@sonoma-security/mcp-gateway 0.1.11 → 0.1.13

package/dist/auth/storage.js

@@ -1,47 +1,98 @@
 /**
  * Secure token storage for MCP Gateway OAuth credentials
  *
- * Stores tokens in ~/.sonoma/gateway-credentials.json with AES-256-GCM encryption.
- * The encryption key is derived from a machine-specific identifier to prevent
- * tokens from being copied between machines.
+ * Stores tokens in the OS keychain (macOS Keychain, Windows Credential Manager).
+ * Falls back to encrypted file storage on unsupported platforms.
  */
 import { existsSync, readFileSync, writeFileSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { SONOMA_DIR, ensureSonomaDir, getDeviceId, encrypt, decrypt } from "./crypto.js";
-const CREDENTIALS_PATH = join(SONOMA_DIR, "gateway-credentials.json");
+import { keychainAvailable, keychainGet, keychainSet, keychainDelete } from "./keychain.js";
+const KEYCHAIN_ACCOUNT = "sonoma-auth";
+// Legacy file path (for migration)
+const LEGACY_CREDENTIALS_PATH = join(SONOMA_DIR, "gateway-credentials.json");
 /**
- * Load stored credentials from disk
+ * Load stored credentials from OS keychain (or legacy file).
  */
 export function loadCredentials() {
-    if (!existsSync(CREDENTIALS_PATH)) {
-        return null;
-    }
-    try {
-        const encryptedData = readFileSync(CREDENTIALS_PATH, "utf-8");
-        const decrypted = decrypt(encryptedData);
-        return JSON.parse(decrypted);
-    }
-    catch (error) {
-        // If decryption fails (e.g., machine changed), return null
-        console.error("[auth] Failed to load credentials:", error);
+    // Try OS keychain first
+    if (keychainAvailable()) {
+        try {
+            const creds = keychainGet(KEYCHAIN_ACCOUNT);
+            if (creds)
+                return creds;
+        }
+        catch {
+            // Keychain access failed, try legacy
+        }
+        // Migrate from legacy encrypted file if it exists
+        const legacy = loadLegacyCredentials();
+        if (legacy) {
+            try {
+                keychainSet(KEYCHAIN_ACCOUNT, legacy);
+                // Clean up legacy file after successful migration
+                unlinkSync(LEGACY_CREDENTIALS_PATH);
+            }
+            catch {
+                // Migration failed, return legacy credentials anyway
+            }
+            return legacy;
+        }
         return null;
     }
+    // Fallback: encrypted file (Linux, etc.)
+    return loadLegacyCredentials();
 }
 /**
- * Save credentials to disk (encrypted)
+ * Save credentials to OS keychain (or fallback file).
  */
 export function saveCredentials(credentials) {
+    if (keychainAvailable()) {
+        keychainSet(KEYCHAIN_ACCOUNT, credentials);
+        // Clean up legacy file if it exists
+        if (existsSync(LEGACY_CREDENTIALS_PATH)) {
+            try {
+                unlinkSync(LEGACY_CREDENTIALS_PATH);
+            }
+            catch { /* ignore */ }
+        }
+        return;
+    }
+    // Fallback: encrypted file
     ensureSonomaDir();
     const data = JSON.stringify(credentials, null, 2);
     const encrypted = encrypt(data);
-    writeFileSync(CREDENTIALS_PATH, encrypted, { mode: 0o600 });
+    writeFileSync(LEGACY_CREDENTIALS_PATH, encrypted, { mode: 0o600 });
 }
 /**
- * Clear all stored credentials
+ * Clear all stored credentials.
  */
 export function clearCredentials() {
-    if (existsSync(CREDENTIALS_PATH)) {
-        unlinkSync(CREDENTIALS_PATH);
+    if (keychainAvailable()) {
+        try {
+            keychainDelete(KEYCHAIN_ACCOUNT);
+        }
+        catch { /* ignore */ }
+    }
+    // Always clean up legacy file too
+    if (existsSync(LEGACY_CREDENTIALS_PATH)) {
+        unlinkSync(LEGACY_CREDENTIALS_PATH);
+    }
+}
+/**
+ * Load from legacy encrypted file (pre-keychain migration).
+ */
+function loadLegacyCredentials() {
+    if (!existsSync(LEGACY_CREDENTIALS_PATH)) {
+        return null;
+    }
+    try {
+        const encryptedData = readFileSync(LEGACY_CREDENTIALS_PATH, "utf-8");
+        const decrypted = decrypt(encryptedData);
+        return JSON.parse(decrypted);
+    }
+    catch {
+        return null;
     }
 }
 /**

