indusagi 0.13.6 → 0.13.8

package/dist/zoho.js

@@ -0,0 +1,1451 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/facade/mcp-core/client.ts
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
+import {
+  UnauthorizedError
+} from "@modelcontextprotocol/sdk/client/auth.js";
+import {
+  ListRootsRequestSchema,
+  ElicitRequestSchema,
+  CreateMessageRequestSchema,
+  PingRequestSchema,
+  ToolListChangedNotificationSchema,
+  ResourceListChangedNotificationSchema,
+  ResourceUpdatedNotificationSchema,
+  PromptListChangedNotificationSchema,
+  ProgressNotificationSchema,
+  LoggingMessageNotificationSchema,
+  CancelledNotificationSchema
+} from "@modelcontextprotocol/sdk/types.js";
+
+// src/facade/mcp-core/errors.ts
+var MCPError = class extends Error {
+  /** Error code */
+  code;
+  /** Additional error details */
+  details;
+  /** Server name where error occurred */
+  serverName;
+  /** Tool name if error occurred during tool execution */
+  toolName;
+  constructor(message, code, details, options) {
+    super(message, options?.cause ? { cause: options.cause } : void 0);
+    this.name = "MCPError";
+    this.code = code;
+    this.details = details;
+    this.serverName = options?.serverName;
+    this.toolName = options?.toolName;
+  }
+  /**
+   * Convert error to JSON for logging/serialization.
+   */
+  toJSON() {
+    return {
+      name: this.name,
+      message: this.message,
+      code: this.code,
+      details: this.details,
+      serverName: this.serverName,
+      toolName: this.toolName
+    };
+  }
+  /**
+   * Create a string representation of the error.
+   */
+  toString() {
+    let str = `${this.name} [${this.code}]: ${this.message}`;
+    if (this.serverName) str += ` (server: ${this.serverName})`;
+    if (this.toolName) str += ` (tool: ${this.toolName})`;
+    return str;
+  }
+};
+function createServerError(message, serverName, details) {
+  return new MCPError(message, "SERVER_ERROR" /* SERVER_ERROR */, details, { serverName });
+}
+
+// src/facade/mcp-core/client.ts
+var DEFAULT_REQUEST_TIMEOUT = 6e4;
+var DEFAULT_CONNECT_TIMEOUT = 3e4;
+var MCPClient = class {
+  constructor(options) {
+    this.options = options;
+    this.serverName = options.name;
+    this.config = options.config;
+    this.timeout = options.timeout ?? DEFAULT_REQUEST_TIMEOUT;
+    this.logHandler = options.logger;
+    this.enableServerLogs = options.enableServerLogs ?? true;
+    this.enableProgressTracking = options.enableProgressTracking ?? false;
+    this._roots = options.roots ?? [];
+  }
+  options;
+  client;
+  transport;
+  isConnected = false;
+  connectionPromise = null;
+  serverCapabilities;
+  logHandler;
+  enableServerLogs;
+  enableProgressTracking;
+  _roots;
+  // --- Host-overridable handlers (Core of #13) --------------------------------
+  // Server-initiated REQUESTS are answered by request handlers registered on the
+  // SDK client; the handlers delegate to these host-supplied callbacks when set,
+  // and fall back to sensible defaults otherwise.
+  elicitationHandler;
+  samplingHandler;
+  // Server-initiated NOTIFICATIONS are dispatched to these (so the host can, for
+  // example, re-list tools when a `tools/list_changed` arrives).
+  resourceUpdatedHandler;
+  resourceListChangedHandler;
+  toolListChangedHandler;
+  promptListChangedHandler;
+  progressHandler;
+  /** Server name */
+  serverName;
+  /** Server config */
+  config;
+  /** Request timeout */
+  timeout;
+  // ========================================================================
+  // Connection Lifecycle
+  // ========================================================================
+  /**
+   * Connect to the MCP server.
+   * Safe to call multiple times - returns existing connection if already connected.
+   */
+  async connect() {
+    if (this.isConnected) return;
+    if (this.connectionPromise) {
+      return this.connectionPromise;
+    }
+    this.connectionPromise = this.doConnect();
+    try {
+      await this.connectionPromise;
+    } finally {
+      this.connectionPromise = null;
+    }
+  }
+  async doConnect() {
+    const transport = this.createTransport(this.config);
+    this.transport = transport;
+    const client = new Client(
+      { name: "indusagi-coding-agent", version: "0.13.0" },
+      {
+        capabilities: {
+          roots: { listChanged: true },
+          elicitation: {},
+          sampling: {}
+        }
+      }
+    );
+    this.client = client;
+    this.registerServerHandlers(client);
+    const prevOnClose = transport.onclose;
+    transport.onclose = () => {
+      this.isConnected = false;
+      this.log("debug", "Transport closed");
+      prevOnClose?.();
+    };
+    try {
+      await client.connect(transport, { timeout: DEFAULT_CONNECT_TIMEOUT });
+    } catch (err) {
+      const recovered = await this.tryFinishOAuthAndReconnect(client, transport, err);
+      if (!recovered) {
+        throw this.wrapConnectError(err);
+      }
+    }
+    this.serverCapabilities = client.getServerCapabilities();
+    this.isConnected = true;
+    this.log("info", `Connected to MCP server`);
+  }
+  /**
+   * If `err` is an OAuth challenge and we have a provider + finishAuth-capable
+   * transport, wait for the browser code, exchange tokens, then reconnect on a
+   * **fresh** transport (the first transport is already `start()`ed and cannot
+   * be reused — see StreamableHTTPClientTransport.start).
+   *
+   * Matches the official SDK CLI example (`simpleOAuthClient`):
+   *   finishAuth(code) → new StreamableHTTPClientTransport → client.connect again
+   *
+   * Client.connect already called `close()` on init failure, so the Client is
+   * free to attach a new transport.
