@yagni-app/code-staging 1.1.4-staging.1425.1 → 1.1.4-staging.1429.1

package/dist/doctor.d.ts

@@ -147,6 +147,29 @@ export interface McpProbe {
  * pending-approval cases read as `warn`, config errors as `fail` (non-required).
  */
 export declare function checkMcpConfig(probe: McpProbe): CheckResult;
+/** Config-only snapshot of the Claude Code MCP bridge (claudeImport.ts). */
+export interface ClaudeImportProbe {
+    /** `~/.claude.json` exists (and the bridge is not disabled). */
+    exists: boolean;
+    /** Set when the file exists but could not be parsed. */
+    parseError?: string;
+    /** The same one-line notice the session-start banner shows, when the gap is non-empty. */
+    notice?: string;
+    /** Claude Code server names not configured here. */
+    importable: string[];
+    /** claude.ai connectors with a public MCP equivalent not configured here. */
+    connectorSuggestions: string[];
+    /** Claude Code has `.mcp.json` approvals for this checkout that ours lack. */
+    approvals: boolean;
+    /** The probe itself failed (bundled extension broken, config unreadable) while ~/.claude.json exists. */
+    probeError?: string;
+}
+/**
+ * Advisory (never required) line for the Claude Code bridge. Absent entirely
+ * when there is no `~/.claude.json` — a machine without Claude Code has
+ * nothing to say here. Reads config only; never connects.
+ */
+export declare function checkClaudeImport(probe: ClaudeImportProbe): CheckResult | null;
 /** What the Windows bash probe found (pi needs a bash — Git Bash — on win32). */
 export interface BashProbe {
     found: boolean;
@@ -179,6 +202,8 @@ export interface DoctorDeps {
     probeLatestVersion?: () => Promise<string | null>;
     /** MCP config snapshot (config-only, no connections). */
     probeMcp?: () => Promise<McpProbe>;
+    /** Claude Code bridge snapshot (config-only). */
+    probeClaudeImport?: () => Promise<ClaudeImportProbe>;
     /** Certificate-authority configuration of the running process. */
     probeCaTrust?: () => CaTrustProbe;
     /** OTel gate resolution (env / workspace / repo settings); tests stub it. */

