openfox 2.0.110 → 2.0.112

package/dist/{chunk-ZJW3KOII.js → chunk-IYTDCPEQ.js}

@@ -1,3 +1,11 @@
+import {
+  McpOAuthProvider,
+  setMcpOAuthServerPort
+} from "./chunk-RSB4AR2A.js";
+import {
+  setMcpOAuthStoreMode,
+  setMcpOAuthStorePath
+} from "./chunk-IJ53Y77N.js";
 import {
   TEMPLATE_VARIABLES,
   createWebSocketServer,
@@ -21,7 +29,7 @@ import {
   tokenFromPassword,
   verifyPassword,
   workflowExists
-} from "./chunk-4HIFB7F5.js";
+} from "./chunk-XCK5IBO4.js";
 import {
   openFolder
 } from "./chunk-WLJJRX22.js";
@@ -34,7 +42,7 @@ import {
   setMcpManagerForTools,
   setMcpTools,
   setNotifyMcpServersChanged
-} from "./chunk-UCYPPLVR.js";
+} from "./chunk-RAKPI4OE.js";
 import {
   deleteOwnedSkill,
   deleteProjectSkill,
@@ -53,12 +61,12 @@ import {
   setSkillEnabled,
   skillExists,
   updateOwnedSkill
-} from "./chunk-GNFDD6LN.js";
+} from "./chunk-BOSKQI62.js";
 import {
   ALWAYS_ALLOWED,
   ALWAYS_ALLOWED_FOR_SUBAGENTS,
   TOP_LEVEL_ONLY_TOOLS
-} from "./chunk-5HMKLHTT.js";
+} from "./chunk-XWNCKIPO.js";
 import {
   createMcpTools
 } from "./chunk-JE7LW7Y6.js";
@@ -81,7 +89,7 @@ import {
 import {
   getSessionDisabledServers,
   setSessionDisabledServers
-} from "./chunk-WCQOHRUX.js";
+} from "./chunk-JDT63SSP.js";
 import {
   emitAssistantMessageStart,
   emitContextState,
@@ -98,24 +106,24 @@ import {
   getEventStore,
   getSessionState,
   initEventStore
-} from "./chunk-LXYNP7LL.js";
+} from "./chunk-NB2D6I64.js";
 import {
   createContextStateMessage,
   toClientSession
-} from "./chunk-B5MH4HQ6.js";
-import {
-  EventEmitter
-} from "./chunk-JAX5OEMM.js";
+} from "./chunk-SYJMUIRC.js";
 import {
   getPathSeparator,
   isAbsolutePath
-} from "./chunk-6EV7X5MP.js";
+} from "./chunk-N4RTAGFY.js";
+import {
+  EventEmitter
+} from "./chunk-JURM3RPZ.js";
 import {
   getAgentModelOverride,
   getAgentModelOverrides,
   resolveLLMClientForAgent,
   setAgentModelOverride
-} from "./chunk-MM46DJJL.js";
+} from "./chunk-RISQXU32.js";
 import {
   getProject,
   getProjectByWorkdir,
@@ -123,7 +131,7 @@ import {
 } from "./chunk-6FPGJR7O.js";
 import {
   VERSION
-} from "./chunk-64374FPB.js";
+} from "./chunk-P5AA7OYJ.js";
 import {
   clearWorkflowExecution,
   createSession,
@@ -132,8 +140,10 @@ import {
   getActiveWorkflowExecution,
   getSession,
   getSessionCachedPrompt,
+  listHomeSessions,
   listSessions,
   listSessionsByProject,
+  listSessionsLimited,
   updateSessionBranch,
   updateSessionCachedPrompt,
   updateSessionDangerLevel,
@@ -143,7 +153,7 @@ import {
   updateSessionRunning,
   updateSessionWorkdir,
   updateWorkflowExecutionStatus
-} from "./chunk-4ZXRERIW.js";
+} from "./chunk-C5NQF2K4.js";
 import {
   agentExists,
   deleteAgent,
@@ -166,13 +176,13 @@ import {
   saveAgentToProject,
   saveItemToDir,
   setRuntimeConfig
-} from "./chunk-VT2X3DMC.js";
+} from "./chunk-JNHKKUGJ.js";
 import {
   createProviderManager,
   detectModel,
   getLlmStatus,
   parseDefaultModelSelection
-} from "./chunk-KDQJOI2I.js";
+} from "./chunk-FSYRANYR.js";
 import {
   getModelProfile
 } from "./chunk-V4IE7HJY.js";
@@ -185,12 +195,12 @@ import {
 import {
   SessionNotFoundError,
   WorkspaceInUseError
-} from "./chunk-E5HZKNTY.js";
+} from "./chunk-PCC4DBPF.js";
 import {
   deleteSetting,
   getSetting,
   setSetting
-} from "./chunk-VXKPZUCT.js";
+} from "./chunk-RT2A2RRL.js";
 import {
   initDatabase
 } from "./chunk-LCQ5AN6Y.js";
@@ -200,7 +210,7 @@ import {
 } from "./chunk-K44MW7JJ.js";
 import {
   createServerMessage
-} from "./chunk-4R7G5JB6.js";
+} from "./chunk-P45RJGOT.js";
 import {
   getGlobalConfigDir
 } from "./chunk-CQGTEGKL.js";
@@ -1471,6 +1481,12 @@ function createMockLLMClient() {
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+function withoutAuthorizationHeader(headers) {
+  if (!headers) return void 0;
+  const kept = Object.entries(headers).filter(([key]) => key.trim().toLowerCase() !== "authorization");
+  if (kept.length === Object.keys(headers).length) return headers;
+  return Object.fromEntries(kept);
+}
 function estimateToolTokens(toolName, description, inputSchema) {
   const def = {
     type: "function",
@@ -1519,8 +1535,12 @@ var McpManager = class {
       } else if (entry.config.transport === "http") {
         if (!entry.config.url) throw new Error("url is required for http transport");
         const httpOpts = {};
-        if (entry.config.headers) {
-          httpOpts.requestInit = { headers: entry.config.headers };
+        const headers = entry.config.oauth ? withoutAuthorizationHeader(entry.config.headers) : entry.config.headers;
+        if (headers) {
+          httpOpts.requestInit = { headers };
+        }
+        if (entry.config.oauth) {
+          httpOpts.authProvider = new McpOAuthProvider(name, entry.config.url);
         }
         transport = new StreamableHTTPClientTransport(new URL(entry.config.url), httpOpts);
       } else {
@@ -2917,6 +2937,13 @@ var SessionManager = class {
   listSessions() {
     return listSessions();
   }
+  /**
+   * Lightweight homepage list: the N most recently updated sessions per
+   * project, summaries only (no prompt extraction, no snapshot parsing).
