auvrynt 1.0.1 → 1.0.2

package/dist/config.js

@@ -4,6 +4,26 @@ import { expandHomePath } from "./roots.js";
 import { loadAuvryntFiles } from "./user-config.js";
 const DEFAULT_OAUTH_ACCESS_TOKEN_TTL_SECONDS = 60 * 60;
 const DEFAULT_OAUTH_REFRESH_TOKEN_TTL_SECONDS = 30 * 24 * 60 * 60;
+export const SUPPORTED_SCOPES = [
+    "auvrynt:read",
+    "auvrynt:write",
+    "auvrynt:process",
+    "auvrynt:web",
+    "auvrynt:software",
+    "auvrynt:godot",
+    "auvrynt:blender",
+    "auvrynt:serena",
+];
+export const SCOPE_DESCRIPTIONS = {
+    "auvrynt:read": "Inspect files, search, and perform read-only project analysis",
+    "auvrynt:write": "Edit and create files",
+    "auvrynt:process": "Start and stop approved workspace processes",
+    "auvrynt:web": "Use browser and web-development tools",
+    "auvrynt:software": "Use software and .NET tools",
+    "auvrynt:godot": "Use Godot project tools",
+    "auvrynt:blender": "Use Blender 3D tools",
+    "auvrynt:serena": "Use local Serena semantic code tools",
+};
 function parsePort(value) {
     if (value === undefined || value === "")
         return 49321;
@@ -133,9 +153,11 @@ function parseOAuthConfig(env, ownerToken) {
         ownerToken: parseRequiredSecret(env.AUVRYNT_OAUTH_OWNER_TOKEN ?? ownerToken, "AUVRYNT_OAUTH_OWNER_TOKEN"),
         accessTokenTtlSeconds: parsePositiveInteger(env.AUVRYNT_OAUTH_ACCESS_TOKEN_TTL_SECONDS, DEFAULT_OAUTH_ACCESS_TOKEN_TTL_SECONDS, "AUVRYNT_OAUTH_ACCESS_TOKEN_TTL_SECONDS"),
         refreshTokenTtlSeconds: parsePositiveInteger(env.AUVRYNT_OAUTH_REFRESH_TOKEN_TTL_SECONDS, DEFAULT_OAUTH_REFRESH_TOKEN_TTL_SECONDS, "AUVRYNT_OAUTH_REFRESH_TOKEN_TTL_SECONDS"),
-        scopes: parseStringList(env.AUVRYNT_OAUTH_SCOPES, ["auvrynt"]),
+        scopes: parseStringList(env.AUVRYNT_OAUTH_SCOPES, [...SUPPORTED_SCOPES]),
         allowedRedirectHosts: parseStringList(env.AUVRYNT_OAUTH_ALLOWED_REDIRECT_HOSTS, [
             "chatgpt.com",
+            "claude.ai",
+            "claude.com",
             "localhost",
             "127.0.0.1",
         ]),
@@ -154,7 +176,7 @@ function parseSerenaConfig(env, filesConfig) {
     const filesSerena = filesConfig.serena ?? {};
     return {
         enabled: parseBoolean(env.AUVRYNT_SERENA_ENABLED ?? filesSerena.enabled),
-        executable: env.AUVRYNT_SERENA_EXECUTABLE ?? filesSerena.executable ?? "serena",
+        executable: env.AUVRYNT_SERENA_EXECUTABLE ?? env.AUVRYNT_SERENA_PATH ?? filesConfig.executables?.serena ?? filesSerena.executable ?? "serena",
         backend: (env.AUVRYNT_SERENA_BACKEND ?? filesSerena.backend ?? "LSP"),
         context: env.AUVRYNT_SERENA_CONTEXT ?? filesSerena.context ?? "desktop-app",
         startupTimeoutMs: parsePositiveInteger(env.AUVRYNT_SERENA_STARTUP_TIMEOUT ?? filesSerena.startupTimeoutMs, 30_000, "AUVRYNT_SERENA_STARTUP_TIMEOUT"),
@@ -163,6 +185,15 @@ function parseSerenaConfig(env, filesConfig) {
         maxInstances: parsePositiveInteger(env.AUVRYNT_SERENA_MAX_INSTANCES ?? filesSerena.maxInstances, 3, "AUVRYNT_SERENA_MAX_INSTANCES"),
     };
 }
+function parseExecutablesConfig(env, filesConfig) {
+    const configExecs = filesConfig.executables ?? {};
+    return {
+        serena: env.AUVRYNT_SERENA_PATH ?? configExecs.serena,
+        godot: env.AUVRYNT_GODOT_PATH ?? configExecs.godot,
+        godotCsharp: env.AUVRYNT_GODOT_CSHARP_PATH ?? configExecs.godotCsharp,
+        blender: env.AUVRYNT_BLENDER_PATH ?? configExecs.blender,
+    };
+}
 export function loadConfig(env = process.env) {
     const files = loadAuvryntFiles(env);
     const host = env.HOST ?? files.config.host ?? "127.0.0.1";
@@ -193,6 +224,7 @@ export function loadConfig(env = process.env) {
         agentDir: resolve(expandHomePath(env.AUVRYNT_AGENT_DIR ?? files.config.agentDir ?? defaultAgentDir())),
         logging: parseLoggingConfig(env),
         serena: parseSerenaConfig(env, files.config),
+        executables: parseExecutablesConfig(env, files.config),
     };
 }
 function parsePublicBaseUrl(value) {

