@mtaap/mcp 0.4.1 → 0.5.1

package/dist/server.js

@@ -36,11 +36,13 @@ var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
 // package.json
 var package_default = {
   name: "@mtaap/mcp",
-  version: "0.4.1",
+  version: "0.5.1",
   description: "Model Context Protocol (MCP) server for AI agents to interact with Collab - the multi-tenant collaborative agent development platform",
   mcpName: "collab",
   scripts: {
-    build: "tsup"
+    build: "pnpm build:ui && tsup",
+    "build:ui": "node scripts/build-ui.mjs",
+    "dev:ui": "vite build --watch"
   },
   main: "./dist/index.js",
   types: "./dist/index.d.ts",
@@ -78,6 +80,7 @@ var package_default = {
   },
   dependencies: {
     "@modelcontextprotocol/sdk": "^1.0.0",
+    "@modelcontextprotocol/ext-apps": "^1.0.1",
     express: "^5.0.1",
     zod: "^4.3.5"
   },
@@ -86,8 +89,18 @@ var package_default = {
     "@mtaap/core": "workspace:*",
     "@types/express": "^5.0.0",
     "@types/node": "^22.0.0",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
+    "@vitejs/plugin-react": "^4.4.0",
+    autoprefixer: "^10.4.21",
+    postcss: "^8.5.3",
+    react: "^19.0.0",
+    "react-dom": "^19.0.0",
+    tailwindcss: "^3.4.17",
     tsup: "^8.5.1",
-    typescript: "^5.4.0"
+    typescript: "^5.4.0",
+    vite: "^6.3.2",
+    "vite-plugin-singlefile": "^2.0.3"
   }
 };
 
@@ -95,7 +108,7 @@ var package_default = {
 var VERSION = package_default.version;
 
 // src/index.ts
-var import_zod4 = require("zod");
+var import_zod9 = require("zod");
 
 // ../../packages/core/dist/constants/enums.js
 var TaskState;
@@ -181,6 +194,10 @@ var WebSocketEventType;
   WebSocketEventType2["TASK_UPDATED"] = "task.updated";
   WebSocketEventType2["TASK_DELETED"] = "task.deleted";
   WebSocketEventType2["MEMBER_JOINED"] = "member.joined";
+  WebSocketEventType2["AGENT_STARTED"] = "agent.started";
+  WebSocketEventType2["AGENT_OUTPUT"] = "agent.output";
+  WebSocketEventType2["AGENT_STOPPED"] = "agent.stopped";
+  WebSocketEventType2["AGENT_ERROR"] = "agent.error";
 })(WebSocketEventType || (WebSocketEventType = {}));
 var SubscriptionStatus;
 (function(SubscriptionStatus2) {
@@ -203,6 +220,31 @@ var CreatedVia;
   CreatedVia2["API_KEY"] = "API_KEY";
   CreatedVia2["OAUTH"] = "OAUTH";
 })(CreatedVia || (CreatedVia = {}));
+var AgentModel;
+(function(AgentModel2) {
+  AgentModel2["OPUS"] = "OPUS";
+  AgentModel2["SONNET"] = "SONNET";
+  AgentModel2["HAIKU"] = "HAIKU";
+})(AgentModel || (AgentModel = {}));
+var AgentModelMode;
+(function(AgentModelMode2) {
+  AgentModelMode2["DEFAULT"] = "DEFAULT";
+  AgentModelMode2["PRESET"] = "PRESET";
+  AgentModelMode2["CUSTOM"] = "CUSTOM";
+})(AgentModelMode || (AgentModelMode = {}));
+var AgentCLIType;
+(function(AgentCLIType2) {
+  AgentCLIType2["CLAUDE_CODE"] = "CLAUDE_CODE";
+  AgentCLIType2["OPENCODE"] = "OPENCODE";
+})(AgentCLIType || (AgentCLIType = {}));
+var AgentSessionStatus;
+(function(AgentSessionStatus2) {
+  AgentSessionStatus2["STARTING"] = "STARTING";
+  AgentSessionStatus2["RUNNING"] = "RUNNING";
+  AgentSessionStatus2["STOPPING"] = "STOPPING";
+  AgentSessionStatus2["STOPPED"] = "STOPPED";
+  AgentSessionStatus2["ERROR"] = "ERROR";
+})(AgentSessionStatus || (AgentSessionStatus = {}));
 
 // ../../packages/core/dist/constants/state-machine.js
 var VALID_TRANSITIONS = {
@@ -291,9 +333,9 @@ var isOnPrem = config.deploymentMode === "onprem";
 
 // ../../packages/core/dist/versions.js
 var VERSIONS = {
-  core: "0.3.0",
-  web: "0.3.0",
-  mcp: "0.4.1"
+  core: "0.4.0",
+  web: "0.4.0",
+  mcp: "0.5.0"
 };
 var VERSION2 = VERSIONS.core;
 
@@ -374,6 +416,18 @@ var config2 = {
       requestsPerHour: 1e3
     }
   },
+  agent: {
+    defaultModel: "SONNET",
+    sessionTimeoutMs: 30 * 60 * 1e3,
+    // 30 minutes
+    maxSessionDurationMs: 4 * 60 * 60 * 1e3,
+    // 4 hours
+    maxConcurrentSessions: {
+      FREE: 1,
+      PRO: 5,
+      ENTERPRISE: -1
+    }
+  },
   limits: {
     projectNameMaxLength: 100,
     taskDescriptionMaxLength: 5e3,
@@ -781,7 +835,8 @@ var UpdateProjectInputSchema = import_zod3.z.object({
   repositoryUrl: import_zod3.z.string().url().optional(),
   baseBranch: import_zod3.z.string().optional(),
   tags: import_zod3.z.array(import_zod3.z.string()).optional(),
-  allowMemberArchive: import_zod3.z.boolean().optional()
+  allowMemberArchive: import_zod3.z.boolean().optional(),
+  localRepoPath: import_zod3.z.string().max(500).optional()
 });
 var CreateEpicInputSchema = import_zod3.z.object({
   projectId: cuidOrPrefixedId,
@@ -998,6 +1053,10 @@ var dbSlowQueriesTotal = createCounter("mtaap_db_slow_queries_total", "Total num
 var tasksCreatedTotal = createCounter("mtaap_tasks_created_total", "Total number of tasks created");
 var tasksAssignedTotal = createCounter("mtaap_tasks_assigned_total", "Total number of tasks assigned");
 var tasksCompletedTotal = createCounter("mtaap_tasks_completed_total", "Total number of tasks completed");
+var agentSessionsTotal = createCounter("mtaap_agent_sessions_total", "Total number of agent sessions started");
+var agentErrorsTotal = createCounter("mtaap_agent_errors_total", "Total number of agent errors");
+var agentSessionDuration = createHistogram("mtaap_agent_session_duration_seconds", "Agent session duration in seconds", [1, 5, 15, 30, 60, 120, 300, 600, 1800, 3600]);
+var agentSessionsActive = createGauge("mtaap_agent_sessions_active", "Number of currently active agent sessions");
 