+   */
+  listHomeSessions(sessionsPerProject = 5) {
+    return listHomeSessions(sessionsPerProject);
+  }
   /**
    * List sessions for a project with pagination.
    */
@@ -2927,6 +2954,14 @@ var SessionManager = class {
     }
     return listSessionsByProject(projectId, limit, offset);
   }
+  /**
+   * Most recently updated sessions across all projects, bounded with
+   * pagination. Used by the legacy global list refresh when a limit is
+   * explicitly requested (the homepage itself uses listHomeSessions).
+   */
+  listSessionsLimited(limit = 20, offset = 0) {
+    return listSessionsLimited(limit, offset);
+  }
   /**
    * Delete a session and all its events.
    */
@@ -3820,6 +3855,7 @@ All file and git operations should use this directory.
     this.switchLocks.set(sessionId, lockPromise);
     lockPromise.finally(() => {
       if (this.switchLocks.get(sessionId) === lockPromise) this.switchLocks.delete(sessionId);
+    }).catch(() => {
     });
     return lockPromise;
   }
@@ -5348,7 +5384,7 @@ function createProviderAuthRoutes(config3, providerManager, registry) {
     try {
       const { challenge, completion } = await adapter.beginLogin({ providerId: provider.id });
       void completion.then(async ({ credentialRef }) => {
-        const { loadGlobalConfig, saveGlobalConfig, updateProvider } = await import("./config-HX7FDKGJ.js");
+        const { loadGlobalConfig, saveGlobalConfig, updateProvider } = await import("./config-TW5FHQEM.js");
         const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
         const updatedConfig = updateProvider(globalConfig, provider.id, { credentialRef, authAdapter: adapter.id });
         await saveGlobalConfig(config3.mode ?? "production", updatedConfig, config3.globalConfigPath);
@@ -5385,7 +5421,7 @@ function createProviderAuthRoutes(config3, providerManager, registry) {
       const ref = provider.credentialRef ?? provider.id;
       await adapter.logout(ref);
     }
-    const { loadGlobalConfig, saveGlobalConfig } = await import("./config-HX7FDKGJ.js");
+    const { loadGlobalConfig, saveGlobalConfig } = await import("./config-TW5FHQEM.js");
     const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
     const updatedConfig = {
       ...globalConfig,
@@ -5863,7 +5899,7 @@ async function createServerHandle(config3) {
   const mcpManager = new McpManager({
     onToolsDiscovered: async (name, tools) => {
       try {
-        const { loadGlobalConfig, saveGlobalConfig } = await import("./config-HX7FDKGJ.js");
+        const { loadGlobalConfig, saveGlobalConfig } = await import("./config-TW5FHQEM.js");
         const mode = config3.mode ?? "production";
         const globalConfig = await loadGlobalConfig(mode, config3.globalConfigPath);
         const mcpServers2 = {
@@ -5881,6 +5917,8 @@ async function createServerHandle(config3) {
   setMcpManagerForTools(mcpManager);
   setMcpConfigMode(config3.mode ?? "production");
   setMcpConfigPath(config3.globalConfigPath);
+  setMcpOAuthStoreMode(config3.mode ?? "production");
+  setMcpOAuthStorePath(config3.globalConfigPath ? join10(dirname8(config3.globalConfigPath), "mcp-auth.json") : void 0);
   const mcpServers = config3.mcpServers ?? {};
   Promise.all(
     Object.entries(mcpServers).map(
@@ -5895,14 +5933,14 @@ async function createServerHandle(config3) {
       toolRegistry = createToolRegistry();
       logger.info("MCP tools registered", { count: mcpTools.length });
     }
-    const { signalMcpReady } = await import("./server-R6DDJNF3.js");
+    const { signalMcpReady } = await import("./server-7MOOJR2N.js");
     signalMcpReady();
   });
   const app = express();
   app.use(cors());
   const authMiddleware = async (req, res, next) => {
     const path = req.path;
-    const publicPaths = ["/health", "/auth", "/auth/login", "/auto-update/check", "/changelog"];
+    const publicPaths = ["/health", "/auth", "/auth/login", "/auto-update/check", "/changelog", "/mcp/oauth/callback"];
     if (publicPaths.includes(path)) {
       return next();
     }
@@ -6105,7 +6143,7 @@ async function createServerHandle(config3) {
     }
     try {
       await checkoutBranch(project.workdir, branch);
-      const { updateSessionBranch: updateSessionBranch2 } = await import("./sessions-YTWCOHI3.js");
+      const { updateSessionBranch: updateSessionBranch2 } = await import("./sessions-D772YTWL.js");
       const allSessions = sessionManager.listSessions();
       for (const s of allSessions) {
         if (sessionManager.getEffectiveWorkdir(s.id) === project.workdir) {
@@ -6141,7 +6179,7 @@ async function createServerHandle(config3) {
         );
       }
       await createBranch(project.workdir, name, sb);
-      const { updateSessionBranch: updateSessionBranch2 } = await import("./sessions-YTWCOHI3.js");
+      const { updateSessionBranch: updateSessionBranch2 } = await import("./sessions-D772YTWL.js");
       const allSessions = sessionManager.listSessions();
       for (const s of allSessions) {
         if (sessionManager.getEffectiveWorkdir(s.id) === project.workdir) {
@@ -6173,7 +6211,7 @@ async function createServerHandle(config3) {
     if (!branch || typeof branch !== "string") return res.status(400).json({ error: "branch is required" });
     const effectiveWorkdir = sessionManager.getEffectiveWorkdir(req.params.id);
     const { checkoutBranch, validateRef: validateRef2 } = await import("./workspace-YDUQZ3HC.js");
-    const { updateSessionBranch: updateSessionBranch2 } = await import("./sessions-YTWCOHI3.js");
+    const { updateSessionBranch: updateSessionBranch2 } = await import("./sessions-D772YTWL.js");
     try {
       await validateRef2(effectiveWorkdir, branch);
       await checkoutBranch(effectiveWorkdir, branch);
@@ -6216,7 +6254,7 @@ All file and git operations should use this branch.
