@openhands/agent-canvas 1.9.0 → 1.11.0

package/dist/utils/mcp-config.js

@@ -1,167 +1,185 @@
-import { toMcpServerName as e } from "./mcp-server-name.js";
+import { isMcpAuthCredential as e } from "../types/mcp-auth.js";
+import { toMcpServerName as t } from "./mcp-server-name.js";
 //#region src/utils/mcp-config.ts
-var t = {
-	sse_servers: [],
-	stdio_servers: [],
-	shttp_servers: []
-}, n = "**********";
-function r(e, t) {
-	return RegExp(`^${t}(_\\d+)?$`).test(e) ? void 0 : e;
-}
+var n = "**********", r = (e) => !!e && typeof e == "object" && !Array.isArray(e);
 function i(e) {
-	return !!e && typeof e == "object" && !Array.isArray(e);
-}
-function a(e) {
-	if (!i(e)) return null;
+	if (!r(e)) return null;
 	let t = e.mcpServers;
-	return i(t) && !("url" in t) && !("command" in t) ? t : e;
+	return r(t) && !("url" in t) && !("command" in t) ? t : e;
 }
-function o(e) {
-	if (!i(e)) return;
+function a(e) {
+	if (!r(e)) return;
 	let t = Object.entries(e).filter((e) => typeof e[1] == "string");
 	return t.length > 0 ? Object.fromEntries(t) : void 0;
 }
-function s(e) {
-	return e === "**********" ? !0 : Array.isArray(e) ? e.some(s) : i(e) ? Object.values(e).some(s) : !1;
-}
-function c(e) {
-	if (!i(e)) return;
-	let t = {};
-	return i(e.tokens) && (t.tokens = e.tokens), i(e.client_info) && (t.client_info = e.client_info), (typeof e.token_expires_at == "number" || e.token_expires_at === null) && (t.token_expires_at = e.token_expires_at), Object.keys(t).length > 0 ? t : void 0;
-}
-function l(e) {
-	if (i(e)) switch (e.strategy) {
-		case "none": return { strategy: "none" };
-		case "api_key": return typeof e.value == "string" ? {
-			strategy: "api_key",
-			value: e.value,
-			...typeof e.header_name == "string" && { header_name: e.header_name }
-		} : void 0;
-		case "bearer": return typeof e.value == "string" ? {
-			strategy: "bearer",
-			value: e.value
-		} : void 0;
-		case "basic": return typeof e.username != "string" || typeof e.password != "string" ? void 0 : {
-			strategy: "basic",
-			username: e.username,
-			password: e.password
-		};
-		case "header": {
-			let t = o(e.headers);
-			return t ? {
-				strategy: "header",
-				headers: t
-			} : void 0;
-		}
-		case "oauth2": {
-			let t = _(e.authentication), n = c(e.state);
-			return {
-				strategy: "oauth2",
-				...t && { authentication: t },
-				...n && { state: n }
+function o(e) {
+	return e === "**********" ? !0 : Array.isArray(e) ? e.some(o) : r(e) ? Object.values(e).some(o) : !1;
+}
+var s = (e) => e.enabled === !1 ? !1 : void 0, c = (e) => {
+	if (e === "stdio" || e === "sse" || e === "streamable-http") return e;
+	if (e === "http" || e === "shttp" || e === void 0) return "http";
+};
+function l(t) {
+	let n = i(t);
+	if (!n) return {};
+	let o = {};
+	for (let [t, i] of Object.entries(n)) {
+		if (!r(i)) continue;
+		if (typeof i.command == "string") {
+			o[t] = {
+				transport: "stdio",
+				command: i.command,
+				...Array.isArray(i.args) && i.args.every((e) => typeof e == "string") && { args: i.args },
+				...a(i.env) && { env: a(i.env) },
+				...typeof i.cwd == "string" && { cwd: i.cwd },
+				...typeof i.description == "string" && { description: i.description },
+				...typeof i.icon == "string" && { icon: i.icon },
+				...typeof i.timeout == "number" && { timeout: i.timeout },
+				...i.enabled === !1 && { enabled: !1 }
 			};
+			continue;
 		}
-		default: return;
+		if (typeof i.url != "string") continue;
+		let n = c(i.transport);
+		!n || n === "stdio" || (o[t] = {
+			transport: n,
+			url: i.url,
+			...a(i.headers) && { headers: a(i.headers) },
+			...e(i.auth) && { auth: i.auth },
+			...typeof i.description == "string" && { description: i.description },
+			...typeof i.icon == "string" && { icon: i.icon },
+			...typeof i.timeout == "number" && { timeout: i.timeout },
+			...typeof i.sse_read_timeout == "number" && { sse_read_timeout: i.sse_read_timeout },
+			...typeof i.keep_alive == "boolean" && { keep_alive: i.keep_alive },
+			...i.enabled === !1 && { enabled: !1 }
+		});
 	}
+	return o;
 }
 function u(e) {
-	return l(e.auth);
-}
-function d(e) {
-	let t = {};
-	return e.auth && !s(e.auth) && (t.auth = e.auth), e.headers && Object.keys(e.headers).length > 0 && (t.headers = e.headers), t;
-}
-function f(e) {
-	return e.enabled === !1 ? { enabled: !1 } : {};
-}
-function p(e) {
-	return {
-		...e.name && { name: e.name },
+	return e.type === "stdio" ? {
+		transport: "stdio",
+		command: e.command,
+		...e.args?.length ? { args: e.args } : {},
+		...e.env && Object.keys(e.env).length > 0 ? { env: e.env } : {},
+		...e.enabled === !1 && { enabled: !1 }
+	} : {
+		transport: e.type === "sse" ? "sse" : "http",
 		url: e.url,
-		...e.headers && { headers: e.headers },
-		...e.auth && { auth: e.auth },
-		...f(e)
+		...e.headers && Object.keys(e.headers).length > 0 ? { headers: e.headers } : {},
+		...e.auth ? { auth: e.auth } : {},
+		...e.type === "shttp" && e.timeout !== void 0 ? { timeout: e.timeout } : {},
+		...e.enabled === !1 && { enabled: !1 }
 	};
 }
-function m(e) {
-	return p(e);
-}
-function h(e) {
-	return {
-		...p(e),
-		...e.timeout !== void 0 && { timeout: e.timeout }
-	};
-}
-function g(e) {
-	return {
-		name: e.name,
-		command: e.command,
-		...e.args && { args: e.args },
-		...e.env && { env: e.env },
-		...f(e)
+var d = (e, t) => t.enabled === !1 ? { enabled: !1 } : s(e) === !1 ? { enabled: !0 } : {}, f = (e, t) => {
+	if (!t) return e ? null : void 0;
+	let n = {};
+	for (let [e, r] of Object.entries(t)) r !== "**********" && (n[e] = r);
+	for (let r of Object.keys(e ?? {})) r in t || (n[r] = null);
+	return Object.keys(n).length > 0 ? n : void 0;
+}, p = [
+	"client_auth_method",
+	"scopes",
+	"client_id",
+	"client_secret"
+], m = (e, t) => {
+	if (t === "**********" || t === void 0) return;
+	if (t === null) return null;
+	if (Array.isArray(t)) return o(t) || JSON.stringify(e) === JSON.stringify(t) ? void 0 : t;
+	if (!r(t)) return Object.is(e, t) ? void 0 : t;
+	let n = r(e) ? e : {}, i = {};
+	for (let [e, r] of Object.entries(t)) {
+		let t = m(n[e], r);
+		t !== void 0 && (i[e] = t);
+	}
+	return Object.keys(i).length > 0 ? i : void 0;
+}, h = (e, t) => {
+	if (t === void 0) return;
+	if (t === null) return null;
+	let n = m(e, t), i = r(n) ? { ...n } : {}, a = r(e) ? e : {};
+	for (let e of p) e in a && !(e in t) && (i[e] = null);
+	if (Object.keys(i).length !== 0) return {
+		type: "oauth",
+		...i
 	};
-}
-function _(e) {
-	if (!e || typeof e != "object") return;
-	let t = e;
-	if (t.type !== "oauth") return;
-	let n = { type: "oauth" };
-	return (t.client_auth_method === "none" || t.client_auth_method === "client_secret_post" || t.client_auth_method === "client_secret_basic" || t.client_auth_method === "private_key_jwt") && (n.client_auth_method = t.client_auth_method), (typeof t.scopes == "string" || Array.isArray(t.scopes) && t.scopes.every((e) => typeof e == "string")) && (n.scopes = t.scopes), typeof t.client_name == "string" && (n.client_name = t.client_name), typeof t.client_metadata_url == "string" && (n.client_metadata_url = t.client_metadata_url), typeof t.client_id == "string" && (n.client_id = t.client_id), typeof t.client_secret == "string" && (n.client_secret = t.client_secret), t.additional_client_metadata && typeof t.additional_client_metadata == "object" && !Array.isArray(t.additional_client_metadata) && (n.additional_client_metadata = t.additional_client_metadata), n;
-}
-function v(e) {
-	let n = a(e);
-	if (!n) return { ...t };
-	let s = [], c = [], l = [];
-	for (let [e, t] of Object.entries(n)) {
-		if (!i(t)) continue;
-		let n = t.url, a = t.enabled === !1;
-		if (n) {
-			let i = t.transport, c = u(t), d = o(t.headers);
-			if (i === "sse") {
-				let t = r(e, "sse"), i = { url: n };
-				t && (i.name = t), c && (i.auth = c), d && (i.headers = d), a && (i.enabled = !1), s.push(i);
-			} else {
-				let i = r(e, "shttp"), o = { url: n };
-				i && (o.name = i), t.timeout != null && (o.timeout = t.timeout), c && (o.auth = c), d && (o.headers = d), a && (o.enabled = !1), l.push(o);
-			}
-		} else {
-			if (typeof t.command != "string") continue;
-			let n = {
-				name: e,
-				command: t.command
-			};
-			t.args && (n.args = t.args), t.env && (n.env = t.env), a && (n.enabled = !1), c.push(n);
-		}
+}, g = (e, t) => {
+	if (!e || e.strategy === t.strategy) return t;
+	let n = { ...t };
+	for (let t of Object.keys(e)) t !== "strategy" && !(t in n) && (n[t] = null);
+	return n;
+}, _ = "Removing an individual header from header authentication is not supported yet. Replace the credential or clear authentication, then re-enter the headers you want to keep.", v = (e, t) => {
+	let n = f(e?.strategy === "header" ? e.headers : void 0, t.headers);
+	if (n) {
+		if (Object.values(n).some((e) => e === null)) throw Error(_);
+		return {
+			strategy: "header",
+			headers: n
+		};
 	}
+}, y = (e, t) => {
+	let n = e?.strategy === "oauth2" ? e : void 0, r = h(n?.authentication, t.authentication), i = m(n?.state, t.state);
+	if (!(n && r === void 0 && i === void 0)) return g(e, {
+		strategy: "oauth2",
+		...r !== void 0 && { authentication: r },
+		...i !== void 0 && { state: i }
+	});
+};
+function b(e, t) {
+	let n = d(e, t);
+	if (t.type === "stdio") {
+		let r = f(e.transport === "stdio" ? e.env : void 0, t.env);
+		return {
+			transport: "stdio",
+			command: t.command,
+			...t.args?.length ? { args: t.args } : e.transport === "stdio" && e.args ? { args: null } : {},
+			...r === void 0 ? {} : { env: r },
+			...n
+		};
+	}
+	let r = e.transport === "stdio" ? void 0 : e, i = {
+		transport: t.type === "sse" ? "sse" : "http",
+		url: t.url,
+		...n
+	};
+	if (t.type === "shttp" && (t.timeout === void 0 ? r?.timeout !== void 0 && (i.timeout = null) : i.timeout = t.timeout), t.auth) if (t.auth.strategy === "oauth2") {
+		let e = y(r?.auth, t.auth);
+		e !== void 0 && (i.auth = e);
+	} else if (t.auth.strategy === "header" && r?.auth?.strategy === "header") {
+		let e = v(r.auth, t.auth);
+		e !== void 0 && (i.auth = e);
+	} else o(t.auth) || (i.auth = g(r?.auth, t.auth));
+	else r?.auth && (i.auth = null);
+	return i;
+}
+var x = (e, t) => {
+	let n = (e, t) => {
+		let i = r(e) ? { ...e } : {};
+		if (!r(t)) return i;
+		for (let [e, a] of Object.entries(t)) a === null ? delete i[e] : r(a) ? i[e] = n(i[e], a) : i[e] = a;
+		return i;
+	};
+	return n(e, t);
+}, S = "Replace or clear the stored credential before renaming this MCP server.";
+function C(e, t, n, r) {
+	if (o(n.transport === "stdio" ? n.env : {
+		auth: n.auth,
+		headers: n.headers
+	})) throw Error(S);
+	let i = x(n, b(n, r));
 	return {
-		sse_servers: s,
-		stdio_servers: c,
-		shttp_servers: l
+		[e]: null,
+		[t]: i
 	};
 }
-function y(t) {
-	let n = {}, r = (t) => {
-		let r = e(t);
-		if (!(r in n)) return r;
-		let i = 1;
-		for (; `${r}_${i}` in n;) i += 1;
-		return `${r}_${i}`;
-	};
-	for (let e of t.sse_servers) {
-		let t = {}, i;
-		typeof e == "string" ? t.url = e : (i = e.name, t.url = e.url, Object.assign(t, d(e), f(e))), t.transport = "sse", n[r(i || "sse")] = t;
-	}
-	for (let e of t.shttp_servers) {
-		let t = { transport: "http" }, i;
-		typeof e == "string" ? t.url = e : (i = e.name, t.url = e.url, Object.assign(t, d(e), f(e)), e.timeout != null && (t.timeout = e.timeout)), n[r(i || "shttp")] = t;
-	}
-	for (let e of t.stdio_servers) {
-		let t = { command: e.command };
-		e.args && (t.args = e.args), e.env && (t.env = e.env), Object.assign(t, f(e)), n[r(e.name || "stdio")] = t;
-	}
-	return Object.keys(n).length > 0 ? n : null;
+function w(e, n, r) {
+	let i = t(n || r);
+	if (!(i in e)) return i;
+	let a = 1;
+	for (; `${i}_${a}` in e;) a += 1;
+	return `${i}_${a}`;
 }
 //#endregion
-export { n as REDACTED_MCP_SECRET_VALUE, a as getSdkMcpServerMap, s as hasRedactedMcpSecretLeaf, v as parseMcpConfig, o as stringRecord, h as toMcpShttpServer, m as toMcpSseServer, g as toMcpStdioServer, y as toSdkMcpConfig };
+export { S as MCP_RENAME_CREDENTIAL_ERROR, n as REDACTED_MCP_SECRET_VALUE, w as allocateMcpSettingsKey, b as buildMcpServerPatch, C as buildRenameMcpConfigPatch, s as getMcpServerEnabled, o as hasRedactedMcpSecretLeaf, l as parseMcpConfig, a as stringRecord, u as toCanonicalMcpServer };
 