 // ../../packages/core/dist/logging/performance-monitor.js
 var MAX_SAMPLES = 1e3;
@@ -1201,6 +1260,9 @@ var errorTrackerInstance = new NoOpErrorTracker();
 
 // src/api-client.ts
 var DEFAULT_TIMEOUT = 3e4;
+var DEFAULT_CACHE_TTL = 3e4;
+var MAX_RETRIES = 2;
+var INITIAL_RETRY_DELAY = 500;
 function sanitizeForLogging(str) {
   let sanitized = str.replace(/\bcollab_[a-zA-Z0-9_-]+\b/gi, "[REDACTED_API_KEY]");
   sanitized = sanitized.replace(/\bBearer\s+[a-zA-Z0-9._-]+\b/gi, "Bearer [REDACTED]");
@@ -1215,7 +1277,17 @@ var ApiError = class extends Error {
     this.details = details;
     this.name = "ApiError";
   }
+  /**
+   * Whether this error is transient and the request can be retried.
+   * Retries on network errors (status 0), timeouts (408), and server errors (5xx).
+   */
+  get isRetryable() {
+    return this.status === 0 || this.status === 408 || this.status >= 500;
+  }
 };
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
 var MCPApiClient = class {
   baseUrl;
   apiKey;
@@ -1223,6 +1295,7 @@ var MCPApiClient = class {
   timeout;
   debug;
   authContext = null;
+  cache = /* @__PURE__ */ new Map();
   constructor(config3) {
     if (!config3.apiKey && !config3.oauthToken) {
       throw new Error("Either apiKey or oauthToken must be provided");
@@ -1234,14 +1307,54 @@ var MCPApiClient = class {
     this.debug = config3.debug ?? false;
   }
   /**
-   * Make an HTTP request to the API
+   * Get a cached value if it exists and hasn't expired.
+   */
+  getCached(key) {
+    const entry = this.cache.get(key);
+    if (!entry) return void 0;
+    if (Date.now() > entry.expiresAt) {
+      this.cache.delete(key);
+      return void 0;
+    }
+    return entry.data;
+  }
+  /**
+   * Store a value in cache with a TTL.
    */
-  async request(method, path, body) {
-    const url = `${this.baseUrl}${path}`;
+  setCache(key, data, ttl = DEFAULT_CACHE_TTL) {
+    this.cache.set(key, { data, expiresAt: Date.now() + ttl });
+  }
+  /**
+   * Make an HTTP request to the API with automatic retry on transient failures.
+   */
+  async request(method, path2, body) {
+    let lastError;
+    for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+      try {
+        return await this.requestOnce(method, path2, body);
+      } catch (error) {
+        if (!(error instanceof ApiError) || !error.isRetryable || attempt === MAX_RETRIES) {
+          throw error;
+        }
+        lastError = error;
+        const delay = INITIAL_RETRY_DELAY * Math.pow(2, attempt);
+        if (this.debug) {
+          console.error(`[mcp-api] Retry ${attempt + 1}/${MAX_RETRIES} after ${delay}ms (${lastError.code})`);
+        }
+        await sleep(delay);
+      }
+    }
+    throw lastError;
+  }
+  /**
+   * Execute a single HTTP request to the API.
+   */
+  async requestOnce(method, path2, body) {
+    const url = `${this.baseUrl}${path2}`;
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), this.timeout);
     if (this.debug) {
-      console.error(`[mcp-api] ${method} ${sanitizeForLogging(path)}`);
+      console.error(`[mcp-api] ${method} ${sanitizeForLogging(path2)}`);
     }
     try {
       const headers = {
@@ -1317,14 +1430,19 @@ ${data.hint ? `Hint: ${data.hint}` : ""}`,
     return this.authenticate();
   }
   /**
-   * List accessible projects
+   * List accessible projects (cached for 30s)
    */
   async listProjects(workspaceType) {
     const type = workspaceType || "ALL";
-    return this.request(
+    const cacheKey = `listProjects:${type}`;
+    const cached = this.getCached(cacheKey);
+    if (cached) return cached;
+    const result = await this.request(
       "GET",
       `/api/mcp/projects?workspaceType=${encodeURIComponent(type)}`
     );
+    this.setCache(cacheKey, result);
+    return result;
   }
   /**
    * Get single project details
@@ -1333,13 +1451,18 @@ ${data.hint ? `Hint: ${data.hint}` : ""}`,
     return this.request("GET", `/api/mcp/projects/${projectId}`);
   }
   /**
-   * Get project context (README, stack, conventions)
+   * Get project context (README, stack, conventions) (cached for 60s)
    */
   async getProjectContext(projectId) {
-    return this.request(
+    const cacheKey = `projectContext:${projectId}`;
+    const cached = this.getCached(cacheKey);
+    if (cached) return cached;
+    const result = await this.request(
       "GET",
       `/api/mcp/projects/${projectId}/context`
     );
+    this.setCache(cacheKey, result, 6e4);
+    return result;
   }
   /**
    * Create a personal project
@@ -1367,8 +1490,8 @@ ${data.hint ? `Hint: ${data.hint}` : ""}`,
     if (filters.assigneeId) params.set("assigneeId", filters.assigneeId);
     if (filters.includeArchived) params.set("includeArchived", "true");
     const queryString = params.toString();
-    const path = queryString ? `/api/mcp/tasks?${queryString}` : "/api/mcp/tasks";
-    return this.request("GET", path);
+    const path2 = queryString ? `/api/mcp/tasks?${queryString}` : "/api/mcp/tasks";
+    return this.request("GET", path2);
   }
   /**
    * Get full task details
@@ -1501,7 +1624,8 @@ ${data.hint ? `Hint: ${data.hint}` : ""}`,
     );
   }
   /**
-   * Update task details (DRAFT/TODO states only)
+   * Update task details (DRAFT/TODO states only).
+   * Task stays in its current state.
    */
   async updateTask(taskId, projectId, data) {
     return this.request("PATCH", `/api/mcp/tasks/${taskId}`, {
@@ -1536,6 +1660,454 @@ function assertApiKeyPermission(apiKey, required, toolName) {
   throw error;
 }
 
