@namzu/cli 35.0.0 → 36.1.0

package/dist/chunks/mcp-WFXKXGNM.js

@@ -0,0 +1,763 @@
+import { createRequire as __namzuCreateRequire } from 'node:module';
+const require = __namzuCreateRequire(import.meta.url);
+import {
+  deleteUserConfigValue,
+  setUserConfigValue,
+  userConfigPath
+} from "./chunk-UWWGSDZ5.js";
+import {
+  firstStdinLine
+} from "./chunk-EY7UNVER.js";
+import "./chunk-JV3LONAU.js";
+import {
+  decideHeadlessTrust
+} from "./chunk-C5WBEO3X.js";
+import {
+  Client,
+  StreamableHTTPClientTransport,
+  UnauthorizedError,
+  clearMcpOAuthCredentials,
+  clearMcpOAuthPending,
+  connectDeadlineFor,
+  connectMcpServers,
+  consumeMcpOAuthCallbackState,
+  createMcpOAuthProvider,
+  isSecureMcpOAuthUrl,
+  transportFor
+} from "./chunk-FXS3AG6B.js";
+import {
+  openInBrowser
+} from "./chunk-R7DCDBRN.js";
+import "./chunk-HPMWYIBY.js";
+import "./chunk-NUGPLXVK.js";
+import {
+  loadConfig
+} from "./chunk-RC6X3ZY6.js";
+import {
+  require_dist
+} from "./chunk-KONYGNG6.js";
+import "./chunk-KU3W6IHV.js";
+import "./chunk-K76WV7TN.js";
+import "./chunk-US5ZFPAU.js";
+import "./chunk-2A37JQKY.js";
+import "./chunk-6LLJQ3KY.js";
+import {
+  EXIT_BAD_CONFIG,
+  EXIT_FAIL,
+  EXIT_OK,
+  EXIT_UNTRUSTED,
+  EXIT_USAGE
+} from "./chunk-Y7B67G22.js";
+import {
+  terminalDisplayText
+} from "./chunk-EEDZOGV4.js";
+import "./chunk-AHIDYIRB.js";
+import "./chunk-GIXSS6KW.js";
+import "./chunk-CG65NUSJ.js";
+import "./chunk-JORONMD3.js";
+import "./chunk-Q24K7536.js";
+import "./chunk-NQY5P2EB.js";
+import "./chunk-EWKJGHRO.js";
+import {
+  __name,
+  __toESM
+} from "./chunk-76FLAFCG.js";
+
+// src/integrations/mcp/user-config.ts
+var import_yaml = __toESM(require_dist(), 1);
+import { existsSync, readFileSync } from "node:fs";
+var MCP_NAME = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
+function readUserMcpServers(opts = {}) {
+  const file = userConfigPath(opts);
+  if (!existsSync(file)) return [];
+  const doc = (0, import_yaml.parseDocument)(readFileSync(file, "utf8"));
+  if (doc.errors.length > 0) {
+    throw new Error(
+      `${file} is not valid YAML (${doc.errors[0]?.message ?? "parse error"}); fix it first`
+    );
+  }
+  if (doc.contents !== null && !(0, import_yaml.isMap)(doc.contents)) {
+    throw new Error(`${file} is not a mapping of settings; fix it first`);
+  }
+  const node = doc.get("mcpServers", true);
+  if (node === void 0) return [];
+  if (!(0, import_yaml.isMap)(node)) throw new Error(`${file}: mcpServers is not a mapping; fix it first`);
+  return Object.entries(node.toJSON()).map(([name, spec]) => ({
+    name,
+    spec
+  }));
+}
+__name(readUserMcpServers, "readUserMcpServers");
+function isUserMcpName(name) {
+  return MCP_NAME.test(name);
+}
+__name(isUserMcpName, "isUserMcpName");
+function addUserMcpServer(name, spec, opts = {}) {
+  if (!isUserMcpName(name)) {
+    throw new Error(
+      "server name must start with a letter and contain only letters, digits, _ or - (up to 64 characters)"
+    );
+  }
+  if (readUserMcpServers(opts).some((entry) => entry.name === name)) {
+    throw new Error(`server "${name}" already exists in ${userConfigPath(opts)}`);
+  }
+  return setUserConfigValue(["mcpServers", name], spec, opts);
+}
+__name(addUserMcpServer, "addUserMcpServer");
+function removeUserMcpServer(name, opts = {}) {
+  return deleteUserConfigValue(["mcpServers", name], opts);
+}
+__name(removeUserMcpServer, "removeUserMcpServer");
+function summarizeUserMcpServer(entry) {
+  const spec = entry.spec;
+  if (typeof spec !== "object" || spec === null || Array.isArray(spec)) {