+   */
+  async tryFinishOAuthAndReconnect(client, transport, err) {
+    if (!isAuthRequiredError(err)) return false;
+    const provider = this.options.authProvider;
+    if (!provider) return false;
+    const finishAuth = transport.finishAuth;
+    const waitForCode = provider.waitForAuthorizationCode;
+    if (typeof finishAuth !== "function" || typeof waitForCode !== "function") {
+      this.log(
+        "error",
+        "MCP server requires authentication but OAuth finish path is incomplete (need authProvider.waitForAuthorizationCode + transport.finishAuth)."
+      );
+      return false;
+    }
+    this.log("info", "MCP server requires OAuth \u2014 complete login in the browser\u2026");
+    try {
+      const code = await waitForCode.call(provider);
+      this.log("info", "OAuth authorization code received \u2014 exchanging tokens\u2026");
+      await finishAuth.call(transport, code);
+      try {
+        await transport.close?.();
+      } catch {
+      }
+      const fresh = this.createTransport(this.config);
+      this.transport = fresh;
+      const prevOnClose = fresh.onclose;
+      fresh.onclose = () => {
+        this.isConnected = false;
+        this.log("debug", "Transport closed");
+        prevOnClose?.();
+      };
+      this.log("info", "Reconnecting MCP session with OAuth tokens\u2026");
+      await client.connect(fresh, { timeout: DEFAULT_CONNECT_TIMEOUT });
+      return true;
+    } catch (oauthErr) {
+      this.log(
+        "error",
+        `OAuth finish failed: ${oauthErr instanceof Error ? oauthErr.message : String(oauthErr)}`
+      );
+      throw this.wrapConnectError(oauthErr);
+    }
+  }
+  /** Turn raw SDK / network errors into a clearer MCPError for callers. */
+  wrapConnectError(err) {
+    if (err instanceof MCPError) return err;
+    const message = err instanceof Error ? err.message : String(err);
+    if (isAuthRequiredError(err)) {
+      return new MCPError(
+        `Authentication required for MCP server "${this.serverName}". Pass auth: "auto" (default) to run the OAuth browser flow, or set a Bearer token via headers. Original: ${message}`,
+        "CONNECTION_FAILED" /* CONNECTION_FAILED */,
+        err,
+        { serverName: this.serverName, cause: err instanceof Error ? err : void 0 }
+      );
+    }
+    return new MCPError(
+      `Failed to connect to MCP server "${this.serverName}": ${message}`,
+      "CONNECTION_FAILED" /* CONNECTION_FAILED */,
+      err,
+      { serverName: this.serverName, cause: err instanceof Error ? err : void 0 }
+    );
+  }
+  /**
+   * Build the SDK transport for the configured server.
+   *
+   *  - stdio: `StdioClientTransport` (inherits the parent env, merges config.env).
+   *  - http:  `StreamableHTTPClientTransport` (POST + server-push SSE channel,
+   *           reconnect + session-expiry handled by the SDK), unless the config
+   *           asks for the legacy `SSEClientTransport`.
+   */
+  createTransport(config) {
+    if ("command" in config) {
+      return new StdioClientTransport({
+        command: config.command,
+        args: config.args ?? [],
+        env: { ...sanitizeEnv(process.env), ...config.env ?? {} },
+        cwd: config.cwd,
+        stderr: "pipe"
+      });
+    }
+    if ("url" in config) {
+      const requestInit = config.headers ? { headers: config.headers } : void 0;
+      if (config.transport === "sse") {
+        return new SSEClientTransport(config.url, {
+          requestInit,
+          ...this.options.authProvider ? { authProvider: this.options.authProvider } : {}
+        });
+      }
+      return new StreamableHTTPClientTransport(config.url, {
+        requestInit,
+        ...this.options.authProvider ? { authProvider: this.options.authProvider } : {}
+      });
+    }
+    throw new MCPError(
+      "Server configuration must include either a command or a url",
+      "CONFIG_ERROR" /* CONFIG_ERROR */,
+      void 0,
+      { serverName: this.serverName }
+    );
+  }
+  /**
+   * Register handlers for server-initiated REQUESTS and NOTIFICATIONS.
+   *
+   * REQUESTS (have both `.method` AND `.id`) must be ANSWERED with a JSON-RPC
+   * RESPONSE carrying the matching id — the SDK does this automatically for the
+   * value a request handler returns (or rejects). The previous hand-rolled
+   * transport routed these into the notification path, so they were never
+   * answered (bug #13).
+   *
+   * Defaults:
+   *   - ping              → {}
+   *   - roots/list        → the configured roots
+   *   - elicitation/create→ decline ({action:"cancel"}) unless a host handler is set
+   *   - sampling          → reject "Method not found" unless a host handler is set
+   */
+  registerServerHandlers(client) {
+    client.setRequestHandler(PingRequestSchema, async () => ({}));
+    client.setRequestHandler(ListRootsRequestSchema, async () => ({
+      roots: this._roots.map((r) => ({ uri: r.uri, name: r.name }))
+    }));
+    client.setRequestHandler(ElicitRequestSchema, async (request) => {
+      if (!this.elicitationHandler) {
+        return { action: "cancel" };
+      }
+      const params = request.params;
+      const elicitRequest = {
+        message: params.message,
+        requestedSchema: params.requestedSchema ?? {}
+      };
+      const result = await this.elicitationHandler(elicitRequest);
+      return mapToSdkElicitResult(result);
+    });
+    client.setRequestHandler(CreateMessageRequestSchema, async (request) => {
+      if (!this.samplingHandler) {
+        throw new MCPError(
+          "Method not found: sampling/createMessage",
+          "SERVER_ERROR" /* SERVER_ERROR */,
+          { method: "sampling/createMessage" },
+          { serverName: this.serverName }
+        );
+      }
+      return await this.samplingHandler(request.params);
+    });
+    client.setNotificationHandler(ToolListChangedNotificationSchema, () => {
+      this.log("debug", "Tool list changed");
+      this.toolListChangedHandler?.();
+    });
+    client.setNotificationHandler(ResourceListChangedNotificationSchema, () => {
+      this.log("debug", "Resource list changed");
+      this.resourceListChangedHandler?.();
+    });
+    client.setNotificationHandler(ResourceUpdatedNotificationSchema, (n) => {
+      const uri = n.params?.uri;
+      this.log("debug", `Resource updated: ${uri}`);
+      if (uri) this.resourceUpdatedHandler?.({ uri });
+    });
+    client.setNotificationHandler(PromptListChangedNotificationSchema, () => {
+      this.log("debug", "Prompt list changed");
+      this.promptListChangedHandler?.();
+    });
+    client.setNotificationHandler(ProgressNotificationSchema, (n) => {
+      const params = n.params;
+      this.log("debug", `Progress: ${JSON.stringify(params)}`);
+      if (this.progressHandler && params) {
+        const notification = {
+          progressToken: params.progressToken,
+          progress: params.progress,
+          total: params.total,
+          message: params.message
+        };
+        this.progressHandler(notification);
+      }
+    });
+    client.setNotificationHandler(LoggingMessageNotificationSchema, (n) => {
+      if (this.enableServerLogs && n.params) {
+        const { level, ...rest } = n.params;
+        this.log(level || "info", "[SERVER]", rest);
+      }
+    });
+    client.setNotificationHandler(CancelledNotificationSchema, (n) => {
+      this.log("debug", `Request cancelled: ${JSON.stringify(n.params)}`);
+    });
+  }
+  /**
+   * Disconnect from the MCP server.
