@trops/dash-core 0.1.610 → 0.1.612

package/dist/index.js

@@ -954,6 +954,8 @@ var MCP_GET_CATALOG_COMPLETE = "mcp:get-catalog:complete";
 var MCP_GET_CATALOG_ERROR = "mcp:get-catalog:error";
 var MCP_RUN_AUTH_COMPLETE = "mcp:run-auth:complete";
 var MCP_RUN_AUTH_ERROR = "mcp:run-auth:error";
+var MCP_AUTHORIZE_COMPLETE = "mcp:authorize:complete";
+var MCP_AUTHORIZE_ERROR = "mcp:authorize:error";
 
 var DATA_JSON_TO_CSV_FILE = "data-json-to-csv-file";
 var DATA_JSON_TO_CSV_FILE_COMPLETE = "data-json-to-csv-file-complete";
@@ -1049,6 +1051,8 @@ var apiEvents = /*#__PURE__*/Object.freeze({
   LAYOUT_LIST: LAYOUT_LIST,
   LAYOUT_LIST_COMPLETE: LAYOUT_LIST_COMPLETE,
   LAYOUT_LIST_ERROR: LAYOUT_LIST_ERROR,
+  MCP_AUTHORIZE_COMPLETE: MCP_AUTHORIZE_COMPLETE,
+  MCP_AUTHORIZE_ERROR: MCP_AUTHORIZE_ERROR,
   MCP_CALL_TOOL_COMPLETE: MCP_CALL_TOOL_COMPLETE,
   MCP_CALL_TOOL_ERROR: MCP_CALL_TOOL_ERROR,
   MCP_GET_CATALOG_COMPLETE: MCP_GET_CATALOG_COMPLETE,
@@ -1653,9 +1657,10 @@ var ElectronDashboardApi = /*#__PURE__*/function () {
       var _this20 = this;
       var workspaceId = arguments.length > 5 && arguments[5] !== undefined ? arguments[5] : null;
       var pathScope = arguments.length > 6 && arguments[6] !== undefined ? arguments[6] : null;
+      var appId = arguments.length > 7 && arguments[7] !== undefined ? arguments[7] : null;
       if (this.api !== null) {
         try {
-          this.api.mcp.startServer(serverName, mcpConfig, credentials, workspaceId, pathScope).then(function (result) {
+          this.api.mcp.startServer(serverName, mcpConfig, credentials, workspaceId, pathScope, appId !== null && appId !== void 0 ? appId : this.appId).then(function (result) {
             onSuccess(_this20.events.MCP_START_SERVER_COMPLETE, result);
           })["catch"](function (error) {
             onError(_this20.events.MCP_START_SERVER_ERROR, error);
@@ -1881,6 +1886,28 @@ var ElectronDashboardApi = /*#__PURE__*/function () {
         return false;
       }
     }
+  }, {
+    key: "mcpAuthorize",
+    value: function mcpAuthorize(serverName, mcpConfig, credentials, onSuccess, onError) {
+      var _this30 = this;
+      var appId = arguments.length > 5 && arguments[5] !== undefined ? arguments[5] : null;
+      if (this.api !== null) {
+        try {
+          this.api.mcp.authorize(serverName, mcpConfig, credentials, appId !== null && appId !== void 0 ? appId : this.appId).then(function (result) {
+            onSuccess(_this30.events.MCP_AUTHORIZE_COMPLETE, result);
+          })["catch"](function (error) {
+            onError(_this30.events.MCP_AUTHORIZE_ERROR, error);
+          });
+          return true;
+        } catch (e) {
+          onError(this.events.MCP_AUTHORIZE_ERROR, e);
+          return false;
+        }
+      } else {
+        onError(this.events.MCP_AUTHORIZE_ERROR, new Error("No Api found"));
+        return false;
+      }
+    }
   }]);
 }();
 
@@ -2154,6 +2181,12 @@ var WebDashboardApi = /*#__PURE__*/function () {
       onError === null || onError === void 0 ? void 0 : onError("mcp:run-auth:error", new Error("MCP not available in web mode"));
       return false;
     }
+  }, {
+    key: "mcpAuthorize",
+    value: function mcpAuthorize(serverName, mcpConfig, credentials, onSuccess, onError) {
+      onError === null || onError === void 0 ? void 0 : onError("mcp:authorize:error", new Error("MCP not available in web mode"));
+      return false;
+    }
   }]);
 }();
 
