@p4code/cli 0.1.13 → 0.1.14

package/dist/bin.mjs

@@ -121,7 +121,7 @@ const closeServer = (server) => {
 * NetService - Service tag for startup networking helpers.
 */
 var NetService = class extends Context.Service()("@p4code/shared/Net/NetService") {};
-const make$73 = () => {
+const make$74 = () => {
 	/**
 	* Returns true when a TCP server can bind to {host, port}.
 	* `EADDRNOTAVAIL` is treated as available so IPv6-absent hosts don't fail
@@ -230,10 +230,10 @@ const make$73 = () => {
 		})
 	};
 };
-const layer$69 = Layer.sync(NetService, make$73);
+const layer$70 = Layer.sync(NetService, make$74);
 //#endregion
 //#region package.json
-var version = "0.1.13";
+var version = "0.1.14";
 //#endregion
 //#region src/config.ts
 /**
@@ -254,8 +254,8 @@ var ServerConfig$1 = class extends Context.Service()("@p4code/cli/config/ServerC
 	/** @deprecated Import and use `layerTest` from this module. */
 	static layerTest = (cwd, baseDirOrPrefix) => layerTest$2(cwd, baseDirOrPrefix);
 };
-const make$72 = (config) => ServerConfig$1.of(config);
-const layer$68 = (config) => Layer.succeed(ServerConfig$1, make$72(config));
+const make$73 = (config) => ServerConfig$1.of(config);
+const layer$69 = (config) => Layer.succeed(ServerConfig$1, make$73(config));
 const deriveServerPaths = Effect.fn(function* (baseDir, devUrl, options = {}) {
 	const { join } = yield* Path.Path;
 	const stateDir = join(baseDir, devUrl !== void 0 && !options.baseDirIsExplicit ? "dev" : "userdata");
@@ -8146,6 +8146,15 @@ const McpSecretSlot = Schema$1.Struct({
 * have to compute the same string or the value is written where nothing looks.
 */
 const mcpSecretStorageName = (input) => `mcp.${input.server}.${input.target}.${input.key}`;
+/**
+* The storage name for a server's OAuth record — client id, endpoints, tokens.
+*
+* Beside `mcpSecretStorageName` for the same reason that one is here: the
+* server writing tokens and the registry cleaning up on remove must compute
+* the same string. Cannot collide with a slot name: slots always carry a
+* `header.` or `env.` segment where this has `oauth`.
+*/
+const mcpOAuthStorageName = (server) => `mcp.${server}.oauth`;
 const commonFields = {
 	name: McpServerName,
 	/**
@@ -8187,6 +8196,20 @@ const McpRemoteServer = Schema$1.Struct({
 */
 const McpServerRegistration = Schema$1.Union([McpStdioServer, McpRemoteServer]);
 /**
+* OAuth state of a remote server, on this machine.
+*
+* Present only for a server that answered a readiness probe with a 401
+* challenge or that already holds a token here. Like `missingSecrets`, this is
+* per-machine truth about a registration that syncs everywhere: the token never
+* travels, so each machine reports its own `connected`.
+*/
+const McpServerOAuthStatus = Schema$1.Struct({
+	/** The server demanded a bearer token this machine does not send. */
+	required: Schema$1.Boolean,
+	/** This machine holds a token for it. */
+	connected: Schema$1.Boolean
+});
+/**
 * What a panel needs to show, including what this machine cannot run.
 *
 * `missingSecrets` is the field that earns this type. A registration syncs
@@ -8198,7 +8221,9 @@ const McpServerStatus = Schema$1.Struct({
 	registration: McpServerRegistration,
 	missingSecrets: Schema$1.Array(McpSecretSlot),
 	/** True when this machine holds everything needed to start it. */
-	ready: Schema$1.Boolean
+	ready: Schema$1.Boolean,
+	/** Absent for servers that never challenged and hold no token here. */
+	oauth: Schema$1.optional(McpServerOAuthStatus)
 });
 const McpServerList = Schema$1.Struct({ servers: Schema$1.Array(McpServerStatus) });
 const McpServerSaveInput = Schema$1.Struct({ registration: McpServerRegistration });
@@ -8216,6 +8241,12 @@ const McpServerSecretInput = Schema$1.Struct({
 	slot: McpSecretSlot,
 	value: Schema$1.String
 });
+/**
+* The one thing the panel needs to continue a sign-in: where to send the
+* browser. Everything else the flow holds — verifier, client id, endpoints —
+* stays on the server, because the callback lands there, not on the panel.
+*/
+const McpOAuthBeginResult = Schema$1.Struct({ authorizeUrl: Schema$1.String });
 var McpRegistryError = class extends Schema$1.TaggedErrorClass()("McpRegistryError", { detail: Schema$1.String }) {
 	get message() {
 		return this.detail;
@@ -8565,6 +8596,8 @@ const WS_METHODS = {
 	mcpSave: "mcp.save",
 	mcpRemove: "mcp.remove",
 	mcpSetSecret: "mcp.setSecret",
+	mcpOAuthBegin: "mcp.oauthBegin",
+	mcpOAuthDisconnect: "mcp.oauthDisconnect",
 	sourceControlLookupRepository: "sourceControl.lookupRepository",
 	sourceControlCloneRepository: "sourceControl.cloneRepository",
 	sourceControlPublishRepository: "sourceControl.publishRepository",
@@ -8834,6 +8867,21 @@ const WsMcpSetSecretRpc = Rpc.make(WS_METHODS.mcpSetSecret, {
 	error: Schema$1.Union([McpRegistryError, EnvironmentAuthorizationError])
 });
 /**
+* Starts an OAuth sign-in for a remote server and answers with the authorize
+* URL. The panel opens it in a browser; the redirect lands on this server's
+* own `/oauth/callback`, so nothing else crosses the wire to the client.
+*/
+const WsMcpOAuthBeginRpc = Rpc.make(WS_METHODS.mcpOAuthBegin, {
+	payload: McpServerNameInput,
+	success: McpOAuthBeginResult,
+	error: Schema$1.Union([McpRegistryError, EnvironmentAuthorizationError])
+});
+const WsMcpOAuthDisconnectRpc = Rpc.make(WS_METHODS.mcpOAuthDisconnect, {
+	payload: McpServerNameInput,
+	success: McpServerList,
+	error: Schema$1.Union([McpRegistryError, EnvironmentAuthorizationError])
+});
+/**
 * The board, then every change to it, for as long as the client stays
 * subscribed. The leading snapshot is what makes this sufficient on its own —
 * a client does not list first, so there is no window between the two in which
@@ -9211,7 +9259,7 @@ const WsSubscribeAuthAccessRpc = Rpc.make(WS_METHODS.subscribeAuthAccess, {
 	error: Schema$1.Union([AuthAccessStreamError, EnvironmentAuthorizationError]),
 	stream: true
 });
-const WsRpcGroup = RpcGroup.make(WsServerProbeRpc, WsServerGetConfigRpc, WsServerRefreshProvidersRpc, WsServerUpdateProviderRpc, WsServerUpdateServerRpc, WsServerUpsertKeybindingRpc, WsServerRemoveKeybindingRpc, WsServerGetSettingsRpc, WsServerUpdateSettingsRpc, WsServerDiscoverSourceControlRpc, WsServerGetProviderUsageRpc, WsServerGetTraceDiagnosticsRpc, WsServerGetProcessDiagnosticsRpc, WsServerGetProcessResourceHistoryRpc, WsServerSignalProcessRpc, WsSourceControlLookupRepositoryRpc, WsSourceControlCloneRepositoryRpc, WsSourceControlPublishRepositoryRpc, WsProjectsListEntriesRpc, WsProjectsReadFileRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsShellOpenInEditorRpc, WsFilesystemBrowseRpc, WsAssetsCreateUrlRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsRefreshStatusRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsVcsListRefsRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsReviewGetDiffPreviewRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, WsSubscribeTerminalEventsRpc, WsSubscribeTerminalMetadataRpc, WsPreviewOpenRpc, WsPreviewNavigateRpc, WsPreviewResizeRpc, WsPreviewRefreshRpc, WsPreviewCloseRpc, WsPreviewListRpc, WsPreviewReportStatusRpc, WsPreviewAutomationConnectRpc, WsPreviewAutomationRespondRpc, WsPreviewAutomationFocusHostRpc, WsSubscribePreviewEventsRpc, WsSubscribeDiscoveredLocalServersRpc, WsSubscribeServerConfigRpc, WsSubscribeServerLifecycleRpc, WsSubscribeAuthAccessRpc, WsTasksListRpc, WsTasksGetRpc, WsTasksCreateRpc, WsTasksUpdateRpc, WsTasksDeleteRpc, WsTasksStartThreadRpc, WsSubscribeTasksRpc, WsHubGetSyncStatusRpc, WsHubConnectRpc, WsHubDisconnectRpc, WsHubSetSyncModeRpc, WsHubSetShareModeRpc, WsHubMintTokenRpc, WsSkillsSyncRpc, WsSkillsPublishRpc, WsSkillsPublishAllRpc, WsSkillsUnpublishRpc, WsAssetsReadRpc, WsAssetsSaveRpc, WsAssetsDeleteRpc, WsAssetsCreateLocalRpc, WsAssetsRemoveLocalRpc, WsSkillRegistrySearchRpc, WsSkillRegistryFetchRpc, WsMcpListRpc, WsMcpSaveRpc, WsMcpRemoveRpc, WsMcpSetSecretRpc, WsOrchestrationDispatchCommandRpc, WsOrchestrationGetTurnDiffRpc, WsOrchestrationGetFullThreadDiffRpc, WsOrchestrationGetArchivedShellSnapshotRpc, WsOrchestrationSubscribeShellRpc, WsOrchestrationSubscribeThreadRpc);