+   *
+   * The SDK's `client.close()` closes the transport and rejects any pending
+   * requests — a clean teardown for both stdio (graceful subprocess shutdown)
+   * and HTTP (close the push channel / end the session).
+   */
+  async disconnect() {
+    if (!this.client) {
+      this.log("debug", "Disconnect called but not connected");
+      this.isConnected = false;
+      return;
+    }
+    this.log("debug", "Disconnecting from MCP server");
+    try {
+      await this.client.close();
+    } catch (error) {
+      this.log("error", `Error during disconnect: ${error}`);
+    } finally {
+      this.client = void 0;
+      this.transport = void 0;
+      this.isConnected = false;
+      this.log("debug", "Successfully disconnected");
+    }
+  }
+  /**
+   * Whether the client is connected.
+   */
+  get connected() {
+    return this.isConnected;
+  }
+  // ========================================================================
+  // Tool Operations
+  // ========================================================================
+  /**
+   * List all tools available from the server.
+   */
+  async listTools() {
+    this.ensureConnected();
+    const result = await this.client.listTools(void 0, {
+      timeout: this.timeout
+    });
+    return result.tools;
+  }
+  /**
+   * Call a tool on the server.
+   */
+  async callTool(name, args) {
+    this.ensureConnected();
+    this.log("debug", `Calling tool: ${name}`);
+    try {
+      const result = await this.client.callTool(
+        { name, arguments: args },
+        void 0,
+        { timeout: this.timeout }
+      );
+      this.log("debug", `Tool ${name} executed successfully`);
+      return result;
+    } catch (error) {
+      this.log("error", `Tool ${name} failed: ${error}`);
+      throw this.wrapError(error);
+    }
+  }
+  // ========================================================================
+  // Resource Operations
+  // ========================================================================
+  /**
+   * List all resources available from the server.
+   */
+  async listResources() {
+    this.ensureConnected();
+    if (!this.serverCapabilities?.resources) {
+      return [];
+    }
+    const result = await this.client.listResources(void 0, {
+      timeout: this.timeout
+    });
+    return result.resources;
+  }
+  /**
+   * Read a resource from the server.
+   */
+  async readResource(uri) {
+    this.ensureConnected();
+    return await this.client.readResource({ uri }, { timeout: this.timeout });
+  }
+  /**
+   * Subscribe to resource updates.
+   */
+  async subscribeResource(uri) {
+    this.ensureConnected();
+    await this.client.subscribeResource({ uri }, { timeout: this.timeout });
+  }
+  /**
+   * Unsubscribe from resource updates.
+   */
+  async unsubscribeResource(uri) {
+    this.ensureConnected();
+    await this.client.unsubscribeResource({ uri }, { timeout: this.timeout });
+  }
+  // ========================================================================
+  // Prompt Operations
+  // ========================================================================
+  /**
+   * List all prompts available from the server.
+   */
+  async listPrompts() {
+    this.ensureConnected();
+    if (!this.serverCapabilities?.prompts) {
+      return [];
+    }
+    const result = await this.client.listPrompts(void 0, {
+      timeout: this.timeout
+    });
+    return result.prompts;
+  }
+  /**
+   * Get a prompt from the server.
+   */
+  async getPrompt(name, args) {
+    this.ensureConnected();
+    return await this.client.getPrompt(
+      { name, arguments: args },
+      { timeout: this.timeout }
+    );
+  }
+  // ========================================================================
+  // Roots Operations
+  // ========================================================================
+  /**
+   * Get the configured roots.
+   */
+  get roots() {
+    return [...this._roots];
+  }
+  /**
+   * Update the roots and notify the server.
+   */
+  async setRoots(roots) {
+    this.log("debug", `Updating roots to ${roots.length} entries`);
+    this._roots = [...roots];
+    if (this.isConnected && this.client) {
+      try {
+        await this.client.sendRootsListChanged();
+      } catch (error) {
+        this.log("debug", `Failed to send roots/list_changed: ${error}`);
+      }
+    }
+  }
+  // ========================================================================
+  // Handler Registration
+  //
+  // Setters STORE the host handler (and, for notifications, the SDK handler
+  // registered in `registerServerHandlers` delegates to the stored callback).
+  // This is the host-overridable layer at the core of bug #13.
+  // ========================================================================
+  /**
+   * Set a handler for resource updated notifications.
+   */
+  setResourceUpdatedHandler(handler) {
+    this.resourceUpdatedHandler = handler;
+    this.log("debug", "Resource updated handler registered");
+  }
+  /**
+   * Set a handler for resource list changed notifications.