@@ -33496,7 +33529,7 @@ var useMcpProvider = function useMcpProvider(providerType) {
                 consumerCount: 0
               });
               reject(err);
-            }, workspaceId, pathScope);
+            }, workspaceId, pathScope, app === null || app === void 0 ? void 0 : app.appId);
           });
           pendingConnects$1.set(stateKey, connectPromise);
           _context.prev = 24;
@@ -43351,7 +43384,7 @@ var ProviderDetail = function ProviderDetail(_ref) {
   });
 };
 
-var _excluded$1 = ["transport", "command", "args", "envMapping", "url", "headerTemplate", "headers"];
+var _excluded$1 = ["transport", "command", "args", "envMapping", "url", "headerTemplate", "headers", "auth", "oauth"];
 function ownKeys$v(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
 function _objectSpread$v(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$v(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$v(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 var DirectoryListField = function DirectoryListField(_ref) {
@@ -43479,9 +43512,20 @@ function buildMcpConfig(transport, _ref3) {
     args = _ref3.args,
     envMappingRows = _ref3.envMappingRows,
     url = _ref3.url,
-    headerRows = _ref3.headerRows;
+    headerRows = _ref3.headerRows,
+    _ref3$authType = _ref3.authType,
+    authType = _ref3$authType === void 0 ? "apiKey" : _ref3$authType,
+    _ref3$oauthScopes = _ref3.oauthScopes,
+    oauthScopes = _ref3$oauthScopes === void 0 ? "" : _ref3$oauthScopes,
+    _ref3$oauthClientId = _ref3.oauthClientId,
+    oauthClientId = _ref3$oauthClientId === void 0 ? "" : _ref3$oauthClientId,
+    _ref3$oauthClientSecr = _ref3.oauthClientSecret,
+    oauthClientSecret = _ref3$oauthClientSecr === void 0 ? "" : _ref3$oauthClientSecr;
   var baseConfig = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
   // Everything on baseConfig that the form doesn't own gets preserved.
+  // `auth`/`oauth` are owned by the form's auth-type selector, so they're
+  // excluded here and re-emitted below based on the current selection
+  // (this is how toggling away from OAuth clears them).
   baseConfig.transport;
     baseConfig.command;
     baseConfig.args;
@@ -43489,6 +43533,8 @@ function buildMcpConfig(transport, _ref3) {
     baseConfig.url;
     baseConfig.headerTemplate;
     baseConfig.headers;
+    baseConfig.auth;
+    baseConfig.oauth;
     var passThrough = _objectWithoutProperties(baseConfig, _excluded$1);
   if (transport === "stdio") {
     var envMapping = {};
@@ -43508,6 +43554,23 @@ function buildMcpConfig(transport, _ref3) {
   }
 
   // streamable_http
+  var config = _objectSpread$v(_objectSpread$v({}, passThrough), {}, {
+    transport: "streamable_http",
+    url: url.trim()
+  });
+  if (authType === "oauth") {
+    // Interactive OAuth 2.0 (SDK-native). Scopes optional; clientId/secret
+    // only for servers without Dynamic Client Registration.
+    config.auth = "oauth";
+    var oauth = {};
+    if (oauthScopes.trim()) oauth.scopes = oauthScopes.trim();
+    if (oauthClientId.trim()) oauth.clientId = oauthClientId.trim();
+    if (oauthClientSecret.trim()) oauth.clientSecret = oauthClientSecret.trim();
+    config.oauth = oauth;
+    return config;
+  }
+
+  // apiKey (header template) — also the path for "none" (no headers added)
   var headerTemplate = {};
   headerRows.forEach(function (row) {
     var name = row.headerName.trim();
@@ -43516,11 +43579,7 @@ function buildMcpConfig(transport, _ref3) {
       headerTemplate[name] = value;
     }
   });
-  var config = _objectSpread$v(_objectSpread$v({}, passThrough), {}, {
-    transport: "streamable_http",
-    url: url.trim()
-  });
-  if (Object.keys(headerTemplate).length > 0) {
+  if (authType === "apiKey" && Object.keys(headerTemplate).length > 0) {
     config.headerTemplate = headerTemplate;
   }
   return config;
@@ -43549,7 +43608,7 @@ function buildMcpConfig(transport, _ref3) {
  *   preserved verbatim on save so editing never silently drops them.
  */
 var CustomMcpServerForm = function CustomMcpServerForm(_ref4) {
-  var _testResult$tools;
+  var _initialMcpConfig$oau, _initialMcpConfig$oau2, _initialMcpConfig$oau3, _initialMcpConfig$oau4, _initialMcpConfig$oau5, _testResult$tools;
   var onSave = _ref4.onSave,
     onBack = _ref4.onBack,
     _ref4$isEditMode = _ref4.isEditMode,
@@ -43635,41 +43694,67 @@ var CustomMcpServerForm = function CustomMcpServerForm(_ref4) {
     headerRows = _useState22[0],
     setHeaderRows = _useState22[1];
 
