indusagi 0.13.6 → 0.13.8

package/dist/index.js

@@ -1,4 +1,10 @@
 var __defProp = Object.defineProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -261,6 +267,85 @@ var MODEL_CARDS = [
       cacheReadPerMTok: 0.15
     }
   },
+  // ── MiniMax (Anthropic-compatible Messages API) ─────────────────────────
+  // Wire: same dialect as Claude (`anthropic-messages`) at api.minimax.io.
+  // Auth: MINIMAX_API_KEY. Ids match facade/models.generated.ts.
+  {
+    id: "MiniMax-M2",
+    provider: "minimax",
+    api: "anthropic-messages",
+    displayName: "MiniMax M2",
+    baseUrl: "https://api.minimax.io/anthropic",
+    contextWindow: 204800,
+    maxOutputTokens: 131072,
+    modalities: ["text"],
+    reasoning: true,
+    cost: {
+      inputPerMTok: 0.3,
+      outputPerMTok: 1.2
+    }
+  },
+  {
+    id: "MiniMax-M2.1",
+    provider: "minimax",
+    api: "anthropic-messages",
+    displayName: "MiniMax M2.1",
+    baseUrl: "https://api.minimax.io/anthropic",
+    contextWindow: 204800,
+    maxOutputTokens: 131072,
+    modalities: ["text"],
+    reasoning: true,
+    cost: {
+      inputPerMTok: 0.3,
+      outputPerMTok: 1.2
+    }
+  },
+  {
+    id: "MiniMax-M2.5",
+    provider: "minimax",
+    api: "anthropic-messages",
+    displayName: "MiniMax M2.5",
+    baseUrl: "https://api.minimax.io/anthropic",
+    contextWindow: 204800,
+    maxOutputTokens: 131072,
+    modalities: ["text"],
+    reasoning: true,
+    cost: {
+      inputPerMTok: 0.3,
+      outputPerMTok: 1.2
+    }
+  },
+  {
+    id: "MiniMax-M2.7",
+    provider: "minimax",
+    api: "anthropic-messages",
+    displayName: "MiniMax M2.7",
+    baseUrl: "https://api.minimax.io/anthropic",
+    contextWindow: 204800,
+    maxOutputTokens: 131072,
+    modalities: ["text"],
+    reasoning: true,
+    cost: {
+      inputPerMTok: 0.3,
+      outputPerMTok: 1.2
+    }
+  },
+  {
+    id: "MiniMax-M3",
+    provider: "minimax",
+    api: "anthropic-messages",
+    displayName: "MiniMax M3",
+    baseUrl: "https://api.minimax.io/anthropic",
+    contextWindow: 1048576,
+    maxOutputTokens: 512e3,
+    modalities: ["text", "image"],
+    reasoning: true,
+    cost: {
+      inputPerMTok: 0.6,
+      outputPerMTok: 2.4,
+      cacheReadPerMTok: 0.12
+    }
+  },
   // ── Ollama (local; pricing is zero — your own hardware) ─────────────────
   {
     id: "llama3.1:8b",
@@ -423,6 +508,19 @@ var SECRET_TABLE = {
     envVars: ["MOONSHOT_API_KEY", "KIMI_API_KEY"],
     hint: "Moonshot AI (Kimi) API key."
   },
+  minimax: {
+    provider: "minimax",
+    scheme: "api-key",
+    envVars: ["MINIMAX_API_KEY"],
+    hint: "MiniMax global API key (api.minimax.io Anthropic-compatible)."
+  },
+  "minimax-cn": {
+    provider: "minimax-cn",
+    scheme: "api-key",
+    // Same key often works for both; CN-specific override first when set.
+    envVars: ["MINIMAX_CN_API_KEY", "MINIMAX_API_KEY"],
+    hint: "MiniMax China API key (api.minimaxi.com Anthropic-compatible)."
+  },
   ollama: {
     provider: "ollama",
     scheme: "none",
@@ -1263,7 +1361,7 @@ function endpointFor(model) {
   const base = (model.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
   return `${base}/v1/messages`;
 }
-async function postMessages(url, apiKey, body, signal) {
+async function postMessages(url, apiKey, body, signal, provider = "anthropic") {
   let response;
   try {
     response = await fetch(url, {
@@ -1278,24 +1376,24 @@ async function postMessages(url, apiKey, body, signal) {
     });
   } catch (cause) {
     if (signal?.aborted) {
-      throw gatewayError("aborted", "request canceled before Anthropic responded", {
-        provider: "anthropic",
+      throw gatewayError("aborted", `request canceled before ${provider} responded`, {
+        provider,
         cause
       });
     }
-    throw gatewayError("transport", "network call to Anthropic failed", { provider: "anthropic", cause });
+    throw gatewayError("transport", `network call to ${provider} failed`, { provider, cause });
   }
   if (!response.ok) {
     const detail = await readErrorBody(response);
     const kind = response.status === 401 || response.status === 403 ? "auth" : response.status === 429 ? "rate_limit" : "http";
-    throw gatewayError(kind, `Anthropic returned HTTP ${response.status}${detail}`, {
-      provider: "anthropic",
+    throw gatewayError(kind, `${provider} returned HTTP ${response.status}${detail}`, {
+      provider,
       status: response.status
     });
   }
   if (response.body === null) {
-    throw gatewayError("transport", "Anthropic response arrived with no body", {
-      provider: "anthropic",
+    throw gatewayError("transport", `${provider} response arrived with no body`, {
+      provider,
       status: response.status
     });
   }
@@ -1317,11 +1415,13 @@ function asGatewayError(cause) {
 }
 function createanthropicConnector(deps2) {
   const api = "anthropic-messages";
-  async function requireKey(options) {
-    const key = await deps2.resolveSecret("anthropic", options.apiKey);
+  async function requireKey(model, options) {
+    const provider = model.provider;
+    const key = await deps2.resolveSecret(provider, options.apiKey);
     if (key === void 0 || key === "") {
-      throw gatewayError("auth", "no Anthropic API key found (set ANTHROPIC_API_KEY or pass options.apiKey)", {
-        provider: "anthropic"
+      const hint = provider === "minimax" || provider === "minimax-cn" ? "set MINIMAX_API_KEY (or MINIMAX_CN_API_KEY for CN) or pass options.apiKey" : "set ANTHROPIC_API_KEY or pass options.apiKey";
+      throw gatewayError("auth", `no API key found for provider "${provider}" (${hint})`, {
+        provider
       });
     }
     return key;
@@ -1330,10 +1430,16 @@ function createanthropicConnector(deps2) {
     return channelOf(async function* run2() {
       const collected = [];
       try {
-        const apiKey = await requireKey(options);
+        const apiKey = await requireKey(model, options);
         const body = toAnthropicRequest(conversation, model, options);
         body.stream = true;
-        const response = await postMessages(endpointFor(model), apiKey, body, options.signal);
+        const response = await postMessages(
+          endpointFor(model),
+          apiKey,
+          body,
+          options.signal,
+          model.provider
+        );
         const wire = response.body;
         const state = { toolIds: /* @__PURE__ */ new Map(), usage: { inputTokens: 0, outputTokens: 0 } };
         for await (const event of sseEvents(wire, options.signal)) {
@@ -8595,6 +8701,1426 @@ function createComposioGateway(opts) {
   return createSaasGateway(createComposioBackend({ apiKey: opts.apiKey }));
 }
 