package/dist/connection-registry.js

@@ -0,0 +1,73 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+const REGISTRY_FILE = "connections.json";
+export function connectionRegistryPath(stateDir) {
+    return join(stateDir, REGISTRY_FILE);
+}
+export function identifyProvider(clientName, userAgent) {
+    const value = `${clientName ?? ""} ${userAgent ?? ""}`.trim();
+    const normalized = value.toLowerCase();
+    const knownProviders = [
+        ["chatgpt", "ChatGPT"],
+        ["openai", "OpenAI"],
+        ["claude", "Claude"],
+        ["anthropic", "Claude / Anthropic"],
+        ["kimi", "Kimi"],
+        ["cursor", "Cursor"],
+        ["windsurf", "Windsurf"],
+        ["gemini", "Gemini"],
+        ["vscode", "VS Code"],
+        ["visual studio code", "VS Code"],
+        ["codex", "Codex"],
+    ];
+    for (const [marker, provider] of knownProviders) {
+        if (normalized.includes(marker))
+            return provider;
+    }
+    if (clientName?.trim())
+        return clientName.trim().slice(0, 80);
+    if (userAgent?.trim())
+        return userAgent.trim().split(/[\s/]/, 1)[0].slice(0, 80) || "Unknown MCP client";
+    return "Unknown MCP client";
+}
+function sanitizeUserAgent(userAgent) {
+    if (!userAgent)
+        return undefined;
+    return userAgent.replace(/[\r\n]/g, " ").slice(0, 160);
+}
+export function readConnectedClients(stateDir) {
+    const path = connectionRegistryPath(stateDir);
+    if (!existsSync(path))
+        return [];
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        if (!Array.isArray(parsed))
+            return [];
+        return parsed.filter((entry) => Boolean(entry && typeof entry === "object"));
+    }
+    catch {
+        return [];
+    }
+}
+export function recordConnectedClient(stateDir, input) {
+    mkdirSync(stateDir, { recursive: true });
+    const provider = identifyProvider(input.clientName, input.userAgent);
+    const clients = readConnectedClients(stateDir);
+    const existing = clients.find((client) => client.provider === provider);
+    const now = new Date().toISOString();
+    if (existing) {
+        existing.lastSeen = now;
+        existing.requestCount += 1;
+        existing.userAgent = sanitizeUserAgent(input.userAgent) ?? existing.userAgent;
+    }
+    else {
+        clients.push({
+            provider,
+            userAgent: sanitizeUserAgent(input.userAgent),
+            lastSeen: now,
+            requestCount: 1,
+        });
+    }
+    clients.sort((left, right) => right.lastSeen.localeCompare(left.lastSeen));
+    writeFileSync(connectionRegistryPath(stateDir), JSON.stringify(clients.slice(0, 32), null, 2) + "\n", { mode: 0o600 });
+}

