indusagi 0.13.6 → 0.13.8

package/dist/mcp.js

@@ -1,8 +1,23 @@
+var __defProp = Object.defineProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
 // src/facade/mcp-core/client.ts
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
+import {
+  UnauthorizedError
+} from "@modelcontextprotocol/sdk/client/auth.js";
 import {
   ListRootsRequestSchema,
   ElicitRequestSchema,
@@ -204,11 +219,90 @@ var MCPClient = class {
       this.log("debug", "Transport closed");
       prevOnClose?.();
     };
-    await client.connect(transport, { timeout: DEFAULT_CONNECT_TIMEOUT });
+    try {
+      await client.connect(transport, { timeout: DEFAULT_CONNECT_TIMEOUT });
+    } catch (err) {
+      const recovered = await this.tryFinishOAuthAndReconnect(client, transport, err);
+      if (!recovered) {
+        throw this.wrapConnectError(err);
+      }
+    }
     this.serverCapabilities = client.getServerCapabilities();
     this.isConnected = true;
     this.log("info", `Connected to MCP server`);
   }
+  /**
+   * If `err` is an OAuth challenge and we have a provider + finishAuth-capable
+   * transport, wait for the browser code, exchange tokens, then reconnect on a
+   * **fresh** transport (the first transport is already `start()`ed and cannot
+   * be reused — see StreamableHTTPClientTransport.start).
+   *
+   * Matches the official SDK CLI example (`simpleOAuthClient`):
+   *   finishAuth(code) → new StreamableHTTPClientTransport → client.connect again
+   *
+   * Client.connect already called `close()` on init failure, so the Client is
+   * free to attach a new transport.
+   */
+  async tryFinishOAuthAndReconnect(client, transport, err) {
+    if (!isAuthRequiredError(err)) return false;
+    const provider = this.options.authProvider;
+    if (!provider) return false;
+    const finishAuth = transport.finishAuth;
+    const waitForCode = provider.waitForAuthorizationCode;
+    if (typeof finishAuth !== "function" || typeof waitForCode !== "function") {
+      this.log(
+        "error",
+        "MCP server requires authentication but OAuth finish path is incomplete (need authProvider.waitForAuthorizationCode + transport.finishAuth)."
+      );
+      return false;
+    }
+    this.log("info", "MCP server requires OAuth \u2014 complete login in the browser\u2026");
+    try {
+      const code = await waitForCode.call(provider);
+      this.log("info", "OAuth authorization code received \u2014 exchanging tokens\u2026");
+      await finishAuth.call(transport, code);
+      try {
+        await transport.close?.();
+      } catch {
+      }
+      const fresh = this.createTransport(this.config);
+      this.transport = fresh;
+      const prevOnClose = fresh.onclose;
+      fresh.onclose = () => {
+        this.isConnected = false;
+        this.log("debug", "Transport closed");
+        prevOnClose?.();
+      };
+      this.log("info", "Reconnecting MCP session with OAuth tokens\u2026");
+      await client.connect(fresh, { timeout: DEFAULT_CONNECT_TIMEOUT });
+      return true;
+    } catch (oauthErr) {
+      this.log(
+        "error",
+        `OAuth finish failed: ${oauthErr instanceof Error ? oauthErr.message : String(oauthErr)}`
+      );
+      throw this.wrapConnectError(oauthErr);
+    }
+  }
+  /** Turn raw SDK / network errors into a clearer MCPError for callers. */
+  wrapConnectError(err) {
+    if (err instanceof MCPError) return err;
+    const message = err instanceof Error ? err.message : String(err);
+    if (isAuthRequiredError(err)) {
+      return new MCPError(
+        `Authentication required for MCP server "${this.serverName}". Pass auth: "auto" (default) to run the OAuth browser flow, or set a Bearer token via headers. Original: ${message}`,
+        "CONNECTION_FAILED" /* CONNECTION_FAILED */,
+        err,
+        { serverName: this.serverName, cause: err instanceof Error ? err : void 0 }
+      );
+    }
+    return new MCPError(
+      `Failed to connect to MCP server "${this.serverName}": ${message}`,
+      "CONNECTION_FAILED" /* CONNECTION_FAILED */,
+      err,
+      { serverName: this.serverName, cause: err instanceof Error ? err : void 0 }
+    );
+  }
   /**
    * Build the SDK transport for the configured server.