+const WsRpcGroup = RpcGroup.make(WsServerProbeRpc, WsServerGetConfigRpc, WsServerRefreshProvidersRpc, WsServerUpdateProviderRpc, WsServerUpdateServerRpc, WsServerUpsertKeybindingRpc, WsServerRemoveKeybindingRpc, WsServerGetSettingsRpc, WsServerUpdateSettingsRpc, WsServerDiscoverSourceControlRpc, WsServerGetProviderUsageRpc, WsServerGetTraceDiagnosticsRpc, WsServerGetProcessDiagnosticsRpc, WsServerGetProcessResourceHistoryRpc, WsServerSignalProcessRpc, WsSourceControlLookupRepositoryRpc, WsSourceControlCloneRepositoryRpc, WsSourceControlPublishRepositoryRpc, WsProjectsListEntriesRpc, WsProjectsReadFileRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsShellOpenInEditorRpc, WsFilesystemBrowseRpc, WsAssetsCreateUrlRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsRefreshStatusRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsVcsListRefsRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsReviewGetDiffPreviewRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, WsSubscribeTerminalEventsRpc, WsSubscribeTerminalMetadataRpc, WsPreviewOpenRpc, WsPreviewNavigateRpc, WsPreviewResizeRpc, WsPreviewRefreshRpc, WsPreviewCloseRpc, WsPreviewListRpc, WsPreviewReportStatusRpc, WsPreviewAutomationConnectRpc, WsPreviewAutomationRespondRpc, WsPreviewAutomationFocusHostRpc, WsSubscribePreviewEventsRpc, WsSubscribeDiscoveredLocalServersRpc, WsSubscribeServerConfigRpc, WsSubscribeServerLifecycleRpc, WsSubscribeAuthAccessRpc, WsTasksListRpc, WsTasksGetRpc, WsTasksCreateRpc, WsTasksUpdateRpc, WsTasksDeleteRpc, WsTasksStartThreadRpc, WsSubscribeTasksRpc, WsHubGetSyncStatusRpc, WsHubConnectRpc, WsHubDisconnectRpc, WsHubSetSyncModeRpc, WsHubSetShareModeRpc, WsHubMintTokenRpc, WsSkillsSyncRpc, WsSkillsPublishRpc, WsSkillsPublishAllRpc, WsSkillsUnpublishRpc, WsAssetsReadRpc, WsAssetsSaveRpc, WsAssetsDeleteRpc, WsAssetsCreateLocalRpc, WsAssetsRemoveLocalRpc, WsSkillRegistrySearchRpc, WsSkillRegistryFetchRpc, WsMcpListRpc, WsMcpSaveRpc, WsMcpRemoveRpc, WsMcpSetSecretRpc, WsMcpOAuthBeginRpc, WsMcpOAuthDisconnectRpc, WsOrchestrationDispatchCommandRpc, WsOrchestrationGetTurnDiffRpc, WsOrchestrationGetFullThreadDiffRpc, WsOrchestrationGetArchivedShellSnapshotRpc, WsOrchestrationSubscribeShellRpc, WsOrchestrationSubscribeThreadRpc);
 //#endregion
 //#region ../../packages/shared/src/oauthScope.ts
 const OAUTH_SCOPE_TOKEN = /^[\u0021\u0023-\u005b\u005d-\u007e]+$/u;
@@ -9357,7 +9405,7 @@ function deriveAuthClientMetadata(input) {
 //#endregion
 //#region src/auth/EnvironmentAuthPolicy.ts
 var EnvironmentAuthPolicy = class extends Context.Service()("@p4code/cli/auth/EnvironmentAuthPolicy") {};
-const make$71 = Effect.gen(function* () {
+const make$72 = Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	const isRemoteReachable = isRemoteReachableHost(config.host);
 	const policy = config.mode === "desktop" ? isRemoteReachable ? "remote-reachable" : "desktop-managed-local" : isRemoteReachable ? "remote-reachable" : "loopback-browser";
@@ -9375,7 +9423,7 @@ const make$71 = Effect.gen(function* () {
 	};
 	return EnvironmentAuthPolicy.of({ getDescriptor: () => Effect.succeed(descriptor).pipe(Effect.withSpan("EnvironmentAuthPolicy.getDescriptor")) });
 });
-const layer$67 = Layer.effect(EnvironmentAuthPolicy, make$71);
+const layer$68 = Layer.effect(EnvironmentAuthPolicy, make$72);
 //#endregion
 //#region src/persistence/Errors.ts
 function summarizeSchemaIssue(issue) {
@@ -9556,7 +9604,7 @@ function toPersistenceSqlOrDecodeError$6(sqlOperation, decodeOperation, correlat
 		cause
 	});
 }
-const make$70 = Effect.gen(function* () {
+const make$71 = Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const createSessionRow = SqlSchema.void({
 		Request: CreateAuthSessionInput,
@@ -9690,7 +9738,7 @@ const make$70 = Effect.gen(function* () {
 		setLastConnectedAt
 	};
 });
-const layer$66 = Layer.effect(AuthSessionRepository, make$70);
+const layer$67 = Layer.effect(AuthSessionRepository, make$71);
 //#endregion
 //#region src/auth/ServerSecretStore.ts
 const secretStoreErrorContext = {
@@ -9757,7 +9805,7 @@ const isSecretStoreError = Schema$1.is(SecretStoreError);
 const isPlatformError = (value) => Predicate.isTagged(value, "PlatformError");
 const isSecretAlreadyExistsError = (error) => "cause" in error && isPlatformError(error.cause) && error.cause.reason._tag === "AlreadyExists";
 var ServerSecretStore = class extends Context.Service()("@p4code/cli/auth/ServerSecretStore") {};
-const make$69 = Effect.gen(function* () {
+const make$70 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
@@ -9827,7 +9875,7 @@ const make$69 = Effect.gen(function* () {
 		remove
 	});
 });
-const layer$65 = Layer.effect(ServerSecretStore, make$69);
+const layer$66 = Layer.effect(ServerSecretStore, make$70);
 //#endregion
 //#region src/auth/SessionStore.ts
 var MalformedSessionTokenError = class extends Schema$1.TaggedErrorClass()("MalformedSessionTokenError", {}) {
@@ -10065,7 +10113,7 @@ function toAuthClientSession(input) {
 		current: false
 	};
 }
-const make$68 = Effect.gen(function* () {
+const make$69 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const serverConfig = yield* ServerConfig$1;
 	const secretStore = yield* ServerSecretStore;
@@ -10379,7 +10427,7 @@ const make$68 = Effect.gen(function* () {
 		markDisconnected
 	});
 });
-const layer$64 = Layer.effect(SessionStore, make$68).pipe(Layer.provideMerge(layer$66));
+const layer$65 = Layer.effect(SessionStore, make$69).pipe(Layer.provideMerge(layer$67));
 //#endregion
 //#region src/persistence/AuthPairingLinks.ts
 const AuthPairingLinkRecord = Schema$1.Struct({
@@ -10440,7 +10488,7 @@ function toPersistenceSqlOrDecodeError$5(sqlOperation, decodeOperation, correlat
 		cause
 	});
 }
-const make$67 = Effect.gen(function* () {
+const make$68 = Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const createPairingLinkRow = SqlSchema.void({
 		Request: CreateAuthPairingLinkInput,
@@ -10575,7 +10623,7 @@ const make$67 = Effect.gen(function* () {
 		getByCredential
 	};
 });
-const layer$63 = Layer.effect(AuthPairingLinkRepository, make$67);
+const layer$64 = Layer.effect(AuthPairingLinkRepository, make$68);
