shortcutxl 0.3.52 → 0.3.53

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## [0.3.53]
+
+- **Enterprise MCP OAuth fixes** - Hosted enterprise MCP servers now handle OAuth discovery and proxied requests more reliably.
+
 ## [0.3.52]
 
 - **Team fast mode policy** - Fast Mode is now automatically disabled for team accounts, with a clear message when your team policy blocks it.
@@ -9,181 +13,181 @@
 ## [0.3.51]
 
 - **TUI rendering and text selection** - Improved TUI rendering, scrolling. Fixed text highlighting and selection for copy pastes.
-- **Agentic MCP setup** - Agents can now help set up MCP servers through `shortcut mcp add/list/get/login/logout/remove`, with clearer login, logs, and OAuth settings.
-- **User-requested session settings** - When asked, agents can inspect available models and thinking levels or apply your requested session change.
-- **Skill sync clarity** - Skill sync now shows startup differences plus per-file upload/download changes, source, and visibility.
-- **Fast mode toggle** - Fast Mode now shows in the footer and can be toggled with `alt+f` or `/fast`, with clearer availability warnings.
-- **Scrollable approvals** - Large approval and permission dialogs now scroll properly, including spreadsheet change tables in small terminals.
-
-## [0.3.50]
-
-- **MCP-enabled task agents** - General task agents can now use connected MCP servers, giving delegated work access to the same external tools and resources as the main CLI.
-- **Safer skill uploads** - Uploading skills no longer treats missing local skills as cloud deletions, so remote-only skills stay untouched unless explicitly replaced.
-- **Misc bug fixes** - Shift+A for agent panel, wording, clarity.
-
-## [0.3.49]
-
-- **Transcript scrolling & rendering** - Long conversations now scroll more cleanly with mouse wheel, PageUp/PageDown, and Ctrl+Home/Ctrl+End support while the editor and footer stay pinned.
-- **Longer-running task agents** - Background task agents now get a 30-minute default timeout, reducing early timeouts on bigger jobs.
-- **Clearer path-based skills** - Skills loaded from custom folders are grouped by their real root paths so the agent can find and use them more reliably.
-
-## [0.3.48]
-
-- **Background subagents** - Subagents can now work in the background, be steered during conversations, be revived for additional tasks once they are done, and have their statuses surfaced in the UI.
-- **Skill proposals** - ShortcutXL now automatically browses through past sessions and suggests new skills and skill modifications.
-
-## [0.3.47]
-
-- **GPT-5.5** — Upgraded the OpenAI reasoning model from GPT-5.4 to GPT-5.5 (400K context window, stronger reasoning). 
-- **Out-of-credits message** — When your credit balance runs out, ShortcutXL now shows a clear message instead of silently failing.
-
-## [0.3.46]
-
-- **`alt+m` to cycle modes** — New keyboard shortcut to cycle between Ask, Plan, and Action modes.
-- **Automatic session recovery** — ShortcutXL now silently refreshes your token and retries when the session expires mid-run, instead of surfacing a "Session expired" error.
-
-## [0.3.45]
-
-- **Preserve Excel calculation mode** — ShortcutXL no longer overrides Excel's calculation mode during code execution. If you have manual calculation enabled, it stays manual while Shortcut runs your code.
-
-## [0.3.44]
-
-- **Shorty mascot** — Replaced the braille X logo with a new Shorty block-art mascot.
-- **Plan mode bug fix** — Fixed an issue where plan mode was unable to read files.
-
-## [0.3.43]
-
-- **Security & stability** — Internal hardening fixes across the runtime.
-
-## [0.3.42]
-
-- **Hosted MCP OAuth** — ShortcutXL now supports OAuth-authenticated hosted MCP servers. Configure a hosted MCP in `mcp.json`, then log in from `/mcp` or `/login`, see `login required` status when auth is missing, and log out again directly from the MCP menu.
-- **AgentController context cleanup** — Simplified agent context and prompt behavior for cleaner single-turn and multi-turn execution.
-
-## [0.3.40]
-
-- **Runtime permissions** — New `/permissions` command to review and change what file and shell tools can do. Approve individual workspaces, grant narrower read or read/write exceptions to files and folders outside them, and toggle spreadsheet auto-approve per settings profile.
-- **Skip runtime and spreadsheet permissions** — Explicit `/permissions skip-runtime-permissions` (and matching `--skip-runtime-permissions` / `--skip-spreadsheet-permissions` CLI flags) for when you intentionally want those permission boundaries disabled.
-
-## [0.3.39]
-
-- **Claude Opus 4.7** - Added Claude Opus 4.7 as a selectable Shortcut model with a 1M-token context window.
-- **Clearer mode switching** - Action, Plan, and Installation now each expose only the mode switches that are actually valid from that mode.
-- **More reliable Excel connection handling** - ShortcutXL now gives clearer guidance and better context for Excel and workbook state.
-
-## [0.3.38]
-
-- **Inline `/skill:name` invocations** — Trigger a skill from anywhere in your message, not just the start.
-- **Interactive approval for skill downloads** — `/download-skills` now shows per-skill diffs (modified, local-only, and remote-only files) and asks before replacing a local skill folder with the cloud copy.
