@x-code-cli/core 0.2.10 → 0.3.0

package/dist/mcp/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/mcp/loader.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,wEAAwE;AACxE,gEAAgE;AAChE,yDAAyD;AACzD,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,iBAAiB,IAAI,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACvE,OAAO,EAEL,WAAW,EAGX,gBAAgB,EAChB,aAAa,GACd,MAAM,eAAe,CAAA;AACtB,OAAO,EAAoB,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AA2CjH;;gCAEgC;AAChC,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IASrC;IACC,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC,iBAAiB,EAAE,CAAC,CAAA;IACrE,MAAM,cAAc,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,CAAA;IAClG,OAAO,cAAc,CAAC;QACpB,WAAW;QACX,cAAc;QACd,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,GAAG;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,eAAe,EAAE,IAAI,CAAC,eAAe;KACtC,CAAC,CAAA;AACJ,CAAC;AAED;;;+DAG+D;AAC/D,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAQ/C;IAKC,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC,iBAAiB,EAAE,CAAC,CAAA;IACrE,MAAM,cAAc,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,CAAA;IAElG,MAAM,YAAY,GAA6C,EAAE,CAAA;IACjE,IAAI,cAAc,GAAG,KAAK,CAAA;IAE1B,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAA;IACjD,YAAY,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;IACpG,MAAM,aAAa,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAA;IACvD,YAAY,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;IAE1G,IAAI,mBAAmB,GAAG,aAAa,CAAC,OAAO,CAAA;IAC/C,IAAI,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAChD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B;gBACE,4DAA4D;gBAC5D,uCAAuC;gBACvC,WAAW;gBACX,cAAc;gBACd,WAAW,EAAE,IAAI,CAAC,GAAG;gBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,EACD,mBAAmB,CACpB,CAAA;YACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,+DAA+D;gBAC/D,0DAA0D;gBAC1D,uDAAuD;gBACvD,mBAAmB,GAAG,EAAE,CAAA;gBACxB,cAAc,GAAG,IAAI,CAAA;YACvB,CAAC;iBAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC7B,mBAAmB,GAAG,EAAE,CAAA;gBACxB,cAAc,GAAG,IAAI,CAAA;YACvB,CAAC;iBAAM,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC9B,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACzC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;gBACjD,CAAC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,kEAAkE;IAClE,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,mBAAmB,EAAE,CAAC,CAChG,CAAA;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,CAAA;AAC1D,CAAC;AAED;+DAC+D;AAC/D,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAoB;IACvD,MAAM,YAAY,GAA6C,EAAE,CAAA;IACjE,IAAI,cAAc,GAAG,KAAK,CAAA;IAE1B,yEAAyE;IACzE,sEAAsE;IACtE,qCAAqC;IACrC,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACzD,YAAY,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;IAEpG,MAAM,aAAa,GAAG,iBAAiB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;IAC/D,YAAY,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;IAE1G,wEAAwE;IACxE,mDAAmD;IACnD,IAAI,mBAAmB,GAAG,aAAa,CAAC,OAAO,CAAA;IAC/C,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAC3D,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;YAC9D,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,OAAO,CAAC,eAAe,EAAE,EAAE,CAAA;gBAC3B,iEAAiE;gBACjE,6CAA6C;gBAC7C,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE,IAAI,EAAE,CAAA;YAC1E,CAAC;YACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,mBAAmB,GAAG,EAAE,CAAA;gBACxB,cAAc,GAAG,IAAI,CAAA;YACvB,CAAC;YACD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,MAAM,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACpD,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;gBACjD,CAAC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,4DAA4D;IAC5D,sEAAsE;IACtE,0DAA0D;IAC1D,kEAAkE;IAClE,oEAAoE;IACpE,kEAAkE;IAClE,+BAA+B;IAC/B,MAAM,MAAM,GAAoC;QAC9C,GAAG,UAAU,CAAC,OAAO;QACrB,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;QAC/B,GAAG,mBAAmB;KACvB,CAAA;IAED,qEAAqE;IACrE,oEAAoE;IACpE,kEAAkE;IAClE,qEAAqE;IACrE,oEAAoE;IACpE,0CAA0C;IAC1C,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO;YACL,QAAQ,EAAE,IAAI,WAAW,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC5G,YAAY;YACZ,cAAc;SACf,CAAA;IACH,CAAC;IAED,kEAAkE;IAClE,2DAA2D;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE;QACnE,OAAO,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAExC,8DAA8D;IAC9D,oEAAoE;IACpE,gEAAgE;IAChE,4CAA4C;IAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAElE,MAAM,KAAK,GAAmB,EAAE,CAAA;IAChC,MAAM,SAAS,GAAuB,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAE/B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YAC5D,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACnB,KAAK,CAAC,IAAI,CAAC;gBACT,YAAY,EAAE,QAAQ;gBACtB,OAAO,EAAE,CAAC,CAAC,IAAI;gBACf,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI;gBACzB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE;gBAChC,WAAW,EAAE,CAAC,CAAC,WAAW;aAC3B,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,SAAS;YAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACpD,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAA0B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IAExE,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QACrC,KAAK;QACL,SAAS;QACT,OAAO;QACP,YAAY,EAAE,OAAO,CAAC,gBAAgB;KACvC,CAAC,CAAA;IAEF,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,CAAA;AACnD,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,OAAoB,EACpB,cAA+C;IAE/C,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI;QACJ,OAAO,EAAE,kBAAkB,CAAC,GAA0D,CAAC;KACxF,CAAC,CAAC,CAAA;IACH,IAAI,CAAC;QACH,OAAO,MAAM,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,iEAAiE;QACjE,wDAAwD;QACxD,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QAChD,OAAO,MAAM,CAAA;IACf,CAAC;AACH,CAAC;AAED;;;sBAGsB;AACtB,KAAK,UAAU,sBAAsB,CAAC,QAAgB;IACpD,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqD,CAAA;QAClF,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAC9D,OAAO,MAAM,CAAC,UAAU,CAAA;QAC1B,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,yBAAyB,EAAE,GAAG,QAAQ,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAClE,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC"}

