agent-trellis 0.6.3 → 0.8.0

package/dist/pi-bridge/bundle.js

@@ -55,7 +55,7 @@ var require_identity = __commonJS({
     var isMap2 = (node2) => !!node2 && typeof node2 === "object" && node2[NODE_TYPE] === MAP;
     var isPair = (node2) => !!node2 && typeof node2 === "object" && node2[NODE_TYPE] === PAIR;
     var isScalar = (node2) => !!node2 && typeof node2 === "object" && node2[NODE_TYPE] === SCALAR;
-    var isSeq = (node2) => !!node2 && typeof node2 === "object" && node2[NODE_TYPE] === SEQ;
+    var isSeq2 = (node2) => !!node2 && typeof node2 === "object" && node2[NODE_TYPE] === SEQ;
     function isCollection(node2) {
       if (node2 && typeof node2 === "object")
         switch (node2[NODE_TYPE]) {
@@ -92,7 +92,7 @@ var require_identity = __commonJS({
     exports.isNode = isNode;
     exports.isPair = isPair;
     exports.isScalar = isScalar;
-    exports.isSeq = isSeq;
+    exports.isSeq = isSeq2;
   }
 });
 
@@ -15140,21 +15140,25 @@ import { homedir as homedir2 } from "node:os";
 
 // src/core/canonical.ts
 var import_yaml = __toESM(require_dist(), 1);
-import { existsSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { basename, join } from "node:path";
+import { basename, dirname, join } from "node:path";
 
 // src/core/types.ts
 var ALL_AGENTS = [
   "claude-code",
   "codex",
   "kiro",
-  "pi"
+  "pi",
+  "kimi-code"
 ];
 function resolveScope(scope, managedAgents) {
   const candidates = scope ?? managedAgents;
   return candidates.filter((id) => managedAgents.includes(id));
 }
+function capabilityDeliveryForAgent(agentId, mcp) {
+  return mcp.runtime?.delivery?.[agentId] ?? "native";
+}
 
 // src/core/canonical.ts
 function fromServerDefYaml(def) {
@@ -15212,9 +15216,34 @@ function loadServersYaml(path) {
     servers,
     knownHostInjected: parsed.known_host_injected ?? [],
     hub: parsed.hub,
-    gateway: fromGatewayYaml(parsed.gateway)
+    gateway: fromGatewayYaml(parsed.gateway),
+    routes: fromRoutesYaml(parsed.routes),
+    runtime: fromRuntimeYaml(parsed.runtime)
   };
 }
+function fromRuntimeYaml(runtime) {
+  if (!runtime?.delivery) return void 0;
+  const delivery = {};
+  for (const [rawAgent, rawDelivery] of Object.entries(runtime.delivery)) {
+    if (!ALL_AGENTS.includes(rawAgent)) continue;
+    if (rawDelivery !== "native" && rawDelivery !== "mcp" && rawDelivery !== "both") continue;
+    delivery[rawAgent] = rawDelivery;
+  }
+  return Object.keys(delivery).length > 0 ? { delivery } : void 0;
+}
+function fromRoutesYaml(routes) {
+  if (!routes) return void 0;
+  const out = {};
+  for (const [rawAgent, rawRoute] of Object.entries(routes)) {
+    if (!ALL_AGENTS.includes(rawAgent)) continue;
+    if (!rawRoute?.mode || !["direct", "gateway", "hub"].includes(rawRoute.mode)) continue;
+    out[rawAgent] = {
+      mode: rawRoute.mode,
+      ...rawRoute.servers ? { servers: rawRoute.servers } : {}
+    };
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
 function fromGatewayYaml(gateway) {
   if (!gateway) return void 0;
   const out = { enabled: gateway.enabled === true };
@@ -15329,7 +15358,7 @@ function codexBearerTokenEnvVar(def) {
 }
 
 // src/lib/secretEnv.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
+import { appendFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2 } from "node:fs";
 var LINE_RE = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
 function parseDotenv(content) {
   const result = {};
@@ -15357,14 +15386,28 @@ function resolveSecretEnv(names, policy) {
 
 // src/adapters/mcpPlan.ts
 var HUB_ENTRY_NAME = "trellis-hub";