+    return { name: entry.name, transport: "invalid" };
+  }
+  const value = spec;
+  const command = typeof value.command === "string" ? value.command : void 0;
+  const url = typeof value.url === "string" ? value.url : void 0;
+  if (command && !url) {
+    return {
+      name: entry.name,
+      transport: "stdio",
+      command,
+      argumentCount: Array.isArray(value.args) ? value.args.length : 0,
+      envNames: mappingKeys(value.env),
+      inheritEnv: stringList(value.inheritEnv)
+    };
+  }
+  if (url && !command) {
+    let endpoint;
+    try {
+      const parsed = new URL(url);
+      endpoint = parsed.origin;
+    } catch {
+      endpoint = "(invalid URL)";
+    }
+    return {
+      name: entry.name,
+      transport: "http",
+      endpoint,
+      headerNames: mappingKeys(value.headers)
+    };
+  }
+  return { name: entry.name, transport: "invalid" };
+}
+__name(summarizeUserMcpServer, "summarizeUserMcpServer");
+function mappingKeys(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? Object.keys(value) : [];
+}
+__name(mappingKeys, "mappingKeys");
+function stringList(value) {
+  return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+__name(stringList, "stringList");
+
+// src/commands/mcp-oauth-login.ts
+import { once } from "node:events";
+import { createServer } from "node:http";
+var CALLBACK_PATH = "/callback";
+var MAX_CALLBACK_URL_LENGTH = 8192;
+function callbackPage(response, status, text) {
+  response.writeHead(status, {
+    "content-type": "text/plain; charset=utf-8",
+    "cache-control": "no-store",
+    "x-content-type-options": "nosniff"
+  });
+  response.end(text);
+}
+__name(callbackPage, "callbackPage");
+function callbackParams(url, expectedOrigin) {
+  if (url.origin !== expectedOrigin || url.pathname !== CALLBACK_PATH || url.hash) {
+    throw new Error("The callback address does not match this sign-in.");
+  }
+  const params = url.searchParams;
+  if (params.getAll("state").length !== 1 || params.getAll("code").length > 1 || params.getAll("iss").length > 1) {
+    throw new Error("The callback parameters are invalid.");
+  }
+  return params;
+}
+__name(callbackParams, "callbackParams");
+function remaining(deadline) {
+  return Math.max(1, deadline - Date.now());
+}
+__name(remaining, "remaining");
+async function beforeDeadline(work, deadline) {
+  let timer;
+  try {
+    return await Promise.race([
+      work,
+      new Promise((_, reject) => {
+        timer = setTimeout(
+          () => reject(new Error("Timed out waiting for MCP sign-in.")),
+          remaining(deadline)
+        );
+      })
+    ]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+__name(beforeDeadline, "beforeDeadline");
+async function closeListener(server) {
+  server.closeAllConnections();
+  if (!server.listening) return;
+  await new Promise((resolve) => server.close(() => resolve()));
+}
+__name(closeListener, "closeListener");
+async function loginMcpServer(options) {
+  if (Object.keys(options.headers ?? {}).some((name) => name.toLowerCase() === "authorization")) {
+    throw new Error("Remove the configured Authorization header before MCP OAuth sign-in.");
+  }
+  let acceptCallback;
+  const callback = new Promise((resolve) => {
+    acceptCallback = resolve;
+  });
+  let callbackOrigin = "";
+  const server = createServer((request, response) => {
+    if (request.method !== "GET" || request.socket.remoteAddress !== "127.0.0.1" || request.headers.host !== callbackOrigin.slice("http://".length) || !request.url || request.url.length > MAX_CALLBACK_URL_LENGTH) {
+      callbackPage(response, 400, "This is not the MCP sign-in callback.\n");
