@yagni-app/code-staging 1.1.4-staging.1426.1 → 1.1.5-staging.1430.1

package/dist/doctor.d.ts

@@ -147,6 +147,29 @@ export interface McpProbe {
  * pending-approval cases read as `warn`, config errors as `fail` (non-required).
  */
 export declare function checkMcpConfig(probe: McpProbe): CheckResult;
+/** Config-only snapshot of the Claude Code MCP bridge (claudeImport.ts). */
+export interface ClaudeImportProbe {
+    /** `~/.claude.json` exists (and the bridge is not disabled). */
+    exists: boolean;
+    /** Set when the file exists but could not be parsed. */
+    parseError?: string;
+    /** The same one-line notice the session-start banner shows, when the gap is non-empty. */
+    notice?: string;
+    /** Claude Code server names not configured here. */
+    importable: string[];
+    /** claude.ai connectors with a public MCP equivalent not configured here. */
+    connectorSuggestions: string[];
+    /** Claude Code has `.mcp.json` approvals for this checkout that ours lack. */
+    approvals: boolean;
+    /** The probe itself failed (bundled extension broken, config unreadable) while ~/.claude.json exists. */
+    probeError?: string;
+}
+/**
+ * Advisory (never required) line for the Claude Code bridge. Absent entirely
+ * when there is no `~/.claude.json` — a machine without Claude Code has
+ * nothing to say here. Reads config only; never connects.
+ */
+export declare function checkClaudeImport(probe: ClaudeImportProbe): CheckResult | null;
 /** What the Windows bash probe found (pi needs a bash — Git Bash — on win32). */
 export interface BashProbe {
     found: boolean;
@@ -179,6 +202,8 @@ export interface DoctorDeps {
     probeLatestVersion?: () => Promise<string | null>;
     /** MCP config snapshot (config-only, no connections). */
     probeMcp?: () => Promise<McpProbe>;
+    /** Claude Code bridge snapshot (config-only). */
+    probeClaudeImport?: () => Promise<ClaudeImportProbe>;
     /** Certificate-authority configuration of the running process. */
     probeCaTrust?: () => CaTrustProbe;
     /** OTel gate resolution (env / workspace / repo settings); tests stub it. */

