agent-nuvira 3.4.0 → 3.5.0

package/dist/mcp/custom-server.js

@@ -0,0 +1,330 @@
+/**
+ * Custom MCP servers — the "configuration, not code" half of MCP.
+ *
+ * WHY THIS EXISTS. Discovery has always been data-driven: `discoverConfigs()`
+ * reads `*.json` from `~/.nuvira/mcp/`, so a hand-written file for a server we
+ * have never heard of connects with no code change. What was missing was an
+ * AUTHORING path — a user had to hand-write JSON to add anything outside the
+ * catalog, and the dashboard could not add it at all. This module is the one
+ * validator/writer both surfaces call, so a config accepted in the terminal
+ * cannot be refused in the dashboard, and vice versa.
+ *
+ * It is deliberately SEPARATE from `catalog.ts`: the catalog decides which
+ * curated variant this machine can run (probes, pins, prerequisite gates). A
+ * custom server has none of that — the user names the command, and the only
+ * gate is that the result must be a config `discoverConfigs()` can connect to.
+ * A name in the catalog is NOT reserved: configuring `github` by hand is a
+ * supported choice, not a conflict (we just say which one is in play).
+ *
+ * SECRETS. `env` values and auth headers are written to disk, so a config that
+ * carries any is chmod 0600 (best-effort — Windows has no mode bits) and is
+ * NEVER read back over the API: the dashboard reports env KEY NAMES only.
+ */
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { resolveMcpConfigDir } from '../config/paths.js';
+import { logger } from '../utils/logger.js';
+import { getCatalogEntry } from './catalog.js';
+/**
+ * What a name may contain.
+ *
+ * A name becomes BOTH a config filename (`<name>.json`) and a settings key
+ * (`mcp.servers.<name>.enabled`), and the settings grammar is dot-separated —
+ * so a dot in a name would produce a server that can never be enabled or
+ * disabled from either surface, and a `/` or `..` would escape the config dir.
+ * Restricting the character set is what makes "any name" safe, so the refusal
+ * says exactly that rather than failing later at connect time.
+ */
+export const SERVER_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+export const SERVER_NAME_MAX = 64;
+export const ENV_KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+export const HEADER_NAME_PATTERN = /^[A-Za-z0-9-]+$/;
+/** Bounds that stop a typo from writing an absurd file (`--arg` in a loop). */
+const MAX_ARGS = 64;
+const MAX_ENTRIES = 64;
+const isPlainObject = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+/** A string with no control characters — a newline in a command is never intentional. */
+function cleanString(value, field) {
+    if (typeof value !== 'string')
+        return null;
+    const trimmed = value.trim();
+    if (!trimmed)
+        return null;
+    // eslint-disable-next-line no-control-regex
+    if (/[\u0000-\u001f\u007f]/.test(trimmed))
+        return null;
+    return trimmed;
+}
+function stringRecord(value, field, keyPattern, keyLabel) {
+    if (value === undefined || value === null)
+        return { ok: true, record: {} };
+    if (!isPlainObject(value))
+        return { ok: false, error: `${field} must be an object of string values` };
+    const entries = Object.entries(value);
+    if (entries.length > MAX_ENTRIES) {
+        return { ok: false, error: `${field} has ${entries.length} entries — the limit is ${MAX_ENTRIES}` };
+    }
+    const record = {};
+    for (const [key, raw] of entries) {
+        if (!keyPattern.test(key)) {
+            return { ok: false, error: `${field} key '${key}' is not a valid ${keyLabel}` };
+        }
+        if (typeof raw !== 'string')
+            return { ok: false, error: `${field}.${key} must be a string` };
+        // eslint-disable-next-line no-control-regex
+        if (/[\u0000-\u001f\u007f]/.test(raw))
+            return { ok: false, error: `${field}.${key} contains a control character` };
+        record[key] = raw;
+    }
+    return { ok: true, record };
+}
+/**
+ * Validate a user-supplied server into the exact shape `discoverConfigs()`
+ * consumes. Pure: no I/O, so the CLI can validate before prompting and the
+ * dashboard can validate before gating on a role.
+ */
+export function validateServerSpec(input) {
+    if (!isPlainObject(input))
+        return { ok: false, error: 'Expected a config object.' };
+    const warnings = [];
+    const name = typeof input.name === 'string' ? input.name.trim() : '';
+    if (!name)
+        return { ok: false, error: 'A server name is required.' };
+    if (name.length > SERVER_NAME_MAX) {
+        return { ok: false, error: `The name is ${name.length} characters — the limit is ${SERVER_NAME_MAX}.` };
+    }
+    if (!SERVER_NAME_PATTERN.test(name)) {
+        return {
+            ok: false,
+            error: `'${name}' is not a usable server name. Use letters, digits, '_' and '-' (no dots, spaces, or slashes): ` +
+                `the name is the config filename and the 'mcp.servers.<name>' settings key, so '.' or '/' would make ` +
+                `the server unmanageable from the CLI and the dashboard.`,
+        };
+    }
+    const transportRaw = input.transport;
+    if (transportRaw !== undefined && transportRaw !== 'stdio' && transportRaw !== 'sse') {
+        return { ok: false, error: `transport must be 'stdio' or 'sse' (got '${String(transportRaw)}').` };
+    }
+    const command = cleanString(input.command, 'command');
+    const url = cleanString(input.url, 'url');
+    if (input.command !== undefined && command === null) {
+        return { ok: false, error: 'command must be a non-empty string with no control characters.' };
+    }
+    if (input.url !== undefined && url === null) {
+        return { ok: false, error: 'url must be a non-empty string with no control characters.' };
+    }
+    // Transport: explicit when given, else inferred — and refused when the two
+    // shapes are mixed, because a config with both a command and a url has no
+    // single obvious meaning and `discoverConfigs` would have to guess.