package/dist/auth/storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/auth/storage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEzF,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAC;AAuBtE;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAsB,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2DAA2D;QAC3D,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,WAA8B;IAC5D,eAAe,EAAE,CAAC;IAElB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhC,aAAa,CAAC,gBAAgB,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACjC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,KAAwB;IACpD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,QAAQ;QACvC,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3F,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,MAAmB,EAAE,QAA4B;IAC/E,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAExF,OAAO;QACL,GAAG,QAAQ;QACX,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,QAAQ,EAAE,YAAY;QAC5D,SAAS;QACT,SAAS,EAAE,MAAM,CAAC,UAAU;QAC5B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE;KAC1B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAwB;IAC1D,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,wBAAwB,EAAE,KAAK,CAAC,qBAAqB;KACtD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,KAAwB,EAAE,QAAQ,GAAG,KAAK;IACvE,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,KAAwB;IACtD,OAAO,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,WAAW,EAAE,CAAC;AACvB,CAAC"}
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/auth/storage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE5F,MAAM,gBAAgB,GAAG,aAAa,CAAC;AACvC,mCAAmC;AACnC,MAAM,uBAAuB,GAAG,IAAI,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAC;AAuB7E;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,wBAAwB;IACxB,IAAI,iBAAiB,EAAE,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,WAAW,CAAoB,gBAAgB,CAAC,CAAC;YAC/D,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;QAED,kDAAkD;QAClD,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACvC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,WAAW,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;gBACtC,kDAAkD;gBAClD,UAAU,CAAC,uBAAuB,CAAC,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,qDAAqD;YACvD,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yCAAyC;IACzC,OAAO,qBAAqB,EAAE,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,WAA8B;IAC5D,IAAI,iBAAiB,EAAE,EAAE,CAAC;QACxB,WAAW,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;QAE3C,oCAAoC;QACpC,IAAI,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC;gBAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACrE,CAAC;QACD,OAAO;IACT,CAAC;IAED,2BAA2B;IAC3B,eAAe,EAAE,CAAC;IAClB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,aAAa,CAAC,uBAAuB,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,iBAAiB,EAAE,EAAE,CAAC;QACxB,IAAI,CAAC;YAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAClE,CAAC;IACD,kCAAkC;IAClC,IAAI,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;QACxC,UAAU,CAAC,uBAAuB,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB;IAC5B,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,YAAY,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAsB,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,KAAwB;IACpD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,QAAQ;QACvC,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3F,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,MAAmB,EAAE,QAA4B;IAC/E,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAExF,OAAO;QACL,GAAG,QAAQ;QACX,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,QAAQ,EAAE,YAAY;QAC5D,SAAS;QACT,SAAS,EAAE,MAAM,CAAC,UAAU;QAC5B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE;KAC1B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAwB;IAC1D,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,wBAAwB,EAAE,KAAK,CAAC,qBAAqB;KACtD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,KAAwB,EAAE,QAAQ,GAAG,KAAK;IACvE,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,KAAwB;IACtD,OAAO,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,WAAW,EAAE,CAAC;AACvB,CAAC"}

package/dist/auth/upstream-oauth.d.ts

@@ -20,6 +20,8 @@ export interface AuthenticateUpstreamOptions {
         clientId: string;
         callbackPort?: number;
     };
+    /** Override the default callback port (19843). Used to give each server a unique port for parallel auth. */
+    callbackPort?: number;
 }
 /**
  * Authenticate with an upstream MCP server that requires OAuth.

package/dist/auth/upstream-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-oauth.d.ts","sourceRoot":"","sources":["../../src/auth/upstream-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAMpE,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8GAA8G;IAC9G,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,2FAA2F;IAC3F,KAAK,CAAC,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;CACH;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAsEhC"}
+{"version":3,"file":"upstream-oauth.d.ts","sourceRoot":"","sources":["../../src/auth/upstream-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAMpE,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8GAA8G;IAC9G,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,2FAA2F;IAC3F,KAAK,CAAC,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,4GAA4G;IAC5G,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAwGhC"}

