@xopcai/xopc 0.0.224 → 0.0.225

package/dist/src/connectors/materialize.d.ts

@@ -4,6 +4,7 @@ export declare function materializeConnectorMcpServer(definition: ConnectorDefin
     serverId: string;
     server: Record<string, unknown>;
 };
+export declare function connectorDefinitionFromManagedMarker(marker: unknown): ConnectorDefinition | undefined;
 export declare function isManagedConnectorServer(server: unknown): server is Record<string, unknown> & {
     xopcConnector: ManagedConnectorMarker;
 };

package/dist/src/connectors/materialize.js

@@ -56,6 +56,7 @@ function materializeConnectorMcpServer(definition, input) {
 		displayName: definition.displayName,
 		source: definition.source,
 		artifactSha256: definition.provenance?.sha256,
+		definition,
 		...input.config && Object.keys(input.config).length > 0 ? { config: input.config } : {}
 	};
 	const server = {
@@ -69,10 +70,17 @@ function materializeConnectorMcpServer(definition, input) {
 		server
 	};
 }
+function connectorDefinitionFromManagedMarker(marker) {
+	if (!marker || typeof marker !== "object" || Array.isArray(marker)) return void 0;
+	const definition = marker.definition;
+	if (!definition || typeof definition !== "object" || Array.isArray(definition)) return void 0;
+	const record = definition;
+	return typeof record.id === "string" && typeof record.version === "string" && record.runtime ? record : void 0;
+}
 function isManagedConnectorServer(server) {
 	if (!server || typeof server !== "object" || Array.isArray(server)) return false;
 	const marker = server.xopcConnector;
 	return Boolean(marker && typeof marker === "object" && !Array.isArray(marker) && marker.managed === true && typeof marker.connectorId === "string");
 }
 //#endregion
-export { assertValidConnectorServerId, isManagedConnectorServer, materializeConnectorMcpServer };
+export { assertValidConnectorServerId, connectorDefinitionFromManagedMarker, isManagedConnectorServer, materializeConnectorMcpServer };

package/dist/src/connectors/runtime-adapter-registry.js

@@ -32,6 +32,7 @@ function installRecord(config, definition, extra = {}, markerExtra = {}) {
 				displayName: definition.displayName,
 				source: definition.source,
 				artifactSha256: definition.provenance?.sha256,
+				definition,
 				...markerExtra
 			},
 			runtime: definition.runtime,

package/dist/src/connectors/types.d.ts

@@ -8,7 +8,8 @@ export type ConnectorAuthDefinition = {
     mode: 'apiKey';
 } | {
     mode: 'oauth';
-    provider: string;
+    provider?: string;
+    clientId?: string;
 };
 export type ConnectorScope = 'read' | 'write' | 'admin';
 export type ConnectorVerificationLevel = 'verified' | 'beta' | 'experimental';
@@ -289,4 +290,6 @@ export type ManagedConnectorMarker = {
     config?: Record<string, unknown>;
     source?: ConnectorDefinition['source'];
     artifactSha256?: string;
+    /** Immutable install-time snapshot used for update, health, and uninstall after restart. */
+    definition?: ConnectorDefinition;
 };

package/dist/src/extensions/connector-dependencies.d.ts

@@ -0,0 +1,10 @@
+import type { Config } from '../config/schema.js';
+export type ExtensionConnectorDiagnostic = {
+    extensionId: string;
+    connectorId: string;
+    message: string;
+};
+export declare function inspectExtensionConnectorDependencies(params: {
+    cfg?: Config;
+    roots?: string[];
+}): ExtensionConnectorDiagnostic[];