package/dist/connection-status.js

@@ -1,6 +1,7 @@
 import { createRequire } from "node:module";
 import { getBlenderClient } from "./blender-client.js";
 import { godotEditorStatus } from "./godot-editor-bridge.js";
+import { discoverLocalIntegrations, processDetected } from "./integration-discovery.js";
 const require = createRequire(import.meta.url);
 function checkedAt() {
     return new Date().toISOString();
@@ -29,6 +30,7 @@ function browserStatus() {
 export async function getConnectionStatus(registry, processManager, workspaceId) {
     const workspace = registry.getWorkspace(workspaceId);
     const timestamp = checkedAt();
+    const local = await discoverLocalIntegrations();
     const blender = {
         state: "disconnected",
         provider: "Auvrynt Blender bridge",
@@ -45,6 +47,17 @@ export async function getConnectionStatus(registry, processManager, workspaceId)
     catch (error) {
         blender.detail = error instanceof Error ? error.message : String(error);
     }
+    const blenderLabMcp = {
+        state: local.ports.blender_lab_mcp ? "connected" : processDetected(local, "blender") ? "available" : "disconnected",
+        provider: "Blender Lab MCP",
+        endpoint: `127.0.0.1:${process.env.AUVRYNT_BLENDER_MCP_PORT ?? "9876"}`,
+        detail: local.ports.blender_lab_mcp
+            ? "Blender MCP is listening on the configured Blender Lab endpoint."
+            : processDetected(local, "blender")
+                ? "Blender is running, but its MCP endpoint is not reachable. Check Blender MCP Auto Start and port 9876."
+                : "Blender is not detected. Start Blender with the MCP extension enabled for automatic connection.",
+        checkedAt: timestamp,
+    };
     let godot;
     try {
         const response = await godotEditorStatus({ workspaceId });
@@ -66,6 +79,37 @@ export async function getConnectionStatus(registry, processManager, workspaceId)
             checkedAt: timestamp,
         };
     }
+    const godotMcp = {
+        state: local.ports.auvrynt_godot_bridge ? "connected" : processDetected(local, "godot") ? "available" : "disconnected",
+        provider: "Godot / Codex MCP",
+        endpoint: "local process or 127.0.0.1:49322",
+        detail: local.ports.auvrynt_godot_bridge
+            ? "Auvrynt Godot bridge is reachable."
+            : processDetected(local, "godot")
+                ? "Godot is running, but no reachable Auvrynt bridge was found. Enable the bridge or Codex Godot MCP."
+                : "Godot is not detected. Start Godot with the Auvrynt bridge or Codex Godot MCP enabled.",
+        checkedAt: timestamp,
+    };
+    const cloudflare = {
+        state: processDetected(local, "cloudflare_tunnel") ? "connected" : local.executables.cloudflared ? "available" : "unavailable",
+        provider: "Cloudflare Tunnel",
+        detail: processDetected(local, "cloudflare_tunnel")
+            ? "cloudflared is running."
+            : local.executables.cloudflared
+                ? `cloudflared is installed at ${local.executables.cloudflared}, but no tunnel process is running.`
+                : "cloudflared is not installed. Install it to expose /mcp through Cloudflare Tunnel.",
+        checkedAt: timestamp,
+    };
+    const serena = {
+        state: processDetected(local, "serena") ? "connected" : local.executables.serena ? "available" : "unavailable",
+        provider: "Serena",
+        detail: processDetected(local, "serena")
+            ? "Serena process detected."
+            : local.executables.serena
+                ? `Serena is installed at ${local.executables.serena} and available on demand.`
+                : "Serena is not installed or not available on PATH.",
+        checkedAt: timestamp,
+    };
     return {
         checkedAt: timestamp,
         workspace: { id: workspace.id, root: workspace.root, mode: workspace.mode },
@@ -77,7 +121,11 @@ export async function getConnectionStatus(registry, processManager, workspaceId)
                 checkedAt: timestamp,
             },
             blender,
+            blender_lab_mcp: blenderLabMcp,
             godot,
+            godot_mcp: godotMcp,
+            cloudflare_tunnel: cloudflare,
+            serena,
             browser: browserStatus(),
             chrome_mcp: {
                 state: "not_configured",