-var GATEWAY_ENTRY_NAME = "trellis-gateway";
+var GATEWAY_ENTRY_NAME = "trellis";
+var RUNTIME_ENTRY_NAME = "trellis";
 var GATEWAY_COMMAND = "trellis";
+var RUNTIME_COMMAND = "trellis";
+function isOAuthMcpServer(def) {
+  return def.auth === "oauth";
+}
 function isGatewayAgent(agentId, mcp, managedAgents) {
+  const route = mcp.routes?.[agentId];
+  if (route) return route.mode === "gateway";
   const gateway = mcp.gateway;
   if (!gateway?.enabled) return false;
   if (gateway.agents) return gateway.agents.includes(agentId);
   return managedAgents.includes(agentId);
 }
+function routeForAgent(agentId, mcp, managedAgents) {
+  const explicit = mcp.routes?.[agentId];
+  if (explicit) return explicit;
+  if (isGatewayAgent(agentId, mcp, managedAgents)) return { mode: "gateway" };
+  if (mcp.hub) return { mode: "hub" };
+  return { mode: "direct" };
+}
 var CODEX_STDIO_URL_CRASH_NOTE = ' On Codex specifically, this crashes the entire process at startup ("url is not supported for stdio"), not just this one server \u2014 see docs/research.md.';
 function collisionMessage(name, agentId) {
   return `refusing to write MCP server "${name}": also appears in known_host_injected.${agentId === "codex" ? CODEX_STDIO_URL_CRASH_NOTE : ""}`;
@@ -15379,13 +15422,17 @@ var DANGEROUS_LITERAL_PATTERNS = [
   { label: "mcp-router token (mcpr_)", pattern: /mcpr_/ }
 ];
 function findLiteralSecret(def) {
-  const candidates = [def.command, def.url, ...def.args ?? [], ...Object.values(def.headers ?? {}), ...Object.values(def.staticEnv ?? {})].filter(
-    (v) => typeof v === "string"
-  );
-  for (const candidate of candidates) {
+  const candidates = [
+    ...def.command !== void 0 ? [{ value: def.command, field: "command" }] : [],
+    ...def.url !== void 0 ? [{ value: def.url, field: "url" }] : [],
+    ...(def.args ?? []).map((value) => ({ value, field: "args" })),
+    ...Object.entries(def.headers ?? {}).map(([key, value]) => ({ value, field: "headers", key })),
+    ...Object.entries(def.staticEnv ?? {}).map(([key, value]) => ({ value, field: "staticEnv", key }))
+  ];
+  for (const { value, field, key } of candidates) {
     for (const { label, pattern } of DANGEROUS_LITERAL_PATTERNS) {
-      if (pattern.test(candidate)) {
-        return label;
+      if (pattern.test(value)) {
+        return { label, field, key };
       }
     }
   }
@@ -15398,45 +15445,111 @@ function findUnresolvedEnvName(def, policy) {
   return names.find((name) => !resolved[name]);
 }
 function resolveMcpPlan(agentId, mcp, managedAgents, policy) {
-  if (isGatewayAgent(agentId, mcp, managedAgents)) {
-    if (mcp.knownHostInjected.includes(GATEWAY_ENTRY_NAME)) {
+  const route = routeForAgent(agentId, mcp, managedAgents);
+  const runtimeEnabled = capabilityDeliveryForAgent(agentId, mcp) !== "native";
+  if (route.mode === "gateway") {
+    const entryName = runtimeEnabled ? RUNTIME_ENTRY_NAME : GATEWAY_ENTRY_NAME;
+    if (mcp.knownHostInjected.includes(entryName)) {
       return {
         desired: [],
-        conflicts: [{ name: GATEWAY_ENTRY_NAME, message: collisionMessage(GATEWAY_ENTRY_NAME, agentId), remediation: collisionRemediation(GATEWAY_ENTRY_NAME) }]
+        conflicts: [{ name: entryName, message: collisionMessage(entryName, agentId), remediation: collisionRemediation(entryName) }]
       };
     }
+    const oauth = planDirectServers(agentId, mcp, managedAgents, policy, route, isOAuthMcpServer);
     return {
-      desired: [{ name: GATEWAY_ENTRY_NAME, def: { transport: "stdio", command: GATEWAY_COMMAND, args: ["mcp-gateway", "--agent", agentId] } }],
-      conflicts: []