+      return;
+    }
+    try {
+      const url = new URL(request.url, callbackOrigin);
+      const params = callbackParams(url, callbackOrigin);
+      consumeMcpOAuthCallbackState(options.endpoint, params.get("state"));
+      acceptCallback?.({ params, response });
+      acceptCallback = void 0;
+    } catch {
+      callbackPage(response, 400, "The MCP sign-in callback was refused.\n");
+    }
+  });
+  server.listen(0, "127.0.0.1");
+  try {
+    await once(server, "listening");
+  } catch (error) {
+    server.close();
+    throw error;
+  }
+  const address = server.address();
+  if (!address || typeof address === "string") {
+    await closeListener(server);
+    throw new Error("Could not reserve a loopback callback port.");
+  }
+  callbackOrigin = `http://127.0.0.1:${address.port}`;
+  const redirectUrl = `${callbackOrigin}${CALLBACK_PATH}`;
+  const abortInput = new AbortController();
+  const deadline = Date.now() + options.timeoutMs;
+  let authorizationUrl;
+  let client;
+  let providerStarted = false;
+  let firstTransport;
+  let browserResponse;
+  try {
+    const provider = createMcpOAuthProvider({
+      endpoint: options.endpoint,
+      redirectUrl,
+      onRedirect: /* @__PURE__ */ __name((url2) => {
+        if (!isSecureMcpOAuthUrl(url2)) {
+          throw new Error("MCP authorization page must use HTTPS or loopback HTTP.");
+        }
+        authorizationUrl = url2;
+      }, "onRedirect")
+    });
+    providerStarted = true;
+    client = new Client(
+      { name: "namzu-cli", version: "1.0.0" },
+      { versionNegotiation: { mode: "auto" } }
+    );
+    const transport = /* @__PURE__ */ __name(() => new StreamableHTTPClientTransport(new URL(options.endpoint), {
+      authProvider: provider,
+      // The official transport also uses its fetch for OAuth discovery,
+      // registration and token exchange. Put configured resource headers
+      // only on the exact MCP endpoint, never in requestInit, which the
+      // official client would merge into the authorization-server calls.
+      // Manual redirects keep both headers and the Bearer token on this
+      // one URL, including for same-origin 307/308 responses.
+      fetch: /* @__PURE__ */ __name((input, init) => {
+        const targetUrl = new URL(String(input));
+        if (!isSecureMcpOAuthUrl(targetUrl)) {
+          throw new Error("MCP OAuth network requests require HTTPS or loopback HTTP.");
+        }
+        const isResource = targetUrl.href === new URL(options.endpoint).href;
+        const headers = new Headers(init?.headers);
+        if (isResource) {
+          for (const [name, value] of Object.entries(options.headers ?? {}))
+            headers.set(name, value);
+        }
+        return fetch(input, { ...init, headers, redirect: "manual" });
+      }, "fetch")
+    }), "transport");
+    firstTransport = transport();
+    try {
+      await beforeDeadline(client.connect(firstTransport), deadline);
+      options.print({
+        name: options.name,
+        text: `MCP server ${options.name} is already signed in.`
+      });
+      return;
+    } catch (error) {
+      if (!(error instanceof UnauthorizedError) || !authorizationUrl) throw error;
+    }
+    const url = authorizationUrl.href;
+    const opened = options.noBrowser ? false : openInBrowser(url);
+    options.print({
+      name: options.name,
+      url,
+      text: [
+        `Authorize MCP server ${options.name} in your browser:`,
+        url,
+        opened ? "Waiting for the browser callback." : "Paste the complete callback URL here, or open the URL on this machine."