+// src/connectors-zoho/index.ts
+var connectors_zoho_exports = {};
+__export(connectors_zoho_exports, {
+  connectZohoMcp: () => connectZohoMcp,
+  zohoToolBoxFromClient: () => zohoToolBoxFromClient
+});
+
+// src/facade/mcp-core/client.ts
+import { Client as Client2 } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport as StdioClientTransport2 } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { SSEClientTransport as SSEClientTransport2 } from "@modelcontextprotocol/sdk/client/sse.js";
+import {
+  UnauthorizedError
+} from "@modelcontextprotocol/sdk/client/auth.js";
+import {
+  ListRootsRequestSchema,
+  ElicitRequestSchema,
+  CreateMessageRequestSchema,
+  PingRequestSchema,
+  ToolListChangedNotificationSchema,
+  ResourceListChangedNotificationSchema,
+  ResourceUpdatedNotificationSchema,
+  PromptListChangedNotificationSchema,
+  ProgressNotificationSchema,
+  LoggingMessageNotificationSchema,
+  CancelledNotificationSchema
+} from "@modelcontextprotocol/sdk/types.js";
+
+// src/facade/mcp-core/errors.ts
+var MCPError = class extends Error {
+  /** Error code */
+  code;
+  /** Additional error details */
+  details;
+  /** Server name where error occurred */
+  serverName;
+  /** Tool name if error occurred during tool execution */
+  toolName;
+  constructor(message, code, details, options) {
+    super(message, options?.cause ? { cause: options.cause } : void 0);
+    this.name = "MCPError";
+    this.code = code;
+    this.details = details;
+    this.serverName = options?.serverName;
+    this.toolName = options?.toolName;
+  }
+  /**
+   * Convert error to JSON for logging/serialization.
+   */
+  toJSON() {
+    return {
+      name: this.name,
+      message: this.message,
+      code: this.code,
+      details: this.details,
+      serverName: this.serverName,
+      toolName: this.toolName
+    };
+  }
+  /**
+   * Create a string representation of the error.
+   */
+  toString() {
+    let str2 = `${this.name} [${this.code}]: ${this.message}`;
+    if (this.serverName) str2 += ` (server: ${this.serverName})`;
+    if (this.toolName) str2 += ` (tool: ${this.toolName})`;
+    return str2;
+  }
+};
+function createServerError(message, serverName, details) {
+  return new MCPError(message, "SERVER_ERROR" /* SERVER_ERROR */, details, { serverName });
+}
+
+// src/facade/mcp-core/client.ts
+var DEFAULT_REQUEST_TIMEOUT = 6e4;
+var DEFAULT_CONNECT_TIMEOUT = 3e4;
+var MCPClient = class {
+  constructor(options) {
+    this.options = options;
+    this.serverName = options.name;
+    this.config = options.config;
+    this.timeout = options.timeout ?? DEFAULT_REQUEST_TIMEOUT;
+    this.logHandler = options.logger;
+    this.enableServerLogs = options.enableServerLogs ?? true;
+    this.enableProgressTracking = options.enableProgressTracking ?? false;
+    this._roots = options.roots ?? [];
+  }
+  options;
+  client;
+  transport;
+  isConnected = false;
+  connectionPromise = null;
+  serverCapabilities;
+  logHandler;
+  enableServerLogs;
+  enableProgressTracking;
+  _roots;
+  // --- Host-overridable handlers (Core of #13) --------------------------------
+  // Server-initiated REQUESTS are answered by request handlers registered on the
+  // SDK client; the handlers delegate to these host-supplied callbacks when set,
+  // and fall back to sensible defaults otherwise.
+  elicitationHandler;
+  samplingHandler;
+  // Server-initiated NOTIFICATIONS are dispatched to these (so the host can, for
+  // example, re-list tools when a `tools/list_changed` arrives).
+  resourceUpdatedHandler;
+  resourceListChangedHandler;
+  toolListChangedHandler;
+  promptListChangedHandler;
+  progressHandler;
+  /** Server name */
+  serverName;
+  /** Server config */
+  config;
+  /** Request timeout */
+  timeout;
+  // ========================================================================
+  // Connection Lifecycle
+  // ========================================================================
+  /**
+   * Connect to the MCP server.
+   * Safe to call multiple times - returns existing connection if already connected.
+   */
+  async connect() {
+    if (this.isConnected) return;
+    if (this.connectionPromise) {
+      return this.connectionPromise;
+    }
+    this.connectionPromise = this.doConnect();
+    try {
+      await this.connectionPromise;
+    } finally {
+      this.connectionPromise = null;
+    }
+  }
+  async doConnect() {
+    const transport = this.createTransport(this.config);
+    this.transport = transport;
+    const client = new Client2(
+      { name: "indusagi-coding-agent", version: "0.13.0" },
+      {
+        capabilities: {
+          roots: { listChanged: true },
+          elicitation: {},
+          sampling: {}
+        }
+      }
+    );
+    this.client = client;
+    this.registerServerHandlers(client);
+    const prevOnClose = transport.onclose;
+    transport.onclose = () => {
+      this.isConnected = false;
+      this.log("debug", "Transport closed");
+      prevOnClose?.();
+    };
+    try {
+      await client.connect(transport, { timeout: DEFAULT_CONNECT_TIMEOUT });
+    } catch (err) {
+      const recovered = await this.tryFinishOAuthAndReconnect(client, transport, err);
+      if (!recovered) {
+        throw this.wrapConnectError(err);
+      }
+    }
+    this.serverCapabilities = client.getServerCapabilities();
+    this.isConnected = true;
+    this.log("info", `Connected to MCP server`);
+  }
+  /**
+   * If `err` is an OAuth challenge and we have a provider + finishAuth-capable
+   * transport, wait for the browser code, exchange tokens, then reconnect on a
+   * **fresh** transport (the first transport is already `start()`ed and cannot
+   * be reused — see StreamableHTTPClientTransport.start).
+   *
+   * Matches the official SDK CLI example (`simpleOAuthClient`):
+   *   finishAuth(code) → new StreamableHTTPClientTransport → client.connect again
+   *
+   * Client.connect already called `close()` on init failure, so the Client is
+   * free to attach a new transport.
+   */
+  async tryFinishOAuthAndReconnect(client, transport, err) {
+    if (!isAuthRequiredError(err)) return false;
+    const provider = this.options.authProvider;
+    if (!provider) return false;
+    const finishAuth = transport.finishAuth;
+    const waitForCode = provider.waitForAuthorizationCode;
+    if (typeof finishAuth !== "function" || typeof waitForCode !== "function") {
+      this.log(
+        "error",
+        "MCP server requires authentication but OAuth finish path is incomplete (need authProvider.waitForAuthorizationCode + transport.finishAuth)."
+      );
+      return false;
+    }
+    this.log("info", "MCP server requires OAuth \u2014 complete login in the browser\u2026");
+    try {
+      const code = await waitForCode.call(provider);
+      this.log("info", "OAuth authorization code received \u2014 exchanging tokens\u2026");
+      await finishAuth.call(transport, code);
+      try {
+        await transport.close?.();
+      } catch {
+      }
+      const fresh = this.createTransport(this.config);
+      this.transport = fresh;
+      const prevOnClose = fresh.onclose;
+      fresh.onclose = () => {
+        this.isConnected = false;
+        this.log("debug", "Transport closed");
+        prevOnClose?.();
+      };
+      this.log("info", "Reconnecting MCP session with OAuth tokens\u2026");
+      await client.connect(fresh, { timeout: DEFAULT_CONNECT_TIMEOUT });
+      return true;
+    } catch (oauthErr) {
+      this.log(
+        "error",
+        `OAuth finish failed: ${oauthErr instanceof Error ? oauthErr.message : String(oauthErr)}`
+      );
+      throw this.wrapConnectError(oauthErr);
+    }
+  }
+  /** Turn raw SDK / network errors into a clearer MCPError for callers. */
+  wrapConnectError(err) {
+    if (err instanceof MCPError) return err;
+    const message = err instanceof Error ? err.message : String(err);
+    if (isAuthRequiredError(err)) {
+      return new MCPError(
+        `Authentication required for MCP server "${this.serverName}". Pass auth: "auto" (default) to run the OAuth browser flow, or set a Bearer token via headers. Original: ${message}`,
+        "CONNECTION_FAILED" /* CONNECTION_FAILED */,
+        err,
+        { serverName: this.serverName, cause: err instanceof Error ? err : void 0 }
+      );
+    }
+    return new MCPError(
+      `Failed to connect to MCP server "${this.serverName}": ${message}`,
+      "CONNECTION_FAILED" /* CONNECTION_FAILED */,
+      err,
+      { serverName: this.serverName, cause: err instanceof Error ? err : void 0 }
+    );
+  }
+  /**
+   * Build the SDK transport for the configured server.
+   *
+   *  - stdio: `StdioClientTransport` (inherits the parent env, merges config.env).
+   *  - http:  `StreamableHTTPClientTransport` (POST + server-push SSE channel,
+   *           reconnect + session-expiry handled by the SDK), unless the config
+   *           asks for the legacy `SSEClientTransport`.
+   */
+  createTransport(config) {
+    if ("command" in config) {
+      return new StdioClientTransport2({
+        command: config.command,
+        args: config.args ?? [],
+        env: { ...sanitizeEnv(process.env), ...config.env ?? {} },
+        cwd: config.cwd,
+        stderr: "pipe"
+      });
+    }
+    if ("url" in config) {
+      const requestInit = config.headers ? { headers: config.headers } : void 0;
+      if (config.transport === "sse") {
+        return new SSEClientTransport2(config.url, {
+          requestInit,
+          ...this.options.authProvider ? { authProvider: this.options.authProvider } : {}
+        });
+      }
+      return new StreamableHTTPClientTransport(config.url, {
+        requestInit,
+        ...this.options.authProvider ? { authProvider: this.options.authProvider } : {}
+      });
+    }
+    throw new MCPError(
+      "Server configuration must include either a command or a url",
+      "CONFIG_ERROR" /* CONFIG_ERROR */,
+      void 0,
+      { serverName: this.serverName }
+    );
+  }
+  /**
+   * Register handlers for server-initiated REQUESTS and NOTIFICATIONS.
+   *
+   * REQUESTS (have both `.method` AND `.id`) must be ANSWERED with a JSON-RPC
+   * RESPONSE carrying the matching id — the SDK does this automatically for the
+   * value a request handler returns (or rejects). The previous hand-rolled
+   * transport routed these into the notification path, so they were never
+   * answered (bug #13).
+   *
+   * Defaults:
+   *   - ping              → {}
+   *   - roots/list        → the configured roots
+   *   - elicitation/create→ decline ({action:"cancel"}) unless a host handler is set
+   *   - sampling          → reject "Method not found" unless a host handler is set
+   */
+  registerServerHandlers(client) {
+    client.setRequestHandler(PingRequestSchema, async () => ({}));
+    client.setRequestHandler(ListRootsRequestSchema, async () => ({
+      roots: this._roots.map((r) => ({ uri: r.uri, name: r.name }))
+    }));
+    client.setRequestHandler(ElicitRequestSchema, async (request) => {
+      if (!this.elicitationHandler) {
+        return { action: "cancel" };
+      }
+      const params = request.params;
+      const elicitRequest = {
+        message: params.message,
+        requestedSchema: params.requestedSchema ?? {}
+      };
+      const result = await this.elicitationHandler(elicitRequest);
+      return mapToSdkElicitResult(result);
+    });
+    client.setRequestHandler(CreateMessageRequestSchema, async (request) => {
+      if (!this.samplingHandler) {
+        throw new MCPError(
+          "Method not found: sampling/createMessage",
+          "SERVER_ERROR" /* SERVER_ERROR */,
+          { method: "sampling/createMessage" },
+          { serverName: this.serverName }
+        );
+      }
+      return await this.samplingHandler(request.params);
+    });