package/dist/mcp/name-mangling.d.ts

@@ -0,0 +1,11 @@
+export declare const MCP_MAX_NAME_LEN = 64;
+/** Build the model-facing tool name for one MCP tool.
+ *
+ *  `existing` is the set of names already taken in the current registry —
+ *  if the new name collides, we append a 4-char hash of the server name
+ *  to disambiguate. (Hashing the server, not the tool, is intentional:
+ *  the tool name carries the semantic meaning the model relies on; the
+ *  server name is the part the user picked, so the disambiguator is
+ *  more meaningful keyed to it.) */
+export declare function buildCallableName(serverName: string, rawToolName: string, existing: ReadonlySet<string>): string;
+//# sourceMappingURL=name-mangling.d.ts.map

package/dist/mcp/name-mangling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"name-mangling.d.ts","sourceRoot":"","sources":["../../src/mcp/name-mangling.ts"],"names":[],"mappings":"AA8BA,eAAO,MAAM,gBAAgB,KAAK,CAAA;AAkBlC;;;;;;;oCAOoC;AACpC,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,MAAM,CAiChH"}

package/dist/mcp/name-mangling.js

@@ -0,0 +1,82 @@
+// @x-code-cli/core — MCP tool name mangling
+//
+// We expose MCP tools to the model under namespaced names so they can't
+// collide with built-in tools (readFile, shell, ...) and so the model
+// can tell at a glance "this came from server X":
+//
+//     <server>__<tool>
+//
+// Both server and tool names are sanitised: any char outside
+// [A-Za-z0-9_] becomes `_`. We pick `__` (double underscore) as the
+// separator so a tool whose raw name contains a single underscore
+// (very common — `read_file`, `list_issues`) is unambiguous.
+//
+// No `mcp__` umbrella prefix — Claude Code adds one (`mcp__<server>__<tool>`)
+// but it burns tokens per-tool without telling the model anything the
+// description doesn't already carry. Codex and Gemini CLI both omit the
+// prefix; we follow them. "Is this tool MCP or built-in?" routing is a
+// registry lookup in tool-execution.ts, not a name-prefix check.
+//
+// The model-facing tool name has a hard cap at 64 chars (OpenAI's
+// historical limit; Anthropic/Google are higher but 64 keeps us
+// portable). Over-length names are truncated and tagged with a 6-char
+// content hash so two long, similar names still differ.
+//
+// Cross-server name collisions are rare in practice but possible
+// (two servers both expose `read_file`). We resolve them by hashing
+// the server name into a 4-char suffix on whichever entry was added
+// second.
+import { createHash } from 'node:crypto';
+export const MCP_MAX_NAME_LEN = 64;
+function sanitize(part) {
+    // Replace any run of disallowed chars with a single `_`. Trim leading
+    // / trailing underscores so we don't end up with `_server__tool_`.
+    const cleaned = part.replace(/[^A-Za-z0-9_]+/g, '_').replace(/^_+|_+$/g, '');
+    // Empty after sanitisation (e.g. all-CJK server name) → fall back to a
+    // hash so we still produce a stable, valid identifier.
+    if (cleaned === '') {
+        return shortHash(part, 6);
+    }
+    return cleaned;
+}
+function shortHash(input, len) {
+    return createHash('sha256').update(input).digest('hex').slice(0, len);
+}
+/** Build the model-facing tool name for one MCP tool.
+ *
+ *  `existing` is the set of names already taken in the current registry —
+ *  if the new name collides, we append a 4-char hash of the server name
+ *  to disambiguate. (Hashing the server, not the tool, is intentional:
+ *  the tool name carries the semantic meaning the model relies on; the