+   */
+  setResourceListChangedHandler(handler) {
+    this.resourceListChangedHandler = handler;
+    this.log("debug", "Resource list changed handler registered");
+  }
+  /**
+   * Set a handler for tool list changed notifications.
+   */
+  setToolListChangedHandler(handler) {
+    this.toolListChangedHandler = handler;
+    this.log("debug", "Tool list changed handler registered");
+  }
+  /**
+   * Set a handler for prompt list changed notifications.
+   */
+  setPromptListChangedHandler(handler) {
+    this.promptListChangedHandler = handler;
+    this.log("debug", "Prompt list changed handler registered");
+  }
+  /**
+   * Set a handler for elicitation requests. When set, the server's
+   * `elicitation/create` REQUEST is answered with the host's decision; when
+   * unset the request is declined ({action:"cancel"}).
+   */
+  setElicitationHandler(handler) {
+    this.elicitationHandler = handler;
+    this.log("debug", "Elicitation handler registered");
+  }
+  /**
+   * Set a handler for sampling (`sampling/createMessage`) requests. When set,
+   * the server request is answered with the host's result; when unset the
+   * request is rejected with "Method not found".
+   */
+  setSamplingHandler(handler) {
+    this.samplingHandler = handler;
+    this.log("debug", "Sampling handler registered");
+  }
+  /**
+   * Set a handler for progress notifications.
+   */
+  setProgressHandler(handler) {
+    this.progressHandler = handler;
+    this.log("debug", "Progress handler registered");
+  }
+  // ========================================================================
+  // Private Methods
+  // ========================================================================
+  ensureConnected() {
+    if (!this.isConnected || !this.client) {
+      throw new MCPError(
+        "Not connected to MCP server",
+        "NOT_CONNECTED" /* NOT_CONNECTED */,
+        void 0,
+        { serverName: this.serverName }
+      );
+    }
+  }
+  /**
+   * Normalize an SDK/transport error into an MCPError. Session-expiry style
+   * failures (404 session / -32001) are surfaced as SESSION_ERROR so callers
+   * (the pool) can decide to reconnect; the SDK's StreamableHTTP transport
+   * already attempts a bounded reconnect re-using the session id before this.
+   */
+  wrapError(error) {
+    if (error instanceof MCPError) return error;
+    const message = error instanceof Error ? error.message : String(error);
+    const code = error.code;
+    if (code === -32001 || /\b404\b|session/i.test(message)) {
+      return new MCPError(message, "SESSION_ERROR" /* SESSION_ERROR */, { code }, {
+        serverName: this.serverName
+      });
+    }
+    return new MCPError(message, "SERVER_ERROR" /* SERVER_ERROR */, { code }, {
+      serverName: this.serverName
+    });
+  }
+  log(level, message, details) {
+    const msg = `[${this.serverName}] ${message}`;
+    if (this.logHandler) {
+      this.logHandler({
+        level,
+        message: msg,
+        timestamp: /* @__PURE__ */ new Date(),
+        serverName: this.serverName,
+        details
+      });
+    } else {
+      if (process.env.INDUSAGI_DEBUG || level === "error") {
+        const prefix = `[MCP:${level.toUpperCase()}]`;
+        if (details) {
+          if (level === "error") {
+            console.error(prefix, msg, details);
+          } else {
+            console.log(prefix, msg, details);
+          }
+        } else {
+          if (level === "error") {
+            console.error(prefix, msg);
+          } else {
+            console.log(prefix, msg);
+          }
+        }
+      }
+    }
+  }
+};
+function mapToSdkElicitResult(result) {
+  if (result.action === "accept") {
+    return {
+      action: "accept",
+      content: result.content ?? {}
+    };
+  }
+  return { action: result.action };
+}
+function isAuthRequiredError(err) {
+  if (err == null) return false;
+  if (err instanceof UnauthorizedError) return true;
+  if (typeof err === "object") {
+    const code = err.code;
+    if (code === 401 || code === "401") return true;
+  }
+  if (err instanceof Error) {
+    const msg = err.message;
+    if (/unauthorized/i.test(msg)) return true;
+    if (/authentication required/i.test(msg)) return true;
+    if (/auth required/i.test(msg)) return true;
+    if (err.name === "UnauthorizedError") return true;
+  }
+  return false;
+}
+function sanitizeEnv(env) {
+  const out = {};
+  for (const [k, v] of Object.entries(env)) {
+    if (typeof v === "string") out[k] = v;
+  }
+  return out;
+}
+
+// src/facade/mcp-core/oauth/flow.ts
+import { createServer } from "node:http";
+var CALLBACK_TIMEOUT_MS = 5 * 60 * 1e3;
+var SUCCESS_HTML = '<!doctype html><html><body style="font-family:system-ui;padding:2rem"><h1>Authorization complete</h1><p>You can close this tab and return to your terminal.</p></body></html>';
+var ERROR_HTML = (msg) => `<!doctype html><html><body style="font-family:system-ui;padding:2rem"><h1>Authorization failed</h1><pre>${escapeHtml(msg)}</pre></body></html>`;
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+async function startOAuthCallbackServer(options) {
+  const timeoutMs = options?.timeoutMs ?? CALLBACK_TIMEOUT_MS;
+  const logger = options?.logger;
+  let settled = false;
+  let timer;
+  let resolveCode;
+  let rejectCode;
+  const codePromise = new Promise((res, rej) => {
+    resolveCode = res;
+    rejectCode = rej;
+  });
+  codePromise.catch(() => {
+  });
+  let expectedState;
+  const clearTimer = () => {
+    if (timer !== void 0) {
+      clearTimeout(timer);
+      timer = void 0;
+    }
+  };
+  const settleReject = (err) => {
+    if (settled) return;
+    settled = true;
+    clearTimer();
+    try {
+      server.close();
+    } catch {
+    }
+    rejectCode(err);
+  };
+  const settleResolve = (code) => {
+    if (settled) return;
+    settled = true;
+    clearTimer();
+    resolveCode(code);