    *
@@ -230,9 +324,15 @@ var MCPClient = class {
     if ("url" in config) {
       const requestInit = config.headers ? { headers: config.headers } : void 0;
       if (config.transport === "sse") {
-        return new SSEClientTransport(config.url, { requestInit });
+        return new SSEClientTransport(config.url, {
+          requestInit,
+          ...this.options.authProvider ? { authProvider: this.options.authProvider } : {}
+        });
       }
-      return new StreamableHTTPClientTransport(config.url, { requestInit });
+      return new StreamableHTTPClientTransport(config.url, {
+        requestInit,
+        ...this.options.authProvider ? { authProvider: this.options.authProvider } : {}
+      });
     }
     throw new MCPError(
       "Server configuration must include either a command or a url",
@@ -604,6 +704,22 @@ function mapToSdkElicitResult(result) {
   }
   return { action: result.action };
 }
+function isAuthRequiredError(err) {
+  if (err == null) return false;
+  if (err instanceof UnauthorizedError) return true;
+  if (typeof err === "object") {
+    const code = err.code;
+    if (code === 401 || code === "401") return true;
+  }
+  if (err instanceof Error) {
+    const msg = err.message;
+    if (/unauthorized/i.test(msg)) return true;
+    if (/authentication required/i.test(msg)) return true;
+    if (/auth required/i.test(msg)) return true;
+    if (err.name === "UnauthorizedError") return true;
+  }
+  return false;
+}
 function sanitizeEnv(env) {
   const out = {};
   for (const [k, v] of Object.entries(env)) {
@@ -1322,6 +1438,697 @@ function createMCPToolsRecord(tools, client) {
   return toolRecord;
 }
 
+// src/capabilities/kernel/spec.ts
+function coerceInput(raw) {
+  if (typeof raw === "string") {
+    const trimmed = raw.trim();
+    if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+      try {
+        return JSON.parse(trimmed);
+      } catch {
+      }
+    }
+    return raw;
+  }
+  if (raw === null || raw === void 0) {
+    return {};
+  }
+  return raw;
+}
+function describeThrow(err) {
+  if (err instanceof Error) return err.message;
+  if (typeof err === "string") return err;
+  try {
+    return JSON.stringify(err);
+  } catch {
+    return String(err);
+  }
+}
+function projectOutcome(id, result) {
+  const blocks = result.content;
+  let output;
+  if (blocks.length === 1) {
+    const only = blocks[0];
+    output = only.kind === "text" ? only.text : only.value;
+  } else {
+    output = blocks;
+  }
+  return { id, output, isError: result.isError === true };
+}
+function defineTool(spec) {
+  return {
+    name: spec.name,
+    // Facade `AgentTool` surface: top-level schema fields + an `execute` adapter
+    // so the tool is usable by the high-level `Agent` as well as the kernel.
+    label: spec.name,
+    description: spec.description,
+    parameters: spec.parameters,
+    async execute(_toolCallId, params, signal) {
+      const ctx = {
+        cwd: process.cwd(),
+        signal: signal ?? new AbortController().signal
+      };
+      try {
+        const result = await spec.run(coerceInput(params), ctx);
+        return {
+          content: result.content.map(
+            (block) => block.kind === "text" ? { type: "text", text: block.text } : { type: "text", text: JSON.stringify(block.value) }
+          ),
+          details: {},
+          isError: result.isError ?? false
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: `${spec.name} did not finish: ${describeThrow(err)}` }],
+          details: {},
+          isError: true
+        };
+      }
+    },
+    descriptor() {
+      return {
+        name: spec.name,
+        description: spec.description,
+        parameters: spec.parameters
+      };
+    },
+    async invoke(call, ctx) {
+      if (ctx.signal.aborted) {
+        return {
+          id: call.id,
+          output: `Cancelled before ${spec.name} could begin.`,
+          isError: true
+        };
+      }
+      try {
+        const input = coerceInput(call.input);