package/dist/src/extensions/connector-dependencies.js

@@ -0,0 +1,65 @@
+import { init_paths, resolveBundledExtensionsDir, resolveExtensionsDir } from "../config/paths.js";
+import { isRecord } from "../utils/is-record.js";
+import { join } from "node:path";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+//#region src/extensions/connector-dependencies.ts
+init_paths();
+function isExtensionEnabled(extensionId, cfg) {
+	const disabled = cfg?.extensions?.disabled;
+	if (Array.isArray(disabled) && disabled.includes(extensionId)) return false;
+	const enabled = cfg?.extensions?.enabled;
+	return !Array.isArray(enabled) || enabled.length === 0 || enabled.includes(extensionId);
+}
+function enabledConnectorIds(cfg) {
+	const ids = /* @__PURE__ */ new Set();
+	for (const server of Object.values(cfg?.mcp?.servers ?? {})) {
+		if (!isRecord(server) || !isRecord(server.xopcConnector)) continue;
+		if (server.xopcConnector.managed === true && server.xopcConnector.enabled !== false && typeof server.xopcConnector.connectorId === "string") ids.add(server.xopcConnector.connectorId);
+	}
+	for (const instance of Object.values(cfg?.connectors?.instances ?? {})) {
+		if (!isRecord(instance) || !isRecord(instance.xopcConnector)) continue;
+		if (instance.xopcConnector.managed === true && instance.xopcConnector.enabled !== false && typeof instance.xopcConnector.connectorId === "string") ids.add(instance.xopcConnector.connectorId);
+	}
+	return ids;
+}
+function scanRoot(params) {
+	if (!existsSync(params.root)) return;
+	for (const entry of readdirSync(params.root, { withFileTypes: true })) {
+		if (!entry.isDirectory() || params.seenExtensions.has(entry.name) || !isExtensionEnabled(entry.name, params.cfg)) continue;
+		const manifestPath = join(params.root, entry.name, "xopc.extension.json");
+		if (!existsSync(manifestPath)) continue;
+		params.seenExtensions.add(entry.name);
+		let manifest;
+		try {
+			manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+		} catch {
+			continue;
+		}
+		if (!isRecord(manifest) || !Array.isArray(manifest.connectorDependencies)) continue;
+		const dependencies = [...new Set(manifest.connectorDependencies.filter((value) => typeof value === "string").map((value) => value.trim()).filter(Boolean))];
+		for (const connectorId of dependencies) {
+			if (params.installed.has(connectorId)) continue;
+			params.diagnostics.push({
+				extensionId: entry.name,
+				connectorId,
+				message: `Extension "${entry.name}" requires enabled Connector "${connectorId}". Install and connect it from the Connector Store.`
+			});
+		}
+	}
+}
+function inspectExtensionConnectorDependencies(params) {
+	const diagnostics = [];
+	const installed = enabledConnectorIds(params.cfg);
+	const seenExtensions = /* @__PURE__ */ new Set();
+	const roots = params.roots ?? [resolveExtensionsDir(), resolveBundledExtensionsDir()].filter((root) => Boolean(root));
+	for (const root of roots) scanRoot({
+		root,
+		cfg: params.cfg,
+		installed,
+		seenExtensions,
+		diagnostics
+	});
+	return diagnostics;
+}
+//#endregion
+export { inspectExtensionConnectorDependencies };

package/dist/src/extensions/install.js

@@ -172,6 +172,24 @@ function isSafeZipPath(name) {
 	for (const p of normalized.split("/")) if (p === "..") return false;
 	return true;
 }
+function findEmbeddedMcpConfig(root) {
+	for (const entry of readdirSync(root, { withFileTypes: true })) {
+		if (entry.isSymbolicLink()) continue;
+		const path = join(root, entry.name);
+		if (entry.isFile() && entry.name.toLowerCase() === ".mcp.json") return path;
+		if (entry.isDirectory()) {
+			const nested = findEmbeddedMcpConfig(path);
+			if (nested) return nested;
+		}
+	}
+}
+function validateConnectorDependencies(value) {
+	if (value === void 0) return void 0;
+	if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) return "Extension connectorDependencies must be an array of unique Connector ids";
+	const dependencies = value;
+	const validId = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;
+	if (dependencies.some((id) => !validId.test(id)) || new Set(dependencies).size !== dependencies.length) return "Extension connectorDependencies must be an array of unique Connector ids";
+}
 function isIgnorableZipEntry(name) {
 	const n = name.replace(/\\/g, "/");
 	if (n.startsWith("__MACOSX/")) return true;
@@ -448,6 +466,15 @@ async function installFromDirectory(sourceDir, extensionsDir) {
 		ok: false,
 		error: "Extension must include xopc.extension.json"
 	};
+	if (findEmbeddedMcpConfig(sourceDir)) return {
+		ok: false,
+		error: "Extensions must declare connectorDependencies instead of embedding .mcp.json"
+	};
+	const connectorDependencyError = validateConnectorDependencies(manifest.connectorDependencies);
+	if (connectorDependencyError) return {
+		ok: false,
+		error: connectorDependencyError
+	};
 	if (!manifest.engines?.xopc) return {
 		ok: false,
 		error: "Extension manifest must declare engines.xopc"