+      desired: [{
+        name: entryName,
+        def: {
+          transport: "stdio",
+          command: runtimeEnabled ? RUNTIME_COMMAND : GATEWAY_COMMAND,
+          args: [runtimeEnabled ? "mcp-runtime" : "mcp-gateway", "--agent", agentId]
+        }
+      }, ...oauth.desired],
+      conflicts: oauth.conflicts
     };
   }
-  if (mcp.hub) {
+  if (route.mode === "hub") {
+    if (!mcp.hub) {
+      return {
+        desired: [],
+        conflicts: [{
+          name: HUB_ENTRY_NAME,
+          message: `cannot resolve hub route "${agentId}": canonical mcp.hub.url is not configured`,
+          remediation: `configure mcp.hub.url or choose direct/gateway mode for ${agentId}`
+        }]
+      };
+    }
     if (mcp.knownHostInjected.includes(HUB_ENTRY_NAME)) {
       return {
         desired: [],
         conflicts: [{ name: HUB_ENTRY_NAME, message: collisionMessage(HUB_ENTRY_NAME, agentId), remediation: collisionRemediation(HUB_ENTRY_NAME) }]
       };
     }
-    return { desired: [{ name: HUB_ENTRY_NAME, def: { transport: "http", url: mcp.hub.url } }], conflicts: [] };
+    if (route.servers) {
+      return {
+        desired: [],
+        conflicts: [{
+          name: HUB_ENTRY_NAME,
+          message: `cannot restrict external hub route "${agentId}" to individual MCP servers: the hub owns its upstream set`,
+          remediation: `remove the servers list from the ${agentId} hub route, or use direct/gateway mode for per-server selection`
+        }]
+      };
+    }
+    const desired = [{ name: HUB_ENTRY_NAME, def: { transport: "http", url: mcp.hub.url } }];
+    if (runtimeEnabled) {
+      if (mcp.knownHostInjected.includes(RUNTIME_ENTRY_NAME)) {
+        return {
+          desired: [],
+          conflicts: [{ name: RUNTIME_ENTRY_NAME, message: collisionMessage(RUNTIME_ENTRY_NAME, agentId), remediation: collisionRemediation(RUNTIME_ENTRY_NAME) }]
+        };
+      }
+      desired.push({
+        name: RUNTIME_ENTRY_NAME,
+        def: { transport: "stdio", command: RUNTIME_COMMAND, args: ["mcp-runtime", "--agent", agentId] }
+      });
+    }
+    return { desired, conflicts: [] };
   }
+  if (runtimeEnabled) {
+    if (mcp.knownHostInjected.includes(RUNTIME_ENTRY_NAME)) {
+      return {
+        desired: [],
+        conflicts: [{ name: RUNTIME_ENTRY_NAME, message: collisionMessage(RUNTIME_ENTRY_NAME, agentId), remediation: collisionRemediation(RUNTIME_ENTRY_NAME) }]
+      };
+    }
+    return {
+      desired: [{
+        name: RUNTIME_ENTRY_NAME,
+        def: { transport: "stdio", command: RUNTIME_COMMAND, args: ["mcp-runtime", "--agent", agentId] }
+      }],
+      conflicts: []
+    };
+  }
+  return planDirectServers(agentId, mcp, managedAgents, policy, route);
+}
+function planDirectServers(agentId, mcp, managedAgents, policy, route, filter) {
   const desired = [];
   const conflicts = [];
   for (const [name, def] of Object.entries(mcp.servers)) {
     if (def.enabled === false) {
       continue;
     }
+    if (filter && !filter(def)) continue;
     if (!isInScope(agentId, def.agents, managedAgents)) {
       continue;
     }
+    if (route.servers && !route.servers.includes(name)) {
+      continue;
+    }
     if (mcp.knownHostInjected.includes(name)) {
       conflicts.push({ name, message: collisionMessage(name, agentId), remediation: collisionRemediation(name) });
       continue;
     }
-    const secretLabel = findLiteralSecret(def);
-    if (secretLabel) {
+    const secretMatch = findLiteralSecret(def);
+    if (secretMatch?.field === "staticEnv") {
       conflicts.push({
