@namzu/cli 32.0.0 → 33.0.0

package/dist/integrations/mcp/servers.js

@@ -31,7 +31,9 @@
  * and a headless run has nobody to read anything, so it refuses. This module
  * reports; the callers decide.
  */
-import { MCPClient, mcpToolset, requireApproval, } from '@namzu/sdk';
+import { UnauthorizedError, auth, extractWWWAuthenticateParams, withOAuth, } from '@modelcontextprotocol/client';
+import { MCPClient, MCPHttpStatusError, mcpToolset, requireApproval, } from '@namzu/sdk';
+import { McpOAuthLoginRequiredError, McpOAuthStoreError, createMcpOAuthProvider, hasMcpOAuthTokens, isSecureMcpOAuthUrl, mcpOAuthPath, } from './oauth-store.js';
 /**
  * How long a single server gets to connect, hand shake and list its tools.
  *
@@ -137,6 +139,148 @@ export function transportFor(spec, defaultCwd, env = process.env) {
     }
     return 'it declares neither a command nor a url';
 }
+/** One refresh per credential file; unrelated MCP requests remain concurrent. */
+const mcpOAuthRefreshes = new Map();
+function mcpOAuthUnauthorized() {
+    return new MCPHttpStatusError('MCP OAuth', 401, 'authorization required; run `namzu mcp login <server>`', '');
+}
+/**
+ * A running agent may reuse a saved OAuth grant, including its refresh token,
+ * but only an explicit `mcp login` may begin browser authorization. The store
+ * binds the grant to this complete URL (path and query included), and the
+ * fetch guard keeps it there even if a transport changes its request target.
+ */
+function withSavedMcpOAuth(transport) {
+    if (transport.type !== 'streamable-http')
+        return transport;
+    // A configured Authorization header is the operator's chosen credential.
+    // The official middleware would replace it with the saved bearer token.
+    if (Object.keys(transport.headers ?? {}).some((key) => key.toLowerCase() === 'authorization')) {
+        return transport;
+    }
+    let endpoint;
+    try {
+        endpoint = new URL(transport.url);
+    }
+    catch {
+        return transport;
+    }
+    // The OAuth store accepts HTTPS and loopback HTTP. Preserve ordinary MCP
+    // behavior for other URLs instead of turning their lack of OAuth into an
+    // unrelated startup error.
+    if (!isSecureMcpOAuthUrl(endpoint))
+        return transport;
+    if (!hasMcpOAuthTokens(transport.url))
+        return transport;
+    const provider = createMcpOAuthProvider({ endpoint: transport.url });
+    const rawFetch = fetch;
+    const oauthNetworkFetch = (input, init) => {
+        const target = new URL(String(input));
+        if (!isSecureMcpOAuthUrl(target)) {
+            throw new McpOAuthStoreError('MCP OAuth network requests require HTTPS or loopback HTTP.');
+        }
+        // OAuth discovery and token requests may carry a client secret or refresh
+        // token. A 307/308 must never replay their POST body to a redirect target.
+        return rawFetch(input, { ...init, redirect: 'manual' });
+    };
+    const credentialKey = mcpOAuthPath(transport.url);
+    const authenticatedFetch = withOAuth(provider, transport.url)(async (input, init) => {
+        if (input.toString() !== transport.url) {
+            throw new Error('MCP OAuth refused a request to a different endpoint');
+        }
+        // The bearer token is attached by `withOAuth` before this call. Never
+        // auto-follow a redirect with it, including to another path on the
+        // same origin, even if an SDK transport changes its own redirect mode.
+        const response = await rawFetch(input, { ...init, redirect: 'manual' });
+        if (response.status !== 401)
+            return response;
+        // Intercept the challenge before `withOAuth` can start an independent
+        // refresh for every simultaneous request. Its token attachment remains
+        // authoritative; the official `auth()` performs the refresh once.
+        const attemptedAuthorization = new Headers(init?.headers).get('authorization');
+        const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
+        void response.body?.cancel().catch(() => undefined);
+        let refresh = mcpOAuthRefreshes.get(credentialKey);
+        if (!refresh) {
+            refresh = (async () => {
+                const current = await provider.tokens();
+                if (!current)
+                    throw new McpOAuthLoginRequiredError();
+                // Another connection or process may have renewed this grant while
+                // the old request was in flight. Its new access token is enough.
+                if (attemptedAuthorization !== `Bearer ${current.access_token}`)
+                    return;
+                const result = await auth(provider, {
+                    serverUrl: transport.url,
+                    resourceMetadataUrl,
+                    scope,
+                    fetchFn: oauthNetworkFetch,
+                });
+                if (result !== 'AUTHORIZED')
+                    throw new McpOAuthLoginRequiredError();
+            })();
+            mcpOAuthRefreshes.set(credentialKey, refresh);
+            const ownedRefresh = refresh;
+            void ownedRefresh.then(() => {
+                if (mcpOAuthRefreshes.get(credentialKey) === ownedRefresh) {
+                    mcpOAuthRefreshes.delete(credentialKey);
+                }
+            }, () => {
+                if (mcpOAuthRefreshes.get(credentialKey) === ownedRefresh) {
+                    mcpOAuthRefreshes.delete(credentialKey);
+                }
+            });
+        }
+        try {
+            await refresh;
+        }
+        catch {
+            // A second process may have won a rotating-token refresh while
+            // this one failed. The store's issuer/endpoint binding still holds;
+            // one retry with its new token is safe and avoids a false failure.
+            const latest = await provider.tokens();
+            if (!latest || attemptedAuthorization === `Bearer ${latest.access_token}`) {
+                throw mcpOAuthUnauthorized();
+            }
+        }
+        const current = await provider.tokens();
+        if (!current)
+            throw mcpOAuthUnauthorized();
+        const headers = new Headers(init?.headers);
+        headers.set('Authorization', `Bearer ${current.access_token}`);
+        const retried = await rawFetch(input, { ...init, headers, redirect: 'manual' });
+        if (retried.status === 401) {
+            void retried.body?.cancel().catch(() => undefined);
+            throw mcpOAuthUnauthorized();
+        }
+        return retried;
+    });
+    const oauthFetch = async (input, init) => {
+        // `withOAuth` authenticates any URL handed to it. Our Streamable HTTP
+        // transport sends the configured URL exactly; reject any other target
+        // before the bearer token can reach it.
+        if (input !== transport.url) {
+            throw new Error('MCP OAuth refused a request to a different endpoint');
+        }
+        try {
+            if (!(await provider.tokens()))
+                throw new McpOAuthLoginRequiredError();
+            return await authenticatedFetch(input, init);
+        }
+        catch (error) {
+            if (error instanceof UnauthorizedError ||
+                error instanceof McpOAuthLoginRequiredError ||
+                error instanceof McpOAuthStoreError) {
+                // The official middleware throws after a 401 or failed refresh.
+                // The SDK's era probe recognizes its own HTTP status error and
+                // refuses 401 instead of offering a legacy initialize handshake.
+                throw mcpOAuthUnauthorized();
+            }
+            throw error;
+        }
+    };
+    return { ...transport, fetch: oauthFetch };
+}
 async function withDeadline(work, ms, what) {
     let timer;
     try {
@@ -255,9 +399,18 @@ export async function connectMcpServers(config, options) {
             startupFailed.push({ name, reason: toolsetOptions });
             continue;
         }
+        let connectedTransport;
+        try {
+            connectedTransport =
+                transport.type === 'streamable-http' ? withSavedMcpOAuth(transport) : transport;
+        }
+        catch (error) {
+            startupFailed.push({ name, reason: reasonOf(error) });
+            continue;
+        }
         const client = new MCPClient({
             serverName: name,
-            transport,
+            transport: connectedTransport,
             ...(eraProbeTimeoutMs !== undefined ? { eraProbeTimeoutMs } : {}),
         });
         const discovery = {