-- **Larger context windows** — Claude Opus 4.6 bumped to 400K tokens; GPT-5.4 bumped to 272K tokens.
-
-## [0.3.37]
-
-- **Bug fixes** — Improved stability for autonomous workflows and update checks.
-
-## [0.3.36]
-
-- **Enterprise install fix** - ShortcutXL no longer fails installation on locked-down networks just because WhatsApp phone control depends on a GitHub-hosted package. Standard installs now succeed without needing GitHub SSH access.
-
-## [0.3.35]
-
-- **Edit-mode detection** — When you're editing a cell, ShortcutXL now detects it and waits instead of throwing a cryptic COM error. You'll see a prompt asking you to press Enter or Escape, and execution resumes automatically.
-- **Bug fixes** — General stability and reliability improvements across credit reporting, Excel operations, session resumption, and concurrency.
-
-## [0.3.34]
-
-- **Revamped update flow** - When an update is available at launch, ShortcutXL now prompts before the shell starts and runs the update in the foreground.
-- **Import skills from Claude Code and Codex** - New `/port-skills` lets you register skills from Claude Code, Codex, and `.agents` folders.
-- **Better `/autonomous` continuation** - Long-running autonomous tasks now continue more cleanly after a context refresh instead of losing the thread mid-run.
-
-## [0.2.32]
-
-- **Durable memory** - ShortcutXL now remembers useful context across sessions, so you no longer need to repeat the same preferences and project details every time you start a new conversation.
-- **Faster and more reliable tool use** - Read-only tools can run while the assistant is still streaming, interrupted turns recover more gracefully, and long responses continue more reliably.
-- **`/manage` mode** - New delegation-focused mode for complex work. Use `/manage` when you want the agent to coordinate tasks instead of executing everything directly.
-- **Tool summaries** - The interactive UI now shows short human-readable summaries of tool executions so it's easier to follow what the agent is doing.
-- **Budgeted runs** - New `/budget <token-budget> <task>` command for long-running work with an explicit cumulative token limit.
-- **More reliable MCP connections** - Long-running MCP tools now handle timeouts and progress more gracefully, with clearer errors and better visibility in `/mcp`.
-- **Skill visibility controls** - `/skills` now lets you choose which loaded skills are advertised to the agent. Unchecked skills stay available through explicit `/skill:name`.
-- **Skill upload** - New `/upload-skills` command to push your local user skills to cloud storage, with approval before overwriting or deleting an existing remote copy.
-- **Faster workbook startup context** - ShortcutXL now uses a lighter workbook context during startup, improving responsiveness before deeper workbook inspection is needed.
-
-## [0.2.31]
-
-- **Improved agent behavior quality** — Better exploration, verification, and convention-matching when working with spreadsheets.
-
-## [0.2.30]
-
-- **MCP server support** — Connect external tools via the Model Context Protocol. Ask the agent to set one up and it will walk you through config, credentials via `/connect`, and verification. Use `/mcp` to see connected servers and their tools.
-- **Loops** — Set up recurring tasks with `/loop`. The agent executes them in the background and shows a status line in the footer. Example: `/loop 5m pull latest google earnings when it drops`.
-- **Autonomous mode** — Run `/autonomous` to let the agent tackle complex tasks end-to-end. It collaborates with you on a phased plan, then executes each phase with built-in implementation, testing, and independent review cycles.
-
-## [0.2.28]
-
-- **Three working modes** — Ask questions about your spreadsheet (Ask), plan complex changes before executing (Plan), or jump straight into edits (Action). Switch anytime with `/ask`, `/plan`, `/action`.
-- **Claude Code & Codex plugin integration** — Use ShortcutXL as a skill directly from Claude Code or Codex.
-- **Improved installation experience** — Smoother setup with better error handling and guided prompts.
-- **Built-in help** — `/docs` opens a guide covering features, workflows, and integrations.
-- **Cleaner status bar** — Simplified token usage display in the footer.
-
-## [0.2.27]
-
-- **Friendlier setup experience** — First-time install now shows plain-language step names (e.g. "Calculation Engine" instead of "Python Packages") and a prominent green prompt when Excel needs to be opened.
-
-## [0.2.26]
-
-- **Workbook scope** — When multiple workbooks are open, ShortcutXL now asks which ones to focus on. The agent only sees the workbooks you select, keeping context tight and responses more relevant.
-- **Connections** — Connect external data sources via `/connect`. Supports databases (Snowflake, Postgres, Oracle, MySQL), SaaS APIs (Salesforce, Notion, HubSpot, Airtable), and cloud drives. Credentials are stored in the OS keychain.
-- **Skill sync** — Download shared skills from the cloud with `/download-skills`.
-- **Skill creator** — A built-in eval-driven workflow for authoring, testing, and improving custom skills.
-- **Fixed local install issues** — Resolved a shell path bug that could prevent the CLI from launching after a global npm install.
-
-## [0.2.22]
-
-- **Tool extensions** — Build custom tools that the agent can call.