+    setTimeout(() => {
+      try {
+        server.close();
+      } catch {
+      }
+    }, 50);
+  };
+  const server = createServer((req, res) => {
+    if (settled) {
+      res.statusCode = 410;
+      res.end("already used");
+      return;
+    }
+    handleRequest(
+      req,
+      res,
+      expectedState,
+      (code) => settleResolve(code),
+      (err) => settleReject(err),
+      logger
+    );
+  });
+  await new Promise((resolveListen, rejectListen) => {
+    server.once("error", rejectListen);
+    server.listen(0, "127.0.0.1", () => resolveListen());
+  });
+  const address = server.address();
+  if (!address) {
+    server.close();
+    throw new Error("oauth-callback: server bound to no address");
+  }
+  const port = address.port;
+  const redirectUri = `http://127.0.0.1:${port}/callback`;
+  const close = () => {
+    if (!settled) {
+      settleReject(new Error("oauth-callback: closed before browser login completed"));
+    } else {
+      clearTimer();
+      try {
+        server.close();
+      } catch {
+      }
+    }
+  };
+  return {
+    redirectUri,
+    port,
+    waitForCode(state) {
+      expectedState = state;
+      logger?.debug(`oauth-callback: waiting for browser at ${redirectUri}`);
+      if (!settled && timer === void 0) {
+        timer = setTimeout(() => {
+          settleReject(
+            new Error(
+              `oauth-callback: timed out after ${timeoutMs}ms waiting for browser login at ${redirectUri}`
+            )
+          );
+        }, timeoutMs);
+        timer.unref();
+      }
+      return codePromise;
+    },
+    close
+  };
+}
+function handleRequest(req, res, expectedState, onCode, onError, logger) {
+  const url = new URL(req.url ?? "/", "http://127.0.0.1");
+  if (url.pathname !== "/callback") {
+    if (url.pathname === "/favicon.ico") {
+      res.statusCode = 404;
+      res.end();
+      return;
+    }
+    res.statusCode = 404;
+    res.end("not found");
+    return;
+  }
+  const errorParam = url.searchParams.get("error");
+  if (errorParam) {
+    const desc = url.searchParams.get("error_description") ?? "";
+    logger?.warn(`oauth-callback: server returned error ${errorParam} ${desc}`);
+    res.statusCode = 400;
+    res.setHeader("content-type", "text/html; charset=utf-8");
+    res.end(ERROR_HTML(`${errorParam}${desc ? ": " + desc : ""}`));
+    onError(new Error(`OAuth provider returned error: ${errorParam}${desc ? " \u2014 " + desc : ""}`));
+    return;
+  }
+  const code = url.searchParams.get("code");
+  const state = url.searchParams.get("state");
+  if (!code) {
+    res.statusCode = 400;
+    res.setHeader("content-type", "text/html; charset=utf-8");
+    res.end(ERROR_HTML("missing code"));
+    return;
+  }
+  if (expectedState && state && state !== expectedState) {
+    res.statusCode = 400;
+    res.setHeader("content-type", "text/html; charset=utf-8");
+    res.end(ERROR_HTML("state mismatch \u2014 possible CSRF"));
+    onError(new Error("OAuth callback state did not match \u2014 refusing to exchange code"));
+    return;
+  }
+  res.statusCode = 200;
+  res.setHeader("content-type", "text/html; charset=utf-8");
+  res.end(SUCCESS_HTML);
+  logger?.debug(`oauth-callback: received authorization code (${code.length} chars)`);
+  onCode(code);
+}
+async function openBrowser(url) {
+  try {
+    const mod = await import("node:child_process").catch(() => null);
+    if (!mod) return false;
+    const cmd = platformOpenCommand(url);
+    if (!cmd) return false;
+    const child = mod.spawn(cmd.cmd, cmd.args, { detached: true, stdio: "ignore" });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+function platformOpenCommand(url) {
+  switch (process.platform) {
+    case "darwin":
+      return { cmd: "open", args: [url] };
+    case "win32":
+      return { cmd: "rundll32", args: ["url.dll,FileProtocolHandler", url] };
+    default:
+      return { cmd: "xdg-open", args: [url] };
+  }
+}
+
+// src/facade/mcp-core/oauth/token-store.ts
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+function defaultCredentialsDir() {
+  const xdg = process.env.XDG_CONFIG_HOME;
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
+  if (xdg && xdg.length > 0) return join(xdg, "indusagi", "credentials", "mcp");
+  if (home.length > 0) return join(home, ".config", "indusagi", "credentials", "mcp");
+  return join(process.cwd(), ".indusagi", "credentials", "mcp");
+}
+function resolveCredentialsDir(override) {
+  return override && override.length > 0 ? override : defaultCredentialsDir();
+}
+function credentialsPath(credentialsDir, id) {
+  const safe = id.replace(/[^a-zA-Z0-9._-]/g, "-");
+  return join(credentialsDir, `${safe}.json`);
+}
+function readMcpOAuthState(credentialsDir, id) {
+  const path = credentialsPath(credentialsDir, id);
+  if (!existsSync(path)) return void 0;
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (e) {
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    return void 0;
+  }
+  if (typeof parsed !== "object" || parsed === null) return void 0;
+  return { id, updatedAt: Date.now(), ...parsed };
+}
+function writeMcpOAuthState(credentialsDir, state) {
+  const path = credentialsPath(credentialsDir, state.id);
+  mkdirSync(dirname(path), { recursive: true });
+  const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
+  const json = JSON.stringify({ ...state, updatedAt: Date.now() }, null, 2);
+  writeFileSync(tmp, json, { mode: 384 });
+  renameSync(tmp, path);
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+}
+function clearMcpOAuthState(credentialsDir, id) {
+  const path = credentialsPath(credentialsDir, id);
+  try {
+    const fs = __require("node:fs");
+    fs.rmSync(path, { force: true });
+  } catch {
+  }
+}
+
+// src/facade/mcp-core/oauth/provider.ts
+function randomState() {
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function toSdkTokens(t) {