+// src/apps/task-details.ts
+var import_server2 = require("@modelcontextprotocol/ext-apps/server");
+var import_zod4 = require("zod");
+
+// src/apps/helpers.ts
+var import_server = require("@modelcontextprotocol/ext-apps/server");
+var import_promises = __toESM(require("fs/promises"));
+var import_node_path = __toESM(require("path"));
+var import_node_url = require("url");
+var import_meta = {};
+var getDirname = () => {
+  try {
+    return import_node_path.default.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
+  } catch {
+    return __dirname;
+  }
+};
+function getAppHtmlPath(htmlFileName) {
+  return import_node_path.default.join(getDirname(), "apps", htmlFileName);
+}
+function registerAppHtmlResource(server, config3) {
+  (0, import_server.registerAppResource)(
+    server,
+    config3.name,
+    config3.uri,
+    {
+      mimeType: import_server.RESOURCE_MIME_TYPE,
+      description: config3.description
+    },
+    async () => {
+      const htmlPath = getAppHtmlPath(config3.htmlFileName);
+      try {
+        const html = await import_promises.default.readFile(htmlPath, "utf-8");
+        return {
+          contents: [
+            {
+              uri: config3.uri,
+              mimeType: import_server.RESOURCE_MIME_TYPE,
+              text: html
+            }
+          ]
+        };
+      } catch {
+        return {
+          contents: [
+            {
+              uri: config3.uri,
+              mimeType: import_server.RESOURCE_MIME_TYPE,
+              text: `<!DOCTYPE html><html><body><p>${config3.fallbackLabel} UI not available. Build the UI apps first.</p></body></html>`
+            }
+          ]
+        };
+      }
+    }
+  );
+}
+
+// src/apps/task-details.ts
+var RESOURCE_URI = "ui://collab/task-details.html";
+function registerTaskDetailsApp(server, apiClient, _authContext) {
+  (0, import_server2.registerAppTool)(
+    server,
+    "view_task_details",
+    {
+      title: "Task Details",
+      description: "View interactive task details with acceptance criteria, notes, and progress. Opens a rich UI panel.",
+      inputSchema: {
+        taskId: import_zod4.z.string().describe("The task ID to view"),
+        projectId: import_zod4.z.string().describe("The project ID")
+      },
+      _meta: { ui: { resourceUri: RESOURCE_URI } }
+    },
+    async ({ taskId, projectId }) => {
+      try {
+        const task = await apiClient.getTask(taskId);
+        let project = null;
+        try {
+          project = await apiClient.getProject(projectId);
+        } catch {
+        }
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Viewing task: ${task.title}`
+            }
+          ],
+          structuredContent: {
+            task,
+            project
+          }
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text", text: `Error loading task: ${message}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  registerAppHtmlResource(server, {
+    name: "Task Details UI",
+    uri: RESOURCE_URI,
+    description: "Interactive task details view with acceptance criteria and notes",
+    htmlFileName: "task-details.html",
+    fallbackLabel: "Task Details"
+  });
+}
+
+// src/apps/kanban.ts
+var import_server3 = require("@modelcontextprotocol/ext-apps/server");
+var import_zod5 = require("zod");
+var RESOURCE_URI2 = "ui://collab/kanban.html";
+function registerKanbanApp(server, apiClient, _authContext) {
+  (0, import_server3.registerAppTool)(
+    server,
+    "view_kanban_board",
+    {
+      title: "Kanban Board",
+      description: "View interactive drag-and-drop Kanban board for a project. Drag tasks between columns to change their state.",
+      inputSchema: {
+        projectId: import_zod5.z.string().describe("The project ID to display")
+      },
+      _meta: { ui: { resourceUri: RESOURCE_URI2 } }
+    },
+    async ({ projectId }) => {
+      try {
+        const [project, tasks] = await Promise.all([
+          apiClient.getProject(projectId),
+          apiClient.listTasks({ projectId })
+        ]);
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Kanban board for ${project.name} (${tasks.length} tasks)`
+            }
+          ],
+          structuredContent: {
+            project,
+            tasks
+          }
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text", text: `Error loading kanban: ${message}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  registerAppHtmlResource(server, {
+    name: "Kanban Board UI",
+    uri: RESOURCE_URI2,
+    description: "Interactive drag-and-drop Kanban board for task management",
+    htmlFileName: "kanban.html",
+    fallbackLabel: "Kanban"
+  });
+}
+
+// src/apps/activity.ts
+var import_server4 = require("@modelcontextprotocol/ext-apps/server");
+var import_zod6 = require("zod");
+var RESOURCE_URI3 = "ui://collab/activity.html";
+function registerActivityApp(server, apiClient, _authContext) {
+  (0, import_server4.registerAppTool)(
+    server,
+    "view_activity",
+    {
+      title: "User Activity",
+      description: "View who is working on what across the team. Shows IN_PROGRESS and REVIEW tasks per user.",
+      inputSchema: {
+        projectId: import_zod6.z.string().optional().describe("Optional project ID to filter by")
+      },
+      _meta: { ui: { resourceUri: RESOURCE_URI3 } }
+    },
+    async ({ projectId }) => {
+      try {
+        const [inProgressTasks, reviewTasks] = await Promise.all([
+          apiClient.listTasks({
+            projectId,
+            state: TaskState.IN_PROGRESS
+          }),
+          apiClient.listTasks({
+            projectId,
+            state: TaskState.REVIEW
+          })
+        ]);
+        const userMap = /* @__PURE__ */ new Map();
+        for (const task of inProgressTasks) {
+          if (task.assigneeId) {
+            if (!userMap.has(task.assigneeId)) {
+              userMap.set(task.assigneeId, {
+                id: task.assigneeId,
+                name: task.assigneeName || "Unknown",
+                email: task.assigneeEmail || "",
+                activeTasks: [],
+                reviewTasks: []
+              });
+            }
+            userMap.get(task.assigneeId).activeTasks.push(task);
+          }
+        }
+        for (const task of reviewTasks) {
+          if (task.assigneeId) {
+            if (!userMap.has(task.assigneeId)) {
+              userMap.set(task.assigneeId, {
+                id: task.assigneeId,
+                name: task.assigneeName || "Unknown",
+                email: task.assigneeEmail || "",
+                activeTasks: [],
+                reviewTasks: []
+              });
+            }
+            userMap.get(task.assigneeId).reviewTasks.push(task);
+          }
+        }
+        const users = Array.from(userMap.values());
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Activity: ${users.length} users with active work`
+            }
+          ],
+          structuredContent: {