 //# sourceMappingURL=mcp-config.js.map

package/dist/utils/mcp-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-config.js","names":[],"sources":["../../src/utils/mcp-config.ts"],"sourcesContent":["import {\n  MCPConfig,\n  MCPSSEServer,\n  MCPSHTTPServer,\n  MCPStdioServer,\n  SettingsValue,\n} from \"#/types/settings\";\nimport type {\n  MCPAuthCredential,\n  MCPAuthenticationConfig,\n  MCPJsonValue,\n  MCPOAuthState,\n} from \"#/types/mcp-auth\";\nimport type { MCPServerConfig } from \"#/types/mcp-server\";\nimport { toMcpServerName } from \"#/utils/mcp-server-name\";\n\nconst EMPTY_MCP_CONFIG: MCPConfig = {\n  sse_servers: [],\n  stdio_servers: [],\n  shttp_servers: [],\n};\n\nexport const REDACTED_MCP_SECRET_VALUE = \"**********\";\n\ntype SdkMcpServerConfig = Record<string, SettingsValue | MCPAuthCredential>;\ntype SdkMcpConfig = Record<string, SdkMcpServerConfig>;\n\n/**\n * The dict key for an SSE/SHTTP server doubles as its display name once a\n * user provides one. Keys that match the auto-generated fallback pattern\n * (``sse``, ``shttp``, ``shttp_1``, …) emitted by {@link toSdkMcpConfig}\n * carry no user intent, so we surface them as \"no name\" — re-serializing\n * regenerates the identical fallback key and existing configs are left\n * untouched.\n */\nfunction userGivenServerName(\n  serverName: string,\n  base: \"sse\" | \"shttp\",\n): string | undefined {\n  const autoGenerated = new RegExp(`^${base}(_\\\\d+)?$`);\n  return autoGenerated.test(serverName) ? undefined : serverName;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return !!value && typeof value === \"object\" && !Array.isArray(value);\n}\n\nexport function getSdkMcpServerMap(\n  value: unknown,\n): Record<string, unknown> | null {\n  if (!isRecord(value)) return null;\n\n  const mcpServers = value.mcpServers;\n  if (\n    isRecord(mcpServers) &&\n    !(\"url\" in mcpServers) &&\n    !(\"command\" in mcpServers)\n  ) {\n    return mcpServers;\n  }\n\n  return value;\n}\n\nexport function stringRecord(\n  value: unknown,\n): Record<string, string> | undefined {\n  if (!isRecord(value)) return undefined;\n  const entries = Object.entries(value).filter(\n    (entry): entry is [string, string] => typeof entry[1] === \"string\",\n  );\n  return entries.length > 0 ? Object.fromEntries(entries) : undefined;\n}\n\nexport function hasRedactedMcpSecretLeaf(value: unknown): boolean {\n  if (value === REDACTED_MCP_SECRET_VALUE) return true;\n  if (Array.isArray(value)) return value.some(hasRedactedMcpSecretLeaf);\n  if (isRecord(value))\n    return Object.values(value).some(hasRedactedMcpSecretLeaf);\n  return false;\n}\n\nfunction getOAuthState(value: unknown): MCPOAuthState | undefined {\n  if (!isRecord(value)) return undefined;\n  const state: MCPOAuthState = {};\n  if (isRecord(value.tokens)) {\n    state.tokens = value.tokens as NonNullable<MCPOAuthState[\"tokens\"]>;\n  }\n  if (isRecord(value.client_info)) {\n    state.client_info = value.client_info as NonNullable<\n      MCPOAuthState[\"client_info\"]\n    >;\n  }\n  if (\n    typeof value.token_expires_at === \"number\" ||\n    value.token_expires_at === null\n  ) {\n    state.token_expires_at = value.token_expires_at;\n  }\n  return Object.keys(state).length > 0 ? state : undefined;\n}\n\nfunction normalizeTaggedAuthCredential(\n  value: unknown,\n): MCPAuthCredential | undefined {\n  if (!isRecord(value)) return undefined;\n  switch (value.strategy) {\n    case \"none\":\n      return { strategy: \"none\" };\n    case \"api_key\":\n      if (typeof value.value !== \"string\") return undefined;\n      return {\n        strategy: \"api_key\",\n        value: value.value,\n        ...(typeof value.header_name === \"string\" && {\n          header_name: value.header_name,\n        }),\n      };\n    case \"bearer\":\n      if (typeof value.value !== \"string\") return undefined;\n      return { strategy: \"bearer\", value: value.value };\n    case \"basic\":\n      if (\n        typeof value.username !== \"string\" ||\n        typeof value.password !== \"string\"\n      ) {\n        return undefined;\n      }\n      return {\n        strategy: \"basic\",\n        username: value.username,\n        password: value.password,\n      };\n    case \"header\": {\n      const headers = stringRecord(value.headers);\n      return headers ? { strategy: \"header\", headers } : undefined;\n    }\n    case \"oauth2\": {\n      const authentication = getAuthenticationConfig(value.authentication);\n      const state = getOAuthState(value.state);\n      return {\n        strategy: \"oauth2\",\n        ...(authentication && { authentication }),\n        ...(state && { state }),\n      };\n    }\n    default:\n      return undefined;\n  }\n}\n\nfunction authCredentialFromServerConfig(\n  serverConfig: Record<string, unknown>,\n): MCPAuthCredential | undefined {\n  return normalizeTaggedAuthCredential(serverConfig.auth);\n}\n\nfunction getRemoteSecretFields(entry: {\n  auth?: MCPAuthCredential;\n  headers?: Record<string, string>;\n}): Partial<SdkMcpServerConfig> {\n  const fields: Partial<SdkMcpServerConfig> = {};\n  if (entry.auth && !hasRedactedMcpSecretLeaf(entry.auth)) {\n    fields.auth = entry.auth;\n  }\n  if (entry.headers && Object.keys(entry.headers).length > 0) {\n    fields.headers = entry.headers;\n  }\n  return fields;\n}\n\n/**\n * Only an explicit ``false`` is carried. Every mutation round-trips the whole\n * server map through these converters, so preserving the flag here is what\n * stops adding or deleting one server from silently re-enabling another.\n */\nfunction disabledField(server: { enabled?: boolean }) {\n  return server.enabled === false ? { enabled: false as const } : {};\n}\n\nfunction getRemoteServerFields(server: MCPServerConfig) {\n  return {\n    ...(server.name && { name: server.name }),\n    url: server.url!,\n    ...(server.headers && { headers: server.headers }),\n    ...(server.auth && { auth: server.auth }),\n    ...disabledField(server),\n  };\n}\n\nexport function toMcpSseServer(server: MCPServerConfig): MCPSSEServer {\n  return getRemoteServerFields(server);\n}\n\nexport function toMcpShttpServer(server: MCPServerConfig): MCPSHTTPServer {\n  return {\n    ...getRemoteServerFields(server),\n    ...(server.timeout !== undefined && { timeout: server.timeout }),\n  };\n}\n\nexport function toMcpStdioServer(server: MCPServerConfig): MCPStdioServer {\n  return {\n    name: server.name!,\n    command: server.command!,\n    ...(server.args && { args: server.args }),\n    ...(server.env && { env: server.env }),\n    ...disabledField(server),\n  };\n}\n\nfunction getAuthenticationConfig(\n  value: unknown,\n): MCPAuthenticationConfig | undefined {\n  if (!value || typeof value !== \"object\") return undefined;\n  const record = value as Record<string, unknown>;\n  if (record.type !== \"oauth\") return undefined;\n  const authentication: MCPAuthenticationConfig = { type: \"oauth\" };\n  if (\n    record.client_auth_method === \"none\" ||\n    record.client_auth_method === \"client_secret_post\" ||\n    record.client_auth_method === \"client_secret_basic\" ||\n    record.client_auth_method === \"private_key_jwt\"\n  ) {\n    authentication.client_auth_method = record.client_auth_method;\n  }\n  if (typeof record.scopes === \"string\") {\n    authentication.scopes = record.scopes;\n  } else if (\n    Array.isArray(record.scopes) &&\n    record.scopes.every((scope) => typeof scope === \"string\")\n  ) {\n    authentication.scopes = record.scopes;\n  }\n  if (typeof record.client_name === \"string\") {\n    authentication.client_name = record.client_name;\n  }\n  if (typeof record.client_metadata_url === \"string\") {\n    authentication.client_metadata_url = record.client_metadata_url;\n  }\n  if (typeof record.client_id === \"string\") {\n    authentication.client_id = record.client_id;\n  }\n  if (typeof record.client_secret === \"string\") {\n    authentication.client_secret = record.client_secret;\n  }\n  if (\n    record.additional_client_metadata &&\n    typeof record.additional_client_metadata === \"object\" &&\n    !Array.isArray(record.additional_client_metadata)\n  ) {\n    authentication.additional_client_metadata =\n      record.additional_client_metadata as Record<string, MCPJsonValue>;\n  }\n  return authentication;\n}\n\n/**\n * Parse the SDK-native ``agent_settings.mcp_config`` value and convert it\n * to the frontend MCPConfig format used by UI components.\n */\nexport function parseMcpConfig(value: unknown): MCPConfig {\n  const mcpConfig = getSdkMcpServerMap(value);\n  if (!mcpConfig) {\n    return { ...EMPTY_MCP_CONFIG };\n  }\n\n  const sseServers: (string | MCPSSEServer)[] = [];\n  const stdioServers: MCPStdioServer[] = [];\n  const shttpServers: (string | MCPSHTTPServer)[] = [];\n\n  for (const [serverName, serverConfig] of Object.entries(mcpConfig)) {\n    if (!isRecord(serverConfig)) continue;\n\n    const url = serverConfig.url as string | undefined;\n\n    // The SDK omits ``enabled`` while it holds its default (true), so only an\n    // explicit ``false`` marks a server as switched off.\n    const disabled = serverConfig.enabled === false;\n\n    if (url) {\n      const transport = serverConfig.transport as string | undefined;\n      const auth = authCredentialFromServerConfig(serverConfig);\n      const headers = stringRecord(serverConfig.headers);\n\n      if (transport === \"sse\") {\n        const name = userGivenServerName(serverName, \"sse\");\n        const server: MCPSSEServer = { url };\n        if (name) server.name = name;\n        if (auth) server.auth = auth;\n        if (headers) server.headers = headers;\n        if (disabled) server.enabled = false;\n        sseServers.push(server);\n      } else {\n        const name = userGivenServerName(serverName, \"shttp\");\n        const server: MCPSHTTPServer = { url };\n        if (name) server.name = name;\n        if (serverConfig.timeout != null) {\n          server.timeout = serverConfig.timeout as number;\n        }\n        if (auth) server.auth = auth;\n        if (headers) server.headers = headers;\n        if (disabled) server.enabled = false;\n        shttpServers.push(server);\n      }\n    } else {\n      if (typeof serverConfig.command !