openfox 2.0.110 → 2.0.112

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 2.0.112 - 2026-08-03
+
+### Bug Fixes
+
+- **Updates install again** — the postinstall script is now bundled with the release, so `openfox update` no longer fails halfway with a missing file
+
+## 2.0.111 - 2026-08-03
+
+### Enhancements
+
+- **OAuth login for MCP servers** — servers that require OAuth authorization now connect through a browser-based login flow instead of failing
+- **Manual model entry in the provider setup** — if a provider exposes no model list, type the model name directly instead of hitting a dead-end "No models found"
+- **You choose when to restart after an update** — updates download first and restart on your OK; service installs can opt into automatic restart
+- **Homepage loads faster** — the session list shows the five most recent per project up front and fills in the rest lazily
+- **Leaner session storage** — finished tool-call streaming buffers are dropped from snapshots and stale backups auto-prune after 10 days
+
+### Bug Fixes
+
+- **Tool calls no longer misread as interrupted** — an output that merely contains the interrupt marker text now shows as successful
+- **Multi-statement shell commands keep their tails** — output is no longer cut at the first line for compound commands
+- **Windows paths shorten to names again** — workspace and file names show their basename instead of the full path
+- **Auto-compaction honors configured thresholds** — the internal cap is raised from 85%, so thresholds up to 95% work as set
+- **Windows path-safety gaps closed** — dangerous commands outside the workdir are confirmed again in edge cases, including under Git Bash
+- **Choice options survive reloads** — structured choices stay stable across page refreshes
+
 ## 2.0.110 - 2026-08-02
 
 ### Bug Fixes

package/README.md

@@ -139,6 +139,7 @@ _Vision Fallback — Image processing configuration_
 | `OPENFOX_LLM_IDLE_TIMEOUT`           | `300000`                   | LLM stream idle timeout in ms                                   |
 | `OPENFOX_PORT`                       | `10369`                    | Server listen port                                              |
 | `OPENFOX_HOST`                       | `127.0.0.1`                | Server bind host                                                |
+| `OPENFOX_PUBLIC_URL`                 | —                          | Public origin used to build the MCP OAuth redirect URI          |
 | `OPENFOX_WORKDIR`                    | `cwd`                      | Working directory                                               |
 | `OPENFOX_DB_PATH`                    | `./openfox.db`             | SQLite database path                                            |
 | `OPENFOX_LOG_LEVEL`                  | `info`                     | Log level: `debug`, `info`, `warn`, `error`                     |

package/dist/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 2.0.112 - 2026-08-03
+
+### Bug Fixes
+
+- **Updates install again** — the postinstall script is now bundled with the release, so `openfox update` no longer fails halfway with a missing file
+
+## 2.0.111 - 2026-08-03
+
+### Enhancements
+
+- **OAuth login for MCP servers** — servers that require OAuth authorization now connect through a browser-based login flow instead of failing
+- **Manual model entry in the provider setup** — if a provider exposes no model list, type the model name directly instead of hitting a dead-end "No models found"
+- **You choose when to restart after an update** — updates download first and restart on your OK; service installs can opt into automatic restart
+- **Homepage loads faster** — the session list shows the five most recent per project up front and fills in the rest lazily
+- **Leaner session storage** — finished tool-call streaming buffers are dropped from snapshots and stale backups auto-prune after 10 days
+
+### Bug Fixes
+
+- **Tool calls no longer misread as interrupted** — an output that merely contains the interrupt marker text now shows as successful
+- **Multi-statement shell commands keep their tails** — output is no longer cut at the first line for compound commands
+- **Windows paths shorten to names again** — workspace and file names show their basename instead of the full path
+- **Auto-compaction honors configured thresholds** — the internal cap is raised from 85%, so thresholds up to 95% work as set
+- **Windows path-safety gaps closed** — dangerous commands outside the workdir are confirmed again in edge cases, including under Git Bash
+- **Choice options survive reloads** — structured choices stay stable across page refreshes
+
 ## 2.0.110 - 2026-08-02
 
