@rahularya01/pi-essentials 0.1.0

package/src/mcp/oauth.ts

@@ -0,0 +1,262 @@
+import http from "node:http";
+import type { OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
+import type {
+  OAuthClientInformation,
+  OAuthClientInformationFull,
+  OAuthClientMetadata,
+  OAuthTokens,
+} from "@modelcontextprotocol/sdk/shared/auth.js";
+import { accountId, createFileStore, resolveCredentialStore } from "./credential-store.ts";
+
+interface StoredRecord {
+  serverUrl: string;
+  tokens?: OAuthTokens;
+  clientInformation?: OAuthClientInformationFull | OAuthClientInformation;
+  codeVerifier?: string;
+}
+
+function storageKey(serverName: string, serverUrl: string): string {
+  return `${serverName}|${serverUrl}`;
+}
+
+/** Shared across FileOAuthProvider instances for the process lifetime, so a
+ *  second instance created for the same server (as the two-step auth-complete
+ *  flow does) sees what an earlier instance just persisted. `null` means
+ *  "confirmed absent", distinct from "not yet looked up". */
+const recordCache = new Map<string, StoredRecord | null>();
+
+function parseRecord(raw: string | undefined, expectedUrl: string): StoredRecord | undefined {
+  if (raw === undefined) return undefined;
+  try {
+    const parsed = JSON.parse(raw) as StoredRecord;
+    // A record whose URL no longer matches belongs to a server that moved; treat it as absent.
+    return parsed && parsed.serverUrl === expectedUrl ? parsed : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+async function readRecord(serverName: string, serverUrl: string): Promise<StoredRecord | undefined> {
+  const rawKey = storageKey(serverName, serverUrl);
+  if (recordCache.has(rawKey)) return recordCache.get(rawKey) ?? undefined;
+
+  const { store } = await resolveCredentialStore();
+  const account = store.backend === "keyring" ? accountId(rawKey) : rawKey;
+  let raw = await store.get(account);
+
+  if (raw === undefined && store.backend === "keyring") {
+    // One-way import of a plaintext entry from before the credential store existed.
+    const legacy = createFileStore();
+    const legacyRaw = await legacy.get(rawKey);
+    if (legacyRaw !== undefined) {
+      await store.set(account, legacyRaw);
+      await legacy.delete(rawKey);
+      raw = legacyRaw;
+    }
+  }
+
+  const record = parseRecord(raw, serverUrl);
+  recordCache.set(rawKey, record ?? null);
+  return record;
+}
+
+async function writeRecord(serverName: string, serverUrl: string, record: StoredRecord): Promise<void> {
+  const rawKey = storageKey(serverName, serverUrl);
+  const { store } = await resolveCredentialStore();
+  const account = store.backend === "keyring" ? accountId(rawKey) : rawKey;
+  await store.set(account, JSON.stringify(record));
+  recordCache.set(rawKey, record);
+}
+
+async function deleteRecord(serverName: string, serverUrl: string): Promise<void> {
+  const rawKey = storageKey(serverName, serverUrl);
+  const { store } = await resolveCredentialStore();
+  const account = store.backend === "keyring" ? accountId(rawKey) : rawKey;
+  await store.delete(account);
+  // A server not yet migrated to the keyring may still have a legacy plaintext
+  // entry; clear that too so logout actually removes every stored credential.