package/dist/integration-discovery.js

@@ -0,0 +1,98 @@
+import { createConnection } from "node:net";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { loadConfig } from "./config.js";
+const execFileAsync = promisify(execFile);
+const PROCESS_MARKERS = {
+    blender: ["blender.exe", "blender"],
+    godot: ["godot.exe", "godot4.exe", "godot"],
+    cloudflare_tunnel: ["cloudflared.exe", "cloudflared"],
+    serena: ["serena.exe", "serena"],
+};
+function probePort(host, port, timeoutMs = 350) {
+    return new Promise((resolve) => {
+        const socket = createConnection({ host, port });
+        const finish = (available) => {
+            socket.destroy();
+            resolve(available);
+        };
+        const timeout = setTimeout(() => finish(false), timeoutMs);
+        socket.once("connect", () => {
+            clearTimeout(timeout);
+            finish(true);
+        });
+        socket.once("error", () => {
+            clearTimeout(timeout);
+            finish(false);
+        });
+    });
+}
+async function runningProcessNames() {
+    if (process.platform !== "win32")
+        return [];
+    try {
+        const { stdout } = await execFileAsync("tasklist.exe", ["/FO", "CSV", "/NH"], { timeout: 5_000 });
+        return stdout
+            .split(/\r?\n/)
+            .map((line) => line.match(/^"([^"]+)"/)?.[1]?.toLowerCase())
+            .filter((name) => Boolean(name));
+    }
+    catch {
+        return [];
+    }
+}
+async function findExecutable(command) {
+    if (process.platform !== "win32")
+        return undefined;
+    try {
+        const { stdout } = await execFileAsync("where.exe", [command], { timeout: 5_000 });
+        return stdout.split(/\r?\n/).map((line) => line.trim()).find(Boolean);
+    }
+    catch {
+        return undefined;
+    }
+}
+function hasProcess(processes, markers) {
+    return processes.some((processName) => markers.some((marker) => processName === marker || processName.includes(marker)));
+}
+export async function discoverLocalIntegrations() {
+    let configExecs = {};
+    try {
+        const config = loadConfig();
+        configExecs = config.executables;
+    }
+    catch { }
+    const blenderMcpPort = Number(process.env.AUVRYNT_BLENDER_MCP_PORT ?? 9876);
+    const [processes, cloudflaredSys, serenaSys, godotSys, blenderSys, blenderLabMcp, auvryntBlenderBridge, auvryntGodotBridge] = await Promise.all([
+        runningProcessNames(),
+        findExecutable("cloudflared"),
+        findExecutable("serena"),
+        findExecutable("godot"),
+        findExecutable("blender"),
+        probePort("127.0.0.1", blenderMcpPort),
+        probePort("127.0.0.1", 49323),
+        probePort("127.0.0.1", 49322),
+    ]);
+    const serena = configExecs.serena || serenaSys;
+    const godot = configExecs.godot || godotSys;
+    const godotCsharp = configExecs.godotCsharp;
+    const blender = configExecs.blender || blenderSys;
+    return {
+        processes,
+        executables: {
+            cloudflared: cloudflaredSys,
+            serena,
+            godot,
+            godotCsharp,
+            blender,
+        },
+        ports: {
+            blender_lab_mcp: blenderLabMcp,
+            auvrynt_blender_bridge: auvryntBlenderBridge,
+            auvrynt_godot_bridge: auvryntGodotBridge,
+        },
+    };
+}
+export function processDetected(discovery, integration) {
+    return hasProcess(discovery.processes, PROCESS_MARKERS[integration]);
+}