+ *  server name is the part the user picked, so the disambiguator is
+ *  more meaningful keyed to it.) */
+export function buildCallableName(serverName, rawToolName, existing) {
+    const s = sanitize(serverName);
+    const t = sanitize(rawToolName);
+    let name = `${s}__${t}`;
+    // Over-length: truncate while preserving a content hash so
+    // truncated-different names don't collapse to the same string.
+    if (name.length > MCP_MAX_NAME_LEN) {
+        const hash = shortHash(`${serverName}::${rawToolName}`, 6);
+        const room = MCP_MAX_NAME_LEN - 1 /* underscore */ - hash.length;
+        name = `${(s + '__' + t).slice(0, room)}_${hash}`;
+    }
+    // Collision: append a 4-char server-name hash. If THAT still collides
+    // (theoretically possible across many servers), bump the hash length
+    // until unique — bounded by MCP_MAX_NAME_LEN.
+    if (existing.has(name)) {
+        for (let extra = 4; extra <= 12; extra++) {
+            const suffix = '_' + shortHash(serverName, extra);
+            const candidate = name.length + suffix.length <= MCP_MAX_NAME_LEN
+                ? name + suffix
+                : name.slice(0, MCP_MAX_NAME_LEN - suffix.length) + suffix;
+            if (!existing.has(candidate)) {
+                return candidate;
+            }
+        }
+        // Pathological: just append a random-ish suffix and hope.
+        return name.slice(0, MCP_MAX_NAME_LEN - 9) + '_' + shortHash(name + Date.now(), 8);
+    }
+    return name;
+}
+//# sourceMappingURL=name-mangling.js.map

package/dist/mcp/name-mangling.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"name-mangling.js","sourceRoot":"","sources":["../../src/mcp/name-mangling.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,kDAAkD;AAClD,EAAE;AACF,uBAAuB;AACvB,EAAE;AACF,6DAA6D;AAC7D,oEAAoE;AACpE,kEAAkE;AAClE,6DAA6D;AAC7D,EAAE;AACF,8EAA8E;AAC9E,sEAAsE;AACtE,wEAAwE;AACxE,uEAAuE;AACvE,iEAAiE;AACjE,EAAE;AACF,kEAAkE;AAClE,gEAAgE;AAChE,sEAAsE;AACtE,wDAAwD;AACxD,EAAE;AACF,iEAAiE;AACjE,oEAAoE;AACpE,oEAAoE;AACpE,UAAU;AACV,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAElC,SAAS,QAAQ,CAAC,IAAY;IAC5B,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC5E,uEAAuE;IACvE,uDAAuD;IACvD,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IAC3B,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,GAAW;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACvE,CAAC;AAED;;;;;;;oCAOoC;AACpC,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,WAAmB,EAAE,QAA6B;IACtG,MAAM,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAA;IAC9B,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAA;IAE/B,IAAI,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAA;IAEvB,2DAA2D;IAC3D,+DAA+D;IAC/D,IAAI,IAAI,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,UAAU,KAAK,WAAW,EAAE,EAAE,CAAC,CAAC,CAAA;QAC1D,MAAM,IAAI,GAAG,gBAAgB,GAAG,CAAC,CAAC,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAA;QAChE,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,CAAA;IACnD,CAAC;IAED,sEAAsE;IACtE,qEAAqE;IACrE,8CAA8C;IAC9C,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;YACjD,MAAM,SAAS,GACb,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,gBAAgB;gBAC7C,CAAC,CAAC,IAAI,GAAG,MAAM;gBACf,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;YAC9D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,OAAO,SAAS,CAAA;YAClB,CAAC;QACH,CAAC;QACD,0DAA0D;QAC1D,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,GAAG,GAAG,GAAG,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAA;IACpF,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/mcp/oauth/callback-server.d.ts