     if (!name || typeof name !== "string") return res.status(400).json({ error: "name is required" });
     const effectiveWorkdir = sessionManager.getEffectiveWorkdir(req.params.id);
     const { validateRef: validateRef2 } = await import("./workspace-YDUQZ3HC.js");
-    const { updateSessionBranch: updateSessionBranch2 } = await import("./sessions-YTWCOHI3.js");
+    const { updateSessionBranch: updateSessionBranch2 } = await import("./sessions-D772YTWL.js");
     try {
       await validateRef2(effectiveWorkdir, name);
       if (sourceBranch) {
@@ -6271,17 +6309,23 @@ All file and git operations should use this branch.
     res.json({ workspaces: workspacesList });
   });
   app.get("/api/sessions", async (req, res) => {
-    const { getRecentUserPromptsForSession } = await import("./events-26J7BUSY.js");
-    const { getPendingConfirmationsBySession } = await import("./path-security-AAZMH33K.js");
+    const { getRecentUserPromptsForSession } = await import("./events-Y6XXQYFG.js");
+    const { getPendingConfirmationsBySession } = await import("./path-security-525YLND3.js");
     const projectId = req.query["projectId"];
-    const limit = Math.min(parseInt(req.query["limit"]) || 20, 100);
+    const rawLimit = req.query["limit"];
     const offset = parseInt(req.query["offset"]) || 0;
     let sessions;
     let hasMore = false;
     if (projectId) {
+      const limit = Math.min(parseInt(rawLimit || "20") || 20, 100);
       const result = sessionManager.listSessionsByProject(projectId, limit, offset);
       sessions = result.sessions;
       hasMore = result.hasMore;
+    } else if (rawLimit !== void 0) {
+      const limit = Math.min(parseInt(rawLimit || "20") || 20, 100);
+      const result = sessionManager.listSessionsLimited(limit, offset);
+      sessions = result.sessions;
+      hasMore = result.hasMore;
     } else {
       sessions = sessionManager.listSessions();
     }
@@ -6299,6 +6343,9 @@ All file and git operations should use this branch.
     }
     res.json({ sessions: sessionsWithPrompts, hasMore, pendingConfirmationsBySession });
   });
+  app.get("/api/sessions/home", (_req, res) => {
+    res.json({ sessions: sessionManager.listHomeSessions() });
+  });
   app.post("/api/sessions", async (req, res) => {
     const { projectId, title } = req.body;
     if (!projectId) {
@@ -6318,7 +6365,7 @@ All file and git operations should use this branch.
         disabledServers = mcpManager.getAllServers().filter((s) => s.config.disabled).map((s) => s.name);
       }
       if (disabledServers.length > 0) {
-        const { setSessionDisabledServers: setSessionDisabledServers2 } = await import("./session-overrides-T47KXDDS.js");
+        const { setSessionDisabledServers: setSessionDisabledServers2 } = await import("./session-overrides-XH6I3COP.js");
         setSessionDisabledServers2(session.id, disabledServers);
       }
     } catch {
@@ -6391,12 +6438,12 @@ All file and git operations should use this branch.
     }
   });
   app.get("/api/sessions/:id", async (req, res) => {
-    const { getEventStore: getEventStore2, combineEventsWithSnapshot } = await import("./events-26J7BUSY.js");
-    const { buildMessagesFromStoredEvents, foldPendingConfirmations } = await import("./folding-ZD4AMFNR.js");
-    const { getPendingQuestionsForSession } = await import("./tools-KPIYFL5A.js");
-    const { getMaxVisibleItems } = await import("./settings-2RZBMX5Y.js");
-    const { getAgentModelOverride: getAgentModelOverride2 } = await import("./model-overrides-BXMFIT47.js");
-    const { updateSessionProvider: updateSessionProvider2 } = await import("./sessions-YTWCOHI3.js");
+    const { getEventStore: getEventStore2, combineEventsWithSnapshot } = await import("./events-Y6XXQYFG.js");
+    const { buildMessagesFromStoredEvents, foldPendingConfirmations } = await import("./folding-Z4GNWRC3.js");
+    const { getPendingQuestionsForSession } = await import("./tools-HTUTYMKI.js");
+    const { getMaxVisibleItems } = await import("./settings-KO6DSJLD.js");
+    const { getAgentModelOverride: getAgentModelOverride2 } = await import("./model-overrides-O3ZYKFP7.js");
+    const { updateSessionProvider: updateSessionProvider2 } = await import("./sessions-D772YTWL.js");
     let session = sessionManager.getSession(req.params.id);
     if (!session) {
       return res.status(404).json({ error: "Session not found" });
@@ -6435,8 +6482,8 @@ All file and git operations should use this branch.
     if (!session) {
       return res.status(404).json({ error: "Session not found" });
     }
-    const { stopSessionExecution } = await import("./chat-handler-UZ7WTT6D.js");
-    const { cancelQuestionsForSession, cancelPathConfirmationsForSession } = await import("./tools-KPIYFL5A.js");
+    const { stopSessionExecution } = await import("./chat-handler-BYXZIIV3.js");
+    const { cancelQuestionsForSession, cancelPathConfirmationsForSession } = await import("./tools-HTUTYMKI.js");
     sessionManager.clearMessageQueue(sessionId);
     stopSessionExecution(sessionId, sessionManager);
     abortSession(sessionId);
@@ -6465,9 +6512,9 @@ All file and git operations should use this branch.
     res.json({ success: true });
   });
   app.post("/api/sessions/:id/provider", async (req, res) => {
-    const { getEventStore: getEventStore2, combineEventsWithSnapshot: combineEv } = await import("./events-26J7BUSY.js");
-    const { buildMessagesFromStoredEvents } = await import("./folding-ZD4AMFNR.js");
-    const { getMaxVisibleItems } = await import("./settings-2RZBMX5Y.js");
+    const { getEventStore: getEventStore2, combineEventsWithSnapshot: combineEv } = await import("./events-Y6XXQYFG.js");
+    const { buildMessagesFromStoredEvents } = await import("./folding-Z4GNWRC3.js");
+    const { getMaxVisibleItems } = await import("./settings-KO6DSJLD.js");
     const sessionId = req.params.id;
     const session = sessionManager.getSession(sessionId);
     if (!session) {
@@ -6502,7 +6549,7 @@ All file and git operations should use this branch.
     if (!result.success) {
       return res.status(500).json({ error: result.error ?? "Failed to set default model" });
     }
-    const { loadGlobalConfig, saveGlobalConfig, setDefaultModelSelection } = await import("./config-HX7FDKGJ.js");
+    const { loadGlobalConfig, saveGlobalConfig, setDefaultModelSelection } = await import("./config-TW5FHQEM.js");
     const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
     const updatedConfig = setDefaultModelSelection(globalConfig, providerId, model);
     await saveGlobalConfig(config3.mode ?? "production", updatedConfig, config3.globalConfigPath);
@@ -6580,11 +6627,11 @@ All file and git operations should use this branch.