package/dist/doctor.js

@@ -13,6 +13,7 @@
  * Advisory checks (loose perms, missing `gh`) never flip the exit code.
  */
 import { existsSync, readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
 import { delimiter, join } from "node:path";
 import { credentialsDir } from "./credentials.js";
 import { currentCliVersion, fetchLatestVersion, isNewerVersion } from "./upgrade.js";
@@ -20,6 +21,7 @@ import { classifyTokenExpiry } from "./launch.js";
 import { otelChildEnv, resolveOtelLaunchWithWorkspace } from "./otel.js";
 import { resolveExtensionPath, resolvePiCliPath, resolvePiPackageDir, resolveTelemetryProbePath } from "./paths.js";
 import { readActiveProfile } from "./profiles.js";
+import { DISTRIBUTION } from "./distribution.js";
 import { resolveMcpConfigPath } from "./mcpCommand.js";
 import { MIN_NODE_VERSION, nodeVersionSatisfies } from "./nodeVersion.js";
 import { EXTRA_CA_ENV, SYSTEM_CA_ENV, SYSTEM_CA_FLAG, childCaEnv, sessionExecArgv, findTlsCertError, nodeOptionsHaveSystemCa, systemCaEnabled, systemCaEnvSupported, systemCaFlagSupported, } from "./tlsTrust.js";
@@ -414,6 +416,52 @@ export function checkMcpConfig(probe) {
         required: false,
     };
 }
+/**
+ * Advisory (never required) line for the Claude Code bridge. Absent entirely
+ * when there is no `~/.claude.json` — a machine without Claude Code has
+ * nothing to say here. Reads config only; never connects.
+ */
+export function checkClaudeImport(probe) {
+    if (!probe.exists)
+        return null;
+    if (probe.probeError) {
+        return {
+            name: "claude code mcp",
+            status: "warn",
+            detail: `could not compare with ~/.claude.json (${probe.probeError})`,
+            hint: "run `yagni mcp add-from-claude` for the full error, or `yagni upgrade` if the extension is missing",
+            required: false,
+        };
+    }
+    if (probe.parseError) {
+        return {
+            name: "claude code mcp",
+            status: "warn",
+            detail: `~/.claude.json unreadable (${probe.parseError})`,
+            hint: "fix the file so Claude Code's MCP servers can be imported",
+            required: false,
+        };
+    }
+    const gaps = [];
+    if (probe.importable.length > 0) {
+        gaps.push(`${probe.importable.length} server${probe.importable.length === 1 ? "" : "s"} not imported (${probe.importable.join(", ")})`);
+    }
+    if (probe.approvals)
+        gaps.push("repo approvals not imported");
+    if (probe.connectorSuggestions.length > 0) {
+        gaps.push(`${probe.connectorSuggestions.length} claude.ai connector${probe.connectorSuggestions.length === 1 ? "" : "s"} with a public MCP (${probe.connectorSuggestions.join(", ")})`);
+    }
+    if (gaps.length === 0) {
+        return { name: "claude code mcp", status: "ok", detail: "in sync with ~/.claude.json", required: false };
+    }
+    return {
+        name: "claude code mcp",
+        status: "warn",
+        detail: gaps.join("; "),
+        hint: probe.notice ?? "run `yagni mcp add-from-claude`",
+        required: false,
+    };
+}
 export function checkBash(probe) {
     if (!probe.found) {
         return {
@@ -501,6 +549,43 @@ function defaultProbeStateDir() {
         return { path, exists: false, mode: null };
     }
 }
+async function defaultProbeClaudeImport(env = process.env) {
+    const none = { exists: false, importable: [], connectorSuggestions: [], approvals: false };
+    if (env.YAGNI_CODE_MCP_DISABLED === "1")
+        return none;
+    try {
+        const mod = (await import(resolveMcpConfigPath()));
+        if (typeof mod?.readClaudeMcpInventory !== "function" ||
+            typeof mod.claudeImportGap !== "function" ||
+            typeof mod.claudeImportNotice !== "function") {
+            return none;
+        }
+        const cwd = process.cwd();
+        const repoRoot = mod.resolveProjectRoot(cwd);
+        const inventory = mod.readClaudeMcpInventory({ cwd, repoRoot, env });
+        if (!inventory.exists)
+            return none;
+        if (inventory.parseError)
+            return { ...none, exists: true, parseError: inventory.parseError };
+        const loaded = mod.loadMcpServers(cwd, env);
+        const { state } = mod.readProjectApproval(repoRoot);
+        const gap = mod.claudeImportGap(inventory, loaded.servers, state, DISTRIBUTION.commandName);
+        return {
+            exists: true,
+            notice: mod.claudeImportNotice(gap, DISTRIBUTION.commandName),
+            importable: gap.importable.map((c) => c.name),
+            connectorSuggestions: gap.connectorSuggestions.map((c) => c.name),
+            approvals: gap.approvals !== undefined,
+        };
+    }
+    catch (err) {
+        // Advisory only: a probe that cannot run must never fail doctor — but a
+        // machine that HAS ~/.claude.json must not read as "no Claude Code".
+        if (!existsSync(join(homedir(), ".claude.json")))
+            return none;
+        return { ...none, exists: true, probeError: err instanceof Error ? err.message : String(err) };
+    }
+}
 async function defaultProbeMcp(env = process.env) {
     const disabled = env.YAGNI_CODE_MCP_DISABLED === "1";
     if (disabled)
@@ -633,6 +718,7 @@ export async function gatherChecks(deps = {}) {
     const probeBackend = deps.probeBackend ?? defaultProbeBackend;
     const probeStateDir = deps.probeStateDir ?? defaultProbeStateDir;
     const probeMcp = deps.probeMcp ?? (() => defaultProbeMcp());
+    const probeClaudeImport = deps.probeClaudeImport ?? (() => defaultProbeClaudeImport());
     const probeCaTrust = deps.probeCaTrust ?? (() => defaultProbeCaTrust());
     const ghOnPath = deps.ghOnPath ?? (() => ghOnPathDefault());
     const platform = deps.platform ?? process.platform;
@@ -665,6 +751,9 @@ export async function gatherChecks(deps = {}) {
     checks.push(checkStateDir(probeStateDir()));
     checks.push(checkGh(ghOnPath()));
     checks.push(checkMcpConfig(await probeMcp()));
+    const claudeImport = checkClaudeImport(await probeClaudeImport());
+    if (claudeImport)
+        checks.push(claudeImport);
     const resolveOtel = deps.resolveOtel ??
         ((p) => resolveOtelLaunchWithWorkspace({
             env: process.env,