package/dist/integrations/mcp/servers.js.map

@@ -1 +1 @@
-{"version":3,"file":"servers.js","sourceRoot":"","sources":["../../../src/integrations/mcp/servers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EACN,SAAS,EAMT,UAAU,EACV,eAAe,GACf,MAAM,YAAY,CAAA;AAEnB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAExC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAA;AA4IrC;;;GAGG;AACH,MAAM,eAAe,GAAG,iCAAiC,CAAA;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,qBAAqB,CACpC,MAAwC,EACxC,GAAsB;IAEtB,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,IAAI,OAA2B,CAAA;QAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;YACrE,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAA;YACvB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,GAAG,IAAI,CAAA;gBACd,OAAO,KAAK,CAAA;YACb,CAAC;YACD,OAAO,KAAK,CAAA;QACb,CAAC,CAAC,CAAA;QACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,iBAAiB,OAAO,mDAAmD,CAAA;QACnF,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAA;IACvB,CAAC;IACD,OAAO,MAAM,CAAA;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAC3B,IAAmB,EACnB,UAAkB,EAClB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;IACrF,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;IACzE,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;QAC1B,OAAO,iDAAiD,CAAA;IACzD,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QAChB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/E,IAAI,OAAO,WAAW,KAAK,QAAQ;YAAE,OAAO,WAAW,CAAA;QACvD,OAAO;YACN,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,IAAI,CAAC,OAAiB;YAC/B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,UAAU;SAC3B,CAAA;IACF,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC3F,IAAI,OAAO,eAAe,KAAK,QAAQ;YAAE,OAAO,eAAe,CAAA;QAC/D,OAAO;YACN,IAAI,EAAE,iBAAiB;YACvB,GAAG,EAAE,IAAI,CAAC,GAAa;YACvB,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAA;IACF,CAAC;IACD,OAAO,yCAAyC,CAAA;AACjD,CAAC;AAED,KAAK,UAAU,YAAY,CAAI,IAAgB,EAAE,EAAU,EAAE,IAAY;IACxE,IAAI,KAAiC,CAAA;IACrC,IAAI,CAAC;QACJ,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACzB,IAAI;YACJ,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAChC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,0BAA0B,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YACzF,CAAC,CAAC;SACF,CAAC,CAAA;IACH,CAAC;YAAS,CAAC;QACV,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAC/B,CAAC;AACF,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;AAE7F;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAmB;IACrD,MAAM,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAA;IAChC,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,kBAAkB,CAAA;IAC/C,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAC/D,OAAO,mEAAmE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAA;IAC/F,CAAC;IACD,OAAO,EAAE,CAAA;AACV,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAmB;IACrD,MAAM,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAA;IACjC,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACtC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAC/D,OAAO,oEAAoE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAA;IAChG,CAAC;IACD,OAAO,EAAE,CAAA;AACV,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAmB,EAAE,IAAY;IAC3D,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,MAAM,CAAU,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QACzB,IACC,KAAK,KAAK,SAAS;YACnB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAC7F,CAAC;YACF,OAAO,GAAG,KAAK,mDAAmD,CAAA;QACnE,CAAC;IACF,CAAC;IACD,IACC,IAAI,CAAC,UAAU,KAAK,SAAS;QAC7B,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,EAC9D,CAAC;QACF,OAAO,iDAAiD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAA;IAC1F,CAAC;IACD,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACrF,OAAO,uCAAuC,CAAA;IAC/C,CAAC;IACD,IAAI,IAAI,CAAC,mBAAmB,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC7F,OAAO,2CAA2C,CAAA;IACnD,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/E,OAAO,oCAAoC,CAAA;IAC5C,CAAC;IACD,OAAO;QACN,EAAE,EAAE,OAAO,IAAI,EAAE;QACjB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;KAC7C,CAAA;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,MAAoC,EACpC,OAAiC;IAEjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;IAC5C,MAAM,QAAQ,GAAc,EAAE,CAAA;IAC9B,MAAM,aAAa,GAAsB,EAAE,CAAA;IAC3C,MAAM,OAAO,GAAgB,EAAE,CAAA;IAC/B,MAAM,WAAW,GAaZ,EAAE,CAAA;IAEP,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/C,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC,CAAA;YACrE,SAAQ;QACT,CAAC;QACD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;QACjD,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YACnC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;YAC/C,SAAQ;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;QACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC9C,SAAQ;QACT,CAAC;QACD,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;QAClD,IAAI,OAAO,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YAC3C,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAA;YACvD,SAAQ;QACT,CAAC;QACD,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACpD,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;YACxC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAA;YACpD,SAAQ;QACT,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;YAC5B,UAAU,EAAE,IAAI;YAChB,SAAS;YACT,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC,CAAA;QACF,MAAM,SAAS,GAAG;YACjB,KAAK,EAAE,IAAI,GAAG,EAAU;YACxB,OAAO,EAAE,IAAI,GAAG,EAAU;YAC1B,OAAO,EAAE,IAAI,GAAG,EAAU;YAC1B,OAAO,EAAE,IAAI,GAAG,EAGb;SACH,CAAA;QACD,IAAI,CAAC;YACJ,MAAM,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,IAAI,GAAG,CAAC,CAAA;YAClE,MAAM,UAAU,GAAG,MAAM,YAAY,CACpC,UAAU,CAAC,MAAM,EAAE;gBAClB,GAAG,cAAc;gBACjB,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;oBACtB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK;wBAAE,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;oBACzD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO;wBAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;oBAC7D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO;wBAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;gBAC9D,CAAC;gBACD,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC;aACtE,CAAC,EACF,QAAQ,EACR,WAAW,IAAI,yBAAyB,CACxC,CAAA;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe;gBACnC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;gBACnD,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAA;YAClB,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAA;YACzB,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAA;YAChE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACnD,sEAAsE;YACtE,mEAAmE;YACnE,EAAE;YACF,mEAAmE;YACnE,oEAAoE;YACpE,6DAA6D;YAC7D,iEAAiE;YACjE,mEAAmE;YACnE,2DAA2D;YAC3D,IAAI,CAAC;gBACJ,MAAM,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,gBAAgB,EAAE,YAAY,IAAI,GAAG,CAAC,CAAA;YAC/E,CAAC;YAAC,MAAM,CAAC;gBACR,qEAAqE;gBACrE,gEAAgE;YACjE,CAAC;QACF,CAAC;IACF,CAAC;IAED,MAAM,OAAO,GAAG,GAGd,EAAE;QACH,MAAM,SAAS,GAAyB,EAAE,CAAA;QAC1C,MAAM,MAAM,GAAsB,CAAC,GAAG,aAAa,CAAC,CAAA;QACpD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC;YACjF,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;gBACvF,SAAS,CAAC,IAAI,CAAC;oBACd,IAAI;oBACJ,SAAS,EAAE,KAAK,CAAC,MAAM;oBACvB,KAAK,EAAE,KAAK;oBACZ,KAAK,EAAE;wBACN,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;wBAC3B,OAAO,