+    client.setNotificationHandler(ToolListChangedNotificationSchema, () => {
+      this.log("debug", "Tool list changed");
+      this.toolListChangedHandler?.();
+    });
+    client.setNotificationHandler(ResourceListChangedNotificationSchema, () => {
+      this.log("debug", "Resource list changed");
+      this.resourceListChangedHandler?.();
+    });
+    client.setNotificationHandler(ResourceUpdatedNotificationSchema, (n) => {
+      const uri = n.params?.uri;
+      this.log("debug", `Resource updated: ${uri}`);
+      if (uri) this.resourceUpdatedHandler?.({ uri });
+    });
+    client.setNotificationHandler(PromptListChangedNotificationSchema, () => {
+      this.log("debug", "Prompt list changed");
+      this.promptListChangedHandler?.();
+    });
+    client.setNotificationHandler(ProgressNotificationSchema, (n) => {
+      const params = n.params;
+      this.log("debug", `Progress: ${JSON.stringify(params)}`);
+      if (this.progressHandler && params) {
+        const notification = {
+          progressToken: params.progressToken,
+          progress: params.progress,
+          total: params.total,
+          message: params.message
+        };
+        this.progressHandler(notification);
+      }
+    });
+    client.setNotificationHandler(LoggingMessageNotificationSchema, (n) => {
+      if (this.enableServerLogs && n.params) {
+        const { level, ...rest } = n.params;
+        this.log(level || "info", "[SERVER]", rest);
+      }
+    });
+    client.setNotificationHandler(CancelledNotificationSchema, (n) => {
+      this.log("debug", `Request cancelled: ${JSON.stringify(n.params)}`);
+    });
+  }
+  /**
+   * Disconnect from the MCP server.
+   *
+   * The SDK's `client.close()` closes the transport and rejects any pending
+   * requests — a clean teardown for both stdio (graceful subprocess shutdown)
+   * and HTTP (close the push channel / end the session).
+   */
+  async disconnect() {
+    if (!this.client) {
+      this.log("debug", "Disconnect called but not connected");
+      this.isConnected = false;
+      return;
+    }
+    this.log("debug", "Disconnecting from MCP server");
+    try {
+      await this.client.close();
+    } catch (error) {
+      this.log("error", `Error during disconnect: ${error}`);
+    } finally {
+      this.client = void 0;
+      this.transport = void 0;
+      this.isConnected = false;
+      this.log("debug", "Successfully disconnected");
+    }
+  }
+  /**
+   * Whether the client is connected.
+   */
+  get connected() {
+    return this.isConnected;
+  }
+  // ========================================================================
+  // Tool Operations
+  // ========================================================================
+  /**
+   * List all tools available from the server.
+   */
+  async listTools() {
+    this.ensureConnected();
+    const result = await this.client.listTools(void 0, {
+      timeout: this.timeout
+    });
+    return result.tools;
+  }
+  /**
+   * Call a tool on the server.
+   */
+  async callTool(name, args) {
+    this.ensureConnected();
+    this.log("debug", `Calling tool: ${name}`);
+    try {
+      const result = await this.client.callTool(
+        { name, arguments: args },
+        void 0,
+        { timeout: this.timeout }
+      );
+      this.log("debug", `Tool ${name} executed successfully`);
+      return result;
+    } catch (error) {
+      this.log("error", `Tool ${name} failed: ${error}`);
+      throw this.wrapError(error);
+    }
+  }
+  // ========================================================================
+  // Resource Operations
+  // ========================================================================
+  /**
+   * List all resources available from the server.
+   */
+  async listResources() {
+    this.ensureConnected();
+    if (!this.serverCapabilities?.resources) {
+      return [];
+    }
+    const result = await this.client.listResources(void 0, {
+      timeout: this.timeout
+    });
+    return result.resources;
+  }
+  /**
+   * Read a resource from the server.
+   */
+  async readResource(uri) {
+    this.ensureConnected();
+    return await this.client.readResource({ uri }, { timeout: this.timeout });
+  }
+  /**
+   * Subscribe to resource updates.
+   */
+  async subscribeResource(uri) {
+    this.ensureConnected();
+    await this.client.subscribeResource({ uri }, { timeout: this.timeout });
+  }
+  /**
+   * Unsubscribe from resource updates.
+   */
+  async unsubscribeResource(uri) {
+    this.ensureConnected();
+    await this.client.unsubscribeResource({ uri }, { timeout: this.timeout });
+  }
+  // ========================================================================
+  // Prompt Operations
+  // ========================================================================
+  /**
+   * List all prompts available from the server.
+   */
+  async listPrompts() {
+    this.ensureConnected();
+    if (!this.serverCapabilities?.prompts) {
+      return [];
+    }
+    const result = await this.client.listPrompts(void 0, {
+      timeout: this.timeout
+    });
+    return result.prompts;
+  }
+  /**
+   * Get a prompt from the server.
+   */
+  async getPrompt(name, args) {
+    this.ensureConnected();
+    return await this.client.getPrompt(
+      { name, arguments: args },
+      { timeout: this.timeout }
+    );
+  }
+  // ========================================================================
+  // Roots Operations
+  // ========================================================================
+  /**
+   * Get the configured roots.
+   */
+  get roots() {
+    return [...this._roots];
+  }
+  /**
+   * Update the roots and notify the server.
+   */
+  async setRoots(roots) {
+    this.log("debug", `Updating roots to ${roots.length} entries`);
+    this._roots = [...roots];
+    if (this.isConnected && this.client) {
+      try {
+        await this.client.sendRootsListChanged();
+      } catch (error) {
+        this.log("debug", `Failed to send roots/list_changed: ${error}`);
+      }
+    }
+  }
+  // ========================================================================
+  // Handler Registration
+  //
+  // Setters STORE the host handler (and, for notifications, the SDK handler
+  // registered in `registerServerHandlers` delegates to the stored callback).
+  // This is the host-overridable layer at the core of bug #13.
+  // ========================================================================
+  /**
+   * Set a handler for resource updated notifications.
+   */
+  setResourceUpdatedHandler(handler) {
+    this.resourceUpdatedHandler = handler;
+    this.log("debug", "Resource updated handler registered");
+  }
+  /**
+   * Set a handler for resource list changed notifications.
+   */
+  setResourceListChangedHandler(handler) {
+    this.resourceListChangedHandler = handler;
+    this.log("debug", "Resource list changed handler registered");
+  }
+  /**
+   * Set a handler for tool list changed notifications.
+   */
+  setToolListChangedHandler(handler) {
+    this.toolListChangedHandler = handler;
+    this.log("debug", "Tool list changed handler registered");
+  }
+  /**
+   * Set a handler for prompt list changed notifications.
+   */
+  setPromptListChangedHandler(handler) {
+    this.promptListChangedHandler = handler;
+    this.log("debug", "Prompt list changed handler registered");
+  }
+  /**
+   * Set a handler for elicitation requests. When set, the server's
+   * `elicitation/create` REQUEST is answered with the host's decision; when
+   * unset the request is declined ({action:"cancel"}).
+   */
+  setElicitationHandler(handler) {
+    this.elicitationHandler = handler;
+    this.log("debug", "Elicitation handler registered");
+  }
+  /**
+   * Set a handler for sampling (`sampling/createMessage`) requests. When set,
+   * the server request is answered with the host's result; when unset the
+   * request is rejected with "Method not found".
+   */
+  setSamplingHandler(handler) {
+    this.samplingHandler = handler;
+    this.log("debug", "Sampling handler registered");
+  }
+  /**
+   * Set a handler for progress notifications.
+   */
+  setProgressHandler(handler) {
+    this.progressHandler = handler;
+    this.log("debug", "Progress handler registered");
+  }
+  // ========================================================================
+  // Private Methods
+  // ========================================================================
+  ensureConnected() {
+    if (!this.isConnected || !this.client) {
+      throw new MCPError(
+        "Not connected to MCP server",
+        "NOT_CONNECTED" /* NOT_CONNECTED */,
+        void 0,
+        { serverName: this.serverName }
+      );
+    }
+  }
+  /**
+   * Normalize an SDK/transport error into an MCPError. Session-expiry style
+   * failures (404 session / -32001) are surfaced as SESSION_ERROR so callers
+   * (the pool) can decide to reconnect; the SDK's StreamableHTTP transport
+   * already attempts a bounded reconnect re-using the session id before this.
+   */
+  wrapError(error) {
+    if (error instanceof MCPError) return error;
+    const message = error instanceof Error ? error.message : String(error);
+    const code = error.code;
+    if (code === -32001 || /\b404\b|session/i.test(message)) {
+      return new MCPError(message, "SESSION_ERROR" /* SESSION_ERROR */, { code }, {
+        serverName: this.serverName
+      });
+    }
+    return new MCPError(message, "SERVER_ERROR" /* SERVER_ERROR */, { code }, {
+      serverName: this.serverName
+    });
+  }
+  log(level, message, details) {
+    const msg = `[${this.serverName}] ${message}`;
+    if (this.logHandler) {
+      this.logHandler({
+        level,
+        message: msg,
+        timestamp: /* @__PURE__ */ new Date(),
+        serverName: this.serverName,
+        details
+      });
+    } else {
+      if (process.env.INDUSAGI_DEBUG || level === "error") {
+        const prefix = `[MCP:${level.toUpperCase()}]`;
+        if (details) {
+          if (level === "error") {
+            console.error(prefix, msg, details);
+          } else {
+            console.log(prefix, msg, details);
+          }
+        } else {
+          if (level === "error") {
+            console.error(prefix, msg);
+          } else {
+            console.log(prefix, msg);
+          }
+        }
+      }
+    }
+  }
+};
+function mapToSdkElicitResult(result) {
+  if (result.action === "accept") {
+    return {
+      action: "accept",
+      content: result.content ?? {}
+    };
+  }
+  return { action: result.action };
+}
+function isAuthRequiredError(err) {
+  if (err == null) return false;
+  if (err instanceof UnauthorizedError) return true;
+  if (typeof err === "object") {
+    const code = err.code;
+    if (code === 401 || code === "401") return true;
+  }
+  if (err instanceof Error) {
+    const msg = err.message;
+    if (/unauthorized/i.test(msg)) return true;
+    if (/authentication required/i.test(msg)) return true;
+    if (/auth required/i.test(msg)) return true;
+    if (err.name === "UnauthorizedError") return true;
+  }
+  return false;
+}
+function sanitizeEnv(env) {
+  const out = {};
+  for (const [k, v] of Object.entries(env)) {
+    if (typeof v === "string") out[k] = v;
+  }
+  return out;
+}
+
+// src/facade/mcp-core/oauth/flow.ts
+import { createServer } from "node:http";
+var CALLBACK_TIMEOUT_MS = 5 * 60 * 1e3;
+var SUCCESS_HTML = '<!doctype html><html><body style="font-family:system-ui;padding:2rem"><h1>Authorization complete</h1><p>You can close this tab and return to your terminal.</p></body></html>';
+var ERROR_HTML = (msg) => `<!doctype html><html><body style="font-family:system-ui;padding:2rem"><h1>Authorization failed</h1><pre>${escapeHtml(msg)}</pre></body></html>`;
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+async function startOAuthCallbackServer(options) {