+    let transport;
+    if (transportRaw === 'stdio' || transportRaw === 'sse')
+        transport = transportRaw;
+    else if (url && !command)
+        transport = 'sse';
+    else if (command && !url)
+        transport = 'stdio';
+    else if (command && url) {
+        return { ok: false, error: 'Pass either a command (stdio) or a url (sse), not both.' };
+    }
+    else {
+        return { ok: false, error: 'Nothing to run: pass --command <path> (stdio) or --url <url> (sse).' };
+    }
+    if (transport === 'stdio') {
+        if (!command)
+            return { ok: false, error: 'stdio needs a command, e.g. --command npx.' };
+        if (url)
+            return { ok: false, error: 'stdio takes no url — drop it or use --transport sse.' };
+    }
+    else {
+        if (!url)
+            return { ok: false, error: 'sse needs a url, e.g. --url https://example.com/mcp.' };
+        if (command)
+            return { ok: false, error: 'sse takes no command — drop it or use --transport stdio.' };
+        let parsed;
+        try {
+            parsed = new URL(url);
+        }
+        catch {
+            return { ok: false, error: `'${url}' is not a valid URL.` };
+        }
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+            return { ok: false, error: `The url must be http(s) (got '${parsed.protocol}').` };
+        }
+        if (parsed.protocol === 'http:') {
+            warnings.push('This endpoint is plain http — credentials and tool results travel unencrypted.');
+        }
+    }
+    const argsRaw = input.args;
+    let args;
+    if (argsRaw !== undefined && argsRaw !== null) {
+        if (!Array.isArray(argsRaw))
+            return { ok: false, error: 'args must be an array of strings.' };
+        if (argsRaw.length > MAX_ARGS) {
+            return { ok: false, error: `args has ${argsRaw.length} entries — the limit is ${MAX_ARGS}.` };
+        }
+        args = [];
+        for (const arg of argsRaw) {
+            if (typeof arg !== 'string')
+                return { ok: false, error: 'Every args entry must be a string.' };
+            // eslint-disable-next-line no-control-regex
+            if (/[\u0000-\u001f\u007f]/.test(arg))
+                return { ok: false, error: 'An args entry contains a control character.' };
+            args.push(arg);
+        }
+        if (transport === 'sse' && args.length > 0) {
+            return { ok: false, error: 'sse takes no args — they only apply to a stdio command.' };
+        }
+        if (args.length === 0)
+            args = undefined;
+    }
+    const envResult = stringRecord(input.env, 'env', ENV_KEY_PATTERN, 'environment variable name');
+    if (!envResult.ok)
+        return { ok: false, error: envResult.error };
+    const headerResult = stringRecord(input.headers, 'headers', HEADER_NAME_PATTERN, 'HTTP header name');
+    if (!headerResult.ok)
+        return { ok: false, error: headerResult.error };
+    if (transport === 'stdio' && Object.keys(headerResult.record).length > 0) {
+        return { ok: false, error: 'headers only apply to a remote (sse) server — for stdio, put credentials in --env.' };
+    }
+    if (input.enabled !== undefined && typeof input.enabled !== 'boolean') {
+        return { ok: false, error: 'enabled must be true or false.' };
+    }
+    // Reported, never silent: a catalog name configured by hand is legitimate,
+    // but the user should know which one will be used.
+    if (getCatalogEntry(name)) {
+        warnings.push(`'${name}' is also a catalog capability — this config is what will be used; ` +
+            `\`mcp install\` would write the same file.`);
+    }
+    const config = {
+        name,
+        transport,
+        enabled: input.enabled ?? true,
+        ...(command ? { command } : {}),
+        ...(args ? { args } : {}),
+        ...(url ? { url } : {}),
+        ...(Object.keys(headerResult.record).length > 0 ? { headers: headerResult.record } : {}),
+        ...(Object.keys(envResult.record).length > 0 ? { env: envResult.record } : {}),
+    };
+    return { ok: true, config, warnings };
+}
+/** Does this config carry a credential? Decides the file mode. */
+export function carriesSecret(config) {
+    if (config.env && Object.keys(config.env).length > 0)
+        return true;
+    return Object.entries(config.headers ?? {}).some(([key]) => ['authorization', 'cookie', 'x-api-key', 'api-key', 'x-auth-token'].includes(key.toLowerCase()));
+}
+/**
+ * Write one server config, refusing to clobber an existing file unless asked.
+ *
+ * The refusal matters: `<name>.json` may be a catalog install with a verified
+ * pin, and silently replacing it would turn "I typed the wrong name" into a
+ * broken server.
+ */
+export function writeServerConfig(config, options = {}) {
+    const dir = resolveMcpConfigDir(options.configDir);
+    const target = join(dir, `${config.name}.json`);
+    const exists = existsSync(target);
+    if (exists && !options.force) {
+        return { ok: false, reason: `'${config.name}' is already configured at ${target} (pass force to replace it).` };
+    }
+    let next = config;
+    const warnings = [...(options.warnings ?? [])];
+    let droppedEnvKeys = [];
+    if (exists && options.mergeEnv) {
+        const previous = readServerConfig(config.name, options.configDir);
+        if (previous) {
+            // Existing fields survive unless this write sets them: credentials (whose
+            // values the page is never shown), plus the fields a page has no control
+            // for — `oauth`, `variant`, `runtime`.