package/dist/oauth-provider.js

@@ -21,10 +21,25 @@ function htmlEscape(value) {
         .replaceAll("'", "'");
 }
 function formHtml(params) {
-    const scopeText = params.scopes.length > 0 ? params.scopes.join(" ") : "auvrynt";
+    const scopeDescriptions = {
+        "auvrynt:read": "Inspect files, search, and perform read-only project analysis",
+        "auvrynt:write": "Edit and create files",
+        "auvrynt:process": "Start and stop approved workspace processes",
+        "auvrynt:web": "Use browser and web-development tools",
+        "auvrynt:software": "Use software and .NET tools",
+        "auvrynt:godot": "Use Godot project tools",
+        "auvrynt:blender": "Use Blender 3D tools",
+        "auvrynt:serena": "Use local Serena semantic code tools",
+    };
+    const scopeItems = params.scopes.length > 0
+        ? params.scopes.map((s) => {
+            const desc = scopeDescriptions[s];
+            return `<li><strong>${htmlEscape(s)}</strong>${desc ? ` <span>${htmlEscape(desc)}</span>` : ""}</li>`;
+        }).join("\n          ")
+        : "<li><strong>auvrynt</strong><span>General access</span></li>";
     const resourceText = params.resource?.href ?? "Auvrynt Webkit Arsenal endpoint";
     const error = params.error
-        ? `<p class="error">${htmlEscape(params.error)}</p>`
+        ? `<output role="alert" class="error">${htmlEscape(params.error)}</output>`
         : "";
     const hiddenFields = Object.entries(params.fields)
         .filter((entry) => entry[1] !== undefined)
@@ -35,39 +50,127 @@ function formHtml(params) {
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>Connect Auvrynt</title>
-    <style>
-      body { font-family: system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; margin: 0; background: #0f172a; color: #e2e8f0; }
-      main { max-width: 440px; margin: 12vh auto; padding: 32px; background: #111827; border: 1px solid #334155; border-radius: 18px; box-shadow: 0 24px 80px rgba(0,0,0,.35); }
-      h1 { margin: 0 0 12px; font-size: 28px; }
-      p { line-height: 1.5; color: #cbd5e1; }
-      dl { padding: 16px; background: #020617; border-radius: 12px; }
-      dt { color: #94a3b8; font-size: 12px; text-transform: uppercase; letter-spacing: .06em; }
-      dd { margin: 4px 0 12px; word-break: break-word; }
-      label { display: block; margin: 18px 0 8px; font-weight: 600; }
-      input { box-sizing: border-box; width: 100%; padding: 12px 14px; border-radius: 10px; border: 1px solid #475569; background: #020617; color: #e2e8f0; font-size: 16px; }
-      button { margin-top: 18px; width: 100%; border: 0; border-radius: 10px; padding: 12px 14px; font-weight: 700; color: #020617; background: #38bdf8; cursor: pointer; }
-      .error { color: #fecaca; background: #7f1d1d; border-radius: 10px; padding: 10px 12px; }
-      .warning { color: #fde68a; }
-    </style>
+    <title>Auvrynt: Webkit Arsenal</title>
+    <style>
+      *, *::before, *::after { box-sizing: border-box; }
+      :root { color-scheme: dark; font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
+      body { margin: 0; min-height: 100vh; background: #080b10; color: #f4f7fb; display: grid; place-items: center; padding: 24px; }
+      main { width: min(100%, 960px); display: grid; grid-template-columns: .82fr 1.18fr; overflow: hidden; background: #10151d; border: 1px solid #273241; border-radius: 18px; box-shadow: 0 28px 90px rgba(0,0,0,.42); }
+      .identity { padding: 44px 38px; background: #0c1118; border-right: 1px solid #273241; display: flex; flex-direction: column; justify-content: space-between; min-height: 620px; }
+      .mark { display: inline-flex; align-items: center; gap: 10px; color: #a9b8c9; font-size: 12px; font-weight: 750; letter-spacing: .14em; text-transform: uppercase; }
+      .mark-icon { width: 26px; height: 26px; display: grid; place-items: center; border: 1px solid #64748b; color: #b8f36b; border-radius: 7px; font-size: 13px; }
+      .identity h1 { max-width: 310px; margin: 56px 0 16px; font-size: clamp(34px, 4vw, 52px); line-height: .98; letter-spacing: -.055em; font-weight: 760; }
+      .identity h1 span { color: #b8f36b; }
+      .identity-copy { max-width: 310px; margin: 0; color: #8e9bad; font-size: 15px; line-height: 1.65; }
+      .connection-meta { display: grid; gap: 14px; margin-top: 36px; }
+      .meta-row { display: flex; justify-content: space-between; gap: 16px; padding-top: 12px; border-top: 1px solid #273241; color: #778598; font-size: 12px; }
+      .meta-row strong { color: #d7e0eb; font-weight: 600; text-align: right; overflow-wrap: anywhere; }
+      .status { display: inline-flex; align-items: center; gap: 7px; color: #b8f36b; font-weight: 650; }
+      .status::before { content: ""; width: 7px; height: 7px; border-radius: 50%; background: #b8f36b; box-shadow: 0 0 0 3px rgba(184,243,107,.12); }
+      .identity-footer { color: #617084; font-size: 11px; line-height: 1.5; }
+      .form-panel { padding: 44px 48px; }
+      .eyebrow { margin: 0 0 12px; color: #b8f36b; font-size: 11px; font-weight: 750; letter-spacing: .14em; text-transform: uppercase; }