+  const timeoutMs = options?.timeoutMs ?? CALLBACK_TIMEOUT_MS;
+  const logger = options?.logger;
+  let settled2 = false;
+  let timer;
+  let resolveCode;
+  let rejectCode;
+  const codePromise = new Promise((res, rej) => {
+    resolveCode = res;
+    rejectCode = rej;
+  });
+  codePromise.catch(() => {
+  });
+  let expectedState;
+  const clearTimer = () => {
+    if (timer !== void 0) {
+      clearTimeout(timer);
+      timer = void 0;
+    }
+  };
+  const settleReject = (err) => {
+    if (settled2) return;
+    settled2 = true;
+    clearTimer();
+    try {
+      server.close();
+    } catch {
+    }
+    rejectCode(err);
+  };
+  const settleResolve = (code) => {
+    if (settled2) return;
+    settled2 = true;
+    clearTimer();
+    resolveCode(code);
+    setTimeout(() => {
+      try {
+        server.close();
+      } catch {
+      }
+    }, 50);
+  };
+  const server = createServer((req, res) => {
+    if (settled2) {
+      res.statusCode = 410;
+      res.end("already used");
+      return;
+    }
+    handleRequest(
+      req,
+      res,
+      expectedState,
+      (code) => settleResolve(code),
+      (err) => settleReject(err),
+      logger
+    );
+  });
+  await new Promise((resolveListen, rejectListen) => {
+    server.once("error", rejectListen);
+    server.listen(0, "127.0.0.1", () => resolveListen());
+  });
+  const address = server.address();
+  if (!address) {
+    server.close();
+    throw new Error("oauth-callback: server bound to no address");
+  }
+  const port = address.port;
+  const redirectUri = `http://127.0.0.1:${port}/callback`;
+  const close = () => {
+    if (!settled2) {
+      settleReject(new Error("oauth-callback: closed before browser login completed"));
+    } else {
+      clearTimer();
+      try {
+        server.close();
+      } catch {
+      }
+    }
+  };
+  return {
+    redirectUri,
+    port,
+    waitForCode(state) {
+      expectedState = state;
+      logger?.debug(`oauth-callback: waiting for browser at ${redirectUri}`);
+      if (!settled2 && timer === void 0) {
+        timer = setTimeout(() => {
+          settleReject(
+            new Error(
+              `oauth-callback: timed out after ${timeoutMs}ms waiting for browser login at ${redirectUri}`
+            )
+          );
+        }, timeoutMs);
+        timer.unref();
+      }
+      return codePromise;
+    },
+    close
+  };
+}
+function handleRequest(req, res, expectedState, onCode, onError, logger) {
+  const url = new URL(req.url ?? "/", "http://127.0.0.1");
+  if (url.pathname !== "/callback") {
+    if (url.pathname === "/favicon.ico") {
+      res.statusCode = 404;
+      res.end();
+      return;
+    }
+    res.statusCode = 404;
+    res.end("not found");
+    return;
+  }
+  const errorParam = url.searchParams.get("error");
+  if (errorParam) {
+    const desc = url.searchParams.get("error_description") ?? "";
+    logger?.warn(`oauth-callback: server returned error ${errorParam} ${desc}`);
+    res.statusCode = 400;
+    res.setHeader("content-type", "text/html; charset=utf-8");
+    res.end(ERROR_HTML(`${errorParam}${desc ? ": " + desc : ""}`));
+    onError(new Error(`OAuth provider returned error: ${errorParam}${desc ? " \u2014 " + desc : ""}`));
+    return;
+  }
+  const code = url.searchParams.get("code");
+  const state = url.searchParams.get("state");
+  if (!code) {
+    res.statusCode = 400;
+    res.setHeader("content-type", "text/html; charset=utf-8");
+    res.end(ERROR_HTML("missing code"));
+    return;
+  }
+  if (expectedState && state && state !== expectedState) {
+    res.statusCode = 400;
+    res.setHeader("content-type", "text/html; charset=utf-8");
+    res.end(ERROR_HTML("state mismatch \u2014 possible CSRF"));
+    onError(new Error("OAuth callback state did not match \u2014 refusing to exchange code"));
+    return;
+  }
+  res.statusCode = 200;
+  res.setHeader("content-type", "text/html; charset=utf-8");
+  res.end(SUCCESS_HTML);
+  logger?.debug(`oauth-callback: received authorization code (${code.length} chars)`);
+  onCode(code);
+}
+async function openBrowser(url) {
+  try {
+    const mod = await import("node:child_process").catch(() => null);
+    if (!mod) return false;
+    const cmd = platformOpenCommand(url);
+    if (!cmd) return false;
+    const child = mod.spawn(cmd.cmd, cmd.args, { detached: true, stdio: "ignore" });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+function platformOpenCommand(url) {
+  switch (process.platform) {
+    case "darwin":
+      return { cmd: "open", args: [url] };
+    case "win32":
+      return { cmd: "rundll32", args: ["url.dll,FileProtocolHandler", url] };
+    default:
+      return { cmd: "xdg-open", args: [url] };
+  }
+}
+
+// src/facade/mcp-core/oauth/token-store.ts
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join as join2 } from "node:path";
+function defaultCredentialsDir() {
+  const xdg = process.env.XDG_CONFIG_HOME;
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
+  if (xdg && xdg.length > 0) return join2(xdg, "indusagi", "credentials", "mcp");
+  if (home.length > 0) return join2(home, ".config", "indusagi", "credentials", "mcp");
+  return join2(process.cwd(), ".indusagi", "credentials", "mcp");
+}
+function resolveCredentialsDir(override) {
+  return override && override.length > 0 ? override : defaultCredentialsDir();
+}
+function credentialsPath(credentialsDir, id) {
+  const safe = id.replace(/[^a-zA-Z0-9._-]/g, "-");
+  return join2(credentialsDir, `${safe}.json`);
+}
+function readMcpOAuthState(credentialsDir, id) {
+  const path2 = credentialsPath(credentialsDir, id);
+  if (!existsSync(path2)) return void 0;
+  let raw;
+  try {
+    raw = readFileSync(path2, "utf8");
+  } catch (e) {
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    return void 0;
+  }
+  if (typeof parsed !== "object" || parsed === null) return void 0;
+  return { id, updatedAt: Date.now(), ...parsed };
+}
+function writeMcpOAuthState(credentialsDir, state) {
+  const path2 = credentialsPath(credentialsDir, state.id);
+  mkdirSync(dirname(path2), { recursive: true });
+  const tmp = `${path2}.tmp-${process.pid}-${Date.now()}`;
+  const json = JSON.stringify({ ...state, updatedAt: Date.now() }, null, 2);
+  writeFileSync(tmp, json, { mode: 384 });
+  renameSync(tmp, path2);
+  try {
+    chmodSync(path2, 384);
+  } catch {
+  }
+}
+function clearMcpOAuthState(credentialsDir, id) {
+  const path2 = credentialsPath(credentialsDir, id);
+  try {
+    const fs2 = __require("node:fs");
+    fs2.rmSync(path2, { force: true });
+  } catch {
+  }
+}
+
+// src/facade/mcp-core/oauth/provider.ts
+function randomState() {
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function toSdkTokens(t) {
+  return {
+    access_token: t.access_token,
+    refresh_token: t.refresh_token,
+    scope: t.scope,
+    token_type: t.token_type ?? "Bearer",
+    expires_in: t.expires_at !== void 0 ? Math.max(0, Math.floor((t.expires_at - Date.now()) / 1e3)) : void 0
+  };
+}
+function toSdkClientInfo(c) {
+  return {
+    client_id: c.client_id,
+    client_secret: c.client_secret,
+    client_id_issued_at: c.client_id_issued_at,
+    client_secret_expires_at: c.client_secret_expires_at
+  };
+}
+async function createMcpOAuthProvider(config) {
+  const credentialsDir = resolveCredentialsDir(config.credentialsDir);
+  const openBrowserEnabled = config.openBrowser ?? Boolean(process.env.CI !== "true" && process.stdout.isTTY);
+  let callback;
+  let redirectUrl;
+  if (config.redirectUrl) {
+    redirectUrl = config.redirectUrl;
+  } else {
+    callback = await startOAuthCallbackServer({
+      logger: config.logger ? { debug: config.logger.debug, warn: config.logger.warn } : void 0
+    });
+    redirectUrl = callback.redirectUri;
+  }
+  const clientMetadata = {
+    client_name: config.clientMetadata?.client_name ?? "indusagi-mcp-client",
+    client_uri: config.clientMetadata?.client_uri,
+    logo_uri: config.clientMetadata?.logo_uri,
+    contacts: config.clientMetadata?.contacts ? [...config.clientMetadata.contacts] : void 0,
+    tos_uri: config.clientMetadata?.tos_uri,
+    policy_uri: config.clientMetadata?.policy_uri,
+    redirect_uris: config.clientMetadata?.redirect_uris ? [...config.clientMetadata.redirect_uris] : [redirectUrl],
+    token_endpoint_auth_method: config.clientMetadata?.token_endpoint_auth_method ?? "none",
+    grant_types: config.clientMetadata?.grant_types ? [...config.clientMetadata.grant_types] : ["authorization_code", "refresh_token"],
+    response_types: config.clientMetadata?.response_types ? [...config.clientMetadata.response_types] : ["code"],
+    scope: config.clientMetadata?.scope
+  };
+  let lastAuthUrl;
+  let lastState;
+  let pendingCode;
+  const provider = {
+    id: config.id,
+    credentialsDir,
+    redirectUrl,
+    get clientMetadata() {
+      return clientMetadata;
+    },
+    state() {
+      const s = randomState();
+      lastState = s;
+      return s;
+    },
+    clientInformation() {
+      const state = readMcpOAuthState(credentialsDir, config.id);
+      return state?.client ? toSdkClientInfo(state.client) : void 0;
+    },
+    saveClientInformation(client) {
+      const state = readMcpOAuthState(credentialsDir, config.id) ?? {
+        id: config.id,
+        updatedAt: Date.now()
+      };
+      writeMcpOAuthState(credentialsDir, {
+        ...state,
+        client: {
+          client_id: client.client_id,
+          client_secret: client.client_secret,
+          client_id_issued_at: client.client_id_issued_at,
+          client_secret_expires_at: client.client_secret_expires_at
+        }
+      });
+    },
+    tokens() {
+      const state = readMcpOAuthState(credentialsDir, config.id);
+      return state?.tokens ? toSdkTokens(state.tokens) : void 0;
+    },
+    saveTokens(tokens) {
+      const state = readMcpOAuthState(credentialsDir, config.id) ?? {
+        id: config.id,
+        updatedAt: Date.now()
+      };
+      writeMcpOAuthState(credentialsDir, {
+        ...state,
+        tokens: {
+          access_token: tokens.access_token,
+          refresh_token: tokens.refresh_token,
+          scope: tokens.scope,
+          token_type: tokens.token_type,
+          expires_at: tokens.expires_in !== void 0 ? Date.now() + Math.trunc(tokens.expires_in) * 1e3 : void 0
+        }
+      });
+    },
+    async redirectToAuthorization(authorizationUrl) {
+      const url = authorizationUrl.toString();
+      lastAuthUrl = url;
+      try {
+        lastState = new URL(url).searchParams.get("state") ?? lastState;
+      } catch {
+      }
+      const prompt = `oauth: open this URL in your browser to authorize Zoho MCP:
+  ${url}`;
+      config.logger?.info?.(prompt);
+      config.logger?.debug?.(prompt);
+      console.error(`
+[zoho oauth] Authorize in browser:
+  ${url}
+`);
+      let opened = false;
+      if (openBrowserEnabled) opened = await openBrowser(url);
+      if (!opened) {
+        const tip = "oauth: could not auto-open browser. Visit the URL above manually.";
+        config.logger?.info?.(tip);
+        config.logger?.debug?.(tip);
+        console.error(`[zoho oauth] ${tip}`);
+      } else {
+        config.logger?.debug?.("oauth: browser open launched");
+      }
+    },
+    saveCodeVerifier(verifier) {
+      const state = readMcpOAuthState(credentialsDir, config.id) ?? {
+        id: config.id,
+        updatedAt: Date.now()
+      };
+      writeMcpOAuthState(credentialsDir, { ...state, codeVerifier: verifier });
+    },
+    codeVerifier() {
+      const state = readMcpOAuthState(credentialsDir, config.id);
+      const verifier = state?.codeVerifier;
+      if (!verifier) throw new Error("No PKCE code verifier saved");
+      return verifier;
+    },
+    invalidateCredentials(scope) {
+      if (scope === "all") {