+      ].join("\n")
+    });
+    const pasted = firstStdinLine(abortInput.signal).then((line) => {
+      if (line === null) return new Promise(() => {
+      });
+      const parsed = new URL(line.trim());
+      const params = callbackParams(parsed, callbackOrigin);
+      consumeMcpOAuthCallbackState(options.endpoint, params.get("state"));
+      return Promise.resolve({ params });
+    });
+    const result = await beforeDeadline(Promise.race([callback, pasted]), deadline);
+    browserResponse = result.response;
+    await beforeDeadline(firstTransport.finishAuth(result.params), deadline);
+    await beforeDeadline(client.connect(transport()), deadline);
+    if (browserResponse)
+      callbackPage(browserResponse, 200, "MCP sign-in complete. You may close this tab.\n");
+    browserResponse = void 0;
+    options.print({ name: options.name, text: `Signed in to MCP server ${options.name}.` });
+  } catch (error) {
+    if (browserResponse)
+      callbackPage(browserResponse, 400, "MCP sign-in failed. Return to the terminal.\n");
+    if (error instanceof Error && error.message === "Timed out waiting for MCP sign-in.")
+      throw error;
+    throw new Error("MCP sign-in failed. Check the server configuration and try again.");
+  } finally {
+    abortInput.abort();
+    try {
+      if (providerStarted) clearMcpOAuthPending(options.endpoint);
+    } finally {
+      await Promise.allSettled([client?.close(), closeListener(server)]);
+    }
+  }
+}
+__name(loginMcpServer, "loginMcpServer");
+
+// src/commands/mcp.ts
+var HELP = [
+  "Usage: namzu mcp <list|get|add|remove|test|login|logout> [arguments]",
+  "",
+  "Manage tool servers in your user config (~/.namzu/config.yaml).",
+  "Project and managed config can override these entries.",
+  "",
+  "  namzu mcp list",
+  "  namzu mcp get <name>",
+  "  namzu mcp add <name> --url <http-url> [--header 'NAME=Bearer ${ENV_VAR}']",
+  "  namzu mcp add <name> [--env ENV_VAR] -- <command> [arguments...]",
+  "  namzu mcp remove <name>",
+  "  namzu mcp test <name> [--trust]    Check the effective server and its tools",
+  "  namzu mcp login <name> [--no-browser] [--timeout <seconds>]",
+  "  namzu mcp logout <name>",
+  "",
+  "Use --format json for structured output. Values of headers, environment",
+  "variables and command arguments are hidden in list/get/test output."
+].join("\n");
+var mcpCommand = {
+  name: "mcp",
+  description: "Manage user tool servers",
+  passThrough: true,
+  help: HELP,
+  handler: /* @__PURE__ */ __name(async ({ ctx, rawArgs }) => {
+    const action = parseMcpAction(rawArgs);
+    if (action.kind === "error") {
+      ctx.formatter.error({ message: action.message });
+      return EXIT_USAGE;
+    }
+    if (action.kind === "test") {
+      return testMcpServer(action.name, action.trust, ctx);
+    }
+    if (action.kind === "login" || action.kind === "logout") {
+      try {
+        const spec = loadConfig({ profile: ctx.selectedProfile }).mcpServers?.[action.name];
+        if (!spec || !spec.url || spec.command) {
+          ctx.formatter.error({
+            message: `MCP server "${oneLine(action.name)}" must be a configured HTTP server to use OAuth.`
+          });
+          return EXIT_USAGE;
+        }
+        if (action.kind === "logout") {
+          const removed = clearMcpOAuthCredentials(spec.url);
+          ctx.formatter.print({
+            name: action.name,
+            removed,
+            text: removed ? `Removed saved MCP sign-in for ${oneLine(action.name)}.` : `No saved MCP sign-in for ${oneLine(action.name)}.`
+          });
+          return EXIT_OK;
+        }
+        const resolved = transportFor(spec, process.cwd());
+        if (typeof resolved === "string" || resolved.type !== "streamable-http") {
+          ctx.formatter.error({
+            message: `MCP server "${oneLine(action.name)}" cannot start OAuth: ${typeof resolved === "string" ? oneLine(resolved) : "it is not an HTTP server"}.`
+          });
+          return EXIT_BAD_CONFIG;
+        }
+        if (Object.keys(resolved.headers ?? {}).some((key) => key.toLowerCase() === "authorization")) {
+          ctx.formatter.error({
+            message: `MCP server "${oneLine(action.name)}" already has an Authorization header. Remove that header before OAuth sign-in.`
+          });
+          return EXIT_BAD_CONFIG;
+        }
+        await loginMcpServer({
+          name: action.name,
+          endpoint: resolved.url,
+          ...resolved.headers ? { headers: resolved.headers } : {},
+          noBrowser: action.noBrowser,
+          timeoutMs: action.timeoutMs,
+          print: /* @__PURE__ */ __name((value) => ctx.formatter.print(value), "print")
+        });
+        return EXIT_OK;
+      } catch (error) {
+        ctx.formatter.error({
+          message: error instanceof Error ? oneLine(error.message) : "MCP sign-in failed."
