Merge feat/per-tool-enable-disable into halo-main

Fast-forward-compatible merge that brings halo-main up to the PR branch
tip. Cherry-picks already on halo-main (f7694c8, f548de1, c3e99ac,
ba2dcad) are byte-identical to their PR-branch originals (6032ed8,
d584b16, b5f0a0c, 7bc7c73), so the 3-way merge resolves cleanly and the
resulting tree matches the PR tip.

Brings in:
- Spec 047 (CPU hotpath fix + coalescer + SSE payload embed)
- Spec 048 (tray refetch elimination)
- Spec 046 (local launcher for HTTP/SSE upstreams + onboarding wizard v2)
- Spec 044 phase H diagnostics counters
- Spec 042 telemetry tier 2 finalization
- The 3 PR-smart-mcp-proxy#463 commits that depend on the Spec 047 coalescer:
  - perf(runtime): build servers.changed payload lazily in coalescer drainer
  - fix(runtime): honour app-shutdown cancellation in coalescer drainer
  - fix(sse): plumb SecurityScan via management.ListServers
- All other upstream-merged fixes between 2b9b5f9 and 7bc7c73

Authorized force-push equivalent: the user explicitly requested halo-main
be set to the PR branch tip; force-push was blocked by the git MCP and
the sandbox lacks raw-git auth, so we take the merge-commit path which
achieves tree-equality without rewriting halo-main history.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

# Conflicts:
#	.gitignore
#	oas/docs.go

Author: electrolobzik

.gitignore

@@ -5,6 +5,7 @@
 *.so
 *.dylib
 /mcpproxy
+/test/launcher-server/launcher-server
 __debug_bin*
 