-  // Tool selection state
-  var _useState23 = React.useState(initialAllowedTools),
+  // HTTP auth type: "none" | "apiKey" | "oauth"
+  var _useState23 = React.useState(function () {
+      var cfg = initialMcpConfig || {};
+      if (cfg.auth === "oauth" || cfg.oauth) return "oauth";
+      return "apiKey";
+    }),
     _useState24 = _slicedToArray(_useState23, 2),
-    selectedTools = _useState24[0],
-    setSelectedTools = _useState24[1];
-
-  // Wizard step state
-  var _useState25 = React.useState(0),
+    authType = _useState24[0],
+    setAuthType = _useState24[1];
+  var _useState25 = React.useState((initialMcpConfig === null || initialMcpConfig === void 0 || (_initialMcpConfig$oau = initialMcpConfig.oauth) === null || _initialMcpConfig$oau === void 0 ? void 0 : _initialMcpConfig$oau.scopes) || ""),
     _useState26 = _slicedToArray(_useState25, 2),
-    wizardStep = _useState26[0],
-    setWizardStep = _useState26[1];
-
-  // Auth state
-  var _useState27 = React.useState(false),
+    oauthScopes = _useState26[0],
+    setOauthScopes = _useState26[1];
+  var _useState27 = React.useState((initialMcpConfig === null || initialMcpConfig === void 0 || (_initialMcpConfig$oau2 = initialMcpConfig.oauth) === null || _initialMcpConfig$oau2 === void 0 ? void 0 : _initialMcpConfig$oau2.clientId) || ""),
     _useState28 = _slicedToArray(_useState27, 2),
-    isAuthorizing = _useState28[0],
-    setIsAuthorizing = _useState28[1];
-  var _useState29 = React.useState(null),
+    oauthClientId = _useState28[0],
+    setOauthClientId = _useState28[1];
+  var _useState29 = React.useState((initialMcpConfig === null || initialMcpConfig === void 0 || (_initialMcpConfig$oau3 = initialMcpConfig.oauth) === null || _initialMcpConfig$oau3 === void 0 ? void 0 : _initialMcpConfig$oau3.clientSecret) || ""),
     _useState30 = _slicedToArray(_useState29, 2),
-    authResult = _useState30[0],
-    setAuthResult = _useState30[1];
-
-  // JSON editor state
-  var _useState31 = React.useState("form"),
+    oauthClientSecret = _useState30[0],
+    setOauthClientSecret = _useState30[1];
+  var _useState31 = React.useState(!!(initialMcpConfig !== null && initialMcpConfig !== void 0 && (_initialMcpConfig$oau4 = initialMcpConfig.oauth) !== null && _initialMcpConfig$oau4 !== void 0 && _initialMcpConfig$oau4.clientId || initialMcpConfig !== null && initialMcpConfig !== void 0 && (_initialMcpConfig$oau5 = initialMcpConfig.oauth) !== null && _initialMcpConfig$oau5 !== void 0 && _initialMcpConfig$oau5.clientSecret)),
     _useState32 = _slicedToArray(_useState31, 2),
-    viewMode = _useState32[0],
-    setViewMode = _useState32[1]; // "form" | "json"
-  var _useState33 = React.useState(""),
+    showOauthAdvanced = _useState32[0],
+    setShowOauthAdvanced = _useState32[1];
+
+  // Tool selection state
+  var _useState33 = React.useState(initialAllowedTools),
     _useState34 = _slicedToArray(_useState33, 2),
-    jsonText = _useState34[0],
-    setJsonText = _useState34[1];
-  var _useState35 = React.useState(null),
+    selectedTools = _useState34[0],
+    setSelectedTools = _useState34[1];
+
+  // Wizard step state
+  var _useState35 = React.useState(0),
     _useState36 = _slicedToArray(_useState35, 2),
-    jsonError = _useState36[0],
-    setJsonError = _useState36[1];
+    wizardStep = _useState36[0],
+    setWizardStep = _useState36[1];
+
+  // Auth state
+  var _useState37 = React.useState(false),
+    _useState38 = _slicedToArray(_useState37, 2),
+    isAuthorizing = _useState38[0],
+    setIsAuthorizing = _useState38[1];
+  var _useState39 = React.useState(null),
+    _useState40 = _slicedToArray(_useState39, 2),
+    authResult = _useState40[0],
+    setAuthResult = _useState40[1];
+
+  // JSON editor state
+  var _useState41 = React.useState("form"),
+    _useState42 = _slicedToArray(_useState41, 2),
+    viewMode = _useState42[0],
+    setViewMode = _useState42[1]; // "form" | "json"
+  var _useState43 = React.useState(""),
+    _useState44 = _slicedToArray(_useState43, 2),
+    jsonText = _useState44[0],
+    setJsonText = _useState44[1];
+  var _useState45 = React.useState(null),
+    _useState46 = _slicedToArray(_useState45, 2),
+    jsonError = _useState46[0],
+    setJsonError = _useState46[1];
 