+        });
+        return EXIT_FAIL;
+      }
+    }
+    try {
+      const entries = readUserMcpServers();
+      const file = userConfigPath();
+      if (action.kind === "list") {
+        const servers = entries.map(summarizeUserMcpServer);
+        const lines = servers.length === 0 ? ["No user tool servers are configured."] : servers.map(
+          (server) => `  ${oneLine(server.name)}: ${server.transport}${server.command ? ` (${oneLine(server.command)})` : ""}${server.endpoint ? ` (${oneLine(server.endpoint)})` : ""}`
+        );
+        ctx.formatter.print({ file, servers, text: ["User tool servers:", ...lines].join("\n") });
+        return EXIT_OK;
+      }
+      const existing = entries.find((entry) => entry.name === action.name);
+      if (action.kind === "get") {
+        if (!existing) {
+          ctx.formatter.error({
+            message: `No user tool server named "${oneLine(action.name)}".`
+          });
+          return EXIT_USAGE;
+        }
+        const server = summarizeUserMcpServer(existing);
+        const detail = server.transport === "http" ? server.endpoint : server.transport === "stdio" ? server.command : "invalid entry";
+        ctx.formatter.print({
+          file,
+          server,
+          text: `${oneLine(server.name)}: ${server.transport} (${oneLine(detail ?? "")})
+Config: ${oneLine(file)}`
+        });
+        return EXIT_OK;
+      }
+      if (action.kind === "add") {
+        if (existing) {
+          ctx.formatter.error({
+            message: `User tool server "${oneLine(action.name)}" already exists in ${oneLine(file)}.`
+          });
+          return EXIT_USAGE;
+        }
+        addUserMcpServer(action.name, action.spec);
+        const server = summarizeUserMcpServer({ name: action.name, spec: action.spec });
+        ctx.formatter.print({
+          file,
+          server,
+          text: `Added user tool server ${oneLine(action.name)} to ${oneLine(file)}.`
+        });
+        return EXIT_OK;
+      }
+      if (!existing || !removeUserMcpServer(action.name)) {
+        ctx.formatter.error({
+          message: `No user tool server named "${oneLine(action.name)}".`
+        });
+        return EXIT_USAGE;
+      }
+      ctx.formatter.print({
+        file,
+        name: action.name,
+        text: `Removed user tool server ${oneLine(action.name)} from ${oneLine(file)}.`
+      });
+      return EXIT_OK;
+    } catch (error) {
+      ctx.formatter.error({
+        message: error instanceof Error ? oneLine(error.message) : "Could not read or write the user tool servers."