package/dist/doctor.js

@@ -13,6 +13,7 @@
  * Advisory checks (loose perms, missing `gh`) never flip the exit code.
  */
 import { existsSync, readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
 import { delimiter, join } from "node:path";
 import { credentialsDir } from "./credentials.js";
 import { currentCliVersion, fetchLatestVersion, isNewerVersion } from "./upgrade.js";
@@ -20,6 +21,7 @@ import { classifyTokenExpiry } from "./launch.js";
 import { otelChildEnv, resolveOtelLaunchWithWorkspace } from "./otel.js";
 import { resolveExtensionPath, resolvePiCliPath, resolvePiPackageDir, resolveTelemetryProbePath } from "./paths.js";
 import { readActiveProfile } from "./profiles.js";
+import { DISTRIBUTION } from "./distribution.js";
 import { resolveMcpConfigPath } from "./mcpCommand.js";
 import { MIN_NODE_VERSION, nodeVersionSatisfies } from "./nodeVersion.js";
 import { EXTRA_CA_ENV, SYSTEM_CA_ENV, SYSTEM_CA_FLAG, childCaEnv, sessionExecArgv, findTlsCertError, nodeOptionsHaveSystemCa, systemCaEnabled, systemCaEnvSupported, systemCaFlagSupported, } from "./tlsTrust.js";
@@ -414,6 +416,52 @@ export function checkMcpConfig(probe) {
         required: false,
     };
 }
+/**
+ * Advisory (never required) line for the Claude Code bridge. Absent entirely
+ * when there is no `~/.claude.json` — a machine without Claude Code has
+ * nothing to say here. Reads config only; never connects.
+ */
+export function checkClaudeImport(probe) {
+    if (!probe.exists)
+        return null;
+    if (probe.probeError) {
+        return {
+            name: "claude code mcp",
+            status: "warn",
+            detail: `could not compare with ~/.claude.json (${probe.probeError})`,
+            hint: "run `yagni mcp add-from-claude` for the full error, or `yagni upgrade` if the extension is missing",
+            required: false,
+        };
+    }
+    if (probe.parseError) {
+        return {
+            name: "claude code mcp",
+            status: "warn",
+            detail: `~/.claude.json unreadable (${probe.parseError})`,
+            hint: "fix the file so Claude Code's MCP servers can be imported",
+            required: false,
+        };
+    }
+    const gaps = [];
+    if (probe.importable.length > 0) {
+        gaps.push(`${probe.importable.length} server${probe.importable.length === 1 ? "" : "s"} not imported (${probe.importable.join(", ")})`);
+    }
+    if (probe.approvals)
+        gaps.push("repo approvals not imported");
+    if (probe.connectorSuggestions.length > 0) {
+        gaps.push(`${probe.connectorSuggestions.length} claude.ai connector${probe.connectorSuggestions.length === 1 ? "" : "s"} with a public MCP (${probe.connectorSuggestions.join(", ")})`);
+    }
+    if (gaps.length === 0) {
+        return { name: "claude code mcp", status: "ok", detail: "in sync with ~/.claude.json", required: false };
+    }
+    return {
+        name: "claude code mcp",
+        status: "warn",
+        detail: gaps.join("; "),
+        hint: probe.notice ?? "run `yagni mcp add-from-claude`",
+        required: false,
+    };
+}
 export function checkBash(probe) {
     if (!probe.found) {
         return {
@@ -501,6 +549,43 @@ function defaultProbeStateDir() {
         return { path, exists: false, mode: null };
     }
 }
+async function defaultProbeClaudeImport(env = process.env) {
+    const none = { exists: false, importable: [], connectorSuggestions: [], approvals: false };
+    if (env.YAGNI_CODE_MCP_DISABLED === "1")
+        return none;
+    try {
+        const mod = (await import(resolveMcpConfigPath()));
+        if (typeof mod?.readClaudeMcpInventory !== "function" ||
+            typeof mod.claudeImportGap !== "function" ||
+            typeof mod.claudeImportNotice !== "function") {
+            return none;
+        }
+        const cwd = process.cwd();
+        const repoRoot = mod.resolveProjectRoot(cwd);
+        const inventory = mod.readClaudeMcpInventory({ cwd, repoRoot, env });
+        if (!inventory.exists)
+            return none;
+        if (inventory.parseError)
+            return { ...none, exists: true, parseError: inventory.parseError };
+        const loaded = mod.loadMcpServers(cwd, env);
+        const { state } = mod.readProjectApproval(repoRoot);
+        const gap = mod.claudeImportGap(inventory, loaded.servers, state, DISTRIBUTION.commandName);
+        return {
+            exists: true,
+            notice: mod.claudeImportNotice(gap, DISTRIBUTION.commandName),
+            importable: gap.importable.map((c) => c.name),
+            connectorSuggestions: gap.connectorSuggestions.map((c) => c.name),
+            approvals: gap.approvals !== undefined,
+        };
+    }
+    catch (err) {
+        // Advisory only: a probe that cannot run must never fail doctor — but a
+        // machine that HAS ~/.claude.json must not read as "no Claude Code".
+        if (!existsSync(join(homedir(), ".claude.json")))
+            return none;
+        return { ...none, exists: true, probeError: err instanceof Error ? err.message : String(err) };
+    }
+}
 async function defaultProbeMcp(env = process.env) {
     const disabled = env.YAGNI_CODE_MCP_DISABLED === "1";
     if (disabled)
@@ -633,6 +718,7 @@ export async function gatherChecks(deps = {}) {
     const probeBackend = deps.probeBackend ?? defaultProbeBackend;
     const probeStateDir = deps.probeStateDir ?? defaultProbeStateDir;
     const probeMcp = deps.probeMcp ?? (() => defaultProbeMcp());
+    const probeClaudeImport = deps.probeClaudeImport ?? (() => defaultProbeClaudeImport());
     const probeCaTrust = deps.probeCaTrust ?? (() => defaultProbeCaTrust());
     const ghOnPath = deps.ghOnPath ?? (() => ghOnPathDefault());
     const platform = deps.platform ?? process.platform;
@@ -665,6 +751,9 @@ export async function gatherChecks(deps = {}) {
     checks.push(checkStateDir(probeStateDir()));
     checks.push(checkGh(ghOnPath()));
     checks.push(checkMcpConfig(await probeMcp()));
+    const claudeImport = checkClaudeImport(await probeClaudeImport());
+    if (claudeImport)
+        checks.push(claudeImport);
     const resolveOtel = deps.resolveOtel ??
         ((p) => resolveOtelLaunchWithWorkspace({
             env: process.env,