 # Playwright MCP artifacts
@@ -139,4 +140,4 @@ native/macos/MCPProxy/.build/
 # Wrangler session cache
 .wrangler/
 
-.run
+.run

CLAUDE.md

@@ -157,6 +157,53 @@ go test -race ./internal/... -v     # Race detection
 
 **E2E Prerequisites**: Node.js, npm, jq, built mcpproxy binary.
 
+### Verifying Web UI changes (Playwright + rich HTML report)
+
+When you modify the Web UI (any Vue file under `frontend/src/`), verify it end-to-end with a Playwright sweep that captures screenshots and packages them into a self-contained HTML report. This is the same workflow used to verify Spec 046 v2 — see `specs/046-local-first-onboarding/verification/` for a worked example.
+
+The pattern, in order:
+
+1. **Stand up a fresh mcpproxy.** Use a throwaway data-dir so persisted state doesn't bleed between runs:
+   ```bash
+   pkill -f 'mcpproxy serve.*<port>' 2>/dev/null; sleep 1
+   rm -rf /tmp/mcpproxy-uitest/{config.db,index.bleve,logs} 2>/dev/null
+   cat > /tmp/mcpproxy-uitest/mcp_config.json <<'EOF'
+   { "listen": "127.0.0.1:18081", "data_dir": "/tmp/mcpproxy-uitest", "api_key": "uitest", "enable_web_ui": true, "enable_socket": false, "telemetry": {"enabled": false}, "mcpServers": [] }
+   EOF
+   ./mcpproxy serve --config=/tmp/mcpproxy-uitest/mcp_config.json --listen=127.0.0.1:18081 --log-level=info > /tmp/mcpproxy-uitest/server.log 2>&1 &
+   until curl -sf -H "X-API-Key: uitest" http://127.0.0.1:18081/api/v1/status >/dev/null; do sleep 1; done
+   ```
+2. **Reuse the existing Playwright install.** `e2e/playwright/node_modules` already has Playwright + Chromium 1217. Symlink it into your scratch dir:
+   ```bash
+   mkdir -p /tmp/uitest && cd /tmp/uitest
+   ln -sfn /Users/user/repos/mcpproxy-go/e2e/playwright/node_modules ./node_modules
+   ```
+3. **Pin the Chromium binary in `playwright.config.ts`** so Playwright doesn't try to download a different version:
+   ```ts
+   import { defineConfig } from '@playwright/test';
+   export default defineConfig({
+     testDir: '.', timeout: 30000, fullyParallel: false, workers: 1, retries: 0,
+     use: {
+       headless: true,
+       viewport: { width: 1440, height: 900 },
+       launchOptions: {
+         executablePath: '/Users/user/Library/Caches/ms-playwright/chromium-1217/chrome-mac-arm64/Google Chrome for Testing.app/Contents/MacOS/Google Chrome for Testing',
+       },
+     },
+   });
+   ```
+4. **Write the spec.** Use `data-test` attributes already on the components (the project convention). For new components, add them. Drive scenarios with `page.locator('[data-test="..."]')`. Always use `page.waitForLoadState('domcontentloaded')` — `networkidle` hangs because of the SSE channel. Snapshot each state with `page.screenshot({ path: ... })`. Number screenshots in execution order so the report renders left-to-right.
+5. **Run.** `./node_modules/.bin/playwright test --reporter=list`. Iterate until green.
+6. **Build the rich HTML report.** A short Python script that base64-embeds each PNG and wraps it in a styled `<details>` per scenario produces a single self-contained HTML file the user can open offline. Pattern: top summary card with pass/fail counts, then one collapsible per scenario with `Expected` / `Observed` / inline screenshot. The reference implementation is `/tmp/wizard-v2-verify/build-report.py` from the v2 work — clone it and update the `SCENARIOS` list. Output goes to `specs/<feature>/verification/report.html`.
+7. **Drop screenshots + report alongside the spec.** Always commit them with the spec changes — they're part of the trace.
+8. **Surface the report.** End your reply with `open <path-to-report.html>` so the user can review without re-running the suite.
+
+Key gotchas:
+- The wizard's `<dialog>` element renders as `[open]` only when the Vue store sets it. To assert open/closed state robustly, query the dialog property in `page.evaluate()`, not aria-hidden or styling.
+- `pkill -f 'mcpproxy ... <port>'` matches the merge-detection regex in user hooks. Ignore the `Merge-detection trigger` notifications when no actual merge happened.
+- The default config from a stub file does NOT trigger `applyFirstRunDockerIsolation` — that only runs when the config file is absent at boot. To test the "Docker auto-enabled" path, either let mcpproxy create the config or pre-set `docker_isolation.enabled: true` in your stub.
+- For browser-driven verification of subtle states (badge counts, empty/loaded transitions), prefer the Playwright spec over ad-hoc screenshots from the chrome-in-chrome MCP — the spec is reproducible and a CI agent can re-run it.
+
 ### Linting
 ```bash
 ./scripts/run-linter.sh             # Requires golangci-lint v1.59.1+
@@ -719,6 +766,10 @@ See `docs/prerelease-builds.md` for download instructions.
 - No new persistent storage. Diagnostic state lives on in-memory stateview snapshot. Fix-attempt audit rows reuse existing activity log (`ActivityBucket` in BBolt). Telemetry counters are in-memory only (consistent with spec 042). (044-diagnostics-taxonomy)
 - Markdown (agent instruction files, wiki articles); optionally shell or AppleScript helpers for bootstrap idempotency + Paperclip AI (paperclipai/paperclip, MIT) running locally on loopback :3100; Synapbus on kubic; Anthropic API via Paperclip's Claude Code subprocess adapter (045-paperclip-cockpit)
 - Paperclip's embedded Postgres (existing, port 54329); Synapbus DB (existing); no new storage in mcpproxy-go (045-paperclip-cockpit)
+- Go 1.24 (toolchain go1.24.10); Swift 5.9 (macOS 13+); TypeScript 5.9 / Vue 3.5 (frontend) + `go.etcd.io/bbolt` (existing), `go.uber.org/zap` (existing), `github.com/mark3labs/mcp-go` (existing). No new deps. (047-cpu-hotpath-fix)
+- BBolt (`~/.mcpproxy/config.db`) — read-only on the hot path; no schema change. (047-cpu-hotpath-fix)
+- Swift 5.9 (macOS 13+); Go 1.24 only for the verification harness, no Go changes in scope. + SwiftUI/AppKit (existing), Combine (existing for the periodic timer pattern). No new deps. (048-tray-refetch-elimination)
+- None. Pure in-memory state. (048-tray-refetch-elimination)
 
 ## Recent Changes
 - 001-update-version-display: Added Go 1.24 (toolchain go1.24.10)

README.md

@@ -76,6 +76,13 @@ sudo dnf config-manager --add-repo https://rpm.mcpproxy.app/mcpproxy.repo
 sudo dnf install -y mcpproxy
 ```
 
+Arch Linux (AUR): [`mcpproxy-bin`](https://aur.archlinux.org/packages/mcpproxy-bin)
+```bash
+yay -S mcpproxy-bin
+# or
+git clone https://aur.archlinux.org/mcpproxy-bin.git && cd mcpproxy-bin && makepkg -si
+```
+
 Both packages ship a hardened `systemd` unit and start the service automatically. Repository signing key fingerprint: `3B6F A1AD 5D53 59DA 51F1  8DDC E1B5 9B9B A1CB 8A3B`.
 
 For one-off `.deb` / `.rpm` downloads (air-gapped installs), grab them from the [latest release](https://github.com/smart-mcp-proxy/mcpproxy-go/releases/latest).

cmd/mcpproxy/connect_cmd.go

@@ -27,7 +27,7 @@ func GetConnectCommand() *cobra.Command {
 AI coding clients. This modifies the client's config file to add an HTTP/SSE
 entry pointing to the running MCPProxy instance.
 
