privateer-agent 0.15.4 → 0.15.6

package/dist-boot/ext-privateer-connect.mjs

@@ -0,0 +1,1862 @@
+import{createRequire as __pvCR}from"node:module";import{fileURLToPath as __pvF}from"node:url";import{dirname as __pvD}from"node:path";const require=__pvCR(import.meta.url);const __pvUrl=(r)=>new URL(r,import.meta.url).href;const __pvFile=(r)=>__pvF(new URL(r,import.meta.url));
+import {
+  Container,
+  Input,
+  Spacer,
+  Text,
+  fuzzyFilter,
+  getKeybindings
+} from "./c-EQBKXWNX.mjs";
+import "./c-4WVR32AP.mjs";
+import {
+  __name
+} from "./c-CN77DCGF.mjs";
+
+// src/remote/mcpControl.ts?ext=privateer-connect
+import { readFileSync, mkdirSync } from "node:fs";
+import { join as join2, dirname } from "node:path";
+
+// src/config/paths.ts?ext=privateer-connect
+import { homedir } from "node:os";
+import { join } from "node:path";
+function globalDir() {
+  return process.env.PRIVATEER_HOME ?? join(homedir(), ".privateer");
+}
+__name(globalDir, "globalDir");
+function agentDir() {
+  return join(globalDir(), "agent");
+}
+__name(agentDir, "agentDir");
+
+// src/util/atomicWrite.ts?ext=privateer-connect
+import { chmodSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+function writeFileAtomic(path, data, opts = {}) {
+  let target = path;
+  let mode = opts.mode ?? 384;
+  try {
+    target = realpathSync(path);
+    if (opts.mode === void 0) mode = statSync(target).mode & 511;
+  } catch {
+  }
+  const tmp = `${target}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+  try {
+    writeFileSync(tmp, data, { encoding: "utf8", mode });
+    try {
+      chmodSync(tmp, mode);
+    } catch {
+    }
+    renameSync(tmp, target);
+  } catch (e) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+    throw e;
+  }
+}
+__name(writeFileAtomic, "writeFileAtomic");
+
+// src/remote/mcpControl.ts?ext=privateer-connect
+var AUTHS = ["oauth", "bearer", "none"];
+function isAuth(v) {
+  return typeof v === "string" && AUTHS.includes(v);
+}
+__name(isAuth, "isAuth");
+function authOf(e, transport) {
+  if (transport !== "http") return "none";
+  if (isAuth(e.auth)) return e.auth;
+  if (e.bearerToken || e.bearerTokenEnv) return "bearer";
+  if (e.oauth === false) return "none";
+  if (e.headers && Object.keys(e.headers).length > 0) return "none";
+  return "oauth";
+}
+__name(authOf, "authOf");
+var TRANSPORTS = ["stdio", "http"];
+function isTransport(v) {
+  return typeof v === "string" && TRANSPORTS.includes(v);
+}
+__name(isTransport, "isTransport");
+function hostOf(url) {
+  try {
+    return new URL(url).host || void 0;
+  } catch {
+    return void 0;
+  }
+}
+__name(hostOf, "hostOf");
+function cleanArgs(v) {
+  if (!Array.isArray(v)) return void 0;
+  return v.map((x) => String(x ?? "")).filter((s) => s.length > 0);
+}
+__name(cleanArgs, "cleanArgs");
+var SERVER_NAME = /^[A-Za-z0-9_-]+$/;
+var ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function isSseUrl(url) {
+  try {
+    return /\/sse\/?$/i.test(new URL(url).pathname);
+  } catch {
+    return false;
+  }
+}
+__name(isSseUrl, "isSseUrl");
+function toPiConfigValue(value) {
+  if (value.startsWith("!!")) return `$!${references(value.slice(2))}`;
+  if (value.startsWith("!")) return value;
+  return references(value);
+}
+__name(toPiConfigValue, "toPiConfigValue");
+function references(value) {
+  const literal = /* @__PURE__ */ __name((text) => text.replace(/\$/g, "$$$$"), "literal");
+  let out = "";
+  let last = 0;
+  for (const m of value.matchAll(/\$\{(\w+)\}|\$env:(\w+)|\{env:(\w+)\}/g)) {
+    out += literal(value.slice(last, m.index)) + "${" + (m[1] ?? m[2] ?? m[3]) + "}";
+    last = m.index + m[0].length;
+  }
+  return out + literal(value.slice(last));
+}
+__name(references, "references");
+function piConfigValues(values) {
+  const out = {};
+  for (const [k, v] of Object.entries(values)) out[k] = toPiConfigValue(String(v ?? ""));
+  return out;
+}
+__name(piConfigValues, "piConfigValues");
+function bearerHeader(token) {
+  if (token.startsWith("!") && !token.startsWith("!!")) return `!printf 'Bearer %s' "$(${token.slice(1)})"`;
+  return `Bearer ${toPiConfigValue(token)}`;
+}
+__name(bearerHeader, "bearerHeader");
+function migrateMcpProjection(dir = agentDir) {
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync(join2(dir(), "mcp.json"), "utf8"));
+    if (raw?.settings?.toolPrefix === void 0) return false;
+  } catch {
+    return false;
+  }
+  makeMcpControl({ dir }).reproject(raw?.mcpServers ?? {});
+  return true;
+}
+__name(migrateMcpProjection, "migrateMcpProjection");
+var LEGACY_SSE_URLS = {
+  "https://mcp.atlassian.com/v1/sse": "https://mcp.atlassian.com/v1/mcp",
+  "https://mcp.asana.com/sse": "https://mcp.asana.com/mcp",
+  "https://mcp.linear.app/sse": "https://mcp.linear.app/mcp"
+};
+function upgradeLegacyUrl(url) {
+  return LEGACY_SSE_URLS[url.replace(/\/$/, "")] ?? url;
+}
+__name(upgradeLegacyUrl, "upgradeLegacyUrl");
+function toPiServerEntry(e) {
+  const transport = e.transport ?? (e.url ? "http" : "stdio");
+  const std = {};
+  if (transport === "stdio") {
+    if (e.command) std.command = e.command;
+    if (e.args?.length) std.args = e.args;
+    if (e.env && Object.keys(e.env).length > 0) std.env = piConfigValues(e.env);
+  } else {
+    if (e.url) std.url = upgradeLegacyUrl(e.url);
+    const headers = piConfigValues(e.headers ?? {});
+    if (authOf(e, transport) === "bearer") {
+      if (e.bearerToken) headers.Authorization = bearerHeader(e.bearerToken);
+      else if (e.bearerTokenEnv && ENV_NAME.test(e.bearerTokenEnv)) headers.Authorization = `Bearer \${${e.bearerTokenEnv}}`;
+    }
+    if (Object.keys(headers).length > 0) std.headers = headers;
+  }
+  return std;
+}
+__name(toPiServerEntry, "toPiServerEntry");
+function makeMcpControl(opts) {
+  const dir = opts?.dir ?? agentDir;
+  const sourcePath = /* @__PURE__ */ __name(() => join2(dir(), "mcp-desktop.json"), "sourcePath");
+  const projectionPath = /* @__PURE__ */ __name(() => join2(dir(), "mcp.json"), "projectionPath");
+  function readSource() {
+    try {
+      const raw = JSON.parse(readFileSync(sourcePath(), "utf8"));
+      if (raw && typeof raw === "object" && raw.servers) return { servers: raw.servers };
+    } catch {
+    }
+    const servers = {};
+    try {
+      const proj = JSON.parse(readFileSync(projectionPath(), "utf8"));
+      for (const [name, entry] of Object.entries(proj?.mcpServers ?? {})) {
+        servers[name] = { ...entry, enabled: true };
+      }
+    } catch {
+    }
+    return { servers };
+  }
+  __name(readSource, "readSource");
+  function writeSource(src) {
+    mkdirSync(dirname(sourcePath()), { recursive: true });
+    writeFileAtomic(sourcePath(), JSON.stringify(src, null, 2) + "\n");
+    project(src);
+  }
+  __name(writeSource, "writeSource");
+  function project(src) {
+    const mcpServers = {};
+    for (const [name, e] of Object.entries(src.servers)) {
+      mcpServers[name] = e.enabled === false ? { ...toPiServerEntry(e), enabled: false } : toPiServerEntry(e);
+    }
+    mkdirSync(dirname(projectionPath()), { recursive: true });
+    writeFileAtomic(projectionPath(), JSON.stringify({ mcpServers }, null, 2) + "\n");
+  }
+  __name(project, "project");
+  function toRemote(name, e) {
+    const transport = e.transport ?? (e.url ? "http" : "stdio");
+    const env = e.env ?? {};
+    const envKeys = Object.keys(env);
+    const headers = transport === "http" ? e.headers ?? {} : {};
+    const headerKeys = Object.keys(headers);
+    const auth = authOf(e, transport);
+    return {
+      name,
+      transport,
+      enabled: e.enabled !== false,
+      command: transport === "stdio" ? e.command : void 0,
+      argsPreview: transport === "stdio" && e.args?.length ? e.args.join(" ") : void 0,
+      url: transport === "http" ? e.url : void 0,