         name,
-        message: `refusing to write MCP server "${name}": a value matches a known-dangerous literal pattern (${secretLabel}) \u2014 configs must hold variable NAMES only, never real values (docs/research.md "Secrets")`,
+        message: `refusing to write MCP server "${name}": a value matches a known-dangerous literal pattern (${secretMatch.label}) \u2014 configs must hold variable NAMES only, never real values (docs/research.md "Secrets")`,
         remediation: `replace the literal value in servers.yaml with a \`\${VAR_NAME}\` reference and put the real value wherever secrets.policy.yaml resolves it from`
       });
       continue;
@@ -27575,6 +27688,7 @@ function extractTemplateVarNames(value) {
 
 // src/lib/mcpConnect.ts
 var DEFAULT_CONNECT_TIMEOUT_MS = 1e4;
+var FAILED_TRANSPORT_CLEANUP_TIMEOUT_MS = 1e3;
 function withTimeout(promise, timeoutMs, message) {
   return new Promise((resolve, reject) => {
     const timer = setTimeout(() => reject(new Error(message)), timeoutMs);
@@ -27596,7 +27710,11 @@ async function connectWithCleanup(client, transport, timeoutMs, message) {
     return client;
   } catch (err) {
     try {
-      await transport.close();
+      await withTimeout(
+        Promise.resolve().then(() => transport.close()),
+        FAILED_TRANSPORT_CLEANUP_TIMEOUT_MS,
+        "transport cleanup timed out"
+      );
     } catch {
     }
     throw err;
@@ -27658,6 +27776,325 @@ function connectServer(def, secretsPolicy, timeoutMs, clientInfo) {
   return connectStdio(def, secretsPolicy, timeoutMs, clientInfo);
 }
 
+// src/lib/mcpToolRegistry.ts
+var MAX_EXPOSED_TOOL_NAME_LENGTH = 64;
+var SHORT_EXPOSED_TOOL_NAME_LENGTH = 12;
+var EXPOSED_TOOL_NAME_PATTERN = /^[a-zA-Z0-9_-]+$/;
+var TOOL_NAME_SEPARATOR = "__";
+function stableHash(value) {
+  let hash = 2166136261;
+  for (let index = 0; index < value.length; index += 1) {
+    hash ^= value.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16).padStart(8, "0");
+}
+function safeSegment(value, fallback) {
+  const normalized = value.replace(/[^a-zA-Z0-9_-]+/g, "_");
+  return normalized || fallback;
+}
+function compactSourceSegment(value) {
+  const normalized = safeSegment(value, "server");
+  return safeSegment(normalized.replace(/^mcp(?:_|-)+/i, ""), "server");
+}
+function boundedName(value, identity) {
+  if (value.length <= MAX_EXPOSED_TOOL_NAME_LENGTH && EXPOSED_TOOL_NAME_PATTERN.test(value)) return value;
+  const suffix = `__${stableHash(identity)}`;
+  const prefixLength = Math.max(1, MAX_EXPOSED_TOOL_NAME_LENGTH - suffix.length);
+  return `${value.slice(0, prefixLength)}${suffix}`;
+}
+function normalizedToolName(toolName) {
+  return boundedName(safeSegment(toolName, "tool"), `tool\0${toolName}`);
+}
+function prefixedToolName(serverName, toolName) {
+  const server = compactSourceSegment(serverName);
+  const tool = safeSegment(toolName, "tool");
+  return boundedName(`${server}${TOOL_NAME_SEPARATOR}${tool}`, `prefixed\0${serverName}\0${toolName}`);
+}
+function allocateExposedToolNames(candidates) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const candidate of candidates) counts.set(candidate.toolName, (counts.get(candidate.toolName) ?? 0) + 1);
+  const ordered = candidates.map((candidate, index) => ({ candidate, index })).sort((left, right) => left.candidate.serverName.localeCompare(right.candidate.serverName) || left.candidate.toolName.localeCompare(right.candidate.toolName) || left.index - right.index);
+  const allocated = new Array(candidates.length);
+  const used = /* @__PURE__ */ new Set();