package/dist/src/extensions/normalize-manifest.js

@@ -130,6 +130,7 @@ function normalizeExtensionManifest(raw) {
 		main: typeof raw.main === "string" ? raw.main : void 0,
 		configSchema: isRecord(raw.configSchema) ? raw.configSchema : void 0,
 		dependencies: isRecord(raw.dependencies) ? raw.dependencies : void 0,
+		connectorDependencies: Array.isArray(raw.connectorDependencies) ? [...new Set(raw.connectorDependencies.filter((value) => typeof value === "string").map((value) => value.trim()).filter(Boolean))] : void 0,
 		enabledByDefault: typeof raw.enabledByDefault === "boolean" ? raw.enabledByDefault : void 0,
 		providers: Array.isArray(raw.providers) ? raw.providers.filter((x) => typeof x === "string") : void 0,
 		speechProviders: Array.isArray(raw.speechProviders) ? raw.speechProviders.filter((x) => typeof x === "string") : void 0,

package/dist/src/extensions/sdk/index.js

@@ -7,8 +7,8 @@ import { SlotRegistry, getSlotRegistry, registerSlotType } from "../slots.js";
 import { ExtensionDiagnostics, ExtensionLoaderCacheImpl, getExtensionCache, getExtensionDiagnostics } from "../diagnostics.js";
 import "../loader.js";
 import { ExtensionHookRunner, createHookContext, isHookEvent } from "../hooks.js";
-import { registerExtensionCliProgram } from "./channel-helpers.js";
 import { defineChannelPluginEntry } from "./channel-entry.js";
+import { registerExtensionCliProgram } from "./channel-helpers.js";
 import { lazyFunction, lazyModule } from "./lazy.js";
 import { createMockExtensionApi, createTestGateway } from "./testing.js";
 //#region src/extensions/sdk/index.ts

package/dist/src/extensions/types/manifest.d.ts

@@ -20,6 +20,8 @@ export interface ExtensionManifest {
     main?: string;
     configSchema?: Record<string, unknown>;
     dependencies?: Record<string, string>;
+    /** Connector ids that must already be installed and enabled. Extensions never embed MCP server configuration. */
+    connectorDependencies?: string[];
     enabledByDefault?: boolean;
     providers?: string[];
     /** Speech/TTS provider ids implemented by this extension. */

package/dist/src/gateway/heartbeat/service.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { shouldSilence, stripHeartbeatToken } from "../../heartbeat/tokens.js";
+import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { isWithinActiveHours } from "../../heartbeat/active-hours.js";
 import { isHeartbeatContentEmpty } from "../../heartbeat/content-check.js";
-import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { createHeartbeatWake } from "../../heartbeat/wake.js";
 import { resolveHeartbeatMdPath } from "../workspace-heartbeat-path.js";
 import { readFile } from "fs/promises";

package/dist/src/gateway/hono/routes/capabilities.js

@@ -1,4 +1,5 @@
 import { getStoreConnectorInstallPlan, installStoreConnector, listStoreConnectors } from "../../../capabilities/store-connector.js";
+import { ConfigPersistenceError, persistConfigMutation } from "../../../config/config-mutation.js";
 //#region src/gateway/hono/routes/capabilities.ts
 function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error);
@@ -50,14 +51,13 @@ function registerCapabilityRoutes(authenticated, deps) {
 	authenticated.post("/api/capabilities/connectors/:name/install", strictRateLimitMiddleware, async (c) => {
 		const body = await c.req.json().catch(() => ({}));
 		const input = body && typeof body === "object" && !Array.isArray(body) ? body : {};
+		const config = service.currentConfig;
 		try {
-			const config = service.currentConfig;
-			const { instance, plan } = await installStoreConnector(config, c.req.param("name"), input, optionalVersion(body));
-			const saved = await service.saveConfig(config);
-			if (!saved.saved) return c.json({
-				ok: false,
-				error: saved.error ?? "Failed to save connector configuration."
-			}, 500);
+			const { instance, plan } = await persistConfigMutation({
+				config,
+				mutate: () => installStoreConnector(config, c.req.param("name"), input, optionalVersion(body)),
+				save: () => service.saveConfig(config)
+			});
 			return c.json({
 				ok: true,
 				payload: {
@@ -69,7 +69,7 @@ function registerCapabilityRoutes(authenticated, deps) {
 			return c.json({
 				ok: false,
 				error: errorMessage(error)
-			}, 400);
+			}, error instanceof ConfigPersistenceError ? 500 : 400);
 		}
 	});
 }

