@openhands/agent-canvas 1.9.0 → 1.10.0

package/dist/utils/mcp-config.cjs

@@ -1,2 +1,2 @@
-require("../_virtual/_rolldown/runtime.cjs");const e=require("./mcp-server-name.cjs");var t={sse_servers:[],stdio_servers:[],shttp_servers:[]},n=`**********`;function r(e,t){return RegExp(`^${t}(_\\d+)?$`).test(e)?void 0:e}function i(e){return!!e&&typeof e==`object`&&!Array.isArray(e)}function a(e){if(!i(e))return null;let t=e.mcpServers;return i(t)&&!(`url`in t)&&!(`command`in t)?t:e}function o(e){if(!i(e))return;let t=Object.entries(e).filter(e=>typeof e[1]==`string`);return t.length>0?Object.fromEntries(t):void 0}function s(e){return e===`**********`?!0:Array.isArray(e)?e.some(s):i(e)?Object.values(e).some(s):!1}function c(e){if(!i(e))return;let t={};return i(e.tokens)&&(t.tokens=e.tokens),i(e.client_info)&&(t.client_info=e.client_info),(typeof e.token_expires_at==`number`||e.token_expires_at===null)&&(t.token_expires_at=e.token_expires_at),Object.keys(t).length>0?t:void 0}function l(e){if(i(e))switch(e.strategy){case`none`:return{strategy:`none`};case`api_key`:return typeof e.value==`string`?{strategy:`api_key`,value:e.value,...typeof e.header_name==`string`&&{header_name:e.header_name}}:void 0;case`bearer`:return typeof e.value==`string`?{strategy:`bearer`,value:e.value}:void 0;case`basic`:return typeof e.username!=`string`||typeof e.password!=`string`?void 0:{strategy:`basic`,username:e.username,password:e.password};case`header`:{let t=o(e.headers);return t?{strategy:`header`,headers:t}:void 0}case`oauth2`:{let t=_(e.authentication),n=c(e.state);return{strategy:`oauth2`,...t&&{authentication:t},...n&&{state:n}}}default:return}}function u(e){return l(e.auth)}function d(e){let t={};return e.auth&&!s(e.auth)&&(t.auth=e.auth),e.headers&&Object.keys(e.headers).length>0&&(t.headers=e.headers),t}function f(e){return e.enabled===!1?{enabled:!1}:{}}function p(e){return{...e.name&&{name:e.name},url:e.url,...e.headers&&{headers:e.headers},...e.auth&&{auth:e.auth},...f(e)}}function m(e){return p(e)}function h(e){return{...p(e),...e.timeout!==void 0&&{timeout:e.timeout}}}function g(e){return{name:e.name,command:e.command,...e.args&&{args:e.args},...e.env&&{env:e.env},...f(e)}}function _(e){if(!e||typeof e!=`object`)return;let t=e;if(t.type!==`oauth`)return;let n={type:`oauth`};return(t.client_auth_method===`none`||t.client_auth_method===`client_secret_post`||t.client_auth_method===`client_secret_basic`||t.client_auth_method===`private_key_jwt`)&&(n.client_auth_method=t.client_auth_method),(typeof t.scopes==`string`||Array.isArray(t.scopes)&&t.scopes.every(e=>typeof e==`string`))&&(n.scopes=t.scopes),typeof t.client_name==`string`&&(n.client_name=t.client_name),typeof t.client_metadata_url==`string`&&(n.client_metadata_url=t.client_metadata_url),typeof t.client_id==`string`&&(n.client_id=t.client_id),typeof t.client_secret==`string`&&(n.client_secret=t.client_secret),t.additional_client_metadata&&typeof t.additional_client_metadata==`object`&&!Array.isArray(t.additional_client_metadata)&&(n.additional_client_metadata=t.additional_client_metadata),n}function v(e){let n=a(e);if(!n)return{...t};let s=[],c=[],l=[];for(let[e,t]of Object.entries(n)){if(!i(t))continue;let n=t.url,a=t.enabled===!1;if(n){let i=t.transport,c=u(t),d=o(t.headers);if(i===`sse`){let t=r(e,`sse`),i={url:n};t&&(i.name=t),c&&(i.auth=c),d&&(i.headers=d),a&&(i.enabled=!1),s.push(i)}else{let i=r(e,`shttp`),o={url:n};i&&(o.name=i),t.timeout!=null&&(o.timeout=t.timeout),c&&(o.auth=c),d&&(o.headers=d),a&&(o.enabled=!1),l.push(o)}}else{if(typeof t.command!=`string`)continue;let n={name:e,command:t.command};t.args&&(n.args=t.args),t.env&&(n.env=t.env),a&&(n.enabled=!1),c.push(n)}}return{sse_servers:s,stdio_servers:c,shttp_servers:l}}function y(t){let n={},r=t=>{let r=e.toMcpServerName(t);if(!(r in n))return r;let i=1;for(;`${r}_${i}`in n;)i+=1;return`${r}_${i}`};for(let e of t.sse_servers){let t={},i;typeof e==`string`?t.url=e:(i=e.name,t.url=e.url,Object.assign(t,d(e),f(e))),t.transport=`sse`,n[r(i||`sse`)]=t}for(let e of t.shttp_servers){let t={transport:`http`},i;typeof e==`string`?t.url=e:(i=e.name,t.url=e.url,Object.assign(t,d(e),f(e)),e.timeout!=null&&(t.timeout=e.timeout)),n[r(i||`shttp`)]=t}for(let e of t.stdio_servers){let t={command:e.command};e.args&&(t.args=e.args),e.env&&(t.env=e.env),Object.assign(t,f(e)),n[r(e.name||`stdio`)]=t}return Object.keys(n).length>0?n:null}exports.REDACTED_MCP_SECRET_VALUE=n,exports.getSdkMcpServerMap=a,exports.hasRedactedMcpSecretLeaf=s,exports.parseMcpConfig=v,exports.stringRecord=o,exports.toMcpShttpServer=h,exports.toMcpSseServer=m,exports.toMcpStdioServer=g,exports.toSdkMcpConfig=y;
+require("../_virtual/_rolldown/runtime.cjs");const e=require("../types/mcp-auth.cjs"),t=require("./mcp-server-name.cjs");var n=`**********`,r=e=>!!e&&typeof e==`object`&&!Array.isArray(e);function i(e){if(!r(e))return null;let t=e.mcpServers;return r(t)&&!(`url`in t)&&!(`command`in t)?t:e}function a(e){if(!r(e))return;let t=Object.entries(e).filter(e=>typeof e[1]==`string`);return t.length>0?Object.fromEntries(t):void 0}function o(e){return e===`**********`?!0:Array.isArray(e)?e.some(o):r(e)?Object.values(e).some(o):!1}var s=e=>e.enabled===!1?!1:void 0,c=e=>{if(e===`stdio`||e===`sse`||e===`streamable-http`)return e;if(e===`http`||e===`shttp`||e===void 0)return`http`};function l(t){let n=i(t);if(!n)return{};let o={};for(let[t,i]of Object.entries(n)){if(!r(i))continue;if(typeof i.command==`string`){o[t]={transport:`stdio`,command:i.command,...Array.isArray(i.args)&&i.args.every(e=>typeof e==`string`)&&{args:i.args},...a(i.env)&&{env:a(i.env)},...typeof i.cwd==`string`&&{cwd:i.cwd},...typeof i.description==`string`&&{description:i.description},...typeof i.icon==`string`&&{icon:i.icon},...typeof i.timeout==`number`&&{timeout:i.timeout},...i.enabled===!1&&{enabled:!1}};continue}if(typeof i.url!=`string`)continue;let n=c(i.transport);!n||n===`stdio`||(o[t]={transport:n,url:i.url,...a(i.headers)&&{headers:a(i.headers)},...e.isMcpAuthCredential(i.auth)&&{auth:i.auth},...typeof i.description==`string`&&{description:i.description},...typeof i.icon==`string`&&{icon:i.icon},...typeof i.timeout==`number`&&{timeout:i.timeout},...typeof i.sse_read_timeout==`number`&&{sse_read_timeout:i.sse_read_timeout},...typeof i.keep_alive==`boolean`&&{keep_alive:i.keep_alive},...i.enabled===!1&&{enabled:!1}})}return o}function u(e){return e.type===`stdio`?{transport:`stdio`,command:e.command,...e.args?.length?{args:e.args}:{},...e.env&&Object.keys(e.env).length>0?{env:e.env}:{},...e.enabled===!1&&{enabled:!1}}:{transport:e.type===`sse`?`sse`:`http`,url:e.url,...e.headers&&Object.keys(e.headers).length>0?{headers:e.headers}:{},...e.auth?{auth:e.auth}:{},...e.type===`shttp`&&e.timeout!==void 0?{timeout:e.timeout}:{},...e.enabled===!1&&{enabled:!1}}}var d=(e,t)=>t.enabled===!1?{enabled:!1}:s(e)===!1?{enabled:!0}:{},f=(e,t)=>{if(!t)return e?null:void 0;let n={};for(let[e,r]of Object.entries(t))r!==`**********`&&(n[e]=r);for(let r of Object.keys(e??{}))r in t||(n[r]=null);return Object.keys(n).length>0?n:void 0},p=[`client_auth_method`,`scopes`,`client_id`,`client_secret`],m=(e,t)=>{if(t===`**********`||t===void 0)return;if(t===null)return null;if(Array.isArray(t))return o(t)||JSON.stringify(e)===JSON.stringify(t)?void 0:t;if(!r(t))return Object.is(e,t)?void 0:t;let n=r(e)?e:{},i={};for(let[e,r]of Object.entries(t)){let t=m(n[e],r);t!==void 0&&(i[e]=t)}return Object.keys(i).length>0?i:void 0},h=(e,t)=>{if(t===void 0)return;if(t===null)return null;let n=m(e,t),i=r(n)?{...n}:{},a=r(e)?e:{};for(let e of p)e in a&&!(e in t)&&(i[e]=null);if(Object.keys(i).length!==0)return{type:`oauth`,...i}},g=(e,t)=>{if(!e||e.strategy===t.strategy)return t;let n={...t};for(let t of Object.keys(e))t!==`strategy`&&!(t in n)&&(n[t]=null);return n},_=`Removing an individual header from header authentication is not supported yet. Replace the credential or clear authentication, then re-enter the headers you want to keep.`,v=(e,t)=>{let n=f(e?.strategy===`header`?e.headers:void 0,t.headers);if(n){if(Object.values(n).some(e=>e===null))throw Error(_);return{strategy:`header`,headers:n}}},y=(e,t)=>{let n=e?.strategy===`oauth2`?e:void 0,r=h(n?.authentication,t.authentication),i=m(n?.state,t.state);if(!