@@ -0,0 +1,25 @@
+export interface CallbackResult {
+    code: string;
+    state?: string;
+}
+export interface RunningCallbackServer {
+    /** The full redirect URL to advertise to the auth server. */
+    url: string;
+    /** Resolves with the code/state on the first valid callback request,
+     *  or rejects on timeout / OAuth error response. */
+    waitForCallback: () => Promise<CallbackResult>;
+    /** Stop accepting new connections and free the port. Idempotent. */
+    close: () => void;
+}
+export interface StartOptions {
+    /** Max time to wait (ms). Default 5 minutes. */
+    timeoutMs?: number;
+    /** Path on which the auth server should redirect.
+     *  Default '/callback'. */
+    path?: string;
+}
+/** Start the listener and return control to the caller so it can hand
+ *  the URL to the auth provider. The actual waiting happens via the
+ *  returned `waitForCallback()` promise. */
+export declare function startCallbackServer(options?: StartOptions): Promise<RunningCallbackServer>;
+//# sourceMappingURL=callback-server.d.ts.map

package/dist/mcp/oauth/callback-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-server.d.ts","sourceRoot":"","sources":["../../../src/mcp/oauth/callback-server.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,6DAA6D;IAC7D,GAAG,EAAE,MAAM,CAAA;IACX;wDACoD;IACpD,eAAe,EAAE,MAAM,OAAO,CAAC,cAAc,CAAC,CAAA;IAC9C,oEAAoE;IACpE,KAAK,EAAE,MAAM,IAAI,CAAA;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;+BAC2B;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAKD;;4CAE4C;AAC5C,wBAAsB,mBAAmB,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAmGpG"}