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;wBAC/B,OAAO,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;qBAC/B;oBACD,OAAO,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CACnE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CACxC;oBACD,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS;wBACzC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,kBAAkB,EAAE;wBAC5C,CAAC,CAAC,EAAE,CAAC;iBACN,CAAC,CAAA;gBACF,SAAQ;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACX,IAAI;gBACJ,MAAM,EACL,KAAK,CAAC,KAAK;oBACX,CAAC,KAAK,CAAC,MAAM,KAAK,cAAc;wBAC/B,CAAC,CAAC,iCAAiC;wBACnC,CAAC,CAAC,iBAAiB,KAAK,CAAC,MAAM,EAAE,CAAC;aACpC,CAAC,CAAA;QACH,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IAC7B,CAAC,CAAA;IAED,OAAO;QACN,IAAI,KAAK;YACR,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAA;QAClD,CAAC;QACD,QAAQ;QACR,OAAO;QACP,IAAI,SAAS;YACZ,OAAO,OAAO,EAAE,CAAC,SAAS,CAAA;QAC3B,CAAC;QACD,IAAI,MAAM;YACT,OAAO,OAAO,EAAE,CAAC,MAAM,CAAA;QACxB,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YACjB,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;YAC3D,MAAM,OAAO,CAAC,GAAG,CAChB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACjB,YAAY,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBAClF,8DAA8D;gBAC9D,8DAA8D;gBAC9D,0DAA0D;gBAC1D,iDAAiD;YAClD,CAAC,CAAC,CACF,CACD,CAAA;QACF,CAAC;KACD,CAAA;AACF,CAAC"}
+{"version":3,"file":"servers.js","sourceRoot":"","sources":["../../../src/integrations/mcp/servers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EACN,iBAAiB,EACjB,IAAI,EACJ,4BAA4B,EAC5B,SAAS,GACT,MAAM,8BAA8B,CAAA;AAErC,OAAO,EACN,SAAS,EAET,kBAAkB,EAMlB,UAAU,EACV,eAAe,GACf,MAAM,YAAY,CAAA;AAEnB,OAAO,EACN,0BAA0B,EAC1B,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,GACZ,MAAM,kBAAkB,CAAA;AAEzB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAExC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAA;AA4IrC;;;GAGG;AACH,MAAM,eAAe,GAAG,iCAAiC,CAAA;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,qBAAqB,CACpC,MAAwC,EACxC,GAAsB;IAEtB,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,IAAI,OAA2B,CAAA;QAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;YACrE,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAA;YACvB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,GAAG,IAAI,CAAA;gBACd,OAAO,KAAK,CAAA;YACb,CAAC;YACD,OAAO,KAAK,CAAA;QACb,CAAC,CAAC,CAAA;QACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,iBAAiB,OAAO,mDAAmD,CAAA;QACnF,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAA;IACvB,CAAC;IACD,OAAO,MAAM,CAAA;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAC3B,IAAmB,EACnB,UAAkB,EAClB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;IACrF,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;IACzE,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;QAC1B,OAAO,iDAAiD,CAAA;IACzD,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QAChB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/E,IAAI,OAAO,WAAW,KAAK,QAAQ;YAAE,OAAO,WAAW,CAAA;QACvD,OAAO;YACN,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,IAAI,CAAC,OAAiB;YAC/B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,UAAU;SAC3B,CAAA;IACF,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC3F,IAAI,OAAO,eAAe,KAAK,QAAQ;YAAE,OAAO,eAAe,CAAA;QAC/D,OAAO;YACN,IAAI,EAAE,iBAAiB;YACvB,GAAG,EAAE,IAAI,CAAC,GAAa;YACvB,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAA;IACF,CAAC;IACD,OAAO,yCAAyC,CAAA;AACjD,CAAC;AAED,iFAAiF;AACjF,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAyB,CAAA;AAE1D,SAAS,oBAAoB;IAC5B,OAAO,IAAI,kBAAkB,CAC5B,WAAW,EACX,GAAG,EACH,wDAAwD,EACxD,EAAE,CACF,CAAA;AACF,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CACzB,SAAsD;IAEtD,IAAI,SAAS,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,SAAS,CAAA;IAC1D,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,EAAE,CAAC;QAC/F,OAAO,SAAS,CAAA;IACjB,CAAC;IACD,IAAI,QAAa,CAAA;IACjB,IAAI,CAAC;QACJ,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAA;IACjB,CAAC;IACD,yEAAyE;IACzE,yEAAyE;IACzE,2BAA2B;IAC3B,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAA;IACpD,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IAEvD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAA;IACpE,MAAM,QAAQ,GAAG,KAAK,CAAA;IACtB,MAAM,iBAAiB,GAAG,CAAC,KAAmB,EAAE,IAAkB,EAAqB,EAAE;QACxF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QACrC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,kBAAkB,CAAC,4DAA4D,CAAC,CAAA;QAC3F,CAAC;QACD,0EAA0E;QAC1E,2EAA2E;QAC3E,OAAO,QAAQ,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;IACxD,CAAC,CAAA;IACD,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IACjD,MAAM,kBAAkB,GAAG,SAAS,CACnC,QAAQ,EACR,SAAS,CAAC,GAAG,CACb,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,KAAK,CAAC,QAAQ,EAAE,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QACvE,CAAC;QACD,sEAAsE;QACtE,mEAAmE;QACnE,uEAAuE;QACvE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;QACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,QAAQ,CAAA;QAC5C,sEAAsE;QACtE,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,sBAAsB,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;QAC9E,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAA;QAC7E,KAAK,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACnD,IAAI,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;gBACrB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAA;gBACvC,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,0BAA0B,EAAE,CAAA;gBACpD,kEAAkE;gBAClE,iEAAiE;gBACjE,IAAI,sBAAsB,KAAK,UAAU,OAAO,CAAC,YAAY,EAAE;oBAAE,OAAM;gBACvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE;oBACnC,SAAS,EAAE,SAAS,CAAC,GAAG;oBACxB,mBAAmB;oBACnB,KAAK;oBACL,OAAO,EAAE,iBAAiB;iBAC1B,CAAC,CAAA;gBACF,IAAI,MAAM,KAAK,YAAY;oBAAE,MAAM,IAAI,0BAA0B,EAAE,CAAA;YACpE,CAAC,CAAC,EAAE,CAAA;YACJ,iBAAiB,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;YAC7C,MAAM,YAAY,GAAG,OAAO,CAAA;YAC5B,KAAK,YAAY,CAAC,IAAI,CACrB,GAAG,EAAE;gBACJ,IAAI,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,YAAY,EAAE,CAAC;oBAC3D,iBAAiB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;gBACxC,CAAC;YACF,CAAC,EACD,GAAG,EAAE;gBACJ,IAAI,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,YAAY,EAAE,CAAC;oBAC3D,iBAAiB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;gBACxC,CAAC;YACF,CAAC,CACD,CAAA;QACF,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,OAAO,CAAA;QACd,CAAC;QAAC,MAAM,CAAC;YACR,+DAA+D;YAC/D,oEAAoE;YACpE,mEAAmE;YACnE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAA;YACtC,IAAI,CAAC,MAAM,IAAI,sBAAsB,KAAK,UAAU,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC;gBAC3E,MAAM,oBAAoB,EAAE,CAAA;YAC7B,CAAC;QACF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAA;QACvC,IAAI,CAAC,OAAO;YAAE,MAAM,oBAAoB,EAAE,CAAA;QAC1C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;QAC9D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC/E,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,KAAK,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YAClD,MAAM,oBAAoB,EAAE,CAAA;QAC7B,CAAC;QACD,OAAO,OAAO,CAAA;IACf,CAAC,CAAC,CAAA;IACF,MAAM,UAAU,GAAiB,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtD,sEAAsE;QACtE,sEAAsE;QACtE,wCAAwC;QACxC,IAAI,KAAK,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QACvE,CAAC;QACD,IAAI,CAAC;YACJ,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAAE,MAAM,IAAI,0BAA0B,EAAE,CAAA;YACtE,OAAO,MAAM,