+  return {
+    access_token: t.access_token,
+    refresh_token: t.refresh_token,
+    scope: t.scope,
+    token_type: t.token_type ?? "Bearer",
+    expires_in: t.expires_at !== void 0 ? Math.max(0, Math.floor((t.expires_at - Date.now()) / 1e3)) : void 0
+  };
+}
+function toSdkClientInfo(c) {
+  return {
+    client_id: c.client_id,
+    client_secret: c.client_secret,
+    client_id_issued_at: c.client_id_issued_at,
+    client_secret_expires_at: c.client_secret_expires_at
+  };
+}
+async function createMcpOAuthProvider(config) {
+  const credentialsDir = resolveCredentialsDir(config.credentialsDir);
+  const openBrowserEnabled = config.openBrowser ?? Boolean(process.env.CI !== "true" && process.stdout.isTTY);
+  let callback;
+  let redirectUrl;
+  if (config.redirectUrl) {
+    redirectUrl = config.redirectUrl;
+  } else {
+    callback = await startOAuthCallbackServer({
+      logger: config.logger ? { debug: config.logger.debug, warn: config.logger.warn } : void 0
+    });
+    redirectUrl = callback.redirectUri;
+  }
+  const clientMetadata = {
+    client_name: config.clientMetadata?.client_name ?? "indusagi-mcp-client",
+    client_uri: config.clientMetadata?.client_uri,
+    logo_uri: config.clientMetadata?.logo_uri,
+    contacts: config.clientMetadata?.contacts ? [...config.clientMetadata.contacts] : void 0,
+    tos_uri: config.clientMetadata?.tos_uri,
+    policy_uri: config.clientMetadata?.policy_uri,
+    redirect_uris: config.clientMetadata?.redirect_uris ? [...config.clientMetadata.redirect_uris] : [redirectUrl],
+    token_endpoint_auth_method: config.clientMetadata?.token_endpoint_auth_method ?? "none",
+    grant_types: config.clientMetadata?.grant_types ? [...config.clientMetadata.grant_types] : ["authorization_code", "refresh_token"],
+    response_types: config.clientMetadata?.response_types ? [...config.clientMetadata.response_types] : ["code"],
+    scope: config.clientMetadata?.scope
+  };
+  let lastAuthUrl;
+  let lastState;
+  let pendingCode;
+  const provider = {
+    id: config.id,
+    credentialsDir,
+    redirectUrl,
+    get clientMetadata() {
+      return clientMetadata;
+    },
+    state() {
+      const s = randomState();
+      lastState = s;
+      return s;
+    },
+    clientInformation() {
+      const state = readMcpOAuthState(credentialsDir, config.id);
+      return state?.client ? toSdkClientInfo(state.client) : void 0;
+    },
+    saveClientInformation(client) {
+      const state = readMcpOAuthState(credentialsDir, config.id) ?? {
+        id: config.id,
+        updatedAt: Date.now()
+      };
+      writeMcpOAuthState(credentialsDir, {
+        ...state,
+        client: {
+          client_id: client.client_id,
+          client_secret: client.client_secret,
+          client_id_issued_at: client.client_id_issued_at,
+          client_secret_expires_at: client.client_secret_expires_at
+        }
+      });
+    },
+    tokens() {
+      const state = readMcpOAuthState(credentialsDir, config.id);
+      return state?.tokens ? toSdkTokens(state.tokens) : void 0;
+    },
+    saveTokens(tokens) {
+      const state = readMcpOAuthState(credentialsDir, config.id) ?? {
+        id: config.id,
+        updatedAt: Date.now()
+      };
+      writeMcpOAuthState(credentialsDir, {
+        ...state,
+        tokens: {
+          access_token: tokens.access_token,
+          refresh_token: tokens.refresh_token,
+          scope: tokens.scope,
+          token_type: tokens.token_type,
+          expires_at: tokens.expires_in !== void 0 ? Date.now() + Math.trunc(tokens.expires_in) * 1e3 : void 0
+        }
+      });
+    },
+    async redirectToAuthorization(authorizationUrl) {
+      const url = authorizationUrl.toString();
+      lastAuthUrl = url;
+      try {
+        lastState = new URL(url).searchParams.get("state") ?? lastState;
+      } catch {
+      }
+      const prompt = `oauth: open this URL in your browser to authorize Zoho MCP:
+  ${url}`;
+      config.logger?.info?.(prompt);
+      config.logger?.debug?.(prompt);
+      console.error(`
+[zoho oauth] Authorize in browser:
+  ${url}
+`);
+      let opened = false;
+      if (openBrowserEnabled) opened = await openBrowser(url);
+      if (!opened) {
+        const tip = "oauth: could not auto-open browser. Visit the URL above manually.";
+        config.logger?.info?.(tip);
+        config.logger?.debug?.(tip);
+        console.error(`[zoho oauth] ${tip}`);
+      } else {
+        config.logger?.debug?.("oauth: browser open launched");
+      }
+    },
+    saveCodeVerifier(verifier) {
+      const state = readMcpOAuthState(credentialsDir, config.id) ?? {
+        id: config.id,
+        updatedAt: Date.now()
+      };
+      writeMcpOAuthState(credentialsDir, { ...state, codeVerifier: verifier });
+    },
+    codeVerifier() {
+      const state = readMcpOAuthState(credentialsDir, config.id);
+      const verifier = state?.codeVerifier;
+      if (!verifier) throw new Error("No PKCE code verifier saved");
+      return verifier;
+    },
+    invalidateCredentials(scope) {
+      if (scope === "all") {
+        clearMcpOAuthState(credentialsDir, config.id);
+        return;
+      }
+      const state = readMcpOAuthState(credentialsDir, config.id);
+      if (!state) return;
+      const next = { ...state };
+      if (scope === "tokens" || scope === "verifier") next.tokens = void 0;
+      if (scope === "verifier") next.codeVerifier = void 0;
+      if (scope === "discovery") {
+        next.resourceMetadata = void 0;
+        next.authServerMetadata = void 0;
+      }
+      writeMcpOAuthState(credentialsDir, next);
+    },
+    async waitForAuthorizationCode() {
+      if (pendingCode) return pendingCode;
+      if (!callback) {
+        throw new Error(
+          "oauth: no local callback server (custom redirectUrl set). Pass the authorization code via finishAuth yourself."