-- **Sandbox hardening** — The sandbox now blocks more ways code could escape isolation. When you update ShortcutXL, the sandbox automatically updates itself too.
-- **Faster install** — Sandbox is now downloaded on demand instead of bundled.
-
-## [0.2.19]
-
-- **Sandbox & security hardening** — Code execution can now optionally run inside a sandbox (/sandbox) that blocks unauthorized file writes, reads, and in-bound and out-bound network traffic.
-- **Clearer privacy controls** - You can opt out of conversation uploads to our servers for complete privacy.
-
-## [0.2.18]
-
-- **Fixed startup crash** — Resolved a circular import in the Python modules that caused "internal error" on every Excel action.
-
-## [0.2.17]
-
-- **Better change review dialog** — Cell diffs now show full addresses (e.g. `Sheet1!A1`), formula details, and keyboard navigation with arrow keys for scrolling through large changesets.
-- **Alt+V paste is more reliable** — Fixed cases where Alt+V would fail silently. Now gives clear feedback and handles clipboard errors gracefully.
-- **Skill saving bug fixed** — Skills are not saved in the correct directory and survives application updates.
-- **Clean terminal on launch** — Starting ShortcutXL now clears prior output so you always begin with a fresh screen.
-
-## [0.2.14]
-
-- **Python linting & type checking** — Added ruff and pyright checks for the Python modules and tests. Import sorting, unused variables, and type errors are now caught before publish.
-- **Cleaner dead-code detection** — Removed unused TypeScript exports and tightened knip configuration.
-
-## [0.2.13]
-
-- **Stay logged in across terminals** — Previously, opening a new terminal while others were running could force you to log in again. Now your session persists reliably no matter how many terminals you have open.
-
-## [0.2.12]
-
-- **No more popup windows during updates** — Background updates now run silently instead of flashing a command prompt on your screen.
-
-## [0.2.11]
-
-- **More reliable first-time setup** — ShortcutXL now waits for Excel to be fully ready before running its connection test, so setup succeeds on the first try even on slower machines.
-- **Switched to production servers** — All traffic now routes through `shortcut.ai` production endpoints for better performance and reliability.
-
-## [0.2.9]
-
-- **Works without Python on your PATH** — ShortcutXL now finds and loads Python automatically. No more fiddling with environment variables or system settings to get things working.
-
-## [0.1.1]
-
-- **Update notifications** — ShortcutXL tells you when a new version is available and shows you the exact command to upgrade.
-- **Survives reinstalls** — Updating or reinstalling the npm package no longer breaks your Excel setup. Everything keeps working without reconfiguration.
-- **Handles Excel locks gracefully** — If Excel has ShortcutXL loaded during an update, you get a clear message instead of a crash.
+- **Agentic MCP setup** - Agents can now help set up MCP servers through `shortcut mcp add/list/get/login/logout/remove`, with clearer login, logs, and OAuth settings.
+- **User-requested session settings** - When asked, agents can inspect available models and thinking levels or apply your requested session change.
+- **Skill sync clarity** - Skill sync now shows startup differences plus per-file upload/download changes, source, and visibility.
+- **Fast mode toggle** - Fast Mode now shows in the footer and can be toggled with `alt+f` or `/fast`, with clearer availability warnings.
+- **Scrollable approvals** - Large approval and permission dialogs now scroll properly, including spreadsheet change tables in small terminals.
+
+## [0.3.50]
+
+- **MCP-enabled task agents** - General task agents can now use connected MCP servers, giving delegated work access to the same external tools and resources as the main CLI.
+- **Safer skill uploads** - Uploading skills no longer treats missing local skills as cloud deletions, so remote-only skills stay untouched unless explicitly replaced.
+- **Misc bug fixes** - Shift+A for agent panel, wording, clarity.
+
+## [0.3.49]
+
+- **Transcript scrolling & rendering** - Long conversations now scroll more cleanly with mouse wheel, PageUp/PageDown, and Ctrl+Home/Ctrl+End support while the editor and footer stay pinned.
+- **Longer-running task agents** - Background task agents now get a 30-minute default timeout, reducing early timeouts on bigger jobs.
+- **Clearer path-based skills** - Skills loaded from custom folders are grouped by their real root paths so the agent can find and use them more reliably.
+
+## [0.3.48]
+
+- **Background subagents** - Subagents can now work in the background, be steered during conversations, be revived for additional tasks once they are done, and have their statuses surfaced in the UI.
+- **Skill proposals** - ShortcutXL now automatically browses through past sessions and suggests new skills and skill modifications.
+
+## [0.3.47]
+
+- **GPT-5.5** — Upgraded the OpenAI reasoning model from GPT-5.4 to GPT-5.5 (400K context window, stronger reasoning).
+- **Out-of-credits message** — When your credit balance runs out, ShortcutXL now shows a clear message instead of silently failing.
+
+## [0.3.46]
+
+- **`alt+m` to cycle modes** — New keyboard shortcut to cycle between Ask, Plan, and Action modes.