+            const env = { ...(previous.env ?? {}), ...(config.env ?? {}) };
+            const headers = { ...(previous.headers ?? {}), ...(config.headers ?? {}) };
+            next = {
+                ...previous,
+                ...config,
+                ...(Object.keys(env).length > 0 ? { env } : {}),
+                ...(Object.keys(headers).length > 0 ? { headers } : {}),
+            };
+            // A transport switch must not leave the OTHER transport's fields behind:
+            // `...previous` would happily keep a stdio `command` on a remote server
+            // (or a `url` on a local one), and discovery would see a config that means
+            // two things at once.
+            if (next.transport === 'sse') {
+                delete next.command;
+                delete next.args;
+            }
+            else {
+                delete next.url;
+                delete next.headers;
+            }
+            warnings.push('Kept the credentials and settings the existing config had — an edit never deletes what it cannot show.');
+        }
+    }
+    else if (exists) {
+        // Exact rewrite (CLI `--force`): name what this replaced, so a dropped token
+        // or an orphaned OAuth block is a reported fact rather than a server that
+        // fails later in a turn.
+        const previous = readServerConfig(config.name, options.configDir);
+        droppedEnvKeys = Object.keys(previous?.env ?? {}).filter((key) => !(key in (config.env ?? {})));
+        if (previous?.oauth && !config.oauth) {
+            warnings.push('the replaced config had an OAuth block — authorize again before relying on it.');
+        }
+        if (previous?.variant && !config.variant) {
+            warnings.push(`the replaced config was the '${previous.variant}' variant of a catalog capability.`);
+        }
+        if (previous?.runtime && !config.runtime) {
+            warnings.push('the replaced config had a runtime override; re-apply it or set mcp.servers.<name>.runtime.command.');
+        }
+    }
+    try {
+        mkdirSync(dir, { recursive: true });
+        writeFileSync(target, JSON.stringify(next, null, 2), 'utf-8');
+        // §7.8 hygiene, matching the catalog installer: a file that carries a
+        // credential is not world-readable. Best-effort (Windows has no mode bits).
+        try {
+            chmodSync(target, carriesSecret(next) ? 0o600 : 0o644);
+        }
+        catch {
+            /* best-effort */
+        }
+        logger.debug(`MCP custom server: wrote '${config.name}' → ${target}`);
+        return {
+            ok: true,
+            path: target,
+            ...(exists ? { overwrote: true } : {}),
+            ...(warnings.length > 0 ? { warnings } : {}),
+            ...(droppedEnvKeys.length > 0 ? { droppedEnvKeys } : {}),
+        };
+    }
+    catch (err) {
+        return { ok: false, reason: `write failed: ${err instanceof Error ? err.message : String(err)}` };
+    }
+}
+/**
+ * Read a stored config by name. Returns null for an absent or malformed file —
+ * a broken file is discovery's problem, not an exception for the caller.
+ */
+export function readServerConfig(name, configDir) {
+    if (!SERVER_NAME_PATTERN.test(name))
+        return null;
+    const target = join(resolveMcpConfigDir(configDir), `${name}.json`);
+    try {
+        if (!existsSync(target))
+            return null;
+        return JSON.parse(readFileSync(target, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Is this name a catalog capability or a custom config? Reporting only — the
+ * connect path does not care where a config came from.
+ */
+export function serverOrigin(name, configDir) {
+    const config = readServerConfig(name, configDir);
+    const entry = getCatalogEntry(name);
+    if (config?.variant)
+        return { origin: 'catalog', variant: config.variant };
+    return entry ? { origin: 'catalog', variant: null } : { origin: 'custom', variant: null };
+}
+//# sourceMappingURL=custom-server.js.map

package/dist/mcp/custom-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-server.js","sourceRoot":"","sources":["../../src/mcp/custom-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAG/C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AACjE,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,MAAM,CAAC,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAC1D,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAErD,+EAA+E;AAC/E,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,WAAW,GAAG,EAAE,CAAC;AAoCvB,MAAM,aAAa,GAAG,CAAC,KAAc,EAAoC,EAAE,CACzE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEvE,yFAAyF;AACzF,SAAS,WAAW,CAAC,KAAc,EAAE,KAAa;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,4CAA4C;IAC5C,IAAI,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CACnB,KAAc,EACd,KAAa,EACb,UAAkB,EAClB,QAAgB;IAEhB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC3E,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,qCAAqC,EAAE,CAAC;IACtG,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,QAAQ,OAAO,CAAC,MAAM,2BAA2B,WAAW,EAAE,EAAE,CAAC;IACtG,CAAC;IACD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,SAAS,GAAG,oBAAoB,QAAQ,EAAE,EAAE,CAAC;QAClF,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,IAAI,GAAG,mBAAmB,EAAE,CAAC;QAC7F,4CAA4C;QAC5C,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,IAAI,GAAG,+BAA+B,EAAE,CAAC;QACnH,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACpB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;IACpF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;IACrE,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,IAAI,CAAC,MAAM,8BAA8B,eAAe,GAAG,EAAE,CAAC;IAC1G,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,IAAI,IAAI,iGAAiG;gBACzG,sGAAsG;gBACtG,yDAAyD;SAC5D,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC;IACrC,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