+      host: transport === "http" && e.url ? hostOf(e.url) : void 0,
+      auth,
+      oauth: auth === "oauth",
+      envKeys,
+      secretsSet: envKeys.filter((k) => String(env[k] ?? "").length > 0),
+      headerKeys,
+      headersSet: headerKeys.filter((k) => String(headers[k] ?? "").length > 0),
+      bearerTokenSet: transport === "http" && String(e.bearerToken ?? "").length > 0,
+      bearerTokenEnv: transport === "http" ? e.bearerTokenEnv : void 0
+    };
+  }
+  __name(toRemote, "toRemote");
+  function mergeSecrets(prev, submitted) {
+    const merged = { ...prev ?? {} };
+    for (const [k, v] of Object.entries(submitted)) {
+      const key = String(k).trim();
+      if (!key) continue;
+      const val = String(v ?? "");
+      if (val.length > 0) merged[key] = val;
+      else delete merged[key];
+    }
+    return Object.keys(merged).length > 0 ? merged : void 0;
+  }
+  __name(mergeSecrets, "mergeSecrets");
+  return {
+    reproject(adopt) {
+      const src = readSource();
+      let added = false;
+      for (const [name, entry] of Object.entries(adopt ?? {})) {
+        if (src.servers[name] || !entry || typeof entry !== "object") continue;
+        src.servers[name] = { ...entry, enabled: true };
+        added = true;
+      }
+      if (added) writeSource(src);
+      else project(src);
+    },
+    list() {
+      const src = readSource();
+      return Object.entries(src.servers).map(([name, e]) => toRemote(name, e));
+    },
+    save(draft) {
+      const name = String(draft?.name ?? "").trim();
+      if (!name) return { ok: false, message: "A connector needs a name." };
+      if (!SERVER_NAME.test(name))
+        return { ok: false, message: 'A connector name may use only letters, digits, "-" and "_".' };
+      if (draft.transport !== void 0 && !isTransport(draft.transport))
+        return { ok: false, message: "Unknown transport." };
+      if (draft.auth !== void 0 && !isAuth(draft.auth))
+        return { ok: false, message: "Unknown authentication type." };
+      const src = readSource();
+      const prev = src.servers[name] ?? {};
+      const entry = { ...prev };
+      const transport = draft.transport ?? prev.transport ?? (draft.url || prev.url ? "http" : "stdio");
+      entry.transport = transport;
+      if (transport === "stdio") {
+        if (draft.command !== void 0) entry.command = String(draft.command).trim();
+        const args = cleanArgs(draft.args);
+        if (args !== void 0) entry.args = args;
+        delete entry.url;
+        delete entry.headers;
+        delete entry.auth;
+        delete entry.bearerToken;
+        delete entry.bearerTokenEnv;
+        delete entry.oauth;
+        if (!entry.command) return { ok: false, message: "A local (stdio) connector needs a command." };
+      } else {
+        if (draft.url !== void 0) entry.url = String(draft.url).trim();
+        if (entry.url) entry.url = upgradeLegacyUrl(entry.url);
+        if (draft.auth !== void 0) entry.auth = draft.auth;
+        else if (draft.oauth !== void 0) entry.auth = draft.oauth ? "oauth" : "none";
+        if (draft.bearerTokenEnv !== void 0) {
+          const v = String(draft.bearerTokenEnv).trim();
+          if (v) entry.bearerTokenEnv = v;
+          else delete entry.bearerTokenEnv;
+        }
+        if (draft.bearerToken !== void 0) {
+          const v = String(draft.bearerToken);
+          if (v.length > 0) entry.bearerToken = v;
+          else delete entry.bearerToken;
+        }
+        if (draft.headers !== void 0) {
+          const merged = mergeSecrets(prev.headers, draft.headers);
+          if (merged) entry.headers = merged;
+          else delete entry.headers;
+        }
+        if (draft.auth === void 0 && (entry.bearerToken || entry.bearerTokenEnv)) entry.auth = "bearer";
+        if (entry.auth !== void 0) delete entry.oauth;
+        delete entry.command;
+        delete entry.args;
+        if (!entry.url) return { ok: false, message: "A remote (http) connector needs a URL." };
+        if (isSseUrl(entry.url))
+          return {
+            ok: false,
+            message: "That looks like a legacy SSE endpoint, which isn't supported. Use the server's streamable HTTP URL (often ending in /mcp)."
+          };
+        if (entry.bearerTokenEnv && !ENV_NAME.test(entry.bearerTokenEnv))
+          return { ok: false, message: "The token variable must be an environment variable name, like GITHUB_TOKEN." };
+        if (authOf(entry, "http") === "bearer" && !entry.bearerToken && !entry.bearerTokenEnv)
+          return { ok: false, message: "A bearer connector needs a token, or the name of an env var holding one." };
+      }
+      if (draft.env !== void 0) {
+        const merged = mergeSecrets(prev.env, draft.env);
+        if (merged) entry.env = merged;
+        else delete entry.env;
+      }
+      entry.enabled = prev.enabled ?? true;
+      src.servers[name] = entry;
+      try {
+        writeSource(src);
+      } catch (e) {
+        return { ok: false, message: `Couldn't write MCP config: ${e instanceof Error ? e.message : String(e)}` };
+      }
+      return { ok: true, message: `Saved "${name}".` };
+    },
+    setEnabled(name, enabled) {
+      const src = readSource();
+      if (!src.servers[name]) return { ok: false, message: "No such connector." };
+      src.servers[name].enabled = !!enabled;
+      try {
+        writeSource(src);
+      } catch (e) {
+        return { ok: false, message: `Couldn't write MCP config: ${e instanceof Error ? e.message : String(e)}` };
+      }
+      return { ok: true, message: `${enabled ? "Enabled" : "Disabled"} "${name}".` };
+    },
+    remove(name) {
+      const src = readSource();
+      if (!src.servers[name]) return { ok: false, message: "Not configured." };
+      delete src.servers[name];
+      try {
+        writeSource(src);
+      } catch (e) {
+        return { ok: false, message: `Couldn't write MCP config: ${e instanceof Error ? e.message : String(e)}` };
+      }
+      return { ok: true, message: `Removed "${name}".` };
+    }
+  };
+}
+__name(makeMcpControl, "makeMcpControl");
+
+// src/mcp/catalog.ts?ext=privateer-connect
+function hostedCapable(e) {
+  if (e.hosted !== void 0) return e.hosted;
+  return e.transport === "http" && e.oauth === true;
+}
+__name(hostedCapable, "hostedCapable");
+var MCP_CATALOG = [
+  {
+    id: "github",
+    name: "github",
+    label: "GitHub",
+    blurb: "Repos, issues, and pull requests.",
+    transport: "stdio",
+    command: "npx",
+    args: ["-y", "@modelcontextprotocol/server-github"],
+    env: { GITHUB_PERSONAL_ACCESS_TOKEN: "" },
+    needs: "token",
+    fill: "GITHUB_PERSONAL_ACCESS_TOKEN",
+    credUrl: "https://github.com/settings/tokens"
+  },
+  {
+    id: "filesystem",
+    name: "filesystem",
+    label: "Filesystem",
+    blurb: "Read and write files in a folder you pick.",
+    transport: "stdio",
+    command: "npx",
+    args: ["-y", "@modelcontextprotocol/server-filesystem", "/path/to/folder"],
+    needs: "path",
+    fill: "/path/to/folder"
+  },
+  {
+    id: "notion",
+    name: "notion",
+    label: "Notion",
+    blurb: "Pages, databases, and blocks.",
+    transport: "stdio",
+    command: "npx",
+    args: ["-y", "@notionhq/notion-mcp-server"],
+    env: { NOTION_TOKEN: "" },
+    needs: "token",
+    fill: "NOTION_TOKEN",
+    credUrl: "https://www.notion.so/my-integrations"
+  },
+  {
+    id: "linear",
+    name: "linear",
+    label: "Linear",
+    blurb: "Issues and projects. Sign in via browser.",
+    transport: "http",
+    // /sse is GONE — it 404s on both GET and POST (checked 2026-07-31). Linear moved
+    // to the Streamable HTTP endpoint; the old URL silently failed for anyone who
+    // added Linear from this picker. Mirrored from the client copy on 2026-08-06.