+- **Automatic session recovery** — ShortcutXL now silently refreshes your token and retries when the session expires mid-run, instead of surfacing a "Session expired" error.
+
+## [0.3.45]
+
+- **Preserve Excel calculation mode** — ShortcutXL no longer overrides Excel's calculation mode during code execution. If you have manual calculation enabled, it stays manual while Shortcut runs your code.
+
+## [0.3.44]
+
+- **Shorty mascot** — Replaced the braille X logo with a new Shorty block-art mascot.
+- **Plan mode bug fix** — Fixed an issue where plan mode was unable to read files.
+
+## [0.3.43]
+
+- **Security & stability** — Internal hardening fixes across the runtime.
+
+## [0.3.42]
+
+- **Hosted MCP OAuth** — ShortcutXL now supports OAuth-authenticated hosted MCP servers. Configure a hosted MCP in `mcp.json`, then log in from `/mcp` or `/login`, see `login required` status when auth is missing, and log out again directly from the MCP menu.
+- **AgentController context cleanup** — Simplified agent context and prompt behavior for cleaner single-turn and multi-turn execution.
+
+## [0.3.40]
+
+- **Runtime permissions** — New `/permissions` command to review and change what file and shell tools can do. Approve individual workspaces, grant narrower read or read/write exceptions to files and folders outside them, and toggle spreadsheet auto-approve per settings profile.
+- **Skip runtime and spreadsheet permissions** — Explicit `/permissions skip-runtime-permissions` (and matching `--skip-runtime-permissions` / `--skip-spreadsheet-permissions` CLI flags) for when you intentionally want those permission boundaries disabled.
+
+## [0.3.39]
+
+- **Claude Opus 4.7** - Added Claude Opus 4.7 as a selectable Shortcut model with a 1M-token context window.
+- **Clearer mode switching** - Action, Plan, and Installation now each expose only the mode switches that are actually valid from that mode.
+- **More reliable Excel connection handling** - ShortcutXL now gives clearer guidance and better context for Excel and workbook state.
+
+## [0.3.38]
+
+- **Inline `/skill:name` invocations** — Trigger a skill from anywhere in your message, not just the start.
+- **Interactive approval for skill downloads** — `/download-skills` now shows per-skill diffs (modified, local-only, and remote-only files) and asks before replacing a local skill folder with the cloud copy.
+- **Larger context windows** — Claude Opus 4.6 bumped to 400K tokens; GPT-5.4 bumped to 272K tokens.
+
+## [0.3.37]
+
+- **Bug fixes** — Improved stability for autonomous workflows and update checks.
+
+## [0.3.36]
+
+- **Managed-network install fix** - ShortcutXL no longer fails installation on locked-down networks just because WhatsApp phone control depends on a GitHub-hosted package. Standard installs now succeed without needing GitHub SSH access.
+
+## [0.3.35]
+
+- **Edit-mode detection** — When you're editing a cell, ShortcutXL now detects it and waits instead of throwing a cryptic COM error. You'll see a prompt asking you to press Enter or Escape, and execution resumes automatically.
+- **Bug fixes** — General stability and reliability improvements across credit reporting, Excel operations, session resumption, and concurrency.
+
+## [0.3.34]
+
+- **Revamped update flow** - When an update is available at launch, ShortcutXL now prompts before the shell starts and runs the update in the foreground.
+- **Import skills from Claude Code and Codex** - New `/port-skills` lets you register skills from Claude Code, Codex, and `.agents` folders.
+- **Better `/autonomous` continuation** - Long-running autonomous tasks now continue more cleanly after a context refresh instead of losing the thread mid-run.
+
+## [0.2.32]
+
+- **Durable memory** - ShortcutXL now remembers useful context across sessions, so you no longer need to repeat the same preferences and project details every time you start a new conversation.
+- **Faster and more reliable tool use** - Read-only tools can run while the assistant is still streaming, interrupted turns recover more gracefully, and long responses continue more reliably.
+- **`/manage` mode** - New delegation-focused mode for complex work. Use `/manage` when you want the agent to coordinate tasks instead of executing everything directly.
+- **Tool summaries** - The interactive UI now shows short human-readable summaries of tool executions so it's easier to follow what the agent is doing.
+- **Budgeted runs** - New `/budget <token-budget> <task>` command for long-running work with an explicit cumulative token limit.
+- **More reliable MCP connections** - Long-running MCP tools now handle timeouts and progress more gracefully, with clearer errors and better visibility in `/mcp`.
+- **Skill visibility controls** - `/skills` now lets you choose which loaded skills are advertised to the agent. Unchecked skills stay available through explicit `/skill:name`.
+- **Skill upload** - New `/upload-skills` command to push your local user skills to cloud storage, with approval before overwriting or deleting an existing remote copy.
+- **Faster workbook startup context** - ShortcutXL now uses a lighter workbook context during startup, improving responsiveness before deeper workbook inspection is needed.
+
+## [0.2.31]
+
+- **Improved agent behavior quality** — Better exploration, verification, and convention-matching when working with spreadsheets.