== \"string\") continue;\n      const stdioServer: MCPStdioServer = {\n        name: serverName,\n        command: serverConfig.command,\n      };\n      if (serverConfig.args) {\n        stdioServer.args = serverConfig.args as string[];\n      }\n      if (serverConfig.env) {\n        stdioServer.env = serverConfig.env as Record<string, string>;\n      }\n      if (disabled) stdioServer.enabled = false;\n      stdioServers.push(stdioServer);\n    }\n  }\n\n  return {\n    sse_servers: sseServers,\n    stdio_servers: stdioServers,\n    shttp_servers: shttpServers,\n  };\n}\n\n/**\n * Convert the frontend MCPConfig format back to the SDK-native server map\n * expected by agent_settings.mcp_config on the backend.\n *\n * Names are only suffixed (``_1``, ``_2``, …) when an earlier entry has\n * already claimed the bare base name. We intentionally do NOT use a single\n * monotonic counter across server types: that would, for example, rename a\n * stdio server \"myname\" to \"myname_1\" the moment any sse/shttp entry is\n * persisted ahead of it, and shift the suffix on every save as the count\n * of other server types changes. With per-base collision suffixing,\n * unrelated entries keep their human-meaningful names stable across edits.\n *\n * ``enabled`` is only emitted when a server is switched off — the SDK defaults\n * it to true. Omitting it is what *clears* a previously persisted\n * ``enabled: false``, and that only works because ``saveSettings`` pre-clears\n * ``mcp_config`` to null before every write (see\n * ``settings-service.api.ts``), turning the backend's RFC 7386 merge into a\n * full replace. If that pre-clear is ever removed, re-enabling a server\n * becomes a silent no-op.\n */\nexport function toSdkMcpConfig(config: MCPConfig): SdkMcpConfig | null {\n  const mcpConfig: SdkMcpConfig = {};\n\n  const reserve = (base: string): string => {\n    const safeBase = toMcpServerName(base);\n    if (!(safeBase in mcpConfig)) return safeBase;\n    let i = 1;\n    while (`${safeBase}_${i}` in mcpConfig) i += 1;\n    return `${safeBase}_${i}`;\n  };\n\n  for (const entry of config.sse_servers) {\n    const server: SdkMcpServerConfig = {};\n    let name: string | undefined;\n    if (typeof entry === \"string\") {\n      server.url = entry;\n    } else {\n      name = entry.name;\n      server.url = entry.url;\n      Object.assign(server, getRemoteSecretFields(entry), disabledField(entry));\n    }\n    server.transport = \"sse\";\n    mcpConfig[reserve(name || \"sse\")] = server;\n  }\n\n  for (const entry of config.shttp_servers) {\n    const server: SdkMcpServerConfig = { transport: \"http\" };\n    let name: string | undefined;\n    if (typeof entry === \"string\") {\n      server.url = entry;\n    } else {\n      name = entry.name;\n      server.url = entry.url;\n      Object.assign(server, getRemoteSecretFields(entry), disabledField(entry));\n      if (entry.timeout != null) server.timeout = entry.timeout;\n    }\n    mcpConfig[reserve(name || \"shttp\")] = server;\n  }\n\n  for (const entry of config.stdio_servers) {\n    const server: SdkMcpServerConfig = {\n      command: entry.command,\n    };\n    if (entry.args) server.args = entry.args;\n    if (entry.env) server.env = entry.env;\n    Object.assign(server, disabledField(entry));\n    mcpConfig[reserve(entry.name || \"stdio\")] = server;\n  }\n\n  return Object.keys(mcpConfig).length > 0 ? mcpConfig : null;\n}\n"],"mappings":";;AAgBA,IAAM,IAA8B;CAClC,aAAa,CAAC;CACd,eAAe,CAAC;CAChB,eAAe,CAAC;AAClB,GAEa,IAA4B;AAazC,SAAS,EACP,GACA,GACoB;CAEpB,OAD0B,OAAO,IAAI,EAAK,UACnC,EAAc,KAAK,CAAU,IAAI,KAAA,IAAY;AACtD;AAEA,SAAS,EAAS,GAAkD;CAClE,OAAO,CAAC,CAAC,KAAS,OAAO,KAAU,YAAY,CAAC,MAAM,QAAQ,CAAK;AACrE;AAEA,SAAgB,EACd,GACgC;CAChC,IAAI,CAAC,EAAS,CAAK,GAAG,OAAO;CAE7B,IAAM,IAAa,EAAM;CASzB,OAPE,EAAS,CAAU,KACnB,EAAE,SAAS,MACX,EAAE,aAAa,KAER,IAGF;AACT;AAEA,SAAgB,EACd,GACoC;CACpC,IAAI,CAAC,EAAS,CAAK,GAAG;CACtB,IAAM,IAAU,OAAO,QAAQ,CAAK,EAAE,QACnC,MAAqC,OAAO,EAAM,MAAO,QAC5D;CACA,OAAO,EAAQ,SAAS,IAAI,OAAO,YAAY,CAAO,IAAI,KAAA;AAC5D;AAEA,SAAgB,EAAyB,GAAyB;CAKhE,OAJI,MAAA,eAA4C,KAC5C,MAAM,QAAQ,CAAK,IAAU,EAAM,KAAK,CAAwB,IAChE,EAAS,CAAK,IACT,OAAO,OAAO,CAAK,EAAE,KAAK,CAAwB,IACpD;AACT;AAEA,SAAS,EAAc,GAA2C;CAChE,IAAI,CAAC,EAAS,CAAK,GAAG;CACtB,IAAM,IAAuB,CAAC;CAe9B,OAdI,EAAS,EAAM,MAAM,MACvB,EAAM,SAAS,EAAM,SAEnB,EAAS,EAAM,WAAW,MAC5B,EAAM,cAAc,EAAM,eAK1B,OAAO,EAAM,oBAAqB,YAClC,EAAM,qBAAqB,UAE3B,EAAM,mBAAmB,EAAM,mBAE1B,OAAO,KAAK,CAAK,EAAE,SAAS,IAAI,IAAQ,KAAA;AACjD;AAEA,SAAS,EACP,GAC+B;CAC1B,MAAS,CAAK,GACnB,QAAQ,EAAM,UAAd;EACE,KAAK,QACH,OAAO,EAAE,UAAU,OAAO;EAC5B,KAAK,WAEH,OADI,OAAO,EAAM,SAAU,WACpB;GACL,UAAU;GACV,OAAO,EAAM;GACb,GAAI,OAAO,EAAM,eAAgB,YAAY,EAC3C,aAAa,EAAM,YACrB;EACF,IAPqC;EAQvC,KAAK,UAEH,OADI,OAAO,EAAM,SAAU,WACpB;GAAE,UAAU;GAAU,OAAO,EAAM;EAAM,IADX;EAEvC,KAAK,SAOH,OALE,OAAO,EAAM,YAAa,YAC1B,OAAO,EAAM,YAAa,WAE1B,SAEK;GACL,UAAU;GACV,UAAU,EAAM;GAChB,UAAU,EAAM;EAClB;EACF,KAAK,UAAU;GACb,IAAM,IAAU,EAAa,EAAM,OAAO;GAC1C,OAAO,IAAU;IAAE,UAAU;IAAU;GAAQ,IAAI,KAAA;EACrD;EACA,KAAK,UAAU;GACb,IAAM,IAAiB,EAAwB,EAAM,cAAc,GAC7D,IAAQ,EAAc,EAAM,KAAK;GACvC,OAAO;IACL,UAAU;IACV,GAAI,KAAkB,EAAE,kBAAe;IACvC,GAAI,KAAS,EAAE,SAAM;GACvB;EACF;EACA,SACE;CACJ;AACF;AAEA,SAAS,EACP,GAC+B;CAC/B,OAAO,EAA8B,EAAa,IAAI;AACxD;AAEA,SAAS,EAAsB,GAGC;CAC9B,IAAM,IAAsC,CAAC;CAO7C,OANI,EAAM,QAAQ,CAAC,EAAyB,EAAM,IAAI,MACpD,EAAO,OAAO,EAAM,OAElB,EAAM,WAAW,OAAO,KAAK,EAAM,OAAO,EAAE,SAAS,MACvD,EAAO,UAAU,EAAM,UAElB;AACT;AAOA,SAAS,EAAc,GAA+B;CACpD,OAAO,EAAO,YAAY,KAAQ,EAAE,SAAS,GAAe,IAAI,CAAC;AACnE;AAEA,SAAS,EAAsB,GAAyB;CACtD,OAAO;EACL,GAAI,EAAO,QAAQ,EAAE,MAAM,EAAO,KAAK;EACvC,KAAK,EAAO;EACZ,GAAI,EAAO,WAAW,EAAE,SAAS,EAAO,QAAQ;EAChD,GAAI,EAAO,QAAQ,EAAE,MAAM,EAAO,KAAK;EACvC,GAAG,EAAc,CAAM;CACzB;AACF;AAEA,SAAgB,EAAe,GAAuC;CACpE,OAAO,EAAsB,CAAM;AACrC;AAEA,SAAgB,EAAiB,GAAyC;CACxE,OAAO;EACL,GAAG,EAAsB,CAAM;EAC/B,GAAI,EAAO,YAAY,KAAA,KAAa,EAAE,SAAS,EAAO,QAAQ;CAChE;AACF;AAEA,SAAgB,EAAiB,GAAyC;CACxE,OAAO;EACL,MAAM,EAAO;EACb,SAAS,EAAO;EAChB,GAAI,EAAO,QAAQ,EAAE,MAAM,EAAO,KAAK;EACvC,GAAI,EAAO,OAAO,EAAE,KAAK,EAAO,IAAI;EACpC,GAAG,EAAc,CAAM;CACzB;AACF;AAEA,SAAS,EACP,GACqC;CACrC,IAAI,CAAC,KAAS,OAAO,KAAU,UAAU;CACzC,IAAM,IAAS;CACf,IAAI,EAAO,SAAS,SAAS;CAC7B,IAAM,IAA0C,EAAE,MAAM,QAAQ;CAqChE,QAnCE,EAAO,uBAAuB,UAC9B,EAAO,uBAAuB,wBAC9B,EAAO,uBAAuB,yBAC9B,EAAO,uBAAuB,uBAE9B,EAAe,qBAAqB,EAAO,sBAEzC,OAAO,EAAO,UAAW,YAG3B,MAAM,QAAQ,EAAO,MAAM,KAC3B,EAAO,OAAO,OAAO,MAAU,OAAO,KAAU,QAAQ,OAHxD,EAAe,SAAS,EAAO,SAO7B,OAAO,EAAO,eAAgB,aAChC,EAAe,cAAc,EAAO,cAElC,OAAO,EAAO,uBAAwB,aACxC,EAAe,sBAAsB,EAAO,sBAE1C,OAAO,EAAO,aAAc,aAC9B,EAAe,YAAY,EAAO,YAEhC,OAAO,EAAO,iBAAkB,aAClC,EAAe,gBAAgB,EAAO,gBAGtC,EAAO,8BACP,OAAO,EAAO,8BAA+B,YAC7C,CAAC,MAAM,QAAQ,EAAO,0BAA0B,MAEhD,EAAe,6BACb,EAAO,6BAEJ;AACT;AAMA,SAAgB,EAAe,GAA2B;CACxD,IAAM,IAAY,EAAmB,CAAK;CAC1C,IAAI,CAAC,GACH,OAAO,EAAE,GAAG,EAAiB;CAG/B,IAAM,IAAwC,CAAC,GACzC,IAAiC,CAAC,GAClC,IAA4C,CAAC;CAEnD,KAAK,IAAM,CAAC,GAAY,MAAiB,OAAO,QAAQ,CAAS,GAAG;EAClE,IAAI,CAAC,EAAS,CAAY,GAAG;EAE7B,IAAM,IAAM,EAAa,KAInB,IAAW,EAAa,YAAY;EAE1C,IAAI,GAAK;GACP,IAAM,IAAY,EAAa,WACzB,IAAO,EAA+B,CAAY,GAClD,IAAU,EAAa,EAAa,OAAO;GAEjD,IAAI,MAAc,OAAO;IACvB,IAAM,IAAO,EAAoB,GAAY,KAAK,GAC5C,IAAuB,EAAE,OAAI;IAKnC,AAJI,MAAM,EAAO,OAAO,IACpB,MAAM,EAAO,OAAO,IACpB,MAAS,EAAO,UAAU,IAC1B,MAAU,EAAO,UAAU,KAC/B,EAAW,KAAK,CAAM;GACxB,OAAO;IACL,IAAM,IAAO,EAAoB,GAAY,OAAO,GAC9C,IAAyB,EAAE,OAAI;IAQrC,AAPI,MAAM,EAAO,OAAO,IACpB,EAAa,WAAW,SAC1B,EAAO,UAAU,EAAa,UAE5B,MAAM,EAAO,OAAO,IACpB,MAAS,EAAO,UAAU,IAC1B,MAAU,EAAO,UAAU,KAC/B,EAAa,KAAK,CAAM;GAC1B;EACF,OAAO;GACL,IAAI,OAAO,EAAa,WAAY,UAAU;GAC9C,IAAM,IAA8B;IAClC,MAAM;IACN,SAAS,EAAa;GACxB;GAQA,AAPI,EAAa,SACf,EAAY,OAAO,EAAa,OAE9B,EAAa,QACf,EAAY,MAAM,EAAa,MAE7B,MAAU,EAAY,UAAU,KACpC,EAAa,KAAK,CAAW;EAC/B;CACF;CAEA,OAAO;EACL,aAAa;EACb,eAAe;EACf,eAAe;CACjB;AACF;AAsBA,SAAgB,EAAe,GAAwC;CACrE,IAAM,IAA0B,CAAC,GAE3B,KAAW,MAAyB;EACxC,IAAM,IAAW,EAAgB,CAAI;EACrC,IAAI,EAAE,KAAY,IAAY,OAAO;EACrC,IAAI,IAAI;EACR,OAAO,GAAG,EAAS,GAAG,OAAO,IAAW,KAAK;EAC7C,OAAO,GAAG,EAAS,GAAG;CACxB;CAEA,KAAK,IAAM,KAAS,EAAO,aAAa;EACtC,IAAM,IAA6B,CAAC,GAChC;EASJ,AARI,OAAO,KAAU,WACnB,EAAO,MAAM,KAEb,IAAO,EAAM,MACb,EAAO,MAAM,EAAM,KACnB,OAAO,OAAO,GAAQ,EAAsB,CAAK,GAAG,EAAc,CAAK,CAAC,IAE1E,EAAO,YAAY,OACnB,EAAU,EAAQ,KAAQ,KAAK,KAAK;CACtC;CAEA,KAAK,IAAM,KAAS,EAAO,eAAe;EACxC,IAAM,IAA6B,EAAE,WAAW,OAAO,GACnD;EASJ,AARI,OAAO,KAAU,WACnB,EAAO,MAAM,KAEb,IAAO,EAAM,MACb,EAAO,MAAM,EAAM,KACnB,OAAO,OAAO,GAAQ,EAAsB,CAAK,GAAG,EAAc,CAAK,CAAC,GACpE,EAAM,WAAW,SAAM,EAAO,UAAU,EAAM,WAEpD,EAAU,EAAQ,KAAQ,OAAO,KAAK;CACxC;CAEA,KAAK,IAAM,KAAS,EAAO,eAAe;EACxC,IAAM,IAA6B,EACjC,SAAS,EAAM,QACjB;EAIA,AAHI,EAAM,SAAM,EAAO,OAAO,EAAM,OAChC,EAAM,QAAK,EAAO,MAAM,EAAM,MAClC,OAAO,OAAO,GAAQ,EAAc,CAAK,CAAC,GAC1C,EAAU,EAAQ,EAAM,QAAQ,OAAO,KAAK;CAC9C;CAEA,OAAO,OAAO,KAAK,CAAS,EAAE,SAAS,IAAI,IAAY;AACzD"}