 //#endregion
 //#region src/auth/PairingGrantStore.ts
 var UnknownBootstrapCredentialError = class extends Schema$1.TaggedErrorClass()("UnknownBootstrapCredentialError", {}) {
@@ -10670,7 +10718,7 @@ const DEV_STARTUP_TTL_HOURS = Duration.hours(24);
 const PAIRING_TOKEN_ALPHABET = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
 const PAIRING_TOKEN_LENGTH = 12;
 const PAIRING_TOKEN_REJECTION_LIMIT = Math.floor(256 / 32) * 32;
-const make$66 = Effect.gen(function* () {
+const make$67 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const config = yield* ServerConfig$1;
 	const pairingLinks = yield* AuthPairingLinkRepository;
@@ -10868,7 +10916,7 @@ const make$66 = Effect.gen(function* () {
 		consume
 	});
 });
-const layer$62 = Layer.effect(PairingGrantStore, make$66).pipe(Layer.provideMerge(layer$63));
+const layer$63 = Layer.effect(PairingGrantStore, make$67).pipe(Layer.provideMerge(layer$64));
 //#endregion
 //#region src/persistence/Migrations/001_OrchestrationEvents.ts
 var _001_OrchestrationEvents_default = Effect.gen(function* () {
@@ -12723,7 +12771,7 @@ function parseBearerToken(request) {
 	const token = header.slice(7).trim();
 	return token.length > 0 ? token : null;
 }
-const make$65 = Effect.gen(function* () {
+const make$66 = Effect.gen(function* () {
 	const policy = yield* EnvironmentAuthPolicy;
 	const bootstrapCredentials = yield* PairingGrantStore;
 	const sessions = yield* SessionStore;
@@ -12918,9 +12966,9 @@ const make$65 = Effect.gen(function* () {
 		issueStartupPairingUrl
 	});
 });
-const layer$61 = Layer.effect(EnvironmentAuth, make$65).pipe(Layer.provideMerge(layer$62), Layer.provideMerge(layer$64), Layer.provideMerge(layer$67));
-const storageLayer = Layer.mergeAll(layer$65, layerConfig);
-const runtimeLayer = layer$61.pipe(Layer.provideMerge(storageLayer));
+const layer$62 = Layer.effect(EnvironmentAuth, make$66).pipe(Layer.provideMerge(layer$63), Layer.provideMerge(layer$65), Layer.provideMerge(layer$68));
+const storageLayer = Layer.mergeAll(layer$66, layerConfig);
+const runtimeLayer = layer$62.pipe(Layer.provideMerge(storageLayer));
 //#endregion
 //#region src/cliAuthFormat.ts
 const newline = "\n";
@@ -13675,7 +13723,7 @@ const runWithEnvironmentAuth = (flags, run, options) => Effect.gen(function* ()
 	}
 	return yield* Effect.gen(function* () {
 		return yield* run(yield* EnvironmentAuth);
-	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer).pipe(Layer.provide(layer$68(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
+	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer).pipe(Layer.provide(layer$69(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
 });
 const ttlFlag = Flag.string("ttl").pipe(Flag.withSchema(DurationFromString), Flag.withDescription("TTL, for example `5m`, `1h`, `30d`, or `15 minutes`."), Flag.optional);
 const jsonFlag = Flag.boolean("json").pipe(Flag.withDescription("Emit JSON instead of human-readable output."), Flag.withDefault(false));
@@ -13815,7 +13863,7 @@ const DEFAULT_LIMITS = {
 	windowMillis: FAILURE_WINDOW_MS,
 	blockMillis: BLOCK_DURATION_MS
 };
-const make$64 = Effect.fn("HubAuthThrottle.make")(function* (limits = DEFAULT_LIMITS) {
+const make$65 = Effect.fn("HubAuthThrottle.make")(function* (limits = DEFAULT_LIMITS) {
 	const state = yield* Ref.make(initialThrottleState);
 	return HubAuthThrottle.of({
 		shouldRefuse: Effect.gen(function* () {
@@ -13829,7 +13877,7 @@ const make$64 = Effect.fn("HubAuthThrottle.make")(function* (limits = DEFAULT_LI
 		})
 	});
 });
-const layer$60 = Layer.effect(HubAuthThrottle, make$64());
+const layer$61 = Layer.effect(HubAuthThrottle, make$65());
 //#endregion
 //#region src/hub/HubAuth.ts
 /**
@@ -14628,7 +14676,7 @@ const deleteAssetRoute = HttpRouter.add("DELETE", "/assets/:kind/:name", respond
 	const outcome = yield* (yield* AgentAssetRepository).deleteByName(requested);
 	return outcome._tag === "conflict" ? assetConflict(Option.getOrNull(outcome.current)) : HttpServerResponse.empty({ status: 204 });
 })));
-const layer$59 = Layer.mergeAll(healthRoute, listTasksRoute, getTaskRoute, createTaskRoute, updateTaskRoute, deleteTaskRoute, listAssetsRoute, getAssetRoute, putAssetRoute, deleteAssetRoute);
+const layer$60 = Layer.mergeAll(healthRoute, listTasksRoute, getTaskRoute, createTaskRoute, updateTaskRoute, deleteTaskRoute, listAssetsRoute, getAssetRoute, putAssetRoute, deleteAssetRoute);
 //#endregion
 //#region src/hub/Migrations/001_Tasks.ts
 /**
@@ -14907,7 +14955,7 @@ const announce = Layer.effectDiscard(Effect.gen(function* () {
 	});
 	if (isRemoteReachableHost(config.host)) yield* Effect.logWarning("Hub is reachable beyond loopback. The bearer token is the only control — repeated auth failures are not rate limited.", { host: config.host });
 }));
-const makeHubLayer = HttpRouter.serve(layer$59).pipe(Layer.provideMerge(announce), Layer.provideMerge(HubHttpServerLive), Layer.provideMerge(layer$60), Layer.provideMerge(TaskRepositoryLive), Layer.provideMerge(AgentAssetRepositoryLive), Layer.provideMerge(HubPersistenceLive));
+const makeHubLayer = HttpRouter.serve(layer$60).pipe(Layer.provideMerge(announce), Layer.provideMerge(HubHttpServerLive), Layer.provideMerge(layer$61), Layer.provideMerge(TaskRepositoryLive), Layer.provideMerge(AgentAssetRepositoryLive), Layer.provideMerge(HubPersistenceLive));
 const runHub = Layer.launch(makeHubLayer);
 //#endregion
 //#region src/atomicWrite.ts
@@ -15031,7 +15079,7 @@ function stripDefaultServerSettings(current, defaults) {
 	}
 	return Object.is(current, defaults) ? void 0 : current;
 }
-const make$63 = Effect.gen(function* () {
+const make$64 = Effect.gen(function* () {
 	const { settingsPath } = yield* ServerConfig$1;
 	const fs = yield* FileSystem.FileSystem;
 	const pathService = yield* Path.Path;
@@ -15252,7 +15300,7 @@ const make$63 = Effect.gen(function* () {
 		}
 	};
 });
-const layer$58 = Layer.effect(ServerSettingsService, make$63);
+const layer$59 = Layer.effect(ServerSettingsService, make$64);
 //#endregion
 //#region src/pathExpansion.ts
 /**
@@ -15461,6 +15509,464 @@ const discoverClaudeSkills = Effect.fn("discoverClaudeSkills")(function* (config
 	}
 	return [...skillsByName.values()].sort((left, right) => left.name.localeCompare(right.name));
 });
+//#endregion
+//#region src/mcp/McpOAuth.ts
+/**
+* OAuth sign-in for remote MCP servers, per the MCP authorization spec.
+*
+* The whole flow runs on this server: RFC 9728 protected-resource discovery,
+* RFC 8414 authorization-server metadata, RFC 7591 dynamic client
+* registration, PKCE, and the token exchange when the browser lands on
+* `/oauth/callback`. The panel only ever sees one string — the authorize URL —
+* because everything else in the flow is either a secret or only meaningful to
+* the machine the callback returns to.
+*
+* **Everything learned per server is one JSON secret** in `ServerSecretStore`
+* (`mcp.<server>.oauth`): client id, endpoints, tokens. Registrations sync
+* between machines; this record deliberately does not, which is what makes
+* "each machine signs in for itself" true by construction rather than policy.