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IACC,KAAK,YAAY,iBAAiB;gBAClC,KAAK,YAAY,0BAA0B;gBAC3C,KAAK,YAAY,kBAAkB,EAClC,CAAC;gBACF,gEAAgE;gBAChE,+DAA+D;gBAC/D,iEAAiE;gBACjE,MAAM,oBAAoB,EAAE,CAAA;YAC7B,CAAC;YACD,MAAM,KAAK,CAAA;QACZ,CAAC;IACF,CAAC,CAAA;IACD,OAAO,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;AAC3C,CAAC;AAED,KAAK,UAAU,YAAY,CAAI,IAAgB,EAAE,EAAU,EAAE,IAAY;IACxE,IAAI,KAAiC,CAAA;IACrC,IAAI,CAAC;QACJ,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACzB,IAAI;YACJ,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAChC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,0BAA0B,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YACzF,CAAC,CAAC;SACF,CAAC,CAAA;IACH,CAAC;YAAS,CAAC;QACV,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAC/B,CAAC;AACF,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;AAE7F;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAmB;IACrD,MAAM,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAA;IAChC,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,kBAAkB,CAAA;IAC/C,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAC/D,OAAO,mEAAmE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAA;IAC/F,CAAC;IACD,OAAO,EAAE,CAAA;AACV,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAmB;IACrD,MAAM,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAA;IACjC,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACtC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAC/D,OAAO,oEAAoE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAA;IAChG,CAAC;IACD,OAAO,EAAE,CAAA;AACV,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAmB,EAAE,IAAY;IAC3D,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,MAAM,CAAU,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QACzB,IACC,KAAK,KAAK,SAAS;YACnB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAC7F,CAAC;YACF,OAAO,GAAG,KAAK,mDAAmD,CAAA;QACnE,CAAC;IACF,CAAC;IACD,IACC,IAAI,CAAC,UAAU,KAAK,SAAS;QAC7B,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,EAC9D,CAAC;QACF,OAAO,iDAAiD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAA;IAC1F,CAAC;IACD,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACrF,OAAO,uCAAuC,CAAA;IAC/C,CAAC;IACD,IAAI,IAAI,CAAC,mBAAmB,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC7F,OAAO,2CAA2C,CAAA;IACnD,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/E,OAAO,oCAAoC,CAAA;IAC5C,CAAC;IACD,OAAO;QACN,EAAE,EAAE,OAAO,IAAI,EAAE;QACjB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;KAC7C,CAAA;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,MAAoC,EACpC,OAAiC;IAEjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;IAC5C,MAAM,QAAQ,GAAc,EAAE,CAAA;IAC9B,MAAM,aAAa,GAAsB,EAAE,CAAA;IAC3C,MAAM,OAAO,GAAgB,EAAE,CAAA;IAC/B,MAAM,WAAW,GAaZ,EAAE,CAAA;IAEP,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/C,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC,CAAA;YACrE,SAAQ;QACT,CAAC;QACD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;QACjD,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YACnC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;YAC/C,SAAQ;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;QACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC9C,SAAQ;QACT,CAAC;QACD,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;QAClD,IAAI,OAAO,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YAC3C,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAA;YACvD,SAAQ;QACT,CAAC;QACD,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACpD,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;YACxC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAA;YACpD,SAAQ;QACT,CAAC;QACD,IAAI,kBAAqC,CAAA;QACzC,IAAI,CAAC;YACJ,kBAAkB;gBACjB,SAAS,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACjF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACrD,SAAQ;QACT,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;YAC5B,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,kBAAkB;YAC7B,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC,CAAA;QACF,MAAM,SAAS,GAAG;YACjB,KAAK,EAAE,IAAI,GAAG,EAAU;YACxB,OAAO,EAAE,IAAI,GAAG,EAAU;YAC1B,OAAO,EAAE,IAAI,GAAG,EAAU;YAC1B,OAAO,EAAE,IAAI,GAAG,EAGb;SACH,CAAA;QACD,IAAI,CAAC;YACJ,MAAM,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,IAAI,GAAG,CAAC,CAAA;YAClE,MAAM,UAAU,GAAG,MAAM,YAAY,CACpC,UAAU,CAAC,MAAM,EAAE;gBAClB,GAAG,cAAc;gBACjB,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;oBACtB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK;wBAAE,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;oBACzD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO;wBAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;oBAC7D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO;wBAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;gBAC9D,CAAC;gBACD,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC;aACtE,CAAC,EACF,QAAQ,EACR,WAAW,IAAI,yBAAyB,CACxC,CAAA;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe;gBACnC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;gBACnD,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAA;YAClB,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAA;YACzB,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAA;YAChE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACnD,sEAAsE;YACtE,mEAAmE;YACnE,EAAE;YACF,mEAAmE;YACnE,oEAAoE;YACpE,6DAA6D;YAC7D,iEAAiE;YACjE,mEAAmE;YACnE,2DAA2D;YAC3D,IAAI,CAAC;gBACJ,MAAM,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,gBAAgB,EAAE,YAAY,IAAI,GAAG,CAAC,CAAA;YAC/E,CAAC;YAAC,MAAM,CAAC;gBACR,qEAAqE;gBACrE,gEAAgE;YACjE,CAAC;QACF,CAAC;IACF,CAAC;IAED,MAAM,OAAO,GAAG,GAGd,EAAE;QACH,MAAM,SAAS,GAAyB,EAAE,CAAA;QAC1C,MAAM,MAAM,GAAsB,CAAC,GAAG,aAAa,CAAC,CAAA;QACpD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC;YACjF,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;gBACvF,SAAS,CAAC,IAAI,CAAC;oBACd,IAAI;oBACJ,SAAS,EAAE,KAAK,CAAC,MAAM;oBACvB,KAAK,EAAE,KAAK;oBACZ,KAAK,EAAE;wBACN,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;wBAC3B,OAAO,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;wBAC/B,OAAO,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;qBAC/B;oBACD,OAAO,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CACnE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CACxC;oBACD,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS;wBACzC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,kBAAkB,EAAE;wBAC5C,CAAC,CAAC,EAAE,CAAC;iBACN,CAAC,CAAA;gBACF,SAAQ;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACX,IAAI;gBACJ,MAAM,EACL,KAAK,CAAC,KAAK;oBACX,CAAC,KAAK,CAAC,MAAM,KAAK,cAAc;wBAC/B,CAAC,CAAC,iCAAiC;wBACnC,CAAC,CAAC,iBAAiB,KAAK,CAAC,MAAM,EAAE,CAAC;aACpC,CAAC,CAAA;QACH,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IAC7B,CAAC,CAAA;IAED,OAAO;QACN,IAAI,KAAK;YACR,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAA;QAClD,CAAC;QACD,QAAQ;QACR,OAAO;QACP,IAAI,SAAS;YACZ,OAAO,OAAO,EAAE,CAAC,SAAS,CAAA;QAC3B,CAAC;QACD,IAAI,MAAM;YACT,OAAO,OAAO,EAAE,CAAC,MAAM,CAAA;QACxB,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YACjB,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;YAC3D,MAAM,OAAO,CAAC,GAAG,CAChB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACjB,YAAY,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBAClF,8DAA8D;gBAC9D,8DAA8D;gBAC9D,0DAA0D;gBAC1D,iDAAiD;YAClD,CAAC,CAAC,CACF,CACD,CAAA;QACF,CAAC;KACD,CAAA;AACF,CAAC"}