     res.json({ success: true });
   });
   app.put("/api/sessions/:id/mode", async (req, res) => {
-    const { getEventStore: getEventStore2, combineEventsWithSnapshot: combineEv } = await import("./events-26J7BUSY.js");
-    const { buildMessagesFromStoredEvents } = await import("./folding-ZD4AMFNR.js");
-    const { getMaxVisibleItems } = await import("./settings-2RZBMX5Y.js");
-    const { getAgentModelOverride: getAgentModelOverride2 } = await import("./model-overrides-BXMFIT47.js");
-    const { updateSessionProvider: updateSessionProvider2 } = await import("./sessions-YTWCOHI3.js");
+    const { getEventStore: getEventStore2, combineEventsWithSnapshot: combineEv } = await import("./events-Y6XXQYFG.js");
+    const { buildMessagesFromStoredEvents } = await import("./folding-Z4GNWRC3.js");
+    const { getMaxVisibleItems } = await import("./settings-KO6DSJLD.js");
+    const { getAgentModelOverride: getAgentModelOverride2 } = await import("./model-overrides-O3ZYKFP7.js");
+    const { updateSessionProvider: updateSessionProvider2 } = await import("./sessions-D772YTWL.js");
     const sessionId = req.params.id;
     const session = sessionManager.getSession(sessionId);
     if (!session) {
@@ -6686,7 +6733,7 @@ All file and git operations should use this branch.
     if (alwaysAllow !== void 0 && typeof alwaysAllow !== "boolean") {
       return res.status(400).json({ error: "alwaysAllow must be a boolean if provided" });
     }
-    const { providePathConfirmation, getConfirmationSessionId } = await import("./tools-KPIYFL5A.js");
+    const { providePathConfirmation, getConfirmationSessionId } = await import("./tools-HTUTYMKI.js");
     const pendingSessionId = getConfirmationSessionId(callId);
     if (!pendingSessionId) {
       return res.status(404).json({ error: "No pending path confirmation with that ID" });
@@ -6698,11 +6745,11 @@ All file and git operations should use this branch.
     if (!result.found) {
       return res.status(404).json({ error: "No pending path confirmation with that ID" });
     }
-    const { getEventStore: getEventStore2, combineEventsWithSnapshot: combineEvents } = await import("./events-26J7BUSY.js");
-    const { buildMessagesFromStoredEvents, foldPendingConfirmations } = await import("./folding-ZD4AMFNR.js");
-    const { createSessionStateMessage } = await import("./protocol-SPIJPOEN.js");
-    const { getPendingQuestionsForSession } = await import("./tools-KPIYFL5A.js");
-    const { getMaxVisibleItems } = await import("./settings-2RZBMX5Y.js");
+    const { getEventStore: getEventStore2, combineEventsWithSnapshot: combineEvents } = await import("./events-Y6XXQYFG.js");
+    const { buildMessagesFromStoredEvents, foldPendingConfirmations } = await import("./folding-Z4GNWRC3.js");
+    const { createSessionStateMessage } = await import("./protocol-FTHAR2YL.js");
+    const { getPendingQuestionsForSession } = await import("./tools-HTUTYMKI.js");
+    const { getMaxVisibleItems } = await import("./settings-KO6DSJLD.js");
     const eventStore = getEventStore2();
     const { snapshot, events: eventsSinceSnapshot } = eventStore.getEventsSinceSnapshot(sessionId);
     const events = combineEvents(sessionId, snapshot, eventsSinceSnapshot);
@@ -6738,7 +6785,7 @@ All file and git operations should use this branch.
     if (!skip && typeof answer !== "string") {
       return res.status(400).json({ error: "answer is required when not skipping" });
     }
-    const { provideAnswer } = await import("./tools-KPIYFL5A.js");
+    const { provideAnswer } = await import("./tools-HTUTYMKI.js");
     const found = provideAnswer(callId, answer ?? "", skip ?? false);
     if (!found) {
       return res.status(404).json({ error: "No pending question with that ID" });
@@ -6771,7 +6818,7 @@ All file and git operations should use this branch.
     if (!session) {
       return res.status(404).json({ error: "Session not found" });
     }
-    const { getSetting: getSetting2, SETTINGS_KEYS } = await import("./settings-2RZBMX5Y.js");
+    const { getSetting: getSetting2, SETTINGS_KEYS } = await import("./settings-KO6DSJLD.js");
     if (getSetting2(SETTINGS_KEYS.CACHE_WARMING) !== "true") {
       return res.json({ success: false, reason: "disabled" });
     }
@@ -6803,7 +6850,7 @@ All file and git operations should use this branch.
       backend: activeProvider?.backend ?? llmClient.getBackend(),
       model: llmClient.getModel()
     };
-    const { runAgentTurn, TurnMetrics } = await import("./orchestrator-BW27C4K4.js");
+    const { runAgentTurn, TurnMetrics } = await import("./orchestrator-P5EUMC7E.js");
     runAgentTurn(
       {
         sessionManager,
@@ -6841,15 +6888,15 @@ All file and git operations should use this branch.
     if (!session) {
       return res.status(404).json({ error: "Session not found" });
     }
-    const { stopSessionExecution } = await import("./chat-handler-UZ7WTT6D.js");
-    const { cancelQuestionsForSession, cancelPathConfirmationsForSession } = await import("./tools-KPIYFL5A.js");
+    const { stopSessionExecution } = await import("./chat-handler-BYXZIIV3.js");
+    const { cancelQuestionsForSession, cancelPathConfirmationsForSession } = await import("./tools-HTUTYMKI.js");
     const queuedMessages = sessionManager.getQueueState(sessionId);
     sessionManager.clearMessageQueue(sessionId);
     stopSessionExecution(sessionId, sessionManager);
     abortSession(sessionId);
     cancelQuestionsForSession(sessionId, "Session stopped by user");
     cancelPathConfirmationsForSession(sessionId, "Session stopped by user");
-    const eventStore = (await import("./events-26J7BUSY.js")).getEventStore();
+    const eventStore = (await import("./events-Y6XXQYFG.js")).getEventStore();
     eventStore.append(sessionId, { type: "running.changed", data: { isRunning: false } });
     res.json({ success: true, queuedMessages });
   });
@@ -6863,7 +6910,7 @@ All file and git operations should use this branch.