package/dist/src/gateway/hono/routes/connectors.js

@@ -13,8 +13,9 @@ import { listConnectorProviders } from "../../../connectors/providers.js";
 import { getConnectorDefinition, listConnectorCatalog } from "../../../connectors/catalog.js";
 import { listUnderstandingSourceGrants, revokeUnderstandingSourceGrant } from "../../../user-context/sources/repository.js";
 import { recordConnectorHealthUsage } from "../../../connectors/usage.js";
-import { getConnectorInstance, listConnectorInstances } from "../../../connectors/instances.js";
+import { getConnectorInstance, getInstalledConnectorDefinition, listConnectorInstances } from "../../../connectors/instances.js";
 import { installConnector, installConnectorDefinition, uninstallConnector, updateConnectorConfig } from "../../../connectors/install.js";
+import { getMcpOAuthManager } from "../../../agent/mcp/oauth/mcp-oauth-manager.js";
 import { startConnectorAuthorization } from "../../../connectors/auth-provider-registry.js";
 import { composioLogoResponse } from "../../../connectors/composio-logo.js";
 import { inspectManagedComposioStatus } from "../../../connectors/composio-managed-client.js";
@@ -25,6 +26,7 @@ import { ingestLocalFolderSource } from "../../../connectors/connected-source-in
 import { previewConnectorDefinition, testConnectorInstance } from "../../../connectors/health.js";
 import { setConnectorEnabled } from "../../../connectors/lifecycle.js";
 import { projectComposioConnectionStatus } from "../../../connectors/runtime-status.js";
+import { ConfigPersistenceError, persistConfigMutation } from "../../../config/config-mutation.js";
 //#region src/gateway/hono/routes/connectors.ts
 init_agent_scope();
 function errorMessage(error) {
@@ -48,9 +50,39 @@ function registerConnectorRoutes(authenticated, deps) {
 			}
 		});
 	});
-	authenticated.get("/api/connectors/installed", (c) => {
+	authenticated.get("/api/connectors/installed", async (c) => {
 		const config = service.currentConfig;
-		const instances = listConnectorInstances(config);
+		const instances = await Promise.all(listConnectorInstances(config).map(async (instance) => {
+			if (!instance.enabled || instance.materialized.type !== "mcp") return instance;
+			const server = config.mcp?.servers?.[instance.materialized.serverId];
+			if (!server) return instance;
+			const oauth = await getMcpOAuthManager().status(instance.materialized.serverId, server);
+			if (!oauth.configured) return instance;
+			if (oauth.status === "connected") return {
+				...instance,
+				authStatus: "connected",
+				connectionStatus: "connected"
+			};
+			if (oauth.status === "authorizing") return {
+				...instance,
+				status: "connecting",
+				authStatus: "unknown",
+				connectionStatus: "connecting"
+			};
+			if (oauth.status === "error") return {
+				...instance,
+				status: "failed",
+				authStatus: "unauthorized",
+				connectionStatus: "error",
+				lastError: oauth.session?.error ?? instance.lastError
+			};
+			return {
+				...instance,
+				status: "unauthorized",
+				authStatus: "missing",
+				connectionStatus: "disconnected"
+			};
+		}));
 		const connections = listConnectorConnections({ principalId: "local-owner" });
 		return c.json({
 			ok: true,
@@ -348,12 +380,11 @@ function registerConnectorRoutes(authenticated, deps) {
 		}, 400);
 		const config = service.currentConfig;
 		try {
-			setComposioToolkitScope(config, toolkit, scope);
-			const saved = await service.saveConfig(config);
-			if (!saved.saved) return c.json({
-				ok: false,
-				error: saved.error
-			}, 500);
+			await persistConfigMutation({
+				config,
+				mutate: () => setComposioToolkitScope(config, toolkit, scope),