 ### Bug Fixes

package/dist/{ask-CJMU6EW7.js → ask-ZYPCJKZD.js}

@@ -7,7 +7,8 @@ import {
   getPendingQuestionsForSession,
   hasPendingQuestion,
   provideAnswer
-} from "./chunk-JAX5OEMM.js";
+} from "./chunk-JURM3RPZ.js";
+import "./chunk-LCLH6ZUL.js";
 import "./chunk-5WRI5ZAA.js";
 export {
   AskUserInterrupt,
@@ -19,4 +20,4 @@ export {
   hasPendingQuestion,
   provideAnswer
 };
-//# sourceMappingURL=ask-CJMU6EW7.js.map
+//# sourceMappingURL=ask-ZYPCJKZD.js.map

package/dist/{chat-handler-UZ7WTT6D.js → chat-handler-BYXZIIV3.js}

@@ -2,48 +2,49 @@ import {
   buildRunChatTurnParams,
   finalizeTurnCompletion,
   generateSessionNameForSession
-} from "./chunk-VJWWJEBX.js";
+} from "./chunk-3UILDGOO.js";
 import {
   runChatTurn
-} from "./chunk-HK75Q3EA.js";
-import "./chunk-NORNB6IJ.js";
-import "./chunk-UCYPPLVR.js";
-import "./chunk-GNFDD6LN.js";
+} from "./chunk-SDGNV45R.js";
+import "./chunk-Z56SEG4Z.js";
+import "./chunk-RAKPI4OE.js";
+import "./chunk-BOSKQI62.js";
 import "./chunk-JR54MDZI.js";
-import "./chunk-5HMKLHTT.js";
+import "./chunk-XWNCKIPO.js";
 import "./chunk-33Q7LCVD.js";
-import "./chunk-C5JJM72V.js";
+import "./chunk-SVJFMZ2Q.js";
 import "./chunk-I72ACQ6R.js";
 import "./chunk-JE7LW7Y6.js";
-import "./chunk-VKWVPQJ5.js";
+import "./chunk-OAN4BXEW.js";
 import "./chunk-FR5LUTLQ.js";
 import "./chunk-J7GAZGZT.js";
-import "./chunk-WCQOHRUX.js";
-import "./chunk-PU3IPUSW.js";
+import "./chunk-JDT63SSP.js";
+import "./chunk-FFPCVN5M.js";
 import {
   getEventStore
-} from "./chunk-LXYNP7LL.js";
+} from "./chunk-NB2D6I64.js";
 import {
   createChatMessageMessage,
   createPhaseChangedMessage,
   createSessionRunningMessage
-} from "./chunk-B5MH4HQ6.js";
-import "./chunk-JAX5OEMM.js";
-import "./chunk-6EV7X5MP.js";
-import "./chunk-MM46DJJL.js";
+} from "./chunk-SYJMUIRC.js";
+import "./chunk-N4RTAGFY.js";
+import "./chunk-JURM3RPZ.js";
+import "./chunk-RISQXU32.js";
 import "./chunk-6FPGJR7O.js";
-import "./chunk-ACJNRPTO.js";
-import "./chunk-4ZXRERIW.js";
-import "./chunk-VT2X3DMC.js";
+import "./chunk-QGXLZZBS.js";
+import "./chunk-LCLH6ZUL.js";
+import "./chunk-C5NQF2K4.js";
+import "./chunk-JNHKKUGJ.js";
 import "./chunk-J2GP3J3X.js";
 import "./chunk-V4IE7HJY.js";
 import "./chunk-YHEQTVFV.js";
 import "./chunk-L737Y63F.js";
-import "./chunk-VXKPZUCT.js";
+import "./chunk-RT2A2RRL.js";
 import "./chunk-LCQ5AN6Y.js";
 import "./chunk-K44MW7JJ.js";
-import "./chunk-4R7G5JB6.js";
-import "./chunk-D6ODGTSZ.js";
+import "./chunk-P45RJGOT.js";
+import "./chunk-C372UH7N.js";
 import "./chunk-CQGTEGKL.js";
 import "./chunk-5WRI5ZAA.js";
 