+{"version":3,"file":"mcp-config.js","names":[],"sources":["../../src/utils/mcp-config.ts"],"sourcesContent":["import type {\n  MCPAuthCredential,\n  MCPConfig,\n  MCPConfigPatch,\n  MCPServer,\n  MCPServerPatch,\n} from \"@openhands/typescript-client\";\nimport { isMcpAuthCredential } from \"#/types/mcp-auth\";\nimport type { MCPServerConfig } from \"#/types/mcp-server\";\nimport { toMcpServerName } from \"#/utils/mcp-server-name\";\n\nexport const REDACTED_MCP_SECRET_VALUE = \"**********\";\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  !!value && typeof value === \"object\" && !Array.isArray(value);\n\nexport function getSdkMcpServerMap(\n  value: unknown,\n): Record<string, unknown> | null {\n  if (!isRecord(value)) return null;\n\n  const mcpServers = value.mcpServers;\n  if (\n    isRecord(mcpServers) &&\n    !(\"url\" in mcpServers) &&\n    !(\"command\" in mcpServers)\n  ) {\n    return mcpServers;\n  }\n\n  return value;\n}\n\nexport function stringRecord(\n  value: unknown,\n): Record<string, string> | undefined {\n  if (!isRecord(value)) return undefined;\n  const entries = Object.entries(value).filter(\n    (entry): entry is [string, string] => typeof entry[1] === \"string\",\n  );\n  return entries.length > 0 ? Object.fromEntries(entries) : undefined;\n}\n\nexport function hasRedactedMcpSecretLeaf(value: unknown): boolean {\n  if (value === REDACTED_MCP_SECRET_VALUE) return true;\n  if (Array.isArray(value)) return value.some(hasRedactedMcpSecretLeaf);\n  if (isRecord(value)) {\n    return Object.values(value).some(hasRedactedMcpSecretLeaf);\n  }\n  return false;\n}\n\n// Agent Server persists this optional field, but typescript-client 1.36.1\n// does not yet expose it in its generated MCP model types.\nexport const getMcpServerEnabled = (server: MCPServer): boolean | undefined =>\n  (server as MCPServer & { enabled?: unknown }).enabled === false\n    ? false\n    : undefined;\n\nconst normalizeTransport = (\n  value: unknown,\n): MCPServer[\"transport\"] | undefined => {\n  if (value === \"stdio\" || value === \"sse\" || value === \"streamable-http\") {\n    return value;\n  }\n  if (value === \"http\" || value === \"shttp\" || value === undefined) {\n    return \"http\";\n  }\n  return undefined;\n};\n\n/**\n * Normalize the SDK and legacy cloud wrapper shapes into the client-owned,\n * name-keyed MCPConfig. The map key remains the server's persistence identity.\n */\n// @spec MCP-003 — Settings map keys are stable MCP identities\nexport function parseMcpConfig(value: unknown): MCPConfig {\n  const serverMap = getSdkMcpServerMap(value);\n  if (!serverMap) return {};\n\n  const config: MCPConfig = {};\n  for (const [settingsKey, candidate] of Object.entries(serverMap)) {\n    if (!isRecord(candidate)) continue;\n\n    if (typeof candidate.command === \"string\") {\n      config[settingsKey] = {\n        transport: \"stdio\",\n        command: candidate.command,\n        ...(Array.isArray(candidate.args) &&\n          candidate.args.every((arg) => typeof arg === \"string\") && {\n            args: candidate.args as string[],\n          }),\n        ...(stringRecord(candidate.env) && {\n          env: stringRecord(candidate.env),\n        }),\n        ...(typeof candidate.cwd === \"string\" && { cwd: candidate.cwd }),\n        ...(typeof candidate.description === \"string\" && {\n          description: candidate.description,\n        }),\n        ...(typeof candidate.icon === \"string\" && { icon: candidate.icon }),\n        ...(typeof candidate.timeout === \"number\" && {\n          timeout: candidate.timeout,\n        }),\n        ...(candidate.enabled === false && { enabled: false }),\n      };\n      continue;\n    }\n\n    if (typeof candidate.url !== \"string\") continue;\n    const transport = normalizeTransport(candidate.transport);\n    if (!transport || transport === \"stdio\") continue;\n    config[settingsKey] = {\n      transport,\n      url: candidate.url,\n      ...(stringRecord(candidate.headers) && {\n        headers: stringRecord(candidate.headers),\n      }),\n      ...(isMcpAuthCredential(candidate.auth) && {\n        auth: candidate.auth,\n      }),\n      ...(typeof candidate.description === \"string\" && {\n        description: candidate.description,\n      }),\n      ...(typeof candidate.icon === \"string\" && { icon: candidate.icon }),\n      ...(typeof candidate.timeout === \"number\" && {\n        timeout: candidate.timeout,\n      }),\n      ...(typeof candidate.sse_read_timeout === \"number\" && {\n        sse_read_timeout: candidate.sse_read_timeout,\n      }),\n      ...(typeof candidate.keep_alive === \"boolean\" && {\n        keep_alive: candidate.keep_alive,\n      }),\n      ...(candidate.enabled === false && { enabled: false }),\n    };\n  }\n  return config;\n}\n\nexport function toCanonicalMcpServer(server: MCPServerConfig): MCPServer {\n  if (server.type === \"stdio\") {\n    return {\n      transport: \"stdio\",\n      command: server.command!,\n      ...(server.args?.length ? { args: server.args } : {}),\n      ...(server.env && Object.keys(server.env).length > 0\n        ? { env: server.env }\n        : {}),\n      ...(server.enabled === false && { enabled: false }),\n    };\n  }\n\n  return {\n    transport: server.type === \"sse\" ? \"sse\" : \"http\",\n    url: server.url!,\n    ...(server.headers && Object.keys(server.headers).length > 0\n      ? { headers: server.headers }\n      : {}),\n    ...(server.auth ? { auth: server.auth } : {}),\n    ...(server.type === \"shttp\" && server.timeout !== undefined\n      ? { timeout: server.timeout }\n      : {}),\n    ...(server.enabled === false && { enabled: false }),\n  };\n}\n\nconst buildEnabledPatch = (\n  previous: MCPServer,\n  edited: MCPServerConfig,\n): MCPServerPatch => {\n  if (edited.enabled === false) return { enabled: false } as MCPServerPatch;\n  return getMcpServerEnabled(previous) === false\n    ? ({ enabled: true } as MCPServerPatch)\n    : {};\n};\n\nconst buildStringMapPatch = (\n  previous: Record<string, string> | null | undefined,\n  next: Record<string, string> | undefined,\n): Record<string, string | null> | null | undefined => {\n  if (!next) return previous ? null : undefined;\n\n  const patch: Record<string, string | null> = {};\n  for (const [key, value] of Object.entries(next)) {\n    if (value !== REDACTED_MCP_SECRET_VALUE) {\n      patch[key] = value;\n    }\n  }\n  for (const key of Object.keys(previous ?? {})) {\n    if (!(key in next)) patch[key] = null;\n  }\n  return Object.keys(patch).length > 0 ? patch : undefined;\n};\n\ntype OAuthCredential = Extract<MCPAuthCredential, { strategy: \"oauth2\" }>;\ntype OAuthCredentialPatch = Extract<\n  NonNullable<MCPServerPatch[\"auth\"]>,\n  { strategy: \"oauth2\" }\n>;\nconst OAUTH_EDITABLE_AUTHENTICATION_FIELDS = [\n  \"client_auth_method\",\n  \"scopes\",\n  \"client_id\",\n  \"client_secret\",\n] as const;\n\nconst buildRedactionSafeNestedPatch = (\n  previous: unknown,\n  next: unknown,\n): unknown | undefined => {\n  if (next === REDACTED_MCP_SECRET_VALUE || next === undefined) {\n    return undefined;\n  }\n  if (next === null) return null;\n  if (Array.isArray(next)) {\n    if (hasRedactedMcpSecretLeaf(next)) return undefined;\n    return JSON.stringify(previous) === JSON.stringify(next) ? undefined : next;\n  }\n  if (!isRecord(next)) {\n    return Object.is(previous, next) ? undefined : next;\n  }\n\n  const previousRecord = isRecord(previous) ? previous : {};\n  const patch: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(next)) {\n    const nestedPatch = buildRedactionSafeNestedPatch(\n      previousRecord[key],\n      value,\n    );\n    if (nestedPatch !== undefined) patch[key] = nestedPatch;\n  }\n  return Object.keys(patch).length > 0 ? patch : undefined;\n};\n\nconst buildOAuthAuthenticationPatch = (\n  previous: OAuthCredential[\"authentication\"],\n  edited: OAuthCredential[\"authentication\"],\n): OAuthCredentialPatch[\"authentication\"] | undefined => {\n  if (edited === undefined) return undefined;\n  if (edited === null) return null;\n\n  const nestedPatch = buildRedactionSafeNestedPatch(previous, edited);\n  const patch = isRecord(nestedPatch) ? { ...nestedPatch } : {};\n  const previousRecord = isRecord(previous) ? previous : {};\n  for (const key of OAUTH_EDITABLE_AUTHENTICATION_FIELDS) {\n    if (key in previousRecord && !(key in edited)) patch[key] = null;\n  }\n  if (Object.keys(patch).length === 0) return undefined;\n  return { type: \"oauth\", ...patch } as NonNullable<\n    OAuthCredentialPatch[\"authentication\"]\n  >;\n};\n\nconst withAuthStrategyReplacementDeletes = <T extends MCPAuthCredential>(\n  previous: MCPAuthCredential | null | undefined,\n  patch: T,\n): T => {\n  if (!previous || previous.strategy === patch.strategy) return patch;\n\n  const replacement = { ...patch } as Record<string, unknown>;\n  for (const key of Object.keys(previous)) {\n    if (key !== \"strategy\" && !(key in replacement)) {\n      replacement[key] = null;\n    }\n  }\n  return replacement as T;\n};\n\ntype HeaderAuthCredential = Extract<MCPAuthCredential, { strategy: \"header\" }>;\n\nexport const MCP_HEADER_REMOVAL_ERROR =\n  \"Removing an individual header from header authentication is not supported yet. Replace the credential or clear authentication, then re-enter the headers you want to keep.\";\n\nconst buildHeaderAuthCredentialPatch = (\n  previous: MCPAuthCredential | null | undefined,\n  edited: HeaderAuthCredential,\n): NonNullable<MCPServerPatch[\"auth\"]> | undefined => {\n  const previousHeaders =\n    previous?.strategy === \"header\" ? previous.headers : undefined;\n  const headersPatch = buildStringMapPatch(previousHeaders, edited.headers);\n  if (!headersPatch) return undefined;\n  if (Object.values(headersPatch).some((value) => value === null)) {\n    throw new Error(MCP_HEADER_REMOVAL_ERROR);\n  }\n  return {\n    strategy: \"header\",\n    headers: headersPatch as Record<string, string>,\n  };\n};\n\nconst buildOAuthCredentialPatch = (\n  previous: MCPAuthCredential | null | undefined,\n  edited: OAuthCredential,\n): OAuthCredentialPatch | undefined => {\n  const previousOAuth = previous?.strategy === \"oauth2\" ? previous : undefined;\n  const authentication = buildOAuthAuthenticationPatch(\n    previousOAuth?.authentication,\n    edited.authentication,\n  );\n  const state = buildRedactionSafeNestedPatch(\n    previousOAuth?.state,\n    edited.state,\n  );\n  if (previousOAuth && authentication === undefined && state === undefined) {\n    return undefined;\n  }\n  return withAuthStrategyReplacementDeletes(previous, {\n    strategy: \"oauth2\",\n    ...(authentication !== undefined && { authentication }),\n    ...(state !== undefined && { state }),\n  } as OAuthCredentialPatch);\n};\n\n/**\n * Build one sparse MCP server merge-patch from an editor result. Redacted\n * values are display-only and are never mutation inputs.