package/dist/extension/bgJobsPanel.js

@@ -16,6 +16,7 @@
 import { Box, Container, Key, Text, matchesKey, truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
 import { logEvent } from "./errorSink.js";
 import { listBgJobs } from "./bgJobs.js";
+import { PanelBorder } from "./panelBorder.js";
 /** The content frame's horizontal padding (SandboxPanel's CONTENT_PADDING_X). */
 export const CONTENT_PADDING_X = 2;
 /** Max rendered output lines in the detail view. */
@@ -100,17 +101,6 @@ export function formatPanelSubtitle(jobs) {
 }
 // ---------------------------------------------------------------------------
 // The panel: SandboxPanel's structure (Container + Border + Box + Border).
-/** Full-width border line (the house pattern, color fn passed explicitly). */
-class Border {
-    color;
-    constructor(color) {
-        this.color = color;
-    }
-    render(width) {
-        return [this.color("─".repeat(Math.max(1, width)))];
-    }
-    invalidate() { }
-}
 export class BgJobsPanel extends Container {
     deps;
     theme;
@@ -138,9 +128,9 @@ export class BgJobsPanel extends Container {
         this.content.addChild(new Text("", 0, 0));
         this.content.addChild(new Text("", 0, 0));
         this.content.addChild(new Text("", 0, 0));
-        this.addChild(new Border((s) => theme.fg("borderMuted", s)));
+        this.addChild(new PanelBorder((s) => theme.fg("borderMuted", s)));
         this.addChild(this.content);
-        this.addChild(new Border((s) => theme.fg("borderMuted", s)));
+        this.addChild(new PanelBorder((s) => theme.fg("borderMuted", s)));
         this.rebuild();
     }
     dispose() {

package/dist/extension/footer.d.ts

@@ -3,9 +3,14 @@
  *
  * Renders three lines:
  *   1. folder  ·  [worktree]  ·  branch        (git context; ~-path fallback off-repo)
- *   2. ↑in ↓out $cost  ·  ctx%                 (session stats; context % is an integer)
+ *   2. ◆ tier  ·  mode  ·  ↑in ↓out $cost  ·  ctx%   (the rung in play, permission mode,
+ *                                               session stats; context % is an integer)
  *   3. extension statuses                       (branding, todo counter, mode) joined by " · "
  *
+ * The tier segment is the footer's answer to "what am I driving on" now that
+ * the rung is a dial (/model, Ctrl+L, /tier): it reads `ctx.model` live on
+ * every render, so a switch shows the moment the footer repaints.
+ *
  * --- How to customize the status bar (for future tickets) ---
  *
  * LIFECYCLE: `ctx.ui.setFooter()` is NOT available at extension factory time.
@@ -42,6 +47,17 @@ import type { ExtensionContext, ReadonlyFooterDataProvider, Theme } from "@earen
 import type { ChildUsageHandle } from "./childUsage.js";
 import type { ModeHolder, PermissionMode } from "./permission/gate.js";
 export declare const BRANCH_MAX_WIDTH = 60;
+/** The glyph in front of the tier segment (the desktop start chips' rung mark). */
+export declare const TIER_GLYPH = "\u25C6";
+/**
+ * The footer's tier label for the model a session is on: the rate-card name
+ * for a selectable rung, the catalog name (or id) for anything else, null
+ * when there is no model yet. PURE.
+ */
+export declare function footerTierLabel(model: {
+    id: string;
+    name?: string;
+} | undefined): string | null;
 export declare function cyclePermissionMode(current: PermissionMode): PermissionMode;
 export declare function isShiftTab(data: string): boolean;
 export declare const GIT_MUTATING_PATTERN: RegExp;
@@ -94,7 +110,12 @@ export declare function detectGitInfo(cwd: string, home: string | undefined): Gi
 /** Pure line-builder, exported for tests. All data injected; colors via theme. */
 export declare function renderFooterLines(input: {
     git: GitInfo;
-    /** Current permission mode; shown on line 2 to the left of the stats as "<mode> mode". */
+    /**
+     * The rung in play, already resolved to its label ("Advanced"); leads
+     * line 2 as "◆ Advanced". Null hides the segment (no model yet).
+     */
+    tier?: string | null;
+    /** Current permission mode; shown on line 2 after the tier as "<mode> mode". */
     mode?: PermissionMode | null;
     /** Formatted `+N -M` / `±`, or null when clean — appended to the branch as `[ … ]`. */
     diff?: string | null;