@@ -166,4 +167,4 @@ export {
   startChatSession,
   stopSessionExecution
 };
-//# sourceMappingURL=chat-handler-UZ7WTT6D.js.map
+//# sourceMappingURL=chat-handler-BYXZIIV3.js.map

package/dist/{chunk-VJWWJEBX.js → chunk-3UILDGOO.js}

@@ -1,27 +1,27 @@
 import {
   combineEventsWithSnapshot,
   getEventStore
-} from "./chunk-LXYNP7LL.js";
+} from "./chunk-NB2D6I64.js";
 import {
   createContextStateMessage,
   createSessionStateMessage
-} from "./chunk-B5MH4HQ6.js";
+} from "./chunk-SYJMUIRC.js";
 import {
   getPendingQuestionsForSession
-} from "./chunk-JAX5OEMM.js";
+} from "./chunk-JURM3RPZ.js";
 import {
   buildMessagesFromStoredEvents,
   foldPendingConfirmations
-} from "./chunk-ACJNRPTO.js";
+} from "./chunk-QGXLZZBS.js";
 import {
   updateSessionMetadata
-} from "./chunk-4ZXRERIW.js";
+} from "./chunk-C5NQF2K4.js";
 import {
   getRuntimeConfig
-} from "./chunk-VT2X3DMC.js";
+} from "./chunk-JNHKKUGJ.js";
 import {
   getMaxVisibleItems
-} from "./chunk-VXKPZUCT.js";
+} from "./chunk-RT2A2RRL.js";
 import {
   logger
 } from "./chunk-K44MW7JJ.js";
@@ -153,7 +153,7 @@ async function generateSessionNameForSession(sessionId, userMessage, deps, signa
       client = deps.getLLMClient();
       client.setModel(providerConfig.model);
     } else if (providerConfig) {
-      const { createLLMClient } = await import("./client-LPNFUOPV.js");
+      const { createLLMClient } = await import("./client-QNQTX5EA.js");
       client = createLLMClient({
         llm: {
           baseUrl: providerConfig.baseUrl,
@@ -204,4 +204,4 @@ export {
   needsNameGeneration,
   generateSessionNameForSession
 };
-//# sourceMappingURL=chunk-VJWWJEBX.js.map
+//# sourceMappingURL=chunk-3UILDGOO.js.map

package/dist/{chunk-GNFDD6LN.js → chunk-BOSKQI62.js}

@@ -5,13 +5,13 @@ import {
   deleteItemFromDir,
   loadItemsFromDir,
   pathExists
-} from "./chunk-VT2X3DMC.js";
+} from "./chunk-JNHKKUGJ.js";
 import {
   SETTINGS_KEYS,
   deleteSetting,
   getSetting,
   setSetting
-} from "./chunk-VXKPZUCT.js";
+} from "./chunk-RT2A2RRL.js";
 
 // src/server/context/instructions.ts
 import { readFile, access } from "fs/promises";
@@ -440,4 +440,4 @@ export {
   deleteSkill,
   deleteProjectSkill
 };
-//# sourceMappingURL=chunk-GNFDD6LN.js.map
+//# sourceMappingURL=chunk-BOSKQI62.js.map

package/dist/{chunk-D6ODGTSZ.js → chunk-C372UH7N.js}

@@ -108,6 +108,7 @@ var mcpServerSchema = z.object({
   env: z.record(z.string(), z.string()).optional(),
   url: z.string().optional(),
   headers: z.record(z.string(), z.string()).optional(),
+  oauth: z.boolean().optional(),
   disabledTools: z.array(z.string()).optional(),
   cachedTools: z.array(cachedToolSchema).optional(),
   timeout: z.number().positive().optional(),
@@ -370,4 +371,4 @@ export {
   removeProvider,
   activateProvider
 };
-//# sourceMappingURL=chunk-D6ODGTSZ.js.map
+//# sourceMappingURL=chunk-C372UH7N.js.map