\n */\n// @spec MCP-002 — Secret patches preserve user intent\nexport function buildMcpServerPatch(\n  previous: MCPServer,\n  edited: MCPServerConfig,\n): MCPServerPatch {\n  const enabled = buildEnabledPatch(previous, edited);\n  if (edited.type === \"stdio\") {\n    const env = buildStringMapPatch(\n      previous.transport === \"stdio\" ? previous.env : undefined,\n      edited.env,\n    );\n    return {\n      transport: \"stdio\",\n      command: edited.command!,\n      ...(edited.args?.length\n        ? { args: edited.args }\n        : previous.transport === \"stdio\" && previous.args\n          ? { args: null }\n          : {}),\n      ...(env !== undefined ? { env } : {}),\n      ...enabled,\n    };\n  }\n\n  const previousRemote = previous.transport === \"stdio\" ? undefined : previous;\n  const patch: MCPServerPatch = {\n    transport: edited.type === \"sse\" ? \"sse\" : \"http\",\n    url: edited.url!,\n    ...enabled,\n  };\n\n  if (edited.type === \"shttp\") {\n    if (edited.timeout !== undefined) patch.timeout = edited.timeout;\n    else if (previousRemote?.timeout !== undefined) patch.timeout = null;\n  }\n\n  if (edited.auth) {\n    if (edited.auth.strategy === \"oauth2\") {\n      const auth = buildOAuthCredentialPatch(previousRemote?.auth, edited.auth);\n      if (auth !== undefined) patch.auth = auth;\n    } else if (\n      edited.auth.strategy === \"header\" &&\n      previousRemote?.auth?.strategy === \"header\"\n    ) {\n      const auth = buildHeaderAuthCredentialPatch(\n        previousRemote.auth,\n        edited.auth,\n      );\n      if (auth !== undefined) patch.auth = auth;\n    } else if (!hasRedactedMcpSecretLeaf(edited.auth)) {\n      patch.auth = withAuthStrategyReplacementDeletes(\n        previousRemote?.auth,\n        edited.auth,\n      );\n    }\n  } else if (previousRemote?.auth) {\n    patch.auth = null;\n  }\n\n  return patch;\n}\n\nconst applyMcpServerPatch = (\n  previous: MCPServer,\n  patch: MCPServerPatch,\n): MCPServer => {\n  const apply = (base: unknown, next: unknown): Record<string, unknown> => {\n    const merged = isRecord(base) ? { ...base } : {};\n    if (!isRecord(next)) return merged;\n\n    for (const [key, value] of Object.entries(next)) {\n      if (value === null) {\n        delete merged[key];\n      } else if (isRecord(value)) {\n        merged[key] = apply(merged[key], value);\n      } else {\n        merged[key] = value;\n      }\n    }\n    return merged;\n  };\n\n  return apply(previous, patch) as MCPServer;\n};\n\nexport const MCP_RENAME_CREDENTIAL_ERROR =\n  \"Replace or clear the stored credential before renaming this MCP server.\";\n\n// @spec MCP-003 — Settings map keys are stable MCP identities\nexport function buildRenameMcpConfigPatch(\n  oldKey: string,\n  newKey: string,\n  previous: MCPServer,\n  edited: MCPServerConfig,\n): MCPConfigPatch {\n  const previousSecrets =\n    previous.transport === \"stdio\"\n      ? previous.env\n      : { auth: previous.auth, headers: previous.headers };\n  if (hasRedactedMcpSecretLeaf(previousSecrets)) {\n    throw new Error(MCP_RENAME_CREDENTIAL_ERROR);\n  }\n  const renamedServer = applyMcpServerPatch(\n    previous,\n    buildMcpServerPatch(previous, edited),\n  );\n  return {\n    [oldKey]: null,\n    [newKey]: renamedServer,\n  };\n}\n\nexport function allocateMcpSettingsKey(\n  config: MCPConfig,\n  preferredName: string | undefined,\n  fallback: \"sse\" | \"shttp\" | \"stdio\",\n): string {\n  const base = toMcpServerName(preferredName || fallback);\n  if (!(base in config)) return base;\n  let suffix = 1;\n  while (`${base}_${suffix}` in config) suffix += 1;\n  return `${base}_${suffix}`;\n}\n"],"mappings":";;;AAWA,IAAa,IAA4B,cAEnC,KAAY,MAChB,CAAC,CAAC,KAAS,OAAO,KAAU,YAAY,CAAC,MAAM,QAAQ,CAAK;AAE9D,SAAgB,EACd,GACgC;CAChC,IAAI,CAAC,EAAS,CAAK,GAAG,OAAO;CAE7B,IAAM,IAAa,EAAM;CASzB,OAPE,EAAS,CAAU,KACnB,EAAE,SAAS,MACX,EAAE,aAAa,KAER,IAGF;AACT;AAEA,SAAgB,EACd,GACoC;CACpC,IAAI,CAAC,EAAS,CAAK,GAAG;CACtB,IAAM,IAAU,OAAO,QAAQ,CAAK,EAAE,QACnC,MAAqC,OAAO,EAAM,MAAO,QAC5D;CACA,OAAO,EAAQ,SAAS,IAAI,OAAO,YAAY,CAAO,IAAI,KAAA;AAC5D;AAEA,SAAgB,EAAyB,GAAyB;CAMhE,OALI,MAAA,eAA4C,KAC5C,MAAM,QAAQ,CAAK,IAAU,EAAM,KAAK,CAAwB,IAChE,EAAS,CAAK,IACT,OAAO,OAAO,CAAK,EAAE,KAAK,CAAwB,IAEpD;AACT;AAIA,IAAa,KAAuB,MACjC,EAA6C,YAAY,KACtD,KACA,KAAA,GAEA,KACJ,MACuC;CACvC,IAAI,MAAU,WAAW,MAAU,SAAS,MAAU,mBACpD,OAAO;CAET,IAAI,MAAU,UAAU,MAAU,WAAW,MAAU,KAAA,GACrD,OAAO;AAGX;AAOA,SAAgB,EAAe,GAA2B;CACxD,IAAM,IAAY,EAAmB,CAAK;CAC1C,IAAI,CAAC,GAAW,OAAO,CAAC;CAExB,IAAM,IAAoB,CAAC;CAC3B,KAAK,IAAM,CAAC,GAAa,MAAc,OAAO,QAAQ,CAAS,GAAG;EAChE,IAAI,CAAC,EAAS,CAAS,GAAG;EAE1B,IAAI,OAAO,EAAU,WAAY,UAAU;GACzC,EAAO,KAAe;IACpB,WAAW;IACX,SAAS,EAAU;IACnB,GAAI,MAAM,QAAQ,EAAU,IAAI,KAC9B,EAAU,KAAK,OAAO,MAAQ,OAAO,KAAQ,QAAQ,KAAK,EACxD,MAAM,EAAU,KAClB;IACF,GAAI,EAAa,EAAU,GAAG,KAAK,EACjC,KAAK,EAAa,EAAU,GAAG,EACjC;IACA,GAAI,OAAO,EAAU,OAAQ,YAAY,EAAE,KAAK,EAAU,IAAI;IAC9D,GAAI,OAAO,EAAU,eAAgB,YAAY,EAC/C,aAAa,EAAU,YACzB;IACA,GAAI,OAAO,EAAU,QAAS,YAAY,EAAE,MAAM,EAAU,KAAK;IACjE,GAAI,OAAO,EAAU,WAAY,YAAY,EAC3C,SAAS,EAAU,QACrB;IACA,GAAI,EAAU,YAAY,MAAS,EAAE,SAAS,GAAM;GACtD;GACA;EACF;EAEA,IAAI,OAAO,EAAU,OAAQ,UAAU;EACvC,IAAM,IAAY,EAAmB,EAAU,SAAS;EACpD,CAAC,KAAa,MAAc,YAChC,EAAO,KAAe;GACpB;GACA,KAAK,EAAU;GACf,GAAI,EAAa,EAAU,OAAO,KAAK,EACrC,SAAS,EAAa,EAAU,OAAO,EACzC;GACA,GAAI,EAAoB,EAAU,IAAI,KAAK,EACzC,MAAM,EAAU,KAClB;GACA,GAAI,OAAO,EAAU,eAAgB,YAAY,EAC/C,aAAa,EAAU,YACzB;GACA,GAAI,OAAO,EAAU,QAAS,YAAY,EAAE,MAAM,EAAU,KAAK;GACjE,GAAI,OAAO,EAAU,WAAY,YAAY,EAC3C,SAAS,EAAU,QACrB;GACA,GAAI,OAAO,EAAU,oBAAqB,YAAY,EACpD,kBAAkB,EAAU,iBAC9B;GACA,GAAI,OAAO,EAAU,cAAe,aAAa,EAC/C,YAAY,EAAU,WACxB;GACA,GAAI,EAAU,YAAY,MAAS,EAAE,SAAS,GAAM;EACtD;CACF;CACA,OAAO;AACT;AAEA,SAAgB,EAAqB,GAAoC;CAavE,OAZI,EAAO,SAAS,UACX;EACL,WAAW;EACX,SAAS,EAAO;EAChB,GAAI,EAAO,MAAM,SAAS,EAAE,MAAM,EAAO,KAAK,IAAI,CAAC;EACnD,GAAI,EAAO,OAAO,OAAO,KAAK,EAAO,GAAG,EAAE,SAAS,IAC/C,EAAE,KAAK,EAAO,IAAI,IAClB,CAAC;EACL,GAAI,EAAO,YAAY,MAAS,EAAE,SAAS,GAAM;CACnD,IAGK;EACL,WAAW,EAAO,SAAS,QAAQ,QAAQ;EAC3C,KAAK,EAAO;EACZ,GAAI,EAAO,WAAW,OAAO,KAAK,EAAO,OAAO,EAAE,SAAS,IACvD,EAAE,SAAS,EAAO,QAAQ,IAC1B,CAAC;EACL,GAAI,EAAO,OAAO,EAAE,MAAM,EAAO,KAAK,IAAI,CAAC;EAC3C,GAAI,EAAO,SAAS,WAAW,EAAO,YAAY,KAAA,IAC9C,EAAE,SAAS,EAAO,QAAQ,IAC1B,CAAC;EACL,GAAI,EAAO,YAAY,MAAS,EAAE,SAAS,GAAM;CACnD;AACF;AAEA,IAAM,KACJ,GACA,MAEI,EAAO,YAAY,KAAc,EAAE,SAAS,GAAM,IAC/C,EAAoB,CAAQ,MAAM,KACpC,EAAE,SAAS,GAAK,IACjB,CAAC,GAGD,KACJ,GACA,MACqD;CACrD,IAAI,CAAC,GAAM,OAAO,IAAW,OAAO,KAAA;CAEpC,IAAM,IAAuC,CAAC;CAC9C,KAAK,IAAM,CAAC,GAAK,MAAU,OAAO,QAAQ,CAAI,GAC5C,AAAI,MAAA,iBACF,EAAM,KAAO;CAGjB,KAAK,IAAM,KAAO,OAAO,KAAK,KAAY,CAAC,CAAC,GAC1C,AAAM,KAAO,MAAO,EAAM,KAAO;CAEnC,OAAO,OAAO,KAAK,CAAK,EAAE,SAAS,IAAI,IAAQ,KAAA;AACjD,GAOM,IAAuC;CAC3C;CACA;CACA;CACA;AACF,GAEM,KACJ,GACA,MACwB;CACxB,IAAI,MAAA,gBAAsC,MAAS,KAAA,GACjD;CAEF,IAAI,MAAS,MAAM,OAAO;CAC1B,IAAI,MAAM,QAAQ,CAAI,GAEpB,OADI,EAAyB,CAAI,KAC1B,KAAK,UAAU,CAAQ,MAAM,KAAK,UAAU,CAAI,IADnB,SACmC;CAEzE,IAAI,CAAC,EAAS,CAAI,GAChB,OAAO,OAAO,GAAG,GAAU,CAAI,IAAI,KAAA,IAAY;CAGjD,IAAM,IAAiB,EAAS,CAAQ,IAAI,IAAW,CAAC,GAClD,IAAiC,CAAC;CACxC,KAAK,IAAM,CAAC,GAAK,MAAU,OAAO,QAAQ,CAAI,GAAG;EAC/C,IAAM,IAAc,EAClB,EAAe,IACf,CACF;EACA,AAAI,MAAgB,KAAA,MAAW,EAAM,KAAO;CAC9C;CACA,OAAO,OAAO,KAAK,CAAK,EAAE,SAAS,IAAI,IAAQ,KAAA;AACjD,GAEM,KACJ,GACA,MACuD;CACvD,IAAI,MAAW,KAAA,GAAW;CAC1B,IAAI,MAAW,MAAM,OAAO;CAE5B,IAAM,IAAc,EAA8B,GAAU,CAAM,GAC5D,IAAQ,EAAS,CAAW,IAAI,EAAE,GAAG,EAAY,IAAI,CAAC,GACtD,IAAiB,EAAS,CAAQ,IAAI,IAAW,CAAC;CACxD,KAAK,IAAM,KAAO,GAChB,AAAI,KAAO,KAAkB,EAAE,KAAO,OAAS,EAAM,KAAO;CAE1D,WAAO,KAAK,CAAK,EAAE,WAAW,GAClC,OAAO;EAAE,MAAM;EAAS,GAAG;CAAM;AAGnC,GAEM,KACJ,GACA,MACM;CACN,IAAI,CAAC,KAAY,EAAS,aAAa,EAAM,UAAU,OAAO;CAE9D,IAAM,IAAc,EAAE,GAAG,EAAM;CAC/B,KAAK,IAAM,KAAO,OAAO,KAAK,CAAQ,GACpC,AAAI,MAAQ,cAAc,EAAE,KAAO,OACjC,EAAY,KAAO;CAGvB,OAAO;AACT,GAIa,IACX,8KAEI,KACJ,GACA,MACoD;CAGpD,IAAM,IAAe,EADnB,GAAU,aAAa,WAAW,EAAS,UAAU,KAAA,GACG,EAAO,OAAO;CACnE,OACL;MAAI,OAAO,OAAO,CAAY,EAAE,MAAM,MAAU,MAAU,IAAI,GAC5D,MAAU,MAAM,CAAwB;EAE1C,OAAO;GACL,UAAU;GACV,SAAS;EACX;CAL0C;AAM5C,GAEM,KACJ,GACA,MACqC;CACrC,IAAM,IAAgB,GAAU,aAAa,WAAW,IAAW,KAAA,GAC7D,IAAiB,EACrB,GAAe,gBACf,EAAO,cACT,GACM,IAAQ,EACZ,GAAe,OACf,EAAO,KACT;CACI,WAAiB,MAAmB,KAAA,KAAa,MAAU,KAAA,IAG/D,OAAO,EAAmC,GAAU;EAClD,UAAU;EACV,GAAI,MAAmB,KAAA,KAAa,EAAE,kBAAe;EACrD,GAAI,MAAU,KAAA,KAAa,EAAE,SAAM;CACrC,CAAyB;AAC3B;AAOA,SAAgB,EACd,GACA,GACgB;CAChB,IAAM,IAAU,EAAkB,GAAU,CAAM;CAClD,IAAI,EAAO,SAAS,SAAS;EAC3B,IAAM,IAAM,EACV,EAAS,cAAc,UAAU,EAAS,MAAM,KAAA,GAChD,EAAO,GACT;EACA,OAAO;GACL,WAAW;GACX,SAAS,EAAO;GAChB,GAAI,EAAO,MAAM,SACb,EAAE,MAAM,EAAO,KAAK,IACpB,EAAS,cAAc,WAAW,EAAS,OACzC,EAAE,MAAM,KAAK,IACb,CAAC;GACP,GAAI,MAAQ,KAAA,IAAsB,CAAC,IAAX,EAAE,OAAI;GAC9B,GAAG;EACL;CACF;CAEA,IAAM,IAAiB,EAAS,cAAc,UAAU,KAAA,IAAY,GAC9D,IAAwB;EAC5B,WAAW,EAAO,SAAS,QAAQ,QAAQ;EAC3C,KAAK,EAAO;EACZ,GAAG;CACL;CAOA,IALI,EAAO,SAAS,YACd,EAAO,YAAY,KAAA,IACd,GAAgB,YAAY,KAAA,MAAW,EAAM,UAAU,QAD9B,EAAM,UAAU,EAAO,UAIvD,EAAO,UACL,EAAO,KAAK,aAAa,UAAU;EACrC,IAAM,IAAO,EAA0B,GAAgB,MAAM,EAAO,IAAI;EACxE,AAAI,MAAS,KAAA,MAAW,EAAM,OAAO;CACvC,OAAO,IACL,EAAO,KAAK,aAAa,YACzB,GAAgB,MAAM,aAAa,UACnC;EACA,IAAM,IAAO,EACX,EAAe,MACf,EAAO,IACT;EACA,AAAI,MAAS,KAAA,MAAW,EAAM,OAAO;CACvC,OAAO,AAAK,EAAyB,EAAO,IAAI,MAC9C,EAAM,OAAO,EACX,GAAgB,MAChB,EAAO,IACT;MAEG,AAAI,GAAgB,SACzB,EAAM,OAAO;CAGf,OAAO;AACT;AAEA,IAAM,KACJ,GACA,MACc;CACd,IAAM,KAAS,GAAe,MAA2C;EACvE,IAAM,IAAS,EAAS,CAAI,IAAI,EAAE,GAAG,EAAK,IAAI,CAAC;EAC/C,IAAI,CAAC,EAAS,CAAI,GAAG,OAAO;EAE5B,KAAK,IAAM,CAAC,GAAK,MAAU,OAAO,QAAQ,CAAI,GAC5C,AAAI,MAAU,OACZ,OAAO,EAAO,KACL,EAAS,CAAK,IACvB,EAAO,KAAO,EAAM,EAAO,IAAM,CAAK,IAEtC,EAAO,KAAO;EAGlB,OAAO;CACT;CAEA,OAAO,EAAM,GAAU,CAAK;AAC9B,GAEa,IACX;AAGF,SAAgB,EACd,GACA,GACA,GACA,GACgB;CAKhB,IAAI,EAHF,EAAS,cAAc,UACnB,EAAS,MACT;EAAE,MAAM,EAAS;EAAM,SAAS,EAAS;CAAQ,CACX,GAC1C,MAAU,MAAM,CAA2B;CAE7C,IAAM,IAAgB,EACpB,GACA,EAAoB,GAAU,CAAM,CACtC;CACA,OAAO;GACJ,IAAS;GACT,IAAS;CACZ;AACF;AAEA,SAAgB,EACd,GACA,GACA,GACQ;CACR,IAAM,IAAO,EAAgB,KAAiB,CAAQ;CACtD,IAAI,EAAE,KAAQ,IAAS,OAAO;CAC9B,IAAI,IAAS;CACb,OAAO,GAAG,EAAK,GAAG,OAAY,IAAQ,KAAU;CAChD,OAAO,GAAG,EAAK,GAAG;AACpB"}