+        clearMcpOAuthState(credentialsDir, config.id);
+        return;
+      }
+      const state = readMcpOAuthState(credentialsDir, config.id);
+      if (!state) return;
+      const next = { ...state };
+      if (scope === "tokens" || scope === "verifier") next.tokens = void 0;
+      if (scope === "verifier") next.codeVerifier = void 0;
+      if (scope === "discovery") {
+        next.resourceMetadata = void 0;
+        next.authServerMetadata = void 0;
+      }
+      writeMcpOAuthState(credentialsDir, next);
+    },
+    async waitForAuthorizationCode() {
+      if (pendingCode) return pendingCode;
+      if (!callback) {
+        throw new Error(
+          "oauth: no local callback server (custom redirectUrl set). Pass the authorization code via finishAuth yourself."
+        );
+      }
+      config.logger?.info("oauth: waiting for browser authorization\u2026");
+      console.error("[zoho oauth] Waiting for browser authorization\u2026");
+      const code = await callback.waitForCode(lastState);
+      pendingCode = code;
+      return code;
+    },
+    dispose() {
+      callback?.close();
+      callback = void 0;
+    },
+    lastAuthorizationUrl() {
+      return lastAuthUrl;
+    }
+  };
+  return provider;
+}
+
+// src/facade/mcp-core/oauth/index.ts
+import {
+  auth,
+  discoverOAuthServerInfo,
+  startAuthorization,
+  exchangeAuthorization,
+  refreshAuthorization,
+  registerClient,
+  extractWWWAuthenticateParams
+} from "@modelcontextprotocol/sdk/client/auth.js";
+
+// src/facade/mcp-core/toolbox-bridge.ts
+var NOOP_FS_NOT_SUPPORTED = "not supported in MCP-wrapped tools";
+var noopFs = {
+  readFile: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  },
+  writeFile: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  },
+  stat: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  },
+  readdir: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  },
+  mkdir: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  },
+  rm: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  },
+  exists: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  }
+};
+var noopShell = {
+  exec: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  },
+  spawn: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  }
+};
+function makeToolContext(signal) {
+  return {
+    cwd: process.cwd(),
+    fs: noopFs,
+    shell: noopShell,
+    signal,
+    budget: { kind: "tail", maxBytes: 5e4 }
+  };
+}
+function describeThrow2(err) {
+  if (err instanceof Error) return err.message;
+  if (typeof err === "string") return err;
+  try {
+    return JSON.stringify(err);
+  } catch {
+    return String(err);
+  }
+}
+function projectMcpResult(result, logger) {
+  const blocks = [];
+  if (result.content && result.content.length > 0) {
+    for (const block of result.content) {
+      if (block.type === "text") {
+        blocks.push({ kind: "text", text: block.text });
+      } else if (block.type === "image") {
+        const len = typeof block.data === "string" ? block.data.length : 0;
+        blocks.push({ kind: "text", text: `[image ${block.mimeType}, ${len} chars base64]` });
+        logger?.debug(`mcp bridge: image block collapsed to text mention (${block.mimeType})`);
+      } else if (block.type === "resource") {
+        blocks.push({ kind: "text", text: `[resource ${block.resource.uri}]` });
+      } else {
+        blocks.push({ kind: "text", text: "[unknown content block]" });
+      }
+    }
+  }
+  if (result.structuredContent !== void 0) {
+    blocks.push({ kind: "json", value: result.structuredContent });
+  }
+  const content = blocks.length > 0 ? blocks : [{ kind: "text", text: "(no content)" }];
+  return {
+    content,
+    ...result.isError === true ? { isError: true } : {}
+  };
+}
+function makeRunner(client, remoteName, logger) {
+  return async (input, ctx) => {
+    if (ctx.signal.aborted) {
+      return {
+        content: [{ kind: "text", text: "Cancelled before tool could start." }],
+        isError: true
+      };
+    }
+    try {
+      const args = input ?? {};
+      const result = await client.callTool(remoteName, args);
+      return projectMcpResult(result, logger);
+    } catch (err) {
+      const wrapped = err instanceof MCPError ? err : createServerError(describeThrow2(err), client.serverName);
+      logger?.error(`mcp bridge: tool "${remoteName}" failed: ${wrapped.message}`, wrapped);
+      return {
+        content: [{ kind: "text", text: `MCP tool failed: ${wrapped.message}` }],
+        isError: true
+      };
+    }
+  };
+}
+async function mcpClientToToolBox(client, options = {}) {
+  const prefix = options.namePrefix ?? "mcp";
+  const logger = options.logger;
+  const tools = await client.listTools();
+  const filtered = typeof options.filter === "function" ? tools.filter((t) => options.filter(t)) : tools;
+  const byName = /* @__PURE__ */ new Map();
+  for (const tool of filtered) {
+    const remoteName = tool.name;
+    const prefixed = `${prefix}__${remoteName}`;
+    const description = tool.description && tool.description.length > 0 ? tool.description : `<tool "${remoteName}" from MCP server "${client.serverName}">`;
+    const parameters = tool.inputSchema;
+    const def = defineTool({
+      name: prefixed,
+      description,
+      parameters,
+      run: makeRunner(client, remoteName, logger)
+    });
+    byName.set(prefixed, def);
+  }
+  const runner = {
+    async run(call, signal) {
+      const def = byName.get(call.name);
+      if (!def) {
+        return {
+          id: call.id,
+          output: `No tool "${call.name}" on MCP server "${client.serverName}".`,
+          isError: true
+        };
+      }
+      return def.invoke(call, makeToolContext(signal));
+    }
+  };
+  return {
+    descriptors() {
+      return Array.from(byName.values()).map((d) => d.descriptor());
+    },
+    runner
+  };
+}
+
+// src/connectors-zoho/connect.ts
+async function connectZohoMcp(options) {
+  const id = options.id ?? "zoho";
+  const authMode = options.auth ?? "auto";
+  let parsedUrl;
+  try {
+    parsedUrl = new URL(options.url);
+  } catch {
+    throw new Error(`connectZohoMcp: invalid url "${options.url}"`);
+  }
+  if (parsedUrl.protocol !== "https:" && parsedUrl.protocol !== "http:") {
+    throw new Error(`connectZohoMcp: url must be http(s), got "${parsedUrl.protocol}"`);
+  }
+  let oauthProvider;
+  if (authMode === "auto" || authMode === "oauth") {
+    oauthProvider = await createMcpOAuthProvider({
+      id,
+      credentialsDir: options.tokenStorePath,
+      redirectUrl: options.redirectUrl,
+      // Default true outside CI so TUI sessions always get a browser redirect.
+      openBrowser: options.openBrowser ?? (process.env.CI !== "true" && process.env.ZOHO_OPEN_BROWSER !== "0"),
+      clientMetadata: {
+        client_name: "indusagi-zoho-agent",
+        scope: options.scopes?.join(" ")
+      },
+      logger: options.logger ? {
+        debug: options.logger.debug,
+        info: (msg) => {
+          options.logger?.debug(msg);
+          console.error(`[zoho] ${msg}`);
+        },
+        warn: (msg) => options.logger?.debug(msg),
+        error: options.logger.error
+      } : {
+        debug: (msg) => {
+          if (process.env.INDUSAGI_DEBUG) console.error(`[zoho debug] ${msg}`);
+        },
+        info: (msg) => console.error(`[zoho] ${msg}`),
+        warn: (msg) => console.error(`[zoho] ${msg}`),
+        error: (msg) => console.error(`[zoho error] ${msg}`)
+      }
+    });
+  }
+  const client = new MCPClient({
+    name: id,
+    config: {
+      url: parsedUrl,
+      headers: options.headers ? { ...options.headers } : void 0,
+      ...options.useSse ? { transport: "sse" } : {}
+    },
+    timeout: options.timeoutMs ?? 3e4,
+    ...oauthProvider ? {
+      authProvider: oauthProvider
+    } : {}
+  });
+  try {
+    await client.connect();
+  } catch (e) {
+    oauthProvider?.dispose();
+    const msg = e instanceof Error ? e.message : String(e);
+    if (/authentication required|unauthorized|401/i.test(msg)) {
+      throw new Error(
+        `Zoho MCP authentication failed for "${id}".
+  \u2022 Ensure ZOHO_MCP_URL is the full Connect URL from https://mcp.zoho.com
+  \u2022 Complete the browser OAuth login when prompted
+  \u2022 Or set auth: "none" and pass Authorization headers if you use a pre-authorized URL
+  Original: ${msg}`,
+        { cause: e instanceof Error ? e : void 0 }
+      );
+    }
+    throw e;
+  }
+  try {
+    const toolBox2 = await mcpClientToToolBox(client, {
+      namePrefix: id,
+      logger: options.logger
+    });
+    const tools = await client.listTools();
+    const prefixed = tools.map((t) => `${id}__${t.name}`);
+    try {
+      oauthProvider?.dispose();
+    } catch {
+    }
+    let closed = false;
+    return {
+      id,
+      toolBox: toolBox2,
+      toolNames: prefixed,
+      client,
+      async close() {
+        if (closed) return;
+        closed = true;
+        try {
+          await client.disconnect();
+        } catch (err) {
+          options.logger?.error(`zoho close failed: ${err.message}`, err);
+        } finally {
+          try {
+            oauthProvider?.dispose();
+          } catch {
+          }
+        }
+      }
+    };
+  } catch (e) {
+    oauthProvider?.dispose();
+    try {
+      await client.disconnect();
+    } catch {
+    }
+    throw e;
+  }
+}
+
+// src/connectors-zoho/toolbox.ts
+async function zohoToolBoxFromClient(client, options) {
+  return mcpClientToToolBox(client, {
+    ...options,
+    namePrefix: options?.id ?? "zoho"
+  });
+}
+
+// src/connectors-sarvam/index.ts
+var connectors_sarvam_exports = {};
+__export(connectors_sarvam_exports, {
+  connectSarvamMcp: () => connectSarvamMcp,
+  sarvamToolBoxFromClient: () => sarvamToolBoxFromClient
+});
+
+// src/connectors-sarvam/connect.ts
+function resolveHome(p) {
+  if (!p.startsWith("~")) return p;
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
+  return home.length > 0 ? p.replace(/^~/, home) : p;
+}
+async function connectSarvamMcp(options) {
+  const id = options.id ?? "sarvam";
+  const apiKey = (options.apiKey?.trim() || process.env.SARVAM_API_KEY?.trim() || "").trim();
+  if (!apiKey) {
+    throw new Error(
+      "connectSarvamMcp: SARVAM_API_KEY missing (pass apiKey or set the env var)."
+    );
+  }
+  const baseUrl = options.baseUrl ?? process.env.SARVAM_API_BASE_URL ?? "https://api.sarvam.ai";
+  const basePath = resolveHome(options.basePath ?? process.env.SARVAM_MCP_BASE_PATH ?? "~/Desktop");
+  const command = options.command ?? "uvx";
+  const args = [...options.args ?? ["sarvam-mcp"]];
+  const env = {
+    ...options.env ? { ...options.env } : {},
+    SARVAM_API_KEY: apiKey,
+    SARVAM_API_BASE_URL: baseUrl,
+    SARVAM_MCP_BASE_PATH: basePath
+  };
+  const client = new MCPClient({
+    name: id,
+    config: { command, args, env },
+    timeout: options.timeoutMs ?? 6e4
+  });
+  await client.connect();
+  const toolBox2 = await mcpClientToToolBox(client, {
+    namePrefix: id,
+    logger: options.logger
+  });
+  const tools = await client.listTools();
+  const prefixed = tools.map((t) => `${id}__${t.name}`);
+  let closed = false;
+  return {
+    id,
+    toolBox: toolBox2,
+    toolNames: prefixed,
+    client,
+    async close() {
+      if (closed) return;
+      closed = true;
+      try {
+        await client.disconnect();
+      } catch (e) {
+        options.logger?.error(`sarvam close failed: ${e.message}`, e);
+      }
+    }
+  };
+}
+
+// src/connectors-sarvam/toolbox.ts
+async function sarvamToolBoxFromClient(client, options) {
+  return mcpClientToToolBox(client, {
+    ...options,
+    namePrefix: options?.id ?? "sarvam"
+  });
+}
+
 // src/swarm/index.ts
 var swarm_exports = {};
 __export(swarm_exports, {
@@ -8624,14 +10150,14 @@ __export(swarm_exports, {
 });
 