package/dist/auth/upstream-oauth.js

@@ -33,7 +33,9 @@ export async function authenticateUpstream(options) {
         }
     };
     store.setServerName(serverUrl, serverName);
-    const callbackPort = oauth?.callbackPort ?? UPSTREAM_CALLBACK_PORT;
+    // Pre-registered OAuth callbackPort takes priority because the redirect URI
+    // is fixed in the OAuth provider's app config (e.g., Slack only allows port 3118)
+    const callbackPort = oauth?.callbackPort ?? options.callbackPort ?? UPSTREAM_CALLBACK_PORT;
     const provider = new UpstreamOAuthProvider({
         serverUrl,
         store,
@@ -56,17 +58,49 @@ export async function authenticateUpstream(options) {
         throw new Error(`Auth flow returned REDIRECT but no authorization URL was captured for ${serverName}`);
     }
     const authUrl = provider.pendingAuthorizationUrl.toString();
+    // Try to start callback server (acquires the port atomically)
+    let handle;
+    try {
+        handle = await startCallbackServer({
+            port: callbackPort,
+            debug,
+            serverName,
+        });
+    }
+    catch (err) {
+        // Port taken: another gateway may be authenticating this server, or a
+        // stale process is holding the port. Wait briefly (15s) for tokens to
+        // appear; if not, try to take the port anyway (the stale process may
+        // have died by then).
+        if (err instanceof Error && err.message.includes("already in use")) {
+            log(`Port ${callbackPort} in use for ${serverName}, waiting briefly for external auth...`);
+            console.error(`\nPort ${callbackPort} in use. Waiting briefly for ${serverName} auth to complete...`);
+            const completed = await waitForUpstreamAuth(store, serverUrl, callbackPort, debug, 15_000);
+            if (completed) {
+                log(`Upstream auth for ${serverName} completed by another process`);
+                const retryResult = await auth(provider, { serverUrl });
+                if (retryResult === "AUTHORIZED")
+                    return provider;
+            }
+            log(`External auth did not complete for ${serverName}, retrying port...`);
+            handle = await startCallbackServer({
+                port: callbackPort,
+                debug,
+                serverName,
+            });
+        }
+        else {
+            throw err;
+        }
+    }
+    // Set auth URL on handle so the timeout page can offer a retry button
+    handle.setAuthUrl(authUrl);
+    // Port acquired: now safe to open browser (no duplicate tabs possible)
     console.error(`\nOpening browser to authenticate with ${serverName}...`);
     console.error(`If browser doesn't open, visit:\n${authUrl}\n`);
-    // Start callback server and open browser
-    const callbackPromise = startCallbackServer({
-        port: callbackPort,
-        debug,
-        serverName,
-    });
     await openBrowser(authUrl);
     // Wait for the authorization code
-    const callbackResult = await callbackPromise;
+    const callbackResult = await handle.waitForCallback();
     // State validation is handled internally by the MCP SDK's auth() function.
     // The provider's codeVerifier storage implicitly binds the session.
     log(`Received authorization code from ${serverName}`);
@@ -81,4 +115,20 @@ export async function authenticateUpstream(options) {
     log(`Successfully authenticated with ${serverName}`);
     return provider;
 }
+/**
+ * Wait for another gateway process to complete upstream OAuth.
+ * Polls the token store until tokens appear or timeout.
+ */
+async function waitForUpstreamAuth(store, serverUrl, _port, _debug, timeoutMs = 5 * 60 * 1000) {
+    const start = Date.now();
+    const pollInterval = 2000;
+    while (Date.now() - start < timeoutMs) {
+        await new Promise((r) => setTimeout(r, pollInterval));
+        const tokens = store.getTokens(serverUrl);
+        if (tokens?.access_token) {
+            return true;
+        }
+    }
+    return false;
+}
 //# sourceMappingURL=upstream-oauth.js.map