+            users,
+            projectId
+          }
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [
+            { type: "text", text: `Error loading activity: ${message}` }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  registerAppHtmlResource(server, {
+    name: "User Activity UI",
+    uri: RESOURCE_URI3,
+    description: "Dashboard showing team member activity and workload",
+    htmlFileName: "activity.html",
+    fallbackLabel: "Activity"
+  });
+}
+
+// src/apps/project-overview.ts
+var import_server5 = require("@modelcontextprotocol/ext-apps/server");
+var import_zod7 = require("zod");
+var RESOURCE_URI4 = "ui://collab/project-overview.html";
+function registerProjectOverviewApp(server, apiClient, _authContext) {
+  (0, import_server5.registerAppTool)(
+    server,
+    "view_project_overview",
+    {
+      title: "Project Overview",
+      description: "View project health dashboard with task metrics, state distribution, and conventions.",
+      inputSchema: {
+        projectId: import_zod7.z.string().describe("The project ID to display")
+      },
+      _meta: { ui: { resourceUri: RESOURCE_URI4 } }
+    },
+    async ({ projectId }) => {
+      try {
+        const [project, context, tasks] = await Promise.all([
+          apiClient.getProject(projectId),
+          apiClient.getProjectContext(projectId).catch(() => null),
+          apiClient.listTasks({ projectId })
+        ]);
+        const activeTasks = tasks.filter((t) => !t.isArchived);
+        const inProgress = activeTasks.filter(
+          (t) => t.state === TaskState.IN_PROGRESS
+        ).length;
+        const done = activeTasks.filter(
+          (t) => t.state === TaskState.DONE
+        ).length;
+        const blocked = activeTasks.filter((t) => t.errorType).length;
+        const tasksByState = {
+          DRAFT: 0,
+          TODO: 0,
+          IN_PROGRESS: 0,
+          REVIEW: 0,
+          DONE: 0
+        };
+        for (const task of activeTasks) {
+          tasksByState[task.state]++;
+        }
+        const tasksByPriority = {
+          LOW: 0,
+          MEDIUM: 0,
+          HIGH: 0,
+          CRITICAL: 0
+        };
+        for (const task of activeTasks) {
+          tasksByPriority[task.priority]++;
+        }
+        const recentCompleted = activeTasks.filter((t) => t.state === TaskState.DONE).sort(
+          (a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime()
+        ).slice(0, 5);
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Project overview for ${project.name}: ${activeTasks.length} tasks`
+            }
+          ],
+          structuredContent: {
+            project,
+            context,
+            metrics: {
+              totalTasks: activeTasks.length,
+              inProgress,
+              blocked,
+              done
+            },
+            tasksByState,
+            tasksByPriority,
+            recentCompleted
+          }
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [
+            { type: "text", text: `Error loading project overview: ${message}` }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  registerAppHtmlResource(server, {
+    name: "Project Overview UI",
+    uri: RESOURCE_URI4,
+    description: "Project health dashboard with metrics and visualizations",
+    htmlFileName: "project-overview.html",
+    fallbackLabel: "Project Overview"
+  });
+}
+
+// src/apps/agent-sessions.ts
+var import_server6 = require("@modelcontextprotocol/ext-apps/server");
+var import_zod8 = require("zod");
+var RESOURCE_URI5 = "ui://collab/agent-sessions.html";
+function registerAgentSessionsApp(server, apiClient, authContext) {
+  (0, import_server6.registerAppTool)(
+    server,
+    "view_agent_sessions",
+    {
+      title: "Agent Sessions",
+      description: "View active AI agent sessions working on tasks. Monitor real-time progress and session status.",
+      inputSchema: {
+        projectId: import_zod8.z.string().optional().describe("Optional project ID to filter by")
+      },
+      _meta: { ui: { resourceUri: RESOURCE_URI5 } }
+    },
+    async ({ projectId }) => {
+      try {
+        const [inProgressTasks, reviewTasks] = await Promise.all([
+          apiClient.listTasks({
+            projectId,
+            state: TaskState.IN_PROGRESS
+          }),
+          apiClient.listTasks({
+            projectId,
+            state: TaskState.REVIEW
+          })
+        ]);
+        const sessions2 = [];
+        for (const task of inProgressTasks) {
+          if (task.assigneeId) {
+            const totalCriteria = task.acceptanceCriteria?.length || 0;
+            const completedCriteria = task.acceptanceCriteria?.filter((c) => c.completed).length || 0;
+            const progress = totalCriteria > 0 ? Math.round(completedCriteria / totalCriteria * 100) : 0;
+            const latestUpdate = task.progressUpdates?.[task.progressUpdates.length - 1];
+            sessions2.push({
+              id: `session-${task.id}`,
+              taskId: task.id,
+              taskTitle: task.title,
+              agentName: task.assigneeName || "Agent",
+              status: "RUNNING",
+              startedAt: task.updatedAt,
+              lastCheckpoint: latestUpdate?.timestamp,
+              currentStep: latestUpdate?.statusMessage,
+              progress
+            });
+          }
+        }
+        for (const task of reviewTasks) {
+          if (task.assigneeId) {
+            sessions2.push({
+              id: `session-${task.id}`,
+              taskId: task.id,
+              taskTitle: task.title,
+              agentName: task.assigneeName || "Agent",
+              status: "STOPPED",
+              startedAt: task.updatedAt,
+              progress: 100
+            });
+          }
+        }
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Agent sessions: ${sessions2.length} active`
+            }
+          ],
+          structuredContent: {
+            sessions: sessions2,
+            projectId
+          }
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [
+            { type: "text", text: `Error loading agent sessions: ${message}` }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  registerAppHtmlResource(server, {
+    name: "Agent Sessions UI",
+    uri: RESOURCE_URI5,
+    description: "Real-time view of AI agent sessions and their progress",
+    htmlFileName: "agent-sessions.html",
+    fallbackLabel: "Agent Sessions"
+  });
+}
+
+// src/apps/index.ts
+function registerMCPApps(server, apiClient, authContext) {
+  registerTaskDetailsApp(server, apiClient, authContext);
+  registerKanbanApp(server, apiClient, authContext);
+  registerActivityApp(server, apiClient, authContext);
+  registerProjectOverviewApp(server, apiClient, authContext);
+  registerAgentSessionsApp(server, apiClient, authContext);
+}
+
 // src/index.ts
 var COLLAB_SERVER_INSTRUCTIONS = `Collab - AI-assisted software development task management platform.
 