+
+## [0.2.30]
+
+- **MCP server support** — Connect external tools via the Model Context Protocol. Ask the agent to set one up and it will walk you through config, credentials via `/connect`, and verification. Use `/mcp` to see connected servers and their tools.
+- **Loops** — Set up recurring tasks with `/loop`. The agent executes them in the background and shows a status line in the footer. Example: `/loop 5m pull latest google earnings when it drops`.
+- **Autonomous mode** — Run `/autonomous` to let the agent tackle complex tasks end-to-end. It collaborates with you on a phased plan, then executes each phase with built-in implementation, testing, and independent review cycles.
+
+## [0.2.28]
+
+- **Three working modes** — Ask questions about your spreadsheet (Ask), plan complex changes before executing (Plan), or jump straight into edits (Action). Switch anytime with `/ask`, `/plan`, `/action`.
+- **Claude Code & Codex plugin integration** — Use ShortcutXL as a skill directly from Claude Code or Codex.
+- **Improved installation experience** — Smoother setup with better error handling and guided prompts.
+- **Built-in help** — `/docs` opens a guide covering features, workflows, and integrations.
+- **Cleaner status bar** — Simplified token usage display in the footer.
+
+## [0.2.27]
+
+- **Friendlier setup experience** — First-time install now shows plain-language step names (e.g. "Calculation Engine" instead of "Python Packages") and a prominent green prompt when Excel needs to be opened.
+
+## [0.2.26]
+
+- **Workbook scope** — When multiple workbooks are open, ShortcutXL now asks which ones to focus on. The agent only sees the workbooks you select, keeping context tight and responses more relevant.
+- **Connections** — Connect external data sources via `/connect`. Supports databases (Snowflake, Postgres, Oracle, MySQL), SaaS APIs (Salesforce, Notion, HubSpot, Airtable), and cloud drives. Credentials are stored in the OS keychain.
+- **Skill sync** — Download shared skills from the cloud with `/download-skills`.
+- **Skill creator** — A built-in eval-driven workflow for authoring, testing, and improving custom skills.
+- **Fixed local install issues** — Resolved a shell path bug that could prevent the CLI from launching after a global npm install.
+
+## [0.2.22]
+
+- **Tool extensions** — Build custom tools that the agent can call.
+- **Sandbox hardening** — The sandbox now blocks more ways code could escape isolation. When you update ShortcutXL, the sandbox automatically updates itself too.
+- **Faster install** — Sandbox is now downloaded on demand instead of bundled.
+
+## [0.2.19]
+
+- **Sandbox & security hardening** — Code execution can now optionally run inside a sandbox (/sandbox) that blocks unauthorized file writes, reads, and in-bound and out-bound network traffic.
+- **Clearer privacy controls** - You can opt out of conversation uploads to our servers for complete privacy.
+
+## [0.2.18]
+
+- **Fixed startup crash** — Resolved a circular import in the Python modules that caused "internal error" on every Excel action.
+
+## [0.2.17]
+
+- **Better change review dialog** — Cell diffs now show full addresses (e.g. `Sheet1!A1`), formula details, and keyboard navigation with arrow keys for scrolling through large changesets.
+- **Alt+V paste is more reliable** — Fixed cases where Alt+V would fail silently. Now gives clear feedback and handles clipboard errors gracefully.
+- **Skill saving bug fixed** — Skills are not saved in the correct directory and survives application updates.
+- **Clean terminal on launch** — Starting ShortcutXL now clears prior output so you always begin with a fresh screen.
+
+## [0.2.14]
+
+- **Python linting & type checking** — Added ruff and pyright checks for the Python modules and tests. Import sorting, unused variables, and type errors are now caught before publish.
+- **Cleaner dead-code detection** — Removed unused TypeScript exports and tightened knip configuration.
+
+## [0.2.13]
+
+- **Stay logged in across terminals** — Previously, opening a new terminal while others were running could force you to log in again. Now your session persists reliably no matter how many terminals you have open.
+
+## [0.2.12]
+
+- **No more popup windows during updates** — Background updates now run silently instead of flashing a command prompt on your screen.
+
+## [0.2.11]
+
+- **More reliable first-time setup** — ShortcutXL now waits for Excel to be fully ready before running its connection test, so setup succeeds on the first try even on slower machines.
+- **Switched to production servers** — All traffic now routes through `shortcut.ai` production endpoints for better performance and reliability.
+
+## [0.2.9]
+
+- **Works without Python on your PATH** — ShortcutXL now finds and loads Python automatically. No more fiddling with environment variables or system settings to get things working.
+
+## [0.1.1]
+
+- **Update notifications** — ShortcutXL tells you when a new version is available and shows you the exact command to upgrade.
+- **Survives reinstalls** — Updating or reinstalling the npm package no longer breaks your Excel setup. Everything keeps working without reconfiguration.
+- **Handles Excel locks gracefully** — If Excel has ShortcutXL loaded during an update, you get a clear message instead of a crash.