package/dist/auth/upstream-oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-oauth.js","sourceRoot":"","sources":["../../src/auth/upstream-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,0CAA0C,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAgBrC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAoC;IAEpC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,KAAK,EAAE,eAAe,GAAG,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAEhG,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,EAAE;QAC1B,IAAI,KAAK,EAAE,CAAC;YACV,uDAAuD;YACvD,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,EAAE,CAAC,CAAC,CAAC,iCAAiC;QAC7E,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,CAAC,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAE3C,MAAM,YAAY,GAAG,KAAK,EAAE,YAAY,IAAI,sBAAsB,CAAC;IAEnE,MAAM,QAAQ,GAAG,IAAI,qBAAqB,CAAC;QACzC,SAAS;QACT,KAAK;QACL,YAAY;QACZ,KAAK;QACL,qBAAqB,EAAE,KAAK,EAAE,QAAQ;KACvC,CAAC,CAAC;IAEH,kFAAkF;IAClF,GAAG,CAAC,uBAAuB,UAAU,KAAK,SAAS,MAAM,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAEnD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5B,GAAG,CAAC,2BAA2B,UAAU,EAAE,CAAC,CAAC;QAC7C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,iEAAiE;IACjE,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,kCAAkC,UAAU,+CAA+C,CAAC,CAAC;IAC/G,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,yEAAyE,UAAU,EAAE,CAAC,CAAC;IACzG,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,uBAAuB,CAAC,QAAQ,EAAE,CAAC;IAC5D,OAAO,CAAC,KAAK,CAAC,0CAA0C,UAAU,KAAK,CAAC,CAAC;IACzE,OAAO,CAAC,KAAK,CAAC,oCAAoC,OAAO,IAAI,CAAC,CAAC;IAE/D,yCAAyC;IACzC,MAAM,eAAe,GAAG,mBAAmB,CAAC;QAC1C,IAAI,EAAE,YAAY;QAClB,KAAK;QACL,UAAU;KACX,CAAC,CAAC;IACH,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAE3B,kCAAkC;IAClC,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC;IAC7C,2EAA2E;IAC3E,oEAAoE;IACpE,GAAG,CAAC,oCAAoC,UAAU,EAAE,CAAC,CAAC;IAEtD,iEAAiE;IACjE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE;QAC1C,SAAS;QACT,iBAAiB,EAAE,cAAc,CAAC,IAAI;KACvC,CAAC,CAAC;IAEH,IAAI,cAAc,KAAK,YAAY,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,6BAA6B,UAAU,wBAAwB,cAAc,GAAG,CAAC,CAAC;IACpG,CAAC;IAED,GAAG,CAAC,mCAAmC,UAAU,EAAE,CAAC,CAAC;IACrD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"upstream-oauth.js","sourceRoot":"","sources":["../../src/auth/upstream-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,0CAA0C,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAkBrC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAoC;IAEpC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,KAAK,EAAE,eAAe,GAAG,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAEhG,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,EAAE;QAC1B,IAAI,KAAK,EAAE,CAAC;YACV,uDAAuD;YACvD,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,EAAE,CAAC,CAAC,CAAC,iCAAiC;QAC7E,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,CAAC,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAE3C,4EAA4E;IAC5E,kFAAkF;IAClF,MAAM,YAAY,GAAG,KAAK,EAAE,YAAY,IAAI,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC;IAE3F,MAAM,QAAQ,GAAG,IAAI,qBAAqB,CAAC;QACzC,SAAS;QACT,KAAK;QACL,YAAY;QACZ,KAAK;QACL,qBAAqB,EAAE,KAAK,EAAE,QAAQ;KACvC,CAAC,CAAC;IAEH,kFAAkF;IAClF,GAAG,CAAC,uBAAuB,UAAU,KAAK,SAAS,MAAM,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAEnD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5B,GAAG,CAAC,2BAA2B,UAAU,EAAE,CAAC,CAAC;QAC7C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,iEAAiE;IACjE,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,kCAAkC,UAAU,+CAA+C,CAAC,CAAC;IAC/G,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,yEAAyE,UAAU,EAAE,CAAC,CAAC;IACzG,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,uBAAuB,CAAC,QAAQ,EAAE,CAAC;IAE5D,8DAA8D;IAC9D,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACjC,IAAI,EAAE,YAAY;YAClB,KAAK;YACL,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,sBAAsB;QACtB,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,QAAQ,YAAY,eAAe,UAAU,wCAAwC,CAAC,CAAC;YAC3F,OAAO,CAAC,KAAK,CAAC,UAAU,YAAY,gCAAgC,UAAU,sBAAsB,CAAC,CAAC;YACtG,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC3F,IAAI,SAAS,EAAE,CAAC;gBACd,GAAG,CAAC,qBAAqB,UAAU,+BAA+B,CAAC,CAAC;gBACpE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;gBACxD,IAAI,WAAW,KAAK,YAAY;oBAAE,OAAO,QAAQ,CAAC;YACpD,CAAC;YACD,GAAG,CAAC,sCAAsC,UAAU,oBAAoB,CAAC,CAAC;YAC1E,MAAM,GAAG,MAAM,mBAAmB,CAAC;gBACjC,IAAI,EAAE,YAAY;gBAClB,KAAK;gBACL,UAAU;aACX,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAE3B,uEAAuE;IACvE,OAAO,CAAC,KAAK,CAAC,0CAA0C,UAAU,KAAK,CAAC,CAAC;IACzE,OAAO,CAAC,KAAK,CAAC,oCAAoC,OAAO,IAAI,CAAC,CAAC;IAE/D,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAE3B,kCAAkC;IAClC,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;IACtD,2EAA2E;IAC3E,oEAAoE;IACpE,GAAG,CAAC,oCAAoC,UAAU,EAAE,CAAC,CAAC;IAEtD,iEAAiE;IACjE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE;QAC1C,SAAS;QACT,iBAAiB,EAAE,cAAc,CAAC,IAAI;KACvC,CAAC,CAAC;IAEH,IAAI,cAAc,KAAK,YAAY,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,6BAA6B,UAAU,wBAAwB,cAAc,GAAG,CAAC,CAAC;IACpG,CAAC;IAED,GAAG,CAAC,mCAAmC,UAAU,EAAE,CAAC,CAAC;IACrD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,mBAAmB,CAChC,KAAyB,EACzB,SAAiB,EACjB,KAAa,EACb,MAAe,EACf,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI;IAEzB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,YAAY,GAAG,IAAI,CAAC;IAE1B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,MAAM,EAAE,YAAY,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/auth/upstream-token-store.d.ts