@@ -1587,7 +2159,7 @@ Review Workflow:
   list_tasks(state=REVIEW) -> get_task -> approve_task OR request_changes
 
 Task Editing:
-  update_task (DRAFT/TODO only) -> if was TODO, reverts to DRAFT -> verify_task again
+  update_task (DRAFT/TODO only) -> task stays in current state
 
 Error Recovery:
   report_error -> abandon_task -> list_tasks -> assign_task (retry or pick different task)
@@ -1606,7 +2178,7 @@ GIT OPERATIONS NOTE:
 TASK STATE FLOW:
   DRAFT -> TODO -> IN_PROGRESS -> REVIEW -> DONE
   (verify_task: DRAFT -> TODO)
-  (update_task on TODO: reverts to DRAFT)
+  (update_task: DRAFT/TODO only, state unchanged)
   (request_changes: REVIEW -> IN_PROGRESS)
   (abandon_task: IN_PROGRESS -> TODO)
 
@@ -1639,7 +2211,7 @@ function initializeMCPServer(apiClient, authContext) {
     {
       description: "Discover all accessible projects. Use first to find project IDs. Filter by TEAM, PERSONAL, or ALL workspaces.",
       inputSchema: {
-        workspaceType: import_zod4.z.enum(["TEAM", "PERSONAL", "ALL"]).optional().describe("Filter by workspace type")
+        workspaceType: import_zod9.z.enum(["TEAM", "PERSONAL", "ALL"]).optional().describe("Filter by workspace type")
       }
     },
     async (args) => {
@@ -1669,10 +2241,10 @@ function initializeMCPServer(apiClient, authContext) {
     {
       description: "Query tasks with filters. Use state=TODO for assignable tasks, state=REVIEW for pending reviews.",
       inputSchema: {
-        projectId: import_zod4.z.string().optional().describe("Filter by project ID"),
-        state: import_zod4.z.nativeEnum(TaskState).optional().describe("Filter by task state"),
-        assigneeId: import_zod4.z.string().optional().describe("Filter by assignee ID"),
-        includeArchived: import_zod4.z.boolean().optional().describe("Include archived tasks (default: false)")
+        projectId: import_zod9.z.string().optional().describe("Filter by project ID"),
+        state: import_zod9.z.nativeEnum(TaskState).optional().describe("Filter by task state"),
+        assigneeId: import_zod9.z.string().optional().describe("Filter by assignee ID"),
+        includeArchived: import_zod9.z.boolean().optional().describe("Include archived tasks (default: false)")
       }
     },
     async (args) => {
@@ -1703,7 +2275,7 @@ function initializeMCPServer(apiClient, authContext) {
     {
       description: "Get complete task details with acceptance criteria and notes. Call before assign_task to understand requirements.",
       inputSchema: {
-        taskId: import_zod4.z.string().describe("The task ID to retrieve")
+        taskId: import_zod9.z.string().describe("The task ID to retrieve")
       }
     },
     async (args) => {
@@ -1729,9 +2301,9 @@ function initializeMCPServer(apiClient, authContext) {
     {
       description: "Atomically claim a task. Race-safe - fails if already assigned. Task must be TODO. Returns suggested branch name and worktree path for isolated parallel development.",
       inputSchema: {
-        projectId: import_zod4.z.string().describe("The project ID"),
-        taskId: import_zod4.z.string().describe("The task ID to assign"),
-        expectedState: import_zod4.z.nativeEnum(TaskState).optional().describe("Expected task state (default: TODO)")
+        projectId: import_zod9.z.string().describe("The project ID"),
+        taskId: import_zod9.z.string().describe("The task ID to assign"),
+        expectedState: import_zod9.z.nativeEnum(TaskState).optional().describe("Expected task state (default: TODO)")
       }
     },
     async (args) => {
@@ -1765,10 +2337,10 @@ function initializeMCPServer(apiClient, authContext) {
     {
       description: "Report progress and checkpoint work. Call frequently during execution. Marks acceptance criteria complete.",
       inputSchema: {
-        taskId: import_zod4.z.string().describe("The task ID to update"),
-        statusMessage: import_zod4.z.string().optional().describe("Status message (max 1000 chars)"),
-        completedCheckpointIds: import_zod4.z.array(import_zod4.z.string()).optional().describe("Array of completed checkpoint IDs"),
-        currentCheckpointIndex: import_zod4.z.number().optional().describe("Current checkpoint index")
+        taskId: import_zod9.z.string().describe("The task ID to update"),
+        statusMessage: import_zod9.z.string().optional().describe("Status message (max 1000 chars)"),
+        completedCheckpointIds: import_zod9.z.array(import_zod9.z.string()).optional().describe("Array of completed checkpoint IDs"),
+        currentCheckpointIndex: import_zod9.z.number().optional().describe("Current checkpoint index")
       }
     },
     async (args) => {
@@ -1802,10 +2374,10 @@ function initializeMCPServer(apiClient, authContext) {
     {
       description: "Prepare task for PR creation. Returns PR suggestions. After creating PR locally, call report_pr to transition to REVIEW. Requires IN_PROGRESS state.",
       inputSchema: {
-        projectId: import_zod4.z.string().describe("The project ID"),
-        taskId: import_zod4.z.string().describe("The task ID to complete"),
-        pullRequestTitle: import_zod4.z.string().optional().describe("PR title (max 300 chars)"),
-        pullRequestBody: import_zod4.z.string().optional().describe("PR body/description (max 10000 chars)")
+        projectId: import_zod9.z.string().describe("The project ID"),
+        taskId: import_zod9.z.string().describe("The task ID to complete"),
+        pullRequestTitle: import_zod9.z.string().optional().describe("PR title (max 300 chars)"),
+        pullRequestBody: import_zod9.z.string().optional().describe("PR body/description (max 10000 chars)")
       }
     },
     async (args) => {
@@ -1862,10 +2434,10 @@ function initializeMCPServer(apiClient, authContext) {
     {
       description: "Report unrecoverable errors (BUILD_FAILURE, TEST_FAILURE, CONFLICT, AUTH_ERROR). Consider abandon_task after.",
       inputSchema: {
-        taskId: import_zod4.z.string().describe("The task ID"),
-        errorType: import_zod4.z.nativeEnum(ErrorType).describe("Error type: BUILD_FAILURE, TEST_FAILURE, CONFLICT, AUTH_ERROR, OTHER"),
-        errorMessage: import_zod4.z.string().describe("Error message (max 1000 chars)"),
-        context: import_zod4.z.string().optional().describe("Additional context (max 2000 chars)")
+        taskId: import_zod9.z.string().describe("The task ID"),
+        errorType: import_zod9.z.nativeEnum(ErrorType).describe("Error type: BUILD_FAILURE, TEST_FAILURE, CONFLICT, AUTH_ERROR, OTHER"),
+        errorMessage: import_zod9.z.string().describe("Error message (max 1000 chars)"),