+        const result = await spec.run(input, ctx);
+        return projectOutcome(call.id, result);
+      } catch (err) {
+        return {
+          id: call.id,
+          output: `${spec.name} did not finish: ${describeThrow(err)}`,
+          isError: true
+        };
+      }
+    }
+  };
+}
+
+// src/facade/mcp-core/toolbox-bridge.ts
+var NOOP_FS_NOT_SUPPORTED = "not supported in MCP-wrapped tools";
+var noopFs = {
+  readFile: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  },
+  writeFile: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  },
+  stat: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  },
+  readdir: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  },
+  mkdir: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  },
+  rm: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  },
+  exists: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  }
+};
+var noopShell = {
+  exec: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  },
+  spawn: () => {
+    throw new MCPError(NOOP_FS_NOT_SUPPORTED, "CONFIG_ERROR");
+  }
+};
+function makeToolContext(signal) {
+  return {
+    cwd: process.cwd(),
+    fs: noopFs,
+    shell: noopShell,
+    signal,
+    budget: { kind: "tail", maxBytes: 5e4 }
+  };
+}
+function describeThrow2(err) {
+  if (err instanceof Error) return err.message;
+  if (typeof err === "string") return err;
+  try {
+    return JSON.stringify(err);
+  } catch {
+    return String(err);
+  }
+}
+function projectMcpResult(result, logger) {
+  const blocks = [];
+  if (result.content && result.content.length > 0) {
+    for (const block of result.content) {
+      if (block.type === "text") {
+        blocks.push({ kind: "text", text: block.text });
+      } else if (block.type === "image") {
+        const len = typeof block.data === "string" ? block.data.length : 0;
+        blocks.push({ kind: "text", text: `[image ${block.mimeType}, ${len} chars base64]` });
+        logger?.debug(`mcp bridge: image block collapsed to text mention (${block.mimeType})`);
+      } else if (block.type === "resource") {
+        blocks.push({ kind: "text", text: `[resource ${block.resource.uri}]` });
+      } else {
+        blocks.push({ kind: "text", text: "[unknown content block]" });
+      }
+    }
+  }
+  if (result.structuredContent !== void 0) {
+    blocks.push({ kind: "json", value: result.structuredContent });
+  }
+  const content = blocks.length > 0 ? blocks : [{ kind: "text", text: "(no content)" }];
+  return {
+    content,
+    ...result.isError === true ? { isError: true } : {}
+  };
+}
+function makeRunner(client, remoteName, logger) {
+  return async (input, ctx) => {
+    if (ctx.signal.aborted) {
+      return {
+        content: [{ kind: "text", text: "Cancelled before tool could start." }],
+        isError: true
+      };
+    }
+    try {
+      const args = input ?? {};
+      const result = await client.callTool(remoteName, args);
+      return projectMcpResult(result, logger);
+    } catch (err) {
+      const wrapped = err instanceof MCPError ? err : createServerError(describeThrow2(err), client.serverName);
+      logger?.error(`mcp bridge: tool "${remoteName}" failed: ${wrapped.message}`, wrapped);
+      return {
+        content: [{ kind: "text", text: `MCP tool failed: ${wrapped.message}` }],
+        isError: true
+      };
+    }
+  };
+}
+async function mcpClientToToolBox(client, options = {}) {
+  const prefix = options.namePrefix ?? "mcp";
+  const logger = options.logger;
+  const tools = await client.listTools();
+  const filtered = typeof options.filter === "function" ? tools.filter((t) => options.filter(t)) : tools;
+  const byName = /* @__PURE__ */ new Map();
+  for (const tool of filtered) {
+    const remoteName = tool.name;
+    const prefixed = `${prefix}__${remoteName}`;
+    const description = tool.description && tool.description.length > 0 ? tool.description : `<tool "${remoteName}" from MCP server "${client.serverName}">`;
+    const parameters = tool.inputSchema;