+  for (const { candidate, index } of ordered) {
+    const normalized = normalizedToolName(candidate.toolName);
+    const source = compactSourceSegment(candidate.serverName);
+    const sourceQualified = normalized.includes("__") || normalized === source || normalized.startsWith(`${source}_`) || normalized.startsWith(`${source}__`);
+    const unique = (counts.get(candidate.toolName) ?? 0) === 1;
+    const base = unique && normalized.length > SHORT_EXPOSED_TOOL_NAME_LENGTH ? normalized : unique && sourceQualified ? normalized : prefixedToolName(candidate.serverName, candidate.toolName);
+    let exposed = base;
+    let suffix = 2;
+    while (used.has(exposed)) {
+      exposed = boundedName(`${base}${TOOL_NAME_SEPARATOR}${suffix}`, `collision\0${candidate.serverName}\0${candidate.toolName}\0${suffix}`);
+      suffix += 1;
+    }
+    used.add(exposed);
+    allocated[index] = exposed;
+  }
+  return allocated;
+}
+var McpToolRegistry = class {
+  entries = /* @__PURE__ */ new Map();
+  order = [];
+  candidates = [];
+  rebuild() {
+    this.entries.clear();
+    this.order.length = 0;
+    const allocated = allocateExposedToolNames(this.candidates);
+    const ordered = this.candidates.map((candidate, index) => ({ candidate, index, exposed: allocated[index] })).sort((left, right) => left.candidate.serverName.localeCompare(right.candidate.serverName) || left.candidate.toolName.localeCompare(right.candidate.toolName) || left.index - right.index);
+    for (const { candidate, exposed } of ordered) {
+      this.entries.set(exposed, candidate);
+      this.order.push(exposed);
+    }
+  }
+  /**
+   * Register one connected upstream's tools. Callers add each upstream
+   * independently, so an upstream that failed to connect or to list its
+   * tools is simply never added — every other upstream's tools remain
+   * aggregated, with no special-casing here.
+   */
+  add(serverName, upstream, tools) {
+    for (const tool of tools) this.candidates.push({ serverName, toolName: tool.name, upstream, tool });
+    this.rebuild();
+    const added = tools.map((tool) => this.exposedNameFor(serverName, tool.name)).filter((name) => name !== void 0);
+    return { added, skipped: [] };
+  }
+  exposedNameFor(serverName, toolName) {
+    for (const [name, entry] of this.entries) {
+      if (entry.serverName === serverName && entry.toolName === toolName) return name;
+    }
+    return void 0;
+  }
+  /** Every registered tool, under its prefixed name, in registration
+   * order. Each tool's own `description`/`inputSchema` and any additional
+   * fields the upstream sent are preserved verbatim; only `name` changes. */
+  listTools() {
+    this.rebuild();
+    return this.order.map((name) => {
+      const entry = this.entries.get(name);
+      const title = name === entry.toolName || entry.tool.title !== void 0 ? entry.tool.title : `${entry.serverName} / ${entry.toolName}`;
+      return { ...entry.tool, name, ...title === void 0 ? {} : { title } };
+    });
+  }
+  /** The owning upstream and original tool name for a prefixed name, or
+   * `undefined` if nothing owns it. */
+  resolve(prefixedName) {
+    this.rebuild();
+    const entry = this.entries.get(prefixedName);
+    if (!entry) return void 0;
+    return { serverName: entry.serverName, toolName: entry.toolName, upstream: entry.upstream };
+  }
+  /**
+   * Route a call to the owning upstream, unprefixing the name on the way
+   * out — an upstream knows its tool only by its own name, never by the
+   * aggregated one. A name no upstream owns throws rather than guessing.