+				save: () => service.saveConfig(config)
+			});
 			return c.json({
 				ok: true,
 				payload: {
@@ -365,7 +396,7 @@ function registerConnectorRoutes(authenticated, deps) {
 			return c.json({
 				ok: false,
 				error: errorMessage(error)
-			}, 400);
+			}, error instanceof ConfigPersistenceError ? 500 : 400);
 		}
 	});
 	authenticated.post("/api/connectors/composio/tools/:slug/execute", strictRateLimitMiddleware, async (c) => {
@@ -573,14 +604,16 @@ function registerConnectorRoutes(authenticated, deps) {
 		});
 	});
 	authenticated.post("/api/connectors/:id/auth/start", strictRateLimitMiddleware, async (c) => {
-		const connectorId = c.req.param("id");
-		const connector = getConnectorDefinition(connectorId);
+		const connectorOrInstanceId = c.req.param("id");
+		const config = service.currentConfig;
+		const instance = getConnectorInstance(config, connectorOrInstanceId);
+		const connector = instance ? getInstalledConnectorDefinition(config, instance.instanceId) : getConnectorDefinition(connectorOrInstanceId);
 		if (!connector) return c.json({
 			ok: false,
-			error: `Unknown connector: ${connectorId}`
+			error: `Unknown connector: ${connectorOrInstanceId}`
 		}, 404);
 		try {
-			const authorization = await startConnectorAuthorization(connector, service.currentConfig);
+			const authorization = await startConnectorAuthorization(connector, config, instance?.instanceId);
 			return c.json({
 				ok: true,
 				payload: { authorization }
@@ -628,12 +661,11 @@ function registerConnectorRoutes(authenticated, deps) {
 		const registryDefinition = body && typeof body === "object" && !Array.isArray(body) && body.definition && typeof body.definition === "object" && !Array.isArray(body.definition) ? body.definition : void 0;
 		const config = service.currentConfig;
 		try {
-			const instance = registryDefinition?.id === connectorId ? await installConnectorDefinition(config, registryDefinition, input) : await installConnector(config, connectorId, input);
-			const saved = await service.saveConfig(config);
-			if (!saved.saved) return c.json({
-				ok: false,
-				error: saved.error
-			}, 500);
+			const instance = await persistConfigMutation({
+				config,
+				mutate: () => registryDefinition?.id === connectorId ? installConnectorDefinition(config, registryDefinition, input) : installConnector(config, connectorId, input),
+				save: () => service.saveConfig(config)
+			});
 			return c.json({
 				ok: true,
 				payload: { instance }
@@ -642,7 +674,7 @@ function registerConnectorRoutes(authenticated, deps) {
 			return c.json({
 				ok: false,
 				error: errorMessage(error)
-			}, 400);
+			}, error instanceof ConfigPersistenceError ? 500 : 400);
 		}
 	});
 	authenticated.post("/api/connectors/:id/test", async (c) => {
@@ -659,12 +691,11 @@ function registerConnectorRoutes(authenticated, deps) {
 		}, 400);
 		try {
 			const result = await testConnectorInstance(config, instance.materialized.serverId);
-			recordConnectorHealthUsage(config, instance.instanceId, result);
-			const saved = await service.saveConfig(config);
-			if (!saved.saved) return c.json({
-				ok: false,
-				error: saved.error
-			}, 500);
+			await persistConfigMutation({
+				config,
+				mutate: () => recordConnectorHealthUsage(config, instance.instanceId, result),
+				save: () => service.saveConfig(config)
+			});
 			return c.json({
 				ok: true,
 				payload: result
@@ -701,12 +732,11 @@ function registerConnectorRoutes(authenticated, deps) {
 		const input = body && typeof body === "object" && !Array.isArray(body) ? body : {};
 		const config = service.currentConfig;
 		try {
-			const instance = updateConnectorConfig(config, instanceId, input);