   // Clear credential data when transport changes (derived fields change entirely)
   // Only in create mode — in edit mode the initial transport is set correctly
@@ -43681,8 +43766,11 @@ var CustomMcpServerForm = function CustomMcpServerForm(_ref4) {
     }
   }, [transport, isEditMode]);
 
-  // Dynamic wizard steps based on whether auth is needed
-  var hasAuth = !!initialAuthCommand;
+  // Dynamic wizard steps based on whether auth is needed. Either a
+  // catalog-provided subprocess authCommand (legacy) or an OAuth 2.0
+  // custom server adds an "Authorize" step before Test & Tools.
+  var isOAuth = transport === "streamable_http" && authType === "oauth";
+  var hasAuth = !!initialAuthCommand || isOAuth;
   var wizardSteps = hasAuth ? ["configure", "authorize", "testTools"] : ["configure", "testTools"];
   var totalSteps = wizardSteps.length;
   var currentStepType = wizardSteps[wizardStep];
@@ -43711,9 +43799,13 @@ var CustomMcpServerForm = function CustomMcpServerForm(_ref4) {
       args: args,
       envMappingRows: envMappingRows,
       url: url,
-      headerRows: headerRows
+      headerRows: headerRows,
+      authType: authType,
+      oauthScopes: oauthScopes,
+      oauthClientId: oauthClientId,
+      oauthClientSecret: oauthClientSecret
     }, initialMcpConfig || {});
-  }, [transport, command, args, envMappingRows, url, headerRows, initialMcpConfig]);
+  }, [transport, command, args, envMappingRows, url, headerRows, authType, oauthScopes, oauthClientId, oauthClientSecret, initialMcpConfig]);
 
   // Invalidate test result when config changes after a test
   var mcpConfigRef = React.useRef(mcpConfig);
@@ -43911,10 +44003,10 @@ var CustomMcpServerForm = function CustomMcpServerForm(_ref4) {
 
   // --- authorize (OAuth browser flow) ---
   var handleAuthorize = function handleAuthorize() {
-    if (!dashApi || !initialAuthCommand) return;
+    if (!dashApi) return;
     setIsAuthorizing(true);
     setAuthResult(null);
-    dashApi.mcpRunAuth(mcpConfig, credentialData, initialAuthCommand, function (event, result) {
+    var onComplete = function onComplete(event, result) {
       if (result.error) {
         setAuthResult({
           success: false,
@@ -43927,13 +44019,22 @@ var CustomMcpServerForm = function CustomMcpServerForm(_ref4) {
         });
       }
       setIsAuthorizing(false);
-    }, function (event, err) {
+    };
+    var onFail = function onFail(event, err) {
       setAuthResult({
         success: false,
         message: (err === null || err === void 0 ? void 0 : err.message) || "Authorization failed"
       });
       setIsAuthorizing(false);
-    });
+    };
+    if (isOAuth) {
+      // SDK-native OAuth 2.0: opens the system browser, persists tokens.
+      dashApi.mcpAuthorize(providerName.trim() || "__test__custom", mcpConfig, credentialData, onComplete, onFail, appContext === null || appContext === void 0 ? void 0 : appContext.appId);
+      return;
+    }
+    if (!initialAuthCommand) return;
+    // Legacy catalog subprocess auth (e.g. bundled Google servers).
+    dashApi.mcpRunAuth(mcpConfig, credentialData, initialAuthCommand, onComplete, onFail);
   };
 