package/dist/extension/footer.js

@@ -3,9 +3,14 @@
  *
  * Renders three lines:
  *   1. folder  ·  [worktree]  ·  branch        (git context; ~-path fallback off-repo)
- *   2. ↑in ↓out $cost  ·  ctx%                 (session stats; context % is an integer)
+ *   2. ◆ tier  ·  mode  ·  ↑in ↓out $cost  ·  ctx%   (the rung in play, permission mode,
+ *                                               session stats; context % is an integer)
  *   3. extension statuses                       (branding, todo counter, mode) joined by " · "
  *
+ * The tier segment is the footer's answer to "what am I driving on" now that
+ * the rung is a dial (/model, Ctrl+L, /tier): it reads `ctx.model` live on
+ * every render, so a switch shows the moment the footer repaints.
+ *
  * --- How to customize the status bar (for future tickets) ---
  *
  * LIFECYCLE: `ctx.ui.setFooter()` is NOT available at extension factory time.
@@ -43,10 +48,23 @@ import { statSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { matchesKey, truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
 import { createDiffStatCache, formatDiffStat } from "./diffStat.js";
+import { isSelectableTier, tierLabel } from "./tierCommand.js";
 export const BRANCH_MAX_WIDTH = 60;
 const WORKTREE_MAX_WIDTH = 30;
 /** Section separator: single space + middle dot + single space. */
 const SEP = " · ";
+/** The glyph in front of the tier segment (the desktop start chips' rung mark). */
+export const TIER_GLYPH = "◆";
+/**
+ * The footer's tier label for the model a session is on: the rate-card name
+ * for a selectable rung, the catalog name (or id) for anything else, null
+ * when there is no model yet. PURE.
+ */
+export function footerTierLabel(model) {
+    if (!model)
+        return null;
+    return isSelectableTier(model.id) ? tierLabel(model.id) : model.name || model.id;
+}
 const MODE_CYCLE = ["auto", "review", "plan"];
 export function cyclePermissionMode(current) {
     const idx = MODE_CYCLE.indexOf(current);
@@ -244,7 +262,7 @@ export function renderFooterLines(input, theme, width, padX = 0) {
         }
     }
     const line1 = pad + truncateToWidth(line1Parts.join(sep), contentWidth, dim("…"));
-    // Line 2: [mode ·] ↑in ↓out $cost · ctx%
+    // Line 2: [◆ tier ·] [mode ·] ↑in ↓out $cost · ctx%
     // Child-process spend (subagents, advisor, /go) joins the driver totals so
     // the footer matches the per-child receipts and /cost's session scope.
     const child = input.childUsage;
@@ -261,6 +279,8 @@ export function renderFooterLines(input, theme, width, padX = 0) {
     const stats = statParts.join(" ");
     const percentText = input.contextPercent === null ? "?" : `${Math.round(input.contextPercent)}%`;
     const line2Parts = [];
+    if (input.tier)
+        line2Parts.push(theme.fg("accent", `${TIER_GLYPH} ${input.tier}`));
     if (input.mode) {
         const modeLabel = modeDisplay(input.mode);
         line2Parts.push(theme.fg(modeLabel.color, modeLabel.text) + dim(" (shift+tab to change)"));
@@ -306,6 +326,7 @@ export function createYagniFooterFactory(ctx, modeHolder, invalidateHandle, chil
                     .map(([, text]) => text);
                 return renderFooterLines({
                     git: gitInfo(),
+                    tier: footerTierLabel(ctx.model),
                     mode: modeHolder?.get() ?? null,
                     diff: formatDiffStat(diffStatCache?.get() ?? null),
                     usage: collectUsage(ctx.sessionManager),