+    const def = defineTool({
+      name: prefixed,
+      description,
+      parameters,
+      run: makeRunner(client, remoteName, logger)
+    });
+    byName.set(prefixed, def);
+  }
+  const runner = {
+    async run(call, signal) {
+      const def = byName.get(call.name);
+      if (!def) {
+        return {
+          id: call.id,
+          output: `No tool "${call.name}" on MCP server "${client.serverName}".`,
+          isError: true
+        };
+      }
+      return def.invoke(call, makeToolContext(signal));
+    }
+  };
+  return {
+    descriptors() {
+      return Array.from(byName.values()).map((d) => d.descriptor());
+    },
+    runner
+  };
+}
+
+// src/facade/mcp-core/oauth/index.ts
+var oauth_exports = {};
+__export(oauth_exports, {
+  auth: () => auth,
+  clearMcpOAuthState: () => clearMcpOAuthState,
+  createMcpOAuthProvider: () => createMcpOAuthProvider,
+  credentialsPath: () => credentialsPath,
+  discoverOAuthServerInfo: () => discoverOAuthServerInfo,
+  exchangeAuthorization: () => exchangeAuthorization,
+  extractWWWAuthenticateParams: () => extractWWWAuthenticateParams,
+  openBrowser: () => openBrowser,
+  readMcpOAuthState: () => readMcpOAuthState,
+  refreshAuthorization: () => refreshAuthorization,
+  registerClient: () => registerClient,
+  resolveCredentialsDir: () => resolveCredentialsDir,
+  startAuthorization: () => startAuthorization,
+  startOAuthCallbackServer: () => startOAuthCallbackServer,
+  waitForAuthorizationCode: () => waitForAuthorizationCode,
+  writeMcpOAuthState: () => writeMcpOAuthState
+});
+
+// src/facade/mcp-core/oauth/flow.ts
+import { createServer } from "node:http";
+var CALLBACK_TIMEOUT_MS = 5 * 60 * 1e3;
+var SUCCESS_HTML = '<!doctype html><html><body style="font-family:system-ui;padding:2rem"><h1>Authorization complete</h1><p>You can close this tab and return to your terminal.</p></body></html>';
+var ERROR_HTML = (msg) => `<!doctype html><html><body style="font-family:system-ui;padding:2rem"><h1>Authorization failed</h1><pre>${escapeHtml(msg)}</pre></body></html>`;
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+async function startOAuthCallbackServer(options) {
+  const timeoutMs = options?.timeoutMs ?? CALLBACK_TIMEOUT_MS;
+  const logger = options?.logger;
+  let settled = false;
+  let timer;
+  let resolveCode;
+  let rejectCode;
+  const codePromise = new Promise((res, rej) => {
+    resolveCode = res;
+    rejectCode = rej;
+  });
+  codePromise.catch(() => {
+  });
+  let expectedState;
+  const clearTimer = () => {
+    if (timer !== void 0) {
+      clearTimeout(timer);
+      timer = void 0;
+    }
+  };
+  const settleReject = (err) => {
+    if (settled) return;
+    settled = true;
+    clearTimer();
+    try {
+      server.close();
+    } catch {
+    }
+    rejectCode(err);
+  };
+  const settleResolve = (code) => {
+    if (settled) return;
+    settled = true;
+    clearTimer();
+    resolveCode(code);
+    setTimeout(() => {
+      try {
+        server.close();
+      } catch {
+      }
+    }, 50);
+  };
+  const server = createServer((req, res) => {
+    if (settled) {
+      res.statusCode = 410;
+      res.end("already used");
+      return;
+    }
+    handleRequest(
+      req,
+      res,
+      expectedState,
+      (code) => settleResolve(code),
+      (err) => settleReject(err),
+      logger
+    );
+  });
+  await new Promise((resolveListen, rejectListen) => {
+    server.once("error", rejectListen);
+    server.listen(0, "127.0.0.1", () => resolveListen());
+  });
+  const address = server.address();
+  if (!address) {
+    server.close();
+    throw new Error("oauth-callback: server bound to no address");
+  }
+  const port = address.port;
+  const redirectUri = `http://127.0.0.1:${port}/callback`;
+  const close = () => {
+    if (!settled) {
+      settleReject(new Error("oauth-callback: closed before browser login completed"));
+    } else {
+      clearTimer();
+      try {
+        server.close();
+      } catch {
+      }
+    }
+  };
+  return {
+    redirectUri,