+*
+* @module mcp/McpOAuth
+*/
+/** How long a probe's verdict is trusted before the server is asked again. */
+const PROBE_CACHE_TTL_MS = 300 * 1e3;
+/** An authorize URL nobody returned from within this window is abandoned. */
+const PENDING_FLOW_TTL_MS = 600 * 1e3;
+/** A token this close to expiry is refreshed rather than handed to a session. */
+const TOKEN_EXPIRY_MARGIN_MS = 60 * 1e3;
+/** Outbound discovery, registration and token requests all use this cap. */
+const OAUTH_REQUEST_TIMEOUT_MS = 10 * 1e3;
+const CODE_VERIFIER_BYTES = 32;
+const STATE_BYTES = 16;
+/** Sent in the probe's initialize request; any spec revision the server accepts will do. */
+const MCP_PROBE_PROTOCOL_VERSION = "2025-06-18";
+/** What the authorization server's consent screen shows. See `registerClient`. */
+const OAUTH_CLIENT_NAME = "Claude Code (p4code)";
+/** The path the environment server answers on; also sent as the redirect URI. */
+const OAUTH_CALLBACK_PATH = "/oauth/callback";
+const StoredTokens = Schema$1.Struct({
+	accessToken: Schema$1.String,
+	refreshToken: Schema$1.optional(Schema$1.String),
+	/** Epoch milliseconds. Absent when the server did not say. */
+	expiresAt: Schema$1.optional(Schema$1.Number)
+});
+/**
+* Everything this machine holds about one server's OAuth relationship.
+*
+* Endpoints and client id live beside the tokens so that disconnect can drop
+* the tokens and a later reconnect can skip re-registration — a client id is
+* not a credential, but re-registering on every sign-in litters the
+* authorization server with one-use clients.
+*/
+const StoredOAuth = Schema$1.Struct({
+	clientId: Schema$1.String,
+	clientSecret: Schema$1.optional(Schema$1.String),
+	authorizationEndpoint: Schema$1.String,
+	tokenEndpoint: Schema$1.String,
+	/** RFC 8707 resource indicator: the canonical MCP server URL. */
+	resource: Schema$1.optional(Schema$1.String),
+	scope: Schema$1.optional(Schema$1.String),
+	tokens: Schema$1.optional(StoredTokens)
+});
+const StoredOAuthFromJson = Schema$1.fromJsonString(StoredOAuth);
+const decodeStored = Schema$1.decodeUnknownExit(StoredOAuthFromJson);
+const encodeStored = Schema$1.encodeSync(StoredOAuthFromJson);
+/**
+* Parse a `WWW-Authenticate` challenge into its scheme and parameters.
+*
+* Handles the shape MCP servers actually send — `Bearer` followed by
+* comma-separated `key="value"` or bare `key=value` pairs. Exported for tests;
+* a wrong parse here turns "needs sign-in" into "broken server".
+*/
+function parseWwwAuthenticate(header) {
+	const trimmed = header.trim();
+	const spaceIndex = trimmed.indexOf(" ");
+	const scheme = (spaceIndex === -1 ? trimmed : trimmed.slice(0, spaceIndex)).toLowerCase();
+	const rest = spaceIndex === -1 ? "" : trimmed.slice(spaceIndex + 1);
+	const params = {};
+	for (const match of rest.matchAll(/([a-zA-Z0-9_-]+)\s*=\s*(?:"([^"]*)"|([^\s,]+))/gu)) {
+		const key = match[1];
+		const value = match[2] ?? match[3];
+		if (key !== void 0 && value !== void 0) params[key.toLowerCase()] = value;
+	}
+	return {
+		scheme,
+		params
+	};
+}
+/**
+* The RFC 8414 lookup locations for an issuer, in the order worth trying.
+*
+* Path insertion first — `https://a/.well-known/oauth-authorization-server/x`
+* for issuer `https://a/x` — then the OIDC variants, because real servers are
+* split between the two specs and a miss costs one request.
+*/
+function authServerMetadataUrls(issuer) {
+	const url = new URL(issuer);
+	const path = url.pathname === "/" ? "" : url.pathname.replace(/\/$/u, "");
+	return [
+		`${url.origin}/.well-known/oauth-authorization-server${path}`,
+		`${url.origin}/.well-known/openid-configuration${path}`,
+		...path === "" ? [] : [`${url.origin}${path}/.well-known/openid-configuration`]
+	];
+}
+const AuthServerMetadata = Schema$1.Struct({
+	authorization_endpoint: Schema$1.String,
+	token_endpoint: Schema$1.String,
+	registration_endpoint: Schema$1.optional(Schema$1.String),
+	scopes_supported: Schema$1.optional(Schema$1.Array(Schema$1.String))
+});
+const ProtectedResourceMetadata = Schema$1.Struct({
+	authorization_servers: Schema$1.optional(Schema$1.Array(Schema$1.String)),
+	scopes_supported: Schema$1.optional(Schema$1.Array(Schema$1.String))
+});
+const ClientRegistrationResponse = Schema$1.Struct({
+	client_id: Schema$1.String,
+	client_secret: Schema$1.optional(Schema$1.String)
+});
+const TokenResponse = Schema$1.Struct({
+	access_token: Schema$1.String,
+	refresh_token: Schema$1.optional(Schema$1.String),
+	expires_in: Schema$1.optional(Schema$1.Number)
+});
+const decodeJsonBody = Schema$1.decodeUnknownExit(Schema$1.UnknownFromJsonString);
+const decodeAuthServerMetadata = Schema$1.decodeUnknownExit(AuthServerMetadata);
+const decodeProtectedResourceMetadata = Schema$1.decodeUnknownExit(ProtectedResourceMetadata);
+const decodeClientRegistration = Schema$1.decodeUnknownExit(ClientRegistrationResponse);
+const decodeTokenResponse = Schema$1.decodeUnknownExit(TokenResponse);
+var McpOAuth = class extends Context.Service()("@p4code/cli/mcp/McpOAuth") {};
+const registryError = (detail) => new McpRegistryError({ detail });
+const make$63 = Effect.gen(function* () {
+	const config = yield* ServerConfig$1;
+	const secrets = yield* ServerSecretStore;
+	const http = yield* HttpClient.HttpClient;
+	const crypto = yield* Crypto.Crypto;
+	const pendingFlows = yield* Ref.make(/* @__PURE__ */ new Map());
+	const probeCache = yield* Ref.make(/* @__PURE__ */ new Map());
+	const redirectUri = `http://127.0.0.1:${config.port}${OAUTH_CALLBACK_PATH}`;
+	const nowMillis = Effect.map(DateTime.now, DateTime.toEpochMillis);
+	const readRecord = Effect.fn("McpOAuth.readRecord")(function* (server) {
+		const stored = yield* secrets.get(mcpOAuthStorageName(server)).pipe(Effect.orElseSucceed(() => Option.none()));
+		if (Option.isNone(stored)) return Option.none();
+		const decoded = decodeStored(new TextDecoder().decode(stored.value));
+		return decoded._tag === "Success" ? Option.some(decoded.value) : Option.none();
+	});
+	const writeRecord = Effect.fn("McpOAuth.writeRecord")(function* (server, record) {
+		yield* secrets.set(mcpOAuthStorageName(server), new TextEncoder().encode(encodeStored(record))).pipe(Effect.catchCause((cause) => Effect.logWarning("mcp oauth record write failed", {
+			cause,
+			server
+		})));
+	});
+	const fetchJson = Effect.fn("McpOAuth.fetchJson")(function* (request) {
+		const response = yield* http.execute(HttpClientRequest.setHeader(request, "accept", "application/json")).pipe(Effect.timeout(OAUTH_REQUEST_TIMEOUT_MS));
+		const text = yield* response.text;
+		const parsed = decodeJsonBody(text);
+		return {
+			status: response.status,
+			json: parsed._tag === "Success" ? parsed.value : void 0
+		};
+	});
+	/**
+	* Ask the server, without credentials, whether it wants any.
+	*
+	* A real MCP initialize request rather than a bare GET, because the GET is
+	* not part of the streamable-http contract and real servers 405 it — Figma
+	* does — while answering the initialize POST with the 401 challenge this
+	* probe exists to see.