(n&&r===void 0&&i===void 0))return g(e,{strategy:`oauth2`,...r!==void 0&&{authentication:r},...i!==void 0&&{state:i}})};function b(e,t){let n=d(e,t);if(t.type===`stdio`){let r=f(e.transport===`stdio`?e.env:void 0,t.env);return{transport:`stdio`,command:t.command,...t.args?.length?{args:t.args}:e.transport===`stdio`&&e.args?{args:null}:{},...r===void 0?{}:{env:r},...n}}let r=e.transport===`stdio`?void 0:e,i={transport:t.type===`sse`?`sse`:`http`,url:t.url,...n};if(t.type===`shttp`&&(t.timeout===void 0?r?.timeout!==void 0&&(i.timeout=null):i.timeout=t.timeout),t.auth)if(t.auth.strategy===`oauth2`){let e=y(r?.auth,t.auth);e!==void 0&&(i.auth=e)}else if(t.auth.strategy===`header`&&r?.auth?.strategy===`header`){let e=v(r.auth,t.auth);e!==void 0&&(i.auth=e)}else o(t.auth)||(i.auth=g(r?.auth,t.auth));else r?.auth&&(i.auth=null);return i}var x=(e,t)=>{let n=(e,t)=>{let i=r(e)?{...e}:{};if(!r(t))return i;for(let[e,a]of Object.entries(t))a===null?delete i[e]:r(a)?i[e]=n(i[e],a):i[e]=a;return i};return n(e,t)},S=`Replace or clear the stored credential before renaming this MCP server.`;function C(e,t,n,r){if(o(n.transport===`stdio`?n.env:{auth:n.auth,headers:n.headers}))throw Error(S);let i=x(n,b(n,r));return{[e]:null,[t]:i}}function w(e,n,r){let i=t.toMcpServerName(n||r);if(!(i in e))return i;let a=1;for(;`${i}_${a}`in e;)a+=1;return`${i}_${a}`}exports.MCP_RENAME_CREDENTIAL_ERROR=S,exports.REDACTED_MCP_SECRET_VALUE=n,exports.allocateMcpSettingsKey=w,exports.buildMcpServerPatch=b,exports.buildRenameMcpConfigPatch=C,exports.getMcpServerEnabled=s,exports.hasRedactedMcpSecretLeaf=o,exports.parseMcpConfig=l,exports.stringRecord=a,exports.toCanonicalMcpServer=u;
 //# sourceMappingURL=mcp-config.cjs.map

package/dist/utils/mcp-config.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-config.cjs","names":[],"sources":["../../src/utils/mcp-config.ts"],"sourcesContent":["import {\n  MCPConfig,\n  MCPSSEServer,\n  MCPSHTTPServer,\n  MCPStdioServer,\n  SettingsValue,\n} from \"#/types/settings\";\nimport type {\n  MCPAuthCredential,\n  MCPAuthenticationConfig,\n  MCPJsonValue,\n  MCPOAuthState,\n} from \"#/types/mcp-auth\";\nimport type { MCPServerConfig } from \"#/types/mcp-server\";\nimport { toMcpServerName } from \"#/utils/mcp-server-name\";\n\nconst EMPTY_MCP_CONFIG: MCPConfig = {\n  sse_servers: [],\n  stdio_servers: [],\n  shttp_servers: [],\n};\n\nexport const REDACTED_MCP_SECRET_VALUE = \"**********\";\n\ntype SdkMcpServerConfig = Record<string, SettingsValue | MCPAuthCredential>;\ntype SdkMcpConfig = Record<string, SdkMcpServerConfig>;\n\n/**\n * The dict key for an SSE/SHTTP server doubles as its display name once a\n * user provides one. Keys that match the auto-generated fallback pattern\n * (``sse``, ``shttp``, ``shttp_1``, …) emitted by {@link toSdkMcpConfig}\n * carry no user intent, so we surface them as \"no name\" — re-serializing\n * regenerates the identical fallback key and existing configs are left\n * untouched.\n */\nfunction userGivenServerName(\n  serverName: string,\n  base: \"sse\" | \"shttp\",\n): string | undefined {\n  const autoGenerated = new RegExp(`^${base}(_\\\\d+)?$`);\n  return autoGenerated.test(serverName) ? undefined : serverName;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return !!value && typeof value === \"object\" && !Array.isArray(value);\n}\n\nexport function getSdkMcpServerMap(\n  value: unknown,\n): Record<string, unknown> | null {\n  if (!isRecord(value)) return null;\n\n  const mcpServers = value.mcpServers;\n  if (\n    isRecord(mcpServers) &&\n    !(\"url\" in mcpServers) &&\n    !(\"command\" in mcpServers)\n  ) {\n    return mcpServers;\n  }\n\n  return value;\n}\n\nexport function stringRecord(\n  value: unknown,\n): Record<string, string> | undefined {\n  if (!isRecord(value)) return undefined;\n  const entries = Object.entries(value).filter(\n    (entry): entry is [string, string] => typeof entry[1] === \"string\",\n  );\n  return entries.length > 0 ? Object.fromEntries(entries) : undefined;\n}\n\nexport function hasRedactedMcpSecretLeaf(value: unknown): boolean {\n  if (value === REDACTED_MCP_SECRET_VALUE) return true;\n  if (Array.isArray(value)) return value.some(hasRedactedMcpSecretLeaf);\n  if (isRecord(value))\n    return Object.values(value).some(hasRedactedMcpSecretLeaf);\n  return false;\n}\n\nfunction getOAuthState(value: unknown): MCPOAuthState | undefined {\n  if (!isRecord(value)) return undefined;\n  const state: MCPOAuthState = {};\n  if (isRecord(value.tokens)) {\n    state.tokens = value.tokens as NonNullable<MCPOAuthState[\"tokens\"]>;\n  }\n  if (isRecord(value.client_info)) {\n    state.client_info = value.client_info as NonNullable<\n      MCPOAuthState[\"client_info\"]\n    >;\n  }\n  if (\n    typeof value.token_expires_at === \"number\" ||\n    value.token_expires_at === null\n  ) {\n    state.token_expires_at = value.token_expires_at;\n  }\n  return Object.keys(state).length > 0 ? state : undefined;\n}\n\nfunction normalizeTaggedAuthCredential(\n  value: unknown,\n): MCPAuthCredential | undefined {\n  if (!isRecord(value)) return undefined;\n  switch (value.strategy) {\n    case \"none\":\n      return { strategy: \"none\" };\n    case \"api_key\":\n      if (typeof value.value !== \"string\") return undefined;\n      return {\n        strategy: \"api_key\",\n        value: value.value,\n        ...(typeof value.header_name === \"string\" && {\n          header_name: value.header_name,\n        }),\n      };\n    case \"bearer\":\n      if (typeof value.value !== \"string\") return undefined;\n      return { strategy: \"bearer\", value: value.value };\n    case \"basic\":\n      if (\n        typeof value.username !== \"string\" ||\n        typeof value.password !== \"string\"\n      ) {\n        return undefined;\n      }\n      return {\n        strategy: \"basic\",\n        username: value.username,\n        password: value.password,\n      };\n    case \"header\": {\n      const headers = stringRecord(value.headers);\n      return headers ? { strategy: \"header\", headers } : undefined;\n    }\n    case \"oauth2\": {\n      const authentication = getAuthenticationConfig(value.authentication);\n      const state = getOAuthState(value.state);\n      return {\n        strategy: \"oauth2\",\n        ...(authentication && { authentication }),\n        ...(state && { state }),\n      };\n    }\n    default:\n      return undefined;\n  }\n}\n\nfunction authCredentialFromServerConfig(\n  serverConfig: Record<string, unknown>,\n): MCPAuthCredential | undefined {\n  return normalizeTaggedAuthCredential(serverConfig.auth);\n}\n\nfunction getRemoteSecretFields(entry: {\n  auth?: MCPAuthCredential;\n  headers?: Record<string, string>;\n}): Partial<SdkMcpServerConfig> {\n  const fields: Partial<SdkMcpServerConfig> = {};\n  if (entry.auth && !hasRedactedMcpSecretLeaf(entry.auth)) {\n    fields.auth = entry.auth;\n  }\n  if (entry.headers && Object.keys(entry.headers).length > 0) {\n    fields.headers = entry.headers;\n  }\n  return fields;\n}\n\n/**\n * Only an explicit ``false`` is carried. Every mutation round-trips the whole\n * server map through these converters, so preserving the flag here is what\n * stops adding or deleting one server from silently re-enabling another.\n */\nfunction disabledField(server: { enabled?: boolean }) {\n  return server.enabled === false ? { enabled: false as const } : {};\n}\n\nfunction getRemoteServerFields(server: MCPServerConfig) {\n  return {\n    ...(server.name && { name: server.name }),\n    url: server.url!,\n    ...(server.headers && { headers: server.headers }),\n    ...(server.auth && { auth: server.auth }),\n    ...disabledField(server),\n  };\n}\n\nexport function toMcpSseServer(server: MCPServerConfig): MCPSSEServer {\n  return getRemoteServerFields(server);\n}\n\nexport function toMcpShttpServer(server: MCPServerConfig): MCPSHTTPServer {\n  return {\n    ...getRemoteServerFields(server),\n    ...(server.timeout !== undefined && { timeout: server.timeout }),\n  };\n}\n\nexport function toMcpStdioServer(server: MCPServerConfig): MCPStdioServer {\n  return {\n    name: server.name!,\n    command: server.command!,\n    ...