+    url: "https://mcp.linear.app/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "slack",
+    name: "slack",
+    label: "Slack",
+    blurb: "Read and post to channels.",
+    transport: "stdio",
+    command: "npx",
+    args: ["-y", "@modelcontextprotocol/server-slack"],
+    env: { SLACK_BOT_TOKEN: "", SLACK_TEAM_ID: "" },
+    needs: "token",
+    fill: "SLACK_BOT_TOKEN",
+    credUrl: "https://api.slack.com/apps"
+  },
+  {
+    id: "postgres",
+    name: "postgres",
+    label: "PostgreSQL",
+    blurb: "Query a Postgres database (read-only).",
+    transport: "stdio",
+    command: "npx",
+    args: ["-y", "@modelcontextprotocol/server-postgres", "postgresql://localhost/mydb"],
+    needs: "path",
+    fill: "postgresql://localhost/mydb"
+  },
+  {
+    id: "playwright",
+    name: "playwright",
+    label: "Browser (Playwright)",
+    blurb: "Drive a real browser to fetch and click.",
+    transport: "stdio",
+    command: "npx",
+    args: ["-y", "@playwright/mcp@latest"],
+    needs: "none"
+  },
+  {
+    id: "memory",
+    name: "memory",
+    label: "Memory",
+    blurb: "A local knowledge-graph scratchpad.",
+    transport: "stdio",
+    command: "npx",
+    args: ["-y", "@modelcontextprotocol/server-memory"],
+    needs: "none"
+  },
+  // ── Remote, browser-authorized (OAuth) ──────────────────────────────────────
+  {
+    id: "sentry",
+    name: "sentry",
+    label: "Sentry",
+    blurb: "Errors, issues, and releases. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.sentry.dev/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "atlassian",
+    name: "atlassian",
+    label: "Jira & Confluence",
+    blurb: "Atlassian issues and pages. Sign in via browser.",
+    transport: "http",
+    // Streamable HTTP; /v1/sse is the legacy SSE endpoint, which Pi does not speak.
+    url: "https://mcp.atlassian.com/v1/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "stripe",
+    name: "stripe",
+    label: "Stripe",
+    blurb: "Payments, customers, and invoices. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.stripe.com",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "asana",
+    name: "asana",
+    label: "Asana",
+    blurb: "Tasks and projects. Sign in via browser.",
+    transport: "http",
+    // Streamable HTTP on the same OAuth server as the legacy /sse endpoint, which Pi does
+    // not speak. (/v2/mcp is a separate app-registration flow.)
+    url: "https://mcp.asana.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  // ── More remote OAuth servers (added 2026-10-20) ───────────────────────────
+  // Mirrors the block of the same name in treeview client/components/mcpCatalog.ts,
+  // minus the rows whose registration refuses a loopback redirect (Calendly). Each
+  // was probed on 2026-10-20: initialize → 401, OAuth discovery, and a dynamic
+  // client registration with http://127.0.0.1:<port>/callback. A full consent →
+  // tools/list round trip has not been run.
+  {
+    // Distinct id from the stdio `notion` entry: the two coexist, and this one
+    // needs no integration token.
+    id: "notion-remote",
+    name: "notion-remote",
+    label: "Notion",
+    blurb: "Pages, databases, and search. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.notion.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "supabase-remote",
+    name: "supabase-remote",
+    label: "Supabase",
+    blurb: "Projects, tables, and SQL. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.supabase.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "gitlab",
+    name: "gitlab",
+    label: "GitLab",
+    blurb: "Projects, issues, and merge requests. Sign in via browser.",
+    transport: "http",
+    url: "https://gitlab.com/api/v4/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "vercel",
+    name: "vercel",
+    label: "Vercel",
+    blurb: "Deployments, logs, and projects. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.vercel.com/",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "netlify",
+    name: "netlify",
+    label: "Netlify",
+    blurb: "Sites, deploys, and forms. Sign in via browser.",
+    transport: "http",
+    url: "https://netlify-mcp.netlify.app/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "cloudflare",
+    name: "cloudflare",
+    label: "Cloudflare",
+    blurb: "Your whole Cloudflare account through its API. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.cloudflare.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "cloudflare-workers",
+    name: "cloudflare-workers",
+    label: "Cloudflare Workers",
+    blurb: "Workers, KV, R2, and D1. Sign in via browser.",
+    transport: "http",
+    url: "https://bindings.mcp.cloudflare.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "cloudflare-observability",
+    name: "cloudflare-observability",
+    label: "Cloudflare Observability",
+    blurb: "Worker logs and analytics. Sign in via browser.",
+    transport: "http",
+    url: "https://observability.mcp.cloudflare.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "neon",
+    name: "neon",
+    label: "Neon",
+    blurb: "Serverless Postgres projects, branches, and SQL. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.neon.tech/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "prisma",
+    name: "prisma",
+    label: "Prisma Postgres",
+    blurb: "Databases, migrations, and queries. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.prisma.io/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "instantdb",
+    name: "instantdb",
+    label: "InstantDB",
+    blurb: "Apps, schemas, and data. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.instantdb.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "buildkite",
+    name: "buildkite",
+    label: "Buildkite",
+    blurb: "Pipelines, builds, and jobs. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.buildkite.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "grafana",
+    name: "grafana",
+    label: "Grafana",
+    blurb: "Dashboards, metrics, and alerts. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.grafana.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "honeycomb",
+    name: "honeycomb",
+    label: "Honeycomb",
+    blurb: "Traces, queries, and SLOs. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.honeycomb.io/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "posthog",
+    name: "posthog",
+    label: "PostHog",
+    blurb: "Product analytics, flags, and errors. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.posthog.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "amplitude",
+    name: "amplitude",
+    label: "Amplitude",
+    blurb: "Charts, cohorts, and experiments. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.amplitude.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "mixpanel",
+    name: "mixpanel",
+    label: "Mixpanel",
+    blurb: "Events, funnels, and reports. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.mixpanel.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "semgrep",
+    name: "semgrep",
+    label: "Semgrep",
+    blurb: "Scan code for security issues. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.semgrep.ai/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "port",
+    name: "port",
+    label: "Port",
+    blurb: "Your software catalog and developer portal. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.port.io/v1",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "stytch",
+    name: "stytch",
+    label: "Stytch",
+    blurb: "Auth projects, users, and settings. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.stytch.dev/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "globalping",
+    name: "globalping",
+    label: "Globalping",
+    blurb: "Ping, traceroute, and DNS from probes worldwide. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.globalping.dev/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "apify",
+    name: "apify",
+    label: "Apify",
+    blurb: "Run scrapers and actors. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.apify.com",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "parallel-search",
+    name: "parallel-search",
+    label: "Parallel Search",
+    blurb: "Web search built for agents. Sign in via browser.",
+    transport: "http",
+    url: "https://search-mcp.parallel.ai/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "clickup",
+    name: "clickup",
+    label: "ClickUp",
+    blurb: "Tasks, docs, and spaces. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.clickup.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "monday",
+    name: "monday",
+    label: "monday.com",
+    blurb: "Boards, items, and updates. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.monday.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "todoist",
+    name: "todoist",
+    label: "Todoist",
+    blurb: "Tasks, projects, and due dates. Sign in via browser.",
+    transport: "http",