-			const saved = await service.saveConfig(config);
-			if (!saved.saved) return c.json({
-				ok: false,
-				error: saved.error
-			}, 500);
+			const instance = await persistConfigMutation({
+				config,
+				mutate: () => updateConnectorConfig(config, instanceId, input),
+				save: () => service.saveConfig(config)
+			});
 			return c.json({
 				ok: true,
 				payload: { instance }
@@ -715,19 +745,18 @@ function registerConnectorRoutes(authenticated, deps) {
 			return c.json({
 				ok: false,
 				error: errorMessage(error)
-			}, 400);
+			}, error instanceof ConfigPersistenceError ? 500 : 400);
 		}
 	});
 	authenticated.post("/api/connectors/:id/enable", strictRateLimitMiddleware, async (c) => {
 		const instanceId = c.req.param("id");
 		const config = service.currentConfig;
 		try {
-			const instance = setConnectorEnabled(config, instanceId, true);
-			const saved = await service.saveConfig(config);
-			if (!saved.saved) return c.json({
-				ok: false,
-				error: saved.error
-			}, 500);
+			const instance = await persistConfigMutation({
+				config,
+				mutate: () => setConnectorEnabled(config, instanceId, true),
+				save: () => service.saveConfig(config)
+			});
 			return c.json({
 				ok: true,
 				payload: { instance }
@@ -736,19 +765,18 @@ function registerConnectorRoutes(authenticated, deps) {
 			return c.json({
 				ok: false,
 				error: errorMessage(error)
-			}, 400);
+			}, error instanceof ConfigPersistenceError ? 500 : 400);
 		}
 	});
 	authenticated.post("/api/connectors/:id/disable", strictRateLimitMiddleware, async (c) => {
 		const instanceId = c.req.param("id");
 		const config = service.currentConfig;
 		try {
-			const instance = setConnectorEnabled(config, instanceId, false);
-			const saved = await service.saveConfig(config);
-			if (!saved.saved) return c.json({
-				ok: false,
-				error: saved.error
-			}, 500);
+			const instance = await persistConfigMutation({
+				config,
+				mutate: () => setConnectorEnabled(config, instanceId, false),
+				save: () => service.saveConfig(config)
+			});
 			return c.json({
 				ok: true,
 				payload: { instance }
@@ -757,19 +785,23 @@ function registerConnectorRoutes(authenticated, deps) {
 			return c.json({
 				ok: false,
 				error: errorMessage(error)
-			}, 400);
+			}, error instanceof ConfigPersistenceError ? 500 : 400);
 		}
 	});
 	authenticated.delete("/api/connectors/:id", strictRateLimitMiddleware, async (c) => {
 		const instanceId = c.req.param("id");
 		const config = service.currentConfig;
 		try {
-			const instance = uninstallConnector(config, instanceId);
-			const saved = await service.saveConfig(config);
-			if (!saved.saved) return c.json({
-				ok: false,
-				error: saved.error
-			}, 500);
+			const definition = getInstalledConnectorDefinition(config, instanceId);
+			const installed = getConnectorInstance(config, instanceId);
+			const serverId = installed?.materialized.type === "mcp" ? installed.materialized.serverId : void 0;
+			const rawServer = serverId ? config.mcp?.servers?.[serverId] : void 0;
+			if (definition?.auth.mode === "oauth" && definition.runtime.type === "mcp" && rawServer) await getMcpOAuthManager().disconnect(serverId, rawServer);
+			const instance = await persistConfigMutation({
+				config,
+				mutate: () => uninstallConnector(config, instanceId),
+				save: () => service.saveConfig(config)
+			});
 			return c.json({
 				ok: true,
 				payload: { instance }
@@ -778,7 +810,7 @@ function registerConnectorRoutes(authenticated, deps) {
 			return c.json({
 				ok: false,
 				error: errorMessage(error)
-			}, 400);
+			}, error instanceof ConfigPersistenceError ? 500 : 400);
 		}
 	});
 }