(server.args && { args: server.args }),\n    ...(server.env && { env: server.env }),\n    ...disabledField(server),\n  };\n}\n\nfunction getAuthenticationConfig(\n  value: unknown,\n): MCPAuthenticationConfig | undefined {\n  if (!value || typeof value !== \"object\") return undefined;\n  const record = value as Record<string, unknown>;\n  if (record.type !== \"oauth\") return undefined;\n  const authentication: MCPAuthenticationConfig = { type: \"oauth\" };\n  if (\n    record.client_auth_method === \"none\" ||\n    record.client_auth_method === \"client_secret_post\" ||\n    record.client_auth_method === \"client_secret_basic\" ||\n    record.client_auth_method === \"private_key_jwt\"\n  ) {\n    authentication.client_auth_method = record.client_auth_method;\n  }\n  if (typeof record.scopes === \"string\") {\n    authentication.scopes = record.scopes;\n  } else if (\n    Array.isArray(record.scopes) &&\n    record.scopes.every((scope) => typeof scope === \"string\")\n  ) {\n    authentication.scopes = record.scopes;\n  }\n  if (typeof record.client_name === \"string\") {\n    authentication.client_name = record.client_name;\n  }\n  if (typeof record.client_metadata_url === \"string\") {\n    authentication.client_metadata_url = record.client_metadata_url;\n  }\n  if (typeof record.client_id === \"string\") {\n    authentication.client_id = record.client_id;\n  }\n  if (typeof record.client_secret === \"string\") {\n    authentication.client_secret = record.client_secret;\n  }\n  if (\n    record.additional_client_metadata &&\n    typeof record.additional_client_metadata === \"object\" &&\n    !Array.isArray(record.additional_client_metadata)\n  ) {\n    authentication.additional_client_metadata =\n      record.additional_client_metadata as Record<string, MCPJsonValue>;\n  }\n  return authentication;\n}\n\n/**\n * Parse the SDK-native ``agent_settings.mcp_config`` value and convert it\n * to the frontend MCPConfig format used by UI components.\n */\nexport function parseMcpConfig(value: unknown): MCPConfig {\n  const mcpConfig = getSdkMcpServerMap(value);\n  if (!mcpConfig) {\n    return { ...EMPTY_MCP_CONFIG };\n  }\n\n  const sseServers: (string | MCPSSEServer)[] = [];\n  const stdioServers: MCPStdioServer[] = [];\n  const shttpServers: (string | MCPSHTTPServer)[] = [];\n\n  for (const [serverName, serverConfig] of Object.entries(mcpConfig)) {\n    if (!isRecord(serverConfig)) continue;\n\n    const url = serverConfig.url as string | undefined;\n\n    // The SDK omits ``enabled`` while it holds its default (true), so only an\n    // explicit ``false`` marks a server as switched off.\n    const disabled = serverConfig.enabled === false;\n\n    if (url) {\n      const transport = serverConfig.transport as string | undefined;\n      const auth = authCredentialFromServerConfig(serverConfig);\n      const headers = stringRecord(serverConfig.headers);\n\n      if (transport === \"sse\") {\n        const name = userGivenServerName(serverName, \"sse\");\n        const server: MCPSSEServer = { url };\n        if (name) server.name = name;\n        if (auth) server.auth = auth;\n        if (headers) server.headers = headers;\n        if (disabled) server.enabled = false;\n        sseServers.push(server);\n      } else {\n        const name = userGivenServerName(serverName, \"shttp\");\n        const server: MCPSHTTPServer = { url };\n        if (name) server.name = name;\n        if (serverConfig.timeout != null) {\n          server.timeout = serverConfig.timeout as number;\n        }\n        if (auth) server.auth = auth;\n        if (headers) server.headers = headers;\n        if (disabled) server.enabled = false;\n        shttpServers.push(server);\n      }\n    } else {\n      if (typeof serverConfig.command !== \"string\") continue;\n      const stdioServer: MCPStdioServer = {\n        name: serverName,\n        command: serverConfig.command,\n      };\n      if (serverConfig.args) {\n        stdioServer.args = serverConfig.args as string[];\n      }\n      if (serverConfig.env) {\n        stdioServer.env = serverConfig.env as Record<string, string>;\n      }\n      if (disabled) stdioServer.enabled = false;\n      stdioServers.push(stdioServer);\n    }\n  }\n\n  return {\n    sse_servers: sseServers,\n    stdio_servers: stdioServers,\n    shttp_servers: shttpServers,\n  };\n}\n\n/**\n * Convert the frontend MCPConfig format back to the SDK-native server map\n * expected by agent_settings.mcp_config on the backend.\n *\n * Names are only suffixed (``_1``, ``_2``, …) when an earlier entry has\n * already claimed the bare base name. We intentionally do NOT use a single\n * monotonic counter across server types: that would, for example, rename a\n * stdio server \"myname\" to \"myname_1\" the moment any sse/shttp entry is\n * persisted ahead of it, and shift the suffix on every save as the count\n * of other server types changes. With per-base collision suffixing,\n * unrelated entries keep their human-meaningful names stable across edits.\n *\n * ``enabled`` is only emitted when a server is switched off — the SDK defaults\n * it to true. Omitting it is what *clears* a previously persisted\n * ``enabled: false``, and that only works because ``saveSettings`` pre-clears\n * ``mcp_config`` to null before every write (see\n * ``settings-service.api.ts``), turning the backend's RFC 7386 merge into a\n * full replace. If that pre-clear is ever removed, re-enabling a server\n * becomes a silent no-op.\n */\nexport function toSdkMcpConfig(config: MCPConfig): SdkMcpConfig | null {\n  const mcpConfig: SdkMcpConfig = {};\n\n  const reserve = (base: string): string => {\n    const safeBase = toMcpServerName(base);\n    if (!(safeBase in mcpConfig)) return safeBase;\n    let i = 1;\n    while (`${safeBase}_${i}` in mcpConfig) i += 1;\n    return `${safeBase}_${i}`;\n  };\n\n  for (const entry of config.sse_servers) {\n    const server: SdkMcpServerConfig = {};\n    let name: string | undefined;\n    if (typeof entry === \"string\") {\n      server.url = entry;\n    } else {\n      name = entry.name;\n      server.url = entry.url;\n      Object.assign(server, getRemoteSecretFields(entry), disabledField(entry));\n    }\n    server.transport = \"sse\";\n    mcpConfig[reserve(name || \"sse\")] = server;\n  }\n\n  for (const entry of config.shttp_servers) {\n    const server: SdkMcpServerConfig = { transport: \"http\" };\n    let name: string | undefined;\n    if (typeof entry === \"string\") {\n      server.url = entry;\n    } else {\n      name = entry.name;\n      server.url = entry.url;\n      Object.assign(server, getRemoteSecretFields(entry), disabledField(entry));\n      if (entry.timeout != null) server.timeout = entry.timeout;\n    }\n    mcpConfig[reserve(name || \"shttp\")] = server;\n  }\n\n  for (const entry of config.stdio_servers) {\n    const server: SdkMcpServerConfig = {\n      command: entry.command,\n    };\n    if (entry.args) server.args = entry.args;\n    if (entry.env) server.env = entry.env;\n    Object.assign(server, disabledField(entry));\n    mcpConfig[reserve(entry.name || \"stdio\")] = server;\n  }\n\n  return Object.keys(mcpConfig).length > 0 ? mcpConfig : null;\n}\n"],"mappings":"sFAgBA,IAAM,EAA8B,CAClC,YAAa,CAAC,EACd,cAAe,CAAC,EAChB,cAAe,CAAC,CAClB,EAEa,EAA4B,aAazC,SAAS,EACP,EACA,EACoB,CAEpB,OAD0B,OAAO,IAAI,EAAK,UACnC,EAAc,KAAK,CAAU,EAAI,IAAA,GAAY,CACtD,CAEA,SAAS,EAAS,EAAkD,CAClE,MAAO,CAAC,CAAC,GAAS,OAAO,GAAU,UAAY,CAAC,MAAM,QAAQ,CAAK,CACrE,CAEA,SAAgB,EACd,EACgC,CAChC,GAAI,CAAC,EAAS,CAAK,EAAG,OAAO,KAE7B,IAAM,EAAa,EAAM,WASzB,OAPE,EAAS,CAAU,GACnB,EAAE,QAAS,IACX,EAAE,YAAa,GAER,EAGF,CACT,CAEA,SAAgB,EACd,EACoC,CACpC,GAAI,CAAC,EAAS,CAAK,EAAG,OACtB,IAAM,EAAU,OAAO,QAAQ,CAAK,EAAE,OACnC,GAAqC,OAAO,EAAM,IAAO,QAC5D,EACA,OAAO,EAAQ,OAAS,EAAI,OAAO,YAAY,CAAO,EAAI,IAAA,EAC5D,CAEA,SAAgB,EAAyB,EAAyB,CAKhE,OAJI,IAAA,aAA4C,GAC5C,MAAM,QAAQ,CAAK,EAAU,EAAM,KAAK,CAAwB,EAChE,EAAS,CAAK,EACT,OAAO,OAAO,CAAK,EAAE,KAAK,CAAwB,EACpD,EACT,CAEA,SAAS,EAAc,EAA2C,CAChE,GAAI,CAAC,EAAS,CAAK,EAAG,OACtB,IAAM,EAAuB,CAAC,EAe9B,OAdI,EAAS,EAAM,MAAM,IACvB,EAAM,OAAS,EAAM,QAEnB,EAAS,EAAM,WAAW,IAC5B,EAAM,YAAc,EAAM,cAK1B,OAAO,EAAM,kBAAqB,UAClC,EAAM,mBAAqB,QAE3B,EAAM,iBAAmB,EAAM,kBAE1B,OAAO,KAAK,CAAK,EAAE,OAAS,EAAI,EAAQ,IAAA,EACjD,CAEA,SAAS,EACP,EAC+B,CAC1B,KAAS,CAAK,EACnB,OAAQ,EAAM,SAAd,CACE,IAAK,OACH,MAAO,CAAE,SAAU,MAAO,EAC5B,IAAK,UAEH,OADI,OAAO,EAAM,OAAU,SACpB,CACL,SAAU,UACV,MAAO,EAAM,MACb,GAAI,OAAO,EAAM,aAAgB,UAAY,CAC3C,YAAa,EAAM,WACrB,CACF,EAPqC,OAQvC,IAAK,SAEH,OADI,OAAO,EAAM,OAAU,SACpB,CAAE,SAAU,SAAU,MAAO,EAAM,KAAM,EADX,OAEvC,IAAK,QAOH,OALE,OAAO,EAAM,UAAa,UAC1B,OAAO,EAAM,UAAa,SAE1B,OAEK,CACL,SAAU,QACV,SAAU,EAAM,SAChB,SAAU,EAAM,QAClB,EACF,IAAK,SAAU,CACb,IAAM,EAAU,EAAa,EAAM,OAAO,EAC1C,OAAO,EAAU,CAAE,SAAU,SAAU,SAAQ,EAAI,IAAA,EACrD,CACA,IAAK,SAAU,CACb,IAAM,EAAiB,EAAwB,EAAM,cAAc,EAC7D,EAAQ,EAAc,EAAM,KAAK,EACvC,MAAO,CACL,SAAU,SACV,GAAI,GAAkB,CAAE,gBAAe,EACvC,GAAI,GAAS,CAAE,OAAM,CACvB,CACF,CACA,QACE,MACJ,CACF,CAEA,SAAS,EACP,EAC+B,CAC/B,OAAO,EAA8B,EAAa,IAAI,CACxD,CAEA,SAAS,EAAsB,EAGC,CAC9B,IAAM,EAAsC,CAAC,EAO7C,OANI,EAAM,MAAQ,CAAC,EAAyB,EAAM,IAAI,IACpD,EAAO,KAAO,EAAM,MAElB,EAAM,SAAW,OAAO,KAAK,EAAM,OAAO,EAAE,OAAS,IACvD,EAAO,QAAU,EAAM,SAElB,CACT,CAOA,SAAS,EAAc,EAA+B,CACpD,OAAO,EAAO,UAAY,GAAQ,CAAE,QAAS,EAAe,EAAI,CAAC,CACnE,CAEA,SAAS,EAAsB,EAAyB,CACtD,MAAO,CACL,GAAI,EAAO,MAAQ,CAAE,KAAM,EAAO,IAAK,EACvC,IAAK,EAAO,IACZ,GAAI,EAAO,SAAW,CAAE,QAAS,EAAO,OAAQ,EAChD,GAAI,EAAO,MAAQ,CAAE,KAAM,EAAO,IAAK,EACvC,GAAG,EAAc,CAAM,CACzB,CACF,CAEA,SAAgB,EAAe,EAAuC,CACpE,OAAO,EAAsB,CAAM,CACrC,CAEA,SAAgB,EAAiB,EAAyC,CACxE,MAAO,CACL,GAAG,EAAsB,CAAM,EAC/B,GAAI,EAAO,UAAY,IAAA,IAAa,CAAE,QAAS,EAAO,OAAQ,CAChE,CACF,CAEA,SAAgB,EAAiB,EAAyC,CACxE,MAAO,CACL,KAAM,EAAO,KACb,QAAS,EAAO,QAChB,GAAI,EAAO,MAAQ,CAAE,KAAM,EAAO,IAAK,EACvC,GAAI,EAAO,KAAO,CAAE,IAAK,EAAO,GAAI,EACpC,GAAG,EAAc,CAAM,CACzB,CACF,CAEA,SAAS,EACP,EACqC,CACrC,GAAI,CAAC,GAAS,OAAO,GAAU,SAAU,OACzC,IAAM,EAAS,EACf,GAAI,EAAO,OAAS,QAAS,OAC7B,IAAM,EAA0C,CAAE,KAAM,OAAQ,EAqChE,OAnCE,EAAO,qBAAuB,QAC9B,EAAO,qBAAuB,sBAC9B,EAAO,qBAAuB,uBAC9B,EAAO,qBAAuB,qBAE9B,EAAe,mBAAqB,EAAO,qBAEzC,OAAO,EAAO,QAAW,UAG3B,MAAM,QAAQ,EAAO,MAAM,GAC3B,EAAO,OAAO,MAAO,GAAU,OAAO,GAAU,QAAQ,KAHxD,EAAe,OAAS,EAAO,QAO7B,OAAO,EAAO,aAAgB,WAChC,EAAe,YAAc,EAAO,aAElC,OAAO,EAAO,qBAAwB,WACxC,EAAe,oBAAsB,EAAO,qBAE1C,OAAO,EAAO,WAAc,WAC9B,EAAe,UAAY,EAAO,WAEhC,OAAO,EAAO,eAAkB,WAClC,EAAe,cAAgB,EAAO,eAGtC,EAAO,4BACP,OAAO,EAAO,4BAA+B,UAC7C,CAAC,MAAM,QAAQ,EAAO,0BAA0B,IAEhD,EAAe,2BACb,EAAO,4BAEJ,CACT,CAMA,SAAgB,EAAe,EAA2B,CACxD,IAAM,EAAY,EAAmB,CAAK,EAC1C,GAAI,CAAC,EACH,MAAO,CAAE,GAAG,CAAiB,EAG/B,IAAM,EAAwC,CAAC,EACzC,EAAiC,CAAC,EAClC,EAA4C,CAAC,EAEnD,IAAK,GAAM,CAAC,EAAY,KAAiB,OAAO,QAAQ,CAAS,EAAG,CAClE,GAAI,CAAC,EAAS,CAAY,EAAG,SAE7B,IAAM,EAAM,EAAa,IAInB,EAAW,EAAa,UAAY,GAE1C,GAAI,EAAK,CACP,IAAM,EAAY,EAAa,UACzB,EAAO,EAA+B,CAAY,EAClD,EAAU,EAAa,EAAa,OAAO,EAEjD,GAAI,IAAc,MAAO,CACvB,IAAM,EAAO,EAAoB,EAAY,KAAK,EAC5C,EAAuB,CAAE,KAAI,EAC/B,IAAM,EAAO,KAAO,GACpB,IAAM,EAAO,KAAO,GACpB,IAAS,EAAO,QAAU,GAC1B,IAAU,EAAO,QAAU,IAC/B,EAAW,KAAK,CAAM,CACxB,KAAO,CACL,IAAM,EAAO,EAAoB,EAAY,OAAO,EAC9C,EAAyB,CAAE,KAAI,EACjC,IAAM,EAAO,KAAO,GACpB,EAAa,SAAW,OAC1B,EAAO,QAAU,EAAa,SAE5B,IAAM,EAAO,KAAO,GACpB,IAAS,EAAO,QAAU,GAC1B,IAAU,EAAO,QAAU,IAC/B,EAAa,KAAK,CAAM,CAC1B,CACF,KAAO,CACL,GAAI,OAAO,EAAa,SAAY,SAAU,SAC9C,IAAM,EAA8B,CAClC,KAAM,EACN,QAAS,EAAa,OACxB,EACI,EAAa,OACf,EAAY,KAAO,EAAa,MAE9B,EAAa,MACf,EAAY,IAAM,EAAa,KAE7B,IAAU,EAAY,QAAU,IACpC,EAAa,KAAK,CAAW,CAC/B,CACF,CAEA,MAAO,CACL,YAAa,EACb,cAAe,EACf,cAAe,CACjB,CACF,CAsBA,SAAgB,EAAe,EAAwC,CACrE,IAAM,EAA0B,CAAC,EAE3B,EAAW,GAAyB,CACxC,IAAM,EAAW,EAAA,gBAAgB,CAAI,EACrC,GAAI,EAAE,KAAY,GAAY,OAAO,EACrC,IAAI,EAAI,EACR,KAAO,GAAG,EAAS,GAAG,MAAO,GAAW,GAAK,EAC7C,MAAO,GAAG,EAAS,GAAG,GACxB,EAEA,IAAK,IAAM,KAAS,EAAO,YAAa,CACtC,IAAM,EAA6B,CAAC,EAChC,EACA,OAAO,GAAU,SACnB,EAAO,IAAM,GAEb,EAAO,EAAM,KACb,EAAO,IAAM,EAAM,IACnB,OAAO,OAAO,EAAQ,EAAsB,CAAK,EAAG,EAAc,CAAK,CAAC,GAE1E,EAAO,UAAY,MACnB,EAAU,EAAQ,GAAQ,KAAK,GAAK,CACtC,CAEA,IAAK,IAAM,KAAS,EAAO,cAAe,CACxC,IAAM,EAA6B,CAAE,UAAW,MAAO,EACnD,EACA,OAAO,GAAU,SACnB,EAAO,IAAM,GAEb,EAAO,EAAM,KACb,EAAO,IAAM,EAAM,IACnB,OAAO,OAAO,EAAQ,EAAsB,CAAK,EAAG,EAAc,CAAK,CAAC,EACpE,EAAM,SAAW,OAAM,EAAO,QAAU,EAAM,UAEpD,EAAU,EAAQ,GAAQ,OAAO,GAAK,CACxC,CAEA,IAAK,IAAM,KAAS,EAAO,cAAe,CACxC,IAAM,EAA6B,CACjC,QAAS,EAAM,OACjB,EACI,EAAM,OAAM,EAAO,KAAO,EAAM,MAChC,EAAM,MAAK,EAAO,IAAM,EAAM,KAClC,OAAO,OAAO,EAAQ,EAAc,CAAK,CAAC,EAC1C,EAAU,EAAQ,EAAM,MAAQ,OAAO,GAAK,CAC9C,CAEA,OAAO,OAAO,KAAK,CAAS,EAAE,OAAS,EAAI,EAAY,IACzD"}
+{"version":3,"file":"mcp-config.cjs","names":[],"sources":["../../src/utils/mcp-config.ts"],"sourcesContent":["import type {\n  MCPAuthCredential,\n  MCPConfig,\n  MCPConfigPatch,\n  MCPServer,\n  MCPServerPatch,\n} from \"@openhands/typescript-client\";\nimport { isMcpAuthCredential } from \"#/types/mcp-auth\";\nimport type { MCPServerConfig } from \"#/types/mcp-server\";\nimport { toMcpServerName } from \"#/utils/mcp-server-name\";\n\nexport const REDACTED_MCP_SECRET_VALUE = \"**********\";\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  !!value && typeof value === \"object\" && !Array.isArray(value);\n\nexport function getSdkMcpServerMap(\n  value: unknown,\n): Record<string, unknown> | null {\n  if (!isRecord(value)) return null;\n\n  const mcpServers = value.mcpServers;\n  if (\n    isRecord(mcpServers) &&\n    !(\"url\" in mcpServers) &&\n    !(\"command\" in mcpServers)\n  ) {\n    return mcpServers;\n  }\n\n  return value;\n}\n\nexport function stringRecord(\n  value: unknown,\n): Record<string, string> | undefined {\n  if (!isRecord(value)) return undefined;\n  const entries = Object.entries(value).filter(\n    (entry): entry is [string, string] => typeof entry[1] === \"string\",\n  );\n  return entries.length > 0 ? Object.fromEntries(entries) : undefined;\n}\n\nexport function hasRedactedMcpSecretLeaf(value: unknown): boolean {\n  if (value === REDACTED_MCP_SECRET_VALUE) return true;\n  if (Array.isArray(value)) return value.some(hasRedactedMcpSecretLeaf);\n  if (isRecord(value)) {\n    return Object.values(value).some(hasRedactedMcpSecretLeaf);\n  }\n  return false;\n}\n\n// Agent Server persists this optional field, but typescript-client 1.36.1\n// does not yet expose it in its generated MCP model types.\nexport const getMcpServerEnabled = (server: MCPServer): boolean | undefined =>\n  (server as MCPServer & { enabled?: unknown }).enabled === false\n    ? false\n    : undefined;\n\nconst normalizeTransport = (\n  value: unknown,\n): MCPServer[\"transport\"] | undefined => {\n  if (value === \"stdio\" || value === \"sse\" || value === \"streamable-http\") {\n    return value;\n  }\n  if (value === \"http\" || value === \"shttp\" || value === undefined) {\n    return \"http\";\n  }\n  return undefined;\n};\n\n/**\n * Normalize the SDK and legacy cloud wrapper shapes into the client-owned,\n * name-keyed MCPConfig. The map key remains the server's persistence identity.\n */\n// @spec MCP-003 — Settings map keys are stable MCP identities\nexport function parseMcpConfig(value: unknown): MCPConfig {\n  const serverMap = getSdkMcpServerMap(value);\n  if (!serverMap) return {};\n\n  const config: MCPConfig = {};\n  for (const [settingsKey, candidate] of Object.entries(serverMap)) {\n    if (!isRecord(candidate)) continue;\n\n    if (typeof candidate.command === \"string\") {\n      config[settingsKey] = {\n        transport: \"stdio\",\n        command: candidate.command,\n        ...(Array.isArray(candidate.args) &&\n          candidate.args.every((arg) => typeof arg === \"string\") && {\n            args: candidate.args as string[],\n          }),\n        ...(stringRecord(candidate.env) && {\n          env: stringRecord(candidate.env),\n        }),\n        ...(typeof candidate.cwd === \"string\" && { cwd: candidate.cwd }),\n        ...(typeof candidate.description === \"string\" && {\n          description: candidate.description,\n        }),\n        ...(typeof candidate.icon === \"string\" && { icon: candidate.icon }),\n        ...(typeof candidate.timeout === \"number\" && {\n          timeout: candidate.timeout,\n        }),\n        ...(candidate.enabled === false && { enabled: false }),\n      };\n      continue;\n    }\n\n    if (typeof candidate.url !== \"string\") continue;\n    const transport = normalizeTransport(candidate.transport);\n    if (!transport || transport === \"stdio\") continue;\n    config[settingsKey] = {\n      transport,\n      url: candidate.url,\n      ...