package/dist/integrations/mcp/user-config.d.ts

@@ -0,0 +1,25 @@
+import { type UserConfigWriteOptions } from '../../config/user-config.js';
+import type { McpServerSpec } from './servers.js';
+export interface UserMcpServer {
+    readonly name: string;
+    readonly spec: unknown;
+}
+/** Read only the user's own entries, not project/profile/managed overrides. */
+export declare function readUserMcpServers(opts?: UserConfigWriteOptions): readonly UserMcpServer[];
+export declare function isUserMcpName(name: string): boolean;
+/** Never replace an entry silently: the existing server may carry permissions. */
+export declare function addUserMcpServer(name: string, spec: McpServerSpec, opts?: UserConfigWriteOptions): string;
+export declare function removeUserMcpServer(name: string, opts?: UserConfigWriteOptions): boolean;
+export interface UserMcpServerSummary {
+    readonly name: string;
+    readonly transport: 'stdio' | 'http' | 'invalid';
+    readonly command?: string;
+    readonly endpoint?: string;
+    readonly argumentCount?: number;
+    readonly envNames?: readonly string[];
+    readonly headerNames?: readonly string[];
+    readonly inheritEnv?: readonly string[];
+}
+/** Display metadata only. Headers, environment values, and argv can contain secrets. */
+export declare function summarizeUserMcpServer(entry: UserMcpServer): UserMcpServerSummary;
+//# sourceMappingURL=user-config.d.ts.map