package/dist/app/index.d.ts

@@ -28,9 +28,7 @@ export { resolveCliModel } from './providers/model-resolver.js';
 export { registerShortcutProvider } from './providers/register-shortcut-provider.js';
 export * from './resources/index.js';
 export type { PromptTemplate, Skill } from './resources/index.js';
-export { detectProjectWorkspace, type ProjectWorkspace } from './services/project-workspace.js';
-export { UserContextProvider, fetchUserInfo, type WorkspaceContextValue } from './services/user-context.js';
-export { createWebsiteStorageOperations, type WebsiteStorageOptions } from './services/website-storage.js';
+export { fetchUserInfo, type UserInfo } from './services/user-context.js';
 export { getLastAssistantText } from './session/assistant-text.js';
 export { listAllSessions, listSessions } from './session/session-catalog.js';
 export type { SessionInfo, SessionListProgress } from './session/session-catalog.js';

package/dist/app/index.js

@@ -23,9 +23,7 @@ export { ModelRegistry } from './providers/model-registry.js';
 export { resolveCliModel } from './providers/model-resolver.js';
 export { registerShortcutProvider } from './providers/register-shortcut-provider.js';
 export * from './resources/index.js';
-export { detectProjectWorkspace } from './services/project-workspace.js';
-export { UserContextProvider, fetchUserInfo } from './services/user-context.js';
-export { createWebsiteStorageOperations } from './services/website-storage.js';
+export { fetchUserInfo } from './services/user-context.js';
 export { getLastAssistantText } from './session/assistant-text.js';
 export { listAllSessions, listSessions } from './session/session-catalog.js';
 export { continueRecentSessionManager, createInMemorySessionManager, createSessionManager, forkSessionManager, openSessionManager } from './session/session-factory.js';