 // src/swarm/coordinator.ts
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 
 // src/swarm/roster/manifest.ts
 import { z as z2 } from "zod";
 
 // src/swarm/kernel/json-cell.ts
 import { mkdir as mkdir2, readFile as readFile2, rename, rm, stat, writeFile } from "node:fs/promises";
-import { dirname, join as join2 } from "node:path";
+import { dirname as dirname2, join as join3 } from "node:path";
 import { z } from "zod";
 
 // src/swarm/kernel/faults.ts
@@ -8702,7 +10228,7 @@ var JsonCell = class _JsonCell {
         parsed.error
       );
     }
-    await mkdir2(dirname(path2), { recursive: true });
+    await mkdir2(dirname2(path2), { recursive: true });
     const opts = { ...GUARD_DEFAULTS, ...guard };
     return new _JsonCell(path2, schema, parsed.data, opts);
   }
@@ -8813,7 +10339,7 @@ var JsonCell = class _JsonCell {
       try {
         await mkdir2(this.lockDir);
         await writeFile(
-          join2(this.lockDir, "owner.json"),
+          join3(this.lockDir, "owner.json"),
           JSON.stringify({
             pid: process.pid,
             takenAt: Date.now(),
@@ -8851,7 +10377,7 @@ var JsonCell = class _JsonCell {
     const now = Date.now();
     try {
       const marker = lockMarkerSchema.safeParse(
-        JSON.parse(await readFile2(join2(this.lockDir, "owner.json"), "utf8"))
+        JSON.parse(await readFile2(join3(this.lockDir, "owner.json"), "utf8"))
       );
       if (marker.success) return now - marker.data.takenAt > staleMs;
     } catch {
@@ -8877,7 +10403,7 @@ var JsonCell = class _JsonCell {
 