@@ -1,16 +1,28 @@
 /**
  * Per-server token storage for upstream MCP servers that require OAuth.
  *
- * Stores credentials in ~/.sonoma/upstream-credentials.json, encrypted with
- * the same AES-256-GCM scheme used for Sonoma gateway credentials.
- * Each server is keyed by its URL origin (e.g., "https://mcp.sentry.dev").
+ * Stores credentials in the OS keychain (macOS Keychain, Windows Credential Manager),
+ * keyed by server URL origin (e.g., "https://mcp.slack.com").
+ *
+ * Falls back to encrypted file storage on unsupported platforms.
  */
 import type { OAuthTokens, OAuthClientInformationMixed } from "@modelcontextprotocol/sdk/shared/auth.js";
 export declare class UpstreamTokenStore {
-    private store;
-    private load;
-    private save;
+    private useKeychain;
+    private fileStore;
+    private migrated;
+    constructor();
+    /**
+     * Migrate credentials from legacy encrypted file to OS keychain.
+     */
+    private migrateLegacy;
+    private getServerFromKeychain;
+    private saveServerToKeychain;
+    private loadFile;
+    private saveFile;
+    private getServerFromFile;
     private getServer;
+    private saveServer;
     getTokens(serverUrl: string): OAuthTokens | undefined;
     saveTokens(serverUrl: string, tokens: OAuthTokens): void;
     clearTokens(serverUrl: string): void;

package/dist/auth/upstream-token-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-token-store.d.ts","sourceRoot":"","sources":["../../src/auth/upstream-token-store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAsBzG,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,KAAK,CAAwC;IAErD,OAAO,CAAC,IAAI;IAoBZ,OAAO,CAAC,IAAI;IAOZ,OAAO,CAAC,SAAS;IASjB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAIrD,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,IAAI;IAOxD,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAMpC,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,2BAA2B,GAAG,SAAS;IAIzE,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,GAAG,IAAI;IAM1E,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAMxC,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAItD,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAM3D,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAMpD,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI3D,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAOjC,mDAAmD;IACnD,eAAe,IAAI,IAAI;CAIxB"}
+{"version":3,"file":"upstream-token-store.d.ts","sourceRoot":"","sources":["../../src/auth/upstream-token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AA4BzG,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,WAAW,CAAU;IAE7B,OAAO,CAAC,SAAS,CAAwC;IAEzD,OAAO,CAAC,QAAQ,CAAS;;IAYzB;;OAEG;IACH,OAAO,CAAC,aAAa;IA6BrB,OAAO,CAAC,qBAAqB;IAK7B,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,QAAQ;IAmBhB,OAAO,CAAC,QAAQ;IAOhB,OAAO,CAAC,iBAAiB;IAazB,OAAO,CAAC,SAAS;IAOjB,OAAO,CAAC,UAAU;IAWlB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAIrD,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,IAAI;IAOxD,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAMpC,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,2BAA2B,GAAG,SAAS;IAIzE,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,GAAG,IAAI;IAM1E,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAMxC,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAItD,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAM3D,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAMpD,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI3D,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAYjC,mDAAmD;IACnD,eAAe,IAAI,IAAI;CAQxB"}