package/dist/integrations/mcp/user-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-config.d.ts","sourceRoot":"","sources":["../../../src/integrations/mcp/user-config.ts"],"names":[],"mappings":"AAGA,OAAO,EACN,KAAK,sBAAsB,EAI3B,MAAM,6BAA6B,CAAA;AACpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAIjD,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CACtB;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,sBAA2B,GAAG,SAAS,aAAa,EAAE,CAmB9F;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,aAAa,EACnB,IAAI,GAAE,sBAA2B,GAC/B,MAAM,CAUR;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,sBAA2B,GAAG,OAAO,CAE5F;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAA;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACvC;AAED,wFAAwF;AACxF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,aAAa,GAAG,oBAAoB,CAoCjF"}

package/dist/integrations/mcp/user-config.js

@@ -0,0 +1,92 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { isMap, parseDocument } from 'yaml';
+import { deleteUserConfigValue, setUserConfigValue, userConfigPath, } from '../../config/user-config.js';
+const MCP_NAME = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
+/** Read only the user's own entries, not project/profile/managed overrides. */
+export function readUserMcpServers(opts = {}) {
+    const file = userConfigPath(opts);
+    if (!existsSync(file))
+        return [];
+    const doc = parseDocument(readFileSync(file, 'utf8'));
+    if (doc.errors.length > 0) {
+        throw new Error(`${file} is not valid YAML (${doc.errors[0]?.message ?? 'parse error'}); fix it first`);
+    }
+    if (doc.contents !== null && !isMap(doc.contents)) {
+        throw new Error(`${file} is not a mapping of settings; fix it first`);
+    }
+    const node = doc.get('mcpServers', true);
+    if (node === undefined)
+        return [];
+    if (!isMap(node))
+        throw new Error(`${file}: mcpServers is not a mapping; fix it first`);
+    return Object.entries(node.toJSON()).map(([name, spec]) => ({
+        name,
+        spec,
+    }));
+}
+export function isUserMcpName(name) {
+    return MCP_NAME.test(name);
+}
+/** Never replace an entry silently: the existing server may carry permissions. */
+export function addUserMcpServer(name, spec, opts = {}) {
+    if (!isUserMcpName(name)) {
+        throw new Error('server name must start with a letter and contain only letters, digits, _ or - (up to 64 characters)');
+    }
+    if (readUserMcpServers(opts).some((entry) => entry.name === name)) {
+        throw new Error(`server "${name}" already exists in ${userConfigPath(opts)}`);
+    }
+    return setUserConfigValue(['mcpServers', name], spec, opts);
+}
+export function removeUserMcpServer(name, opts = {}) {
+    return deleteUserConfigValue(['mcpServers', name], opts);
+}
+/** Display metadata only. Headers, environment values, and argv can contain secrets. */
+export function summarizeUserMcpServer(entry) {
+    const spec = entry.spec;
+    if (typeof spec !== 'object' || spec === null || Array.isArray(spec)) {
+        return { name: entry.name, transport: 'invalid' };
+    }
+    const value = spec;
+    const command = typeof value.command === 'string' ? value.command : undefined;
+    const url = typeof value.url === 'string' ? value.url : undefined;
+    if (command && !url) {
+        return {
+            name: entry.name,
+            transport: 'stdio',
+            command,
+            argumentCount: Array.isArray(value.args) ? value.args.length : 0,
+            envNames: mappingKeys(value.env),
+            inheritEnv: stringList(value.inheritEnv),
+        };
+    }
+    if (url && !command) {
+        let endpoint;
+        try {
+            const parsed = new URL(url);
+            // Tokenized MCP endpoints can carry credentials in path segments. Show
+            // only the origin in both human and structured summaries.
+            endpoint = parsed.origin;
+        }
+        catch {
+            endpoint = '(invalid URL)';
+        }
+        return {
+            name: entry.name,
+            transport: 'http',
+            endpoint,
+            headerNames: mappingKeys(value.headers),
+        };
+    }
+    return { name: entry.name, transport: 'invalid' };
+}
+function mappingKeys(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value)
+        ? Object.keys(value)
+        : [];
+}
+function stringList(value) {
+    return Array.isArray(value)
+        ? value.filter((item) => typeof item === 'string')
+        : [];
+}
+//# sourceMappingURL=user-config.js.map

package/dist/integrations/mcp/user-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-config.js","sourceRoot":"","sources":["../../../src/integrations/mcp/user-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAA;AAE3C,OAAO,EAEN,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,GACd,MAAM,6BAA6B,CAAA;AAGpC,MAAM,QAAQ,GAAG,+BAA+B,CAAA;AAOhD,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,OAA+B,EAAE;IACnE,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAA;IAChC,MAAM,GAAG,GAAG,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IACrD,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACd,GAAG,IAAI,uBAAuB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,aAAa,iBAAiB,CACtF,CAAA;IACF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6CAA6C,CAAC,CAAA;IACtE,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAA;IACxC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IACjC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6CAA6C,CAAC,CAAA;IACvF,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAA6B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,IAAI;QACJ,IAAI;KACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACzC,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC3B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAC/B,IAAY,EACZ,IAAmB,EACnB,OAA+B,EAAE;IAEjC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACd,qGAAqG,CACrG,CAAA;IACF,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,uBAAuB,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC9E,CAAC;IACD,OAAO,kBAAkB,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;AAC5D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,OAA+B,EAAE;IAClF,OAAO,qBAAqB,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAA;AACzD,CAAC;AAaD,wFAAwF;AACxF,MAAM,UAAU,sBAAsB,CAAC,KAAoB;IAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;IACvB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAA;IAClD,CAAC;IACD,MAAM,KAAK,GAAG,IAA+B,CAAA;IAC7C,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IAC7E,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;IACjE,IAAI,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,OAAO;YACN,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,OAAO;YAClB,OAAO;YACP,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAChE,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC;YAChC,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;SACxC,CAAA;IACF,CAAC;IACD,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,IAAI,QAAgB,CAAA;QACpB,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;YAC3B,uEAAuE;YACvE,0DAA0D;YAC1D,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACR,QAAQ,GAAG,eAAe,CAAA;QAC3B,CAAC;QACD,OAAO;YACN,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,MAAM;YACjB,QAAQ;YACR,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC;SACvC,CAAA;IACF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAA;AAClD,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1E,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC,CAAC,EAAE,CAAA;AACN,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1B,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAClE,CAAC,CAAC,EAAE,CAAA;AACN,CAAC"}

