in the background. Returns a promise that resolves with status when done. */
+    initInBackground(): Promise<McpInitResult>;
+    /** Disconnect all servers, reload config from disk, reconnect. */
+    reload(): Promise<void>;
+    /** Reconnect a single server by name. Returns updated status. */
+    reconnectServer(name: string): Promise<McpServerStatus>;
+    /**
+     * Run the OAuth authorization-code flow for an HTTP server, then reconnect it.
+     * Servers without an `oauth` config are provisioned with a zero-config default
+     * (dynamic client registration). The authorization URL is surfaced through
+     * `onAuthorizationUrl` for the caller to open in a browser.
+     *
+     * Resolves with the resulting {@link McpServerStatus}: a connected status on
+     * success, or a status carrying an `error` message on failure (including
+     * cancellation) — it does not reject. Inspect the returned status rather than
+     * relying on a thrown error.
+     */
+    authenticateServer(name: string, options?: {
+        onAuthorizationUrl?: (url: string) => void;
+        timeoutMs?: number;
+    }): Promise<McpServerStatus>;
+    /**
+     * Cancel a pending {@link authenticateServer} flow for a server (e.g. the
+     * user closed the browser without completing consent). The pending
+     * authenticate call rejects and the server returns to the `needsAuth` state
+     * so it can be retried. Returns `true` if a flow was cancelled.
+     */
+    cancelServerAuthentication(name: string): Promise<boolean>;
+    /**
+     * Disable or enable a single server by name. The change is persisted (in
+     * mastracode's app data, not the user's config files) and survives restarts.
+     * With `global: true` the change applies to every project; otherwise it is
+     * scoped to this project. Enabling only removes the server from the given
+     * scope — a server disabled in the other scope stays disabled, and the
+     * returned status's `disabledScope` says which scope still applies.
+     * Connections are rebuilt, so other servers reconnect — same behavior as
+     * {@link reload}. Returns the server's resulting status.
+     */
+    setServerDisabled(name: string, disabled: boolean, options?: {
+        global?: boolean;
+    }): Promise<McpServerStatus>;
+    /**
+     * Disable or enable all servers at once. Project scope records every
+     * currently-configured server name; enabling clears the project list.
+     * Global scope sets/clears a persisted all-MCP kill switch (and, when
+     * enabling, also clears globally disabled server names). Persisted like
+     * {@link setServerDisabled}.
+     */
+    setAllDisabled(disabled: boolean, options?: {
+        global?: boolean;
+    }): Promise<void>;
+    /** Names of configured servers that are currently disabled (any scope). */
+    getDisabledServers(): string[];
+    /** Whether all MCP is disabled globally (across every project). */
+    isAllDisabledGlobally(): boolean;
+    /** Disconnect from all MCP servers and clean up. */
+    disconnect(): Promise<void>;
+    /** Get all tools from connected MCP servers (namespaced as serverName_toolName). */
+    getTools(): Record<string, any>;
+    /** Check if any MCP servers are configured (or skipped). */
+    hasServers(): boolean;
+    /** Get status of all servers. */
+    getServerStatuses(): McpServerStatus[];
+    /** Get servers that were skipped during config loading. */
+    getSkippedServers(): McpSkippedServer[];
+    /** Get config file paths for display. */
+    getConfigPaths(): {
+        project: string;
+        global: string;
+        claude: string;
+    };
+    /** Get the merged config. */
+    getConfig(): McpConfig;
+    /** Get captured stderr logs for a server. */
+    getServerLogs(name: string): string[];
+}
+/**
+ * Create an MCP manager that wraps MCPClient with config-file discovery
+ * and per-server status tracking.
+ */
+export declare function createMcpManager(projectDir: string, configDirName?: string, extraServers?: Record<string, McpServerConfig>): McpManager;
+//# sourceMappingURL=manager.d.ts.map

package/dist/mcp/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/mcp/manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAiBH,OAAO,KAAK,EACV,SAAS,EAGT,eAAe,EACf,eAAe,EACf,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAIpB,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,2EAA2E;AAC3E,MAAM,WAAW,UAAU;IACzB,qEAAqE;IACrE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,2FAA2F;IAC3F,gBAAgB,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3C,kEAAkE;IAClE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,iEAAiE;IACjE,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACxD;;;;;;;;;;OAUG;IACH,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3E,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5B;;;;;OAKG;IACH,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D;;;;;;;;;OASG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7G;;;;;;OAMG;IACH,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjF,2EAA2E;IAC3E,kBAAkB,IAAI,MAAM,EAAE,CAAC;IAC/B,mEAAmE;IACnE,qBAAqB,IAAI,OAAO,CAAC;IACjC,oDAAoD;IACpD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,oFAAoF;IACpF,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,4DAA4D;IAC5D,UAAU,IAAI,OAAO,CAAC;IACtB,iCAAiC;IACjC,iBAAiB,IAAI,eAAe,EAAE,CAAC;IACvC,2DAA2D;IAC3D,iBAAiB,IAAI,gBAAgB,EAAE,CAAC;IACxC,yCAAyC;IACzC,cAAc,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE,6BAA6B;IAC7B,SAAS,IAAI,SAAS,CAAC;IACvB,6CAA6C;IAC7C,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CACvC;AA0ED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,aAAa,SAAqB,EAClC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAC7C,UAAU,CA0sBZ"}