(stringRecord(candidate.headers) && {\n        headers: stringRecord(candidate.headers),\n      }),\n      ...(isMcpAuthCredential(candidate.auth) && {\n        auth: candidate.auth,\n      }),\n      ...(typeof candidate.description === \"string\" && {\n        description: candidate.description,\n      }),\n      ...(typeof candidate.icon === \"string\" && { icon: candidate.icon }),\n      ...(typeof candidate.timeout === \"number\" && {\n        timeout: candidate.timeout,\n      }),\n      ...(typeof candidate.sse_read_timeout === \"number\" && {\n        sse_read_timeout: candidate.sse_read_timeout,\n      }),\n      ...(typeof candidate.keep_alive === \"boolean\" && {\n        keep_alive: candidate.keep_alive,\n      }),\n      ...(candidate.enabled === false && { enabled: false }),\n    };\n  }\n  return config;\n}\n\nexport function toCanonicalMcpServer(server: MCPServerConfig): MCPServer {\n  if (server.type === \"stdio\") {\n    return {\n      transport: \"stdio\",\n      command: server.command!,\n      ...(server.args?.length ? { args: server.args } : {}),\n      ...(server.env && Object.keys(server.env).length > 0\n        ? { env: server.env }\n        : {}),\n      ...(server.enabled === false && { enabled: false }),\n    };\n  }\n\n  return {\n    transport: server.type === \"sse\" ? \"sse\" : \"http\",\n    url: server.url!,\n    ...(server.headers && Object.keys(server.headers).length > 0\n      ? { headers: server.headers }\n      : {}),\n    ...(server.auth ? { auth: server.auth } : {}),\n    ...(server.type === \"shttp\" && server.timeout !== undefined\n      ? { timeout: server.timeout }\n      : {}),\n    ...(server.enabled === false && { enabled: false }),\n  };\n}\n\nconst buildEnabledPatch = (\n  previous: MCPServer,\n  edited: MCPServerConfig,\n): MCPServerPatch => {\n  if (edited.enabled === false) return { enabled: false } as MCPServerPatch;\n  return getMcpServerEnabled(previous) === false\n    ? ({ enabled: true } as MCPServerPatch)\n    : {};\n};\n\nconst buildStringMapPatch = (\n  previous: Record<string, string> | null | undefined,\n  next: Record<string, string> | undefined,\n): Record<string, string | null> | null | undefined => {\n  if (!next) return previous ? null : undefined;\n\n  const patch: Record<string, string | null> = {};\n  for (const [key, value] of Object.entries(next)) {\n    if (value !== REDACTED_MCP_SECRET_VALUE) {\n      patch[key] = value;\n    }\n  }\n  for (const key of Object.keys(previous ?? {})) {\n    if (!(key in next)) patch[key] = null;\n  }\n  return Object.keys(patch).length > 0 ? patch : undefined;\n};\n\ntype OAuthCredential = Extract<MCPAuthCredential, { strategy: \"oauth2\" }>;\ntype OAuthCredentialPatch = Extract<\n  NonNullable<MCPServerPatch[\"auth\"]>,\n  { strategy: \"oauth2\" }\n>;\nconst OAUTH_EDITABLE_AUTHENTICATION_FIELDS = [\n  \"client_auth_method\",\n  \"scopes\",\n  \"client_id\",\n  \"client_secret\",\n] as const;\n\nconst buildRedactionSafeNestedPatch = (\n  previous: unknown,\n  next: unknown,\n): unknown | undefined => {\n  if (next === REDACTED_MCP_SECRET_VALUE || next === undefined) {\n    return undefined;\n  }\n  if (next === null) return null;\n  if (Array.isArray(next)) {\n    if (hasRedactedMcpSecretLeaf(next)) return undefined;\n    return JSON.stringify(previous) === JSON.stringify(next) ? undefined : next;\n  }\n  if (!isRecord(next)) {\n    return Object.is(previous, next) ? undefined : next;\n  }\n\n  const previousRecord = isRecord(previous) ? previous : {};\n  const patch: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(next)) {\n    const nestedPatch = buildRedactionSafeNestedPatch(\n      previousRecord[key],\n      value,\n    );\n    if (nestedPatch !== undefined) patch[key] = nestedPatch;\n  }\n  return Object.keys(patch).length > 0 ? patch : undefined;\n};\n\nconst buildOAuthAuthenticationPatch = (\n  previous: OAuthCredential[\"authentication\"],\n  edited: OAuthCredential[\"authentication\"],\n): OAuthCredentialPatch[\"authentication\"] | undefined => {\n  if (edited === undefined) return undefined;\n  if (edited === null) return null;\n\n  const nestedPatch = buildRedactionSafeNestedPatch(previous, edited);\n  const patch = isRecord(nestedPatch) ? { ...nestedPatch } : {};\n  const previousRecord = isRecord(previous) ? previous : {};\n  for (const key of OAUTH_EDITABLE_AUTHENTICATION_FIELDS) {\n    if (key in previousRecord && !(key in edited)) patch[key] = null;\n  }\n  if (Object.keys(patch).length === 0) return undefined;\n  return { type: \"oauth\", ...patch } as NonNullable<\n    OAuthCredentialPatch[\"authentication\"]\n  >;\n};\n\nconst withAuthStrategyReplacementDeletes = <T extends MCPAuthCredential>(\n  previous: MCPAuthCredential | null | undefined,\n  patch: T,\n): T => {\n  if (!previous || previous.strategy === patch.strategy) return patch;\n\n  const replacement = { ...patch } as Record<string, unknown>;\n  for (const key of Object.keys(previous)) {\n    if (key !== \"strategy\" && !(key in replacement)) {\n      replacement[key] = null;\n    }\n  }\n  return replacement as T;\n};\n\ntype HeaderAuthCredential = Extract<MCPAuthCredential, { strategy: \"header\" }>;\n\nexport const MCP_HEADER_REMOVAL_ERROR =\n  \"Removing an individual header from header authentication is not supported yet. Replace the credential or clear authentication, then re-enter the headers you want to keep.\";\n\nconst buildHeaderAuthCredentialPatch = (\n  previous: MCPAuthCredential | null | undefined,\n  edited: HeaderAuthCredential,\n): NonNullable<MCPServerPatch[\"auth\"]> | undefined => {\n  const previousHeaders =\n    previous?.strategy === \"header\" ? previous.headers : undefined;\n  const headersPatch = buildStringMapPatch(previousHeaders, edited.headers);\n  if (!headersPatch) return undefined;\n  if (Object.values(headersPatch).some((value) => value === null)) {\n    throw new Error(MCP_HEADER_REMOVAL_ERROR);\n  }\n  return {\n    strategy: \"header\",\n    headers: headersPatch as Record<string, string>,\n  };\n};\n\nconst buildOAuthCredentialPatch = (\n  previous: MCPAuthCredential | null | undefined,\n  edited: OAuthCredential,\n): OAuthCredentialPatch | undefined => {\n  const previousOAuth = previous?.strategy === \"oauth2\" ? previous : undefined;\n  const authentication = buildOAuthAuthenticationPatch(\n    previousOAuth?.authentication,\n    edited.authentication,\n  );\n  const state = buildRedactionSafeNestedPatch(\n    previousOAuth?.state,\n    edited.state,\n  );\n  if (previousOAuth && authentication === undefined && state === undefined) {\n    return undefined;\n  }\n  return withAuthStrategyReplacementDeletes(previous, {\n    strategy: \"oauth2\",\n    ...(authentication !== undefined && { authentication }),\n    ...(state !== undefined && { state }),\n  } as OAuthCredentialPatch);\n};\n\n/**\n * Build one sparse MCP server merge-patch from an editor result. Redacted\n * values are display-only and are never mutation inputs.\n */\n// @spec MCP-002 — Secret patches preserve user intent\nexport function buildMcpServerPatch(\n  previous: MCPServer,\n  edited: MCPServerConfig,\n): MCPServerPatch {\n  const enabled = buildEnabledPatch(previous, edited);\n  if (edited.type === \"stdio\") {\n    const env = buildStringMapPatch(\n      previous.transport === \"stdio\" ? previous.env : undefined,\n      edited.env,\n    );\n    return {\n      transport: \"stdio\",\n      command: edited.command!,\n      ...(edited.args?.length\n        ? { args: edited.args }\n        : previous.transport === \"stdio\" && previous.args\n          ? { args: null }\n          : {}),\n      ...(env !== undefined ? { env } : {}),\n      ...enabled,\n    };\n  }\n\n  const previousRemote = previous.transport === \"stdio\" ? undefined : previous;\n  const patch: MCPServerPatch = {\n    transport: edited.type === \"sse\" ? \"sse\" : \"http\",\n    url: edited.url!,\n    ...enabled,\n  };\n\n  if (edited.type === \"shttp\") {\n    if (edited.timeout !== undefined) patch.timeout = edited.timeout;\n    else if (previousRemote?.timeout !== undefined) patch.timeout = null;\n  }\n\n  if (edited.auth) {\n    if (edited.auth.strategy === \"oauth2\") {\n      const auth = buildOAuthCredentialPatch(previousRemote?.auth, edited.auth);\n      if (auth !