+        context: import_zod9.z.string().optional().describe("Additional context (max 2000 chars)")
       }
     },
     async (args) => {
@@ -1900,7 +2472,7 @@ function initializeMCPServer(apiClient, authContext) {
     {
       description: "Load project README, tech stack, and coding conventions. Call after selecting project.",
       inputSchema: {
-        projectId: import_zod4.z.string().describe("The project ID")
+        projectId: import_zod9.z.string().describe("The project ID")
       }
     },
     async (args) => {
@@ -1930,8 +2502,8 @@ function initializeMCPServer(apiClient, authContext) {
     {
       description: "Document implementation decisions. Notes persist for future reference and handoff.",
       inputSchema: {
-        taskId: import_zod4.z.string().describe("The task ID"),
-        content: import_zod4.z.string().describe("Note content (max 500 chars)")
+        taskId: import_zod9.z.string().describe("The task ID"),
+        content: import_zod9.z.string().describe("Note content (max 500 chars)")
       }
     },
     async (args) => {
@@ -1960,9 +2532,9 @@ function initializeMCPServer(apiClient, authContext) {
     {
       description: "Release task assignment and optionally clean up branch. Task returns to TODO. Use after errors.",
       inputSchema: {
-        projectId: import_zod4.z.string().describe("The project ID"),
-        taskId: import_zod4.z.string().describe("The task ID to abandon"),
-        deleteBranch: import_zod4.z.boolean().optional().describe("Whether to delete the associated branch")
+        projectId: import_zod9.z.string().describe("The project ID"),
+        taskId: import_zod9.z.string().describe("The task ID to abandon"),
+        deleteBranch: import_zod9.z.boolean().optional().describe("Whether to delete the associated branch")
       }
     },
     async (args) => {
@@ -1996,9 +2568,9 @@ function initializeMCPServer(apiClient, authContext) {
     {
       description: "Report a branch created by the agent. Call after using git to create and push a branch. Task must be IN_PROGRESS.",
       inputSchema: {
-        projectId: import_zod4.z.string().describe("The project ID"),
-        taskId: import_zod4.z.string().describe("The task ID"),
-        branchName: import_zod4.z.string().describe("Name of the branch created (e.g., feature/TASK-123-fix-login)")
+        projectId: import_zod9.z.string().describe("The project ID"),
+        taskId: import_zod9.z.string().describe("The task ID"),
+        branchName: import_zod9.z.string().describe("Name of the branch created (e.g., feature/TASK-123-fix-login)")
       }
     },
     async (args) => {
@@ -2032,10 +2604,10 @@ function initializeMCPServer(apiClient, authContext) {
     {
       description: "Report a PR created by the agent. Call after using gh pr create. Transitions task to REVIEW state.",
       inputSchema: {
-        projectId: import_zod4.z.string().describe("The project ID"),
-        taskId: import_zod4.z.string().describe("The task ID"),
-        pullRequestUrl: import_zod4.z.string().describe("Full URL of the created PR (e.g., https://github.com/owner/repo/pull/123)"),
-        pullRequestNumber: import_zod4.z.number().describe("PR number (e.g., 123)")
+        projectId: import_zod9.z.string().describe("The project ID"),
+        taskId: import_zod9.z.string().describe("The task ID"),
+        pullRequestUrl: import_zod9.z.string().describe("Full URL of the created PR (e.g., https://github.com/owner/repo/pull/123)"),
+        pullRequestNumber: import_zod9.z.number().describe("PR number (e.g., 123)")
       }
     },
     async (args) => {
@@ -2070,8 +2642,8 @@ function initializeMCPServer(apiClient, authContext) {
     {
       description: "Soft-delete a task. Hidden but restorable via unarchive_task.",
       inputSchema: {
-        projectId: import_zod4.z.string().describe("The project ID"),
-        taskId: import_zod4.z.string().describe("The task ID to archive")
+        projectId: import_zod9.z.string().describe("The project ID"),
+        taskId: import_zod9.z.string().describe("The task ID to archive")
       }
     },
     async (args) => {
@@ -2104,8 +2676,8 @@ function initializeMCPServer(apiClient, authContext) {
     {
       description: "Restore previously archived task to original state.",
       inputSchema: {
-        projectId: import_zod4.z.string().describe("The project ID"),
-        taskId: import_zod4.z.string().describe("The task ID to restore")
+        projectId: import_zod9.z.string().describe("The project ID"),
+        taskId: import_zod9.z.string().describe("The task ID to restore")
       }
     },
     async (args) => {
@@ -2138,9 +2710,9 @@ function initializeMCPServer(apiClient, authContext) {
     {
       description: "Create new project in personal workspace linked to GitHub repository.",
       inputSchema: {
-        name: import_zod4.z.string().describe("Project name (max 100 chars)"),
-        description: import_zod4.z.string().optional().describe("Project description (max 500 chars)"),
-        repositoryUrl: import_zod4.z.string().describe("GitHub repository URL")
+        name: import_zod9.z.string().describe("Project name (max 100 chars)"),
+        description: import_zod9.z.string().optional().describe("Project description (max 500 chars)"),
+        repositoryUrl: import_zod9.z.string().describe("GitHub repository URL")
       }
     },
     async (args) => {
@@ -2174,14 +2746,14 @@ function initializeMCPServer(apiClient, authContext) {
     {
       description: "Create task with title, description, acceptance criteria. Starts in DRAFT. Priority: LOW/MEDIUM/HIGH/CRITICAL.",
       inputSchema: {
-        projectId: import_zod4.z.string().describe("The project ID to create the task in"),
-        epicId: import_zod4.z.string().nullable().optional().describe("Optional epic ID to associate the task with"),
-        title: import_zod4.z.string().describe("Task title (max 200 chars)"),
-        description: import_zod4.z.string().describe("Task description (max 5000 chars)"),
-        priority: import_zod4.z.nativeEnum(TaskPriority).optional().describe("Task priority: LOW, MEDIUM, HIGH, CRITICAL (default: MEDIUM)"),
-        acceptanceCriteria: import_zod4.z.array(
-          import_zod4.z.object({
-            description: import_zod4.z.string().describe("Acceptance criterion description (max 500 chars)")
+        projectId: import_zod9.z.string().describe("The project ID to create the task in"),
+        epicId: import_zod9.z.string().nullable().optional().describe("Optional epic ID to associate the task with"),