+    url: "https://ai.todoist.net/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "airtable",
+    name: "airtable",
+    label: "Airtable",
+    blurb: "Bases, tables, and records. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.airtable.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "miro",
+    name: "miro",
+    label: "Miro",
+    blurb: "Boards, sticky notes, and diagrams. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.miro.com/",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "canva",
+    name: "canva",
+    label: "Canva",
+    blurb: "Find, create, and export designs. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.canva.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "webflow",
+    name: "webflow",
+    label: "Webflow",
+    blurb: "Sites, pages, and CMS collections. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.webflow.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "wix",
+    name: "wix",
+    label: "Wix",
+    blurb: "Sites, stores, and bookings. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.wix.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "cloudinary",
+    name: "cloudinary",
+    label: "Cloudinary",
+    blurb: "Upload, search, and transform media assets. Sign in via browser.",
+    transport: "http",
+    url: "https://asset-management.mcp.cloudinary.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "attio",
+    name: "attio",
+    label: "Attio",
+    blurb: "CRM records, lists, and notes. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.attio.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "intercom",
+    name: "intercom",
+    label: "Intercom",
+    blurb: "Conversations, contacts, and tickets. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.intercom.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "zapier",
+    name: "zapier",
+    label: "Zapier",
+    blurb: "Run actions across thousands of apps. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.zapier.com/api/mcp/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "paypal",
+    name: "paypal",
+    label: "PayPal",
+    blurb: "Invoices, orders, and transactions. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.paypal.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "square",
+    name: "square",
+    label: "Square",
+    blurb: "Payments, catalog, and orders. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.squareup.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "ramp",
+    name: "ramp",
+    label: "Ramp",
+    blurb: "Spend, cards, and reimbursements. Sign in via browser.",
+    transport: "http",
+    url: "https://ramp-mcp-remote.ramp.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "morningstar",
+    name: "morningstar",
+    label: "Morningstar",
+    blurb: "Fund and stock research data. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.morningstar.com/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "thoughtspot",
+    name: "thoughtspot",
+    label: "ThoughtSpot",
+    blurb: "Ask questions of your analytics data. Sign in via browser.",
+    transport: "http",
+    url: "https://agent.thoughtspot.app/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "jam",
+    name: "jam",
+    label: "Jam",
+    blurb: "Bug reports with recordings and logs. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.jam.dev/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "granola",
+    name: "granola",
+    label: "Granola",
+    blurb: "Your meeting notes. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.granola.ai/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "fathom",
+    name: "fathom",
+    label: "Fathom",
+    blurb: "Meeting recordings, transcripts, and summaries. Sign in via browser.",
+    transport: "http",
+    url: "https://api.fathom.ai/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "fireflies",
+    name: "fireflies",
+    label: "Fireflies.ai",
+    blurb: "Meeting transcripts and summaries. Sign in via browser.",
+    transport: "http",
+    url: "https://api.fireflies.ai/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "otter",
+    name: "otter",
+    label: "Otter.ai",
+    blurb: "Meeting transcripts and notes. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.otter.ai/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "read-ai",
+    name: "read-ai",
+    label: "Read AI",
+    blurb: "Meeting reports and recaps. Sign in via browser.",
+    transport: "http",
+    url: "https://api.read.ai/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  {
+    id: "tldv",
+    name: "tldv",
+    label: "tl;dv",
+    blurb: "Meeting recordings and highlights. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.tldv.io/mcp",
+    oauth: true,
+    needs: "oauth"
+  },
+  // ── Local, token-authorized ─────────────────────────────────────────────────
+  {
+    id: "brave-search",
+    name: "brave-search",
+    label: "Brave Search",
+    blurb: "Web and local search results.",
+    transport: "stdio",
+    command: "npx",
+    args: ["-y", "@modelcontextprotocol/server-brave-search"],
+    env: { BRAVE_API_KEY: "" },
+    needs: "token",
+    fill: "BRAVE_API_KEY",
+    credUrl: "https://brave.com/search/api/"
+  },
+  {
+    id: "google-maps",
+    name: "google-maps",
+    label: "Google Maps",
+    blurb: "Places, directions, and geocoding.",
+    transport: "stdio",
+    command: "npx",
+    args: ["-y", "@modelcontextprotocol/server-google-maps"],
+    env: { GOOGLE_MAPS_API_KEY: "" },
+    needs: "token",
+    fill: "GOOGLE_MAPS_API_KEY",
+    credUrl: "https://console.cloud.google.com/google/maps-apis/credentials"
+  },
+  {
+    id: "supabase",
+    name: "supabase",
+    label: "Supabase",
+    blurb: "Query and manage your Supabase project.",
+    transport: "stdio",
+    command: "npx",
+    args: ["-y", "@supabase/mcp-server-supabase@latest"],
+    env: { SUPABASE_ACCESS_TOKEN: "" },
+    needs: "token",
+    fill: "SUPABASE_ACCESS_TOKEN",
+    credUrl: "https://supabase.com/dashboard/account/tokens"
+  },
+  {
+    id: "figma",
+    name: "figma",
+    label: "Figma",
+    blurb: "Read designs, frames, and components.",
+    transport: "stdio",
+    command: "npx",
+    args: ["-y", "figma-developer-mcp", "--stdio"],
+    env: { FIGMA_API_KEY: "" },
+    needs: "token",
+    fill: "FIGMA_API_KEY",
+    credUrl: "https://www.figma.com/developers/api#access-tokens"
+  },
+  // ── Google Workspace (needs a Google Cloud OAuth client, then browser sign-in) ─
+  // One server (workspace-mcp) scoped per service via --tools. Runs on uv (uvx),
+  // not npx. Create an OAuth client in Google Cloud once and paste its ID + secret;
+  // the first request opens Google's consent screen on THIS machine.
+  {
+    id: "gmail",
+    name: "gmail",
+    label: "Gmail",
+    blurb: "Read, search, and send email. Google sign-in.",
+    transport: "stdio",
+    command: "uvx",
+    args: ["workspace-mcp", "--tools", "gmail"],
+    env: { GOOGLE_OAUTH_CLIENT_ID: "", GOOGLE_OAUTH_CLIENT_SECRET: "" },
+    needs: "token",
+    fill: "GOOGLE_OAUTH_CLIENT_ID",
+    credUrl: "https://console.cloud.google.com/apis/credentials"
+  },
+  {
+    id: "google-calendar",
+    name: "google-calendar",
+    label: "Google Calendar",
+    blurb: "Events and scheduling. Google sign-in.",
+    transport: "stdio",
+    command: "uvx",
+    args: ["workspace-mcp", "--tools", "calendar"],
+    env: { GOOGLE_OAUTH_CLIENT_ID: "", GOOGLE_OAUTH_CLIENT_SECRET: "" },
+    needs: "token",
+    fill: "GOOGLE_OAUTH_CLIENT_ID",
+    credUrl: "https://console.cloud.google.com/apis/credentials"
+  },
+  {
+    id: "google-drive",
+    name: "google-drive",
+    label: "Google Drive",
+    blurb: "Files and folders in your Drive. Google sign-in.",
+    transport: "stdio",
+    command: "uvx",
+    args: ["workspace-mcp", "--tools", "drive"],
+    env: { GOOGLE_OAUTH_CLIENT_ID: "", GOOGLE_OAUTH_CLIENT_SECRET: "" },
+    needs: "token",
+    fill: "GOOGLE_OAUTH_CLIENT_ID",
+    credUrl: "https://console.cloud.google.com/apis/credentials"
+  },
+  {
+    id: "google-docs",
+    name: "google-docs",
+    label: "Google Docs",
+    blurb: "Read and edit your documents. Google sign-in.",
+    transport: "stdio",
+    command: "uvx",
+    args: ["workspace-mcp", "--tools", "docs"],
+    env: { GOOGLE_OAUTH_CLIENT_ID: "", GOOGLE_OAUTH_CLIENT_SECRET: "" },
+    needs: "token",
+    fill: "GOOGLE_OAUTH_CLIENT_ID",
+    credUrl: "https://console.cloud.google.com/apis/credentials"
+  },
+  {
+    id: "sequential-thinking",
+    name: "sequential-thinking",
+    label: "Sequential Thinking",
+    blurb: "A step-by-step reasoning scratchpad.",
+    transport: "stdio",
+    command: "npx",
+    args: ["-y", "@modelcontextprotocol/server-sequential-thinking"],
+    needs: "none"
+  },
+  // ── Local apps that host their own MCP server ───────────────────────────────
+  // http, but on 127.0.0.1: nothing to install, nothing to authorize, nothing
+  // leaving the machine. See `localHttp` on CatalogEntry for why that needs a flag.