+	*/
+	const probe = Effect.fn("McpOAuth.probe")(function* (registration) {
+		const now = yield* nowMillis;
+		const cached = (yield* Ref.get(probeCache)).get(registration.url);
+		if (cached !== void 0 && now - cached.at < PROBE_CACHE_TTL_MS) return cached;
+		const verdict = yield* http.execute(HttpClientRequest.bodyJsonUnsafe(HttpClientRequest.setHeaders(HttpClientRequest.post(registration.url), {
+			...registration.headers,
+			accept: "application/json, text/event-stream"
+		}), {
+			jsonrpc: "2.0",
+			id: 0,
+			method: "initialize",
+			params: {
+				protocolVersion: MCP_PROBE_PROTOCOL_VERSION,
+				capabilities: {},
+				clientInfo: {
+					name: "p4code",
+					version: "0.0.0"
+				}
+			}
+		})).pipe(Effect.timeout(OAUTH_REQUEST_TIMEOUT_MS), Effect.map((response) => {
+			const challengeHeader = response.headers["www-authenticate"];
+			const challenge = response.status === 401 && challengeHeader !== void 0 ? parseWwwAuthenticate(challengeHeader) : void 0;
+			return {
+				at: now,
+				requiresAuth: response.status === 401,
+				resourceMetadataUrl: challenge?.params["resource_metadata"],
+				scope: challenge?.params["scope"]
+			};
+		}), Effect.orElseSucceed(() => ({
+			at: now,
+			requiresAuth: false,
+			resourceMetadataUrl: void 0,
+			scope: void 0
+		})));
+		yield* Ref.update(probeCache, (cache) => {
+			const next = new Map(cache);
+			next.set(registration.url, verdict);
+			return next;
+		});
+		return verdict;
+	});
+	const forgetProbe = (url) => Ref.update(probeCache, (cache) => {
+		const next = new Map(cache);
+		next.delete(url);
+		return next;
+	});
+	const statusFor = (registration) => Effect.gen(function* () {
+		const record = yield* readRecord(registration.name);
+		if (Option.isSome(record) && record.value.tokens !== void 0) return Option.some({
+			required: true,
+			connected: true
+		});
+		if ((yield* probe(registration)).requiresAuth || Option.isSome(record)) return Option.some({
+			required: true,
+			connected: false
+		});
+		return Option.none();
+	}).pipe(Effect.catchCause((cause) => Effect.logWarning("mcp oauth status failed", {
+		cause,
+		server: registration.name
+	}).pipe(Effect.as(Option.none()))));
+	/**
+	* Find the authorization server for an MCP endpoint.
+	*
+	* RFC 9728 first: the 401 challenge names a protected-resource metadata URL,
+	* which names the authorization servers. When the challenge does not say —
+	* the spec's fallback — the MCP origin itself is tried as the issuer.
+	*/
+	const discover = Effect.fn("McpOAuth.discover")(function* (registration) {
+		yield* forgetProbe(registration.url);
+		const verdict = yield* probe(registration);
+		let issuers = [new URL(registration.url).origin];
+		let resourceScopes;
+		const metadataUrl = verdict.resourceMetadataUrl ?? `${new URL(registration.url).origin}/.well-known/oauth-protected-resource${new URL(registration.url).pathname.replace(/\/$/u, "")}`;
+		const resourceMetadata = yield* fetchJson(HttpClientRequest.get(metadataUrl)).pipe(Effect.map(({ status, json }) => {
+			if (status !== 200) return void 0;
+			const decoded = decodeProtectedResourceMetadata(json);
+			return decoded._tag === "Success" ? decoded.value : void 0;
+		}), Effect.orElseSucceed(() => void 0));
+		if (resourceMetadata !== void 0) {
+			if ((resourceMetadata.authorization_servers?.length ?? 0) > 0) issuers = resourceMetadata.authorization_servers ?? issuers;
+			resourceScopes = resourceMetadata.scopes_supported;
+		}
+		for (const issuer of issuers) for (const candidate of authServerMetadataUrls(issuer)) {
+			const metadata = yield* fetchJson(HttpClientRequest.get(candidate)).pipe(Effect.map(({ status, json }) => {
+				if (status !== 200) return void 0;
+				const decoded = decodeAuthServerMetadata(json);
+				return decoded._tag === "Success" ? decoded.value : void 0;
+			}), Effect.orElseSucceed(() => void 0));
+			if (metadata !== void 0) return {
+				metadata,
+				scope: verdict.scope ?? (resourceScopes !== void 0 && resourceScopes.length > 0 ? resourceScopes.join(" ") : void 0)
+			};
+		}
+		return yield* registryError(`Could not discover an OAuth authorization server for ${registration.url}.`);
+	});
+	const registerClient = Effect.fn("McpOAuth.registerClient")(function* (metadata) {
+		if (metadata.registration_endpoint === void 0) return yield* registryError("The authorization server does not support dynamic client registration.");
+		const { status, json } = yield* fetchJson(HttpClientRequest.bodyJsonUnsafe(HttpClientRequest.post(metadata.registration_endpoint), {
+			client_name: OAUTH_CLIENT_NAME,
+			redirect_uris: [redirectUri],
+			grant_types: ["authorization_code", "refresh_token"],
+			response_types: ["code"],
+			token_endpoint_auth_method: "none"
+		})).pipe(Effect.mapError(() => registryError("Client registration request failed.")));
+		if (status !== 200 && status !== 201) return yield* registryError(`Client registration was rejected with status ${status}.`);
+		const decoded = decodeClientRegistration(json);
+		if (decoded._tag !== "Success") return yield* registryError("Client registration answered an unexpected shape.");
+		return decoded.value;
+	});
+	const randomUrlSafe = (bytes) => crypto.randomBytes(bytes).pipe(Effect.map(Encoding.encodeBase64Url));
+	const begin = (registration) => Effect.gen(function* () {
+		const { metadata, scope } = yield* discover(registration);
+		const existing = yield* readRecord(registration.name);
+		const reusable = Option.filter(existing, (record) => record.tokenEndpoint === metadata.token_endpoint && record.authorizationEndpoint === metadata.authorization_endpoint);
+		const client = Option.isSome(reusable) ? {
+			client_id: reusable.value.clientId,
+			client_secret: reusable.value.clientSecret
+		} : yield* registerClient(metadata);
+		const codeVerifier = yield* randomUrlSafe(CODE_VERIFIER_BYTES).pipe(Effect.mapError(() => registryError("Could not generate a PKCE verifier.")));
+		const challengeBytes = yield* crypto.digest("SHA-256", new TextEncoder().encode(codeVerifier)).pipe(Effect.mapError(() => registryError("Could not hash the PKCE verifier.")));
+		const state = yield* randomUrlSafe(STATE_BYTES).pipe(Effect.mapError(() => registryError("Could not generate a state value.")));
+		const record = {
+			clientId: client.client_id,
+			...client.client_secret === void 0 ? {} : { clientSecret: client.client_secret },
+			authorizationEndpoint: metadata.authorization_endpoint,
+			tokenEndpoint: metadata.token_endpoint,
+			resource: registration.url,
+			...scope === void 0 ? {} : { scope }
+		};
+		yield* writeRecord(registration.name, record);
+		const startedAt = yield* nowMillis;
+		yield* Ref.update(pendingFlows, (flows) => {
+			const next = new Map([...flows].filter(([, flow]) => startedAt - flow.startedAt < PENDING_FLOW_TTL_MS));
+			next.set(state, {
+				server: registration.name,
+				codeVerifier,
+				redirectUri,
+				record,
+				startedAt
+			});
+			return next;
+		});
+		const authorizeUrl = new URL(metadata.authorization_endpoint);
+		authorizeUrl.searchParams.set("response_type", "code");
+		authorizeUrl.searchParams.set("client_id", client.client_id);
+		authorizeUrl.searchParams.set("redirect_uri", redirectUri);
+		authorizeUrl.searchParams.set("state", state);
+		authorizeUrl.searchParams.set("code_challenge", Encoding.encodeBase64Url(challengeBytes));
+		authorizeUrl.searchParams.set("code_challenge_method", "S256");
+		authorizeUrl.searchParams.set("resource", registration.url);
+		if (scope !== void 0) authorizeUrl.searchParams.set("scope", scope);
+		return { authorizeUrl: authorizeUrl.toString() };
+	});
+	const exchangeToken = Effect.fn("McpOAuth.exchangeToken")(function* (flow, code) {
+		const { status, json } = yield* fetchJson(HttpClientRequest.bodyUrlParams(HttpClientRequest.post(flow.record.tokenEndpoint), {
+			grant_type: "authorization_code",
+			code,
+			redirect_uri: flow.redirectUri,
+			client_id: flow.record.clientId,
+			code_verifier: flow.codeVerifier,
+			...flow.record.clientSecret === void 0 ? {} : { client_secret: flow.record.clientSecret },
+			...flow.record.resource === void 0 ? {} : { resource: flow.record.resource }
+		}));
+		if (status !== 200) return yield* Effect.fail(`token endpoint answered status ${status}`);
+		const decoded = decodeTokenResponse(json);
+		if (decoded._tag !== "Success") return yield* Effect.fail("token endpoint answered an unexpected shape");
+		return decoded.value;
+	});
+	const handleCallback = (params) => Effect.gen(function* () {
+		if (params.state === void 0) return {
+			ok: false,
+			detail: "The redirect carried no state value."