package/dist/utils/mcp-installed-servers.cjs

@@ -1,2 +1,2 @@
-require("../_virtual/_rolldown/runtime.cjs");function e(e){return[...e.sse_servers.map((e,t)=>({id:`sse-${t}`,type:`sse`,name:typeof e==`object`?e.name:void 0,url:typeof e==`string`?e:e.url,headers:typeof e==`object`?e.headers:void 0,auth:typeof e==`object`?e.auth:void 0,enabled:typeof e==`object`?e.enabled:void 0})),...e.stdio_servers.map((e,t)=>({id:`stdio-${t}`,type:`stdio`,name:e.name,command:e.command,args:e.args,env:e.env,enabled:e.enabled})),...e.shttp_servers.map((e,t)=>({id:`shttp-${t}`,type:`shttp`,name:typeof e==`object`?e.name:void 0,url:typeof e==`string`?e:e.url,headers:typeof e==`object`?e.headers:void 0,timeout:typeof e==`object`?e.timeout:void 0,auth:typeof e==`object`?e.auth:void 0,enabled:typeof e==`object`?e.enabled:void 0}))]}exports.flattenMcpConfig=e;
+require("../_virtual/_rolldown/runtime.cjs");const e=require("./mcp-config.cjs");function t(t){return Object.entries(t).map(([t,n])=>n.transport===`stdio`?{id:t,type:`stdio`,name:t,command:n.command,args:n.args??void 0,env:n.env??void 0,enabled:e.getMcpServerEnabled(n)}:{id:t,type:n.transport===`sse`?`sse`:`shttp`,name:t,url:n.url,headers:n.headers??void 0,timeout:n.timeout??void 0,auth:n.auth??void 0,enabled:e.getMcpServerEnabled(n)})}exports.flattenMcpConfig=t;
 //# sourceMappingURL=mcp-installed-servers.cjs.map

package/dist/utils/mcp-installed-servers.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-installed-servers.cjs","names":[],"sources":["../../src/utils/mcp-installed-servers.ts"],"sourcesContent":["import { MCPServerConfig } from \"#/types/mcp-server\";\nimport { MCPConfig } from \"#/types/settings\";\n\nexport function flattenMcpConfig(config: MCPConfig): MCPServerConfig[] {\n  return [\n    ...config.sse_servers.map((server, index) => ({\n      id: `sse-${index}`,\n      type: \"sse\" as const,\n      name: typeof server === \"object\" ? server.name : undefined,\n      url: typeof server === \"string\" ? server : server.url,\n      headers: typeof server === \"object\" ? server.headers : undefined,\n      auth: typeof server === \"object\" ? server.auth : undefined,\n      enabled: typeof server === \"object\" ? server.enabled : undefined,\n    })),\n    ...config.stdio_servers.map((server, index) => ({\n      id: `stdio-${index}`,\n      type: \"stdio\" as const,\n      name: server.name,\n      command: server.command,\n      args: server.args,\n      env: server.env,\n      enabled: server.enabled,\n    })),\n    ...config.shttp_servers.map((server, index) => ({\n      id: `shttp-${index}`,\n      type: \"shttp\" as const,\n      name: typeof server === \"object\" ? server.name : undefined,\n      url: typeof server === \"string\" ? server : server.url,\n      headers: typeof server === \"object\" ? server.headers : undefined,\n      timeout: typeof server === \"object\" ? server.timeout : undefined,\n      auth: typeof server === \"object\" ? server.auth : undefined,\n      enabled: typeof server === \"object\" ? server.enabled : undefined,\n    })),\n  ];\n}\n"],"mappings":"6CAGA,SAAgB,EAAiB,EAAsC,CACrE,MAAO,CACL,GAAG,EAAO,YAAY,KAAK,EAAQ,KAAW,CAC5C,GAAI,OAAO,IACX,KAAM,MACN,KAAM,OAAO,GAAW,SAAW,EAAO,KAAO,IAAA,GACjD,IAAK,OAAO,GAAW,SAAW,EAAS,EAAO,IAClD,QAAS,OAAO,GAAW,SAAW,EAAO,QAAU,IAAA,GACvD,KAAM,OAAO,GAAW,SAAW,EAAO,KAAO,IAAA,GACjD,QAAS,OAAO,GAAW,SAAW,EAAO,QAAU,IAAA,EACzD,EAAE,EACF,GAAG,EAAO,cAAc,KAAK,EAAQ,KAAW,CAC9C,GAAI,SAAS,IACb,KAAM,QACN,KAAM,EAAO,KACb,QAAS,EAAO,QAChB,KAAM,EAAO,KACb,IAAK,EAAO,IACZ,QAAS,EAAO,OAClB,EAAE,EACF,GAAG,EAAO,cAAc,KAAK,EAAQ,KAAW,CAC9C,GAAI,SAAS,IACb,KAAM,QACN,KAAM,OAAO,GAAW,SAAW,EAAO,KAAO,IAAA,GACjD,IAAK,OAAO,GAAW,SAAW,EAAS,EAAO,IAClD,QAAS,OAAO,GAAW,SAAW,EAAO,QAAU,IAAA,GACvD,QAAS,OAAO,GAAW,SAAW,EAAO,QAAU,IAAA,GACvD,KAAM,OAAO,GAAW,SAAW,EAAO,KAAO,IAAA,GACjD,QAAS,OAAO,GAAW,SAAW,EAAO,QAAU,IAAA,EACzD,EAAE,CACJ,CACF"}
+{"version":3,"file":"mcp-installed-servers.cjs","names":[],"sources":["../../src/utils/mcp-installed-servers.ts"],"sourcesContent":["import type { MCPConfig } from \"@openhands/typescript-client\";\nimport type { MCPServerConfig } from \"#/types/mcp-server\";\nimport { getMcpServerEnabled } from \"./mcp-config\";\n\nexport function flattenMcpConfig(config: MCPConfig): MCPServerConfig[] {\n  return Object.entries(config).map(([settingsKey, server]) =>\n    server.transport === \"stdio\"\n      ? {\n          id: settingsKey,\n          type: \"stdio\",\n          name: settingsKey,\n          command: server.command,\n          args: server.args ?? undefined,\n          env: server.env ?? undefined,\n          enabled: getMcpServerEnabled(server),\n        }\n      : {\n          id: settingsKey,\n          type: server.transport === \"sse\" ? \"sse\" : \"shttp\",\n          name: settingsKey,\n          url: server.url,\n          headers: server.headers ?? undefined,\n          timeout: server.timeout ?? undefined,\n          auth: server.auth ?? undefined,\n          enabled: getMcpServerEnabled(server),\n        },\n  );\n}\n"],"mappings":"iFAIA,SAAgB,EAAiB,EAAsC,CACrE,OAAO,OAAO,QAAQ,CAAM,EAAE,KAAK,CAAC,EAAa,KAC/C,EAAO,YAAc,QACjB,CACE,GAAI,EACJ,KAAM,QACN,KAAM,EACN,QAAS,EAAO,QAChB,KAAM,EAAO,MAAQ,IAAA,GACrB,IAAK,EAAO,KAAO,IAAA,GACnB,QAAS,EAAA,oBAAoB,CAAM,CACrC,EACA,CACE,GAAI,EACJ,KAAM,EAAO,YAAc,MAAQ,MAAQ,QAC3C,KAAM,EACN,IAAK,EAAO,IACZ,QAAS,EAAO,SAAW,IAAA,GAC3B,QAAS,EAAO,SAAW,IAAA,GAC3B,KAAM,EAAO,MAAQ,IAAA,GACrB,QAAS,EAAA,oBAAoB,CAAM,CACrC,CACN,CACF"}

package/dist/utils/mcp-installed-servers.d.ts

@@ -1,3 +1,3 @@
-import { MCPServerConfig } from "#/types/mcp-server";
-import { MCPConfig } from "#/types/settings";
+import type { MCPConfig } from "@openhands/typescript-client";
+import type { MCPServerConfig } from "#/types/mcp-server";
 export declare function flattenMcpConfig(config: MCPConfig): MCPServerConfig[];