   // --- save ---
@@ -44242,7 +44343,82 @@ var CustomMcpServerForm = function CustomMcpServerForm(_ref4) {
                     className: "text-sm text-red-400",
                     children: formErrors.url
                   })]
-                }), /*#__PURE__*/jsxRuntime.jsxs("div", {
+                }), /*#__PURE__*/jsxRuntime.jsx("div", {
+                  className: "flex flex-col gap-2",
+                  children: /*#__PURE__*/jsxRuntime.jsx(DashReact.RadioGroup, {
+                    label: "Authentication",
+                    name: "mcp-http-auth-type",
+                    value: authType,
+                    onChange: function onChange(value) {
+                      setAuthType(value);
+                      setAuthResult(null);
+                    },
+                    options: [{
+                      value: "none",
+                      label: "None"
+                    }, {
+                      value: "apiKey",
+                      label: "API key (headers)"
+                    }, {
+                      value: "oauth",
+                      label: "OAuth 2.0 (browser sign-in)"
+                    }]
+                  })
+                }), authType === "oauth" && /*#__PURE__*/jsxRuntime.jsxs("div", {
+                  className: "space-y-3",
+                  children: [/*#__PURE__*/jsxRuntime.jsxs("div", {
+                    className: "flex flex-col gap-2",
+                    children: [/*#__PURE__*/jsxRuntime.jsx(DashReact.FormLabel, {
+                      label: "Scopes"
+                    }), /*#__PURE__*/jsxRuntime.jsx("p", {
+                      className: "text-sm opacity-50",
+                      children: "Space-separated OAuth scopes (optional \u2014 many servers grant defaults)."
+                    }), /*#__PURE__*/jsxRuntime.jsx(DashReact.InputText, {
+                      value: oauthScopes,
+                      onChange: setOauthScopes,
+                      placeholder: "e.g., read write offline_access"
+                    })]
+                  }), /*#__PURE__*/jsxRuntime.jsxs("button", {
+                    type: "button",
+                    onClick: function onClick() {
+                      return setShowOauthAdvanced(function (v) {
+                        return !v;
+                      });
+                    },
+                    className: "text-sm text-blue-400 hover:text-blue-300 transition-colors flex items-center gap-1 self-start",
+                    children: [/*#__PURE__*/jsxRuntime.jsx(DashReact.FontAwesomeIcon, {
+                      icon: showOauthAdvanced ? "chevron-down" : "chevron-right",
+                      className: "text-xs"
+                    }), /*#__PURE__*/jsxRuntime.jsx("span", {
+                      children: "Advanced: pre-registered client"
+                    })]
+                  }), showOauthAdvanced && /*#__PURE__*/jsxRuntime.jsxs("div", {
+                    className: "space-y-3 pl-1",
+                    children: [/*#__PURE__*/jsxRuntime.jsx("p", {
+                      className: "text-sm opacity-50",
+                      children: "Only needed for servers that don't support Dynamic Client Registration. Leave blank otherwise."
+                    }), /*#__PURE__*/jsxRuntime.jsxs("div", {
+                      className: "flex flex-col gap-2",
+                      children: [/*#__PURE__*/jsxRuntime.jsx(DashReact.FormLabel, {
+                        label: "Client ID"
+                      }), /*#__PURE__*/jsxRuntime.jsx(DashReact.InputText, {
+                        value: oauthClientId,
+                        onChange: setOauthClientId,
+                        placeholder: "Client ID"
+                      })]
+                    }), /*#__PURE__*/jsxRuntime.jsxs("div", {
+                      className: "flex flex-col gap-2",
+                      children: [/*#__PURE__*/jsxRuntime.jsx(DashReact.FormLabel, {
+                        label: "Client secret"
+                      }), /*#__PURE__*/jsxRuntime.jsx(DashReact.InputText, {
+                        type: "password",
+                        value: oauthClientSecret,
+                        onChange: setOauthClientSecret,
+                        placeholder: "Client secret (if required)"
+                      })]
+                    })]
+                  })]
+                }), authType === "apiKey" && /*#__PURE__*/jsxRuntime.jsxs("div", {
                   className: "space-y-3",
                   children: [/*#__PURE__*/jsxRuntime.jsxs("div", {
                     children: [/*#__PURE__*/jsxRuntime.jsx(DashReact.FormLabel, {
@@ -44383,7 +44559,7 @@ var CustomMcpServerForm = function CustomMcpServerForm(_ref4) {
               className: "flex flex-col items-center justify-center py-8 space-y-4",
               children: [/*#__PURE__*/jsxRuntime.jsx("p", {
                 className: "text-sm opacity-60 text-center max-w-md",
-                children: "This server requires OAuth authorization. Click the button below to open a browser window and complete the authentication flow."
+                children: isOAuth ? "This server uses OAuth 2.0. Click below to open your browser, sign in, and approve access. Dash stores the resulting tokens securely and refreshes them automatically." : "This server requires OAuth authorization. Click the button below to open a browser window and complete the authentication flow."
               }), /*#__PURE__*/jsxRuntime.jsx(DashReact.Button, {
                 title: isAuthorizing ? "Authorizing..." : "Authorize",
                 onClick: handleAuthorize,
@@ -44404,7 +44580,18 @@ var CustomMcpServerForm = function CustomMcpServerForm(_ref4) {
               children: [/*#__PURE__*/jsxRuntime.jsx("p", {
                 className: "text-xs font-semibold opacity-40 uppercase tracking-wider",
                 children: "Troubleshooting"
-              }), /*#__PURE__*/jsxRuntime.jsxs("ul", {
+              }), isOAuth ? /*#__PURE__*/jsxRuntime.jsxs("ul", {
+                className: "text-sm opacity-60 space-y-1 list-disc list-inside",
+                children: [/*#__PURE__*/jsxRuntime.jsx("li", {
+                  children: "Make sure a browser window opened \u2014 check for a blocked pop-up or default-browser prompt"
+                }), /*#__PURE__*/jsxRuntime.jsx("li", {
+                  children: "Allow Dash to accept the local sign-in redirect if your firewall prompts"
+                }), /*#__PURE__*/jsxRuntime.jsx("li", {
+                  children: "Verify the server URL is correct and the scopes are valid for this server"
+                }), /*#__PURE__*/jsxRuntime.jsx("li", {
+                  children: "For servers without dynamic registration, set a Client ID under \"Advanced\""
+                })]
+              }) : /*#__PURE__*/jsxRuntime.jsxs("ul", {
                 className: "text-sm opacity-60 space-y-1 list-disc list-inside",
                 children: [/*#__PURE__*/jsxRuntime.jsx("li", {
                   children: "Ensure Node.js and npx are available in your PATH"
@@ -52009,18 +52196,35 @@ var McpServerSection = function McpServerSection() {
   });
 };
 