+  {
+    // Unreal Engine 5.8 embeds an MCP server in the EDITOR PROCESS (plugin
+    // `ModelContextProtocol`, surfaced as "Unreal MCP"; the tools come from the
+    // "All Toolsets" plugin, which has to be enabled too). Three facts shape this:
+    //
+    //  1. NO AUTHENTICATION, of any kind. Hence localHttp + auth:"none".
+    //  2. LOOPBACK ONLY. It binds per [HTTPServer.Listeners] DefaultBindAddress
+    //     (default `localhost`) AND rejects non-loopback `Origin` headers — so the
+    //     agent has to be on the same machine as the editor. True for this CLI and
+    //     for the desktop app; not true for a hosted agent, hence hosted: false.
+    //  3. IT IS ONLY UP WHILE THE EDITOR IS. A connector that fails here usually
+    //     means "Unreal isn't running", not "this is misconfigured".
+    //
+    // The port and path are editable in Editor Preferences → Model Context
+    // Protocol, so `needs: "url"`: the one setup step is confirming the endpoint
+    // rather than pasting a secret. `ModelContextProtocol.GenerateClientConfig` in
+    // the UE console prints the URL the editor is actually serving.
+    id: "unreal",
+    name: "unreal",
+    label: "Unreal Engine",
+    blurb: "Drive the Unreal Editor \u2014 actors, lighting, materials, tests.",
+    transport: "http",
+    url: "http://127.0.0.1:8000/mcp",
+    localHttp: true,
+    needs: "url",
+    hosted: false,
+    docsUrl: "https://dev.epicgames.com/documentation/unreal-engine/unreal-mcp-in-unreal-editor"
+  },
+  {
+    // Godot ships no MCP server of its own. This is the "Godot MCP Native" editor
+    // plugin (MIT, Godot Asset Library) — chosen because it serves streamable HTTP
+    // from INSIDE the editor process, which is the same shape as the Unreal entry
+    // above and needs nothing installed on the machine outside Godot itself.
+    //
+    // Deliberately NOT one of the npx-launched Godot servers: those shell out to the
+    // `godot` BINARY headlessly (a second, non-interactive copy of the project rather
+    // than the editor the user is looking at), and every one of them is configured by
+    // a GODOT_PATH env var — a filesystem path, which is neither a token nor a
+    // placeholder arg, so this catalog has no `needs` that could ask for it honestly.
+    //
+    // Two things differ from Unreal, and they are the only two:
+    //  1. THE PLUGIN IS NOT PART OF THE ENGINE. Install "Godot MCP Native" from the
+    //     Asset Library and enable it in Project → Project Settings → Plugins. Until
+    //     that is done the port is simply closed, which looks identical to "Godot is
+    //     not running" — so the setup guide below matters more here than it does for
+    //     Unreal, where the plugin ships with 5.8.
+    //  2. ITS BIND ADDRESS IS NOT DOCUMENTED UPSTREAM. Unreal's is (loopback, plus an
+    //     Origin check); this one's is not, so the honest claim is only that WE dial
+    //     127.0.0.1 — never that the editor cannot be reached from the LAN. Its own
+    //     `auth_enabled` is off by default (user://mcp_settings.cfg), which is the
+    //     knob to turn on when the machine sits on a network you don't trust.
+    //
+    // Everything else matches Unreal: nothing to authorize on the wire we use (hence
+    // localHttp + auth:"none"), it answers only while the editor is open, and the port
+    // is editable (`http_port`) — hence needs:"url", confirm the endpoint.
+    id: "godot",
+    name: "godot",
+    label: "Godot Engine",
+    blurb: "Drive the Godot editor \u2014 scenes, nodes, scripts, resources.",
+    transport: "http",
+    url: "http://127.0.0.1:9080/mcp",
+    localHttp: true,
+    needs: "url",
+    // Same reason as Unreal: hostedCapable() derives its answer from `oauth`, so
+    // http-with-no-auth would otherwise read as hostable. An enclave cannot reach a
+    // loopback port on the user's desk.
+    hosted: false,
+    docsUrl: "https://github.com/yurineko73/Godot-MCP-Native"
+  }
+];
+function promptOrder(e) {
+  const keys = Object.keys(e.env ?? {});
+  if (!e.fill || !keys.includes(e.fill)) return keys;
+  return [e.fill, ...keys.filter((k) => k !== e.fill)];
+}
+__name(promptOrder, "promptOrder");
+function draftFromCatalog(e, input = {}) {
+  const draft = { name: e.name, transport: e.transport };
+  if (e.transport === "stdio") {
+    draft.command = e.command;
+    const filled = input.fill?.trim();
+    draft.args = (e.args ?? []).map((a) => e.fill && a === e.fill && filled ? filled : a);
+  } else {
+    draft.url = input.url?.trim() || e.url;
+    draft.auth = e.localHttp ? "none" : e.oauth ?? true ? "oauth" : "none";
+  }
+  const keys = Object.keys(e.env ?? {});
+  if (keys.length > 0) {
+    const env = {};
+    for (const k of keys) env[k] = input.env?.[k] ?? "";
+    draft.env = env;
+  }
+  return draft;
+}
+__name(draftFromCatalog, "draftFromCatalog");
+
+// src/config/hosted.ts?ext=privateer-connect
+function isHosted() {
+  return process.env.HARBOR_HOSTED === "1";
+}
+__name(isHosted, "isHosted");
+
+// extensions/privateer-connect.ts?ext=privateer-connect
+var MAX_VISIBLE = 10;
+var SecretField = class {
+  static {
+    __name(this, "SecretField");
+  }
+  value = "";
+  // Returns true when the keystroke was consumed. Escape sequences (arrows, F-keys)
+  // are swallowed rather than inserted — the naive "strip control chars" approach
+  // would leave "[A" behind from an up-arrow and silently corrupt the token.
+  handleInput(data) {
+    const paste = /^\x1b\[200~([\s\S]*?)\x1b\[201~$/.exec(data);
+    if (paste) {
+      this.value += paste[1].replace(/[\x00-\x1f\x7f]/g, "");
+      return true;
+    }
+    if (data.startsWith("\x1B")) return true;
+    if (data === "\x7F" || data === "\b") {
+      this.value = this.value.slice(0, -1);
+      return true;
+    }
+    if (data === "") {
+      this.value = "";
+      return true;
+    }
+    const printable = data.replace(/[\x00-\x1f\x7f]/g, "");
+    if (!printable) return false;
+    this.value += printable;
+    return true;
+  }
+  // Dots, capped so a long PAT can't wrap the panel. Length is intentionally NOT
+  // exact past the cap — it isn't information the user needs, and it leaks the
+  // token's length to anyone watching.