+    port,
+    waitForCode(state) {
+      expectedState = state;
+      logger?.debug(`oauth-callback: waiting for browser at ${redirectUri}`);
+      if (!settled && timer === void 0) {
+        timer = setTimeout(() => {
+          settleReject(
+            new Error(
+              `oauth-callback: timed out after ${timeoutMs}ms waiting for browser login at ${redirectUri}`
+            )
+          );
+        }, timeoutMs);
+        timer.unref();
+      }
+      return codePromise;
+    },
+    close
+  };
+}
+async function waitForAuthorizationCode(expectedState, options) {
+  const server = await startOAuthCallbackServer(options);
+  const code = await server.waitForCode(expectedState);
+  return {
+    code,
+    redirectUri: server.redirectUri,
+    port: server.port,
+    close: () => server.close()
+  };
+}
+function handleRequest(req, res, expectedState, onCode, onError, logger) {
+  const url = new URL(req.url ?? "/", "http://127.0.0.1");
+  if (url.pathname !== "/callback") {
+    if (url.pathname === "/favicon.ico") {
+      res.statusCode = 404;
+      res.end();
+      return;
+    }
+    res.statusCode = 404;
+    res.end("not found");
+    return;
+  }
+  const errorParam = url.searchParams.get("error");
+  if (errorParam) {
+    const desc = url.searchParams.get("error_description") ?? "";
+    logger?.warn(`oauth-callback: server returned error ${errorParam} ${desc}`);
+    res.statusCode = 400;
+    res.setHeader("content-type", "text/html; charset=utf-8");
+    res.end(ERROR_HTML(`${errorParam}${desc ? ": " + desc : ""}`));
+    onError(new Error(`OAuth provider returned error: ${errorParam}${desc ? " \u2014 " + desc : ""}`));
+    return;
+  }
+  const code = url.searchParams.get("code");
+  const state = url.searchParams.get("state");
+  if (!code) {
+    res.statusCode = 400;
+    res.setHeader("content-type", "text/html; charset=utf-8");
+    res.end(ERROR_HTML("missing code"));
+    return;
+  }
+  if (expectedState && state && state !== expectedState) {
+    res.statusCode = 400;
+    res.setHeader("content-type", "text/html; charset=utf-8");
+    res.end(ERROR_HTML("state mismatch \u2014 possible CSRF"));
+    onError(new Error("OAuth callback state did not match \u2014 refusing to exchange code"));
+    return;
+  }
+  res.statusCode = 200;
+  res.setHeader("content-type", "text/html; charset=utf-8");
+  res.end(SUCCESS_HTML);
+  logger?.debug(`oauth-callback: received authorization code (${code.length} chars)`);
+  onCode(code);
+}
+async function openBrowser(url) {
+  try {
+    const mod = await import("node:child_process").catch(() => null);
+    if (!mod) return false;
+    const cmd = platformOpenCommand(url);
+    if (!cmd) return false;
+    const child = mod.spawn(cmd.cmd, cmd.args, { detached: true, stdio: "ignore" });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+function platformOpenCommand(url) {
+  switch (process.platform) {
+    case "darwin":
+      return { cmd: "open", args: [url] };
+    case "win32":
+      return { cmd: "rundll32", args: ["url.dll,FileProtocolHandler", url] };
+    default:
+      return { cmd: "xdg-open", args: [url] };
+  }
+}
+
+// src/facade/mcp-core/oauth/token-store.ts
+import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, join as join2 } from "node:path";
+function defaultCredentialsDir() {
+  const xdg = process.env.XDG_CONFIG_HOME;
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
+  if (xdg && xdg.length > 0) return join2(xdg, "indusagi", "credentials", "mcp");
+  if (home.length > 0) return join2(home, ".config", "indusagi", "credentials", "mcp");
+  return join2(process.cwd(), ".indusagi", "credentials", "mcp");
+}
+function resolveCredentialsDir(override) {
+  return override && override.length > 0 ? override : defaultCredentialsDir();
+}
+function credentialsPath(credentialsDir, id) {
+  const safe = id.replace(/[^a-zA-Z0-9._-]/g, "-");
+  return join2(credentialsDir, `${safe}.json`);
+}
+function readMcpOAuthState(credentialsDir, id) {