package/dist/integrations/providers/credential-store.d.ts

@@ -66,6 +66,14 @@ export type ConditionalCodexCredentialWrite = {
     readonly current: StoredCodexCredential | null;
 };
 export declare function credentialsPath(home?: string): string;
+/** Kept separate from subscriptions so older credentials.json writers cannot erase it. */
+export declare function googleApiKeyPath(home?: string): string;
+/** Return only a Namzu-owned, private Gemini API key. Never read a symlink. */
+export declare function readStoredGeminiApiKey(home?: string): string | null;
+/** Atomically publish a verified-private key after a usable Google session opens. */
+export declare function writeStoredGeminiApiKey(apiKey: string, home?: string): string;
+/** Remove Namzu's Gemini key without changing environment or Gemini CLI credentials. */
+export declare function clearStoredGeminiApiKey(home?: string): void;
 /**
  * The stored subscription credential, or `null` when there is none.
  *

package/dist/integrations/providers/credential-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAqBH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAKzD,eAAO,MAAM,wBAAwB,EAAG,CAAU,CAAA;AAElD,wFAAwF;AACxF,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,SAAkB,IAAI,0BAAyB;CAC/C;AAED,MAAM,MAAM,0BAA0B,GACnC;IAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI,CAAA;CAAE,CAAA;AAE9E,MAAM,WAAW,qBAAsB,SAAQ,oBAAoB;IAClE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,MAAM,+BAA+B,GACxC;IAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAA;CAAE,GACpE;IACA,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAAA;CAC7C,CAAA;AAQJ,wBAAgB,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAE3F;AAED,4EAA4E;AAC5E,wBAAgB,yBAAyB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAErF;AAsDD;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAChD,IAAI,EAAE,oBAAoB,EAC1B,IAAI,CAAC,EAAE,MAAM,GACX,MAAM,CAUR;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,qBAAqB,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAc7F;AAED,wBAAgB,4BAA4B,CAC3C,QAAQ,EAAE,qBAAqB,EAC/B,WAAW,EAAE,qBAAqB,EAClC,IAAI,CAAC,EAAE,MAAM,GACX,+BAA+B,CAiBjC;AAED;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAClD,QAAQ,EAAE,oBAAoB,EAC9B,WAAW,EAAE,oBAAoB,EACjC,IAAI,CAAC,EAAE,MAAM,GACX,0BAA0B,CAiB5B;AA4DD,wDAAwD;AACxD,wBAAgB,iCAAiC,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAiBrE;AAED,0FAA0F;AAC1F,wBAAgB,0BAA0B,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAc9D;AAED,gEAAgE;AAChE,wBAAgB,yBAAyB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAI7D;AAsGD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAiBlD;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAMpE;AA8DD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBvD;AAED,qFAAqF;AACrF,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAc9C;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAmDjF"}
+{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAuBH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAKzD,eAAO,MAAM,wBAAwB,EAAG,CAAU,CAAA;AAElD,wFAAwF;AACxF,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,SAAkB,IAAI,0BAAyB;CAC/C;AAED,MAAM,MAAM,0BAA0B,GACnC;IAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI,CAAA;CAAE,CAAA;AAE9E,MAAM,WAAW,qBAAsB,SAAQ,oBAAoB;IAClE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,MAAM,+BAA+B,GACxC;IAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAA;CAAE,GACpE;IACA,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAAA;CAC7C,CAAA;AAQJ,wBAAgB,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,0FAA0F;AAC1F,wBAAgB,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBnE;AAED,qFAAqF;AACrF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAO7E;AAED,wFAAwF;AACxF,wBAAgB,uBAAuB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAI3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAE3F;AAED,4EAA4E;AAC5E,wBAAgB,yBAAyB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAErF;AAsDD;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAChD,IAAI,EAAE,oBAAoB,EAC1B,IAAI,CAAC,EAAE,MAAM,GACX,MAAM,CAUR;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,qBAAqB,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAc7F;AAED,wBAAgB,4BAA4B,CAC3C,QAAQ,EAAE,qBAAqB,EAC/B,WAAW,EAAE,qBAAqB,EAClC,IAAI,CAAC,EAAE,MAAM,GACX,+BAA+B,CAiBjC;AAED;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAClD,QAAQ,EAAE,oBAAoB,EAC9B,WAAW,EAAE,oBAAoB,EACjC,IAAI,CAAC,EAAE,MAAM,GACX,0BAA0B,CAiB5B;AA6ED,wDAAwD;AACxD,wBAAgB,iCAAiC,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAiBrE;AAED,0FAA0F;AAC1F,wBAAgB,0BAA0B,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAc9D;AAED,gEAAgE;AAChE,wBAAgB,yBAAyB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAI7D;AAuID;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAiBlD;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAMpE;AA8DD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBvD;AAED,qFAAqF;AACrF,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAc9C;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAmDjF"}