+		};
+		const flow = (yield* Ref.get(pendingFlows)).get(params.state);
+		if (flow === void 0) return {
+			ok: false,
+			detail: "This sign-in is unknown or has expired. Start it again from settings."
+		};
+		yield* Ref.update(pendingFlows, (current) => {
+			const next = new Map(current);
+			next.delete(params.state);
+			return next;
+		});
+		if (params.error !== void 0) return {
+			ok: false,
+			detail: params.errorDescription ?? `The authorization server answered: ${params.error}.`
+		};
+		if (params.code === void 0) return {
+			ok: false,
+			detail: "The redirect carried no authorization code."
+		};
+		const now = yield* nowMillis;
+		const exchanged = yield* exchangeToken(flow, params.code).pipe(Effect.map((response) => ({
+			failed: false,
+			response
+		})), Effect.catch((detail) => Effect.succeed({
+			failed: true,
+			detail: typeof detail === "string" ? detail : "the token request failed"
+		})));
+		if (exchanged.failed) {
+			yield* Effect.logWarning("mcp oauth token exchange failed", {
+				server: flow.server,
+				detail: exchanged.detail
+			});
+			return {
+				ok: false,
+				detail: `Token exchange failed: ${exchanged.detail}.`
+			};
+		}
+		yield* writeRecord(flow.server, {
+			...flow.record,
+			tokens: {
+				accessToken: exchanged.response.access_token,
+				...exchanged.response.refresh_token === void 0 ? {} : { refreshToken: exchanged.response.refresh_token },
+				...exchanged.response.expires_in === void 0 ? {} : { expiresAt: now + exchanged.response.expires_in * 1e3 }
+			}
+		});
+		return {
+			ok: true,
+			server: flow.server
+		};
+	}).pipe(Effect.catchCause((cause) => Effect.logWarning("mcp oauth callback failed", { cause }).pipe(Effect.as({
+		ok: false,
+		detail: "The sign-in failed. See the server log."
+	}))));
+	const disconnect = (name) => Effect.gen(function* () {
+		const record = yield* readRecord(name);
+		if (Option.isNone(record)) return;
+		const { tokens: _dropped, ...rest } = record.value;
+		yield* writeRecord(name, rest);
+	}).pipe(Effect.catchCause((cause) => Effect.logWarning("mcp oauth disconnect failed", {
+		cause,
+		server: name
+	}).pipe(Effect.asVoid)));
+	const refreshTokens = Effect.fn("McpOAuth.refreshTokens")(function* (server, record, refreshToken) {
+		const { status, json } = yield* fetchJson(HttpClientRequest.bodyUrlParams(HttpClientRequest.post(record.tokenEndpoint), {
+			grant_type: "refresh_token",
+			refresh_token: refreshToken,
+			client_id: record.clientId,
+			...record.clientSecret === void 0 ? {} : { client_secret: record.clientSecret },
+			...record.resource === void 0 ? {} : { resource: record.resource }
+		}));
+		if (status !== 200) return yield* Effect.fail(`status ${status}`);
+		const decoded = decodeTokenResponse(json);
+		if (decoded._tag !== "Success") return yield* Effect.fail("unexpected shape");
+		const response = decoded.value;
+		const now = yield* nowMillis;
+		const tokens = {
+			accessToken: response.access_token,
+			refreshToken: response.refresh_token ?? refreshToken,
+			...response.expires_in === void 0 ? {} : { expiresAt: now + response.expires_in * 1e3 }
+		};
+		yield* writeRecord(server, {
+			...record,
+			tokens
+		});
+		return tokens.accessToken;
+	});
+	const accessTokenFor = (registration) => Effect.gen(function* () {
+		const record = yield* readRecord(registration.name);
+		if (Option.isNone(record) || record.value.tokens === void 0) return Option.none();
+		const tokens = record.value.tokens;
+		const now = yield* nowMillis;
+		if (!(tokens.expiresAt !== void 0 && now >= tokens.expiresAt - TOKEN_EXPIRY_MARGIN_MS)) return Option.some(tokens.accessToken);
+		if (tokens.refreshToken === void 0) return Option.none();
+		return yield* refreshTokens(registration.name, record.value, tokens.refreshToken).pipe(Effect.map(Option.some), Effect.catchCause((cause) => Effect.logWarning("mcp oauth refresh failed", {
+			cause,
+			server: registration.name
+		}).pipe(Effect.as(Option.none()))));
+	}).pipe(Effect.catchCause((cause) => Effect.logWarning("mcp oauth token lookup failed", {
+		cause,
+		server: registration.name
+	}).pipe(Effect.as(Option.none()))));
+	return {
+		statusFor,
+		begin,
+		handleCallback,
+		disconnect,
+		accessTokenFor
+	};
+});
+const layer$58 = Layer.effect(McpOAuth, make$63);
+Layer.succeed(McpOAuth, {
+	statusFor: () => Effect.succeed(Option.none()),
+	begin: () => Effect.fail(new McpRegistryError({ detail: "OAuth sign-in is not available." })),
+	handleCallback: () => Effect.succeed({
+		ok: false,
+		detail: "OAuth sign-in is not available."
+	}),
+	disconnect: () => Effect.void,
+	accessTokenFor: () => Effect.succeed(Option.none())
+});
 /** Extension for a registration file, so the sync's asset name is `<server>.json`. */
 const MCP_REGISTRATION_SUFFIX = ".json";
 const RegistrationFromJson$1 = Schema$1.fromJsonString(McpServerRegistration);
@@ -15471,6 +15977,7 @@ const slotsOf = (registration) => registration.secrets ?? [];
 const make$62 = Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	const secrets = yield* ServerSecretStore;
+	const oauth = yield* McpOAuth;
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const services = yield* Effect.context();
@@ -15513,10 +16020,13 @@ const make$62 = Effect.gen(function* () {
 				const value = yield* readSecret(registration.name, slot);
 				if (Option.isNone(value)) missingSecrets.push(slot);
 			}
+			const oauthStatus = registration.transport === "stdio" || !registration.enabled ? Option.none() : yield* oauth.statusFor(registration);
+			const needsSignIn = Option.isSome(oauthStatus) && !oauthStatus.value.connected;
 			statuses.push({
 				registration,
 				missingSecrets,
-				ready: registration.enabled && missingSecrets.length === 0
+				ready: registration.enabled && missingSecrets.length === 0 && !needsSignIn,
+				...Option.isSome(oauthStatus) ? { oauth: oauthStatus.value } : {}
 			});
 		}
 		return statuses;
@@ -15536,6 +16046,7 @@ const make$62 = Effect.gen(function* () {
 			target: slot.target,
 			key: slot.key
 		})).pipe(Effect.ignore);
+		yield* secrets.remove(mcpOAuthStorageName(name)).pipe(Effect.ignore);
 	}).pipe(Effect.provide(services), Effect.catchCause((cause) => Effect.logWarning("mcp registry remove failed", { cause }).pipe(Effect.asVoid)));
 	const setSecret = ({ name, slot, value }) => secrets.set(mcpSecretStorageName({
 		server: name,
@@ -15565,6 +16076,11 @@ const make$62 = Effect.gen(function* () {
 					else env[slot.key] = value.value;
 				}
 				if (!complete) continue;
+				const hasExplicitAuthorization = Object.keys(headers).some((key) => key.toLowerCase() === "authorization");
+				if (registration.transport !== "stdio" && !hasExplicitAuthorization) {
+					const token = yield* oauth.accessTokenFor(registration);
+					if (Option.isSome(token)) headers["Authorization"] = `Bearer ${token.value}`;