package/dist/mcp/oauth/callback-server.js

@@ -0,0 +1,118 @@
+// @x-code-cli/core — Local OAuth callback receiver
+//
+// Spins up an ephemeral HTTP server on 127.0.0.1:<random-port>/callback,
+// waits for the user's authorization-server redirect, returns the
+// captured `code` + `state` (or error). Auto-closes after the first
+// request (or on timeout).
+//
+// Why ephemeral & random-port:
+//   - A fixed port collides if two CLIs run concurrently.
+//   - Random ports require the OAuth provider to be told the URL after
+//     the listener is up — we expose `start()` returning the actual URL
+//     before resolving any callbacks.
+//
+// Security:
+//   - Bound to 127.0.0.1 only, never 0.0.0.0 — the listener should not
+//     be reachable from other machines.
+//   - We only accept the first matching request; subsequent hits return
+//     a friendly "auth complete, you can close this window" page.
+//   - We do NOT validate `state` here — that's the SDK's job. We just
+//     forward whatever the auth server sent back.
+import http from 'node:http';
+import { debugLog } from '../../utils.js';
+const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;
+const DEFAULT_PATH = '/callback';
+/** Start the listener and return control to the caller so it can hand
+ *  the URL to the auth provider. The actual waiting happens via the
+ *  returned `waitForCallback()` promise. */
+export async function startCallbackServer(options = {}) {
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const expectedPath = options.path ?? DEFAULT_PATH;
+    let resolveOnce = null;
+    let rejectOnce = null;
+    const waiter = new Promise((res, rej) => {
+        resolveOnce = res;
+        rejectOnce = rej;
+    });
+    const server = http.createServer((req, response) => {
+        if (!req.url) {
+            response.writeHead(400).end('missing URL');
+            return;
+        }
+        // Parse against a dummy base — we only care about pathname + search.
+        const u = new URL(req.url, 'http://localhost');
+        if (u.pathname !== expectedPath) {
+            response.writeHead(404).end('not found');
+            return;
+        }
+        const err = u.searchParams.get('error');
+        if (err) {
+            const desc = u.searchParams.get('error_description') ?? '';
+            response
+                .writeHead(400, { 'Content-Type': 'text/html' })
+                .end(`<html><body><h1>Authorization failed</h1><p>${escapeHtml(err)}: ${escapeHtml(desc)}</p></body></html>`);
+            rejectOnce?.(new Error(`OAuth callback error: ${err} ${desc}`.trim()));
+            resolveOnce = null;
+            rejectOnce = null;
+            return;
+        }
+        const code = u.searchParams.get('code');
+        if (!code) {
+            response.writeHead(400).end('missing code');
+            rejectOnce?.(new Error('OAuth callback missing `code` parameter'));
+            resolveOnce = null;
+            rejectOnce = null;
+            return;
+        }
+        const state = u.searchParams.get('state') ?? undefined;
+        response
+            .writeHead(200, { 'Content-Type': 'text/html' })
+            .end(`<html><body style="font-family:system-ui;padding:2rem;max-width:40rem;margin:auto;">` +
+            `<h1>Authorization complete</h1>` +
+            `<p>You can close this tab and return to the X-Code CLI.</p>` +
+            `</body></html>`);
+        resolveOnce?.({ code, state });
+        resolveOnce = null;
+        rejectOnce = null;
+    });
+    // Watch for socket errors so a connection reset doesn't crash the
+    // CLI on Windows where ECONNRESET is more common.
+    server.on('error', (err) => {
+        debugLog('mcp.callback-server-error', String(err));
+        rejectOnce?.(err);
+        resolveOnce = null;
+        rejectOnce = null;
+    });
+    // Bind to ephemeral port. listen(0, '127.0.0.1') asks the OS for any
+    // free port; the actual one comes out of address().
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            server.removeListener('error', reject);
+            resolve();
+        });
+    });
+    const addr = server.address();
+    const url = `http://127.0.0.1:${addr.port}${expectedPath}`;
+    const timeoutHandle = setTimeout(() => {
+        rejectOnce?.(new Error(`OAuth callback timed out after ${timeoutMs}ms`));
+        resolveOnce = null;
+        rejectOnce = null;
+    }, timeoutMs);
+    // Clear the timer on either resolution path.
+    void waiter.finally(() => clearTimeout(timeoutHandle));
+    let closed = false;
+    const close = () => {
+        if (closed)
+            return;
+        closed = true;
+        server.close();
+    };
+    // Auto-close once we've handled the (single) callback.
+    void waiter.finally(close);
+    return { url, waitForCallback: () => waiter, close };
+}
+function escapeHtml(s) {
+    return s.replace(/[&<>"']/g, (c) => c === '&' ? '&amp;' : c === '<' ? '&lt;' : c === '>' ? '&gt;' : c === '"' ? '&quot;' : '&#39;');
+}
+//# sourceMappingURL=callback-server.js.map