package/dist/utils/mcp-installed-servers.js

@@ -1,37 +1,26 @@
+import { getMcpServerEnabled as e } from "./mcp-config.js";
 //#region src/utils/mcp-installed-servers.ts
-function e(e) {
-	return [
-		...e.sse_servers.map((e, t) => ({
-			id: `sse-${t}`,
-			type: "sse",
-			name: typeof e == "object" ? e.name : void 0,
-			url: typeof e == "string" ? e : e.url,
-			headers: typeof e == "object" ? e.headers : void 0,
-			auth: typeof e == "object" ? e.auth : void 0,
-			enabled: typeof e == "object" ? e.enabled : void 0
-		})),
-		...e.stdio_servers.map((e, t) => ({
-			id: `stdio-${t}`,
-			type: "stdio",
-			name: e.name,
-			command: e.command,
-			args: e.args,
-			env: e.env,
-			enabled: e.enabled
-		})),
-		...e.shttp_servers.map((e, t) => ({
-			id: `shttp-${t}`,
-			type: "shttp",
-			name: typeof e == "object" ? e.name : void 0,
-			url: typeof e == "string" ? e : e.url,
-			headers: typeof e == "object" ? e.headers : void 0,
-			timeout: typeof e == "object" ? e.timeout : void 0,
-			auth: typeof e == "object" ? e.auth : void 0,
-			enabled: typeof e == "object" ? e.enabled : void 0
-		}))
-	];
+function t(t) {
+	return Object.entries(t).map(([t, n]) => n.transport === "stdio" ? {
+		id: t,
+		type: "stdio",
+		name: t,
+		command: n.command,
+		args: n.args ?? void 0,
+		env: n.env ?? void 0,
+		enabled: e(n)
+	} : {
+		id: t,
+		type: n.transport === "sse" ? "sse" : "shttp",
+		name: t,
+		url: n.url,
+		headers: n.headers ?? void 0,
+		timeout: n.timeout ?? void 0,
+		auth: n.auth ?? void 0,
+		enabled: e(n)
+	});
 }
 //#endregion
-export { e as flattenMcpConfig };
+export { t as flattenMcpConfig };
 
 //# sourceMappingURL=mcp-installed-servers.js.map

package/dist/utils/mcp-installed-servers.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-installed-servers.js","names":[],"sources":["../../src/utils/mcp-installed-servers.ts"],"sourcesContent":["import { MCPServerConfig } from \"#/types/mcp-server\";\nimport { MCPConfig } from \"#/types/settings\";\n\nexport function flattenMcpConfig(config: MCPConfig): MCPServerConfig[] {\n  return [\n    ...config.sse_servers.map((server, index) => ({\n      id: `sse-${index}`,\n      type: \"sse\" as const,\n      name: typeof server === \"object\" ? server.name : undefined,\n      url: typeof server === \"string\" ? server : server.url,\n      headers: typeof server === \"object\" ? server.headers : undefined,\n      auth: typeof server === \"object\" ? server.auth : undefined,\n      enabled: typeof server === \"object\" ? server.enabled : undefined,\n    })),\n    ...config.stdio_servers.map((server, index) => ({\n      id: `stdio-${index}`,\n      type: \"stdio\" as const,\n      name: server.name,\n      command: server.command,\n      args: server.args,\n      env: server.env,\n      enabled: server.enabled,\n    })),\n    ...config.shttp_servers.map((server, index) => ({\n      id: `shttp-${index}`,\n      type: \"shttp\" as const,\n      name: typeof server === \"object\" ? server.name : undefined,\n      url: typeof server === \"string\" ? server : server.url,\n      headers: typeof server === \"object\" ? server.headers : undefined,\n      timeout: typeof server === \"object\" ? server.timeout : undefined,\n      auth: typeof server === \"object\" ? server.auth : undefined,\n      enabled: typeof server === \"object\" ? server.enabled : undefined,\n    })),\n  ];\n}\n"],"mappings":";AAGA,SAAgB,EAAiB,GAAsC;CACrE,OAAO;EACL,GAAG,EAAO,YAAY,KAAK,GAAQ,OAAW;GAC5C,IAAI,OAAO;GACX,MAAM;GACN,MAAM,OAAO,KAAW,WAAW,EAAO,OAAO,KAAA;GACjD,KAAK,OAAO,KAAW,WAAW,IAAS,EAAO;GAClD,SAAS,OAAO,KAAW,WAAW,EAAO,UAAU,KAAA;GACvD,MAAM,OAAO,KAAW,WAAW,EAAO,OAAO,KAAA;GACjD,SAAS,OAAO,KAAW,WAAW,EAAO,UAAU,KAAA;EACzD,EAAE;EACF,GAAG,EAAO,cAAc,KAAK,GAAQ,OAAW;GAC9C,IAAI,SAAS;GACb,MAAM;GACN,MAAM,EAAO;GACb,SAAS,EAAO;GAChB,MAAM,EAAO;GACb,KAAK,EAAO;GACZ,SAAS,EAAO;EAClB,EAAE;EACF,GAAG,EAAO,cAAc,KAAK,GAAQ,OAAW;GAC9C,IAAI,SAAS;GACb,MAAM;GACN,MAAM,OAAO,KAAW,WAAW,EAAO,OAAO,KAAA;GACjD,KAAK,OAAO,KAAW,WAAW,IAAS,EAAO;GAClD,SAAS,OAAO,KAAW,WAAW,EAAO,UAAU,KAAA;GACvD,SAAS,OAAO,KAAW,WAAW,EAAO,UAAU,KAAA;GACvD,MAAM,OAAO,KAAW,WAAW,EAAO,OAAO,KAAA;GACjD,SAAS,OAAO,KAAW,WAAW,EAAO,UAAU,KAAA;EACzD,EAAE;CACJ;AACF"}
+{"version":3,"file":"mcp-installed-servers.js","names":[],"sources":["../../src/utils/mcp-installed-servers.ts"],"sourcesContent":["import type { MCPConfig } from \"@openhands/typescript-client\";\nimport type { MCPServerConfig } from \"#/types/mcp-server\";\nimport { getMcpServerEnabled } from \"./mcp-config\";\n\nexport function flattenMcpConfig(config: MCPConfig): MCPServerConfig[] {\n  return Object.entries(config).map(([settingsKey, server]) =>\n    server.transport === \"stdio\"\n      ? {\n          id: settingsKey,\n          type: \"stdio\",\n          name: settingsKey,\n          command: server.command,\n          args: server.args ?? undefined,\n          env: server.env ?? undefined,\n          enabled: getMcpServerEnabled(server),\n        }\n      : {\n          id: settingsKey,\n          type: server.transport === \"sse\" ? \"sse\" : \"shttp\",\n          name: settingsKey,\n          url: server.url,\n          headers: server.headers ?? undefined,\n          timeout: server.timeout ?? undefined,\n          auth: server.auth ?? undefined,\n          enabled: getMcpServerEnabled(server),\n        },\n  );\n}\n"],"mappings":";;AAIA,SAAgB,EAAiB,GAAsC;CACrE,OAAO,OAAO,QAAQ,CAAM,EAAE,KAAK,CAAC,GAAa,OAC/C,EAAO,cAAc,UACjB;EACE,IAAI;EACJ,MAAM;EACN,MAAM;EACN,SAAS,EAAO;EAChB,MAAM,EAAO,QAAQ,KAAA;EACrB,KAAK,EAAO,OAAO,KAAA;EACnB,SAAS,EAAoB,CAAM;CACrC,IACA;EACE,IAAI;EACJ,MAAM,EAAO,cAAc,QAAQ,QAAQ;EAC3C,MAAM;EACN,KAAK,EAAO;EACZ,SAAS,EAAO,WAAW,KAAA;EAC3B,SAAS,EAAO,WAAW,KAAA;EAC3B,MAAM,EAAO,QAAQ,KAAA;EACrB,SAAS,EAAoB,CAAM;CACrC,CACN;AACF"}

package/dist/utils/mcp-server-health-key.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-server-health-key.cjs","names":[],"sources":["../../src/utils/mcp-server-health-key.ts"],"sourcesContent":["import type { MCPServerConfig } from \"#/types/mcp-server\";\n\nconst sortedKeys = (record?: Record<string, string> | null): string[] =>\n  Object.keys(record ?? {}).sort();\n\n/**\n * Stable identity for a server's health entry.\n *\n * Built from the server's structural, non-secret fields. Names are included\n * because persisted configs are keyed by name (`toSdkMcpConfig` suffixes\n * duplicates `github` → `github_1`), which makes the key unique per stored\n * server and stable across list reordering — unlike the positional\n * `sse-0`/`stdio-1` ids from `flattenMcpConfig`. Secret VALUES are excluded:\n * the same credential legitimately appears as plaintext at install time,\n * `**********` in redacted settings, and ciphertext in test requests, so any\n * of them would make the key flap. A structural edit (URL, command, header\n * names, auth strategy, ...) therefore produces a new key, orphaning the old\n * health entry instead of misattributing it.\n */\nexport function getMcpServerHealthKey(server: MCPServerConfig): string {\n  if (server.type === \"stdio\") {\n    return JSON.stringify({\n      type: server.type,\n      name: server.name ?? \"\",\n      command: server.command ?? \"\",\n      args: server.args ?? [],\n      envKeys: sortedKeys(server.env),\n    });\n  }\n  return JSON.stringify({\n    type: server.type,\n    name: server.name ?? \"\",\n    url: server.url ?? \"\",\n    headerKeys: sortedKeys(server.headers),\n    authStrategy: server.auth?.strategy ?? \"\",\n    authHeaderName:\n      server.auth?.strategy === \"api_key\"\n        ? (server.auth.header_name ?? \"\")\n        : \"\",\n    authHeaderKeys:\n      server.auth?.strategy === \"header\" ? sortedKeys(server.auth.headers) : [],\n  });\n}\n"],"mappings":"6CAEA,IAAM,EAAc,GAClB,OAAO,KAAK,GAAU,CAAC,CAAC,EAAE,KAAK,EAgBjC,SAAgB,EAAsB,EAAiC,CAUrE,OATI,EAAO,OAAS,QACX,KAAK,UAAU,CACpB,KAAM,EAAO,KACb,KAAM,EAAO,MAAQ,GACrB,QAAS,EAAO,SAAW,GAC3B,KAAM,EAAO,MAAQ,CAAC,EACtB,QAAS,EAAW,EAAO,GAAG,CAChC,CAAC,EAEI,KAAK,UAAU,CACpB,KAAM,EAAO,KACb,KAAM,EAAO,MAAQ,GACrB,IAAK,EAAO,KAAO,GACnB,WAAY,EAAW,EAAO,OAAO,EACrC,aAAc,EAAO,MAAM,UAAY,GACvC,eACE,EAAO,MAAM,WAAa,UACrB,EAAO,KAAK,aAAe,GAC5B,GACN,eACE,EAAO,MAAM,WAAa,SAAW,EAAW,EAAO,KAAK,OAAO,EAAI,CAAC,CAC5E,CAAC,CACH"}
+{"version":3,"file":"mcp-server-health-key.cjs","names":[],"sources":["../../src/utils/mcp-server-health-key.ts"],"sourcesContent":["import type { MCPServerConfig } from \"#/types/mcp-server\";\n\nconst sortedKeys = (record?: Record<string, string> | null): string[] =>\n  Object.keys(record ?? {}).sort();\n\n/**\n * Stable identity for a server's health entry.\n *\n * Built from the server's structural, non-secret fields. Names are included\n * because persisted configs are keyed by name, which makes the key unique per\n * stored server and stable across list reordering. Secret VALUES are excluded:\n * the same credential legitimately appears as plaintext at install time,\n * `**********` in redacted settings, and ciphertext in test requests, so any\n * of them would make the key flap. A structural edit (URL, command, header\n * names, auth strategy, ...) therefore produces a new key, orphaning the old\n * health entry instead of misattributing it.\n */\nexport function getMcpServerHealthKey(server: MCPServerConfig): string {\n  if (server.type === \"stdio\") {\n    return JSON.stringify({\n      type: server.type,\n      name: server.name ?? \"\",\n      command: server.command ?? \"\",\n      args: server.args ?? [],\n      envKeys: sortedKeys(server.env),\n    });\n  }\n  return JSON.stringify({\n    type: server.type,\n    name: server.name ?? \"\",\n    url: server.url ?? \"\",\n    headerKeys: sortedKeys(server.headers),\n    authStrategy: server.auth?.strategy ?? \"\",\n    authHeaderName:\n      server.auth?.strategy === \"api_key\"\n        ? (server.auth.header_name ?? \"\")\n        : \"\",\n    authHeaderKeys:\n      server.auth?.strategy === \"header\" ? sortedKeys(server.auth.headers) : [],\n  });\n}\n"],"mappings":"6CAEA,IAAM,EAAc,GAClB,OAAO,KAAK,GAAU,CAAC,CAAC,EAAE,KAAK,EAcjC,SAAgB,EAAsB,EAAiC,CAUrE,OATI,EAAO,OAAS,QACX,KAAK,UAAU,CACpB,KAAM,EAAO,KACb,KAAM,EAAO,MAAQ,GACrB,QAAS,EAAO,SAAW,GAC3B,KAAM,EAAO,MAAQ,CAAC,EACtB,QAAS,EAAW,EAAO,GAAG,CAChC,CAAC,EAEI,KAAK,UAAU,CACpB,KAAM,EAAO,KACb,KAAM,EAAO,MAAQ,GACrB,IAAK,EAAO,KAAO,GACnB,WAAY,EAAW,EAAO,OAAO,EACrC,aAAc,EAAO,MAAM,UAAY,GACvC,eACE,EAAO,MAAM,WAAa,UACrB,EAAO,KAAK,aAAe,GAC5B,GACN,eACE,EAAO,MAAM,WAAa,SAAW,EAAW,EAAO,KAAK,OAAO,EAAI,CAAC,CAC5E,CAAC,CACH"}