,OAAO,IAAI,YAAY,KAAK,KAAK,EAAE,CAAC;QACrF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4CAA4C,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACrG,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gEAAgE,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4DAA4D,EAAE,CAAC;IAC5F,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,oEAAoE;IACpE,IAAI,SAA0B,CAAC;IAC/B,IAAI,YAAY,KAAK,OAAO,IAAI,YAAY,KAAK,KAAK;QAAE,SAAS,GAAG,YAAY,CAAC;SAC5E,IAAI,GAAG,IAAI,CAAC,OAAO;QAAE,SAAS,GAAG,KAAK,CAAC;SACvC,IAAI,OAAO,IAAI,CAAC,GAAG;QAAE,SAAS,GAAG,OAAO,CAAC;SACzC,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yDAAyD,EAAE,CAAC;IACzF,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qEAAqE,EAAE,CAAC;IACrG,CAAC;IAED,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;QACxF,IAAI,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC;IAC/F,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC;QAC9F,IAAI,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0DAA0D,EAAE,CAAC;QACrG,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,GAAG,uBAAuB,EAAE,CAAC;QAC9D,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,MAAM,CAAC,QAAQ,KAAK,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;IAC3B,IAAI,IAA0B,CAAC;IAC/B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;QAC9F,IAAI,OAAO,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;YAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,OAAO,CAAC,MAAM,2BAA2B,QAAQ,GAAG,EAAE,CAAC;QAChG,CAAC;QACD,IAAI,GAAG,EAAE,CAAC;QACV,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;YAC/F,4CAA4C;YAC5C,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC;YAClH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;QACD,IAAI,SAAS,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yDAAyD,EAAE,CAAC;QACzF,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,GAAG,SAAS,CAAC;IAC1C,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,2BAA2B,CAAC,CAAC;IAC/F,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;IAChE,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,CAAC;IACrG,IAAI,CAAC,YAAY,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC;IACtE,IAAI,SAAS,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oFAAoF,EAAE,CAAC;IACpH,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;IAChE,CAAC;IAED,2EAA2E;IAC3E,mDAAmD;IACnD,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CACX,IAAI,IAAI,qEAAqE;YAC3E,4CAA4C,CAC/C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAoB;QAC9B,IAAI;QACJ,SAAS;QACT,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;QAC9B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/E,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,aAAa,CAAC,MAAgD;IAC5E,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CACzD,CAAC,eAAe,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAChG,CAAC;AACJ,CAAC;AAqBD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAuB,EAAE,UAA8B,EAAE;IACzF,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAElC,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,8BAA8B,MAAM,8BAA8B,EAAE,CAAC;IAClH,CAAC;IAED,IAAI,IAAI,GAAoB,MAAM,CAAC;IACnC,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,cAAc,GAAa,EAAE,CAAC;IAClC,IAAI,MAAM,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAClE,IAAI,QAAQ,EAAE,CAAC;YACb,0EAA0E;YAC1E,yEAAyE;YACzE,uCAAuC;YACvC,MAAM,GAAG,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3E,IAAI,GAAG;gBACL,GAAG,QAAQ;gBACX,GAAG,MAAM;gBACT,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,CAAC;YACF,yEAAyE;YACzE,wEAAwE;YACxE,2EAA2E;YAC3E,sBAAsB;YACtB,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,OAAO,CAAC;gBACpB,OAAO,IAAI,CAAC,IAAI,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,GAAG,CAAC;gBAChB,OAAO,IAAI,CAAC,OAAO,CAAC;YACtB,CAAC;YACD,QAAQ,CAAC,IAAI,CACX,wGAAwG,CACzG,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,EAAE,CAAC;QAClB,6EAA6E;QAC7E,0EAA0E;QAC1E,yBAAyB;QACzB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAClE,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChG,IAAI,QAAQ,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,QAAQ,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzC,QAAQ,CAAC,IAAI,CAAC,gCAAgC,QAAQ,CAAC,OAAO,oCAAoC,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,QAAQ,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzC,QAAQ,CAAC,IAAI,CAAC,oGAAoG,CAAC,CAAC;QACtH,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC9D,sEAAsE;QACtE,4EAA4E;QAC5E,IAAI,CAAC;YACH,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,6BAA6B,MAAM,CAAC,IAAI,OAAO,MAAM,EAAE,CAAC,CAAC;QACtE,OAAO;YACL,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,MAAM;YACZ,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACpG,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,SAAkB;IAC/D,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAoB,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,SAAkB;IAC3D,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC3E,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC5F,CAAC"}

package/dist/mcp/manager.d.ts

@@ -10,9 +10,17 @@ import { type MCPServerConfig, type MCPConnectionState, type Tool, type CallTool
 export declare class MCPManager {
     private clients;
     private configDir;
+    /**
+     * Where `buffconfig.json` is read from for `mcp.*` overrides. Undefined =
+     * the resolved config dir (honouring `$NUVIRA_CONFIG_DIR`). When a caller
+     * passes an explicit MCP dir (tests), settings resolve from its PARENT so a
+     * temp dir never picks up the developer's own `mcp.servers` overrides.
+     */
+    private settingsDir?;
     constructor(configDir?: string);
     /**
-     * Discover MCP server configurations from the config directory.
+     * Discover MCP server configurations from the config directory, with the
+     * `mcp.servers.*` overrides applied (enable/disable, runtime override, args).
      * Looks for *.json files in ~/.nuvira/mcp/ and subdirectories.