package/dist/mcp/oauth/callback-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-server.js","sourceRoot":"","sources":["../../../src/mcp/oauth/callback-server.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,EAAE;AACF,yEAAyE;AACzE,kEAAkE;AAClE,oEAAoE;AACpE,2BAA2B;AAC3B,EAAE;AACF,+BAA+B;AAC/B,0DAA0D;AAC1D,uEAAuE;AACvE,wEAAwE;AACxE,sCAAsC;AACtC,EAAE;AACF,YAAY;AACZ,uEAAuE;AACvE,wCAAwC;AACxC,wEAAwE;AACxE,kEAAkE;AAClE,sEAAsE;AACtE,kDAAkD;AAClD,OAAO,IAAI,MAAM,WAAW,CAAA;AAG5B,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAyBzC,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AACxC,MAAM,YAAY,GAAG,WAAW,CAAA;AAEhC;;4CAE4C;AAC5C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,UAAwB,EAAE;IAClE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAA;IACzD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,IAAI,YAAY,CAAA;IAEjD,IAAI,WAAW,GAAyC,IAAI,CAAA;IAC5D,IAAI,UAAU,GAAgC,IAAI,CAAA;IAElD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACtD,WAAW,GAAG,GAAG,CAAA;QACjB,UAAU,GAAG,GAAG,CAAA;IAClB,CAAC,CAAC,CAAA;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE;QACjD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;YAC1C,OAAM;QACR,CAAC;QACD,qEAAqE;QACrE,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;QAC9C,IAAI,CAAC,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAChC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YACxC,OAAM;QACR,CAAC;QAED,MAAM,GAAG,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAA;YAC1D,QAAQ;iBACL,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;iBAC/C,GAAG,CAAC,+CAA+C,UAAU,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;YAC/G,UAAU,EAAE,CAAC,IAAI,KAAK,CAAC,yBAAyB,GAAG,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;YACtE,WAAW,GAAG,IAAI,CAAA;YAClB,UAAU,GAAG,IAAI,CAAA;YACjB,OAAM;QACR,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;YAC3C,UAAU,EAAE,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAA;YAClE,WAAW,GAAG,IAAI,CAAA;YAClB,UAAU,GAAG,IAAI,CAAA;YACjB,OAAM;QACR,CAAC;QAED,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAA;QACtD,QAAQ;aACL,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;aAC/C,GAAG,CACF,sFAAsF;YACpF,iCAAiC;YACjC,6DAA6D;YAC7D,gBAAgB,CACnB,CAAA;QACH,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC9B,WAAW,GAAG,IAAI,CAAA;QAClB,UAAU,GAAG,IAAI,CAAA;IACnB,CAAC,CAAC,CAAA;IAEF,kEAAkE;IAClE,kDAAkD;IAClD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACzB,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QAClD,UAAU,EAAE,CAAC,GAAG,CAAC,CAAA;QACjB,WAAW,GAAG,IAAI,CAAA;QAClB,UAAU,GAAG,IAAI,CAAA;IACnB,CAAC,CAAC,CAAA;IAEF,qEAAqE;IACrE,oDAAoD;IACpD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC5B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YACtC,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAA;IAC5C,MAAM,GAAG,GAAG,oBAAoB,IAAI,CAAC,IAAI,GAAG,YAAY,EAAE,CAAA;IAE1D,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;QACpC,UAAU,EAAE,CAAC,IAAI,KAAK,CAAC,kCAAkC,SAAS,IAAI,CAAC,CAAC,CAAA;QACxE,WAAW,GAAG,IAAI,CAAA;QAClB,UAAU,GAAG,IAAI,CAAA;IACnB,CAAC,EAAE,SAAS,CAAC,CAAA;IACb,6CAA6C;IAC7C,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAA;IAEtD,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,IAAI,MAAM;YAAE,OAAM;QAClB,MAAM,GAAG,IAAI,CAAA;QACb,MAAM,CAAC,KAAK,EAAE,CAAA;IAChB,CAAC,CAAA;IACD,uDAAuD;IACvD,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAE1B,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,CAAA;AACtD,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CACjC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAC/F,CAAA;AACH,CAAC"}