+        title: import_zod9.z.string().describe("Task title (max 200 chars)"),
+        description: import_zod9.z.string().describe("Task description (max 5000 chars)"),
+        priority: import_zod9.z.nativeEnum(TaskPriority).optional().describe("Task priority: LOW, MEDIUM, HIGH, CRITICAL (default: MEDIUM)"),
+        acceptanceCriteria: import_zod9.z.array(
+          import_zod9.z.object({
+            description: import_zod9.z.string().describe("Acceptance criterion description (max 500 chars)")
           })
         ).describe("Array of acceptance criteria (at least 1 required)")
       }
@@ -2220,10 +2792,10 @@ function initializeMCPServer(apiClient, authContext) {
     {
       description: "Return task from REVIEW to IN_PROGRESS with feedback. Original assignee addresses changes.",
       inputSchema: {
-        projectId: import_zod4.z.string().describe("The project ID"),
-        taskId: import_zod4.z.string().describe("The task ID to review"),
-        reviewComments: import_zod4.z.string().describe("Review comments explaining requested changes (max 5000 chars)"),
-        requestedChanges: import_zod4.z.array(import_zod4.z.string()).optional().describe("List of specific changes requested")
+        projectId: import_zod9.z.string().describe("The project ID"),
+        taskId: import_zod9.z.string().describe("The task ID to review"),
+        reviewComments: import_zod9.z.string().describe("Review comments explaining requested changes (max 5000 chars)"),
+        requestedChanges: import_zod9.z.array(import_zod9.z.string()).optional().describe("List of specific changes requested")
       }
     },
     async (args) => {
@@ -2258,9 +2830,9 @@ function initializeMCPServer(apiClient, authContext) {
     {
       description: "Approve completed work and mark DONE. Only for REVIEW state tasks.",
       inputSchema: {
-        projectId: import_zod4.z.string().describe("The project ID"),
-        taskId: import_zod4.z.string().describe("The task ID to approve"),
-        reviewComments: import_zod4.z.string().optional().describe("Optional approval comments (max 2000 chars)")
+        projectId: import_zod9.z.string().describe("The project ID"),
+        taskId: import_zod9.z.string().describe("The task ID to approve"),
+        reviewComments: import_zod9.z.string().optional().describe("Optional approval comments (max 2000 chars)")
       }
     },
     async (args) => {
@@ -2294,10 +2866,10 @@ function initializeMCPServer(apiClient, authContext) {
     {
       description: "Verify a DRAFT task and move it to TODO state. Requires task to pass programmatic validation (title 10+ chars, description 50+ chars, each criterion 20+ chars). If approved=false, stores feedback with NEEDS_REVISION status.",
       inputSchema: {
-        projectId: import_zod4.z.string().describe("The project ID"),
-        taskId: import_zod4.z.string().describe("The task ID to verify"),
-        approved: import_zod4.z.boolean().describe("Whether to approve the task"),
-        feedback: import_zod4.z.string().optional().describe("Feedback for the task (required if not approved)")
+        projectId: import_zod9.z.string().describe("The project ID"),
+        taskId: import_zod9.z.string().describe("The task ID to verify"),
+        approved: import_zod9.z.boolean().describe("Whether to approve the task"),
+        feedback: import_zod9.z.string().optional().describe("Feedback for the task (required if not approved)")
       }
     },
     async (args) => {
@@ -2328,8 +2900,8 @@ function initializeMCPServer(apiClient, authContext) {
     {
       description: "Get state-appropriate prompt for a task. Returns verify prompt for DRAFT, assignment prompt for TODO, or continue prompt for IN_PROGRESS tasks.",
       inputSchema: {
-        projectId: import_zod4.z.string().describe("The project ID"),
-        taskId: import_zod4.z.string().describe("The task ID")
+        projectId: import_zod9.z.string().describe("The project ID"),
+        taskId: import_zod9.z.string().describe("The task ID")
       }
     },
     async (args) => {
@@ -2360,17 +2932,17 @@ function initializeMCPServer(apiClient, authContext) {
   server.registerTool(
     "update_task",
     {
-      description: "Update task details (title, description, priority, acceptanceCriteria). Only works for DRAFT and TODO states. If task is in TODO state, it reverts to DRAFT and requires re-verification.",
+      description: "Update task details (title, description, priority, acceptanceCriteria). Only works for DRAFT and TODO states. Task stays in its current state.",
       inputSchema: {
-        projectId: import_zod4.z.string().describe("The project ID"),
-        taskId: import_zod4.z.string().describe("The task ID to update"),
-        title: import_zod4.z.string().optional().describe("New task title"),
-        description: import_zod4.z.string().optional().describe("New task description"),
-        priority: import_zod4.z.nativeEnum(TaskPriority).optional().describe("New task priority"),
-        acceptanceCriteria: import_zod4.z.array(
-          import_zod4.z.object({
-            id: import_zod4.z.string().optional().describe("Existing criterion ID (for updates)"),
-            description: import_zod4.z.string().describe("Criterion description")
+        projectId: import_zod9.z.string().describe("The project ID"),
+        taskId: import_zod9.z.string().describe("The task ID to update"),
+        title: import_zod9.z.string().optional().describe("New task title"),
+        description: import_zod9.z.string().optional().describe("New task description"),
+        priority: import_zod9.z.nativeEnum(TaskPriority).optional().describe("New task priority"),
+        acceptanceCriteria: import_zod9.z.array(
+          import_zod9.z.object({
+            id: import_zod9.z.string().optional().describe("Existing criterion ID (for updates)"),
+            description: import_zod9.z.string().describe("Criterion description")
           })
         ).optional().describe("New acceptance criteria (replaces existing)")
       }
@@ -2426,6 +2998,7 @@ function initializeMCPServer(apiClient, authContext) {
       };
     }
   );
+  registerMCPApps(server, apiClient, authContext);
   return server;
 }
 function handleApiError(error) {
@@ -2460,30 +3033,30 @@ function handleApiError(error) {
     isError: true
   };
 }
-var ActiveTaskSchema = import_zod4.z.object({
-  taskId: import_zod4.z.string().min(1),
-  projectId: import_zod4.z.string().min(1),
-  branchName: import_zod4.z.string().optional(),
-  worktreePath: import_zod4.z.string().optional(),