+      .form-panel h2 { margin: 0 0 10px; font-size: 28px; line-height: 1.1; letter-spacing: -.035em; }
+      .intro { max-width: 520px; margin: 0 0 28px; color: #9ba8b8; font-size: 15px; line-height: 1.6; }
+      .client-badge { display: inline-flex; align-items: center; gap: 8px; margin-bottom: 24px; padding: 8px 11px; border: 1px solid #344153; border-radius: 8px; color: #dce6f1; background: #171e28; font-size: 13px; }
+      .client-badge::before { content: ""; width: 7px; height: 7px; border-radius: 50%; background: #b8f36b; }
+      .section-label { margin: 0 0 10px; color: #718095; font-size: 11px; font-weight: 750; letter-spacing: .12em; text-transform: uppercase; }
+      .scope-list { list-style: none; padding: 0; margin: 0 0 28px; display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 8px; }
+      .scope-list li { min-height: 68px; padding: 12px 13px; border: 1px solid #2b3747; border-radius: 10px; background: #141b24; color: #8e9bad; font-size: 12px; line-height: 1.45; }
+      .scope-list li strong { display: block; margin-bottom: 4px; color: #f1f5f9; font-size: 13px; font-weight: 650; }
+      .token-group { margin-bottom: 22px; }
+      .token-group label { display: block; margin-bottom: 8px; color: #dce6f1; font-size: 13px; font-weight: 650; }
+      .input-wrapper { position: relative; }
+      .input-wrapper input { width: 100%; padding: 13px 58px 13px 14px; border: 1px solid #3a485a; border-radius: 9px; background: #0c1118; color: #f4f7fb; font: inherit; font-size: 15px; outline: none; transition: border-color .18s, box-shadow .18s; }
+      .input-wrapper input:focus { border-color: #b8f36b; box-shadow: 0 0 0 3px rgba(184,243,107,.14); }
+      .input-wrapper input::placeholder { color: #657388; }
+      .toggle-vis { position: absolute; right: 5px; top: 50%; transform: translateY(-50%); border: 0; border-radius: 6px; padding: 7px 9px; background: transparent; color: #9ba8b8; cursor: pointer; font-size: 12px; font-weight: 650; }
+      .toggle-vis:hover { color: #b8f36b; background: #1b2632; }
+      .button-group { display: flex; gap: 10px; }
+      .button-group button { flex: 1; min-height: 46px; border-radius: 9px; padding: 12px 14px; font: inherit; font-size: 14px; font-weight: 750; cursor: pointer; transition: transform .18s, background .18s, border-color .18s; }
+      .button-group button:hover { transform: translateY(-1px); }
+      .button-group button:focus-visible, .toggle-vis:focus-visible { outline: 2px solid #b8f36b; outline-offset: 3px; }
+      .btn-approve { border: 1px solid #b8f36b; color: #10150c; background: #b8f36b; }
+      .btn-approve:hover { background: #c8fa89; }
+      .btn-deny { border: 1px solid #3a485a; color: #dce6f1; background: transparent; }
+      .btn-deny:hover { border-color: #718095; background: #171e28; }
+      .error { display: block; margin: 0 0 20px; padding: 12px 14px; border: 1px solid #b45555; border-radius: 9px; color: #ffd1d1; background: #321a1e; font-size: 13px; line-height: 1.45; }
+      .security-note { display: flex; gap: 8px; margin: 22px 0 0; color: #718095; font-size: 12px; line-height: 1.5; }
+      .security-note::before { content: "✓"; color: #b8f36b; font-weight: 800; }
+      @media (prefers-reduced-motion: reduce) { *, *::before, *::after { transition: none !important; } .button-group button:hover { transform: none; } }
+      @media (max-width: 720px) { body { padding: 12px; place-items: start center; } main { grid-template-columns: 1fr; } .identity { min-height: auto; padding: 28px 24px; border-right: 0; border-bottom: 1px solid #273241; } .identity h1 { margin: 34px 0 12px; font-size: 40px; } .identity-copy { max-width: 520px; } .connection-meta { margin-top: 24px; } .identity-footer { display: none; } .form-panel { padding: 28px 24px 32px; } }
+      @media (max-width: 480px) { .scope-list { grid-template-columns: 1fr; } .button-group { flex-direction: column-reverse; } }
+      .sr-only { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0,0,0,0); white-space: nowrap; border: 0; }
+    </style>
   </head>
   <body>
-    <main>
-      <h1>Connect Auvrynt</h1>
-      <p class="warning">Only approve this if you are intentionally connecting your own ChatGPT or MCP client to this local machine.</p>
-      ${error}
-      <dl>
-        <dt>Client</dt><dd>${htmlEscape(params.clientName)}</dd>
-        <dt>Scope</dt><dd>${htmlEscape(scopeText)}</dd>
-        <dt>Resource</dt><dd>${htmlEscape(resourceText)}</dd>
-      </dl>
-      <form method="post">
-${hiddenFields}
-        <label for="owner_token">Owner password</label>
-        <input id="owner_token" name="owner_token" type="password" autocomplete="current-password" autofocus required />
-        <button type="submit">Authorize Auvrynt</button>
-      </form>
-    </main>
+    <main role="main">
+      <section class="identity" aria-label="Auvrynt connection details">
+        <div>
+          <div class="mark"><span class="mark-icon" aria-hidden="true">A</span> Auvrynt</div>
+          <h1>Local power.<br /><span>Explicit access.</span></h1>
+          <p class="identity-copy">Auvrynt keeps your development workspace local while giving your web agent a controlled MCP connection.</p>