      */
     discoverConfigs(): MCPServerConfig[];

package/dist/mcp/manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/mcp/manager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,IAAI,EAGT,KAAK,cAAc,EACpB,MAAM,YAAY,CAAC;AAIpB,qBAAa,UAAU;IACrB,OAAO,CAAC,OAAO,CAAqC;IACpD,OAAO,CAAC,SAAS,CAAS;gBAEd,SAAS,CAAC,EAAE,MAAM;IAS9B;;;OAGG;IACH,eAAe,IAAI,eAAe,EAAE;IA6CpC;;;OAGG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAwC/C;;;;;;;;OAQG;IACH,OAAO,CAAC,sBAAsB;IAe9B;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IAkBxC;;OAEG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAQ9B;;OAEG;IACH,aAAa,IAAI,IAAI;IASrB;;OAEG;IACH,WAAW,IAAI,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,CAAC;IAcpD;;;OAGG;IACG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,cAAc,CAAA;KAAE,GAAG,IAAI,CAAC;IAcxH;;OAEG;IACH,YAAY,IAAI,kBAAkB,EAAE;IA8BpC;;;OAGG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAK9C;;OAEG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;CAGnC;AAwDD,wBAAgB,aAAa,IAAI,UAAU,CAK1C;AAED,wBAAgB,eAAe,IAAI,IAAI,CAKtC"}
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/mcp/manager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,IAAI,EAGT,KAAK,cAAc,EACpB,MAAM,YAAY,CAAC;AAIpB,qBAAa,UAAU;IACrB,OAAO,CAAC,OAAO,CAAqC;IACpD,OAAO,CAAC,SAAS,CAAS;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,WAAW,CAAC,CAAS;gBAEjB,SAAS,CAAC,EAAE,MAAM;IAU9B;;;;OAIG;IACH,eAAe,IAAI,eAAe,EAAE;IAgDpC;;;OAGG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAwC/C;;;;;;;;OAQG;IACH,OAAO,CAAC,sBAAsB;IAe9B;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IAkBxC;;OAEG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAQ9B;;OAEG;IACH,aAAa,IAAI,IAAI;IASrB;;OAEG;IACH,WAAW,IAAI,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,CAAC;IAcpD;;;OAGG;IACG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,cAAc,CAAA;KAAE,GAAG,IAAI,CAAC;IAcxH;;OAEG;IACH,YAAY,IAAI,kBAAkB,EAAE;IA8BpC;;;OAGG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAK9C;;OAEG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;CAGnC;AAwDD,wBAAgB,aAAa,IAAI,UAAU,CAK1C;AAED,wBAAgB,eAAe,IAAI,IAAI,CAKtC"}

package/dist/mcp/manager.js

@@ -11,19 +11,29 @@ import { resolveMcpConfigDir } from '../config/paths.js';
 import { logger } from '../utils/logger.js';
 import { getMCPSchemaCache, MCPSchemaCache } from './mcp-schema-cache.js';
 import { MCPClient } from './client.js';
+import { applyServerOverrides, loadMcpSettings } from './settings.js';
 // ─── MCP Manager ────────────────────────────────────────────────────────────
 export class MCPManager {
     clients = new Map();
     configDir;
+    /**
+     * Where `buffconfig.json` is read from for `mcp.*` overrides. Undefined =
+     * the resolved config dir (honouring `$NUVIRA_CONFIG_DIR`). When a caller
+     * passes an explicit MCP dir (tests), settings resolve from its PARENT so a
+     * temp dir never picks up the developer's own `mcp.servers` overrides.
+     */
+    settingsDir;
     constructor(configDir) {
         // Resolved through `config/paths`, never `join(homedir(), '.nuvira', …)`:
         // that reach made every test run discover — and spawn — the developer's real
         // MCP servers. See `resolveMcpConfigDir`.
         this.configDir = resolveMcpConfigDir(configDir);
+        this.settingsDir = configDir ? join(this.configDir, '..') : undefined;
     }
     // ─── Server Discovery ─────────────────────────────────────────────────────
     /**
-     * Discover MCP server configurations from the config directory.
+     * Discover MCP server configurations from the config directory, with the
+     * `mcp.servers.*` overrides applied (enable/disable, runtime override, args).
      * Looks for *.json files in ~/.nuvira/mcp/ and subdirectories.
      */
     discoverConfigs() {
@@ -64,7 +74,10 @@ export class MCPManager {
         catch (err) {
             logger.debug(`MCP: Failed to scan config directory: ${err}`);
         }
-        return configs;
+        // Configuration-only overrides (`mcp.enabled`, `mcp.servers.<name>.*`): the
+        // single place every caller (connect, connectAll, getAllStates, discovery)
+        // passes through, so a config change reaches every surface at once.