package/dist/app/mcp/connection.js

@@ -1,7 +1,7 @@
 /**
  * MCP server connection — connect, listTools, callTool, close.
  */
-import { UnauthorizedError } from '@modelcontextprotocol/sdk/client/auth.js';
+import { extractWWWAuthenticateParams, UnauthorizedError } from '@modelcontextprotocol/sdk/client/auth.js';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
 import { StreamableHTTPClientTransport, StreamableHTTPError } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
@@ -14,6 +14,7 @@ import { getSecret } from '../connectors/secret-store.js';
 import { getHostedMcpOAuthProviderId } from './hosted-oauth-id.js';
 import { createHostedMcpRuntimeAuthProvider } from './hosted-oauth-provider.js';
 import { resolveHostedMcpOAuthTimeoutMs, supportsHostedMcpOAuth } from './oauth-discovery.js';
+import { withHostedMcpProxyFetchOptions } from './proxy-fetch.js';
 import { isHostedServerConfig } from './types.js';
 const DEFAULT_STARTUP_TIMEOUT_MS = 30_000;
 const DEFAULT_TOOL_CALL_TIMEOUT_MS = 600_000;
@@ -301,6 +302,58 @@ function summarizeRequestHeaders(headers) {
         ...(protocolVersion ? { mcpProtocolVersion: protocolVersion } : {})
     });
 }
+function summarizeResponseHeaders(response) {
+    const headerNames = [...response.headers.keys()].sort();
+    const contentType = response.headers.get('content-type');
+    const location = response.headers.get('location');
+    const mcpSessionId = response.headers.get('mcp-session-id');
+    const wwwAuthenticate = response.headers.get('www-authenticate');
+    const authParams = extractWWWAuthenticateParams(response);
+    return JSON.stringify({
+        headerNames,
+        contentType,
+        hasMcpSessionId: !!mcpSessionId,
+        ...(location ? { location: redactUrlForLog(location) } : {}),
+        ...(wwwAuthenticate
+            ? {
+                wwwAuthenticate: {
+                    hasHeader: true,
+                    ...(authParams.error ? { error: authParams.error } : {}),
+                    ...(authParams.scope ? { scope: authParams.scope } : {}),
+                    ...(authParams.resourceMetadataUrl
+                        ? { resourceMetadataUrl: redactUrlForLog(authParams.resourceMetadataUrl.toString()) }
+                        : {})
+                }
+            }
+            : {})
+    });
+}
+function buildMcpHttpRequestLogContext(input, init) {
+    const method = readRequestMethod(input, init);
+    const headers = readRequestHeaders(input, init);
+    const phase = inferMcpHttpPhase(method, init);
+    return `phase='${phase}' method='${method}' url='${redactUrlForLog(input)}' requestHeaders=${summarizeRequestHeaders(headers)}`;
+}
+function summarizeErrorForLog(error, depth = 0) {
+    if (!(error instanceof Error)) {
+        return String(error);
+    }
+    const details = {
+        name: error.name,
+        message: error.message
+    };
+    const record = error;
+    for (const key of ['code', 'errno', 'syscall', 'hostname', 'host', 'port', 'address']) {
+        const value = record[key];
+        if (value !== undefined) {
+            details[key] = value;
+        }
+    }
+    if (record.cause !== undefined && depth < 3) {
+        details.cause = summarizeErrorForLog(record.cause, depth + 1);
+    }
+    return details;
+}
 async function readResponseSnippet(response) {
     try {
         const text = await response.clone().text();
@@ -312,15 +365,21 @@ async function readResponseSnippet(response) {
 }
 export function createHostedMcpLoggingFetch(serverName, fetchImpl = fetch) {
     return async (input, init) => {
-        const response = await fetchImpl(input, init);
+        const startedAt = Date.now();
+        const requestContext = buildMcpHttpRequestLogContext(input, init);
+        let response;
+        try {
+            response = await fetchImpl(input, withHostedMcpProxyFetchOptions(input, init));
+        }
+        catch (err) {
+            log.warn('mcp', `Hosted MCP fetch failed: server='${serverName}' ${requestContext} durationMs=${Date.now() - startedAt} error=${JSON.stringify(summarizeErrorForLog(err))}`);
+            throw err;
+        }
         if (response.ok) {
             return response;
         }
-        const method = readRequestMethod(input, init);
-        const headers = readRequestHeaders(input, init);
-        const phase = inferMcpHttpPhase(method, init);
         const bodySnippet = await readResponseSnippet(response);
-        log.warn('mcp', `Hosted MCP HTTP failure: server='${serverName}' phase='${phase}' method='${method}' url='${redactUrlForLog(input)}' status=${response.status} statusText='${response.statusText}' requestHeaders=${summarizeRequestHeaders(headers)} responseBody='${bodySnippet}'`);
+        log.warn('mcp', `Hosted MCP HTTP failure: server='${serverName}' ${requestContext} durationMs=${Date.now() - startedAt} status=${response.status} statusText='${response.statusText}' responseHeaders=${summarizeResponseHeaders(response)} responseBody='${bodySnippet}'`);
         return response;
     };
 }