-  startedAt: import_zod4.z.string().optional()
+var ActiveTaskSchema = import_zod9.z.object({
+  taskId: import_zod9.z.string().min(1),
+  projectId: import_zod9.z.string().min(1),
+  branchName: import_zod9.z.string().optional(),
+  worktreePath: import_zod9.z.string().optional(),
+  startedAt: import_zod9.z.string().optional()
 });
 async function checkActiveTask() {
-  const fs = await import("fs");
-  const path = await import("path");
+  const fs2 = await import("fs");
+  const path2 = await import("path");
   const cwd = process.cwd();
-  const collabDir = path.join(cwd, ".collab");
-  const activeTaskPath = path.join(collabDir, "active-task.json");
+  const collabDir = path2.join(cwd, ".collab");
+  const activeTaskPath = path2.join(collabDir, "active-task.json");
   try {
-    const resolvedPath = path.resolve(activeTaskPath);
-    const resolvedCollabDir = path.resolve(collabDir);
-    if (!resolvedPath.startsWith(resolvedCollabDir + path.sep) && resolvedPath !== resolvedCollabDir) {
+    const resolvedPath = path2.resolve(activeTaskPath);
+    const resolvedCollabDir = path2.resolve(collabDir);
+    if (!resolvedPath.startsWith(resolvedCollabDir + path2.sep) && resolvedPath !== resolvedCollabDir) {
       return {
         hasActiveTask: false,
         task: null,
         error: "Invalid active task path"
       };
     }
-    const stats = await fs.promises.lstat(activeTaskPath);
+    const stats = await fs2.promises.lstat(activeTaskPath);
     if (stats.isSymbolicLink()) {
       return {
         hasActiveTask: false,
@@ -2497,7 +3070,7 @@ async function checkActiveTask() {
         task: null
       };
     }
-    const content = await fs.promises.readFile(activeTaskPath, "utf-8");
+    const content = await fs2.promises.readFile(activeTaskPath, "utf-8");
     let parsed;
     try {
       parsed = JSON.parse(content);
@@ -2558,6 +3131,12 @@ async function validateOAuthToken(baseUrl, accessToken) {
   }
   return response.json();
 }
+function buildWwwAuthenticateHeader(req) {
+  const protocol = req.headers["x-forwarded-proto"] || req.protocol || "https";
+  const host = req.headers["x-forwarded-host"] || req.headers.host;
+  const resourceMetadataUrl = `${protocol}://${host}/.well-known/oauth-protected-resource`;
+  return `Bearer resource_metadata="${resourceMetadataUrl}"`;
+}
 function createAuthMiddleware(baseUrl) {
   return async (req, res, next) => {
     const authHeader = req.headers.authorization;
@@ -2566,7 +3145,7 @@ function createAuthMiddleware(baseUrl) {
       try {
         const validation = await validateOAuthToken(baseUrl, bearerToken);
         if (!validation.valid) {
-          res.status(401).json({
+          res.status(401).set("WWW-Authenticate", buildWwwAuthenticateHeader(req)).json({
             jsonrpc: "2.0",
             error: {
               code: -32001,
@@ -2603,7 +3182,7 @@ function createAuthMiddleware(baseUrl) {
         return;
       } catch (error) {
         console.error("[collab-mcp-server] OAuth validation error:", error);
-        res.status(401).json({
+        res.status(401).set("WWW-Authenticate", buildWwwAuthenticateHeader(req)).json({
           jsonrpc: "2.0",
           error: {
             code: -32001,
@@ -2616,7 +3195,7 @@ function createAuthMiddleware(baseUrl) {
     }
     const apiKey = req.headers["x-api-key"];
     if (!apiKey || typeof apiKey !== "string") {
-      res.status(401).json({
+      res.status(401).set("WWW-Authenticate", buildWwwAuthenticateHeader(req)).json({
         jsonrpc: "2.0",
         error: {
           code: -32001,
@@ -2736,19 +3315,11 @@ async function createHTTPServer() {
   }
   const app = (0, import_express.default)();
   app.use(import_express.default.json());
-  app.get("/mcp/health", (_req, res) => {
-    res.json({
-      status: "ok",
-      version: VERSION,
-      activeSessions: sessions.size,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
-    });
-  });
-  app.get("/mcp/.well-known/oauth-protected-resource", (_req, res) => {
-    const protocol = _req.headers["x-forwarded-proto"] || _req.protocol || "https";
-    const host = _req.headers["x-forwarded-host"] || _req.headers.host;
+  function buildProtectedResourceMetadata(req) {
+    const protocol = req.headers["x-forwarded-proto"] || req.protocol || "https";
+    const host = req.headers["x-forwarded-host"] || req.headers.host;
     const resourceUrl = `${protocol}://${host}/mcp`;
-    res.json({
+    return {
       resource: resourceUrl,
       authorization_servers: [baseUrl],
       scopes_supported: [
@@ -2758,8 +3329,48 @@ async function createHTTPServer() {
       ],
       bearer_methods_supported: ["header"],
       resource_documentation: `${baseUrl}/docs/mcp`
+    };
+  }
+  app.use((_req, res, next) => {
+    const origin = _req.headers.origin;
+    const allowedOrigins = [
+      "https://claude.ai",
+      "https://claude.com",
+      "http://localhost:3000",
+      "http://localhost:5173"
+    ];
+    if (origin && allowedOrigins.includes(origin)) {
+      res.header("Access-Control-Allow-Origin", origin);
+    }
+    res.header(
+      "Access-Control-Allow-Methods",
+      "GET, POST, DELETE, OPTIONS"
+    );
+    res.header(
+      "Access-Control-Allow-Headers",
+      "Content-Type, Authorization, X-API-Key, mcp-session-id"
+    );
+    res.header("Access-Control-Expose-Headers", "mcp-session-id");
+    if (_req.method === "OPTIONS") {
+      res.status(204).end();
+      return;
+    }
+    next();
+  });
+  app.get("/mcp/health", (_req, res) => {
+    res.json({
+      status: "ok",
+      version: VERSION,
+      activeSessions: sessions.size,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
     });
   });
+  app.get("/.well-known/oauth-protected-resource", (req, res) => {
+    res.json(buildProtectedResourceMetadata(req));
+  });
+  app.get("/mcp/.well-known/oauth-protected-resource", (req, res) => {
+    res.json(buildProtectedResourceMetadata(req));
+  });
   const authMiddleware = createAuthMiddleware(baseUrl);
   app.post("/mcp", authMiddleware, async (req, res) => {
     const authReq = req;
@@ -2895,7 +3506,7 @@ async function createHTTPServer() {
     console.error(`[collab-mcp-server] MCP endpoint: POST/GET/DELETE /mcp`);
     console.error(`[collab-mcp-server] Health check: GET /mcp/health`);
     console.error(
-      `[collab-mcp-server] OAuth metadata: GET /mcp/.well-known/oauth-protected-resource`
+      `[collab-mcp-server] OAuth PRM: GET /.well-known/oauth-protected-resource`
     );
     console.error(`[collab-mcp-server] API URL: ${baseUrl}`);
     console.error(