package/dist/{chunk-4ZXRERIW.js → chunk-C5NQF2K4.js}

@@ -1,6 +1,6 @@
 import {
   resolveDefaultAgentId
-} from "./chunk-VT2X3DMC.js";
+} from "./chunk-JNHKKUGJ.js";
 import {
   getDatabase
 } from "./chunk-LCQ5AN6Y.js";
@@ -245,7 +245,14 @@ function listSessions() {
   return rows.map(mapSessionSummaryRow);
 }
 function listSessionsByProject(projectId, limit = 20, offset = 0) {
+  return listSessionsPaged(projectId, limit, offset);
+}
+function listSessionsLimited(limit = 20, offset = 0) {
+  return listSessionsPaged(null, limit, offset);
+}
+function listSessionsPaged(projectId, limit, offset) {
   const db = getDatabase();
+  const where = projectId ? "WHERE s.project_id = ?" : "";
   const rows = db.prepare(
     `
     SELECT
@@ -264,15 +271,48 @@ function listSessionsByProject(projectId, limit = 20, offset = 0) {
       s.provider_model,
       s.message_count
     FROM sessions s
-    WHERE s.project_id = ?
+    ${where}
     ORDER BY s.updated_at DESC
     LIMIT ? OFFSET ?
   `
-  ).all(projectId, limit + 1, offset);
+  ).all(...projectId ? [projectId] : [], limit + 1, offset);
   const hasMore = rows.length > limit;
   const sessions = rows.slice(0, limit).map(mapSessionSummaryRow);
   return { sessions, hasMore };
 }
+function listHomeSessions(sessionsPerProject = 5) {
+  const db = getDatabase();
+  const rows = db.prepare(
+    `
+    SELECT
+      s.id,
+      s.project_id,
+      s.workdir,
+      s.workspace,
+      s.branch,
+      s.mode,
+      s.workflow_phase,
+      s.is_running,
+      s.created_at,
+      s.updated_at,
+      s.title,
+      s.provider_id,
+      s.provider_model,
+      s.message_count
+    FROM sessions s
+    ORDER BY s.updated_at DESC
+  `
+  ).all();
+  const seen = /* @__PURE__ */ new Map();
+  const result = [];
+  for (const row of rows) {
+    const count = seen.get(row.project_id) ?? 0;
+    if (count >= sessionsPerProject) continue;
+    seen.set(row.project_id, count + 1);
+    result.push(mapSessionSummaryRow(row));
+  }
+  return result;
+}
 function updateSessionWorkdir(id, workdir, workspace, branch) {
   const db = getDatabase();
   const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -360,6 +400,8 @@ export {
   getSessionMessageCount,
   listSessions,
   listSessionsByProject,
+  listSessionsLimited,
+  listHomeSessions,
   updateSessionWorkdir,
   updateSessionBranch,
   deleteSession,
@@ -368,4 +410,4 @@ export {
   getActiveWorkflowExecution,
   clearWorkflowExecution
 };
-//# sourceMappingURL=chunk-4ZXRERIW.js.map
+//# sourceMappingURL=chunk-C5NQF2K4.js.map

package/dist/{chunk-3HS72YIE.js → chunk-ERYUSG5C.js}

@@ -17,7 +17,7 @@ import {
 import {
   LLMError,
   OpenAIHttpClient
-} from "./chunk-E5HZKNTY.js";
+} from "./chunk-PCC4DBPF.js";
 import {
   logger
 } from "./chunk-K44MW7JJ.js";
@@ -310,4 +310,4 @@ function createLLMClient(config, initialBackend = "unknown") {
 export {
   createLLMClient
 };
-//# sourceMappingURL=chunk-3HS72YIE.js.map
+//# sourceMappingURL=chunk-ERYUSG5C.js.map

package/dist/{chunk-PU3IPUSW.js → chunk-FFPCVN5M.js}

@@ -1,9 +1,12 @@
 import {
   getEventStore
-} from "./chunk-LXYNP7LL.js";
+} from "./chunk-NB2D6I64.js";
 import {
   createChatPathConfirmationMessage
-} from "./chunk-B5MH4HQ6.js";
+} from "./chunk-SYJMUIRC.js";
+import {
+  getPlatformShell
+} from "./chunk-N4RTAGFY.js";
 