     if (typeof messageIndex !== "number" || messageIndex < 0) {
       return res.status(400).json({ error: "messageIndex must be a non-negative number" });
     }
-    const { truncateSessionMessages } = await import("./events-26J7BUSY.js");
+    const { truncateSessionMessages } = await import("./events-Y6XXQYFG.js");
     truncateSessionMessages(sessionId, messageIndex);
     res.json({ success: true });
   });
@@ -6880,8 +6927,8 @@ All file and git operations should use this branch.
     if (content !== void 0 && (typeof content !== "string" || !content.trim())) {
       return res.status(400).json({ error: "content must be a non-empty string if provided" });
     }
-    const { getEventStore: getEventStore2 } = await import("./events-26J7BUSY.js");
-    const { buildMessagesFromStoredEvents } = await import("./folding-ZD4AMFNR.js");
+    const { getEventStore: getEventStore2 } = await import("./events-Y6XXQYFG.js");
+    const { buildMessagesFromStoredEvents } = await import("./folding-Z4GNWRC3.js");
     const eventStore = getEventStore2();
     const events = eventStore.getEvents(sessionId);
     const { messages } = buildMessagesFromStoredEvents(events);
@@ -6893,7 +6940,7 @@ All file and git operations should use this branch.
     if (msg.role !== "user" || msg.isSystemGenerated) {
       return res.status(400).json({ error: "Can only replay user messages" });
     }
-    const { truncateSessionMessages } = await import("./events-26J7BUSY.js");
+    const { truncateSessionMessages } = await import("./events-Y6XXQYFG.js");
     truncateSessionMessages(sessionId, msgIndex - 1);
     sessionManager.queueMessage(sessionId, "asap", content ?? msg.content, msg.attachments, msg.messageKind);
     res.json({ success: true });
@@ -6949,7 +6996,7 @@ All file and git operations should use this branch.
     res.json({ accepted: true });
   });
   app.get("/api/settings", async (req, res) => {
-    const { getSetting: getSetting2, SETTINGS_DEFAULTS } = await import("./settings-2RZBMX5Y.js");
+    const { getSetting: getSetting2, SETTINGS_DEFAULTS } = await import("./settings-KO6DSJLD.js");
     const keysParam = req.query["keys"];
     if (!keysParam) {
       return res.status(400).json({ error: "keys query parameter is required" });
@@ -6962,19 +7009,19 @@ All file and git operations should use this branch.
     res.json(result);
   });
   app.get("/api/settings/:key", async (req, res) => {
-    const { getSetting: getSetting2, SETTINGS_DEFAULTS } = await import("./settings-2RZBMX5Y.js");
+    const { getSetting: getSetting2, SETTINGS_DEFAULTS } = await import("./settings-KO6DSJLD.js");
     const key = req.params.key;
     const value = getSetting2(key) ?? SETTINGS_DEFAULTS[key] ?? null;
     res.json({ key, value });
   });
   app.get("/api/settings/:key", async (req, res) => {
-    const { getSetting: getSetting2, SETTINGS_DEFAULTS } = await import("./settings-2RZBMX5Y.js");
+    const { getSetting: getSetting2, SETTINGS_DEFAULTS } = await import("./settings-KO6DSJLD.js");
     const key = req.params.key;
     const value = getSetting2(key) ?? SETTINGS_DEFAULTS[key] ?? null;
     res.json({ key, value });
   });
   app.put("/api/settings/:key", async (req, res) => {
-    const { setSetting: setSetting2 } = await import("./settings-2RZBMX5Y.js");
+    const { setSetting: setSetting2 } = await import("./settings-KO6DSJLD.js");
     const key = req.params.key;
     const { value } = req.body;
     if (value === void 0) {
@@ -7001,7 +7048,7 @@ All file and git operations should use this branch.
     }
   });
   app.get("/api/tools/shells", async (_req, res) => {
-    const { listAvailableShells } = await import("./platform-EZJABX5J.js");
+    const { listAvailableShells } = await import("./platform-MEQUWG6U.js");
     res.json({ shells: listAvailableShells() });
   });
   app.get("/api/config", async (_req, res) => {
@@ -7010,7 +7057,7 @@ All file and git operations should use this branch.
     let visionFallback;
     let globalWorkdir;
     try {
-      const { loadGlobalConfig, getVisionFallback } = await import("./config-HX7FDKGJ.js");
+      const { loadGlobalConfig, getVisionFallback } = await import("./config-TW5FHQEM.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const fallback = getVisionFallback(globalConfig);
       if (fallback) {
@@ -7091,7 +7138,7 @@ All file and git operations should use this branch.
     }));
   }
   app.post("/api/proxy/test", async (_req, res) => {
-    const { getSetting: getSetting2, SETTINGS_KEYS } = await import("./settings-2RZBMX5Y.js");
+    const { getSetting: getSetting2, SETTINGS_KEYS } = await import("./settings-KO6DSJLD.js");
     const proxyUrl = getSetting2(SETTINGS_KEYS.PROXY_URL);
     if (!proxyUrl) {
       return res.status(400).json({ success: false, error: "No proxy URL configured" });
@@ -7183,7 +7230,7 @@ All file and git operations should use this branch.
     }
   });
   app.post("/api/proxy/test", async (_req, res) => {
-    const { getSetting: getSetting2, SETTINGS_KEYS } = await import("./settings-2RZBMX5Y.js");
+    const { getSetting: getSetting2, SETTINGS_KEYS } = await import("./settings-KO6DSJLD.js");
     const proxyUrl = getSetting2(SETTINGS_KEYS.PROXY_URL);
     if (!proxyUrl) {
       return res.status(400).json({ success: false, error: "No proxy URL configured" });
@@ -7210,7 +7257,7 @@ All file and git operations should use this branch.
     const backend = req.query["backend"];
     if (!url) return res.status(400).json({ error: "url is required" });
     try {
-      const { fetchModelsWithContext } = await import("./provider-manager-MWAIOX2A.js");
+      const { fetchModelsWithContext } = await import("./provider-manager-W5N4XRE5.js");
       const { getModelProfile: getModelProfile2 } = await import("./profiles-5J7F4BML.js");
       const models = await fetchModelsWithContext(
         url,
@@ -7281,7 +7328,7 @@ All file and git operations should use this branch.