+        );
+      }
+      config.logger?.info("oauth: waiting for browser authorization\u2026");
+      console.error("[zoho oauth] Waiting for browser authorization\u2026");
+      const code = await callback.waitForCode(lastState);
+      pendingCode = code;
+      return code;
+    },
+    dispose() {
+      callback?.close();
+      callback = void 0;
+    },
+    lastAuthorizationUrl() {
+      return lastAuthUrl;
+    }
+  };
+  return provider;
+}
+
+// src/facade/mcp-core/oauth/index.ts
+import {
+  auth,
+  discoverOAuthServerInfo,
+  startAuthorization,
+  exchangeAuthorization,
+  refreshAuthorization,
+  registerClient,
+  extractWWWAuthenticateParams
+} from "@modelcontextprotocol/sdk/client/auth.js";
+
+// src/capabilities/kernel/spec.ts
+function coerceInput(raw) {
+  if (typeof raw === "string") {
+    const trimmed = raw.trim();
+    if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+      try {
+        return JSON.parse(trimmed);
+      } catch {
+      }
+    }
+    return raw;
+  }
+  if (raw === null || raw === void 0) {
+    return {};
+  }
+  return raw;
+}
+function describeThrow(err) {
+  if (err instanceof Error) return err.message;
+  if (typeof err === "string") return err;
+  try {
+    return JSON.stringify(err);
+  } catch {
+    return String(err);
+  }
+}
+function projectOutcome(id, result) {
+  const blocks = result.content;
+  let output;
+  if (blocks.length === 1) {
+    const only = blocks[0];
+    output = only.kind === "text" ? only.text : only.value;
+  } else {
+    output = blocks;
+  }
+  return { id, output, isError: result.isError === true };
+}
+function defineTool(spec) {
+  return {
+    name: spec.name,
+    // Facade `AgentTool` surface: top-level schema fields + an `execute` adapter
+    // so the tool is usable by the high-level `Agent` as well as the kernel.
+    label: spec.name,
+    description: spec.description,
+    parameters: spec.parameters,
+    async execute(_toolCallId, params, signal) {
+      const ctx = {
+        cwd: process.cwd(),
+        signal: signal ?? new AbortController().signal
+      };
+      try {
+        const result = await spec.run(coerceInput(params), ctx);
+        return {
+          content: result.content.map(
+            (block) => block.kind === "text" ? { type: "text", text: block.text } : { type: "text", text: JSON.stringify(block.value) }
+          ),
+          details: {},
+          isError: result.isError ?? false
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: `${spec.name} did not finish: ${describeThrow(err)}` }],
+          details: {},
+          isError: true
+        };
+      }
+    },
+    descriptor() {
+      return {
+        name: spec.name,
+        description: spec.description,
+        parameters: spec.parameters
+      };
+    },
+    async invoke(call, ctx) {
+      if (ctx.signal.aborted) {
+        return {
+          id: call.id,
+          output: `Cancelled before ${spec.name} could begin.`,
+          isError: true
+        };
+      }
+      try {
+        const input = coerceInput(call.input);
+        const result = await spec.run(input, ctx);
+        return projectOutcome(call.id, result);
+      } catch (err) {
+        return {
+          id: call.id,
+          output: `${spec.name} did not finish: ${describeThrow(err)}`,
+          isError: true
+        };
+      }
+    }
+  };
+}
+
+// src/facade/mcp-core/toolbox-bridge.ts
+var NOOP_FS_NOT_SUPPORTED = "not supported in MCP-wrapped tools";
+var noopFs = {
+  readFile: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  },
+  writeFile: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  },
+  stat: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  },
+  readdir: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  },
+  mkdir: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  },
+  rm: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  },
+  exists: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  }
+};
+var noopShell = {
+  exec: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  },
+  spawn: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  }
+};
+function makeToolContext(signal) {
+  return {
+    cwd: process.cwd(),
+    fs: noopFs,
+    shell: noopShell,
+    signal,
+    budget: { kind: "tail", maxBytes: 5e4 }
+  };
+}
+function describeThrow2(err) {
+  if (err instanceof Error) return err.message;
+  if (typeof err === "string") return err;
+  try {
+    return JSON.stringify(err);
+  } catch {
+    return String(err);
+  }
+}
+function projectMcpResult(result, logger) {
+  const blocks = [];
+  if (result.content && result.content.length > 0) {
+    for (const block of result.content) {
+      if (block.type === "text") {
+        blocks.push({ kind: "text", text: block.text });
+      } else if (block.type === "image") {
+        const len = typeof block.data === "string" ? block.data.length : 0;
+        blocks.push({ kind: "text", text: `[image ${block.mimeType}, ${len} chars base64]` });
+        logger?.debug(`mcp bridge: image block collapsed to text mention (${block.mimeType})`);
+      } else if (block.type === "resource") {
+        blocks.push({ kind: "text", text: `[resource ${block.resource.uri}]` });
+      } else {
+        blocks.push({ kind: "text", text: "[unknown content block]" });
+      }
+    }
+  }
+  if (result.structuredContent !== void 0) {
+    blocks.push({ kind: "json", value: result.structuredContent });
+  }
+  const content = blocks.length > 0 ? blocks : [{ kind: "text", text: "(no content)" }];
+  return {
+    content,
+    ...result.isError === true ? { isError: true } : {}
+  };
+}
+function makeRunner(client, remoteName, logger) {
+  return async (input, ctx) => {
+    if (ctx.signal.aborted) {