+  if (store.backend === "keyring") await createFileStore().delete(rawKey);
+  recordCache.set(rawKey, null);
+}
+
+/** Test-only: forget cached records so a test can observe a fresh read from the backing store. */
+export function resetOAuthCacheForTests(): void {
+  recordCache.clear();
+}
+
+export class FileOAuthProvider implements OAuthClientProvider {
+  private pendingRedirect: URL | undefined;
+  private localVerifier: string | undefined;
+
+  constructor(
+    readonly serverName: string,
+    readonly serverUrl: string,
+    readonly redirectUrl: string,
+    readonly clientMetadata: OAuthClientMetadata,
+    private readonly staticClient?: OAuthClientInformation,
+    private readonly onRedirect?: (url: URL) => void,
+  ) {}
+
+  private async read(): Promise<StoredRecord> {
+    const record = await readRecord(this.serverName, this.serverUrl);
+    return record ?? { serverUrl: this.serverUrl };
+  }
+
+  private async write(patch: Partial<StoredRecord>): Promise<void> {
+    const current = await this.read();
+    await writeRecord(this.serverName, this.serverUrl, { ...current, ...patch, serverUrl: this.serverUrl });
+  }
+
+  async clientInformation(): Promise<OAuthClientInformation | undefined> {
+    return this.staticClient ?? (await this.read()).clientInformation;
+  }
+
+  async saveClientInformation(info: OAuthClientInformationFull): Promise<void> {
+    await this.write({ clientInformation: info });
+  }
+
+  async tokens(): Promise<OAuthTokens | undefined> {
+    return (await this.read()).tokens;
+  }
+
+  async saveTokens(tokens: OAuthTokens): Promise<void> {
+    await this.write({ tokens, codeVerifier: undefined });
+  }
+
+  redirectToAuthorization(authorizationUrl: URL): void {
+    this.pendingRedirect = authorizationUrl;
+    this.onRedirect?.(authorizationUrl);
+  }
+
+  takeRedirectUrl(): URL | undefined {
+    const url = this.pendingRedirect;
+    this.pendingRedirect = undefined;
+    return url;
+  }
+
+  async saveCodeVerifier(codeVerifier: string): Promise<void> {
+    this.localVerifier = codeVerifier;
+    await this.write({ codeVerifier });
+  }
+
+  async codeVerifier(): Promise<string> {
+    const stored = this.localVerifier ?? (await this.read()).codeVerifier;
+    if (!stored) throw new Error("No PKCE code verifier is stored for this OAuth flow.");
+    return stored;
+  }
+
+  async clearTokens(): Promise<void> {
+    await deleteRecord(this.serverName, this.serverUrl);
+    this.localVerifier = undefined;
+  }
+}
+
+export interface LoopbackCallback {
+  redirectUri: string;
+  waitForCallback: (timeoutMs: number) => Promise<URL>;
+  close: () => void;
+}
+
+const CALLBACK_PAGE = (message: string) =>
+  `<!doctype html><meta charset="utf-8"><title>Pi</title>` +
+  `<body style="font-family:system-ui;padding:2rem"><p>${message}</p></body>`;
+
+export function startLoopbackCallback(preferredPort = 0): Promise<LoopbackCallback> {
+  return new Promise((resolve, reject) => {
+    const server = http.createServer();
+    const sockets = new Set<import("node:net").Socket>();
+    const waiters: Array<(url: URL) => void> = [];
+    let received: URL | undefined;
+
+    // Keep-alive sockets would otherwise block server.close().
+    server.on("connection", (socket) => {
+      sockets.add(socket);
+      socket.on("close", () => sockets.delete(socket));
+    });
+
+    server.on("request", (req, res) => {
+      let url: URL;
+      try {
+        url = new URL(req.url ?? "/", "http://127.0.0.1");
+      } catch {
+        res.statusCode = 400;
+        res.end("Bad request");
+        return;
+      }
+      if (url.pathname !== "/callback") {
+        res.statusCode = 404;
+        res.end("Not found");
+        return;
+      }
+      const oauthError = url.searchParams.get("error");
+      res.statusCode = 200;
+      res.setHeader("Content-Type", "text/html; charset=utf-8");
+      res.end(
+        CALLBACK_PAGE(
+          oauthError
+            ? `Authorization failed: ${escapeHtml(url.searchParams.get("error_description") ?? oauthError)}`
+            : "Authentication complete. You can return to Pi.",
+        ),
+      );
+      received = url;
+      for (const waiter of waiters.splice(0)) waiter(url);
+    });
+
+    server.once("error", reject);
+    server.listen(preferredPort, "127.0.0.1", () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        reject(new Error("Failed to bind the OAuth callback server on 127.0.0.1"));