package/dist/auth/upstream-token-store.js

@@ -1,53 +1,131 @@
 /**
  * Per-server token storage for upstream MCP servers that require OAuth.
  *
- * Stores credentials in ~/.sonoma/upstream-credentials.json, encrypted with
- * the same AES-256-GCM scheme used for Sonoma gateway credentials.
- * Each server is keyed by its URL origin (e.g., "https://mcp.sentry.dev").
+ * Stores credentials in the OS keychain (macOS Keychain, Windows Credential Manager),
+ * keyed by server URL origin (e.g., "https://mcp.slack.com").
+ *
+ * Falls back to encrypted file storage on unsupported platforms.
  */
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync, writeFileSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { SONOMA_DIR, ensureSonomaDir, encrypt, decrypt } from "./crypto.js";
-const UPSTREAM_CREDENTIALS_PATH = join(SONOMA_DIR, "upstream-credentials.json");
+import { keychainAvailable, keychainGet, keychainSet, keychainDelete, keychainDeleteAll } from "./keychain.js";
+// Legacy file path (for migration from encrypted file)
+const LEGACY_CREDENTIALS_PATH = join(SONOMA_DIR, "upstream-credentials.json");
 function getServerKey(serverUrl) {
     const url = new URL(serverUrl);
     return url.origin;
 }
+function keychainAccount(serverKey) {
+    return `upstream:${serverKey}`;
+}
 export class UpstreamTokenStore {
-    store = null;
-    load() {
-        if (this.store)
-            return this.store;
-        if (!existsSync(UPSTREAM_CREDENTIALS_PATH)) {
-            this.store = { servers: {} };
-            return this.store;
+    useKeychain;
+    // In-memory cache for file-based fallback only
+    fileStore = null;
+    // Track whether legacy migration has been attempted
+    migrated = false;
+    constructor() {
+        this.useKeychain = keychainAvailable();
+        // Migrate legacy file to keychain on first use
+        if (this.useKeychain && !this.migrated) {
+            this.migrateLegacy();
+            this.migrated = true;
+        }
+    }
+    /**
+     * Migrate credentials from legacy encrypted file to OS keychain.
+     */
+    migrateLegacy() {
+        if (!existsSync(LEGACY_CREDENTIALS_PATH))
+            return;
+        try {
+            const encryptedData = readFileSync(LEGACY_CREDENTIALS_PATH, "utf-8");
+            const decrypted = decrypt(encryptedData);
+            const store = JSON.parse(decrypted);
+            if (store.servers) {
+                for (const [key, creds] of Object.entries(store.servers)) {
+                    try {
+                        keychainSet(keychainAccount(key), creds);
+                    }
+                    catch {
+                        // Skip entries that fail to migrate
+                    }
+                }
+            }
+            // Clean up legacy file after successful migration
+            unlinkSync(LEGACY_CREDENTIALS_PATH);
+        }
+        catch {
+            // Migration failed, legacy file may be corrupt
+        }
+    }
+    // ---------------------------------------------------------------------------
+    // Keychain-backed operations
+    // ---------------------------------------------------------------------------
+    getServerFromKeychain(serverUrl) {
+        const key = getServerKey(serverUrl);
+        return keychainGet(keychainAccount(key)) ?? {};
+    }
+    saveServerToKeychain(serverUrl, creds) {
+        const key = getServerKey(serverUrl);
+        keychainSet(keychainAccount(key), creds);
+    }
+    // ---------------------------------------------------------------------------
+    // File-backed fallback (Linux, etc.)
+    // ---------------------------------------------------------------------------
+    loadFile() {
+        if (this.fileStore)
+            return this.fileStore;
+        if (!existsSync(LEGACY_CREDENTIALS_PATH)) {
+            this.fileStore = { servers: {} };
+            return this.fileStore;
         }
         try {
-            const encryptedData = readFileSync(UPSTREAM_CREDENTIALS_PATH, "utf-8");
+            const encryptedData = readFileSync(LEGACY_CREDENTIALS_PATH, "utf-8");
             const decrypted = decrypt(encryptedData);
-            this.store = JSON.parse(decrypted);
-            return this.store;
+            this.fileStore = JSON.parse(decrypted);
+            return this.fileStore;
         }
         catch {
-            // If decryption fails (e.g., machine changed), start fresh
-            this.store = { servers: {} };
-            return this.store;
+            this.fileStore = { servers: {} };
+            return this.fileStore;
         }
     }
-    save() {
+    saveFile() {
         ensureSonomaDir();
-        const data = JSON.stringify(this.load(), null, 2);
+        const data = JSON.stringify(this.loadFile(), null, 2);
         const encrypted = encrypt(data);
-        writeFileSync(UPSTREAM_CREDENTIALS_PATH, encrypted, { mode: 0o600 });
+        writeFileSync(LEGACY_CREDENTIALS_PATH, encrypted, { mode: 0o600 });
     }
-    getServer(serverUrl) {
-        const store = this.load();
+    getServerFromFile(serverUrl) {
+        const store = this.loadFile();
         const key = getServerKey(serverUrl);
         if (!store.servers[key]) {
             store.servers[key] = {};
         }
         return store.servers[key];
     }
+    // ---------------------------------------------------------------------------
+    // Public API (delegates to keychain or file based on platform)
+    // ---------------------------------------------------------------------------
+    getServer(serverUrl) {
+        if (this.useKeychain) {
+            return this.getServerFromKeychain(serverUrl);
+        }
+        return this.getServerFromFile(serverUrl);
+    }
+    saveServer(serverUrl, creds) {
+        if (this.useKeychain) {
+            this.saveServerToKeychain(serverUrl, creds);
+        }
+        else {
+            const store = this.loadFile();
+            const key = getServerKey(serverUrl);
+            store.servers[key] = creds;
+            this.saveFile();
+        }
+    }
     getTokens(serverUrl) {
         return this.getServer(serverUrl).tokens;
     }
@@ -55,12 +133,12 @@ export class UpstreamTokenStore {
         const server = this.getServer(serverUrl);
         server.tokens = tokens;
         server.lastAuthenticated = Date.now();
-        this.save();
+        this.saveServer(serverUrl, server);
     }
     clearTokens(serverUrl) {
         const server = this.getServer(serverUrl);
         delete server.tokens;
-        this.save();
+        this.saveServer(serverUrl, server);
     }
     getClientInfo(serverUrl) {
         return this.getServer(serverUrl).clientInfo;
@@ -68,12 +146,12 @@ export class UpstreamTokenStore {
     saveClientInfo(serverUrl, info) {
         const server = this.getServer(serverUrl);
         server.clientInfo = info;
-        this.save();
+        this.saveServer(serverUrl, server);
     }
     clearClientInfo(serverUrl) {
         const server = this.getServer(serverUrl);
         delete server.clientInfo;
-        this.save();
+        this.saveServer(serverUrl, server);
     }
     getCodeVerifier(serverUrl) {
         return this.getServer(serverUrl).codeVerifier;
@@ -81,26 +159,40 @@ export class UpstreamTokenStore {
     saveCodeVerifier(serverUrl, verifier) {
         const server = this.getServer(serverUrl);
         server.codeVerifier = verifier;
-        this.save();
+        this.saveServer(serverUrl, server);
     }
     setServerName(serverUrl, name) {
         const server = this.getServer(serverUrl);
         server.serverName = name;
-        this.save();
+        this.saveServer(serverUrl, server);
     }
     getLastAuthenticated(serverUrl) {
         return this.getServer(serverUrl).lastAuthenticated;
     }
     clearAll(serverUrl) {
-        const store = this.load();
-        const key = getServerKey(serverUrl);
-        delete store.servers[key];
-        this.save();
+        if (this.useKeychain) {
+            const key = getServerKey(serverUrl);
+            try {
+                keychainDelete(keychainAccount(key));
+            }
+            catch { /* ignore */ }
+        }
+        else {
+            const store = this.loadFile();
+            const key = getServerKey(serverUrl);
+            delete store.servers[key];
+            this.saveFile();
+        }
     }
     /** Clear credentials for every upstream server. */
     clearAllServers() {
-        this.store = { servers: {} };
-        this.save();
+        if (this.useKeychain) {
+            keychainDeleteAll();
+        }
+        else {
+            this.fileStore = { servers: {} };
+            this.saveFile();
+        }
     }
 }
 //# sourceMappingURL=upstream-token-store.js.map