+        return applyServerOverrides(configs, loadMcpSettings(this.settingsDir));
     }
     // ─── Connection Management ────────────────────────────────────────────────
     /**

package/dist/mcp/manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/mcp/manager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAa,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAUxC,+EAA+E;AAE/E,MAAM,OAAO,UAAU;IACb,OAAO,GAA2B,IAAI,GAAG,EAAE,CAAC;IAC5C,SAAS,CAAS;IAE1B,YAAY,SAAkB;QAC5B,0EAA0E;QAC1E,6EAA6E;QAC7E,0CAA0C;QAC1C,IAAI,CAAC,SAAS,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAClD,CAAC;IAED,6EAA6E;IAE7E;;;OAGG;IACH,eAAe;QACb,MAAM,OAAO,GAAsB,EAAE,CAAC;QAEtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAErE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBACnD,IAAI,CAAC;wBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;wBAClD,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;wBAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;wBAClD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACvB,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,KAAK,CAAC,+BAA+B,KAAK,CAAC,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC;oBACrE,CAAC;gBACH,CAAC;gBAED,kDAAkD;gBAClD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;oBACxB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;oBACtE,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;wBAC9B,IAAI,CAAC;4BACH,MAAM,GAAG,GAAG,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;4BACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;4BAClD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;wBACvB,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,MAAM,CAAC,KAAK,CAAC,mCAAmC,KAAK,CAAC,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC;wBACzE,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,6EAA6E;IAE7E;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACnC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,kCAAkC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;QAE3E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,kBAAkB,IAAI,CAAC,SAAS,gDAAgD,CAAC,CAAC;QACvH,CAAC;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,kCAAkC;QAClC,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK;YAAE,qBAAqB,EAAE,CAAC;QAExD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,uEAAuE;YACvE,yEAAyE;YACzE,sEAAsE;YACtE,wEAAwE;YACxE,+DAA+D;YAC/D,IAAI,CAAC;gBACH,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;OAQG;IACK,sBAAsB,CAAC,MAAuB,EAAE,MAAiB;QACvE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;YAClC,KAAK,CAAC,GAAG,CACP,MAAM,CAAC,IAAI,EACX,cAAc,CAAC,iBAAiB,CAAC,MAA4C,CAAC,EAC9E,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,OAAO,CACf,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,qCAAqC,MAAM,CAAC,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,MAAM,SAAS,GAAgB,EAAE,CAAC;QAElC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK;gBAAE,SAAS;YAEvC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC/C,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,8BAA8B,MAAM,CAAC,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,IAAY;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,aAAa;QACX,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,6EAA6E;IAE7E;;OAEG;IACH,WAAW;QACT,MAAM,GAAG,GAA0C,EAAE,CAAC;QAEtD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACrB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBAChC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,IAA8B;QACzD,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,SAAS;YAEhC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAC1D,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACjD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;YACxC,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,YAAY;QACV,MAAM,MAAM,GAAyB,EAAE,CAAC;QAExC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,MAAM,EAAE,cAAc;oBACtB,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,EAAE;oBACb,OAAO,EAAE,EAAE;iBACZ,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;gBACzC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,IAAY;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,IAAY;QACtB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;IAC5C,CAAC;CACF;AAED,gFAAgF;AAEhF,IAAI,SAAS,GAAsB,IAAI,CAAC;AAExC,IAAI,uBAAuB,GAAG,KAAK,CAAC;AAEpC;;;;;;;;;;GAUG;AACH,SAAS,qBAAqB;IAC5B,IAAI,uBAAuB;QAAE,OAAO;IACpC,uBAAuB,GAAG,IAAI,CAAC;IAE/B,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,IAAI,CAAC;YACH,SAAS,EAAE,aAAa,EAAE,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC,CAAC;IAEF,6EAA6E;IAC7E,6EAA6E;IAC7E,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE5B,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;IACpE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,GAAS,EAAE;YAC1B,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACzC,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;gBACrE,mEAAmE;gBACnE,0CAA0C;gBAC1C,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACnF,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;QACH,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,SAAS,GAAG,IAAI,UAAU,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,IAAI,SAAS,EAAE,CAAC;QACd,SAAS,CAAC,aAAa,EAAE,CAAC;QAC1B,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;AACH,CAAC"}
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/mcp/manager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAa,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAUtE,+EAA+E;AAE/E,MAAM,OAAO,UAAU;IACb,OAAO,GAA2B,IAAI,GAAG,EAAE,CAAC;IAC5C,SAAS,CAAS;IAC1B;;;;;OAKG;IACK,WAAW,CAAU;IAE7B,YAAY,SAAkB;QAC5B,0EAA0E;QAC1E,6EAA6E;QAC7E,0CAA0C;QAC1C,IAAI,CAAC,SAAS,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,CAAC;IAED,6EAA6E;IAE7E;;;;OAIG;IACH,eAAe;QACb,MAAM,OAAO,GAAsB,EAAE,CAAC;QAEtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAErE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBACnD,IAAI,CAAC;wBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;wBAClD,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;wBAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;wBAClD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACvB,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,KAAK,CAAC,+BAA+B,KAAK,CAAC,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC;oBACrE,CAAC;gBACH,CAAC;gBAED,kDAAkD;gBAClD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;oBACxB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;oBACtE,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;wBAC9B,IAAI,CAAC;4BACH,MAAM,GAAG,GAAG,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;4BACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;4BAClD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;wBACvB,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,MAAM,CAAC,KAAK,CAAC,mCAAmC,KAAK,CAAC,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC;wBACzE,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,4EAA4E;QAC5E,2EAA2E;QAC3E,oEAAoE;QACpE,OAAO,oBAAoB,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,6EAA6E;IAE7E;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACnC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,kCAAkC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;QAE3E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,kBAAkB,IAAI,CAAC,SAAS,gDAAgD,CAAC,CAAC;QACvH,CAAC;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,kCAAkC;QAClC,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK;YAAE,qBAAqB,EAAE,CAAC;QAExD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,uEAAuE;YACvE,yEAAyE;YACzE,sEAAsE;YACtE,wEAAwE;YACxE,+DAA+D;YAC/D,IAAI,CAAC;gBACH,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;OAQG;IACK,sBAAsB,CAAC,MAAuB,EAAE,MAAiB;QACvE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;YAClC,KAAK,CAAC,GAAG,CACP,MAAM,CAAC,IAAI,EACX,cAAc,CAAC,iBAAiB,CAAC,MAA4C,CAAC,EAC9E,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,OAAO,CACf,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