+      return {
+        content: [{ kind: "text", text: "Cancelled before tool could start." }],
+        isError: true
+      };
+    }
+    try {
+      const args = input ?? {};
+      const result = await client.callTool(remoteName, args);
+      return projectMcpResult(result, logger);
+    } catch (err) {
+      const wrapped = err instanceof MCPError ? err : createServerError(describeThrow2(err), client.serverName);
+      logger?.error(`mcp bridge: tool "${remoteName}" failed: ${wrapped.message}`, wrapped);
+      return {
+        content: [{ kind: "text", text: `MCP tool failed: ${wrapped.message}` }],
+        isError: true
+      };
+    }
+  };
+}
+async function mcpClientToToolBox(client, options = {}) {
+  const prefix = options.namePrefix ?? "mcp";
+  const logger = options.logger;
+  const tools = await client.listTools();
+  const filtered = typeof options.filter === "function" ? tools.filter((t) => options.filter(t)) : tools;
+  const byName = /* @__PURE__ */ new Map();
+  for (const tool of filtered) {
+    const remoteName = tool.name;
+    const prefixed = `${prefix}__${remoteName}`;
+    const description = tool.description && tool.description.length > 0 ? tool.description : `<tool "${remoteName}" from MCP server "${client.serverName}">`;
+    const parameters = tool.inputSchema;
+    const def = defineTool({
+      name: prefixed,
+      description,
+      parameters,
+      run: makeRunner(client, remoteName, logger)
+    });
+    byName.set(prefixed, def);
+  }
+  const runner = {
+    async run(call, signal) {
+      const def = byName.get(call.name);
+      if (!def) {
+        return {
+          id: call.id,
+          output: `No tool "${call.name}" on MCP server "${client.serverName}".`,
+          isError: true
+        };
+      }
+      return def.invoke(call, makeToolContext(signal));
+    }
+  };
+  return {
+    descriptors() {
+      return Array.from(byName.values()).map((d) => d.descriptor());
+    },
+    runner
+  };
+}
+
+// src/connectors-zoho/connect.ts
+async function connectZohoMcp(options) {
+  const id = options.id ?? "zoho";
+  const authMode = options.auth ?? "auto";
+  let parsedUrl;
+  try {
+    parsedUrl = new URL(options.url);
+  } catch {
+    throw new Error(`connectZohoMcp: invalid url "${options.url}"`);
+  }
+  if (parsedUrl.protocol !== "https:" && parsedUrl.protocol !== "http:") {
+    throw new Error(`connectZohoMcp: url must be http(s), got "${parsedUrl.protocol}"`);
+  }
+  let oauthProvider;
+  if (authMode === "auto" || authMode === "oauth") {
+    oauthProvider = await createMcpOAuthProvider({
+      id,
+      credentialsDir: options.tokenStorePath,
+      redirectUrl: options.redirectUrl,
+      // Default true outside CI so TUI sessions always get a browser redirect.
+      openBrowser: options.openBrowser ?? (process.env.CI !== "true" && process.env.ZOHO_OPEN_BROWSER !== "0"),
+      clientMetadata: {
+        client_name: "indusagi-zoho-agent",
+        scope: options.scopes?.join(" ")
+      },
+      logger: options.logger ? {
+        debug: options.logger.debug,
+        info: (msg) => {
+          options.logger?.debug(msg);
+          console.error(`[zoho] ${msg}`);
+        },
+        warn: (msg) => options.logger?.debug(msg),
+        error: options.logger.error
+      } : {
+        debug: (msg) => {
+          if (process.env.INDUSAGI_DEBUG) console.error(`[zoho debug] ${msg}`);
+        },
+        info: (msg) => console.error(`[zoho] ${msg}`),
+        warn: (msg) => console.error(`[zoho] ${msg}`),
+        error: (msg) => console.error(`[zoho error] ${msg}`)
+      }
+    });
+  }
+  const client = new MCPClient({
+    name: id,
+    config: {
+      url: parsedUrl,
+      headers: options.headers ? { ...options.headers } : void 0,
+      ...options.useSse ? { transport: "sse" } : {}
+    },
+    timeout: options.timeoutMs ?? 3e4,
+    ...oauthProvider ? {
+      authProvider: oauthProvider
+    } : {}
+  });
+  try {
+    await client.connect();
+  } catch (e) {
+    oauthProvider?.dispose();
+    const msg = e instanceof Error ? e.message : String(e);
+    if (/authentication required|unauthorized|401/i.test(msg)) {
+      throw new Error(
+        `Zoho MCP authentication failed for "${id}".
+  \u2022 Ensure ZOHO_MCP_URL is the full Connect URL from https://mcp.zoho.com
+  \u2022 Complete the browser OAuth login when prompted
+  \u2022 Or set auth: "none" and pass Authorization headers if you use a pre-authorized URL
+  Original: ${msg}`,
+        { cause: e instanceof Error ? e : void 0 }
+      );
+    }
+    throw e;
+  }
+  try {
+    const toolBox = await mcpClientToToolBox(client, {
+      namePrefix: id,
+      logger: options.logger
+    });
+    const tools = await client.listTools();
+    const prefixed = tools.map((t) => `${id}__${t.name}`);
+    try {
+      oauthProvider?.dispose();
+    } catch {
+    }
+    let closed = false;
+    return {
+      id,
+      toolBox,
+      toolNames: prefixed,
+      client,
+      async close() {
+        if (closed) return;
+        closed = true;
+        try {
+          await client.disconnect();
+        } catch (err) {
+          options.logger?.error(`zoho close failed: ${err.message}`, err);
+        } finally {
+          try {
+            oauthProvider?.dispose();
+          } catch {
+          }
+        }
+      }
+    };
+  } catch (e) {
+    oauthProvider?.dispose();
+    try {
+      await client.disconnect();
+    } catch {
+    }
+    throw e;
+  }
+}
+
+// src/connectors-zoho/toolbox.ts
+async function zohoToolBoxFromClient(client, options) {
+  return mcpClientToToolBox(client, {
+    ...options,
+    namePrefix: options?.id ?? "zoho"
+  });
+}
+export {
+  connectZohoMcp,
+  zohoToolBoxFromClient
+};