== undefined) patch.auth = auth;\n    } else if (\n      edited.auth.strategy === \"header\" &&\n      previousRemote?.auth?.strategy === \"header\"\n    ) {\n      const auth = buildHeaderAuthCredentialPatch(\n        previousRemote.auth,\n        edited.auth,\n      );\n      if (auth !== undefined) patch.auth = auth;\n    } else if (!hasRedactedMcpSecretLeaf(edited.auth)) {\n      patch.auth = withAuthStrategyReplacementDeletes(\n        previousRemote?.auth,\n        edited.auth,\n      );\n    }\n  } else if (previousRemote?.auth) {\n    patch.auth = null;\n  }\n\n  return patch;\n}\n\nconst applyMcpServerPatch = (\n  previous: MCPServer,\n  patch: MCPServerPatch,\n): MCPServer => {\n  const apply = (base: unknown, next: unknown): Record<string, unknown> => {\n    const merged = isRecord(base) ? { ...base } : {};\n    if (!isRecord(next)) return merged;\n\n    for (const [key, value] of Object.entries(next)) {\n      if (value === null) {\n        delete merged[key];\n      } else if (isRecord(value)) {\n        merged[key] = apply(merged[key], value);\n      } else {\n        merged[key] = value;\n      }\n    }\n    return merged;\n  };\n\n  return apply(previous, patch) as MCPServer;\n};\n\nexport const MCP_RENAME_CREDENTIAL_ERROR =\n  \"Replace or clear the stored credential before renaming this MCP server.\";\n\n// @spec MCP-003 — Settings map keys are stable MCP identities\nexport function buildRenameMcpConfigPatch(\n  oldKey: string,\n  newKey: string,\n  previous: MCPServer,\n  edited: MCPServerConfig,\n): MCPConfigPatch {\n  const previousSecrets =\n    previous.transport === \"stdio\"\n      ? previous.env\n      : { auth: previous.auth, headers: previous.headers };\n  if (hasRedactedMcpSecretLeaf(previousSecrets)) {\n    throw new Error(MCP_RENAME_CREDENTIAL_ERROR);\n  }\n  const renamedServer = applyMcpServerPatch(\n    previous,\n    buildMcpServerPatch(previous, edited),\n  );\n  return {\n    [oldKey]: null,\n    [newKey]: renamedServer,\n  };\n}\n\nexport function allocateMcpSettingsKey(\n  config: MCPConfig,\n  preferredName: string | undefined,\n  fallback: \"sse\" | \"shttp\" | \"stdio\",\n): string {\n  const base = toMcpServerName(preferredName || fallback);\n  if (!(base in config)) return base;\n  let suffix = 1;\n  while (`${base}_${suffix}` in config) suffix += 1;\n  return `${base}_${suffix}`;\n}\n"],"mappings":"yHAWA,IAAa,EAA4B,aAEnC,EAAY,GAChB,CAAC,CAAC,GAAS,OAAO,GAAU,UAAY,CAAC,MAAM,QAAQ,CAAK,EAE9D,SAAgB,EACd,EACgC,CAChC,GAAI,CAAC,EAAS,CAAK,EAAG,OAAO,KAE7B,IAAM,EAAa,EAAM,WASzB,OAPE,EAAS,CAAU,GACnB,EAAE,QAAS,IACX,EAAE,YAAa,GAER,EAGF,CACT,CAEA,SAAgB,EACd,EACoC,CACpC,GAAI,CAAC,EAAS,CAAK,EAAG,OACtB,IAAM,EAAU,OAAO,QAAQ,CAAK,EAAE,OACnC,GAAqC,OAAO,EAAM,IAAO,QAC5D,EACA,OAAO,EAAQ,OAAS,EAAI,OAAO,YAAY,CAAO,EAAI,IAAA,EAC5D,CAEA,SAAgB,EAAyB,EAAyB,CAMhE,OALI,IAAA,aAA4C,GAC5C,MAAM,QAAQ,CAAK,EAAU,EAAM,KAAK,CAAwB,EAChE,EAAS,CAAK,EACT,OAAO,OAAO,CAAK,EAAE,KAAK,CAAwB,EAEpD,EACT,CAIA,IAAa,EAAuB,GACjC,EAA6C,UAAY,GACtD,GACA,IAAA,GAEA,EACJ,GACuC,CACvC,GAAI,IAAU,SAAW,IAAU,OAAS,IAAU,kBACpD,OAAO,EAET,GAAI,IAAU,QAAU,IAAU,SAAW,IAAU,IAAA,GACrD,MAAO,MAGX,EAOA,SAAgB,EAAe,EAA2B,CACxD,IAAM,EAAY,EAAmB,CAAK,EAC1C,GAAI,CAAC,EAAW,MAAO,CAAC,EAExB,IAAM,EAAoB,CAAC,EAC3B,IAAK,GAAM,CAAC,EAAa,KAAc,OAAO,QAAQ,CAAS,EAAG,CAChE,GAAI,CAAC,EAAS,CAAS,EAAG,SAE1B,GAAI,OAAO,EAAU,SAAY,SAAU,CACzC,EAAO,GAAe,CACpB,UAAW,QACX,QAAS,EAAU,QACnB,GAAI,MAAM,QAAQ,EAAU,IAAI,GAC9B,EAAU,KAAK,MAAO,GAAQ,OAAO,GAAQ,QAAQ,GAAK,CACxD,KAAM,EAAU,IAClB,EACF,GAAI,EAAa,EAAU,GAAG,GAAK,CACjC,IAAK,EAAa,EAAU,GAAG,CACjC,EACA,GAAI,OAAO,EAAU,KAAQ,UAAY,CAAE,IAAK,EAAU,GAAI,EAC9D,GAAI,OAAO,EAAU,aAAgB,UAAY,CAC/C,YAAa,EAAU,WACzB,EACA,GAAI,OAAO,EAAU,MAAS,UAAY,CAAE,KAAM,EAAU,IAAK,EACjE,GAAI,OAAO,EAAU,SAAY,UAAY,CAC3C,QAAS,EAAU,OACrB,EACA,GAAI,EAAU,UAAY,IAAS,CAAE,QAAS,EAAM,CACtD,EACA,QACF,CAEA,GAAI,OAAO,EAAU,KAAQ,SAAU,SACvC,IAAM,EAAY,EAAmB,EAAU,SAAS,EACpD,CAAC,GAAa,IAAc,UAChC,EAAO,GAAe,CACpB,YACA,IAAK,EAAU,IACf,GAAI,EAAa,EAAU,OAAO,GAAK,CACrC,QAAS,EAAa,EAAU,OAAO,CACzC,EACA,GAAI,EAAA,oBAAoB,EAAU,IAAI,GAAK,CACzC,KAAM,EAAU,IAClB,EACA,GAAI,OAAO,EAAU,aAAgB,UAAY,CAC/C,YAAa,EAAU,WACzB,EACA,GAAI,OAAO,EAAU,MAAS,UAAY,CAAE,KAAM,EAAU,IAAK,EACjE,GAAI,OAAO,EAAU,SAAY,UAAY,CAC3C,QAAS,EAAU,OACrB,EACA,GAAI,OAAO,EAAU,kBAAqB,UAAY,CACpD,iBAAkB,EAAU,gBAC9B,EACA,GAAI,OAAO,EAAU,YAAe,WAAa,CAC/C,WAAY,EAAU,UACxB,EACA,GAAI,EAAU,UAAY,IAAS,CAAE,QAAS,EAAM,CACtD,EACF,CACA,OAAO,CACT,CAEA,SAAgB,EAAqB,EAAoC,CAavE,OAZI,EAAO,OAAS,QACX,CACL,UAAW,QACX,QAAS,EAAO,QAChB,GAAI,EAAO,MAAM,OAAS,CAAE,KAAM,EAAO,IAAK,EAAI,CAAC,EACnD,GAAI,EAAO,KAAO,OAAO,KAAK,EAAO,GAAG,EAAE,OAAS,EAC/C,CAAE,IAAK,EAAO,GAAI,EAClB,CAAC,EACL,GAAI,EAAO,UAAY,IAAS,CAAE,QAAS,EAAM,CACnD,EAGK,CACL,UAAW,EAAO,OAAS,MAAQ,MAAQ,OAC3C,IAAK,EAAO,IACZ,GAAI,EAAO,SAAW,OAAO,KAAK,EAAO,OAAO,EAAE,OAAS,EACvD,CAAE,QAAS,EAAO,OAAQ,EAC1B,CAAC,EACL,GAAI,EAAO,KAAO,CAAE,KAAM,EAAO,IAAK,EAAI,CAAC,EAC3C,GAAI,EAAO,OAAS,SAAW,EAAO,UAAY,IAAA,GAC9C,CAAE,QAAS,EAAO,OAAQ,EAC1B,CAAC,EACL,GAAI,EAAO,UAAY,IAAS,CAAE,QAAS,EAAM,CACnD,CACF,CAEA,IAAM,GACJ,EACA,IAEI,EAAO,UAAY,GAAc,CAAE,QAAS,EAAM,EAC/C,EAAoB,CAAQ,IAAM,GACpC,CAAE,QAAS,EAAK,EACjB,CAAC,EAGD,GACJ,EACA,IACqD,CACrD,GAAI,CAAC,EAAM,OAAO,EAAW,KAAO,IAAA,GAEpC,IAAM,EAAuC,CAAC,EAC9C,IAAK,GAAM,CAAC,EAAK,KAAU,OAAO,QAAQ,CAAI,EACxC,IAAA,eACF,EAAM,GAAO,GAGjB,IAAK,IAAM,KAAO,OAAO,KAAK,GAAY,CAAC,CAAC,EACpC,KAAO,IAAO,EAAM,GAAO,MAEnC,OAAO,OAAO,KAAK,CAAK,EAAE,OAAS,EAAI,EAAQ,IAAA,EACjD,EAOM,EAAuC,CAC3C,qBACA,SACA,YACA,eACF,EAEM,GACJ,EACA,IACwB,CACxB,GAAI,IAAA,cAAsC,IAAS,IAAA,GACjD,OAEF,GAAI,IAAS,KAAM,OAAO,KAC1B,GAAI,MAAM,QAAQ,CAAI,EAEpB,OADI,EAAyB,CAAI,GAC1B,KAAK,UAAU,CAAQ,IAAM,KAAK,UAAU,CAAI,EADnB,OACmC,EAEzE,GAAI,CAAC,EAAS,CAAI,EAChB,OAAO,OAAO,GAAG,EAAU,CAAI,EAAI,IAAA,GAAY,EAGjD,IAAM,EAAiB,EAAS,CAAQ,EAAI,EAAW,CAAC,EAClD,EAAiC,CAAC,EACxC,IAAK,GAAM,CAAC,EAAK,KAAU,OAAO,QAAQ,CAAI,EAAG,CAC/C,IAAM,EAAc,EAClB,EAAe,GACf,CACF,EACI,IAAgB,IAAA,KAAW,EAAM,GAAO,EAC9C,CACA,OAAO,OAAO,KAAK,CAAK,EAAE,OAAS,EAAI,EAAQ,IAAA,EACjD,EAEM,GACJ,EACA,IACuD,CACvD,GAAI,IAAW,IAAA,GAAW,OAC1B,GAAI,IAAW,KAAM,OAAO,KAE5B,IAAM,EAAc,EAA8B,EAAU,CAAM,EAC5D,EAAQ,EAAS,CAAW,EAAI,CAAE,GAAG,CAAY,EAAI,CAAC,EACtD,EAAiB,EAAS,CAAQ,EAAI,EAAW,CAAC,EACxD,IAAK,IAAM,KAAO,EACZ,KAAO,GAAkB,EAAE,KAAO,KAAS,EAAM,GAAO,MAE1D,UAAO,KAAK,CAAK,EAAE,SAAW,EAClC,MAAO,CAAE,KAAM,QAAS,GAAG,CAAM,CAGnC,EAEM,GACJ,EACA,IACM,CACN,GAAI,CAAC,GAAY,EAAS,WAAa,EAAM,SAAU,OAAO,EAE9D,IAAM,EAAc,CAAE,GAAG,CAAM,EAC/B,IAAK,IAAM,KAAO,OAAO,KAAK,CAAQ,EAChC,IAAQ,YAAc,EAAE,KAAO,KACjC,EAAY,GAAO,MAGvB,OAAO,CACT,EAIa,EACX,6KAEI,GACJ,EACA,IACoD,CAGpD,IAAM,EAAe,EADnB,GAAU,WAAa,SAAW,EAAS,QAAU,IAAA,GACG,EAAO,OAAO,EACnE,KACL,IAAI,OAAO,OAAO,CAAY,EAAE,KAAM,GAAU,IAAU,IAAI,EAC5D,MAAU,MAAM,CAAwB,EAE1C,MAAO,CACL,SAAU,SACV,QAAS,CACX,CAL0C,CAM5C,EAEM,GACJ,EACA,IACqC,CACrC,IAAM,EAAgB,GAAU,WAAa,SAAW,EAAW,IAAA,GAC7D,EAAiB,EACrB,GAAe,eACf,EAAO,cACT,EACM,EAAQ,EACZ,GAAe,MACf,EAAO,KACT,EACI,QAAiB,IAAmB,IAAA,IAAa,IAAU,IAAA,IAG/D,OAAO,EAAmC,EAAU,CAClD,SAAU,SACV,GAAI,IAAmB,IAAA,IAAa,CAAE,gBAAe,EACrD,GAAI,IAAU,IAAA,IAAa,CAAE,OAAM,CACrC,CAAyB,CAC3B,EAOA,SAAgB,EACd,EACA,EACgB,CAChB,IAAM,EAAU,EAAkB,EAAU,CAAM,EAClD,GAAI,EAAO,OAAS,QAAS,CAC3B,IAAM,EAAM,EACV,EAAS,YAAc,QAAU,EAAS,IAAM,IAAA,GAChD,EAAO,GACT,EACA,MAAO,CACL,UAAW,QACX,QAAS,EAAO,QAChB,GAAI,EAAO,MAAM,OACb,CAAE,KAAM,EAAO,IAAK,EACpB,EAAS,YAAc,SAAW,EAAS,KACzC,CAAE,KAAM,IAAK,EACb,CAAC,EACP,GAAI,IAAQ,IAAA,GAAsB,CAAC,EAAX,CAAE,KAAI,EAC9B,GAAG,CACL,CACF,CAEA,IAAM,EAAiB,EAAS,YAAc,QAAU,IAAA,GAAY,EAC9D,EAAwB,CAC5B,UAAW,EAAO,OAAS,MAAQ,MAAQ,OAC3C,IAAK,EAAO,IACZ,GAAG,CACL,EAOA,GALI,EAAO,OAAS,UACd,EAAO,UAAY,IAAA,GACd,GAAgB,UAAY,IAAA,KAAW,EAAM,QAAU,MAD9B,EAAM,QAAU,EAAO,SAIvD,EAAO,QACL,EAAO,KAAK,WAAa,SAAU,CACrC,IAAM,EAAO,EAA0B,GAAgB,KAAM,EAAO,IAAI,EACpE,IAAS,IAAA,KAAW,EAAM,KAAO,EACvC,MAAO,GACL,EAAO,KAAK,WAAa,UACzB,GAAgB,MAAM,WAAa,SACnC,CACA,IAAM,EAAO,EACX,EAAe,KACf,EAAO,IACT,EACI,IAAS,IAAA,KAAW,EAAM,KAAO,EACvC,MAAY,EAAyB,EAAO,IAAI,IAC9C,EAAM,KAAO,EACX,GAAgB,KAChB,EAAO,IACT,QAEO,GAAgB,OACzB,EAAM,KAAO,MAGf,OAAO,CACT,CAEA,IAAM,GACJ,EACA,IACc,CACd,IAAM,GAAS,EAAe,IAA2C,CACvE,IAAM,EAAS,EAAS,CAAI,EAAI,CAAE,GAAG,CAAK,EAAI,CAAC,EAC/C,GAAI,CAAC,EAAS,CAAI,EAAG,OAAO,EAE5B,IAAK,GAAM,CAAC,EAAK,KAAU,OAAO,QAAQ,CAAI,EACxC,IAAU,KACZ,OAAO,EAAO,GACL,EAAS,CAAK,EACvB,EAAO,GAAO,EAAM,EAAO,GAAM,CAAK,EAEtC,EAAO,GAAO,EAGlB,OAAO,CACT,EAEA,OAAO,EAAM,EAAU,CAAK,CAC9B,EAEa,EACX,0EAGF,SAAgB,EACd,EACA,EACA,EACA,EACgB,CAKhB,GAAI,EAHF,EAAS,YAAc,QACnB,EAAS,IACT,CAAE,KAAM,EAAS,KAAM,QAAS,EAAS,OAAQ,CACX,EAC1C,MAAU,MAAM,CAA2B,EAE7C,IAAM,EAAgB,EACpB,EACA,EAAoB,EAAU,CAAM,CACtC,EACA,MAAO,EACJ,GAAS,MACT,GAAS,CACZ,CACF,CAEA,SAAgB,EACd,EACA,EACA,EACQ,CACR,IAAM,EAAO,EAAA,gBAAgB,GAAiB,CAAQ,EACtD,GAAI,EAAE,KAAQ,GAAS,OAAO,EAC9B,IAAI,EAAS,EACb,KAAO,GAAG,EAAK,GAAG,MAAY,GAAQ,GAAU,EAChD,MAAO,GAAG,EAAK,GAAG,GACpB"}