,qCAAqC,MAAM,CAAC,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,MAAM,SAAS,GAAgB,EAAE,CAAC;QAElC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK;gBAAE,SAAS;YAEvC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC/C,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,8BAA8B,MAAM,CAAC,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,IAAY;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,aAAa;QACX,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,6EAA6E;IAE7E;;OAEG;IACH,WAAW;QACT,MAAM,GAAG,GAA0C,EAAE,CAAC;QAEtD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACrB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBAChC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,IAA8B;QACzD,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,SAAS;YAEhC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAC1D,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACjD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;YACxC,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,YAAY;QACV,MAAM,MAAM,GAAyB,EAAE,CAAC;QAExC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,MAAM,EAAE,cAAc;oBACtB,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,EAAE;oBACb,OAAO,EAAE,EAAE;iBACZ,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;gBACzC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,IAAY;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,IAAY;QACtB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;IAC5C,CAAC;CACF;AAED,gFAAgF;AAEhF,IAAI,SAAS,GAAsB,IAAI,CAAC;AAExC,IAAI,uBAAuB,GAAG,KAAK,CAAC;AAEpC;;;;;;;;;;GAUG;AACH,SAAS,qBAAqB;IAC5B,IAAI,uBAAuB;QAAE,OAAO;IACpC,uBAAuB,GAAG,IAAI,CAAC;IAE/B,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,IAAI,CAAC;YACH,SAAS,EAAE,aAAa,EAAE,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC,CAAC;IAEF,6EAA6E;IAC7E,6EAA6E;IAC7E,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE5B,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;IACpE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,GAAS,EAAE;YAC1B,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACzC,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;gBACrE,mEAAmE;gBACnE,0CAA0C;gBAC1C,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACnF,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;QACH,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,SAAS,GAAG,IAAI,UAAU,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,IAAI,SAAS,EAAE,CAAC;QACd,SAAS,CAAC,aAAa,EAAE,CAAC;QAC1B,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/mcp/mcp-oauth.d.ts

@@ -66,6 +66,34 @@ export declare class MCPOAuthManager {
      * Store tokens for a server.
      */
     setTokens(serverName: string, tokens: OAuthTokens): void;
+    /**
+     * Record a server's OAuth configuration WITHOUT touching its tokens.
+     *
+     * WHY THIS IS NEEDED. `refreshToken()` reads the stored `state.config` to find
+     * the token endpoint and client, and that config used to be written ONLY by
+     * `startAuthorizationCodeFlow()` — so a server whose config came from the
+     * catalog (or from a hand-written JSON file) could never refresh: the manager
+     * had no entry, `getTokens()` returned null and `refreshToken()` bailed out
+     * with "no config". Seeding the config from the server config makes a refresh
+     * possible in a process that never ran the interactive flow, which is exactly
+     * the case for a scheduled turn or the gateway.
+     *
+     * Tokens are deliberately left alone: this is the HOW, not the credential.
+     */
+    setConfig(serverName: string, config: OAuthConfig): void;
+    /** The stored OAuth configuration for a server, when there is one. */
+    getConfig(serverName: string): OAuthConfig | null;
+    /**
+     * Every server this manager knows about, with whether its token is usable.
+     * Deliberately reports NO token values — a status surface is for "am I
+     * authorized", not for reading credentials out of the store.
+     */
+    listServers(): Array<{
+        server: string;
+        authorized: boolean;
+        hasRefreshToken: boolean;
+        expiresAt: number | null;
+    }>;
     /**
      * Clear tokens for a server.
      */

package/dist/mcp/mcp-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-oauth.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAWH,MAAM,WAAW,WAAW;IAC1B,uBAAuB;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6BAA6B;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qBAAqB;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,kBAAkB;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB;IACnB,MAAM,EAAE,WAAW,CAAC;IACpB,qBAAqB;IACrB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0BAA0B;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4BAA4B;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAOD,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAsC;;IAQpD;;;OAGG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAiBjD;;OAEG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,IAAI;IAYxD;;OAEG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAWrC;;;OAGG;IACG,0BAA0B,CAC9B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IA8CvD;;OAEG;IACG,YAAY,CAChB,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,EACzB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,CAAC;IA4DvB;;OAEG;IACG,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAsDnE;;OAEG;IACG,0BAA0B,CAC9B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,WAAW,CAAC;IA2CvB,OAAO,CAAC,UAAU;IAclB,OAAO,CAAC,UAAU;CAcnB;AAMD,wBAAgB,kBAAkB,IAAI,eAAe,CAKpD;AAED,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C"}
+{"version":3,"file":"mcp-oauth.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAWH,MAAM,WAAW,WAAW;IAC1B,uBAAuB;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6BAA6B;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qBAAqB;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,kBAAkB;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB;IACnB,MAAM,EAAE,WAAW,CAAC;IACpB,qBAAqB;IACrB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0BAA0B;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4BAA4B;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAsBD,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAsC;;IAQpD;;;OAGG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAiBjD;;OAEG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,IAAI;IAYxD;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,IAAI;IASxD,sEAAsE;IACtE,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAIjD;;;;OAIG;IACH,WAAW,IAAI,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IASjH;;OAEG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAWrC;;;OAGG;IACG,0BAA0B,CAC9B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IA8CvD;;OAEG;IACG,YAAY,CAChB,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,EACzB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,CAAC;IA4DvB;;OAEG;IACG,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAsDnE;;OAEG;IACG,0BAA0B,CAC9B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,WAAW,CAAC;IA2CvB,OAAO,CAAC,UAAU;IAelB,OAAO,CAAC,UAAU;CAenB;AAMD,wBAAgB,kBAAkB,IAAI,eAAe,CAKpD;AAED,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C"}

package/dist/mcp/mcp-oauth.js

@@ -11,13 +11,27 @@
  * Hermes equivalent: mcp_oauth.py + mcp_oauth_manager.py + mcp_dashboard_oauth.py
  */
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
-import { resolveNuviraHome } from '../config/paths.js';
+import { resolveNuviraDataPath } from '../config/paths.js';
 import { join } from 'node:path';
 import { createHash, randomBytes } from 'node:crypto';
 import { logger } from '../utils/logger.js';
 // ─── OAuth Manager ────────────────────────────────────────────────────────
-const OAUTH_DIR = join(resolveNuviraHome(), 'mcp', 'oauth');
-const OAUTH_STATE_FILE = join(OAUTH_DIR, 'oauth-state.json');
+/**
+ * Where the token store lives, resolved PER OPERATION.