+  display() {
+    if (!this.value) return "";
+    return "\u2022".repeat(Math.min(this.value.length, 32));
+  }
+};
+var isHttpTarget = /* @__PURE__ */ __name((answers) => /^https?:\/\//i.test((answers.target ?? "").trim()), "isHttpTarget");
+function customSteps(existing) {
+  const hosted = isHosted();
+  const target = existing ? existing.transport === "http" ? existing.url : [existing.command, existing.argsPreview].filter(Boolean).join(" ") : void 0;
+  return [
+    {
+      key: "name",
+      prompt: "Connector name",
+      hint: "Lowercase, no spaces \u2014 it prefixes every tool, e.g. github__list_issues",
+      initial: existing?.name
+    },
+    {
+      key: "target",
+      prompt: hosted ? "Server URL" : "Launch command, or an https:// URL",
+      hint: hosted ? "e.g. https://mcp.example.com/mcp \u2014 a hosted agent can't run a local command." : "e.g. npx -y @modelcontextprotocol/server-memory  \xB7  or  https://mcp.example.com/mcp",
+      initial: target,
+      validate: hosted ? (v) => /^https?:\/\//i.test(v.trim()) ? void 0 : "A hosted agent can only reach remote connectors \u2014 this needs an https:// URL." : void 0
+    },
+    {
+      key: "env",
+      prompt: "Environment variables (optional)",
+      hint: "KEY=value, comma-separated. Leave blank for none.",
+      optional: true,
+      // Nothing to set them ON when there is no local process to spawn, and their
+      // values are credentials at rest — both reasons a hosted agent skips this.
+      when: /* @__PURE__ */ __name(() => !hosted, "when")
+    },
+    {
+      key: "bearerToken",
+      prompt: "Bearer token (optional)",
+      hint: existing?.bearerTokenSet ? "Leave blank to keep the token already saved." : "Leave blank to sign in through the browser instead (OAuth).",
+      secret: true,
+      optional: true,
+      // Never asked on a hosted agent: the home is tmpfs and a stored token would have
+      // to rest somewhere we can read. OAuth is the only credential it may hold.
+      when: /* @__PURE__ */ __name((a) => !hosted && isHttpTarget(a), "when")
+    },
+    {
+      key: "headers",
+      prompt: "Extra HTTP headers (optional)",
+      hint: "KEY=value, comma-separated \u2014 e.g. X-Api-Version=2. Leave blank for none.",
+      // Header values are credentials as often as not, so this is masked like a token
+      // — and for the same reason a hosted agent is never offered it.
+      secret: true,
+      optional: true,
+      when: /* @__PURE__ */ __name((a) => !hosted && isHttpTarget(a), "when")
+    }
+  ];
+}
+__name(customSteps, "customSteps");
+function parseEnv(answer) {
+  const env = {};
+  for (const pair of answer.split(",")) {
+    const eq = pair.indexOf("=");
+    if (eq <= 0) continue;
+    const key = pair.slice(0, eq).trim();
+    const val = pair.slice(eq + 1).trim();
+    if (key) env[key] = val;
+  }
+  return env;
+}
+__name(parseEnv, "parseEnv");
+function buildCustomDraft(answers) {
+  const name = (answers.name ?? "").trim();
+  const target = (answers.target ?? "").trim();
+  const draft = { name };
+  if (/^https?:\/\//i.test(target)) {
+    draft.transport = "http";
+    draft.url = target;
+    const token = (answers.bearerToken ?? "").trim();
+    const headers = parseEnv(answers.headers ?? "");
+    const hasHeaders = Object.keys(headers).length > 0;
+    if (hasHeaders) draft.headers = headers;
+    if (token) {
+      draft.auth = "bearer";
+      draft.bearerToken = token;
+    } else if (hasHeaders) {
+      draft.auth = "none";
+    } else {
+      draft.auth = "oauth";
+    }
+  } else {
+    draft.transport = "stdio";
+    const parts = target.split(/\s+/).filter(Boolean);
+    draft.command = parts[0] ?? "";
+    draft.args = parts.slice(1);
+  }
+  const env = parseEnv(answers.env ?? "");
+  if (Object.keys(env).length > 0) draft.env = env;
+  return draft;
+}
+__name(buildCustomDraft, "buildCustomDraft");
+function pendingFromCatalog(e) {
+  const steps = [];
+  if (e.needs === "token") {
+    for (const key of promptOrder(e)) {
+      steps.push({
+        key: `env:${key}`,
+        prompt: `Paste your ${key}`,
+        hint: e.credUrl ? `Get one at ${e.credUrl}` : void 0,
+        secret: true,
+        // Only the primary credential is required; the rest can be filled later.
+        optional: key !== e.fill
+      });
+    }
+  } else if (e.needs === "path" && e.fill) {
+    steps.push({
+      key: "fill",
+      prompt: e.fill.startsWith("postgres") ? "Connection string" : "Folder path",
+      hint: `Replaces the placeholder ${e.fill}`,
+      initial: e.fill
+    });
+  } else if (e.needs === "url") {
+    steps.push({
+      key: "url",
+      prompt: "Server URL",
+      hint: `Default is ${e.url} \u2014 change it only if you moved it.`,
+      initial: e.url,
+      validate: /* @__PURE__ */ __name((v) => /^https?:\/\//i.test(v.trim()) ? void 0 : "That needs to be an http:// or https:// URL.", "validate")
+    });
+  }
+  return {
+    title: e.label,
+    steps,
+    origin: "catalog",
+    build: /* @__PURE__ */ __name((answers) => {
+      const env = {};
+      for (const [k, v] of Object.entries(answers)) {
+        if (k.startsWith("env:")) env[k.slice(4)] = v;
+      }
+      return draftFromCatalog(e, { env, fill: answers.fill, url: answers.url });
+    }, "build"),
+    note: e.needs === "oauth" ? `Authorize it in a browser on THIS machine: /mcp login ${e.name}` : e.localHttp ? `Works whenever ${e.label} is running on this machine. Nothing to authorize.` : void 0
+  };
+}
+__name(pendingFromCatalog, "pendingFromCatalog");
+var NEEDS_LABEL = {
+  token: "needs a token",
+  path: "needs a path",
+  oauth: "browser sign-in",
+  url: "confirm the URL",
+  none: "no setup"
+};
+function catalogRows() {
+  const hosted = isHosted();
+  const entries = hosted ? MCP_CATALOG.filter(hostedCapable) : MCP_CATALOG;
+  const rows = entries.map((e) => ({
+    entry: e,
+    label: e.label,
+    blurb: e.blurb,
+    needsLabel: NEEDS_LABEL[e.needs] ?? ""
+  }));
+  rows.push({
+    label: "Custom\u2026",
+    // Custom survives the filter because a custom REMOTE OAuth connector is fine here;
+    // it's stdio and stored tokens that aren't. customSteps enforces that.
+    blurb: hosted ? "Any https:// URL with browser sign-in." : "Any stdio command or http URL.",
+    needsLabel: ""
+  });
+  return rows;
+}
+__name(catalogRows, "catalogRows");
+var ConnectPanel = class extends Container {
+  static {
+    __name(this, "ConnectPanel");
+  }
+  tui;
+  theme;
+  control = makeMcpControl();
+  close;
+  view = "list";
+  servers = [];
+  changed = false;
+  status = "";
+  // list view
+  index = 0;
+  // Name of the connector a first `d` has armed for removal; see removeSelected.