package/dist/utils/mcp-config.d.ts

@@ -1,39 +1,22 @@
-import { MCPConfig, MCPSSEServer, MCPSHTTPServer, MCPStdioServer, SettingsValue } from "#/types/settings";
-import type { MCPAuthCredential } from "#/types/mcp-auth";
+import type { MCPConfig, MCPConfigPatch, MCPServer, MCPServerPatch } from "@openhands/typescript-client";
 import type { MCPServerConfig } from "#/types/mcp-server";
 export declare const REDACTED_MCP_SECRET_VALUE = "**********";
-type SdkMcpServerConfig = Record<string, SettingsValue | MCPAuthCredential>;
-type SdkMcpConfig = Record<string, SdkMcpServerConfig>;
 export declare function getSdkMcpServerMap(value: unknown): Record<string, unknown> | null;
 export declare function stringRecord(value: unknown): Record<string, string> | undefined;
 export declare function hasRedactedMcpSecretLeaf(value: unknown): boolean;
-export declare function toMcpSseServer(server: MCPServerConfig): MCPSSEServer;
-export declare function toMcpShttpServer(server: MCPServerConfig): MCPSHTTPServer;
-export declare function toMcpStdioServer(server: MCPServerConfig): MCPStdioServer;
+export declare const getMcpServerEnabled: (server: MCPServer) => boolean | undefined;
 /**
- * Parse the SDK-native ``agent_settings.mcp_config`` value and convert it
- * to the frontend MCPConfig format used by UI components.
+ * Normalize the SDK and legacy cloud wrapper shapes into the client-owned,
+ * name-keyed MCPConfig. The map key remains the server's persistence identity.
  */
 export declare function parseMcpConfig(value: unknown): MCPConfig;
+export declare function toCanonicalMcpServer(server: MCPServerConfig): MCPServer;
+export declare const MCP_HEADER_REMOVAL_ERROR = "Removing an individual header from header authentication is not supported yet. Replace the credential or clear authentication, then re-enter the headers you want to keep.";
 /**
- * Convert the frontend MCPConfig format back to the SDK-native server map
- * expected by agent_settings.mcp_config on the backend.
- *
- * Names are only suffixed (``_1``, ``_2``, …) when an earlier entry has
- * already claimed the bare base name. We intentionally do NOT use a single
- * monotonic counter across server types: that would, for example, rename a
- * stdio server "myname" to "myname_1" the moment any sse/shttp entry is
- * persisted ahead of it, and shift the suffix on every save as the count
- * of other server types changes. With per-base collision suffixing,
- * unrelated entries keep their human-meaningful names stable across edits.
- *
- * ``enabled`` is only emitted when a server is switched off — the SDK defaults
- * it to true. Omitting it is what *clears* a previously persisted
- * ``enabled: false``, and that only works because ``saveSettings`` pre-clears
- * ``mcp_config`` to null before every write (see
- * ``settings-service.api.ts``), turning the backend's RFC 7386 merge into a
- * full replace. If that pre-clear is ever removed, re-enabling a server
- * becomes a silent no-op.
+ * Build one sparse MCP server merge-patch from an editor result. Redacted
+ * values are display-only and are never mutation inputs.
  */
-export declare function toSdkMcpConfig(config: MCPConfig): SdkMcpConfig | null;
-export {};
+export declare function buildMcpServerPatch(previous: MCPServer, edited: MCPServerConfig): MCPServerPatch;
+export declare const MCP_RENAME_CREDENTIAL_ERROR = "Replace or clear the stored credential before renaming this MCP server.";
+export declare function buildRenameMcpConfigPatch(oldKey: string, newKey: string, previous: MCPServer, edited: MCPServerConfig): MCPConfigPatch;
+export declare function allocateMcpSettingsKey(config: MCPConfig, preferredName: string | undefined, fallback: "sse" | "shttp" | "stdio"): string;

package/dist/utils/mcp-config.js

@@ -1,167 +1,185 @@
-import { toMcpServerName as e } from "./mcp-server-name.js";
+import { isMcpAuthCredential as e } from "../types/mcp-auth.js";
+import { toMcpServerName as t } from "./mcp-server-name.js";
 //#region src/utils/mcp-config.ts
-var t = {
-	sse_servers: [],
-	stdio_servers: [],
-	shttp_servers: []
-}, n = "**********";
-function r(e, t) {
-	return RegExp(`^${t}(_\\d+)?$`).test(e) ? void 0 : e;
-}
+var n = "**********", r = (e) => !!e && typeof e == "object" && !Array.isArray(e);
 function i(e) {
-	return !!e && typeof e == "object" && !Array.isArray(e);
-}
-function a(e) {
-	if (!i(e)) return null;
+	if (!r(e)) return null;
 	let t = e.mcpServers;
-	return i(t) && !("url" in t) && !("command" in t) ? t : e;
+	return r(t) && !("url" in t) && !("command" in t) ? t : e;
 }
-function o(e) {
-	if (!i(e)) return;
+function a(e) {
+	if (!r(e)) return;
 	let t = Object.entries(e).filter((e) => typeof e[1] == "string");
 	return t.length > 0 ? Object.fromEntries(t) : void 0;
 }
-function s(e) {
-	return e === "**********" ? !0 : Array.isArray(e) ? e.some(s) : i(e) ? Object.values(e).some(s) : !1;
-}
-function c(e) {
-	if (!i(e)) return;
-	let t = {};
-	return i(e.tokens) && (t.tokens = e.tokens), i(e.client_info) && (t.client_info = e.client_info), (typeof e.token_expires_at == "number" || e.token_expires_at === null) && (t.token_expires_at = e.token_expires_at), Object.keys(t).length > 0 ? t : void 0;
-}
-function l(e) {
-	if (i(e)) switch (e.strategy) {
-		case "none": return { strategy: "none" };
-		case "api_key": return typeof e.value == "string" ? {
-			strategy: "api_key",
-			value: e.value,
-			...typeof e.header_name == "string" && { header_name: e.header_name }
-		} : void 0;
-		case "bearer": return typeof e.value == "string" ? {
-			strategy: "bearer",
-			value: e.value
-		} : void 0;
-		case "basic": return typeof e.username != "string" || typeof e.password != "string" ? void 0 : {
-			strategy: "basic",
-			username: e.username,
-			password: e.password
-		};
-		case "header": {
-			let t = o(e.headers);
-			return t ? {
-				strategy: "header",
-				headers: t
-			} : void 0;
-		}
-		case "oauth2": {
-			let t = _(e.authentication), n = c(e.state);
-			return {
-				strategy: "oauth2",
-				...t && { authentication: t },
-				...n && { state: n }
+function o(e) {
+	return e === "**********" ? !0 : Array.isArray(e) ? e.some(o) : r(e) ? Object.values(e).some(o) : !1;
+}
+var s = (e) => e.enabled === !1 ? !1 : void 0, c = (e) => {
+	if (e === "stdio" || e === "sse" || e === "streamable-http") return e;
+	if (e === "http" || e === "shttp" || e === void 0) return "http";
+};
+function l(t) {
+	let n = i(t);
+	if (!n) return {};
+	let o = {};
+	for (let [t, i] of Object.entries(n)) {
+		if (!r(i)) continue;
+		if (typeof i.command == "string") {
+			o[t] = {
+				transport: "stdio",
+				command: i.command,
+				...Array.isArray(i.args) && i.args.every((e) => typeof e == "string") && { args: i.args },
+				...a(i.env) && { env: a(i.env) },
+				...typeof i.cwd == "string" && { cwd: i.cwd },
+				...typeof i.description == "string" && { description: i.description },
+				...typeof i.icon == "string" && { icon: i.icon },
+				...typeof i.timeout == "number" && { timeout: i.timeout },
+				...i.enabled === !1 && { enabled: !1 }
 			};
+			continue;
 		}
-		default: return;
+		if (typeof i.url != "string") continue;
+		let n = c(i.transport);
+		!n || n === "stdio" || (o[t] = {
+			transport: n,
+			url: i.url,
+			...a(i.headers) && { headers: a(i.headers) },
+			...e(i.auth) && { auth: i.auth },
+			...typeof i.description == "string" && { description: i.description },
+			...typeof i.icon == "string" && { icon: i.icon },
+			...typeof i.timeout == "number" && { timeout: i.timeout },
+			...typeof i.sse_read_timeout == "number" && { sse_read_timeout: i.sse_read_timeout },
+			...typeof i.keep_alive == "boolean" && { keep_alive: i.keep_alive },
+			...i.enabled === !1 && { enabled: !1 }
+		});
 	}
+	return o;
 }
 function u(e) {