+/**
+ * modelMigration.js (renderer mirror)
+ *
+ * Mirrors the retired-model map + default from the main-process provider
+ * registry (electron/llm/modelProviders.js) so the Settings UI can detect a
+ * stale saved selection, auto-migrate it, and show a notice — without an IPC
+ * round-trip. KEEP IN SYNC with modelProviders.js (anthropic provider).
+ */
+var DEFAULT_MODEL = "claude-opus-4-8";
+var RETIRED_MODEL_MAP = {
+  "claude-sonnet-4-20250514": "claude-sonnet-4-6",
+  "claude-opus-4-20250514": "claude-opus-4-8",
+  "claude-opus-4-1-20250805": "claude-opus-4-8",
+  "claude-3-7-sonnet-20250219": "claude-sonnet-4-6",
+  "claude-3-5-sonnet-20241022": "claude-sonnet-4-6",
+  "claude-3-5-sonnet-20240620": "claude-sonnet-4-6",
+  "claude-3-5-haiku-20241022": "claude-haiku-4-5",
+  "claude-3-opus-20240229": "claude-opus-4-8"
+};
+function isRetiredModel(id) {
+  return !!RETIRED_MODEL_MAP[id];
+}
+function migrateModelId(id) {
+  if (!id) return DEFAULT_MODEL;
+  return RETIRED_MODEL_MAP[id] || id;
+}
+
 function ownKeys$m(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
 function _objectSpread$m(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$m(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$m(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
-var MODELS = [{
-  value: "claude-sonnet-4-20250514",
-  label: "Claude Sonnet 4"
-}, {
-  value: "claude-opus-4-20250514",
-  label: "Claude Opus 4"
-}, {
-  value: "claude-haiku-4-5-20251001",
-  label: "Claude Haiku 4.5"
-}];
 var BACKENDS = [{
   value: "claude-code",
   label: "Claude Code CLI"
@@ -52029,6 +52233,7 @@ var BACKENDS = [{
   label: "Anthropic API"
 }];
 var AiAssistantSection = function AiAssistantSection() {
+  var _anthropicProvider$;
   var appContext = React.useContext(AppContext);
   var settings = (appContext === null || appContext === void 0 ? void 0 : appContext.settings) || {};
   var providers = (appContext === null || appContext === void 0 ? void 0 : appContext.providers) || {};
@@ -52046,7 +52251,7 @@ var AiAssistantSection = function AiAssistantSection() {
     _useState4 = _slicedToArray(_useState3, 2),
     preferredBackend = _useState4[0],
     setPreferredBackend = _useState4[1];
-  var _useState5 = React.useState(aiSettings.model || "claude-sonnet-4-20250514"),
+  var _useState5 = React.useState(aiSettings.model || DEFAULT_MODEL),
     _useState6 = _slicedToArray(_useState5, 2),
     selectedModel = _useState6[0],
     setSelectedModel = _useState6[1];
@@ -52063,6 +52268,21 @@ var AiAssistantSection = function AiAssistantSection() {
     saveKeyStatus = _useState10[0],
     setSaveKeyStatus = _useState10[1];
 