+   */
+  async callTool(prefixedName, args) {
+    const target = this.resolve(prefixedName);
+    if (!target) {
+      throw new Error(`unknown tool "${prefixedName}"`);
+    }
+    return target.upstream.callTool({ name: target.toolName, arguments: args });
+  }
+  /** Distinct server names with at least one registered tool, in
+   * registration order. */
+  servers() {
+    this.rebuild();
+    const seen = [];
+    for (const name of this.order) {
+      const { serverName } = this.entries.get(name);
+      if (!seen.includes(serverName)) seen.push(serverName);
+    }
+    return seen;
+  }
+  get size() {
+    this.rebuild();
+    return this.entries.size;
+  }
+};
+
+// src/lib/oauth/store.ts
+import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join2 } from "node:path";
+function oauthDir(homeDir) {
+  return join2(homeDir, ".trellis", "mcp", "oauth");
+}
+function tokenPath(homeDir, serverName) {
+  assertSafeServerName(serverName);
+  return join2(oauthDir(homeDir), `${serverName}.json`);
+}
+function lockPath(homeDir, serverName) {
+  assertSafeServerName(serverName);
+  return join2(oauthDir(homeDir), `${serverName}.lock`);
+}
+function assertSafeServerName(serverName) {
+  if (serverName === "" || serverName === "." || serverName === ".." || /[/\\]/.test(serverName) || serverName.startsWith(".")) {
+    throw new Error(`refusing to use MCP server name "${serverName}" as an OAuth credential filename`);
+  }
+}
+function readToken(homeDir, serverName) {
+  const path = tokenPath(homeDir, serverName);
+  if (!existsSync3(path)) return void 0;
+  try {
+    return JSON.parse(readFileSync3(path, "utf-8"));
+  } catch {
+    return void 0;
+  }
+}
+function writeToken(homeDir, serverName, token) {
+  const dir = oauthDir(homeDir);
+  mkdirSync3(dir, { recursive: true, mode: 448 });
+  const path = tokenPath(homeDir, serverName);
+  const tmp = `${path}.tmp`;
+  writeFileSync2(tmp, `${JSON.stringify(token, null, 2)}
+`, { mode: 384 });
+  chmodSync(tmp, 384);
+  renameSync(tmp, path);
+  chmodSync(path, 384);
+}
+function isExpired(token, skewMs = 6e4, now = Date.now()) {
+  if (token.expiresAt === void 0) return false;
+  return token.expiresAt - skewMs <= now;
+}
+
+// src/lib/oauth/lock.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, openSync, closeSync, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname2 } from "node:path";
+var STALE_AFTER_MS = 6e4;
+var POLL_INTERVAL_MS = 50;
+var DEFAULT_TIMEOUT_MS = 3e4;
+function processAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+function isStale(path, now) {
+  let contents;
+  try {
+    contents = JSON.parse(readFileSync4(path, "utf-8"));
+  } catch {
+    return true;
+  }
+  if (typeof contents.pid !== "number" || typeof contents.acquiredAt !== "number") return true;
+  if (now - contents.acquiredAt > STALE_AFTER_MS) return true;
+  return !processAlive(contents.pid);
+}
+async function withServerLock(homeDir, serverName, fn, opts = {}) {
+  const path = lockPath(homeDir, serverName);
+  const now = opts.now ?? Date.now;
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const deadline = now() + timeoutMs;
+  mkdirSync4(dirname2(path), { recursive: true, mode: 448 });
+  for (; ; ) {
+    try {
+      const fd = openSync(path, "wx", 384);
+      try {
+        writeFileSync3(fd, JSON.stringify({ pid: process.pid, acquiredAt: now() }));
+      } finally {
+        closeSync(fd);
+      }
+      break;
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+      if (existsSync4(path) && isStale(path, now())) {
+        rmSync2(path, { force: true });
+        continue;
+      }
+      if (now() >= deadline) {
+        throw new Error(`timed out waiting for the OAuth refresh lock on "${serverName}" (${path})`);
+      }
+      await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+    }
+  }
+  try {