-	return l(e.auth);
-}
-function d(e) {
-	let t = {};
-	return e.auth && !s(e.auth) && (t.auth = e.auth), e.headers && Object.keys(e.headers).length > 0 && (t.headers = e.headers), t;
-}
-function f(e) {
-	return e.enabled === !1 ? { enabled: !1 } : {};
-}
-function p(e) {
-	return {
-		...e.name && { name: e.name },
+	return e.type === "stdio" ? {
+		transport: "stdio",
+		command: e.command,
+		...e.args?.length ? { args: e.args } : {},
+		...e.env && Object.keys(e.env).length > 0 ? { env: e.env } : {},
+		...e.enabled === !1 && { enabled: !1 }
+	} : {
+		transport: e.type === "sse" ? "sse" : "http",
 		url: e.url,
-		...e.headers && { headers: e.headers },
-		...e.auth && { auth: e.auth },
-		...f(e)
+		...e.headers && Object.keys(e.headers).length > 0 ? { headers: e.headers } : {},
+		...e.auth ? { auth: e.auth } : {},
+		...e.type === "shttp" && e.timeout !== void 0 ? { timeout: e.timeout } : {},
+		...e.enabled === !1 && { enabled: !1 }
 	};
 }
-function m(e) {
-	return p(e);
-}
-function h(e) {
-	return {
-		...p(e),
-		...e.timeout !== void 0 && { timeout: e.timeout }
-	};
-}
-function g(e) {
-	return {
-		name: e.name,
-		command: e.command,
-		...e.args && { args: e.args },
-		...e.env && { env: e.env },
-		...f(e)
+var d = (e, t) => t.enabled === !1 ? { enabled: !1 } : s(e) === !1 ? { enabled: !0 } : {}, f = (e, t) => {
+	if (!t) return e ? null : void 0;
+	let n = {};
+	for (let [e, r] of Object.entries(t)) r !== "**********" && (n[e] = r);
+	for (let r of Object.keys(e ?? {})) r in t || (n[r] = null);
+	return Object.keys(n).length > 0 ? n : void 0;
+}, p = [
+	"client_auth_method",
+	"scopes",
+	"client_id",
+	"client_secret"
+], m = (e, t) => {
+	if (t === "**********" || t === void 0) return;
+	if (t === null) return null;
+	if (Array.isArray(t)) return o(t) || JSON.stringify(e) === JSON.stringify(t) ? void 0 : t;
+	if (!r(t)) return Object.is(e, t) ? void 0 : t;
+	let n = r(e) ? e : {}, i = {};
+	for (let [e, r] of Object.entries(t)) {
+		let t = m(n[e], r);
+		t !== void 0 && (i[e] = t);
+	}
+	return Object.keys(i).length > 0 ? i : void 0;
+}, h = (e, t) => {
+	if (t === void 0) return;
+	if (t === null) return null;
+	let n = m(e, t), i = r(n) ? { ...n } : {}, a = r(e) ? e : {};
+	for (let e of p) e in a && !(e in t) && (i[e] = null);
+	if (Object.keys(i).length !== 0) return {
+		type: "oauth",
+		...i
 	};
-}
-function _(e) {
-	if (!e || typeof e != "object") return;
-	let t = e;
-	if (t.type !== "oauth") return;
-	let n = { type: "oauth" };
-	return (t.client_auth_method === "none" || t.client_auth_method === "client_secret_post" || t.client_auth_method === "client_secret_basic" || t.client_auth_method === "private_key_jwt") && (n.client_auth_method = t.client_auth_method), (typeof t.scopes == "string" || Array.isArray(t.scopes) && t.scopes.every((e) => typeof e == "string")) && (n.scopes = t.scopes), typeof t.client_name == "string" && (n.client_name = t.client_name), typeof t.client_metadata_url == "string" && (n.client_metadata_url = t.client_metadata_url), typeof t.client_id == "string" && (n.client_id = t.client_id), typeof t.client_secret == "string" && (n.client_secret = t.client_secret), t.additional_client_metadata && typeof t.additional_client_metadata == "object" && !Array.isArray(t.additional_client_metadata) && (n.additional_client_metadata = t.additional_client_metadata), n;
-}
-function v(e) {
-	let n = a(e);
-	if (!n) return { ...t };
-	let s = [], c = [], l = [];
-	for (let [e, t] of Object.entries(n)) {
-		if (!i(t)) continue;
-		let n = t.url, a = t.enabled === !1;
-		if (n) {
-			let i = t.transport, c = u(t), d = o(t.headers);
-			if (i === "sse") {
-				let t = r(e, "sse"), i = { url: n };
-				t && (i.name = t), c && (i.auth = c), d && (i.headers = d), a && (i.enabled = !1), s.push(i);
-			} else {
-				let i = r(e, "shttp"), o = { url: n };
-				i && (o.name = i), t.timeout != null && (o.timeout = t.timeout), c && (o.auth = c), d && (o.headers = d), a && (o.enabled = !1), l.push(o);
-			}
-		} else {
-			if (typeof t.command != "string") continue;
-			let n = {
-				name: e,
-				command: t.command
-			};
-			t.args && (n.args = t.args), t.env && (n.env = t.env), a && (n.enabled = !1), c.push(n);
-		}
+}, g = (e, t) => {
+	if (!e || e.strategy === t.strategy) return t;
+	let n = { ...t };
+	for (let t of Object.keys(e)) t !== "strategy" && !(t in n) && (n[t] = null);
+	return n;
+}, _ = "Removing an individual header from header authentication is not supported yet. Replace the credential or clear authentication, then re-enter the headers you want to keep.", v = (e, t) => {
+	let n = f(e?.strategy === "header" ? e.headers : void 0, t.headers);
+	if (n) {
+		if (Object.values(n).some((e) => e === null)) throw Error(_);
+		return {
+			strategy: "header",
+			headers: n
+		};
 	}
+}, y = (e, t) => {
+	let n = e?.strategy === "oauth2" ? e : void 0, r = h(n?.authentication, t.authentication), i = m(n?.state, t.state);
+	if (!(n && r === void 0 && i === void 0)) return g(e, {
+		strategy: "oauth2",
+		...r !== void 0 && { authentication: r },
+		...i !== void 0 && { state: i }
+	});
+};
+function b(e, t) {
+	let n = d(e, t);
+	if (t.type === "stdio") {
+		let r = f(e.transport === "stdio" ? e.env : void 0, t.env);
+		return {
+			transport: "stdio",
+			command: t.command,
+			...t.args?.length ? { args: t.args } : e.transport === "stdio" && e.args ? { args: null } : {},
+			...r === void 0 ? {} : { env: r },
+			...n
+		};
+	}
+	let r = e.transport === "stdio" ? void 0 : e, i = {
+		transport: t.type === "sse" ? "sse" : "http",
+		url: t.url,
+		...n
+	};
+	if (t.type === "shttp" && (t.timeout === void 0 ? r?.timeout !== void 0 && (i.timeout = null) : i.timeout = t.timeout), t.auth) if (t.auth.strategy === "oauth2") {
+		let e = y(r?.auth, t.auth);
+		e !== void 0 && (i.auth = e);
+	} else if (t.auth.strategy === "header" && r?.auth?.strategy === "header") {
+		let e = v(r.auth, t.auth);
+		e !== void 0 && (i.auth = e);
+	} else o(t.auth) || (i.auth = g(r?.auth, t.auth));
+	else r?.auth && (i.auth = null);
+	return i;
+}
+var x = (e, t) => {
+	let n = (e, t) => {
+		let i = r(e) ? { ...e } : {};
+		if (!r(t)) return i;
+		for (let [e, a] of Object.entries(t)) a === null ? delete i[e] : r(a) ? i[e] = n(i[e], a) : i[e] = a;
+		return i;
+	};
+	return n(e, t);
+}, S = "Replace or clear the stored credential before renaming this MCP server.";
+function C(e, t, n, r) {
+	if (o(n.transport === "stdio" ? n.env : {
+		auth: n.auth,
+		headers: n.headers
+	})) throw Error(S);
+	let i = x(n, b(n, r));
 	return {
-		sse_servers: s,
-		stdio_servers: c,
-		shttp_servers: l
+		[e]: null,
+		[t]: i
 	};
 }
-function y(t) {
-	let n = {}, r = (t) => {
-		let r = e(t);
-		if (!(r in n)) return r;
-		let i = 1;
-		for (; `${r}_${i}` in n;) i += 1;
-		return `${r}_${i}`;
-	};
-	for (let e of t.sse_servers) {
-		let t = {}, i;
-		typeof e == "string" ? t.url = e : (i = e.name, t.url = e.url, Object.assign(t, d(e), f(e))), t.transport = "sse", n[r(i || "sse")] = t;
-	}
-	for (let e of t.shttp_servers) {
-		let t = { transport: "http" }, i;
-		typeof e == "string" ? t.url = e : (i = e.name, t.url = e.url, Object.assign(t, d(e), f(e)), e.timeout != null && (t.timeout = e.timeout)), n[r(i || "shttp")] = t;
-	}
-	for (let e of t.stdio_servers) {
-		let t = { command: e.command };
-		e.args && (t.args = e.args), e.env && (t.env = e.env), Object.assign(t, f(e)), n[r(e.name || "stdio")] = t;
-	}
-	return Object.keys(n).length > 0 ? n : null;
+function w(e, n, r) {
+	let i = t(n || r);
+	if (!(i in e)) return i;
+	let a = 1;
+	for (; `${i}_${a}` in e;) a += 1;
+	return `${i}_${a}`;
 }
 //#endregion
-export { n as REDACTED_MCP_SECRET_VALUE, a as getSdkMcpServerMap, s as hasRedactedMcpSecretLeaf, v as parseMcpConfig, o as stringRecord, h as toMcpShttpServer, m as toMcpSseServer, g as toMcpStdioServer, y as toSdkMcpConfig };
+export { S as MCP_RENAME_CREDENTIAL_ERROR, n as REDACTED_MCP_SECRET_VALUE, w as allocateMcpSettingsKey, b as buildMcpServerPatch, C as buildRenameMcpConfigPatch, s as getMcpServerEnabled, o as hasRedactedMcpSecretLeaf, l as parseMcpConfig, a as stringRecord, u as toCanonicalMcpServer };
 
 //# sourceMappingURL=mcp-config.js.map