+  // Provider-pluggable model discovery (live fetch + curated fallback)
+  var _useState11 = React.useState([]),
+    _useState12 = _slicedToArray(_useState11, 2),
+    availableModels = _useState12[0],
+    setAvailableModels = _useState12[1];
+  var _useState13 = React.useState(false),
+    _useState14 = _slicedToArray(_useState13, 2),
+    modelsLoading = _useState14[0],
+    setModelsLoading = _useState14[1];
+  // One-time notice when a retired saved model was auto-migrated
+  var _useState15 = React.useState(null),
+    _useState16 = _slicedToArray(_useState15, 2),
+    migrationNotice = _useState16[0],
+    setMigrationNotice = _useState16[1];
+
   // Find existing Anthropic provider
   var anthropicProvider = Object.entries(providers).find(function (_ref) {
     var _ref2 = _slicedToArray(_ref, 2),
@@ -52071,6 +52291,9 @@ var AiAssistantSection = function AiAssistantSection() {
   });
   var hasAnthropicProvider = !!anthropicProvider;
   var anthropicProviderName = anthropicProvider === null || anthropicProvider === void 0 ? void 0 : anthropicProvider[0];
+  // Decrypted key (when AppContext exposes it) enables the live Models API
+  // fetch; without it, listModels returns the curated fallback list.
+  var anthropicApiKey = (anthropicProvider === null || anthropicProvider === void 0 || (_anthropicProvider$ = anthropicProvider[1]) === null || _anthropicProvider$ === void 0 || (_anthropicProvider$ = _anthropicProvider$.credentials) === null || _anthropicProvider$ === void 0 ? void 0 : _anthropicProvider$.apiKey) || null;
 
   // Check CLI availability on mount
   React.useEffect(function () {
@@ -52092,6 +52315,28 @@ var AiAssistantSection = function AiAssistantSection() {
     }
   }, []);
 
+  // Fetch selectable models for the current provider. With an API key the
+  // main process does a live Anthropic Models API fetch; otherwise it returns
+  // the curated fallback. Provider is "anthropic" for both current backends.
+  var fetchModels = React.useCallback(function () {
+    var _window$mainApi2;
+    if (!((_window$mainApi2 = window.mainApi) !== null && _window$mainApi2 !== void 0 && (_window$mainApi2 = _window$mainApi2.llm) !== null && _window$mainApi2 !== void 0 && _window$mainApi2.listModels)) return;
+    setModelsLoading(true);
+    window.mainApi.llm.listModels("anthropic", anthropicApiKey).then(function (res) {
+      return setAvailableModels(res && res.models || []);
+    })["catch"](function () {
+      return setAvailableModels([]);
+    })["finally"](function () {
+      return setModelsLoading(false);
+    });
+  }, [anthropicApiKey]);
+
+  // Load models on mount and whenever the available API key changes (so the
+  // list upgrades from curated → live once a key is configured).
+  React.useEffect(function () {
+    fetchModels();
+  }, [fetchModels]);
+
   // Save AI settings to app settings
   var saveAiSettings = React.useCallback(function (updates) {
     if (appContext !== null && appContext !== void 0 && appContext.changeSettings) {
@@ -52102,6 +52347,24 @@ var AiAssistantSection = function AiAssistantSection() {
       }));
     }
   }, [appContext]);
+
+  // Auto-migrate a retired saved model to its current replacement (one-time,
+  // on mount) so an old selection can't 404 the assistant. Shows a notice.
+  React.useEffect(function () {
+    var saved = aiSettings.model;
+    if (saved && isRetiredModel(saved)) {
+      var replacement = migrateModelId(saved);
+      setSelectedModel(replacement);
+      saveAiSettings({
+        model: replacement
+      });
+      setMigrationNotice({
+        from: saved,
+        to: replacement
+      });
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
   function handleBackendChange(e) {
     var value = e.target.value;
     setPreferredBackend(value);
@@ -52145,6 +52408,15 @@ var AiAssistantSection = function AiAssistantSection() {
     });
   }
 