+          <div class="connection-meta" aria-label="Connection summary">
+            <div class="meta-row"><span>Requesting agent</span><strong>${htmlEscape(params.clientName)}</strong></div>
+            <div class="meta-row"><span>Connection state</span><strong class="status">Awaiting approval</strong></div>
+            <div class="meta-row"><span>Permissions</span><strong>${params.scopes.length} requested</strong></div>
+          </div>
+        </div>
+        <p class="identity-footer">Review every permission before continuing. You can deny this request without changing your workspace.</p>
+      </section>
+      <section class="form-panel" aria-labelledby="authorize-title">
+        <p class="eyebrow">Secure handshake</p>
+        <h2 id="authorize-title">Approve this connection</h2>
+        <p class="intro">Review what the web agent can do in your workspace, then confirm with your local owner token.</p>
+        ${error}
+        <div class="client-badge">${htmlEscape(params.clientName)}</div>
+        <p class="section-label">Requested permissions</p>
+        <ul class="scope-list" aria-label="Requested permissions">
+          ${scopeItems}
+        </ul>
+        <form method="post" aria-describedby="token-desc">
+          <div class="token-group">
+            <label for="owner_token">Local owner token</label>
+            <p id="token-desc" class="sr-only">Enter your Auvrynt owner token to authorize this connection. This token stays on this page and is never shared with the web agent.</p>
+            <div class="input-wrapper">
+              <input id="owner_token" name="owner_token" type="password" placeholder="Enter your owner token" autocomplete="off" autofocus required aria-required="true" />
+              <button type="button" class="toggle-vis" aria-label="Show owner token" data-target="owner_token">Show</button>
+            </div>
+          </div>
+${hiddenFields}
+          <div class="button-group">
+            <button type="submit" name="denied" value="true" class="btn-deny" formnovalidate>Deny request</button>
+            <button type="submit" class="btn-approve">Approve connection</button>
+          </div>
+        </form>
+        <p class="security-note">Your owner token is validated locally. It is never sent to the web agent, stored in cookies, or written to logs.</p>
+      </section>
+    </main>
+    <script nonce="${randomUUID()}">
+      (function() {
+        var btn = document.querySelector('.toggle-vis');
+        var input = document.getElementById('owner_token');
+        if (btn && input) {
+          btn.addEventListener('click', function() {
+            var isPassword = input.type === 'password';
+            input.type = isPassword ? 'text' : 'password';
+            btn.textContent = isPassword ? 'Hide' : 'Show';
+            btn.setAttribute('aria-label', isPassword ? 'Hide owner token' : 'Show owner token');
+            input.setAttribute('aria-live', 'polite');
+          });
+        }
+        var form = document.querySelector('form');
+        var denyBtn = document.querySelector('button[name="denied"]');
+        if (form && denyBtn) {
+          denyBtn.addEventListener('click', function(e) {
+            e.preventDefault();
+            var redirect = new URL(window.location.href);
+            redirect.searchParams.set('error', 'access_denied');
+            window.location.href = redirect.href;
+          });
+        }
+      })();
+    </script>
   </body>
 </html>`;
 }
@@ -131,7 +234,12 @@ export class SingleUserOAuthProvider {
         if (!requestedScopesAllowed(params.scopes ?? [], this.config.scopes)) {
             throw new InvalidRequestError("Requested scope is not supported");
         }
-        if (res.req.method !== "POST") {
+        const req = res.req;
+        const queryError = req.query?.error;
+        if (queryError === "access_denied") {
+            throw new AccessDeniedError("Authorization denied by user");
+        }
+        if (req.method !== "POST") {
             res.status(200).setHeader("Content-Type", "text/html; charset=utf-8");
             res.send(formHtml({
                 clientName: client.client_name ?? client.client_id,
@@ -141,11 +249,14 @@ export class SingleUserOAuthProvider {
             }));
             return;
         }
-        const providedToken = String(res.req.body?.owner_token ?? "");
+        if (req.body?.denied === "true") {
+            throw new AccessDeniedError("Authorization denied by user");
+        }
+        const providedToken = String(req.body?.owner_token ?? "");
         if (!safeEquals(providedToken, this.config.ownerToken)) {
             res.status(401).setHeader("Content-Type", "text/html; charset=utf-8");
             res.send(formHtml({
-                error: "The Owner password was not accepted.",
+                error: "The owner password was not accepted.",
                 clientName: client.client_name ?? client.client_id,
                 scopes: params.scopes ?? this.config.scopes,
                 resource: params.resource,