package/dist/utils/mcp-server-health-key.d.ts

@@ -3,10 +3,8 @@ import type { MCPServerConfig } from "#/types/mcp-server";
  * Stable identity for a server's health entry.
  *
  * Built from the server's structural, non-secret fields. Names are included
- * because persisted configs are keyed by name (`toSdkMcpConfig` suffixes
- * duplicates `github` → `github_1`), which makes the key unique per stored
- * server and stable across list reordering — unlike the positional
- * `sse-0`/`stdio-1` ids from `flattenMcpConfig`. Secret VALUES are excluded:
+ * because persisted configs are keyed by name, which makes the key unique per
+ * stored server and stable across list reordering. Secret VALUES are excluded:
  * the same credential legitimately appears as plaintext at install time,
  * `**********` in redacted settings, and ciphertext in test requests, so any
  * of them would make the key flap. A structural edit (URL, command, header

package/dist/utils/mcp-server-health-key.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-server-health-key.js","names":[],"sources":["../../src/utils/mcp-server-health-key.ts"],"sourcesContent":["import type { MCPServerConfig } from \"#/types/mcp-server\";\n\nconst sortedKeys = (record?: Record<string, string> | null): string[] =>\n  Object.keys(record ?? {}).sort();\n\n/**\n * Stable identity for a server's health entry.\n *\n * Built from the server's structural, non-secret fields. Names are included\n * because persisted configs are keyed by name (`toSdkMcpConfig` suffixes\n * duplicates `github` → `github_1`), which makes the key unique per stored\n * server and stable across list reordering — unlike the positional\n * `sse-0`/`stdio-1` ids from `flattenMcpConfig`. Secret VALUES are excluded:\n * the same credential legitimately appears as plaintext at install time,\n * `**********` in redacted settings, and ciphertext in test requests, so any\n * of them would make the key flap. A structural edit (URL, command, header\n * names, auth strategy, ...) therefore produces a new key, orphaning the old\n * health entry instead of misattributing it.\n */\nexport function getMcpServerHealthKey(server: MCPServerConfig): string {\n  if (server.type === \"stdio\") {\n    return JSON.stringify({\n      type: server.type,\n      name: server.name ?? \"\",\n      command: server.command ?? \"\",\n      args: server.args ?? [],\n      envKeys: sortedKeys(server.env),\n    });\n  }\n  return JSON.stringify({\n    type: server.type,\n    name: server.name ?? \"\",\n    url: server.url ?? \"\",\n    headerKeys: sortedKeys(server.headers),\n    authStrategy: server.auth?.strategy ?? \"\",\n    authHeaderName:\n      server.auth?.strategy === \"api_key\"\n        ? (server.auth.header_name ?? \"\")\n        : \"\",\n    authHeaderKeys:\n      server.auth?.strategy === \"header\" ? sortedKeys(server.auth.headers) : [],\n  });\n}\n"],"mappings":";AAEA,IAAM,KAAc,MAClB,OAAO,KAAK,KAAU,CAAC,CAAC,EAAE,KAAK;AAgBjC,SAAgB,EAAsB,GAAiC;CAUrE,OATI,EAAO,SAAS,UACX,KAAK,UAAU;EACpB,MAAM,EAAO;EACb,MAAM,EAAO,QAAQ;EACrB,SAAS,EAAO,WAAW;EAC3B,MAAM,EAAO,QAAQ,CAAC;EACtB,SAAS,EAAW,EAAO,GAAG;CAChC,CAAC,IAEI,KAAK,UAAU;EACpB,MAAM,EAAO;EACb,MAAM,EAAO,QAAQ;EACrB,KAAK,EAAO,OAAO;EACnB,YAAY,EAAW,EAAO,OAAO;EACrC,cAAc,EAAO,MAAM,YAAY;EACvC,gBACE,EAAO,MAAM,aAAa,YACrB,EAAO,KAAK,eAAe,KAC5B;EACN,gBACE,EAAO,MAAM,aAAa,WAAW,EAAW,EAAO,KAAK,OAAO,IAAI,CAAC;CAC5E,CAAC;AACH"}
+{"version":3,"file":"mcp-server-health-key.js","names":[],"sources":["../../src/utils/mcp-server-health-key.ts"],"sourcesContent":["import type { MCPServerConfig } from \"#/types/mcp-server\";\n\nconst sortedKeys = (record?: Record<string, string> | null): string[] =>\n  Object.keys(record ?? {}).sort();\n\n/**\n * Stable identity for a server's health entry.\n *\n * Built from the server's structural, non-secret fields. Names are included\n * because persisted configs are keyed by name, which makes the key unique per\n * stored server and stable across list reordering. Secret VALUES are excluded:\n * the same credential legitimately appears as plaintext at install time,\n * `**********` in redacted settings, and ciphertext in test requests, so any\n * of them would make the key flap. A structural edit (URL, command, header\n * names, auth strategy, ...) therefore produces a new key, orphaning the old\n * health entry instead of misattributing it.\n */\nexport function getMcpServerHealthKey(server: MCPServerConfig): string {\n  if (server.type === \"stdio\") {\n    return JSON.stringify({\n      type: server.type,\n      name: server.name ?? \"\",\n      command: server.command ?? \"\",\n      args: server.args ?? [],\n      envKeys: sortedKeys(server.env),\n    });\n  }\n  return JSON.stringify({\n    type: server.type,\n    name: server.name ?? \"\",\n    url: server.url ?? \"\",\n    headerKeys: sortedKeys(server.headers),\n    authStrategy: server.auth?.strategy ?? \"\",\n    authHeaderName:\n      server.auth?.strategy === \"api_key\"\n        ? (server.auth.header_name ?? \"\")\n        : \"\",\n    authHeaderKeys:\n      server.auth?.strategy === \"header\" ? sortedKeys(server.auth.headers) : [],\n  });\n}\n"],"mappings":";AAEA,IAAM,KAAc,MAClB,OAAO,KAAK,KAAU,CAAC,CAAC,EAAE,KAAK;AAcjC,SAAgB,EAAsB,GAAiC;CAUrE,OATI,EAAO,SAAS,UACX,KAAK,UAAU;EACpB,MAAM,EAAO;EACb,MAAM,EAAO,QAAQ;EACrB,SAAS,EAAO,WAAW;EAC3B,MAAM,EAAO,QAAQ,CAAC;EACtB,SAAS,EAAW,EAAO,GAAG;CAChC,CAAC,IAEI,KAAK,UAAU;EACpB,MAAM,EAAO;EACb,MAAM,EAAO,QAAQ;EACrB,KAAK,EAAO,OAAO;EACnB,YAAY,EAAW,EAAO,OAAO;EACrC,cAAc,EAAO,MAAM,YAAY;EACvC,gBACE,EAAO,MAAM,aAAa,YACrB,EAAO,KAAK,eAAe,KAC5B;EACN,gBACE,EAAO,MAAM,aAAa,WAAW,EAAW,EAAO,KAAK,OAAO,IAAI,CAAC;CAC5E,CAAC;AACH"}

package/dist/utils/settings-like-page-layout-classes.cjs

@@ -1,2 +1,2 @@
-require("../_virtual/_rolldown/runtime.cjs");var e=`flex min-h-0 min-w-0 flex-1 flex-col overflow-x-hidden overflow-y-auto custom-scrollbar-always px-4 pt-8 pb-12 md:px-0 md:pr-[14px]`,t=`flex min-h-0 min-w-0 flex-1 flex-col overflow-x-hidden overflow-y-auto custom-scrollbar-always px-4 pt-8 pb-12 md:px-0 md:pt-0 md:pr-[14px]`;exports.settingsLayoutMainScrollClassName=t,exports.settingsLikeMainScrollClassName=e;
+require("../_virtual/_rolldown/runtime.cjs");var e=`flex min-h-0 min-w-0 flex-1 flex-col overflow-x-hidden overflow-y-auto [scrollbar-gutter:stable] custom-scrollbar-always px-4 pt-8 pb-12 md:px-0 md:pr-[14px]`,t=`flex min-h-0 min-w-0 flex-1 flex-col overflow-x-hidden overflow-y-auto [scrollbar-gutter:stable] custom-scrollbar-always px-4 pt-8 pb-12 md:px-0 md:pt-0 md:pr-[14px]`;exports.settingsLayoutMainScrollClassName=t,exports.settingsLikeMainScrollClassName=e;
 //# sourceMappingURL=settings-like-page-layout-classes.cjs.map

package/dist/utils/settings-like-page-layout-classes.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"settings-like-page-layout-classes.cjs","names":[],"sources":["../../src/utils/settings-like-page-layout-classes.ts"],"sourcesContent":["/**\n * Shared layout tokens for /settings/* and extensions pages (/skills, /mcp,\n * /plugins) so mobile gets horizontal inset while desktop keeps the aside +\n * `gap-10` + right gutter pattern.\n */\nexport const settingsLikeMainScrollClassName =\n  \"flex min-h-0 min-w-0 flex-1 flex-col overflow-x-hidden overflow-y-auto custom-scrollbar-always px-4 pt-8 pb-12 md:px-0 md:pr-[14px]\";\n\n/** Same scroll shell as {@link settingsLikeMainScrollClassName} but desktop top padding comes from the outer `md:pt-8` wrapper ({@link SettingsLayout}). */\nexport const settingsLayoutMainScrollClassName =\n  \"flex min-h-0 min-w-0 flex-1 flex-col overflow-x-hidden overflow-y-auto custom-scrollbar-always px-4 pt-8 pb-12 md:px-0 md:pt-0 md:pr-[14px]\";\n"],"mappings":"6CAKA,IAAa,EACX,sIAGW,EACX"}
+{"version":3,"file":"settings-like-page-layout-classes.cjs","names":[],"sources":["../../src/utils/settings-like-page-layout-classes.ts"],"sourcesContent":["/**\n * Shared layout tokens for /settings/* and extensions pages (/skills, /mcp,\n * /plugins) so mobile gets horizontal inset while desktop keeps the aside +\n * `gap-10` + right gutter pattern.\n *\n * `scrollbar-gutter: stable` keeps the gutter reserved when the page stops\n * overflowing. Without it, filtering a list short enough to fit drops the\n * scrollbar and the centered content jumps sideways into the freed space.\n */\nexport const settingsLikeMainScrollClassName =\n  \"flex min-h-0 min-w-0 flex-1 flex-col overflow-x-hidden overflow-y-auto [scrollbar-gutter:stable] custom-scrollbar-always px-4 pt-8 pb-12 md:px-0 md:pr-[14px]\";\n\n/** Same scroll shell as {@link settingsLikeMainScrollClassName} but desktop top padding comes from the outer `md:pt-8` wrapper ({@link SettingsLayout}). */\nexport const settingsLayoutMainScrollClassName =\n  \"flex min-h-0 min-w-0 flex-1 flex-col overflow-x-hidden overflow-y-auto [scrollbar-gutter:stable] custom-scrollbar-always px-4 pt-8 pb-12 md:px-0 md:pt-0 md:pr-[14px]\";\n"],"mappings":"6CASA,IAAa,EACX,gKAGW,EACX"}

package/dist/utils/settings-like-page-layout-classes.d.ts

@@ -2,7 +2,11 @@
  * Shared layout tokens for /settings/* and extensions pages (/skills, /mcp,
  * /plugins) so mobile gets horizontal inset while desktop keeps the aside +
  * `gap-10` + right gutter pattern.
+ *
+ * `scrollbar-gutter: stable` keeps the gutter reserved when the page stops
+ * overflowing. Without it, filtering a list short enough to fit drops the
+ * scrollbar and the centered content jumps sideways into the freed space.
  */
-export declare const settingsLikeMainScrollClassName = "flex min-h-0 min-w-0 flex-1 flex-col overflow-x-hidden overflow-y-auto custom-scrollbar-always px-4 pt-8 pb-12 md:px-0 md:pr-[14px]";
+export declare const settingsLikeMainScrollClassName = "flex min-h-0 min-w-0 flex-1 flex-col overflow-x-hidden overflow-y-auto [scrollbar-gutter:stable] custom-scrollbar-always px-4 pt-8 pb-12 md:px-0 md:pr-[14px]";
 /** Same scroll shell as {@link settingsLikeMainScrollClassName} but desktop top padding comes from the outer `md:pt-8` wrapper ({@link SettingsLayout}). */
-export declare const settingsLayoutMainScrollClassName = "flex min-h-0 min-w-0 flex-1 flex-col overflow-x-hidden overflow-y-auto custom-scrollbar-always px-4 pt-8 pb-12 md:px-0 md:pt-0 md:pr-[14px]";
+export declare const settingsLayoutMainScrollClassName = "flex min-h-0 min-w-0 flex-1 flex-col overflow-x-hidden overflow-y-auto [scrollbar-gutter:stable] custom-scrollbar-always px-4 pt-8 pb-12 md:px-0 md:pt-0 md:pr-[14px]";