 // src/server/tools/path-security.ts
 import { realpath } from "fs/promises";
@@ -120,11 +123,19 @@ function looksLikeRegex(str) {
   return /[*?+[\]\\]/.test(str);
 }
 var isWindows = () => process.platform === "win32";
+function usesPosixPaths() {
+  if (process.platform !== "win32") return true;
+  return /^(?:ba|z|)sh(?:\.exe)?$/i.test(win32.basename(getPlatformShell().command));
+}
 function isWindowsAbsolutePath(str) {
   return /^[A-Za-z]:[\\/]/.test(str);
 }
 function normalizeExtracted(path) {
-  return isWindowsAbsolutePath(path) ? win32.normalize(path) : posix.normalize(path);
+  if (isWindowsAbsolutePath(path)) return win32.normalize(path);
+  if (isWindows() && /^\/[A-Za-z]\//.test(path)) {
+    return win32.normalize(`${path[1].toUpperCase()}:\\${path.slice(3)}`);
+  }
+  return posix.normalize(path);
 }
 function isPlaceholderToken(str) {
   return str.includes("__URL__") || str.includes("__FILEURL__") || str.includes("__SED__") || str.includes("__COMMIT_MSG__");
@@ -135,6 +146,7 @@ function extractAbsolutePathsFromCommand(command) {
   }
   const paths = [];
   const home = homedir();
+  const posixShell = usesPosixPaths();
   let sanitized = command.replace(/https?:\/\/[^\s'"]+/g, " __URL__ ").replace(/ftp:\/\/[^\s'"]+/g, " __URL__ ");
   sanitized = sanitized.replace(/(?<!\w)s\/[^/]*\/[^/]*\/[gip]*/g, " __SED__ ");
   sanitized = sanitized.replace(/(?<!\w)s\|[^|]*\|[^|]*\|[gip]*/g, " __SED__ ");
@@ -175,7 +187,7 @@ function extractAbsolutePathsFromCommand(command) {
       if (!isSafePath(resolved)) {
         paths.push(resolved);
       }
-    } else if (!isWindows() && content.startsWith("/")) {
+    } else if (posixShell && content.startsWith("/")) {
       const resolved = normalizeExtracted(content);
       if (!isSafePath(resolved)) {
         paths.push(resolved);
@@ -199,7 +211,8 @@ function extractAbsolutePathsFromCommand(command) {
         paths.push(resolved);
       }
     }
-  } else {
+  }
+  if (posixShell) {
     const absolutePattern = /(?:^|[\s=(])(\/[^\s"'|&;<>`()]+)/g;
     while ((match = absolutePattern.exec(sanitized)) !== null) {
       const candidate = match[1];
@@ -238,9 +251,12 @@ function extractSensitivePathsFromCommand(command) {
   }
   return [...new Set(paths)];
 }
+var WINDOWS_DEVICE_NAMES = /* @__PURE__ */ new Set(["nul", "con", "prn", "aux"]);
 function isSafePath(path) {
   const normalized = posix.normalize(path);
-  return SAFE_PATHS.has(normalized);
+  if (SAFE_PATHS.has(normalized)) return true;
+  if (!isWindows()) return false;
+  return WINDOWS_DEVICE_NAMES.has(win32.basename(path.replace(/^\\\\[.?]\\/, "")).toLowerCase());
 }
 async function checkPathsAccess(paths, workdir, sessionId) {
   if (paths.length === 0) {
@@ -274,9 +290,30 @@ var DANGEROUS_PATTERNS = [
   /dd\s+if=/,
   /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;/
 ];
+var WINDOWS_DANGEROUS_PATTERNS = [
+  /\b(?:rd|rmdir)\s+(?:\/[a-z]\s+)*\/s\b/i,
+  // rd /s /q <dir>
+  /\bdel\s+(?:\/[a-z]\s+)*\/s\b/i,
+  // del /f /s /q <pattern>
+  // The operand is a bare drive ("D:", "D:\"), never a file path — that is what
+  // keeps "npm run format -- C:\src\x.ts" out of the dangerous bucket.
+  /\bformat\s+(?:\/\S+\s+)*[a-z]:\\?(?=\s|$)/i,
+  // format D: / format /q D: / format /fs:NTFS D:
+  /\bRemove-Item\b(?=[^|;]*-Recurse\b)(?=[^|;]*-Force\b)/i,
+  // PowerShell recursive force delete (flag order-independent)
+  /\brunas\b/i,
+  // sudo equivalent
+  /\bStart-Process\b[^|;]*-Verb\s+RunAs\b/i,
+  // sudo equivalent (PowerShell)
+  /\bicacls\b[^|;]*\/grant\b[^|;]*Everyone/i,
+  // chmod 777 equivalent
+  /\bdiskpart\b/i
+  // raw disk write, dd/mkfs equivalent
+];
 function extractDangerousPatterns(command) {
+  const patterns = isWindows() ? [...DANGEROUS_PATTERNS, ...WINDOWS_DANGEROUS_PATTERNS] : DANGEROUS_PATTERNS;
   const dangerous = [];
-  for (const pattern of DANGEROUS_PATTERNS) {
+  for (const pattern of patterns) {
     if (pattern.test(command)) {
       dangerous.push(pattern.source);
     }
@@ -498,4 +535,4 @@ export {
   getConfirmationSessionId,
   getPendingConfirmationsBySession
 };
-//# sourceMappingURL=chunk-PU3IPUSW.js.map
+//# sourceMappingURL=chunk-FFPCVN5M.js.map