+				}
 				resolved[registration.name] = registration.transport === "stdio" ? {
 					type: "stdio",
 					command: registration.command,
@@ -17297,7 +17813,7 @@ const make$59 = Effect.gen(function* () {
 const layer$54 = Layer.effect(AssetSync, make$59);
 //#endregion
 //#region src/cli/assets.ts
-const SyncServicesLive = layer$54.pipe(Layer.provideMerge(layer$55), Layer.provideMerge(layer$56), Layer.provideMerge(layer$58.pipe(Layer.provide(layer$65))), Layer.provideMerge(layer$65), Layer.provideMerge(FetchHttpClient.layer));
+const SyncServicesLive = layer$54.pipe(Layer.provideMerge(layer$55), Layer.provideMerge(layer$56), Layer.provideMerge(layer$59.pipe(Layer.provide(layer$66))), Layer.provideMerge(layer$66), Layer.provideMerge(FetchHttpClient.layer));
 const runWithSync = (flags, run) => Effect.gen(function* () {
 	const config = yield* resolveCliAuthConfig(flags, yield* GlobalFlag.LogLevel);
 	return yield* Effect.gen(function* () {
@@ -17305,7 +17821,7 @@ const runWithSync = (flags, run) => Effect.gen(function* () {
 			sync: yield* AssetSync,
 			link: yield* HubLink
 		});
-	}).pipe(Effect.provide(SyncServicesLive.pipe(Layer.provide(layer$68(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, "Error")))));
+	}).pipe(Effect.provide(SyncServicesLive.pipe(Layer.provide(layer$69(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, "Error")))));
 });
 const STATE_LABEL = {
 	synced: "synced",
@@ -27891,7 +28407,7 @@ const runProjectMutation = Effect.fn("runProjectMutation")(function* (flags, run
 			});
 			yield* Console.log(output);
 		}));
-		const offlineRuntimeLayer = ProjectCliRuntimeLive.pipe(Layer.provide(layer$68(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)));
+		const offlineRuntimeLayer = ProjectCliRuntimeLive.pipe(Layer.provide(layer$69(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)));
 		return yield* Effect.gen(function* () {
 			const snapshot = yield* getOfflineSnapshot();
 			const orchestrationEngine = yield* OrchestrationEngineService;
@@ -27902,7 +28418,7 @@ const runProjectMutation = Effect.fn("runProjectMutation")(function* (flags, run
 			});
 			yield* Console.log(output);
 		}).pipe(Effect.provide(offlineRuntimeLayer));
-	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer, layer$43).pipe(Layer.provideMerge(FetchHttpClient.layer), Layer.provide(layer$68(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
+	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer, layer$43).pipe(Layer.provideMerge(FetchHttpClient.layer), Layer.provide(layer$69(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
 });
 const projectAddCommand = Command.make("add", {
 	...projectLocationFlags,
@@ -29222,6 +29738,40 @@ const otlpTracesProxyRouteLayer = HttpRouter.add("POST", OTLP_TRACES_PROXY_PATH,
 	EnvironmentInternalError: HttpServerRespondable.toResponse,
 	EnvironmentScopeRequiredError: HttpServerRespondable.toResponse
 })));
+const escapeHtml = (input) => input.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;");
+const oauthResultPage = (input) => HttpServerResponse.text([
+	"<!doctype html>",
+	`<html><head><meta charset="utf-8"><title>${escapeHtml(input.title)}</title></head>`,
+	"<body style=\"font-family: system-ui, sans-serif; max-width: 32rem; margin: 4rem auto;\">",
+	`<h1 style="font-size: 1.25rem;">${escapeHtml(input.title)}</h1>`,
+	`<p>${escapeHtml(input.detail)}</p>`,
+	"</body></html>"
+].join(""), { contentType: "text/html; charset=utf-8" });
+/**
+* Where the browser lands after an MCP server sign-in.
+*
+* Deliberately unauthenticated: the redirect comes from an authorization
+* server that holds no p4code credential. The `state` value — minted by
+* `McpOAuth.begin`, single-use, expiring — is what ties the request to a flow
+* this server started; a request without a live one changes nothing.
+*/
+const mcpOAuthCallbackRouteLayer = HttpRouter.add("GET", OAUTH_CALLBACK_PATH, Effect.gen(function* () {
+	const request = yield* HttpServerRequest.HttpServerRequest;
+	const url = new URL(request.url, "http://localhost.invalid");
+	const outcome = yield* (yield* McpOAuth).handleCallback({
+		state: url.searchParams.get("state") ?? void 0,
+		code: url.searchParams.get("code") ?? void 0,
+		error: url.searchParams.get("error") ?? void 0,
+		errorDescription: url.searchParams.get("error_description") ?? void 0
+	});
+	return outcome.ok ? oauthResultPage({
+		title: "Signed in",
+		detail: `${outcome.server} is connected. You can close this tab and return to p4code.`
+	}) : oauthResultPage({
+		title: "Sign-in failed",
+		detail: outcome.detail
+	});
+}));
 const assetRouteLayer = HttpRouter.add("GET", `${ASSET_ROUTE_PREFIX}/*`, Effect.gen(function* () {
 	const request = yield* HttpServerRequest.HttpServerRequest;
 	const url = HttpServerRequest.toURL(request);
@@ -33376,15 +33926,15 @@ const toTaskStoreError = (operation) => (cause) => Effect.logWarning("task store
 */
 const buildAutoPrompt = (task) => {
 	const reference = task.readableId ?? task.taskId;
-	return `You are picking up task \`${reference}\` from the board: ${task.title}
+	return `Picking up board task \`${reference}\`: ${task.title}
 
-Start by reading the task itself with \`task_current\` (or \`task_get\` with \`${reference}\`). The body, labels, project and priority live on the row, not in this message, and the row may have been edited since this thread started — what it says now is the source of truth. Re-read it the same way whenever you need the fields again.
+Read the task first via \`task_current\` (or \`task_get\` with \`${reference}\`). Body, labels, project and priority live on the row, not in this message; the row may have changed since this thread started - the current row is the source of truth. Re-read it the same way whenever you need the fields again.
 
-This thread is already linked to the task, which is now In progress. Do the work.
+This thread is already linked to the task, status In progress. Do the work.
 
-Record what you find with \`task_update\` as you go — a decision you made, a constraint you hit, something the task turned out to be wrong about. That is what makes the row worth reading afterwards. Leave \`status\` alone: moving work across the board is the user's call.
+Record findings via \`task_update\` as you go - decisions made, constraints hit, things the task turned out to be wrong about. That is what makes the row worth reading afterwards. Leave \`status\` alone: moving work across the board is the user's call.
 
-After reading the task, read the code it concerns. If it turns out to be specified too poorly to act on, say so and stop rather than guessing at what was meant.`;
+After reading the task, read the code it concerns. If it is specified too poorly to act on, say so and stop rather than guessing.`;
 };
 /**
 * Render a task into the prompt that seeds its thread.