+      });
+      return EXIT_BAD_CONFIG;
+    }
+  }, "handler")
+};
+async function testMcpServer(name, trustFlag, ctx) {
+  const displayName = oneLine(name);
+  const report = /* @__PURE__ */ __name((status, transport2, toolCount2, reason2, warning2, resourceHelperCount2 = 0) => {
+    ctx.formatter.print({
+      name: displayName,
+      status,
+      transport: transport2,
+      toolCount: toolCount2,
+      ...resourceHelperCount2 > 0 ? { resourceHelperCount: resourceHelperCount2 } : {},
+      ...reason2 ? { reason: reason2 } : {},
+      ...warning2 ? { warning: warning2 } : {},
+      text: status === "connected" ? `${displayName}: connected; ${toolCount2} server ${toolCount2 === 1 ? "tool or prompt" : "tools or prompts"}.${resourceHelperCount2 > 0 ? ` ${resourceHelperCount2} resource helpers available.` : ""}${warning2 ? ` ${warning2}` : ""}` : `${displayName}: unavailable; ${reason2 ?? "the server did not become ready"}.`
+    });
+  }, "report");
+  const trust = decideHeadlessTrust({ cwd: process.cwd(), trustFlag });
+  if (!trust.allowed) {
+    report(
+      "unavailable",
+      "invalid",
+      0,
+      "project is not trusted; open namzu here or pass --trust for this test"
+    );
+    return EXIT_UNTRUSTED;
+  }
+  let selected;
+  try {
+    selected = loadConfig({ profile: ctx.selectedProfile, cwd: trust.cwd }).mcpServers?.[name];
+  } catch {
+    report("unavailable", "invalid", 0, "effective MCP configuration could not be loaded");
+    return EXIT_BAD_CONFIG;
+  }
+  if (selected === void 0) {
+    report("unavailable", "invalid", 0, "no server with this name in effective MCP configuration");
+    return EXIT_USAGE;
+  }
+  if (typeof selected !== "object" || selected === null || Array.isArray(selected)) {
+    report("unavailable", "invalid", 0, "server specification must be a mapping");
+    return EXIT_BAD_CONFIG;
+  }
+  const spec = selected;
+  const hasCommand = typeof spec.command === "string" && spec.command.trim().length > 0;
+  const hasUrl = typeof spec.url === "string" && spec.url.trim().length > 0;
+  const transport = hasCommand && hasUrl ? "invalid" : hasCommand ? "stdio" : hasUrl ? "http" : "invalid";
+  let toolCount = 0;
+  let resourceHelperCount = 0;
+  let reason;
+  let warning;
+  let connection;
+  try {
+    connection = await connectMcpServers({ [name]: spec }, { cwd: trust.cwd });
+    const current = connection.current();
+    const failed = current.failed.find((server) => server.name === name);
+    if (failed) {
+      reason = safeTestReason(failed.reason, spec);
+    } else {
+      const connected = current.connected.find((server) => server.name === name);
+      toolCount = connected ? connection.toolsets[0]?.tools().length ?? 0 : 0;
+      resourceHelperCount = connected ? connection.toolsets[1]?.tools().length ?? 0 : 0;
+      if (!connected) reason = "server did not reach a connected state";
+      else if (toolCount === 0) warning = "No server tools or prompts were exposed.";
+    }
+  } catch {
+    reason = "MCP connection or tool discovery failed; inspect the server logs";
+  } finally {
+    try {
+      await connection?.close();
+    } catch {
+      reason = "MCP connection shutdown failed; inspect the server process";
+    }
+  }
+  report(
+    reason ? "unavailable" : "connected",
+    transport,
+    toolCount,
+    reason,
+    warning,
+    resourceHelperCount
+  );
+  return reason ? EXIT_FAIL : EXIT_OK;
+}
+__name(testMcpServer, "testMcpServer");
+function safeTestReason(reason, spec) {
+  if (reason === "server spec must be a mapping") return reason;
+  if (reason.startsWith("it declares both a command and a url")) {
+    return "server declares both a command and a URL; choose one";
+  }
+  if (reason.startsWith("it declares neither a command nor a url")) {
+    return "server declares neither a command nor a URL";
+  }
+  const badShape = /^(command|url|cwd|args|inheritEnv|env|headers) must be\b/.exec(reason);
+  if (badShape) return `invalid ${badShape[1]} setting`;
+  const unsetVariable = /^references \$\{([A-Za-z_][A-Za-z0-9_]*)\}, which is not set/.exec(reason);
+  if (unsetVariable) return `environment variable ${unsetVariable[1]} is not set`;