+        return;
+      }
+      resolve({
+        redirectUri: `http://127.0.0.1:${address.port}/callback`,
+        waitForCallback: (timeoutMs: number) =>
+          new Promise<URL>((resWait, rejWait) => {
+            if (received) {
+              resWait(received);
+              return;
+            }
+            const timer = setTimeout(
+              () => rejWait(new Error(`Timed out after ${Math.round(timeoutMs / 1000)}s waiting for the OAuth callback.`)),
+              timeoutMs,
+            );
+            timer.unref?.();
+            waiters.push((url) => {
+              clearTimeout(timer);
+              resWait(url);
+            });
+          }),
+        close: () => {
+          for (const socket of sockets) socket.destroy();
+          sockets.clear();
+          server.close();
+        },
+      });
+    });
+  });
+}
+
+function escapeHtml(value: string): string {
+  return value.replace(/[&<>"']/g, (char) => `&#${char.charCodeAt(0)};`);
+}
+
+export async function maybeOpenUrl(url: string): Promise<boolean> {
+  try {
+    const { execFile } = await import("node:child_process");
+    const { promisify } = await import("node:util");
+    const execFileAsync = promisify(execFile);
+    if (process.platform === "darwin") {
+      await execFileAsync("open", [url]);
+      return true;
+    }
+    if (process.platform === "win32") {
+      await execFileAsync("cmd", ["/c", "start", "", url]);
+      return true;
+    }
+    await execFileAsync("xdg-open", [url]);
+    return true;
+  } catch {
+    return false;
+  }
+}

package/src/mcp/proxy-tool.ts

@@ -0,0 +1,213 @@
+import { StringEnum } from "@earendil-works/pi-ai";
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { Type } from "typebox";
+import { errorMessage, PiEssentialsError, toolFailure, toolText } from "../errors.ts";
+import type { McpManager } from "./manager.ts";
+import { renderMcpCall, renderMcpResult } from "./render.ts";
+import type { CachedTool } from "./types.ts";
+
+/** Cap on tools echoed back to the model so a large fleet cannot flood context. */
+const MAX_SEARCH_MATCHES = 20;
+const MAX_LIST_TOOLS = 200;
+
+const McpParams = Type.Object({
+  action: StringEnum(
+    [
+      "search",
+      "describe",
+      "call",
+      "list",
+      "status",
+      "enable",
+      "disable",
+      "auth",
+      "auth-start",
+      "auth-complete",
+      "logout",
+      "disconnect",
+    ] as const,
+    { description: "MCP action to perform" },
+  ),
+  query: Type.Optional(Type.String({ description: "Search query (action=search)" })),
+  tool: Type.Optional(Type.String({ description: "Prefixed or original tool name (describe/call)" })),
+  args: Type.Optional(Type.Any({ description: "JSON object or JSON string of tool arguments (call)" })),
+  server: Type.Optional(
+    Type.String({ description: "Server name (enable/disable/auth/auth-start/auth-complete/logout/disconnect)" }),
+  ),
+  redirectUrl: Type.Optional(Type.String({ description: "OAuth callback URL to complete auth (auth or auth-complete)" })),
+  code: Type.Optional(
+    Type.String({ description: "OAuth authorization code, as an alternative to redirectUrl (action=auth-complete)" }),
+  ),
+});
+
+function formatTool(tool: CachedTool): string {
+  const schema = tool.inputSchema ? `\n  Schema: ${JSON.stringify(tool.inputSchema)}` : "";
+  return `${tool.prefixedName}\n  Server: ${tool.server} (${tool.name})\n  ${tool.description || "(no description)"}${schema}`;
+}
+
+function noToolsMessage(manager: McpManager): string {
+  const servers = manager.listServers();
+  if (servers.length === 0) {
+    return "No MCP servers are configured. Add servers to .mcp.json or ~/.pi/agent/mcp.json.";
+  }
+  const problems = manager.discoveryProblems();
+  const detail = problems.length > 0 ? `\n${problems.join("\n")}` : "";
+  return `No MCP tools available.${detail}\nRun mcp({ action: "status" }) or /mcp for details.`;
+}
+
+export function registerMcpTool(
+  pi: ExtensionAPI,
+  manager: McpManager,
+  onStatusChange?: (ctx: ExtensionContext) => void,
+): void {
+  pi.registerTool({
+    name: "mcp",
+    label: "MCP",
+    description:
+      "Discover and call MCP server tools without loading every tool schema into context. Search or list tools, describe one, then call it. Use auth (or auth-start/auth-complete) when a server reports it needs OAuth.",