package/dist/app/mcp/hosted-oauth-provider.js

@@ -5,6 +5,7 @@ import { startOAuthCallbackServer } from '../auth/oauth-callback-server.js';
 import { getHostedMcpOAuthConfig, getHostedMcpOAuthProviderId } from './hosted-oauth-id.js';
 import { registerManagedMcpOAuthProvider, unregisterManagedMcpOAuthProvider } from './managed-oauth-providers.js';
 import { resolveHostedMcpOAuth, resolveHostedMcpOAuthTimeoutMs } from './oauth-discovery.js';
+import { hostedMcpFetch } from './proxy-fetch.js';
 const DEFAULT_REDIRECT_URL = 'http://127.0.0.1:0/auth/callback';
 const EXPIRY_BUFFER_MS = 30_000;
 // The underlying OAuth provider registry is process-global, so hosted MCP
@@ -250,7 +251,8 @@ export function createHostedMcpOAuthProvider(serverName, config, authStorage, mc
                 const result = await auth(provider, {
                     serverUrl: config.url,
                     scope: resolvedAuth.scope,
-                    resourceMetadataUrl: resolvedAuth.resourceMetadataUrl
+                    resourceMetadataUrl: resolvedAuth.resourceMetadataUrl,
+                    fetchFn: hostedMcpFetch
                 });
                 if (result === 'REDIRECT') {
                     const authorizationCode = parseAuthorizationCode(await callbackServer.waitForCallback(), await provider.state?.());
@@ -258,7 +260,8 @@ export function createHostedMcpOAuthProvider(serverName, config, authStorage, mc
                         serverUrl: config.url,
                         authorizationCode,
                         scope: resolvedAuth.scope,
-                        resourceMetadataUrl: resolvedAuth.resourceMetadataUrl
+                        resourceMetadataUrl: resolvedAuth.resourceMetadataUrl,
+                        fetchFn: hostedMcpFetch
                     });
                 }
                 return toOAuthCredentials(await provider.tokens());
@@ -287,7 +290,8 @@ export function createHostedMcpOAuthProvider(serverName, config, authStorage, mc
             await auth(provider, {
                 serverUrl: config.url,
                 scope: resolvedAuth.scope,
-                resourceMetadataUrl: resolvedAuth.resourceMetadataUrl
+                resourceMetadataUrl: resolvedAuth.resourceMetadataUrl,
+                fetchFn: hostedMcpFetch
             });
             return toOAuthCredentials(await provider.tokens());
         },

package/dist/app/mcp/oauth-discovery.js

@@ -1,5 +1,6 @@
 import { discoverOAuthServerInfo, extractWWWAuthenticateParams } from '@modelcontextprotocol/sdk/client/auth.js';
 import { getHostedMcpOAuthProviderId } from './hosted-oauth-id.js';
+import { withHostedMcpProxyFetchOptions } from './proxy-fetch.js';
 const DEFAULT_DISCOVERY_TIMEOUT_MS = 30_000;
 function normalizeScope(scope) {
     if (!scope) {
@@ -26,7 +27,7 @@ async function probeUnauthorizedChallenge(serverUrl, timeoutMs) {
         const timeout = setTimeout(() => controller.abort(), timeoutMs);
         if (typeof timeout === 'object' && 'unref' in timeout)
             timeout.unref();
-        const response = await fetch(serverUrl, {
+        const init = withHostedMcpProxyFetchOptions(serverUrl, {
             method: 'GET',
             redirect: 'manual',
             signal: controller.signal,
@@ -35,6 +36,7 @@ async function probeUnauthorizedChallenge(serverUrl, timeoutMs) {
                 'mcp-protocol-version': '2024-11-05'
             }
         });
+        const response = await fetch(serverUrl, init);
         clearTimeout(timeout);
         return extractWWWAuthenticateParams(response);
     }
@@ -55,10 +57,7 @@ function createTimedFetch(timeoutMs) {
             ? AbortSignal.any([init.signal, controller.signal])
             : controller.signal;
         try {
-            return await fetch(input, {
-                ...init,
-                signal
-            });
+            return await fetch(input, withHostedMcpProxyFetchOptions(input, { ...init, signal }));
         }
         finally {
             clearTimeout(timeout);

package/dist/app/mcp/proxy-fetch.d.ts

@@ -0,0 +1,3 @@
+export declare function withHostedMcpProxyFetchOptions(input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]): Parameters<typeof fetch>[1];
+export declare const hostedMcpFetch: typeof fetch;
+//# sourceMappingURL=proxy-fetch.d.ts.map