package/dist/auth/upstream-token-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-token-store.js","sourceRoot":"","sources":["../../src/auth/upstream-token-store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE5E,MAAM,yBAAyB,GAAG,IAAI,CAAC,UAAU,EAAE,2BAA2B,CAAC,CAAC;AAchF,SAAS,YAAY,CAAC,SAAiB;IACrC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,MAAM,OAAO,kBAAkB;IACrB,KAAK,GAAmC,IAAI,CAAC;IAE7C,IAAI;QACV,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QAElC,IAAI,CAAC,UAAU,CAAC,yBAAyB,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,YAAY,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;YACvE,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAA4B,CAAC;YAC9D,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;YAC3D,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IAEO,IAAI;QACV,eAAe,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,aAAa,CAAC,yBAAyB,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC;IAEO,SAAS,CAAC,SAAiB;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,SAAS,CAAC,SAAiB;QACzB,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;IAC1C,CAAC;IAED,UAAU,CAAC,SAAiB,EAAE,MAAmB;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QACvB,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,WAAW,CAAC,SAAiB;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzC,OAAO,MAAM,CAAC,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,aAAa,CAAC,SAAiB;QAC7B,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC;IAC9C,CAAC;IAED,cAAc,CAAC,SAAiB,EAAE,IAAiC;QACjE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,eAAe,CAAC,SAAiB;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzC,OAAO,MAAM,CAAC,UAAU,CAAC;QACzB,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,eAAe,CAAC,SAAiB;QAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC;IAChD,CAAC;IAED,gBAAgB,CAAC,SAAiB,EAAE,QAAgB;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,YAAY,GAAG,QAAQ,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,aAAa,CAAC,SAAiB,EAAE,IAAY;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,oBAAoB,CAAC,SAAiB;QACpC,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,iBAAiB,CAAC;IACrD,CAAC;IAED,QAAQ,CAAC,SAAiB;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACpC,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,mDAAmD;IACnD,eAAe;QACb,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"upstream-token-store.js","sourceRoot":"","sources":["../../src/auth/upstream-token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAE/G,uDAAuD;AACvD,MAAM,uBAAuB,GAAG,IAAI,CAAC,UAAU,EAAE,2BAA2B,CAAC,CAAC;AAc9E,SAAS,YAAY,CAAC,SAAiB;IACrC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB;IACxC,OAAO,YAAY,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,OAAO,kBAAkB;IACrB,WAAW,CAAU;IAC7B,+CAA+C;IACvC,SAAS,GAAmC,IAAI,CAAC;IACzD,oDAAoD;IAC5C,QAAQ,GAAG,KAAK,CAAC;IAEzB;QACE,IAAI,CAAC,WAAW,GAAG,iBAAiB,EAAE,CAAC;QAEvC,+CAA+C;QAC/C,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvC,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,aAAa;QACnB,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC;YAAE,OAAO;QAEjD,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,YAAY,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;YACrE,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAA4B,CAAC;YAE/D,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;oBACzD,IAAI,CAAC;wBACH,WAAW,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;oBAC3C,CAAC;oBAAC,MAAM,CAAC;wBACP,oCAAoC;oBACtC,CAAC;gBACH,CAAC;YACH,CAAC;YAED,kDAAkD;YAClD,UAAU,CAAC,uBAAuB,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,6BAA6B;IAC7B,8EAA8E;IAEtE,qBAAqB,CAAC,SAAiB;QAC7C,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACpC,OAAO,WAAW,CAAoB,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,CAAC;IAEO,oBAAoB,CAAC,SAAiB,EAAE,KAAwB;QACtE,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACpC,WAAW,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,8EAA8E;IAC9E,qCAAqC;IACrC,8EAA8E;IAEtE,QAAQ;QACd,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC;QAE1C,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,SAAS,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,SAAS,CAAC;QACxB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,YAAY,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;YACrE,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;YACzC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAA4B,CAAC;YAClE,OAAO,IAAI,CAAC,SAAS,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,SAAS,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,SAAS,CAAC;QACxB,CAAC;IACH,CAAC;IAEO,QAAQ;QACd,eAAe,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,aAAa,CAAC,uBAAuB,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;IAEO,iBAAiB,CAAC,SAAiB;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,8EAA8E;IAC9E,+DAA+D;IAC/D,8EAA8E;IAEtE,SAAS,CAAC,SAAiB;QACjC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IAEO,UAAU,CAAC,SAAiB,EAAE,KAAwB;QAC5D,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;YACpC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC3B,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAED,SAAS,CAAC,SAAiB;QACzB,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;IAC1C,CAAC;IAED,UAAU,CAAC,SAAiB,EAAE,MAAmB;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QACvB,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,WAAW,CAAC,SAAiB;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzC,OAAO,MAAM,CAAC,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,aAAa,CAAC,SAAiB;QAC7B,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC;IAC9C,CAAC;IAED,cAAc,CAAC,SAAiB,EAAE,IAAiC;QACjE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,eAAe,CAAC,SAAiB;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzC,OAAO,MAAM,CAAC,UAAU,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,eAAe,CAAC,SAAiB;QAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC;IAChD,CAAC;IAED,gBAAgB,CAAC,SAAiB,EAAE,QAAgB;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,YAAY,GAAG,QAAQ,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,aAAa,CAAC,SAAiB,EAAE,IAAY;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,oBAAoB,CAAC,SAAiB;QACpC,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,iBAAiB,CAAC;IACrD,CAAC;IAED,QAAQ,CAAC,SAAiB;QACxB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,CAAC;gBAAC,cAAc,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;YACpC,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,eAAe;QACb,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,iBAAiB,EAAE,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;CACF"}