+  const path = credentialsPath(credentialsDir, id);
+  if (!existsSync2(path)) return void 0;
+  let raw;
+  try {
+    raw = readFileSync2(path, "utf8");
+  } catch (e) {
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    return void 0;
+  }
+  if (typeof parsed !== "object" || parsed === null) return void 0;
+  return { id, updatedAt: Date.now(), ...parsed };
+}
+function writeMcpOAuthState(credentialsDir, state) {
+  const path = credentialsPath(credentialsDir, state.id);
+  mkdirSync2(dirname2(path), { recursive: true });
+  const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
+  const json = JSON.stringify({ ...state, updatedAt: Date.now() }, null, 2);
+  writeFileSync2(tmp, json, { mode: 384 });
+  renameSync(tmp, path);
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+}
+function clearMcpOAuthState(credentialsDir, id) {
+  const path = credentialsPath(credentialsDir, id);
+  try {
+    const fs = __require("node:fs");
+    fs.rmSync(path, { force: true });
+  } catch {
+  }
+}
+
+// src/facade/mcp-core/oauth/provider.ts
+function randomState() {
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function toSdkTokens(t) {
+  return {
+    access_token: t.access_token,
+    refresh_token: t.refresh_token,
+    scope: t.scope,
+    token_type: t.token_type ?? "Bearer",
+    expires_in: t.expires_at !== void 0 ? Math.max(0, Math.floor((t.expires_at - Date.now()) / 1e3)) : void 0
+  };
+}
+function toSdkClientInfo(c) {
+  return {
+    client_id: c.client_id,
+    client_secret: c.client_secret,
+    client_id_issued_at: c.client_id_issued_at,
+    client_secret_expires_at: c.client_secret_expires_at
+  };
+}
+async function createMcpOAuthProvider(config) {
+  const credentialsDir = resolveCredentialsDir(config.credentialsDir);
+  const openBrowserEnabled = config.openBrowser ?? Boolean(process.env.CI !== "true" && process.stdout.isTTY);
+  let callback;
+  let redirectUrl;
+  if (config.redirectUrl) {
+    redirectUrl = config.redirectUrl;
+  } else {
+    callback = await startOAuthCallbackServer({
+      logger: config.logger ? { debug: config.logger.debug, warn: config.logger.warn } : void 0
+    });
+    redirectUrl = callback.redirectUri;
+  }
+  const clientMetadata = {
+    client_name: config.clientMetadata?.client_name ?? "indusagi-mcp-client",
+    client_uri: config.clientMetadata?.client_uri,
+    logo_uri: config.clientMetadata?.logo_uri,
+    contacts: config.clientMetadata?.contacts ? [...config.clientMetadata.contacts] : void 0,
+    tos_uri: config.clientMetadata?.tos_uri,
+    policy_uri: config.clientMetadata?.policy_uri,
+    redirect_uris: config.clientMetadata?.redirect_uris ? [...config.clientMetadata.redirect_uris] : [redirectUrl],
+    token_endpoint_auth_method: config.clientMetadata?.token_endpoint_auth_method ?? "none",
+    grant_types: config.clientMetadata?.grant_types ? [...config.clientMetadata.grant_types] : ["authorization_code", "refresh_token"],
+    response_types: config.clientMetadata?.response_types ? [...config.clientMetadata.response_types] : ["code"],
+    scope: config.clientMetadata?.scope
+  };
+  let lastAuthUrl;
+  let lastState;
+  let pendingCode;
+  const provider = {
+    id: config.id,
+    credentialsDir,
+    redirectUrl,
+    get clientMetadata() {
+      return clientMetadata;
+    },
+    state() {
+      const s = randomState();
+      lastState = s;
+      return s;
+    },
+    clientInformation() {
+      const state = readMcpOAuthState(credentialsDir, config.id);
+      return state?.client ? toSdkClientInfo(state.client) : void 0;
+    },
+    saveClientInformation(client) {
+      const state = readMcpOAuthState(credentialsDir, config.id) ?? {
+        id: config.id,
+        updatedAt: Date.now()
+      };
+      writeMcpOAuthState(credentialsDir, {
+        ...state,
+        client: {
+          client_id: client.client_id,
+          client_secret: client.client_secret,
+          client_id_issued_at: client.client_id_issued_at,
+          client_secret_expires_at: client.client_secret_expires_at