 // src/swarm/kernel/jsonl-log.ts
 import { appendFile as appendFile2, mkdir as mkdir3, readFile as readFile3 } from "node:fs/promises";
-import { dirname as dirname2 } from "node:path";
+import { dirname as dirname3 } from "node:path";
 function hasCode2(err, code) {
   return typeof err === "object" && err !== null && "code" in err && err.code === code;
 }
@@ -8891,7 +10417,7 @@ var JsonlLog = class _JsonlLog {
   }
   /** Open (or adopt) the log at `path`, ensuring its parent directory exists. */
   static async open(path2, schema) {
-    await mkdir3(dirname2(path2), { recursive: true });
+    await mkdir3(dirname3(path2), { recursive: true });
     return new _JsonlLog(path2, schema);
   }
   /**
@@ -9536,7 +11062,7 @@ function isTicket(value) {
 }
 
 // src/swarm/postbox/channel.ts
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 import { z as z5 } from "zod";
 
 // src/swarm/postbox/codecs.ts
@@ -9650,10 +11176,10 @@ var cursorSchema = z5.object({
   seen: z5.number().int().nonnegative()
 });
 function transcriptPath(root) {
-  return join3(root, "transcript.jsonl");
+  return join4(root, "transcript.jsonl");
 }
 function cursorPath(root, readerId) {
-  return join3(root, "cursors", `${encodeReaderId(readerId)}.json`);
+  return join4(root, "cursors", `${encodeReaderId(readerId)}.json`);
 }
 function encodeReaderId(readerId) {
   return encodeURIComponent(readerId);
@@ -10083,14 +11609,14 @@ var Crew = class _Crew {
    */
   static async open(opts) {
     const now = opts.now ?? Date.now;
-    const manifest = await CrewManifest.open(join4(opts.dir, "manifest.json"));
+    const manifest = await CrewManifest.open(join5(opts.dir, "manifest.json"));
     await manifest.create().catch((err) => {
       if (SwarmFault.is(err, "conflict")) return;
       throw err;
     });
-    const board = await TicketBoard.open(join4(opts.dir, "board.json"), now);
-    const channel = await Channel.open(join4(opts.dir, "channel"));
-    const activity = await ActivityLog.open(join4(opts.dir, "activity.jsonl"), now);
+    const board = await TicketBoard.open(join5(opts.dir, "board.json"), now);
+    const channel = await Channel.open(join5(opts.dir, "channel"));
+    const activity = await ActivityLog.open(join5(opts.dir, "activity.jsonl"), now);
     const workspace = opts.baseRepo !== void 0 ? new Workspace() : null;
     const spawnAgent = opts.spawnAgent ?? defaultSpawnAgent;
     return new _Crew(
@@ -10659,7 +12185,7 @@ function toAgentConfig(blueprint, cwd) {
 