package/dist/cli.js

@@ -123,6 +123,7 @@ async function main() {
             status: { type: "boolean" },
             reauth: { type: "boolean" },
             endpoint: { type: "string", short: "e" },
+            "http-proxy-port": { type: "string" },
         },
         strict: true,
     });
@@ -362,6 +363,16 @@ async function main() {
             }
         }
     }
+    // HTTP proxy mode: expose per-server HTTP endpoints for plugin URL rewriting
+    if (values["http-proxy-port"]) {
+        const port = parseInt(values["http-proxy-port"], 10);
+        if (Number.isNaN(port) || port < 1 || port > 65535) {
+            console.error(`Invalid HTTP proxy port: ${values["http-proxy-port"]}`);
+            process.exit(2);
+        }
+        config.httpProxyPort = port;
+        console.error(`[cli] HTTP proxy mode enabled on port ${port}`);
+    }
     const gateway = new McpGateway(config);
     // Handle shutdown gracefully
     const shutdown = async () => {
@@ -408,6 +419,11 @@ AUTH OPTIONS:
   --reauth              Clear upstream OAuth tokens and re-authenticate
   -e, --endpoint <url>  Sonoma API endpoint (default: https://app.sonoma.dev)
 
+PROXY OPTIONS:
+  --http-proxy-port <port>  Expose per-server HTTP endpoints for plugin proxying.
+                            Each server is available at http://localhost:{port}/proxy/{name}/mcp.
+                            Plugins can rewrite URLs to these endpoints to keep skills active.
+
 QUICKSTART (zero-config):
   Add to your ~/.cursor/mcp.json or Claude Desktop config:
   {