package/dist/integrations/providers/credential-store.js

@@ -44,9 +44,9 @@
  */
 import { execFileSync } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
-import { closeSync, fsyncSync, linkSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, writeSync, } from 'node:fs';
+import { closeSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, writeSync, } from 'node:fs';
 import { platform, tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { basename, dirname, join } from 'node:path';
 import { namzuHomePath } from '../state/home.js';
 const FILE_MODE = 0o600;
 const DIR_MODE = 0o700;
@@ -58,6 +58,45 @@ export class CredentialStoreError extends Error {
 export function credentialsPath(home) {
     return join(namzuHomePath(home), 'credentials.json');
 }
+/** Kept separate from subscriptions so older credentials.json writers cannot erase it. */
+export function googleApiKeyPath(home) {
+    return join(namzuHomePath(home), 'gemini-api-key.json');
+}
+/** Return only a Namzu-owned, private Gemini API key. Never read a symlink. */
+export function readStoredGeminiApiKey(home) {
+    const path = googleApiKeyPath(home);
+    try {
+        protectCredentialParentOnWindows(path);
+        const entry = lstatSync(path);
+        if (!entry.isFile() || entry.isSymbolicLink())
+            return null;
+        restrictToOwner(path);
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        if (typeof parsed !== 'object' || parsed === null)
+            return null;
+        const record = parsed;
+        return record.version === 1 && typeof record.apiKey === 'string' && record.apiKey.trim()
+            ? record.apiKey
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Atomically publish a verified-private key after a usable Google session opens. */
+export function writeStoredGeminiApiKey(apiKey, home) {
+    if (!apiKey.trim())
+        throw new CredentialStoreError('Cannot store an empty Gemini API key.');
+    const path = googleApiKeyPath(home);
+    mkdirSync(dirname(path), { recursive: true, mode: DIR_MODE });
+    return withCredentialStoreLock(path, () => writeCredentialBodyUnlocked(`${JSON.stringify({ version: 1, apiKey })}\n`, path));
+}
+/** Remove Namzu's Gemini key without changing environment or Gemini CLI credentials. */
+export function clearStoredGeminiApiKey(home) {
+    const path = googleApiKeyPath(home);
+    mkdirSync(dirname(path), { recursive: true, mode: DIR_MODE });
+    withCredentialStoreLock(path, () => rmSync(path, { force: true }));
+}
 /**
  * The stored subscription credential, or `null` when there is none.
  *
@@ -196,37 +235,56 @@ export function replaceStoredSubscriptionCredential(expected, replacement, home)
     });
 }
 function writeCredentialDocumentUnlocked(document, path) {
-    const tmp = `${path}.tmp.${process.pid}.${randomBytes(6).toString('hex')}`;
     const body = `${JSON.stringify(serializeDocument(document), null, 2)}\n`;
+    return writeCredentialBodyUnlocked(body, path);
+}
+function writeCredentialBodyUnlocked(body, path) {
+    const tmp = `${path}.tmp.${process.pid}.${randomBytes(6).toString('hex')}`;
     let fd;
+    let placing = false;
     try {
         // `wx` — refuse an existing path rather than truncate one, so a name
         // collision can never hand us a file somebody else already opened.
         fd = openSync(tmp, 'wx', FILE_MODE);
-        writeSync(fd, body);
-    }
-    catch (err) {
-        if (fd !== undefined)
-            closeSync(fd);
-        rmSync(tmp, { force: true });
-        throw new CredentialStoreError(`could not write ${path}: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    closeSync(fd);
-    try {
+        // On Windows, `0600` does not govern the ACL. Prove the still-empty
+        // file is private before putting a credential into it.
         restrictToOwner(tmp);
-    }
-    catch (err) {
-        rmSync(tmp, { force: true });
-        throw err;
-    }
-    try {
+        const bytes = Buffer.from(body, 'utf8');
+        for (let offset = 0; offset < bytes.length;) {
+            const written = writeSync(fd, bytes, offset, bytes.length - offset);
+            if (written <= 0 || written > bytes.length - offset) {
+                throw new Error('credential write did not make progress');
+            }
+            offset += written;
+        }
+        fsyncSync(fd);
+        closeSync(fd);
+        fd = undefined;
+        // Re-check after the write, before the name becomes discoverable.
+        restrictToOwner(tmp);
+        placing = true;
         renameSync(tmp, path);
+        return path;
     }
     catch (err) {
-        rmSync(tmp, { force: true });
-        throw new CredentialStoreError(`could not place ${path}: ${err instanceof Error ? err.message : String(err)}`);
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch {
+                // A failed close may already have closed the descriptor. Remove the
+                // temporary name in either case and report if that also fails.
+            }
+        }
+        let cleanupError;
+        try {
+            rmSync(tmp, { force: true });
+        }
+        catch (error) {
+            cleanupError = error;
+        }
+        throw new CredentialStoreError(`could not ${placing ? 'place' : 'write'} ${path}: ${err instanceof Error ? err.message : String(err)}${cleanupError ? `; temporary file ${tmp} could not be removed: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}` : ''}`);
     }
-    return path;
 }
 function serializeDocument(document) {
     const credential = (value) => ({
@@ -310,6 +368,7 @@ function sameCodexCredential(left, right) {
  * operator proves no process owns the store and removes it.
  */
 function withCredentialStoreLock(path, operation) {
+    protectCredentialParentOnWindows(path);
     const lockPath = `${path}.lock`;
     const token = `${process.pid}:${Date.now()}:${randomBytes(12).toString('hex')}`;
     const published = publishLockAtomically(lockPath, token);
@@ -317,6 +376,7 @@ function withCredentialStoreLock(path, operation) {
         throw new CredentialStoreError(`could not acquire the credential-store lock for ${path}: another owner or an unrecovered process lock is present (${published.error instanceof Error ? published.error.message : String(published.error)}). Refusing concurrent mutation; after proving no Namzu process is using this credential store, remove ${lockPath} and retry.`);
     }
     try {
+        removeCredentialTempsUnlocked(path);
         return operation();
     }
     finally {
@@ -331,6 +391,35 @@ function withCredentialStoreLock(path, operation) {
         }
     }
 }
+/** Protect the directory before opening any child of it on Windows. */
+function protectCredentialParentOnWindows(path) {
+    if (platform() !== 'win32')
+        return;
+    // Windows grants access when a handle is opened. Tightening an empty temp
+    // later cannot revoke another account's already-open handle. The parent
+    // must be private before even the lock candidate or credential file opens.
+    const parent = dirname(path);
+    const entry = lstatSync(parent);
+    if (entry.isSymbolicLink() || !entry.isDirectory()) {
+        throw new CredentialStoreError(`credential directory must be a real directory: ${parent}`);
+    }
+    restrictToOwner(parent);
+}
+/** Only a store-lock owner may remove crash leftovers, never an active writer. */
+function removeCredentialTempsUnlocked(path) {
+    const prefix = `${basename(path)}.tmp.`;
+    try {
+        for (const entry of readdirSync(dirname(path))) {
+            if (!entry.startsWith(prefix) || !/^\d+\.[0-9a-f]{12}$/u.test(entry.slice(prefix.length))) {
+                continue;
+            }
+            rmSync(join(dirname(path), entry), { force: true });
+        }
+    }
+    catch (error) {
+        throw new CredentialStoreError(`could not remove temporary credential files for ${path}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
 /**
  * Publish a complete owner record at the canonical name in one filesystem op.
  *