       const { getModelProfile: getModelProfile2 } = await import("./profiles-5J7F4BML.js");
       const { getBackendCapabilities } = await import("./backend-P3GHHLHJ.js");
       const { buildNonStreamingCreateParams } = await import("./client-pure-VFZIIK4S.js");
-      const { OpenAIHttpClient } = await import("./http-client-MQARNFY3.js");
+      const { OpenAIHttpClient } = await import("./http-client-2GDKHZIG.js");
       const { ensureVersionPrefix } = await import("./url-utils-SAJP7AEX.js");
       const profile = getModelProfile2(model);
       const capabilities = getBackendCapabilities(backend || "unknown");
@@ -7351,7 +7398,7 @@ All file and git operations should use this branch.
       return res.status(400).json({ error: "name, url, and backend are required" });
     }
     try {
-      const { loadGlobalConfig, saveGlobalConfig, addProvider, setDefaultModelSelection } = await import("./config-HX7FDKGJ.js");
+      const { loadGlobalConfig, saveGlobalConfig, addProvider, setDefaultModelSelection } = await import("./config-TW5FHQEM.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const providerBackend = backend;
       const providerModels = modelConfigs?.length ? buildModelConfigs(modelConfigs) : model ? [{ id: model, contextWindow: 2e5, source: "user" }] : [];
@@ -7392,7 +7439,7 @@ All file and git operations should use this branch.
   app.post("/api/init/config", async (req, res) => {
     const { workdir, visionFallback } = req.body;
     try {
-      const { loadGlobalConfig, saveGlobalConfig } = await import("./config-HX7FDKGJ.js");
+      const { loadGlobalConfig, saveGlobalConfig } = await import("./config-TW5FHQEM.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const updatedVf = visionFallback ? { ...globalConfig.visionFallback, ...visionFallback } : globalConfig.visionFallback;
       const updatedConfig = {
@@ -7427,7 +7474,7 @@ All file and git operations should use this branch.
     }
     const updates = parsed.data;
     try {
-      const { loadGlobalConfig, saveGlobalConfig } = await import("./config-HX7FDKGJ.js");
+      const { loadGlobalConfig, saveGlobalConfig } = await import("./config-TW5FHQEM.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const filteredUpdates = Object.fromEntries(Object.entries(updates).filter(([, v]) => v !== void 0));
       const updatedConfig = {
@@ -7469,8 +7516,8 @@ All file and git operations should use this branch.
     }
     const testConfig = parsed.data;
     try {
-      const { resolveVisionFallback } = await import("./config-HX7FDKGJ.js");
-      const { loadGlobalConfig } = await import("./config-HX7FDKGJ.js");
+      const { resolveVisionFallback } = await import("./config-TW5FHQEM.js");
+      const { loadGlobalConfig } = await import("./config-TW5FHQEM.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const filteredTestConfig = Object.fromEntries(Object.entries(testConfig).filter(([, v]) => v !== void 0));
       const testVisionFallback = {
@@ -7521,7 +7568,7 @@ All file and git operations should use this branch.
   });
   app.delete("/api/providers/:id", async (req, res) => {
     const { id } = req.params;
-    const { loadGlobalConfig, saveGlobalConfig, removeProvider } = await import("./config-HX7FDKGJ.js");
+    const { loadGlobalConfig, saveGlobalConfig, removeProvider } = await import("./config-TW5FHQEM.js");
     const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
     const updatedConfig = removeProvider(globalConfig, id);
     await saveGlobalConfig(config3.mode ?? "production", updatedConfig, config3.globalConfigPath);
@@ -7533,7 +7580,7 @@ All file and git operations should use this branch.
     const { id } = req.params;
     const { isLocal } = req.body;
     try {
-      const { loadGlobalConfig, saveGlobalConfig, updateProvider } = await import("./config-HX7FDKGJ.js");
+      const { loadGlobalConfig, saveGlobalConfig, updateProvider } = await import("./config-TW5FHQEM.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const provider = globalConfig.providers.find((p) => p.id === id);
       if (!provider) {
@@ -7565,7 +7612,7 @@ All file and git operations should use this branch.
       transportAdapter
     } = req.body;
     try {
-      const { loadGlobalConfig, saveGlobalConfig, updateProvider } = await import("./config-HX7FDKGJ.js");
+      const { loadGlobalConfig, saveGlobalConfig, updateProvider } = await import("./config-TW5FHQEM.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const provider = globalConfig.providers.find((p) => p.id === id);
       if (!provider) {
@@ -7606,7 +7653,7 @@ All file and git operations should use this branch.
       return res.status(400).json({ error: result.error });
     }
     const llmClient = getLLMClient();
-    const { loadGlobalConfig, saveGlobalConfig, setDefaultModelSelection } = await import("./config-HX7FDKGJ.js");
+    const { loadGlobalConfig, saveGlobalConfig, setDefaultModelSelection } = await import("./config-TW5FHQEM.js");
     const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
     const updatedConfig = setDefaultModelSelection(globalConfig, id, llmClient.getModel());
     await saveGlobalConfig(config3.mode ?? "production", updatedConfig, config3.globalConfigPath);
@@ -7633,7 +7680,7 @@ All file and git operations should use this branch.
   });
   async function rebuildMcpTools() {
     const { createMcpTools: createMcpTools2 } = await import("./tool-adapter-FEAHWU5C.js");
-    const { setMcpTools: setMcpTools2 } = await import("./tools-KPIYFL5A.js");
+    const { setMcpTools: setMcpTools2 } = await import("./tools-HTUTYMKI.js");
     const mcpTools = createMcpTools2(mcpManager);
     setMcpTools2(mcpTools);
     toolRegistry = createToolRegistry();
@@ -7681,7 +7728,7 @@ All file and git operations should use this branch.
     }
   });
   app.post("/api/mcp/servers", async (req, res) => {
-    const { name, transport, command, args, env, url, headers, timeout } = req.body;
+    const { name, transport, command, args, env, url, headers, oauth, timeout } = req.body;
     if (!name) {
       return res.status(400).json({ error: "name is required" });
     }
@@ -7691,6 +7738,9 @@ All file and git operations should use this branch.
     if (timeout !== void 0 && (typeof timeout !== "number" || timeout <= 0)) {
       return res.status(400).json({ error: "timeout must be a positive number" });
     }
+    if (oauth !== void 0 && typeof oauth !== "boolean") {
+      return res.status(400).json({ error: "oauth must be a boolean" });
+    }
     try {
       const resolvedTransport = transport === "http" ? "http" : "stdio";
       const serverCfg = {
@@ -7700,11 +7750,12 @@ All file and git operations should use this branch.