+        }
+      });
+    },
+    tokens() {
+      const state = readMcpOAuthState(credentialsDir, config.id);
+      return state?.tokens ? toSdkTokens(state.tokens) : void 0;
+    },
+    saveTokens(tokens) {
+      const state = readMcpOAuthState(credentialsDir, config.id) ?? {
+        id: config.id,
+        updatedAt: Date.now()
+      };
+      writeMcpOAuthState(credentialsDir, {
+        ...state,
+        tokens: {
+          access_token: tokens.access_token,
+          refresh_token: tokens.refresh_token,
+          scope: tokens.scope,
+          token_type: tokens.token_type,
+          expires_at: tokens.expires_in !== void 0 ? Date.now() + Math.trunc(tokens.expires_in) * 1e3 : void 0
+        }
+      });
+    },
+    async redirectToAuthorization(authorizationUrl) {
+      const url = authorizationUrl.toString();
+      lastAuthUrl = url;
+      try {
+        lastState = new URL(url).searchParams.get("state") ?? lastState;
+      } catch {
+      }
+      const prompt = `oauth: open this URL in your browser to authorize Zoho MCP:
+  ${url}`;
+      config.logger?.info?.(prompt);
+      config.logger?.debug?.(prompt);
+      console.error(`
+[zoho oauth] Authorize in browser:
+  ${url}
+`);
+      let opened = false;
+      if (openBrowserEnabled) opened = await openBrowser(url);
+      if (!opened) {
+        const tip = "oauth: could not auto-open browser. Visit the URL above manually.";
+        config.logger?.info?.(tip);
+        config.logger?.debug?.(tip);
+        console.error(`[zoho oauth] ${tip}`);
+      } else {
+        config.logger?.debug?.("oauth: browser open launched");
+      }
+    },
+    saveCodeVerifier(verifier) {
+      const state = readMcpOAuthState(credentialsDir, config.id) ?? {
+        id: config.id,
+        updatedAt: Date.now()
+      };
+      writeMcpOAuthState(credentialsDir, { ...state, codeVerifier: verifier });
+    },
+    codeVerifier() {
+      const state = readMcpOAuthState(credentialsDir, config.id);
+      const verifier = state?.codeVerifier;
+      if (!verifier) throw new Error("No PKCE code verifier saved");
+      return verifier;
+    },
+    invalidateCredentials(scope) {
+      if (scope === "all") {
+        clearMcpOAuthState(credentialsDir, config.id);
+        return;
+      }
+      const state = readMcpOAuthState(credentialsDir, config.id);
+      if (!state) return;
+      const next = { ...state };
+      if (scope === "tokens" || scope === "verifier") next.tokens = void 0;
+      if (scope === "verifier") next.codeVerifier = void 0;
+      if (scope === "discovery") {
+        next.resourceMetadata = void 0;
+        next.authServerMetadata = void 0;
+      }
+      writeMcpOAuthState(credentialsDir, next);
+    },
+    async waitForAuthorizationCode() {
+      if (pendingCode) return pendingCode;
+      if (!callback) {
+        throw new Error(
+          "oauth: no local callback server (custom redirectUrl set). Pass the authorization code via finishAuth yourself."
+        );
+      }
+      config.logger?.info("oauth: waiting for browser authorization\u2026");
+      console.error("[zoho oauth] Waiting for browser authorization\u2026");
+      const code = await callback.waitForCode(lastState);
+      pendingCode = code;
+      return code;
+    },
+    dispose() {
+      callback?.close();
+      callback = void 0;
+    },
+    lastAuthorizationUrl() {
+      return lastAuthUrl;
+    }
+  };
+  return provider;
+}
+
+// src/facade/mcp-core/oauth/index.ts
+import {
+  auth,
+  discoverOAuthServerInfo,
+  startAuthorization,
+  exchangeAuthorization,
+  refreshAuthorization,
+  registerClient,
+  extractWWWAuthenticateParams
+} from "@modelcontextprotocol/sdk/client/auth.js";
+
 // src/facade/mcp-core/server.ts
 var MCPServer = class {
   constructor(options) {
@@ -1632,6 +2439,8 @@ export {
   isSessionError,
   jsonSchemaToTypeBox,
   loadMCPConfig,
+  mcpClientToToolBox,
+  oauth_exports as oauth,
   registerMCPToolsInRegistry,
   saveConfig,
   saveProjectConfig,