package/dist/mcp/oauth/provider.d.ts

@@ -0,0 +1,80 @@
+import type { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';
+import type { OAuthClientInformationMixed, OAuthClientMetadata, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
+import { McpTokenStorage } from './token-storage.js';
+export interface CreateProviderOptions {
+    serverName: string;
+    serverUrl: string;
+    storage: McpTokenStorage;
+    /** Callback that should be invoked just before the browser opens,
+     *  e.g. to print "Opening browser for sentry auth..." to the CLI UI. */
+    onOpenBrowser?: (url: string) => void;
+}
+/** Concrete provider, wired up to fetched persisted state + a callback
+ *  server that gets started on demand. Reused across multiple connect /
+ *  refresh attempts for the same server. */
+export declare class McpOAuthProvider implements OAuthClientProvider {
+    private readonly opts;
+    /** Currently-running callback server. We keep a handle so a second
+     *  call to redirectToAuthorization (after a failed first attempt)
+     *  reuses the same port instead of opening another listener. */
+    private callbackServer;
+    /** PKCE verifier — kept in memory only, replaced on each new flow. */
+    private memoryCodeVerifier;
+    /** Pending callback that the SDK will consume via `finishAuth` on
+     *  the transport. Caller of `waitForAuthCode()` retrieves it. */
+    private pendingCode;
+    /** Whether `redirectToAuthorization` should actually launch a browser.
+     *  Default false — booting the CLI with an HTTP MCP server that has
+     *  no stored token must NOT silently open a browser window. The flag
+     *  is flipped on for the duration of `connectWithOAuth` (driven by
+     *  `/mcp auth <name>`) and back off in `finally`. */
+    private interactive;
+    constructor(opts: CreateProviderOptions);
+    /** Caller (client.ts:connectWithOAuth) toggles this around an
+     *  authenticated dance. Outside that window we stay passive. */
+    setInteractive(value: boolean): void;
+    /** Eagerly start the callback server, so the real loopback port is
+     *  available to `redirectUrl` and `clientMetadata.redirect_uris`
+     *  BEFORE the SDK constructs the dynamic-registration request.
+     *
+     *  Why this matters: Sentry (and any auth server that doesn't follow
+     *  RFC 8252 §7.3 strictly) validates the auth-URL `redirect_uri` against
+     *  the value the client registered with. If we register with the
+     *  port-less placeholder and then redirect to a concrete port, the
+     *  server replies "Invalid redirect URI" and the whole flow dies.
+     *  Pre-starting the server ensures registration and authorization use
+     *  the SAME concrete `http://127.0.0.1:<port>/callback`. */
+    prepareForAuth(): Promise<void>;
+    get redirectUrl(): string;
+    get clientMetadata(): OAuthClientMetadata;
+    clientInformation(): Promise<OAuthClientInformationMixed | undefined>;
+    saveClientInformation(info: OAuthClientInformationMixed): Promise<void>;
+    tokens(): Promise<OAuthTokens | undefined>;
+    saveTokens(tokens: OAuthTokens): Promise<void>;
+    saveCodeVerifier(codeVerifier: string): void;
+    codeVerifier(): string;
+    redirectToAuthorization(authorizationUrl: URL): Promise<void>;
+    /** Block until the auth server has redirected back. Resolves with the
+     *  captured code; the caller then calls `transport.finishAuth(code)`
+     *  on the SDK's StreamableHTTPClientTransport.
+     *
+     *  We close the callback server here because we already have the code
+     *  — Sentry won't call us back again on this flow. But we leave
+     *  `memoryCodeVerifier` alive: the SDK reads it during
+     *  `transport.finishAuth(code)`, which the caller runs AFTER this
+     *  promise resolves. Nulling the verifier in this finally block was
+     *  the cause of "No PKCE verifier set — auth flow not in progress".
+     *  Cleanup of the verifier happens either via `cancel()` (abort
+     *  path) or naturally on the next `saveCodeVerifier(...)` call. */
+    waitForAuthCode(): Promise<{
+        code: string;
+        state?: string;
+    }>;
+    /** Drop any in-progress flow without saving. Safe to call any time. */
+    cancel(): void;
+    private ensureCallbackServer;
+}
+/** Factory used by loader.ts. Returns undefined for stdio servers — the
+ *  loader skips OAuth construction for those. */
+export declare function createOAuthProviderFactory(storage: McpTokenStorage, onOpenBrowser?: (serverName: string, url: string) => void): (serverName: string, serverUrl: string) => McpOAuthProvider;
+//# sourceMappingURL=provider.d.ts.map

package/dist/mcp/oauth/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/mcp/oauth/provider.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAA;AACnF,OAAO,KAAK,EACV,2BAA2B,EAC3B,mBAAmB,EACnB,WAAW,EACZ,MAAM,0CAA0C,CAAA;AAMjD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAUpD,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,eAAe,CAAA;IACxB;4EACwE;IACxE,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CACtC;AAED;;4CAE4C;AAC5C,qBAAa,gBAAiB,YAAW,mBAAmB;IAiB9C,OAAO,CAAC,QAAQ,CAAC,IAAI;IAhBjC;;oEAEgE;IAChE,OAAO,CAAC,cAAc,CAAqC;IAC3D,sEAAsE;IACtE,OAAO,CAAC,kBAAkB,CAAsB;IAChD;qEACiE;IACjE,OAAO,CAAC,WAAW,CAAyD;IAC5E;;;;yDAIqD;IACrD,OAAO,CAAC,WAAW,CAAQ;gBAEE,IAAI,EAAE,qBAAqB;IAExD;oEACgE;IAChE,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IAIpC;;;;;;;;;;gEAU4D;IACtD,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAOrC,IAAI,WAAW,IAAI,MAAM,CAcxB;IAED,IAAI,cAAc,IAAI,mBAAmB,CASxC;IAEK,iBAAiB,IAAI,OAAO,CAAC,2BAA2B,GAAG,SAAS,CAAC;IAKrE,qBAAqB,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvE,MAAM,IAAI,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAK1C,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAI5C,YAAY,IAAI,MAAM;IAOhB,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAiCnE;;;;;;;;;;;uEAWmE;IAC7D,eAAe,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAalE,uEAAuE;IACvE,MAAM,IAAI,IAAI;YASA,oBAAoB;CAInC;AA+GD;iDACiD;AACjD,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,eAAe,EACxB,aAAa,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,IAEjD,YAAY,MAAM,EAAE,WAAW,MAAM,KAAG,gBAAgB,CAQjE"}