+    return await fn();
+  } finally {
+    rmSync2(path, { force: true });
+  }
+}
+
+// src/lib/oauth/refresh.ts
+var RefreshError = class extends Error {
+};
+async function ensureFreshToken(homeDir, serverName, opts = {}) {
+  const now = opts.now ?? Date.now;
+  const existing = readToken(homeDir, serverName);
+  if (!existing) return void 0;
+  if (!isExpired(existing, opts.skewMs, now())) return existing;
+  if (!existing.refreshToken) {
+    throw new RefreshError(`OAuth token for "${serverName}" has expired and there is no refresh token \u2014 run \`trellis mcp auth ${serverName}\``);
+  }
+  return withServerLock(
+    homeDir,
+    serverName,
+    async () => {
+      const current = readToken(homeDir, serverName);
+      if (current && !isExpired(current, opts.skewMs, now())) return current;
+      const source = current ?? existing;
+      if (!source.refreshToken) {
+        throw new RefreshError(`OAuth token for "${serverName}" has expired and there is no refresh token \u2014 run \`trellis mcp auth ${serverName}\``);
+      }
+      const refreshed = await performRefresh(serverName, source, opts);
+      writeToken(homeDir, serverName, refreshed);
+      return refreshed;
+    },
+    { timeoutMs: opts.lockTimeoutMs, now }
+  );
+}
+async function performRefresh(serverName, token, opts = {}) {
+  const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+  const now = opts.now ?? Date.now;
+  if (!token.tokenEndpoint) {
+    throw new RefreshError(`OAuth token for "${serverName}" has no recorded token endpoint \u2014 run \`trellis mcp auth ${serverName}\``);
+  }
+  const body = new URLSearchParams({ grant_type: "refresh_token", refresh_token: token.refreshToken });
+  if (token.clientId) body.set("client_id", token.clientId);
+  if (token.clientSecret) body.set("client_secret", token.clientSecret);
+  const response = await fetchImpl(token.tokenEndpoint, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+    body: body.toString()
+  });
+  if (!response.ok) {
+    throw new RefreshError(`refresh_token grant for "${serverName}" failed with HTTP ${response.status}: ${await safeText(response)}`);
+  }
+  const payload = await response.json();
+  if (!payload.access_token) {
+    throw new RefreshError(`refresh_token grant for "${serverName}" returned no access_token`);
+  }
+  return {
+    ...token,
+    accessToken: payload.access_token,
+    // Rotation: a server that issues a new refresh token has invalidated
+    // the old one, so keeping the old one would be keeping a dead
+    // credential. A server that omits it is signalling the existing one
+    // stays valid.
+    refreshToken: payload.refresh_token ?? token.refreshToken,
+    expiresAt: payload.expires_in !== void 0 ? now() + payload.expires_in * 1e3 : void 0,
+    scope: payload.scope ?? token.scope
+  };
+}
+async function safeText(response) {
+  try {
+    return (await response.text()).slice(0, 200);
+  } catch {
+    return "<unreadable body>";
+  }
+}
+
+// src/lib/gatewayBackend.ts
+async function withOAuthHeader(name, def, homeDir) {
+  const hasExplicitAuth = Object.keys(def.headers ?? {}).some((key) => key.toLowerCase() === "authorization");
+  if (hasExplicitAuth) return def;
+  const token = await ensureFreshToken(homeDir, name);
+  if (!token) return def;
+  return { ...def, headers: { ...def.headers ?? {}, Authorization: `Bearer ${token.accessToken}` } };
+}
+
 // node_modules/typebox/build/system/memory/memory.mjs
 var memory_exports = {};
 __export(memory_exports, {
@@ -32062,12 +32499,6 @@ __export(typebox_exports, {
   With: () => With2
 });
 
-// src/lib/mcpToolRegistry.ts
-var TOOL_NAME_SEPARATOR = "__";
-function prefixedToolName(serverName, toolName) {
-  return `${serverName}${TOOL_NAME_SEPARATOR}${toolName}`;
-}
-
 // src/pi-bridge/schemaTranslate.ts
 function toParametersSchema(inputSchema) {