         ...env && Object.keys(env).length > 0 ? { env } : {},
         ...url ? { url } : {},
         ...headers && Object.keys(headers).length > 0 ? { headers } : {},
+        ...oauth ? { oauth: true } : {},
         ...timeout !== void 0 ? { timeout } : {}
       };
       await mcpManager.addServer(name, serverCfg);
       const server = mcpManager.getServer(name);
-      const { loadGlobalConfig, saveGlobalConfig } = await import("./config-HX7FDKGJ.js");
+      const { loadGlobalConfig, saveGlobalConfig } = await import("./config-TW5FHQEM.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const updatedMcpServers = { ...globalConfig.mcpServers ?? {}, [name]: serverCfg };
       await saveGlobalConfig(
@@ -7736,7 +7787,7 @@ All file and git operations should use this branch.
       return res.status(404).json({ error: `MCP server '${name}' not found` });
     }
     const body = req.body;
-    const { transport: rawTransport, command, args, env, url, headers, timeout, disabled } = body;
+    const { transport: rawTransport, command, args, env, url, headers, oauth, timeout, disabled } = body;
     if (rawTransport !== void 0 && rawTransport !== "stdio" && rawTransport !== "http") {
       return res.status(400).json({ error: `Invalid transport '${String(rawTransport)}'. Must be 'stdio' or 'http'.` });
     }
@@ -7761,9 +7812,12 @@ All file and git operations should use this branch.
     if (disabled !== void 0 && typeof disabled !== "boolean") {
       return res.status(400).json({ error: "disabled must be a boolean" });
     }
+    if (oauth !== void 0 && typeof oauth !== "boolean") {
+      return res.status(400).json({ error: "oauth must be a boolean" });
+    }
     try {
-      const { loadGlobalConfig, saveGlobalConfig } = await import("./config-HX7FDKGJ.js");
-      const { applyMcpServerUpdate } = await import("./update-server-4I6LXE5K.js");
+      const { loadGlobalConfig, saveGlobalConfig } = await import("./config-TW5FHQEM.js");
+      const { applyMcpServerUpdate } = await import("./update-server-LOOXIXDW.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const mcpServers2 = { ...globalConfig.mcpServers ?? {} };
       const patch = {
@@ -7773,6 +7827,7 @@ All file and git operations should use this branch.
         ...env !== void 0 ? { env } : {},
         ...url !== void 0 ? { url } : {},
         ...headers !== void 0 ? { headers } : {},
+        ...oauth !== void 0 ? { oauth } : {},
         ...timeout !== void 0 ? { timeout } : {},
         ...disabled !== void 0 ? { disabled } : {}
       };
@@ -7808,7 +7863,9 @@ All file and git operations should use this branch.
       return res.status(404).json({ error: `MCP server '${name}' not found` });
     }
     mcpManager.removeServer(name);
-    const { loadGlobalConfig, saveGlobalConfig } = await import("./config-HX7FDKGJ.js");
+    const { clearMcpOAuthEntry } = await import("./oauth-store-XCFXV2VM.js");
+    await clearMcpOAuthEntry(name);
+    const { loadGlobalConfig, saveGlobalConfig } = await import("./config-TW5FHQEM.js");
     const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
     const updatedMcpServers = { ...globalConfig.mcpServers ?? {} };
     delete updatedMcpServers[name];
@@ -7828,6 +7885,143 @@ All file and git operations should use this branch.
     wssExports.broadcastAll(createServerMessage("mcp.servers.changed", { servers: mcpManager.getAllServers() }));
     res.json({ success: true });
   });
+  function oauthCallbackPage(message) {
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>OpenFox</title></head><body style="font-family:system-ui;padding:2rem"><p>${message}</p></body></html>`;
+  }
+  function parseOAuthResponse(value) {
+    let params;
+    try {
+      params = new URL(value).searchParams;
+    } catch {
+      params = value.includes("code=") ? new URLSearchParams(value.replace(/^\?/, "")) : null;
+    }
+    if (!params) return { code: value };
+    const code = params.get("code");
+    const state = params.get("state");
+    return { ...code ? { code } : {}, ...state ? { state } : {} };
+  }
+  async function applyMcpOAuthResult(name) {
+    await mcpManager.connectServer(name);
+    await rebuildMcpTools();
+    for (const s of sessionManager.listSessions()) {
+      sessionManager.setDynamicContextChanged(s.id, true);
+    }
+    wssExports.broadcastAll(createServerMessage("mcp.servers.changed", { servers: mcpManager.getAllServers() }));
+  }
+  async function completeMcpOAuth(name, serverUrl, code) {
+    const { auth } = await import("@modelcontextprotocol/sdk/client/auth.js");
+    const { McpOAuthProvider: McpOAuthProvider2 } = await import("./oauth-provider-52YILVUJ.js");
+    const { clearMcpOAuthAuthorizationState } = await import("./oauth-store-XCFXV2VM.js");
+    const provider = new McpOAuthProvider2(name, serverUrl);
+    try {
+      const result = await auth(provider, { serverUrl, authorizationCode: code });
+      if (result !== "AUTHORIZED") {
+        throw new Error("The authorization server did not return a usable grant");
+      }
+    } catch (error) {
+      await clearMcpOAuthAuthorizationState(name, serverUrl);
+      throw error;
+    }
+    await applyMcpOAuthResult(name);
+  }
+  function oauthEnabledServerUrl(name) {
+    const server = mcpManager.getServer(name);
+    if (!server || server.config.transport !== "http" || !server.config.oauth) return void 0;
+    return server.config.url;
+  }
+  app.post("/api/mcp/servers/:name/oauth/start", async (req, res) => {
+    const { name } = req.params;
+    const server = mcpManager.getServer(name);
+    if (!server) {
+      return res.status(404).json({ error: `MCP server '${name}' not found` });
+    }
+    if (server.config.transport !== "http" || !server.config.url) {
+      return res.status(400).json({ error: "OAuth is only available for http transport" });
+    }
+    if (!server.config.oauth) {
+      return res.status(400).json({ error: `MCP server '${name}' is not configured for OAuth` });
+    }
+    try {
+      const { auth } = await import("@modelcontextprotocol/sdk/client/auth.js");
+      const { McpOAuthProvider: McpOAuthProvider2 } = await import("./oauth-provider-52YILVUJ.js");
+      const provider = new McpOAuthProvider2(name, server.config.url);
+      const result = await auth(provider, { serverUrl: server.config.url });
+      if (result === "AUTHORIZED") {
+        await applyMcpOAuthResult(name);