@@ -43408,6 +43958,8 @@ const RPC_REQUIRED_SCOPE = /* @__PURE__ */ new Map([
 	[WS_METHODS.mcpSave, AuthOrchestrationOperateScope],
 	[WS_METHODS.mcpRemove, AuthOrchestrationOperateScope],
 	[WS_METHODS.mcpSetSecret, AuthOrchestrationOperateScope],
+	[WS_METHODS.mcpOAuthBegin, AuthOrchestrationOperateScope],
+	[WS_METHODS.mcpOAuthDisconnect, AuthOrchestrationOperateScope],
 	[WS_METHODS.serverGetSettings, AuthOrchestrationReadScope],
 	[WS_METHODS.serverUpdateSettings, AuthOrchestrationOperateScope],
 	[WS_METHODS.serverDiscoverSourceControl, AuthOrchestrationReadScope],
@@ -43521,6 +44073,7 @@ const makeWsRpcLayer = (currentSession, previewAutomationBroker) => WsRpcGroup.t
 	const hubLink = yield* HubLink;
 	const assetSync = yield* AssetSync;
 	const mcpRegistry = yield* McpRegistry;
+	const mcpOAuth = yield* McpOAuth;
 	const skillRegistry = yield* SkillRegistry;
 	const startup = yield* ServerRuntimeStartup;
 	const workspaceEntries = yield* WorkspaceEntries;
@@ -44122,6 +44675,13 @@ const makeWsRpcLayer = (currentSession, previewAutomationBroker) => WsRpcGroup.t
 			slot,
 			value
 		}).pipe(Effect.andThen(mcpRegistry.list.pipe(Effect.map((servers) => ({ servers }))))), { "rpc.aggregate": "mcp" }),
+		[WS_METHODS.mcpOAuthBegin]: ({ name }) => observeRpcEffect$1(WS_METHODS.mcpOAuthBegin, Effect.gen(function* () {
+			const found = (yield* mcpRegistry.list).find((status) => status.registration.name === name);
+			if (found === void 0) return yield* new McpRegistryError({ detail: `No server is named ${name}.` });
+			if (found.registration.transport === "stdio") return yield* new McpRegistryError({ detail: "A stdio server is launched locally and has no sign-in." });
+			return yield* mcpOAuth.begin(found.registration);
+		}), { "rpc.aggregate": "mcp" }),
+		[WS_METHODS.mcpOAuthDisconnect]: ({ name }) => observeRpcEffect$1(WS_METHODS.mcpOAuthDisconnect, mcpOAuth.disconnect(name).pipe(Effect.andThen(mcpRegistry.list.pipe(Effect.map((servers) => ({ servers }))))), { "rpc.aggregate": "mcp" }),
 		[WS_METHODS.serverGetSettings]: (_input) => observeRpcEffect$1(WS_METHODS.serverGetSettings, serverSettings.getSettings.pipe(Effect.map(redactServerSettingsForClient)), { "rpc.aggregate": "server" }),
 		[WS_METHODS.serverUpdateSettings]: ({ patch }) => observeRpcEffect$1(WS_METHODS.serverUpdateSettings, serverSettings.updateSettings(patch).pipe(Effect.map(redactServerSettingsForClient)), { "rpc.aggregate": "server" }),
 		[WS_METHODS.serverDiscoverSourceControl]: (_input) => observeRpcEffect$1(WS_METHODS.serverDiscoverSourceControl, sourceControlDiscovery.discover, { "rpc.aggregate": "server" }),
@@ -46619,7 +47179,7 @@ const makeOpenCodeRuntime = Effect.gen(function* () {
 	};
 });
 var OpenCodeRuntime = class extends Context.Service()("@p4code/cli/provider/opencodeRuntime") {};
-const OpenCodeRuntimeLive = Layer.effect(OpenCodeRuntime, makeOpenCodeRuntime).pipe(Layer.provide(layer$69));
+const OpenCodeRuntimeLive = Layer.effect(OpenCodeRuntime, makeOpenCodeRuntime).pipe(Layer.provide(layer$70));
 //#endregion
 //#region src/textGeneration/TextGenerationUtils.ts
 const isTextGenerationError$2 = Schema$1.is(TextGenerationError);
@@ -85904,9 +86464,9 @@ const WorkspaceEntriesLayerLive = layer$25.pipe(Layer.provide(layer$43));
 const WorkspaceFileSystemLayerLive = layer$24.pipe(Layer.provide(layer$43), Layer.provide(WorkspaceEntriesLayerLive));
 const WorkspaceLayerLive = Layer.mergeAll(layer$43, WorkspaceEntriesLayerLive, WorkspaceFileSystemLayerLive);
 const ProjectFaviconResolverLayerLive = layer$41.pipe(Layer.provide(layer$43), Layer.provide(layer$42));
-const AuthLayerLive = layer$61.pipe(Layer.provideMerge(PersistenceLayerLive), Layer.provide(layer$65));
+const AuthLayerLive = layer$62.pipe(Layer.provideMerge(PersistenceLayerLive), Layer.provide(layer$66));
 const ProviderRuntimeLayerLive = ProviderSessionReaperLive.pipe(Layer.provideMerge(ProviderLayerLive), Layer.provideMerge(OrchestrationLayerLive));
-const RuntimeDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(CheckpointingLayerLive), Layer.provideMerge(SourceControlProviderRegistryLayerLive), Layer.provideMerge(GitLayerLive), Layer.provideMerge(VcsLayerLive), Layer.provideMerge(ProviderRuntimeLayerLive), Layer.provideMerge(Layer.mergeAll(TerminalLayerLive, PreviewLayerLive)), Layer.provideMerge(PersistenceLayerLive), Layer.provideMerge(layer$51), Layer.provideMerge(ProviderRegistryLive), Layer.provideMerge(ProviderInstanceRegistryHydrationLive), Layer.provideMerge(ProviderEventLoggersLive), Layer.provideMerge(OpenCodeRuntimeLive), Layer.provideMerge(layer$58.pipe(Layer.provide(layer$65))), Layer.provideMerge(WorkspaceLayerLive), Layer.provideMerge(ProjectFaviconResolverLayerLive), Layer.provideMerge(layer$52), Layer.provideMerge(layer$45), Layer.provideMerge(AuthLayerLive), Layer.provideMerge(Layer.mergeAll(layer$57, layer$31)), Layer.provideMerge(layer$65)).pipe(Layer.provideMerge(layer$8), Layer.provideMerge(layer$7), Layer.provideMerge(layer$6), Layer.provideMerge(layer$48), Layer.provideMerge(layer$50), Layer.provideMerge(layer$49), Layer.provide(layer$69));
+const RuntimeDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(CheckpointingLayerLive), Layer.provideMerge(SourceControlProviderRegistryLayerLive), Layer.provideMerge(GitLayerLive), Layer.provideMerge(VcsLayerLive), Layer.provideMerge(ProviderRuntimeLayerLive), Layer.provideMerge(Layer.mergeAll(TerminalLayerLive, PreviewLayerLive)), Layer.provideMerge(PersistenceLayerLive), Layer.provideMerge(layer$51), Layer.provideMerge(ProviderRegistryLive), Layer.provideMerge(ProviderInstanceRegistryHydrationLive), Layer.provideMerge(ProviderEventLoggersLive), Layer.provideMerge(OpenCodeRuntimeLive), Layer.provideMerge(layer$59.pipe(Layer.provide(layer$66))), Layer.provideMerge(WorkspaceLayerLive), Layer.provideMerge(ProjectFaviconResolverLayerLive), Layer.provideMerge(layer$52), Layer.provideMerge(layer$45), Layer.provideMerge(AuthLayerLive), Layer.provideMerge(Layer.mergeAll(layer$57, layer$31).pipe(Layer.provideMerge(layer$58))), Layer.provideMerge(layer$66)).pipe(Layer.provideMerge(layer$8), Layer.provideMerge(layer$7), Layer.provideMerge(layer$6), Layer.provideMerge(layer$48), Layer.provideMerge(layer$50), Layer.provideMerge(layer$49), Layer.provide(layer$70));
 /**
 * Hub asset sync.
 *
@@ -85916,7 +86476,7 @@ const RuntimeDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(Checkpo
 */
 const AssetSyncLive = layer$54.pipe(Layer.provideMerge(layer$55), Layer.provideMerge(layer$56));
 const RuntimeServicesLive = layer$44.pipe(Layer.provideMerge(AssetSyncLive), Layer.provideMerge(RuntimeDependenciesLive));
-const makeRoutesLayer = Layer.mergeAll(Layer.mergeAll(HttpApiBuilder.layer(EnvironmentHttpApi).pipe(Layer.provide(authHttpApiLayer), Layer.provide(orchestrationHttpApiLayer), Layer.provide(serverEnvironmentHttpApiLayer), Layer.provide(environmentAuthenticatedAuthLayer)), otlpTracesProxyRouteLayer, assetRouteLayer, staticAndDevRouteLayer, websocketRpcRouteLayer), layer.pipe(Layer.provide(layer$2))).pipe(Layer.provide(RoutedTaskRepositoryLive.pipe(Layer.provide(PersistenceLayerLive))), Layer.provide(ProjectionProjectRepositoryLive.pipe(Layer.provide(PersistenceLayerLive))), Layer.provide(layer$42), Layer.provide(layer$28), Layer.provide(layer$46), Layer.provide(browserApiCorsLayer), Layer.provide(httpCompressionLayer));
+const makeRoutesLayer = Layer.mergeAll(Layer.mergeAll(HttpApiBuilder.layer(EnvironmentHttpApi).pipe(Layer.provide(authHttpApiLayer), Layer.provide(orchestrationHttpApiLayer), Layer.provide(serverEnvironmentHttpApiLayer), Layer.provide(environmentAuthenticatedAuthLayer)), otlpTracesProxyRouteLayer, assetRouteLayer, mcpOAuthCallbackRouteLayer, staticAndDevRouteLayer, websocketRpcRouteLayer), layer.pipe(Layer.provide(layer$2))).pipe(Layer.provide(RoutedTaskRepositoryLive.pipe(Layer.provide(PersistenceLayerLive))), Layer.provide(ProjectionProjectRepositoryLive.pipe(Layer.provide(PersistenceLayerLive))), Layer.provide(layer$42), Layer.provide(layer$28), Layer.provide(layer$46), Layer.provide(browserApiCorsLayer), Layer.provide(httpCompressionLayer));
 const makeServerLayer = Layer.unwrap(Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	yield* fixPath();
@@ -86326,7 +86886,7 @@ const serviceCommand = Command.make("service").pipe(Command.withDescription("Man
 ]));
 //#endregion
 //#region src/bin.ts
-const CliRuntimeLayer = Layer.mergeAll(NodeServices.layer, layer$69, FetchHttpClient.layer);
+const CliRuntimeLayer = Layer.mergeAll(NodeServices.layer, layer$70, FetchHttpClient.layer);
 /**
 * Prints an update reminder before dispatching, at most once a day.
 *