   return typebox_exports.Unsafe(inputSchema);
@@ -32091,27 +32522,14 @@ function toPiContent(items) {
 
 // src/pi-bridge/index.ts
 var CLIENT_INFO = { name: "trellis-mcp-bridge", version: "0.0.0" };
-function registerServerTools(pi, serverName, client, timeoutMs) {
-  return withTimeout(client.listTools(), timeoutMs, `listTools timed out after ${timeoutMs}ms`).then((result) => {
-    for (const tool of result.tools) {
-      pi.registerTool({
-        name: prefixedToolName(serverName, tool.name),
-        label: tool.name,
-        description: tool.description ?? `MCP tool "${tool.name}" from server "${serverName}"`,
-        parameters: toParametersSchema(tool.inputSchema),
-        async execute(_toolCallId, params) {
-          const result2 = await client.callTool({ name: tool.name, arguments: params });
-          const content = Array.isArray(result2.content) ? result2.content : [];
-          return { content: toPiContent(content), details: result2 };
-        }
-      });
-    }
-  });
+function listServerTools(client, timeoutMs) {
+  return withTimeout(client.listTools(), timeoutMs, `listTools timed out after ${timeoutMs}ms`).then((result) => result.tools);
 }
 async function trellisMcpBridge(pi, homeDir = homedir2(), connectTimeoutMs = DEFAULT_CONNECT_TIMEOUT_MS) {
   const canonical = loadCanonicalSource(homeDir);
   const { desired } = resolveMcpPlan("pi", canonical.mcp, ALL_AGENTS, canonical.secretsPolicy);
   const clients = /* @__PURE__ */ new Set();
+  const registry2 = new McpToolRegistry();
   const closeClient = async (client) => {
     if (!clients.delete(client)) return;
     try {
@@ -32134,24 +32552,48 @@ async function trellisMcpBridge(pi, homeDir = homedir2(), connectTimeoutMs = DEF
     );
   };
   pi.on?.("session_shutdown", closeAllClients);
-  await Promise.all(
+  const discovered = await Promise.all(
     desired.map(async ({ name, def }) => {
       let client;
       try {
-        client = await connectServer(def, canonical.secretsPolicy, connectTimeoutMs, CLIENT_INFO);
+        const effectiveDef = def.auth === "oauth" && def.url ? await withOAuthHeader(name, def, homeDir) : def;
+        client = await connectServer(effectiveDef, canonical.secretsPolicy, connectTimeoutMs, CLIENT_INFO);
       } catch (err) {
         console.error(`trellis-mcp-bridge: failed to connect to MCP server "${name}": ${err instanceof Error ? err.message : String(err)}`);
-        return;
+        return void 0;
       }
       clients.add(client);
       try {
-        await registerServerTools(pi, name, client, connectTimeoutMs);
+        const tools = await listServerTools(client, connectTimeoutMs);
+        return { name, client, tools };
       } catch (err) {
         console.error(`trellis-mcp-bridge: failed to list tools for MCP server "${name}": ${err instanceof Error ? err.message : String(err)}`);
         await closeClient(client);
+        return void 0;
       }
     })
   );
+  for (const result of discovered) {
+    if (!result) continue;
+    registry2.add(result.name, result.client, result.tools);
+  }
+  for (const tool of registry2.listTools()) {
+    const target = registry2.resolve(tool.name);
+    if (!target) continue;
+    const originalName = target.toolName;
+    const serverName = target.serverName;
+    pi.registerTool({
+      name: tool.name,
+      label: originalName,
+      description: tool.description ?? `MCP tool "${originalName}" from server "${serverName}"`,
+      parameters: toParametersSchema(tool.inputSchema),
+      async execute(_toolCallId, params) {
+        const result = await registry2.callTool(tool.name, params);
+        const content = Array.isArray(result.content) ? result.content : [];
+        return { content: toPiContent(content), details: result };
+      }
+    });
+  }
 }
 export {
   trellisMcpBridge as default,