+        return res.json({ status: "authorized" });
+      }
+      const authorizationUrl = provider.pendingAuthorizationUrl;
+      if (!authorizationUrl) {
+        return res.status(400).json({ error: "The server did not produce an authorization URL" });
+      }
+      res.json({ status: "redirect", authorizationUrl: authorizationUrl.toString(), redirectUri: provider.redirectUrl });
+    } catch (error) {
+      res.status(400).json({ error: error instanceof Error ? error.message : String(error) });
+    }
+  });
+  app.get("/api/mcp/oauth/callback", async (req, res) => {
+    const code = typeof req.query["code"] === "string" ? req.query["code"] : "";
+    const state = typeof req.query["state"] === "string" ? req.query["state"] : "";
+    if (!code || !state) {
+      return res.status(400).type("html").send(oauthCallbackPage("Missing authorization code or state."));
+    }
+    const { findMcpOAuthEntryByState } = await import("./oauth-store-XCFXV2VM.js");
+    const pending = await findMcpOAuthEntryByState(state);
+    if (!pending) {
+      return res.status(400).type("html").send(oauthCallbackPage("No pending authorization matches this callback."));
+    }
+    const pendingUrl = oauthEnabledServerUrl(pending.name);
+    if (!pendingUrl || pendingUrl !== pending.entry.serverUrl) {
+      return res.status(400).type("html").send(oauthCallbackPage("This server is no longer configured for OAuth."));
+    }
+    try {
+      await completeMcpOAuth(pending.name, pending.entry.serverUrl, code);
+      res.type("html").send(oauthCallbackPage("Authorization complete. You can close this tab and go back to OpenFox."));
+    } catch (error) {
+      logger.error("MCP OAuth callback failed", { error: error instanceof Error ? error.message : String(error) });
+      res.status(400).type("html").send(oauthCallbackPage("Authorization failed. See the OpenFox logs for details."));
+    }
+  });
+  app.post("/api/mcp/servers/:name/oauth/complete", async (req, res) => {
+    const { name } = req.params;
+    const { response } = req.body;
+    const server = mcpManager.getServer(name);
+    if (!server) {
+      return res.status(404).json({ error: `MCP server '${name}' not found` });
+    }
+    const serverUrl = oauthEnabledServerUrl(name);
+    if (!serverUrl) {
+      return res.status(400).json({ error: `MCP server '${name}' is not configured for OAuth` });
+    }
+    if (typeof response !== "string" || !response.trim()) {
+      return res.status(400).json({ error: "response is required" });
+    }
+    const parsed = parseOAuthResponse(response.trim());
+    if (!parsed.code || !parsed.state) {
+      return res.status(400).json({ error: "Paste the whole callback URL, both code and state are needed" });
+    }
+    const { readMcpOAuthEntry } = await import("./oauth-store-XCFXV2VM.js");
+    const entry = await readMcpOAuthEntry(name, serverUrl);
+    if (!entry?.state || entry.state !== parsed.state) {
+      return res.status(400).json({ error: "This callback does not match the pending authorization" });
+    }
+    try {
+      await completeMcpOAuth(name, serverUrl, parsed.code);
+      res.json({ server: mcpManager.getServer(name) });
+    } catch (error) {
+      res.status(400).json({ error: error instanceof Error ? error.message : String(error) });
+    }
+  });
+  app.delete("/api/mcp/servers/:name/oauth", async (req, res) => {
+    const { name } = req.params;
+    if (!mcpManager.getServer(name)) {
+      return res.status(404).json({ error: `MCP server '${name}' not found` });
+    }
+    const { clearMcpOAuthEntry } = await import("./oauth-store-XCFXV2VM.js");
+    await clearMcpOAuthEntry(name);
+    await applyMcpOAuthResult(name);
+    res.json({ success: true });
+  });
   app.put("/api/mcp/servers/:name/tools/:toolName", async (req, res) => {
     const { name, toolName } = req.params;
     const { enabled } = req.body;
@@ -7838,7 +8032,7 @@ All file and git operations should use this branch.
       await mcpManager.setToolEnabled(name, toolName, enabled);
       const server = mcpManager.getServer(name);
       if (server) {
-        const { loadGlobalConfig, saveGlobalConfig } = await import("./config-HX7FDKGJ.js");
+        const { loadGlobalConfig, saveGlobalConfig } = await import("./config-TW5FHQEM.js");
         const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
         const mcpServers2 = { ...globalConfig.mcpServers ?? {} };
         const serverCfg = mcpServers2[name];
@@ -7894,13 +8088,13 @@ All file and git operations should use this branch.
     })
   );
   app.get("/api/sessions/:id/background-processes", async (req, res) => {
-    const { getSessionProcesses } = await import("./manager-RJH7EYIG.js");
+    const { getSessionProcesses } = await import("./manager-HCMDFEQH.js");
     const sessionId = req.params.id;
     const processes = getSessionProcesses(sessionId);
     res.json({ processes });
   });
   app.post("/api/sessions/:id/background-process/:processId/stop", async (req, res) => {
-    const { stopProcess } = await import("./manager-RJH7EYIG.js");
+    const { stopProcess } = await import("./manager-HCMDFEQH.js");
     const sessionId = req.params.id;
     const processId = req.params.processId;
     const session = sessionManager.getSession(sessionId);
@@ -8045,7 +8239,7 @@ All file and git operations should use this branch.
     const state = sessionManager.getContextState(sessionId);
     wssExports.broadcastForSession(sessionId, createContextStateMessage(state));
   });
-  const { QueueProcessor } = await import("./processor-FTCPHWBM.js");
+  const { QueueProcessor } = await import("./processor-UN4H4V7F.js");
   const queueProcessor = new QueueProcessor({
     sessionManager,
     providerManager,
@@ -8074,6 +8268,7 @@ All file and git operations should use this branch.
       httpServer.listen(listenPort, host, () => {
         const addr = httpServer.address();
         const actualPort = typeof addr === "object" && addr ? addr.port : listenPort;
+        setMcpOAuthServerPort(actualPort);
         const client = getLLMClient();
         logger.info(`OpenFox server running at http://${host}:${actualPort}`);
         logger.info(`WebSocket available at ws://${host}:${actualPort}/ws`);
@@ -8129,4 +8324,4 @@ export {
   createServerHandle,
   createServer
 };
-//# sourceMappingURL=chunk-ZJW3KOII.js.map
+//# sourceMappingURL=chunk-IYTDCPEQ.js.map