package/dist/server.js

@@ -23,6 +23,7 @@ import { formatAgentsPath, WorkspaceRegistry } from "./workspaces.js";
 import { executeViewImage } from "./view-image.js";
 import { ProcessManager } from "./processes.js";
 import { getConnectionStatus } from "./connection-status.js";
+import { recordConnectedClient } from "./connection-registry.js";
 import { globFiles, searchText, inspectProject } from "./search-discovery.js";
 import { capturePageScreenshot, inspectPage, startDevServer } from "./web-tools.js";
 import { inspectImage, compareImages, inspectSprite, splitSpriteSheet } from "./image-tools.js";
@@ -190,6 +191,14 @@ function requestLogFields(req, config) {
         contentLength: req.header("content-length"),
     };
 }
+function mcpClientName(req) {
+    const headerName = req.header("x-mcp-client-name") ?? req.header("x-client-name");
+    if (headerName)
+        return headerName;
+    const body = req.body;
+    const name = body?.params?.clientInfo?.name;
+    return typeof name === "string" ? name : undefined;
+}
 function logToolCall(config, fields) {
     if (!config.logging.toolCalls)
         return;
@@ -2666,9 +2675,10 @@ export function createServer(config = loadConfig()) {
     const mcpUrl = new URL("/mcp", config.publicBaseUrl);
     const resourceServerUrl = resourceUrlFromServerUrl(mcpUrl);
     const oauthProvider = new SingleUserOAuthProvider(config.oauth, mcpUrl);
+    const minimumScope = config.oauth.scopes.includes("auvrynt:read") ? "auvrynt:read" : config.oauth.scopes[0];
     const bearerAuth = requireBearerAuth({
         verifier: oauthProvider,
-        requiredScopes: [config.oauth.scopes[0] ?? "auvrynt"],
+        requiredScopes: [minimumScope],
         resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(resourceServerUrl),
     });
     const workspaceStore = createWorkspaceStore(config.stateDir);
@@ -2755,6 +2765,18 @@ export function createServer(config = loadConfig()) {
             sendJsonRpcError(res, 401, -32001, "Unauthorized");
             return;
         }
+        try {
+            recordConnectedClient(config.stateDir, {
+                clientName: mcpClientName(req),
+                userAgent: req.header("user-agent") ?? undefined,
+            });
+        }
+        catch (error) {
+            logEvent(config.logging, "warn", "connection_registry_write_failed", {
+                requestId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
         logEvent(config.logging, "debug", "mcp_request", {
             requestId,
             method: req.method,

package/docs/DEVELOPMENT_TOOLS.md

@@ -6,11 +6,16 @@ Auvrynt extends Model Context Protocol (MCP) with tools for web application deve
 
 ## Architecture & Security Boundaries
 
-Use `get_connection_status` after `open_workspace` to automatically probe the
-authenticated MCP session, the local Blender bridge, the Godot editor bridge,
-browser support, Chrome MCP registration, and tracked workspace processes. A
-browser marked `available` means Playwright is installed; browser sessions are
-created on demand and are not persistent connections.
+Use `get_connection_status` after `open_workspace` to automatically probe the
+authenticated MCP session, Blender, Godot, Cloudflare Tunnel, Serena, browser
+support, Chrome MCP registration, and tracked workspace processes. Blender
+detection includes the Blender Lab MCP endpoint shown in Blender preferences
+(`localhost:9876` by default) and the Auvrynt bridge (`127.0.0.1:49323`).
+Godot detection distinguishes a running Godot process from a reachable Auvrynt
+editor bridge (`127.0.0.1:49322`). Cloudflare Tunnel and Serena report whether
+their executables are installed and whether their processes are running. A
+browser marked `available` means Playwright is installed; browser sessions are
+created on demand and are not persistent connections.
 
 1. **Workspace Boundary Enforcement**: Every path input must be relative to the opened workspace root. Path traversal (`..`) or symbolic links escaping the workspace are blocked by `WorkspaceRegistry.resolvePath`.
 2. **Persistent Processes**: Long-running servers, .NET applications, and Godot games run as background child processes managed by `ProcessManager`. Standard output and error streams are captured in bounded in-memory log buffers (max 1000 lines).