+  // Model dropdown options — keep the current selection selectable even if it
+  // isn't in the fetched list (e.g. a pinned/custom id).
+  var modelOptions = selectedModel && !availableModels.some(function (m) {
+    return m.value === selectedModel;
+  }) ? [{
+    value: selectedModel,
+    label: selectedModel
+  }].concat(_toConsumableArray(availableModels)) : availableModels;
+
   // Determine effective backend (what will actually be used)
   var effectiveBackend = preferredBackend === "claude-code" && cliStatus !== null && cliStatus !== void 0 && cliStatus.available ? "claude-code" : preferredBackend === "anthropic" && hasAnthropicProvider ? "anthropic" : cliStatus !== null && cliStatus !== void 0 && cliStatus.available ? "claude-code" : hasAnthropicProvider ? "anthropic" : null;
   return /*#__PURE__*/jsxRuntime.jsxs("div", {
@@ -52241,6 +52513,18 @@ var AiAssistantSection = function AiAssistantSection() {
             }, b.value);
           })
         })]
+      }), migrationNotice && /*#__PURE__*/jsxRuntime.jsxs("div", {
+        className: "flex items-start gap-2 rounded-lg bg-yellow-900/30 border border-yellow-700 px-3 py-2 text-xs text-yellow-300",
+        children: [/*#__PURE__*/jsxRuntime.jsx(DashReact.FontAwesomeIcon, {
+          icon: "exclamation-triangle",
+          className: "h-3.5 w-3.5 mt-0.5"
+        }), /*#__PURE__*/jsxRuntime.jsxs("span", {
+          children: ["Your previously selected model (", /*#__PURE__*/jsxRuntime.jsx("code", {
+            children: migrationNotice.from
+          }), ") is no longer available. Switched to ", /*#__PURE__*/jsxRuntime.jsx("code", {
+            children: migrationNotice.to
+          }), "."]
+        })]
       }), /*#__PURE__*/jsxRuntime.jsxs("div", {
         className: "flex flex-row items-center justify-between py-1",
         children: [/*#__PURE__*/jsxRuntime.jsxs("div", {
@@ -52250,18 +52534,31 @@ var AiAssistantSection = function AiAssistantSection() {
             children: "Model"
           }), /*#__PURE__*/jsxRuntime.jsx("span", {
             className: "text-xs opacity-50",
-            children: "Claude model for AI Assistant conversations"
+            children: "Model for AI Assistant conversations"
+          })]
+        }), /*#__PURE__*/jsxRuntime.jsxs("div", {
+          className: "flex items-center gap-2",
+          children: [/*#__PURE__*/jsxRuntime.jsx("select", {
+            value: selectedModel,
+            onChange: handleModelChange,
+            className: "bg-white/10 border border-white/10 rounded-md px-3 py-1.5 text-sm text-gray-200 focus:outline-none focus:ring-1 focus:ring-blue-500",
+            children: modelOptions.map(function (m) {
+              return /*#__PURE__*/jsxRuntime.jsx("option", {
+                value: m.value,
+                children: m.label
+              }, m.value);
+            })
+          }), /*#__PURE__*/jsxRuntime.jsx("button", {
+            type: "button",
+            onClick: fetchModels,
+            disabled: modelsLoading,
+            title: "Refresh available models",
+            className: "text-gray-400 hover:text-gray-200 disabled:opacity-40 transition-colors p-1.5",
+            children: /*#__PURE__*/jsxRuntime.jsx(DashReact.FontAwesomeIcon, {
+              icon: "rotate",
+              className: "h-3.5 w-3.5 ".concat(modelsLoading ? "animate-spin" : "")
+            })
           })]
-        }), /*#__PURE__*/jsxRuntime.jsx("select", {
-          value: selectedModel,
-          onChange: handleModelChange,
-          className: "bg-white/10 border border-white/10 rounded-md px-3 py-1.5 text-sm text-gray-200 focus:outline-none focus:ring-1 focus:ring-blue-500",
-          children: MODELS.map(function (m) {
-            return /*#__PURE__*/jsxRuntime.jsx("option", {
-              value: m.value,
-              children: m.label
-            }, m.value);
-          })
         })]
       })]
     }), !hasAnthropicProvider && /*#__PURE__*/jsxRuntime.jsxs("div", {
@@ -68452,6 +68749,8 @@ exports.LayoutGridContainer = LayoutGridContainer;
 exports.LayoutManagerModal = LayoutManagerModal;
 exports.LayoutModel = LayoutModel;
 exports.LayoutQuickAddMenu = LayoutQuickAddMenu;
+exports.MCP_AUTHORIZE_COMPLETE = MCP_AUTHORIZE_COMPLETE;
+exports.MCP_AUTHORIZE_ERROR = MCP_AUTHORIZE_ERROR;
 exports.MCP_CALL_TOOL_COMPLETE = MCP_CALL_TOOL_COMPLETE;
 exports.MCP_CALL_TOOL_ERROR = MCP_CALL_TOOL_ERROR;
 exports.MCP_GET_CATALOG_COMPLETE = MCP_GET_CATALOG_COMPLETE;