+  for (const field of [
+    "connectTimeoutMs",
+    "eraProbeTimeoutMs",
+    "allow",
+    "deny",
+    "maxRetries",
+    "requireApproval",
+    "readOnlyHintTrusted",
+    "instructions"
+  ]) {
+    if (reason.startsWith(`${field} `)) return `invalid ${field} setting`;
+  }
+  if (/HTTP 401\b|authorization required|authentication required/i.test(reason)) {
+    const hasAuthorizationHeader = Object.keys(spec.headers ?? {}).some(
+      (key) => key.toLowerCase() === "authorization"
+    );
+    return hasAuthorizationHeader ? "HTTP 401: check the configured Authorization header" : canSignInToMcpUrl(spec.url) ? "HTTP 401: sign in to this server with namzu mcp login <name>" : "HTTP 401: OAuth sign-in requires HTTPS or a loopback endpoint";
+  }
+  if (/HTTP 403\b/i.test(reason))
+    return "HTTP 403: server refused access; check account permissions";
+  if (/HTTP 404\b/i.test(reason)) return "HTTP 404: check the configured MCP endpoint";
+  const httpStatus = /HTTP ([45]\d\d)\b/i.exec(reason);
+  if (httpStatus) return `HTTP ${httpStatus[1]}: server rejected the request`;
+  if (/did not answer within|timed out|timeout/i.test(reason)) {
+    const deadline = connectDeadlineFor(spec);
+    return typeof deadline === "number" ? `connection or tool discovery timed out after ${deadline}ms; check server logs` : "connection or tool discovery timed out; check connectTimeoutMs and server logs";
+  }
+  if (/\bENOENT\b/i.test(reason)) return "server command could not be found";
+  if (/\bEACCES\b|\bEPERM\b/i.test(reason)) return "server command could not be executed";
+  if (/StdioTransport: not connected or stdin not writable/i.test(reason)) {
+    return "stdio server did not start or closed before the handshake; check command, cwd and server logs";
+  }
+  if (/\bECONNREFUSED\b/i.test(reason)) return "connection refused by the server";
+  if (/\bENOTFOUND\b|\bEAI_AGAIN\b/i.test(reason)) return "server hostname could not be resolved";
+  if (/certificate|\bTLS\b/i.test(reason)) return "TLS certificate validation failed";
+  if (/tools\/list|discovering its tools/i.test(reason)) {
+    return "server connected but tool discovery failed; inspect the server logs";
+  }
+  return "MCP connection or tool discovery failed; inspect the server logs";
+}
+__name(safeTestReason, "safeTestReason");
+function canSignInToMcpUrl(raw) {
+  if (!raw) return false;
+  try {
+    return isSecureMcpOAuthUrl(new URL(raw));
+  } catch {
+    return false;
+  }
+}
+__name(canSignInToMcpUrl, "canSignInToMcpUrl");
+function parseMcpAction(args) {
+  const [verb, name] = args;
+  if (verb === "list" && args.length === 1) return { kind: "list" };
+  if (verb === "logout" && args.length === 2 && name && !name.startsWith("-")) {
+    return { kind: "logout", name };
+  }
+  if (verb === "login" && name && !name.startsWith("-")) {
+    let noBrowser = false;
+    let timeoutMs = 3e5;
+    for (let index = 2; index < args.length; index++) {
+      const arg = args[index];
+      if (arg === "--no-browser" && !noBrowser) {
+        noBrowser = true;
+        continue;
+      }
+      if (arg === "--timeout") {
+        const value = args[++index];
+        const seconds = Number(value);
+        if (!value || !Number.isFinite(seconds) || seconds <= 0 || seconds > 3600) {
+          return { kind: "error", message: "--timeout requires seconds between 0 and 3600." };
+        }
+        timeoutMs = seconds * 1e3;
+        continue;
+      }
+      return { kind: "error", message: `Unknown mcp login option: ${oneLine(arg ?? "")}` };
+    }
+    return { kind: "login", name, noBrowser, timeoutMs };
+  }
+  if ((verb === "get" || verb === "remove") && args.length === 2 && name !== void 0) {
+    return { kind: verb, name };
+  }
+  if (verb === "test" && name && (args.length === 2 || args.length === 3 && args[2] === "--trust")) {
+    return { kind: "test", name, trust: args[2] === "--trust" };
+  }
+  if (verb !== "add" || !name || !isUserMcpName(name)) {
+    return {
+      kind: "error",
+      message: "Usage: namzu mcp <list|get|add|remove|test|login|logout>; new server names must start with a letter and use only letters, digits, _ or -."