package/dist/extension/index.js

@@ -61,7 +61,8 @@ import { flushSpool as defaultFlushSpool } from "./spool.js";
 import { makeAuthedFetch, makeTokenProvider } from "./tokenProvider.js";
 import { attributionHeaders, fetchCatalog as defaultFetchCatalog, fetchContextBrief as defaultFetchContextBrief, getToken, getTokenExpiresAt as defaultGetTokenExpiresAt, getWorkspaceId as defaultGetWorkspaceId, isDriverCaller, resolveBaseUrl, tokenExpiryNotice, } from "./config.js";
 import { buildYagniProvider } from "./provider.js";
-import { orderDriverCatalog, registerStartTierGuard, registerTierCommand } from "./tierCommand.js";
+import { orderDriverCatalog, registerStartTierGuard, registerTierCommand, trailReason } from "./tierCommand.js";
+import { makeModelPickerListener } from "./modelPicker.js";
 import { registerChipEditor } from "./chipEditor.js";
 import { registerSlashCommandFilter } from "./slashCommandFilter.js";
 import { defaultMineBeatGit, fileMineBeatMarkers, maybeOfferMiningBeat as defaultMaybeOfferMiningBeat, } from "./mineBeat.js";
@@ -1186,11 +1187,12 @@ export async function registerYagni(pi, deps = {}) {
         // count as costHud's "Excludes N earlier /go runs." note.
         droppedSessionRuns,
     });
-    // The manual tier dial. `/model` (pi's own picker) now lists the four rungs
-    // because the driver catalog carries them; `/tier` is the tier-language
-    // sibling that reports and switches inline. The start guard is what keeps
-    // "movable" from becoming "parked on peak" — driver sessions only, since a
-    // child or eval lane names its tier on the command line.
+    // The manual tier dial. `/model` and Ctrl+L open YAGNI's own picker (the
+    // terminal-input listener wired on session_start below, modelPicker.ts);
+    // `/tier` is the tier-language sibling that reports and switches inline.
+    // The start guard is what keeps "movable" from becoming "parked on peak" —
+    // driver sessions only, since a child or eval lane names its tier on the
+    // command line.
     if (!evalMode && driver) {
         registerTierCommand(pi);
         registerStartTierGuard(pi);
@@ -1677,10 +1679,11 @@ export async function registerYagni(pi, deps = {}) {
             const mastheadCwd = formatCwd(process.cwd(), process.env.HOME);
             ctx.ui?.setHeader?.((_tui, theme) => new Text(buildMastheadString(theme, { version: mastheadVersion, cwd: mastheadCwd })));
             // Replace the built-in footer with the YAGNI status bar: folder +
-            // [worktree] + branch on line 1, model + token/cost stats + integer
-            // context % on line 2, and extension statuses (brand, todos, mode) on
-            // line 3. The factory captures ctx so the footer can read session data
-            // (token stats, context usage) that isn't on the footerData provider.
+            // [worktree] + branch on line 1; the tier in play, the permission mode,
+            // token/cost stats and integer context % on line 2; and extension
+            // statuses (brand, todos, mode) on line 3. The factory captures ctx so
+            // the footer can read session data (the model, token stats, context
+            // usage) that isn't on the footerData provider.
             ctx.ui?.setFooter?.((tui, theme, footerData) => createYagniFooterFactory(ctx, modeHolder, footerInvalidateHandle, childUsage)(tui, theme, footerData));
             ctx.ui?.onTerminalInput?.((data) => {
                 if (isShiftTab(data)) {
@@ -1690,6 +1693,24 @@ export async function registerYagni(pi, deps = {}) {
                 }
                 return undefined;
             });
+            // YAGNI's own model picker in place of pi's: Ctrl+L and Enter on a
+            // `/model` line are consumed here, before the editor sees them, and
+            // mount modelPicker.ts's panel. Driver sessions only, like /tier.
+            if (!evalMode && driver && ctx.hasUI) {
+                try {
+                    ctx.ui?.onTerminalInput?.(makeModelPickerListener(pi, ctx, { footer: footerInvalidateHandle }));
+                }
+                catch (err) {
+                    // The picker is a convenience over /tier; it must never break
+                    // session start. But a "Ctrl+L does nothing" report needs a trail.
+                    logEvent({
+                        source: "tier",
+                        level: "warn",
+                        event: "model_picker_register_failed",
+                        fields: { reason: trailReason(err) },
+                    });
+                }
+            }
             // Label the collapsed chain-of-thought line so users know it is reasoning
             // and how to reveal the full trace. Harmless when reasoning is expanded
             // (the label only shows on hidden thinking blocks). Fails closed to pi's