package/dist/src/gateway/hono/routes/mcp.js

@@ -2,21 +2,31 @@ import { canonicalizeConfiguredMcpServer, normalizeConfiguredMcpServers } from "
 import { loadMergedBundleMcpConfig } from "../../../agent/mcp/bundle-mcp-config.js";
 import { isManagedConnectorServer } from "../../../connectors/materialize.js";
 import { getWorkspacePath } from "../../../config/workspace-path-helpers.js";
+import { getMcpOAuthManager } from "../../../agent/mcp/oauth/mcp-oauth-manager.js";
 import { listBundleMcpServerCapabilitiesForGateway, listBundleMcpServerToolsForGateway } from "../../../agent/mcp/bundle-mcp-gateway.js";
 //#region src/gateway/hono/routes/mcp.ts
 function registerMcpRoutes(authenticated, deps) {
-	authenticated.get("/api/mcp/servers", (c) => {
+	const resolveServer = (id) => {
+		const cfg = deps.service.currentConfig;
+		return loadMergedBundleMcpConfig({
+			workspaceDir: getWorkspacePath(cfg) || "./workspace",
+			cfg
+		}).config.mcpServers[id];
+	};
+	authenticated.get("/api/mcp/servers", async (c) => {
 		const cfg = deps.service.currentConfig;
 		const merged = loadMergedBundleMcpConfig({
 			workspaceDir: getWorkspacePath(cfg) || "./workspace",
 			cfg
 		});
 		const configured = normalizeConfiguredMcpServers(cfg.mcp?.servers);
-		const servers = Object.entries(configured).map(([id, server]) => ({
+		const oauthManager = getMcpOAuthManager();
+		const servers = await Promise.all(Object.entries(configured).map(async ([id, server]) => ({
 			id,
 			managed: isManagedConnectorServer(server),
-			connectorId: isManagedConnectorServer(server) ? server.xopcConnector.connectorId : void 0
-		}));
+			connectorId: isManagedConnectorServer(server) ? server.xopcConnector.connectorId : void 0,
+			oauth: await oauthManager.status(id, server)
+		})));
 		return c.json({
 			ok: true,
 			payload: {
@@ -26,6 +36,62 @@ function registerMcpRoutes(authenticated, deps) {
 			}
 		});
 	});
+	authenticated.get("/api/mcp/servers/:id/oauth", async (c) => {
+		const id = c.req.param("id");
+		const server = resolveServer(id);
+		if (!server) return c.json({
+			ok: false,
+			error: `Unknown MCP server: ${id}`
+		}, 404);
+		return c.json({
+			ok: true,
+			payload: await getMcpOAuthManager().status(id, server)
+		});
+	});
+	authenticated.post("/api/mcp/servers/:id/oauth/start", deps.strictRateLimitMiddleware, async (c) => {
+		const id = c.req.param("id");
+		const server = resolveServer(id);
+		if (!server) return c.json({
+			ok: false,
+			error: `Unknown MCP server: ${id}`
+		}, 404);
+		try {
+			const payload = await getMcpOAuthManager().start({
+				serverId: id,
+				rawServer: server,
+				cfg: deps.service.currentConfig
+			});
+			return c.json({
+				ok: true,
+				payload
+			});
+		} catch (err) {
+			return c.json({
+				ok: false,
+				error: err instanceof Error ? err.message : String(err)
+			}, 400);
+		}
+	});
+	authenticated.delete("/api/mcp/servers/:id/oauth", deps.strictRateLimitMiddleware, async (c) => {
+		const id = c.req.param("id");
+		const server = resolveServer(id);
+		if (!server) return c.json({
+			ok: false,
+			error: `Unknown MCP server: ${id}`
+		}, 404);
+		try {
+			const payload = await getMcpOAuthManager().disconnect(id, server);
+			return c.json({
+				ok: true,
+				payload
+			});
+		} catch (err) {
+			return c.json({
+				ok: false,
+				error: err instanceof Error ? err.message : String(err)
+			}, 400);
+		}
+	});
 	authenticated.get("/api/mcp/servers/:id/tools", async (c) => {
 		const id = c.req.param("id");
 		const cfg = deps.service.currentConfig;
@@ -79,11 +145,17 @@ function registerMcpRoutes(authenticated, deps) {
 			workspaceDir,
 			cfg
 		}).config.mcpServers;
-		if (!(inlineServer ?? servers[id] ?? mergedServers[id])) return c.json({
+		const knownServer = inlineServer ?? servers[id] ?? mergedServers[id];
+		if (!knownServer) return c.json({
 			ok: false,
 			error: `Unknown MCP server: ${id}`
 		}, 404);
 		try {
+			const oauth = await getMcpOAuthManager().status(id, knownServer);
+			if (oauth.configured && oauth.status !== "connected") return c.json({
+				ok: false,
+				error: oauth.session?.error ?? "MCP server authorization is required"
+			}, 409);
 			const capabilities = await listBundleMcpServerCapabilitiesForGateway({
 				workspaceDir,
 				cfg: inlineServer ? {

package/dist/src/gateway/hono/routes/voice.js

@@ -14,8 +14,8 @@ import "../../../voice/stt/index.js";
 import { listSttProvidersForApi } from "../../../voice/stt/list-providers.js";
 import "../../../voice/tts/index.js";
 import { createGatewayRouteLogger } from "../lib/route-logger.js";
-import { listLocalVoiceModelStatuses, removeLocalVoiceModel, startLocalVoiceModelInstall } from "../../../voice/local/model-manager.js";
 import { listTtsProvidersForApi } from "../../../voice/tts/list-providers.js";
+import { listLocalVoiceModelStatuses, removeLocalVoiceModel, startLocalVoiceModelInstall } from "../../../voice/local/model-manager.js";
 //#region src/gateway/hono/routes/voice.ts
 init_providers();
 const log = createGatewayRouteLogger("Voice");