+    promptSnippet: "Discover and call MCP tools on demand through a single proxy",
+    promptGuidelines: [
+      "Use mcp to search/list/describe/call MCP tools instead of assuming a dedicated tool exists for each MCP action.",
+      "Call mcp with action=search or action=list before action=call so you use the prefixed tool name.",
+      "If mcp reports OAuth is required, call mcp with action=auth for that server before retrying. Prefer auth-start (returns the URL immediately, completes in the background) over auth, which blocks up to 5 minutes.",
+      "If a headless session can't reach the automatic callback, finish with action=auth-complete and either redirectUrl (the full pasted callback URL) or code.",
+    ],
+    parameters: McpParams,
+    async execute(_toolCallId, params, signal, onUpdate, ctx) {
+      try {
+        switch (params.action) {
+          case "status":
+            return toolText(manager.formatStatus(), { action: "status", servers: manager.listServers() });
+
+          case "list": {
+            onUpdate?.(toolText("Listing MCP tools..."));
+            await manager.ensureAllTools(signal);
+            const tools = manager.allCachedTools();
+            if (tools.length === 0) return toolText(noToolsMessage(manager), { action: "list", tools: [] });
+            const shown = tools.slice(0, MAX_LIST_TOOLS);
+            const overflow =
+              tools.length > shown.length
+                ? `\n\n(${tools.length - shown.length} more; use action=search to narrow.)`
+                : "";
+            return toolText(`${shown.map((t) => `${t.prefixedName} — ${t.description}`).join("\n")}${overflow}`, {
+              action: "list",
+              tools: shown,
+              total: tools.length,
+            });
+          }
+
+          case "search": {
+            const query = params.query?.trim();
+            if (!query) toolFailure("query is required for search.", "MCP_BAD_ARGS");
+            onUpdate?.(toolText(`Searching MCP tools for "${query}"...`));
+            await manager.ensureAllTools(signal);
+            const matches = manager.searchTools(query);
+            if (matches.length === 0) {
+              const total = manager.allCachedTools().length;
+              return toolText(
+                total === 0
+                  ? noToolsMessage(manager)
+                  : `No MCP tools matched "${query}" out of ${total} available. Try action=list.`,
+                { action: "search", matches: [] },
+              );
+            }
+            const shown = matches.slice(0, MAX_SEARCH_MATCHES);
+            const overflow = matches.length > shown.length ? `\n\n(${matches.length - shown.length} more matches.)` : "";
+            return toolText(`${shown.map(formatTool).join("\n\n")}${overflow}`, {
+              action: "search",
+              matches: shown,
+              total: matches.length,
+            });
+          }
+
+          case "describe": {
+            const name = params.tool?.trim();
+            if (!name) toolFailure("tool is required for describe.", "MCP_BAD_ARGS");
+            await manager.ensureAllTools(signal);
+            const tool = manager.findTool(name);
+            if (!tool) {
+              const near = manager.searchTools(name).slice(0, 5);
+              const hint = near.length > 0 ? ` Did you mean: ${near.map((t) => t.prefixedName).join(", ")}?` : "";
+              toolFailure(`Unknown MCP tool "${name}".${hint}`, "MCP_UNKNOWN_TOOL");
+            }
+            return toolText(formatTool(tool), { action: "describe", tool });
+          }
+
+          case "call": {
+            const name = params.tool?.trim();
+            if (!name) toolFailure("tool is required for call.", "MCP_BAD_ARGS");
+            onUpdate?.(toolText(`Calling MCP tool ${name}...`));
+            if (!manager.findTool(name)) await manager.ensureAllTools(signal);
+            const text = await manager.callTool(name, params.args, signal);
+            return toolText(text, { action: "call", tool: name });
+          }
+
+          case "enable": {
+            const server = params.server?.trim();
+            if (!server) toolFailure("server is required for enable.", "MCP_BAD_ARGS");
+            await manager.setServerDisabled(server, false);
+            return toolText(`Enabled MCP server "${server}".`, { action: "enable", server });
+          }
+
+          case "disable": {
+            const server = params.server?.trim();