+  armedRemoval;
+  // catalog view
+  rows = [];
+  filtered = [];
+  catalogIndex = 0;
+  search = new Input();
+  // form view
+  pending;
+  stepIndex = 0;
+  answers = {};
+  field = new Input();
+  secret = new SecretField();
+  body = new Container();
+  footer = new Text("", 1, 0);
+  _focused = false;
+  constructor(opts) {
+    super();
+    this.tui = opts.tui;
+    this.theme = opts.theme;
+    this.close = opts.close;
+    this.addChild(this.body);
+    this.addChild(new Spacer(1));
+    this.addChild(this.footer);
+    this.search.onSubmit = () => this.chooseCatalogRow();
+    this.field.onSubmit = () => this.submitStep();
+    this.reload();
+  }
+  get focused() {
+    return this._focused;
+  }
+  set focused(v) {
+    this._focused = v;
+    this.search.focused = v && this.view === "catalog";
+    this.field.focused = v && this.view === "form" && !this.currentStep()?.secret;
+  }
+  reload() {
+    try {
+      this.servers = this.control.list().sort((a, b) => a.name.localeCompare(b.name));
+    } catch (e) {
+      this.servers = [];
+      this.status = `Couldn't read MCP config: ${e.message}`;
+    }
+    if (this.index >= this.servers.length) this.index = Math.max(0, this.servers.length - 1);
+    this.refresh();
+  }
+  currentStep() {
+    return this.pending?.steps[this.stepIndex];
+  }
+  // A step is asked only when its `when` predicate (if any) passes against the answers
+  // collected so far. Navigation walks over the hidden ones in both directions, and
+  // the position counter reports the VISIBLE steps so "2/3" doesn't count a question
+  // the user will never see.
+  stepVisible(i) {
+    const step = this.pending?.steps[i];
+    if (!step) return false;
+    return step.when ? step.when(this.answers) : true;
+  }
+  seekStep(from, dir) {
+    const total = this.pending?.steps.length ?? 0;
+    for (let i = from; i >= 0 && i < total; i += dir) {
+      if (this.stepVisible(i)) return i;
+    }
+    return void 0;
+  }
+  visiblePosition() {
+    const total = this.pending?.steps.length ?? 0;
+    let at = 0;
+    let of = 0;
+    for (let i = 0; i < total; i++) {
+      if (!this.stepVisible(i)) continue;
+      of++;
+      if (i <= this.stepIndex) at = of;
+    }
+    return { at, of };
+  }
+  // -- rendering ------------------------------------------------------------
+  refresh() {
+    const t = this.theme;
+    this.body.clear();
+    if (this.view === "list") this.renderList();
+    else if (this.view === "catalog") this.renderCatalog();
+    else this.renderForm();
+    if (this.status) {
+      this.body.addChild(new Spacer(1));
+      this.body.addChild(new Text(t.fg("muted", `  ${this.status}`), 1, 0));
+    }
+    this.tui.requestRender();
+  }
+  // The one-line summary of a connector's readiness. This is the whole reason the
+  // list exists: "saved" and "usable" are different states, and an http/OAuth server
+  // that was never authorized fails only at call time otherwise.
+  statusOf(s) {
+    const t = this.theme;
+    if (s.transport === "http" && s.oauth) {
+      return t.fg("warning", `\u26A0 authorize: /mcp login ${s.name}`);
+    }
+    if (s.envKeys.length > 0) {
+      const missing = s.envKeys.filter((k) => !s.secretsSet.includes(k));
+      if (missing.length > 0) return t.fg("warning", `\u26A0 needs ${missing.join(", ")}`);
+      return t.fg("success", "\u26BF credentials set");
+    }
+    return t.fg("muted", s.argsPreview ?? s.url ?? "");
+  }
+  renderList() {
+    const t = this.theme;
+    this.body.addChild(new Text(t.fg("accent", t.bold("Connect a service")), 1, 0));
+    this.body.addChild(
+      new Text(t.fg("muted", "MCP connectors on this machine \u2014 shared with the app and the harbor."), 1, 0)
+    );
+    this.body.addChild(new Spacer(1));
+    if (this.servers.length === 0) {
+      this.body.addChild(new Text(t.fg("muted", "  No connectors yet."), 1, 0));
+    } else {
+      const width = Math.max(...this.servers.map((s) => s.name.length));
+      this.servers.forEach((s, i) => {
+        const sel = i === this.index;
+        const prefix = sel ? t.fg("accent", "\u2192 ") : "  ";
+        const dot = s.enabled ? t.fg("success", "\u25CF") : t.fg("muted", "\u25CB");
+        const name = sel ? t.fg("accent", s.name.padEnd(width)) : t.fg("text", s.name.padEnd(width));
+        const transport = t.fg("muted", s.transport.padEnd(5));
+        this.body.addChild(new Text(`${prefix}${dot} ${name}  ${transport}  ${this.statusOf(s)}`, 1, 0));
+      });
+    }
+    this.body.addChild(new Spacer(1));
+    const addSel = this.index === this.servers.length;
+    this.body.addChild(
+      new Text(
+        addSel ? t.fg("accent", "\u2192 + Add a connector\u2026") : t.fg("muted", "  + Add a connector\u2026"),
+        1,
+        0
+      )
+    );
+    this.footer.setText(
+      t.fg("muted", "\u2191\u2193 move   space enable/disable   \u23CE edit   a add   d remove   esc done")
+    );
+  }
+  renderCatalog() {
+    const t = this.theme;
+    this.body.addChild(new Text(t.fg("accent", t.bold("Add a connector")), 1, 0));
+    if (isHosted()) {
+      this.body.addChild(
+        new Text(t.fg("muted", "  Hosted agent \u2014 remote connectors with browser sign-in only."), 1, 0)
+      );
+    }
+    this.body.addChild(new Spacer(1));
+    this.body.addChild(this.search);
+    this.body.addChild(new Spacer(1));
+    if (this.filtered.length === 0) {
+      this.body.addChild(new Text(t.fg("muted", "  No matches"), 1, 0));
+    } else {
+      const width = Math.max(...this.filtered.map((r) => r.label.length));
+      const start = Math.max(
+        0,
+        Math.min(this.catalogIndex - Math.floor(MAX_VISIBLE / 2), this.filtered.length - MAX_VISIBLE)
+      );
+      const end = Math.min(start + MAX_VISIBLE, this.filtered.length);
+      for (let i = start; i < end; i++) {
+        const row = this.filtered[i];
+        const sel = i === this.catalogIndex;
+        const prefix = sel ? t.fg("accent", "\u2192 ") : "  ";
+        const label = sel ? t.fg("accent", row.label.padEnd(width)) : t.fg("text", row.label.padEnd(width));
+        const needs = row.needsLabel ? t.fg("muted", `  ${row.needsLabel}`) : "";
+        this.body.addChild(new Text(`${prefix}${label}  ${t.fg("muted", row.blurb)}${needs}`, 1, 0));
+      }
+    }
+    this.footer.setText(t.fg("muted", "\u2191\u2193 move   \u23CE choose   type to search   esc back"));
+  }
+  renderForm() {
+    const t = this.theme;
+    const p = this.pending;
+    const step = this.currentStep();
+    const pos = this.visiblePosition();
+    const counter = pos.of > 1 ? `  ${pos.at}/${pos.of}` : "";
+    this.body.addChild(new Text(t.fg("accent", t.bold(p.title)) + t.fg("muted", counter), 1, 0));
+    this.body.addChild(new Spacer(1));
+    this.body.addChild(new Text(`  ${t.fg("text", step.prompt)}`, 1, 0));
+    if (step.hint) this.body.addChild(new Text(`  ${t.fg("muted", step.hint)}`, 1, 0));
+    this.body.addChild(new Spacer(1));
+    if (step.secret) {
+      const shown = this.secret.display();
+      this.body.addChild(
+        new Text(`  ${shown || t.fg("muted", "(nothing typed yet)")}`, 1, 0)
+      );
+    } else {
+      this.body.addChild(this.field);
+    }
+    this.footer.setText(
+      t.fg(
+        "muted",
+        step.optional ? "\u23CE next (blank to skip)   esc back" : "\u23CE next   esc back"
+      )
+    );
+  }
+  // -- actions --------------------------------------------------------------
+  openCatalog() {
+    this.view = "catalog";
+    this.rows = catalogRows();
+    this.filtered = this.rows;
+    this.catalogIndex = 0;
+    this.search.setValue("");
+    this.search.focused = this._focused;
+    this.field.focused = false;
+    this.status = "";