package/dist/{chunk-KDQJOI2I.js → chunk-FSYRANYR.js}

@@ -1,6 +1,6 @@
 import {
   createLLMClient
-} from "./chunk-3HS72YIE.js";
+} from "./chunk-ERYUSG5C.js";
 import {
   getModelProfile
 } from "./chunk-V4IE7HJY.js";
@@ -804,4 +804,4 @@ export {
   parseDefaultModelSelection,
   createProviderManager
 };
-//# sourceMappingURL=chunk-KDQJOI2I.js.map
+//# sourceMappingURL=chunk-FSYRANYR.js.map

package/dist/chunk-IJ53Y77N.js

@@ -0,0 +1,142 @@
+import {
+  logger
+} from "./chunk-K44MW7JJ.js";
+import {
+  getGlobalConfigDir
+} from "./chunk-CQGTEGKL.js";
+
+// src/server/mcp/oauth-store.ts
+import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
+import { dirname, join } from "path";
+var storeMode = "production";
+var storePathOverride;
+function setMcpOAuthStoreMode(mode) {
+  storeMode = mode;
+}
+function setMcpOAuthStorePath(path) {
+  storePathOverride = path;
+}
+function getMcpOAuthStorePath() {
+  return storePathOverride ?? join(getGlobalConfigDir(storeMode), "mcp-auth.json");
+}
+async function readStore() {
+  const path = getMcpOAuthStorePath();
+  let raw;
+  try {
+    raw = await readFile(path, "utf-8");
+  } catch {
+    return { version: 1, servers: {} };
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    const servers = parsed.servers;
+    if (!servers || typeof servers !== "object") throw new Error("no servers object");
+    const kept = {};
+    for (const [name, entry] of Object.entries(servers)) {
+      if (entry && typeof entry === "object" && typeof entry.serverUrl === "string") {
+        kept[name] = entry;
+      } else {
+        logger.warn("Dropping an unreadable MCP OAuth entry, this server will have to authorize again", {
+          path,
+          server: name
+        });
+      }
+    }
+    return { version: 1, servers: kept };
+  } catch {
+    logger.error("The MCP OAuth store is unreadable, stored authorizations will be ignored", { path });
+    return { version: 1, servers: {} };
+  }
+}
+async function writeStore(store) {
+  const path = getMcpOAuthStorePath();
+  await mkdir(dirname(path), { recursive: true });
+  const tmpPath = `${path}.tmp`;
+  await writeFile(tmpPath, JSON.stringify(store, null, 2), { mode: 384 });
+  try {
+    await chmod(tmpPath, 384);
+  } catch {
+    logger.warn("Could not restrict permissions on the MCP OAuth store", { path });
+  }
+  await rename(tmpPath, path);
+}
+var writeQueue = Promise.resolve();
+function serialize(work) {
+  const result = writeQueue.then(work, work);
+  writeQueue = result.catch(() => void 0);
+  return result;
+}