+            if (!server) toolFailure("server is required for disable.", "MCP_BAD_ARGS");
+            await manager.setServerDisabled(server, true);
+            return toolText(`Disabled MCP server "${server}".`, { action: "disable", server });
+          }
+
+          case "auth": {
+            const server = params.server?.trim();
+            if (!server) toolFailure("server is required for auth.", "MCP_BAD_ARGS");
+            onUpdate?.(toolText(`Starting OAuth for ${server}...`));
+            const text = await manager.auth(server, params.redirectUrl, signal);
+            return toolText(text, { action: "auth", server });
+          }
+
+          case "auth-start": {
+            const server = params.server?.trim();
+            if (!server) toolFailure("server is required for auth-start.", "MCP_BAD_ARGS");
+            const { authorizeUrl, message } = await manager.authStart(server, signal);
+            return toolText(message, { action: "auth-start", server, authorizeUrl });
+          }
+
+          case "auth-complete": {
+            const server = params.server?.trim();
+            if (!server) toolFailure("server is required for auth-complete.", "MCP_BAD_ARGS");
+            if (!params.redirectUrl && !params.code) {
+              toolFailure("auth-complete needs redirectUrl or code.", "MCP_BAD_ARGS");
+            }
+            const text = await manager.authComplete(server, { redirectUrl: params.redirectUrl, code: params.code }, signal);
+            return toolText(text, { action: "auth-complete", server });
+          }
+
+          case "logout": {
+            const server = params.server?.trim();
+            if (!server) toolFailure("server is required for logout.", "MCP_BAD_ARGS");
+            const text = await manager.logout(server);
+            return toolText(text, { action: "logout", server });
+          }
+
+          case "disconnect": {
+            const server = params.server?.trim() || undefined;
+            await manager.disconnect(server);
+            return toolText(server ? `Disconnected ${server}.` : "Disconnected all MCP servers.", {
+              action: "disconnect",
+              server,
+            });
+          }
+
+          default:
+            toolFailure(`Unknown action: ${String(params.action)}`, "MCP_BAD_ARGS");
+        }
+      } catch (error) {
+        const message = error instanceof PiEssentialsError ? error.message : errorMessage(error);
+        toolFailure(`${params.action}: ${message}`, error instanceof PiEssentialsError ? error.code : "MCP_ERROR");
+      } finally {
+        onStatusChange?.(ctx);
+      }
+    },
+    renderCall: renderMcpCall,
+    renderResult: renderMcpResult,
+  });
+}

package/src/mcp/render.ts

@@ -0,0 +1,164 @@
+import type { Theme } from "@earendil-works/pi-coding-agent";
+import { Text } from "@earendil-works/pi-tui";
+import {
+  body,
+  failLine,
+  firstText,
+  formatBytes,
+  GLYPH,
+  meta,
+  okLine,
+  oneLine,
+  safeRender,
+  type RenderableResult,
+  type RenderSlot,
+} from "../ui/render.ts";
+import type { CachedTool, ServerSnapshot } from "./types.ts";
+
+interface McpDetails {
+  action?: string;
+  tools?: CachedTool[];
+  matches?: CachedTool[];
+  tool?: CachedTool | string;
+  servers?: ServerSnapshot[];
+  server?: string;
+  total?: number;
+}
+
+interface McpArgs {
+  action?: string;
+  query?: string;
+  tool?: string;
+  server?: string;
+  args?: unknown;
+}
+
+/** One-line preview of the arguments a proxied MCP call was given. */
+function previewArgs(value: unknown): string | undefined {
+  if (value === undefined || value === null) return undefined;
+  try {
+    const text = typeof value === "string" ? value : JSON.stringify(value);
+    if (!text || text === "{}") return undefined;
+    return oneLine(text, 48);
+  } catch {
+    return undefined;
+  }
+}
+
+export function renderMcpCall(args: McpArgs, theme: Theme, context: RenderSlot): Text {
+  return safeRender(
+    () => {
+      const action = args?.action ?? "";
+      const subject =
+        action === "search"
+          ? args?.query && `"${args.query}"`
+          : action === "call" || action === "describe"
+            ? args?.tool
+            : args?.server;
+      let line = theme.fg("toolTitle", theme.bold("mcp"));
+      if (action) line += ` ${theme.fg("accent", action)}`;
+      if (subject) line += ` ${theme.fg("text", oneLine(String(subject), 52))}`;