+ *
+ * It used to be a module constant built from `homedir()`, which broke the
+ * project's own rule for persisted state (`resolveNuviraDataPath`: "a process
+ * pointed at an isolated config dir never reads or writes the real ~/.nuvira").
+ * Tokens are the most sensitive thing the agent stores, so honouring
+ * `NUVIRA_CONFIG_DIR` is not a test convenience — it is what lets an operator
+ * isolate a credential store, and what keeps a test run out of the user's home.
+ */
+function oauthDir() {
+    return resolveNuviraDataPath('mcp', 'oauth');
+}
+function oauthStateFile() {
+    return join(oauthDir(), 'oauth-state.json');
+}
 export class MCPOAuthManager {
     states = new Map();
     constructor() {
@@ -57,6 +71,45 @@ export class MCPOAuthManager {
         this.saveStates();
         logger.debug(`MCP OAuth: Stored tokens for '${serverName}'`);
     }
+    /**
+     * Record a server's OAuth configuration WITHOUT touching its tokens.
+     *
+     * WHY THIS IS NEEDED. `refreshToken()` reads the stored `state.config` to find
+     * the token endpoint and client, and that config used to be written ONLY by
+     * `startAuthorizationCodeFlow()` — so a server whose config came from the
+     * catalog (or from a hand-written JSON file) could never refresh: the manager
+     * had no entry, `getTokens()` returned null and `refreshToken()` bailed out
+     * with "no config". Seeding the config from the server config makes a refresh
+     * possible in a process that never ran the interactive flow, which is exactly
+     * the case for a scheduled turn or the gateway.
+     *
+     * Tokens are deliberately left alone: this is the HOW, not the credential.
+     */
+    setConfig(serverName, config) {
+        const existing = this.states.get(serverName);
+        const next = existing
+            ? { ...existing, config: { ...existing.config, ...config } }
+            : { serverName, config, createdAt: Date.now() };
+        this.states.set(serverName, next);
+        this.saveStates();
+    }
+    /** The stored OAuth configuration for a server, when there is one. */
+    getConfig(serverName) {
+        return this.states.get(serverName)?.config ?? null;
+    }
+    /**
+     * Every server this manager knows about, with whether its token is usable.
+     * Deliberately reports NO token values — a status surface is for "am I
+     * authorized", not for reading credentials out of the store.
+     */
+    listServers() {
+        return [...this.states.entries()].map(([server, state]) => ({
+            server,
+            authorized: Boolean(state.tokens?.accessToken) && (state.tokens?.expiresAt ?? 0) > Date.now(),
+            hasRefreshToken: Boolean(state.tokens?.refreshToken),
+            expiresAt: state.tokens?.expiresAt ?? null,
+        }));
+    }
     /**
      * Clear tokens for a server.
      */
@@ -237,8 +290,9 @@ export class MCPOAuthManager {
     // ─── Persistence ─────────────────────────────────────────────────────
     loadStates() {
         try {
-            if (existsSync(OAUTH_STATE_FILE)) {
-                const data = readFileSync(OAUTH_STATE_FILE, 'utf-8');
+            const stateFile = oauthStateFile();
+            if (existsSync(stateFile)) {
+                const data = readFileSync(stateFile, 'utf-8');
                 const parsed = JSON.parse(data);
                 for (const [key, value] of Object.entries(parsed)) {
                     this.states.set(key, value);
@@ -251,14 +305,15 @@ export class MCPOAuthManager {
     }
     saveStates() {
         try {
-            if (!existsSync(OAUTH_DIR)) {
-                mkdirSync(OAUTH_DIR, { recursive: true });
+            const dir = oauthDir();
+            if (!existsSync(dir)) {
+                mkdirSync(dir, { recursive: true });
             }
             const data = {};
             for (const [key, value] of this.states.entries()) {
                 data[key] = value;
             }
-            writeFileSync(OAUTH_STATE_FILE, JSON.stringify(data, null, 2));
+            writeFileSync(oauthStateFile(), JSON.stringify(data, null, 2));
         }
         catch (err) {
             logger.warn(`MCP OAuth: Failed to save state: ${err}`);