+async function mutateEntry(name, serverUrl, mutate) {
+  await serialize(async () => {
+    const store = await readStore();
+    const current = store.servers[name];
+    const base = current && current.serverUrl === serverUrl ? current : { serverUrl };
+    store.servers[name] = mutate(base);
+    await writeStore(store);
+  });
+}
+function withoutAuthorizationState(entry) {
+  const next = { serverUrl: entry.serverUrl };
+  if (entry.clientInformation) next.clientInformation = entry.clientInformation;
+  if (entry.tokens) next.tokens = entry.tokens;
+  return next;
+}
+async function readMcpOAuthEntry(name, serverUrl) {
+  const store = await readStore();
+  const entry = store.servers[name];
+  if (!entry || entry.serverUrl !== serverUrl) return void 0;
+  return entry;
+}
+async function saveMcpOAuthClientInformation(name, serverUrl, clientInformation) {
+  await mutateEntry(name, serverUrl, (entry) => ({ ...entry, clientInformation }));
+}
+async function saveMcpOAuthTokens(name, serverUrl, tokens) {
+  await mutateEntry(name, serverUrl, (entry) => ({ ...withoutAuthorizationState(entry), tokens }));
+}
+async function saveMcpOAuthCodeVerifier(name, serverUrl, codeVerifier) {
+  await mutateEntry(name, serverUrl, (entry) => ({ ...entry, codeVerifier }));
+}
+async function saveMcpOAuthState(name, serverUrl, state) {
+  await mutateEntry(name, serverUrl, (entry) => ({ ...entry, state }));
+}
+async function clearMcpOAuthTokens(name, serverUrl) {
+  await mutateEntry(name, serverUrl, (entry) => {
+    const next = withoutAuthorizationState(entry);
+    delete next.tokens;
+    return next;
+  });
+}
+async function clearMcpOAuthAuthorizationState(name, serverUrl) {
+  await mutateEntry(name, serverUrl, withoutAuthorizationState);
+}
+async function clearMcpOAuthEntry(name) {
+  await serialize(async () => {
+    const store = await readStore();
+    if (!(name in store.servers)) return;
+    delete store.servers[name];
+    await writeStore(store);
+  });
+}
+async function findMcpOAuthEntryByState(state) {
+  const store = await readStore();
+  for (const [name, entry] of Object.entries(store.servers)) {
+    if (entry.state && entry.state === state) return { name, entry };
+  }
+  return null;
+}
+
+export {
+  setMcpOAuthStoreMode,
+  setMcpOAuthStorePath,
+  getMcpOAuthStorePath,
+  readMcpOAuthEntry,
+  saveMcpOAuthClientInformation,
+  saveMcpOAuthTokens,
+  saveMcpOAuthCodeVerifier,
+  saveMcpOAuthState,
+  clearMcpOAuthTokens,
+  clearMcpOAuthAuthorizationState,
+  clearMcpOAuthEntry,
+  findMcpOAuthEntryByState
+};
+//# sourceMappingURL=chunk-IJ53Y77N.js.map