+      return line + meta(theme, [action === "call" ? previewArgs(args?.args) : undefined]);
+    },
+    "mcp",
+    context,
+  );
+}
+
+export function renderMcpResult(
+  result: RenderableResult<McpDetails | undefined>,
+  options: { expanded: boolean; isPartial: boolean },
+  theme: Theme,
+  context: RenderSlot,
+): Text {
+  return safeRender(
+    () => {
+      const text = firstText(result);
+      if (options.isPartial) return theme.fg("muted", `${GLYPH.sep} ${oneLine(text, 60) || "working…"}`);
+      if (context.isError) return failLine(theme, oneLine(text || "mcp call failed", 96));
+
+      const details = result?.details ?? {};
+
+      if (details.action === "status" && details.servers) {
+        const rows = details.servers.map((server) => statusRow(theme, server));
+        const connected = details.servers.filter((s) => s.status === "connected").length;
+        return (
+          okLine(theme, theme.fg("text", `${details.servers.length} servers`)) +
+          meta(theme, [`${connected} connected`]) +
+          body(theme, rows, options.expanded, { limit: 6, noun: "server" })
+        );
+      }
+
+      if (details.action === "search" || details.action === "list") {
+        const tools = details.matches ?? details.tools ?? [];
+        if (tools.length === 0) return `${theme.fg("warning", GLYPH.pending)} ${theme.fg("muted", oneLine(text, 80))}`;
+        const rows = tools.map(
+          (tool) =>
+            `${theme.fg("accent", tool.prefixedName)}${theme.fg("dim", ` ${GLYPH.sep} ${oneLine(tool.description || "no description", 56)}`)}`,
+        );
+        return (
+          okLine(theme, theme.fg("text", `${details.total ?? tools.length} tools`)) +
+          body(theme, rows, options.expanded, { limit: 4, noun: "tool" })
+        );
+      }
+
+      if (details.action === "describe") {
+        const tool = typeof details.tool === "object" ? details.tool : undefined;
+        return (
+          okLine(theme, theme.fg("accent", tool?.prefixedName ?? "tool")) +
+          meta(theme, [tool?.server]) +
+          body(theme, text.split("\n").slice(1).map((line) => theme.fg("toolOutput", oneLine(line, 100))), options.expanded, {
+            limit: 2,
+          })
+        );
+      }
+
+      // call / auth / disconnect: show the payload size and a preview.
+      const lines = text.split("\n").filter((line) => line.trim().length > 0);
+      const header =
+        okLine(theme, theme.fg("text", typeof details.tool === "string" ? details.tool : (details.action ?? "done"))) +
+        meta(theme, [sizeNote(text)]);
+      return header + body(theme, lines.map((line) => theme.fg("toolOutput", oneLine(line, 100))), options.expanded, {
+        limit: 2,
+      });
+    },
+    oneLine(firstText(result), 120),
+    context,
+  );
+}
+
+/** Payload size is only worth showing once a result is genuinely large. */
+function sizeNote(text: string): string | undefined {
+  const bytes = Buffer.byteLength(text, "utf8");
+  return bytes >= 1024 ? formatBytes(bytes) : undefined;
+}
+
+function statusRow(theme: Theme, server: ServerSnapshot): string {
+  const color =
+    server.status === "connected"
+      ? "success"
+      : server.status === "failed"
+        ? "error"
+        : server.status === "needs-auth"
+          ? "warning"
+          : "muted";
+  const glyph = server.status === "connected" ? GLYPH.ok : server.status === "failed" ? GLYPH.fail : GLYPH.pending;
+  return (
+    `${theme.fg(color, glyph)} ${theme.fg("text", server.name)}` +
+    theme.fg("dim", ` ${GLYPH.sep} ${server.status} ${GLYPH.sep} ${server.transport} ${GLYPH.sep} ${server.toolCount} tools`)
+  );
+}
+
+/** Footer status: `mcp 2/3` with a warning tint when a server needs attention. */
+export function mcpStatusText(servers: ServerSnapshot[]): string | undefined {
+  const active = servers.filter((server) => server.status !== "disabled");
+  if (active.length === 0) return undefined;
+  const connected = active.filter((server) => server.status === "connected").length;
+  const needsAuth = active.filter((server) => server.status === "needs-auth").length;
+  const failed = active.filter((server) => server.status === "failed").length;
+
+  let text = `⚡ mcp ${connected}/${active.length}`;
+  if (needsAuth > 0) text += ` ${GLYPH.sep} ${needsAuth} need auth`;
+  if (failed > 0) text += ` ${GLYPH.sep} ${failed} failed`;
+  return text;
+}