 // src/smithy/knowledge/loader.ts
 import { readFile as readFile4 } from "node:fs/promises";
-import { dirname as dirname3, isAbsolute, join as join5, resolve } from "node:path";
+import { dirname as dirname4, isAbsolute, join as join6, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 var KnowledgeError = class extends Error {
   constructor(message) {
@@ -10668,21 +12194,21 @@ var KnowledgeError = class extends Error {
   }
 };
 function defaultDir() {
-  return dirname3(fileURLToPath(import.meta.url));
+  return dirname4(fileURLToPath(import.meta.url));
 }
 async function loadKnowledge(dir) {
   const root = dir ? resolve(dir) : defaultDir();
   const manifest = await readManifest(root);
   const guides = [];
   for (const entry of manifest.guides) {
-    const path2 = isAbsolute(entry.file) ? entry.file : join5(root, entry.file);
+    const path2 = isAbsolute(entry.file) ? entry.file : join6(root, entry.file);
     const body = await readGuideBody(path2, entry.id);
     guides.push({ ...entry, body });
   }
   return freezePack(manifest.version, guides);
 }
 async function readManifest(root) {
-  const path2 = join5(root, "manifest.json");
+  const path2 = join6(root, "manifest.json");
   let raw;
   try {
     raw = await readFile4(path2, "utf8");
@@ -11487,6 +13013,43 @@ var DEFAULT_SECRET_PATTERNS = Object.freeze([
     label: "private-key-block-value",
     // a PEM-armoured private key body
     value: /-----BEGIN(?:[A-Z ]+)?PRIVATE KEY-----/
+  },
+  // -----------------------------------------------------------------------
+  // MCP / Zoho MCP additions.
+  // -----------------------------------------------------------------------
+  {
+    label: "mcp-url-key-name",
+    // mcp_url, mcpUrl, mcp_url_secret, MCP_URL, ZOHO_MCP_URL, ZOHO_MCP_TOKEN, etc.
+    key: /(?:mcp[_-]?url|zoho[_-]?mcp|mcp[_-]?token)/i
+  },
+  {
+    label: "pkce-verifier-key-name",
+    // code_verifier, codeVerifier, pkce_verifier, etc.
+    key: /(?:code[_-]?verifier|pkce[_-]?verifier)/i
+  },
+  {
+    label: "mcp-server-url-value",
+    // Zoho MCP URLs — the host is enough to make the URL sensitive.
+    value: /\bhttps?:\/\/(?:[A-Za-z0-9-]+\.)*mcp\.zoho\.(?:com|in|eu|net|com\.au|jp)\b[^\s"'<>]*/i
+  },
+  // -----------------------------------------------------------------------
+  // Sarvam MCP additions.
+  // -----------------------------------------------------------------------
+  {
+    label: "sarvam-api-key-key-name",
+    // SARVAM_API_KEY, sarvamApiKey, sarvam_api_key
+    key: /sarvam[_-]?api[_-]?key/i
+  },
+  {
+    label: "sarvam-api-key-value",
+    // dashboard-issued key shape if Sarvam ever uses a prefix; fallback so
+    // SARVAM_API_KEY=<anything> gets redacted even if no key pattern matched.
+    value: /SARVAM_API_KEY\s*=\s*[^\s"'<>]+/i
+  },
+  {
+    label: "api-subscription-key-header",
+    // Sarvam's REST auth header name.
+    value: /\bapi-subscription-key\s*[:=]\s*[A-Za-z0-9._~+/-]{8,}=*\b/i
   }
 ]);
 function isContainer(value) {
@@ -11986,8 +13549,8 @@ __export(shell_app_exports, {
 
 // src/shell-app/cli.ts
 import { fileURLToPath as fileURLToPath3 } from "node:url";
-import { readFileSync, realpathSync } from "node:fs";
-import { dirname as dirname6, join as join8 } from "node:path";
+import { readFileSync as readFileSync2, realpathSync } from "node:fs";
+import { dirname as dirname7, join as join9 } from "node:path";
 
 // src/shell-app/invocation/flags.ts
 var FLAG_SPECS = [
@@ -12225,7 +13788,7 @@ async function runStages(initial2, stages) {
 
 // src/shell-app/config/locator.ts
 import { homedir } from "node:os";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 var BRAND = {
   name: "indusagi",
   configDir: ".indusagi",
@@ -12240,7 +13803,7 @@ var NodeLocator = class {
   }
   /** Join segments under the profile directory. */
   under(...segments) {
-    return join6(this.home, this.brand.configDir, ...segments);
+    return join7(this.home, this.brand.configDir, ...segments);
   }
   profileDir() {
     return this.under();
@@ -12249,7 +13812,7 @@ var NodeLocator = class {
     return this.under("settings.json");
   }
   projectSettingsPath(cwd) {
-    return join6(cwd, this.brand.configDir, "settings.json");
+    return join7(cwd, this.brand.configDir, "settings.json");
   }
   authPath() {
     return this.under("auth.json");
@@ -12419,7 +13982,7 @@ function resolveModelId(settings, invocationModel) {
 
 // src/shell-app/upgrade/upgrades.ts
 import { mkdir as mkdir4, readFile as readFile6, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname4 } from "node:path";
+import { dirname as dirname5 } from "node:path";
 var UPGRADES = [
   {
     id: "ensure-profile-dir",
@@ -12455,7 +14018,7 @@ async function readApplied(path2) {
   return new Set(parsed.filter((entry) => typeof entry === "string"));
 }
 async function writeApplied(path2, applied) {
-  await mkdir4(dirname4(path2), { recursive: true });
+  await mkdir4(dirname5(path2), { recursive: true });
   const ids = [...applied].sort();
   await writeFile2(path2, `${JSON.stringify(ids, null, 2)}
 `, "utf8");
@@ -15943,7 +17506,7 @@ function envName(suffix, brand = BRAND2) {
 
 // src/shell-app/locate/locator.ts
 import { mkdir as mkdir5 } from "node:fs/promises";
-import { dirname as dirname5, isAbsolute as isAbsolute2, join as join7, resolve as resolve2 } from "node:path";
+import { dirname as dirname6, isAbsolute as isAbsolute2, join as join8, resolve as resolve2 } from "node:path";
 import { homedir as homedir3 } from "node:os";
 var Locator = class {
   home;
@@ -15993,12 +17556,12 @@ var Locator = class {
    * is computed relative to this.
    */
   profileDir() {
-    return join7(this.home, this.brand.profileDirName);
+    return join8(this.home, this.brand.profileDirName);
   }
   // --- Settings ----------------------------------------------------------
   /** The global settings file inside the profile (e.g. `~/.indusagi/settings.json`). */
   settingsPath() {
-    return join7(this.profileDir(), this.brand.settingsFileName);
+    return join8(this.profileDir(), this.brand.settingsFileName);
   }
   /**
    * The per-project settings file for a given working directory.
@@ -16012,20 +17575,20 @@ var Locator = class {
    */
   projectSettingsPath(cwd = this.cwd) {
     const root = isAbsolute2(cwd) ? cwd : resolve2(this.cwd, cwd);
-    return join7(root, this.brand.projectDirName, this.brand.projectSettingsFileName);
+    return join8(root, this.brand.projectDirName, this.brand.projectSettingsFileName);
   }
   // --- Stores & directories ---------------------------------------------
   /** Directory holding persisted conversation sessions (e.g. `~/.indusagi/sessions`). */
   sessionsDir() {
-    return join7(this.profileDir(), this.brand.sessionsDirName);
+    return join8(this.profileDir(), this.brand.sessionsDirName);
   }
   /** The credential/auth store file inside the profile (e.g. `~/.indusagi/auth.json`). */
   authStorePath() {
-    return join7(this.profileDir(), this.brand.authStoreFileName);
+    return join8(this.profileDir(), this.brand.authStoreFileName);
   }
   /** Directory holding diagnostic and crash logs (e.g. `~/.indusagi/logs`). */
   logsDir() {
-    return join7(this.profileDir(), this.brand.logsDirName);
+    return join8(this.profileDir(), this.brand.logsDirName);
   }
   // --- I/O helpers (the only members that touch disk) -------------------
   /**
@@ -16055,7 +17618,7 @@ var Locator = class {
    * never fails on a missing directory.
    */
   async ensureParentOf(filePath) {
-    await this.ensureDir(dirname5(filePath));
+    await this.ensureDir(dirname6(filePath));
     return filePath;
   }
   /**
@@ -16132,11 +17695,11 @@ function renderUsage() {
 function resolveVersion() {
   const FALLBACK = "0.0.0";
   try {
-    const here = dirname6(fileURLToPath3(import.meta.url));
+    const here = dirname7(fileURLToPath3(import.meta.url));
     for (const up of ["..", "../..", "../../.."]) {
-      const candidate = join8(here, up, "package.json");
+      const candidate = join9(here, up, "package.json");
       try {
-        const raw = readFileSync(candidate, "utf8");
+        const raw = readFileSync2(candidate, "utf8");
         const parsed = JSON.parse(raw);
         if (typeof parsed.version === "string" && parsed.version.length > 0) {
           return parsed.version;
@@ -16570,6 +18133,8 @@ var KNOWN_PROVIDERS = [
   "azure",
   "nvidia",
   "kimi",
+  "minimax",
+  "minimax-cn",
   "ollama",
   "mock"
 ];
@@ -16637,8 +18202,10 @@ export {
   interop_exports as interop,
   runtime_exports as runtime,
   connectors_saas_exports as saas,
+  connectors_sarvam_exports as sarvamMcp,
   shell_app_exports as shell,
   smithy_exports as smithy,
   swarm_exports as swarm,
-  tracing_exports as tracing
+  tracing_exports as tracing,
+  connectors_zoho_exports as zoho
 };