package/dist/extension/mcp/auth.d.ts

@@ -18,9 +18,11 @@
  * high port (or a fixed `oauth.callbackPort`), redirect_uri path `/callback`,
  * and validate the returned `state` to prevent CSRF.
  */
+import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
 import { type OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
 import type { AuthorizationServerMetadata, OAuthClientInformationMixed, OAuthClientMetadata, OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
 import type { McpHttpServerConfig } from "./config.js";
+import { type StoredOAuthEntry } from "./authStore.js";
 export interface AuthDeps {
     /** Open a URL in the browser; injected for tests, default is a best-effort opener. */
     openUrl?: (url: string) => Promise<void>;
@@ -57,8 +59,12 @@ export declare const DEFAULT_REDIRECT_PORT = 42000;
 /**
  * Build a provider for a server at connect time. The redirect URL is only used
  * when the SDK needs to (re)authorize; refresh- and access-token paths ignore
- * it, so a stable default port is fine here. `authenticate()` binds its own
- * fresh port and builds a dedicated provider for the interactive flow.
+ * it. A 401 at connect time with no stored client makes the SDK run dynamic
+ * client registration through THIS provider, so the port it advertises is the
+ * one the server pins — `authenticate()` reads it back from the auth store
+ * (`redirectUri`) and reuses it. Precedence: explicit `redirectUrl` >
+ * `oauth.callbackPort` > the redirect a previous registration pinned > the
+ * stable default port.
  */
 export declare function authProviderForServer(serverName: string, config: McpHttpServerConfig, redirectUrl?: string): YagniAuthProvider;
 /**
@@ -93,8 +99,51 @@ export declare function authenticate(serverName: string, config: McpHttpServerCo
     timeoutMs?: number;
     serverUrl?: string;
 }): Promise<OAuthResult>;
-/** Find a free loopback port (OS-assigned). */
-export declare function findFreePort(): Promise<number>;
+type CallbackHandler = (req: IncomingMessage, res: ServerResponse) => void;
+export interface RedirectListener {
+    server: ReturnType<typeof createServer>;
+    port: number;
+    /** Install the callback handler (waitForCode); until then non-marker requests get 404. */
+    arm(handler: CallbackHandler): void;
+    /** Set when the pinned port could not be bound and a fresh one was bound instead: the bind error. */
+    pinnedBindError?: string;
+}
+/**
+ * Every listener answers this path with a fixed marker, so a second flow that
+ * finds the pinned port taken can tell "one of our own callback listeners"
+ * (refuse: that flow's client must not be dropped from under it) from "some
+ * other program" (fresh port, re-register). Loopback only, by design: the
+ * answer is a constant and names nothing — not the server, not the flow.
+ */
+export declare const LISTENER_MARKER_PATH = "/.yagni-oauth-listener";
+export declare const LISTENER_MARKER_HEADER = "x-yagni-oauth-listener";
+/**
+ * Bind the loopback listener for an interactive flow and return the socket
+ * we hold, so the redirect_uri we advertise is the port we are listening on
+ * — decided by an actual bind, not a probe. A fixed `oauth.callbackPort`
+ * always wins (the operator registered it; a bind failure there is the
+ * error, not a fallback). Otherwise reuse the port a previous dynamic
+ * registration pinned when it can still be bound — the authorization server
+ * will reject any other redirect_uri for that client. When it cannot: one of
+ * our own listeners holding it means a concurrent flow for this server (an
+ * error; its client stays); anything else means a fresh OS-assigned port,
+ * and the caller re-registers the client. The probe's verdict is logged as
+ * `oauth_pinned_port_probe` so the later `oauth_client_reregister` reason
+ * is auditable.
+ */
+export declare function bindRedirectListener(serverName: string, config: McpHttpServerConfig, stored: Pick<StoredOAuthEntry, "clientId" | "redirectUri"> | undefined): Promise<RedirectListener>;
+export interface ListenerProbe {
+    /** `ours`: one of our callback listeners answered; `foreign`: something else answered; `no_answer`: refused, hung, or garbled. */
+    outcome: "ours" | "foreign" | "no_answer";
+    /** What the probe saw, for the log. */
+    detail: string;
+}
+/** Ask whoever holds `port` whether it is one of our callback listeners. Bounded (500ms), never throws. */
+export declare function probeListener(port: number): Promise<ListenerProbe>;
+/** Bind `port` (0 = OS-assigned) on 127.0.0.1; rejects when it cannot be bound. */
+export declare function listenOnLoopback(port: number): Promise<RedirectListener>;
+/** The port of a stored loopback redirect_uri, or undefined when it is not ours to parse. */
+export declare function portOfRedirectUri(redirectUri: string | undefined): number | undefined;
 export declare function buildRedirectUri(port: number): string;
 type CodeOutcomeEvent = "oauth_callback_code" | "oauth_callback_error" | "oauth_callback_state_mismatch" | "oauth_timeout" | "oauth_cancelled";
 export interface WaitForCodeOpts {