package/dist/extension/mcp/auth.d.ts

@@ -18,9 +18,11 @@
  * high port (or a fixed `oauth.callbackPort`), redirect_uri path `/callback`,
  * and validate the returned `state` to prevent CSRF.
  */
+import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
 import { type OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
 import type { AuthorizationServerMetadata, OAuthClientInformationMixed, OAuthClientMetadata, OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
 import type { McpHttpServerConfig } from "./config.js";
+import { type StoredOAuthEntry } from "./authStore.js";
 export interface AuthDeps {
     /** Open a URL in the browser; injected for tests, default is a best-effort opener. */
     openUrl?: (url: string) => Promise<void>;
@@ -57,8 +59,12 @@ export declare const DEFAULT_REDIRECT_PORT = 42000;
 /**
  * Build a provider for a server at connect time. The redirect URL is only used
  * when the SDK needs to (re)authorize; refresh- and access-token paths ignore
- * it, so a stable default port is fine here. `authenticate()` binds its own
- * fresh port and builds a dedicated provider for the interactive flow.
+ * it. A 401 at connect time with no stored client makes the SDK run dynamic
+ * client registration through THIS provider, so the port it advertises is the
+ * one the server pins — `authenticate()` reads it back from the auth store
+ * (`redirectUri`) and reuses it. Precedence: explicit `redirectUrl` >
+ * `oauth.callbackPort` > the redirect a previous registration pinned > the
+ * stable default port.
  */
 export declare function authProviderForServer(serverName: string, config: McpHttpServerConfig, redirectUrl?: string): YagniAuthProvider;
 /**
@@ -93,8 +99,51 @@ export declare function authenticate(serverName: string, config: McpHttpServerCo
     timeoutMs?: number;
     serverUrl?: string;
 }): Promise<OAuthResult>;
-/** Find a free loopback port (OS-assigned). */
-export declare function findFreePort(): Promise<number>;
+type CallbackHandler = (req: IncomingMessage, res: ServerResponse) => void;
+export interface RedirectListener {
+    server: ReturnType<typeof createServer>;
+    port: number;
+    /** Install the callback handler (waitForCode); until then non-marker requests get 404. */
+    arm(handler: CallbackHandler): void;
+    /** Set when the pinned port could not be bound and a fresh one was bound instead: the bind error. */
+    pinnedBindError?: string;
+}
+/**
+ * Every listener answers this path with a fixed marker, so a second flow that
+ * finds the pinned port taken can tell "one of our own callback listeners"
+ * (refuse: that flow's client must not be dropped from under it) from "some
+ * other program" (fresh port, re-register). Loopback only, by design: the
+ * answer is a constant and names nothing — not the server, not the flow.
+ */
+export declare const LISTENER_MARKER_PATH = "/.yagni-oauth-listener";
+export declare const LISTENER_MARKER_HEADER = "x-yagni-oauth-listener";
+/**
+ * Bind the loopback listener for an interactive flow and return the socket
+ * we hold, so the redirect_uri we advertise is the port we are listening on
+ * — decided by an actual bind, not a probe. A fixed `oauth.callbackPort`
+ * always wins (the operator registered it; a bind failure there is the
+ * error, not a fallback). Otherwise reuse the port a previous dynamic
+ * registration pinned when it can still be bound — the authorization server
+ * will reject any other redirect_uri for that client. When it cannot: one of
+ * our own listeners holding it means a concurrent flow for this server (an
+ * error; its client stays); anything else means a fresh OS-assigned port,
+ * and the caller re-registers the client. The probe's verdict is logged as
+ * `oauth_pinned_port_probe` so the later `oauth_client_reregister` reason
+ * is auditable.
+ */
+export declare function bindRedirectListener(serverName: string, config: McpHttpServerConfig, stored: Pick<StoredOAuthEntry, "clientId" | "redirectUri"> | undefined): Promise<RedirectListener>;
+export interface ListenerProbe {
+    /** `ours`: one of our callback listeners answered; `foreign`: something else answered; `no_answer`: refused, hung, or garbled. */
+    outcome: "ours" | "foreign" | "no_answer";
+    /** What the probe saw, for the log. */
+    detail: string;
+}
+/** Ask whoever holds `port` whether it is one of our callback listeners. Bounded (500ms), never throws. */
+export declare function probeListener(port: number): Promise<ListenerProbe>;
+/** Bind `port` (0 = OS-assigned) on 127.0.0.1; rejects when it cannot be bound. */
+export declare function listenOnLoopback(port: number): Promise<RedirectListener>;
+/** The port of a stored loopback redirect_uri, or undefined when it is not ours to parse. */
+export declare function portOfRedirectUri(redirectUri: string | undefined): number | undefined;
 export declare function buildRedirectUri(port: number): string;
 type CodeOutcomeEvent = "oauth_callback_code" | "oauth_callback_error" | "oauth_callback_state_mismatch" | "oauth_timeout" | "oauth_cancelled";
 export interface WaitForCodeOpts {