+    };
+  }
+  let url;
+  const inheritEnv = [];
+  const headers = {};
+  let command;
+  for (let index = 2; index < args.length; index++) {
+    const arg = args[index];
+    if (arg === "--") {
+      command = args.slice(index + 1);
+      break;
+    }
+    if (arg === "--url") {
+      url = args[++index];
+      if (!url) return { kind: "error", message: "--url requires an HTTP URL." };
+      continue;
+    }
+    if (arg === "--env") {
+      const variable = args[++index];
+      if (!variable || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(variable)) {
+        return { kind: "error", message: "--env requires an environment variable name." };
+      }
+      inheritEnv.push(variable);
+      continue;
+    }
+    if (arg === "--header") {
+      const header = args[++index];
+      const split = header?.indexOf("=") ?? -1;
+      if (!header || split <= 0 || !/^[A-Za-z0-9-]+$/.test(header.slice(0, split)) || !/^(?:Bearer )?\$\{[A-Za-z_][A-Za-z0-9_]*\}$/.test(header.slice(split + 1))) {
+        return {
+          kind: "error",
+          message: "--header requires NAME=${ENV_VAR} or NAME=Bearer ${ENV_VAR}; literal secrets are refused."
+        };
+      }
+      headers[header.slice(0, split)] = header.slice(split + 1);
+      continue;
+    }
+    if (arg && !arg.startsWith("-")) {
+      command = args.slice(index);
+      break;
+    }
+    return { kind: "error", message: `Unknown mcp add option: ${oneLine(arg ?? "")}` };
+  }
+  if (url && command) return { kind: "error", message: "Choose --url or a command, not both." };
+  if (url) {
+    if (inheritEnv.length > 0)
+      return { kind: "error", message: "--env applies only to a command server." };
+    let parsed;
+    try {
+      parsed = new URL(url);
+    } catch {
+      return { kind: "error", message: "--url requires an HTTP URL." };
+    }
+    if (!["http:", "https:"].includes(parsed.protocol) || parsed.username || parsed.password) {
+      return { kind: "error", message: "--url requires an HTTP URL without embedded credentials." };
+    }
+    const remoteInsecure = parsed.protocol === "http:" && !["localhost", "127.0.0.1", "[::1]"].includes(parsed.hostname);
+    if (remoteInsecure && parsed.search) {
+      return {
+        kind: "error",
+        message: "URL query parameters require HTTPS or a loopback endpoint."
+      };
+    }
+    if (Object.keys(headers).length > 0 && remoteInsecure) {
+      return { kind: "error", message: "Credential headers require HTTPS or a loopback endpoint." };
+    }
+    return { kind: "add", name, spec: { url, ...Object.keys(headers).length ? { headers } : {} } };
+  }
+  if (Object.keys(headers).length > 0)
+    return { kind: "error", message: "--header applies only to an HTTP server." };
+  if (!command?.[0])
+    return { kind: "error", message: "Provide --url or -- <command> [arguments...]." };
+  return {
+    kind: "add",
+    name,
+    spec: {
+      command: command[0],
+      ...command.length > 1 ? { args: command.slice(1) } : {},
+      ...inheritEnv.length > 0 ? { inheritEnv } : {}
+    }
+  };
+}
+__name(parseMcpAction, "parseMcpAction");
+function oneLine(value) {
+  return terminalDisplayText(value).replaceAll("\n", " ").replaceAll("	", " ");
+}
+__name(oneLine, "oneLine");
+export {
+  mcpCommand,
+  safeTestReason
+};
+//# sourceMappingURL=mcp-WFXKXGNM.js.map