+    this.refresh();
+  }
+  applySearch() {
+    const q = this.search.getValue();
+    this.filtered = q ? fuzzyFilter(this.rows, q, (r) => `${r.label} ${r.blurb}`) : this.rows;
+    this.catalogIndex = 0;
+    this.refresh();
+  }
+  chooseCatalogRow() {
+    const row = this.filtered[this.catalogIndex];
+    if (!row) return;
+    const pending = row.entry ? pendingFromCatalog(row.entry) : {
+      title: "Custom connector",
+      steps: customSteps(),
+      origin: "catalog",
+      build: buildCustomDraft
+    };
+    this.startForm(pending);
+  }
+  startForm(pending) {
+    this.pending = pending;
+    this.stepIndex = 0;
+    this.answers = {};
+    if (pending.steps.length === 0) {
+      this.save();
+      return;
+    }
+    this.view = "form";
+    this.loadStep();
+  }
+  loadStep() {
+    const step = this.currentStep();
+    this.secret.value = "";
+    this.field.setValue(step.initial ?? "");
+    this.field.focused = this._focused && !step.secret;
+    this.search.focused = false;
+    this.refresh();
+  }
+  submitStep() {
+    const step = this.currentStep();
+    const value = step.secret ? this.secret.value : this.field.getValue().trim();
+    if (!value && !step.optional) {
+      this.status = "That one's required.";
+      this.refresh();
+      return;
+    }
+    const bad = value && step.validate ? step.validate(value) : void 0;
+    if (bad) {
+      this.status = bad;
+      this.refresh();
+      return;
+    }
+    this.answers[step.key] = value;
+    this.status = "";
+    const next = this.seekStep(this.stepIndex + 1, 1);
+    if (next !== void 0) {
+      this.stepIndex = next;
+      this.loadStep();
+      return;
+    }
+    this.save();
+  }
+  save() {
+    const p = this.pending;
+    let res;
+    try {
+      res = this.control.save(p.build(this.answers));
+    } catch (e) {
+      res = { ok: false, message: e.message };
+    }
+    if (!res.ok) {
+      this.status = res.message ?? "Couldn't save that connector.";
+      if (this.view === "form") this.refresh();
+      else {
+        this.view = "list";
+        this.reload();
+      }
+      return;
+    }
+    this.changed = true;
+    this.status = p.note ? `${res.message} ${p.note}` : res.message ?? "Saved.";
+    this.pending = void 0;
+    this.view = "list";
+    this.reload();
+  }
+  toggleSelected() {
+    const s = this.servers[this.index];
+    if (!s) return;
+    const res = this.control.setEnabled(s.name, !s.enabled);
+    if (res.ok) this.changed = true;
+    this.status = res.message ?? "";
+    this.reload();
+  }
+  // Removal is the one irreversible action here — a deleted connector takes its
+  // credential with it, and there is no undo. So `d` ARMS and a second `d` confirms,
+  // rather than a single keystroke next to the navigation keys wiping a token you'd
+  // have to go re-mint. Any other key (including moving the cursor) disarms.
+  removeSelected() {
+    const s = this.servers[this.index];
+    if (!s) return;
+    if (this.armedRemoval !== s.name) {
+      this.armedRemoval = s.name;
+      this.status = `Press d again to remove "${s.name}"${s.secretsSet.length > 0 ? " and its stored credentials" : ""}.`;
+      this.refresh();
+      return;
+    }
+    this.armedRemoval = void 0;
+    const res = this.control.remove(s.name);
+    if (res.ok) this.changed = true;
+    this.status = res.message ?? "";
+    this.reload();
+  }
+  editSelected() {
+    const s = this.servers[this.index];
+    if (!s) return;
+    this.startForm({
+      title: `Edit ${s.name}`,
+      steps: customSteps(s),
+      origin: "list",
+      build: buildCustomDraft
+    });
+  }
+  // -- input ----------------------------------------------------------------
+  handleInput(data) {
+    if (this.view === "list") return this.handleListInput(data);
+    if (this.view === "catalog") return this.handleCatalogInput(data);
+    return this.handleFormInput(data);
+  }
+  handleListInput(data) {
+    const kb = getKeybindings();
+    const last = this.servers.length;
+    if (data !== "d" && data !== "x" && this.armedRemoval) {
+      this.armedRemoval = void 0;
+      this.status = "";
+    }
+    if (kb.matches(data, "tui.select.up")) {
+      this.index = this.index === 0 ? last : this.index - 1;
+      this.refresh();
+    } else if (kb.matches(data, "tui.select.down")) {
+      this.index = this.index === last ? 0 : this.index + 1;
+      this.refresh();
+    } else if (kb.matches(data, "tui.select.confirm")) {
+      if (this.index === last) this.openCatalog();
+      else this.editSelected();
+    } else if (kb.matches(data, "tui.select.cancel")) {
+      this.close({
+        changed: this.changed,
+        message: this.changed ? this.status || "MCP connectors updated." : void 0
+      });
+    } else if (data === " ") {
+      if (this.index !== last) this.toggleSelected();
+    } else if (data === "a" || data === "A") {
+      this.openCatalog();
+    } else if (data === "d" || data === "x") {
+      if (this.index !== last) this.removeSelected();
+    }
+  }
+  handleCatalogInput(data) {
+    const kb = getKeybindings();
+    if (kb.matches(data, "tui.select.up")) {
+      if (!this.filtered.length) return;
+      this.catalogIndex = this.catalogIndex === 0 ? this.filtered.length - 1 : this.catalogIndex - 1;
+      this.refresh();
+    } else if (kb.matches(data, "tui.select.down")) {
+      if (!this.filtered.length) return;
+      this.catalogIndex = this.catalogIndex === this.filtered.length - 1 ? 0 : this.catalogIndex + 1;
+      this.refresh();
+    } else if (kb.matches(data, "tui.select.confirm")) {
+      this.chooseCatalogRow();
+    } else if (kb.matches(data, "tui.select.cancel")) {
+      this.view = "list";
+      this.search.focused = false;
+      this.status = "";
+      this.refresh();
+    } else {
+      this.search.handleInput(data);
+      this.applySearch();
+    }
+  }
+  handleFormInput(data) {
+    const kb = getKeybindings();
+    const step = this.currentStep();
+    if (kb.matches(data, "tui.select.cancel")) {
+      const prev = this.stepIndex > 0 ? this.seekStep(this.stepIndex - 1, -1) : void 0;
+      if (prev !== void 0) {
+        this.stepIndex = prev;
+        this.loadStep();
+      } else {
+        this.view = this.pending?.origin ?? "list";
+        this.pending = void 0;
+        this.status = "";
+        this.field.focused = false;
+        this.search.focused = this._focused && this.view === "catalog";
+        this.refresh();
+      }
+      return;
+    }
+    if (kb.matches(data, "tui.select.confirm")) {
+      this.submitStep();
+      return;
+    }
+    if (step.secret) {
+      this.secret.handleInput(data);
+      this.refresh();
+      return;
+    }
+    this.field.handleInput(data);
+    this.refresh();
+  }
+};
+function privateerConnect(pi) {
+  if (typeof pi.registerCommand !== "function") return;
+  migrateMcpProjection();
+  pi.registerCommand("connect", {
+    description: "Add, enable, or remove MCP connectors (GitHub, Notion, Linear, \u2026)",
+    handler: /* @__PURE__ */ __name(async (_args, ctx) => {
+      const ui = ctx?.ui;
+      if (!ui?.custom) {
+        ui?.notify?.("/connect needs an interactive terminal.", "warning");
+        return;
+      }
+      const result = await ui.custom(
+        (tui, theme, _kb, close) => new ConnectPanel({ tui, theme, close: /* @__PURE__ */ __name((r) => close(r), "close") })
+      );
+      if (!result?.changed) return;
+      try {
+        await ctx.reload?.();
+      } catch {
+      }
+      ui.notify?.(`${result.message ?? "MCP connectors updated."}  Check it with /mcp.`, "info");
+    }, "handler")
+  });
+}
+__name(privateerConnect, "privateerConnect");
+export {
+  privateerConnect as default
+};