-Supported clients: claude-code, cursor, windsurf, vscode, codex, gemini
+Supported clients: claude-code, cursor, windsurf, vscode, codex, gemini, opencode
 
 A backup of the original config file is created before any modification.
 
@@ -36,6 +36,7 @@ Examples:
   mcpproxy connect claude-code               # Register in Claude Code
   mcpproxy connect cursor --force            # Overwrite existing entry
   mcpproxy connect codex --name my-proxy     # Custom server name
+  mcpproxy connect opencode                  # Register in OpenCode
   mcpproxy connect --all                     # Register in all supported clients`,
 		Args: cobra.MaximumNArgs(1),
 		RunE: runConnect,

cmd/mcpproxy/connect_cmd_test.go

@@ -0,0 +1,21 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/connect"
+)
+
+func TestConnectClientRegistry_IncludesOpenCode(t *testing.T) {
+	clients := connect.GetAllClients()
+	found := false
+	for _, c := range clients {
+		if c.ID == "opencode" {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Fatal("expected opencode in client registry")
+	}
+}

contrib/linux-repos/apt-publish.sh

@@ -52,7 +52,7 @@ echo "[1/5] syncing bucket s3://${APT_BUCKET} -> ${workdir}"
 if [[ "${DRY_RUN}" == "true" ]]; then
   echo "  dry-run: skipping sync-down"
 else
-  aws s3 sync "s3://${APT_BUCKET}/" "${workdir}/" --no-progress
+  aws s3 sync "s3://${APT_BUCKET}/" "${workdir}/" --quiet
 fi
 
 # Set up standard directory structure even if empty
@@ -148,15 +148,15 @@ else
   # fetch Release + Packages.gz together, so that a user running `apt update`
   # never sees a Release referencing a stale Packages.gz.
   aws s3 sync "${workdir}/dists/" "s3://${APT_BUCKET}/dists/" \
-    --cache-control "public, max-age=60, must-revalidate" --no-progress --delete
+    --cache-control "public, max-age=60, must-revalidate" --quiet --delete
   # Pool artifacts are immutable
   aws s3 sync "${workdir}/pool/" "s3://${APT_BUCKET}/pool/" \
-    --cache-control "public, max-age=31536000, immutable" --no-progress --delete
+    --cache-control "public, max-age=31536000, immutable" --quiet --delete
   # Public key
   aws s3 cp "${workdir}/mcpproxy.gpg" "s3://${APT_BUCKET}/mcpproxy.gpg" \
-    --cache-control "public, max-age=86400" --no-progress
+    --cache-control "public, max-age=86400" --quiet
   aws s3 cp "${workdir}/mcpproxy.gpg.asc" "s3://${APT_BUCKET}/mcpproxy.gpg.asc" \
-    --cache-control "public, max-age=86400" --no-progress
+    --cache-control "public, max-age=86400" --quiet
 fi
 
 echo "apt-publish: OK"

contrib/linux-repos/rpm-publish.sh

@@ -42,7 +42,7 @@ echo "[1/7] syncing bucket s3://${RPM_BUCKET} -> ${workdir}"
 if [[ "${DRY_RUN}" == "true" ]]; then
   echo "  dry-run: skipping sync-down"
 else
-  aws s3 sync "s3://${RPM_BUCKET}/" "${workdir}/" --no-progress
+  aws s3 sync "s3://${RPM_BUCKET}/" "${workdir}/" --quiet
 fi
 mkdir -p "${workdir}/x86_64" "${workdir}/aarch64"
 
@@ -157,12 +157,12 @@ else
   # Per-arch content: metadata short cache, rpms immutable
   for arch in x86_64 aarch64; do
     aws s3 sync "${workdir}/${arch}/repodata/" "s3://${RPM_BUCKET}/${arch}/repodata/" \
-      --cache-control "public, max-age=60, must-revalidate" --no-progress --delete
+      --cache-control "public, max-age=60, must-revalidate" --quiet --delete
     # rpms — upload individually with immutable cache (sync --cache-control is per-run)
     for f in "${workdir}/${arch}/"*.rpm; do
       [[ -e "${f}" ]] || continue
       aws s3 cp "${f}" "s3://${RPM_BUCKET}/${arch}/$(basename "${f}")" \
-        --cache-control "public, max-age=31536000, immutable" --no-progress
+        --cache-control "public, max-age=31536000, immutable" --quiet
     done
     # Delete rpms that no longer exist locally (after pruning)
     aws s3 ls "s3://${RPM_BUCKET}/${arch}/" --no-paginate \
@@ -172,16 +172,16 @@ else
         [[ -z "${remote}" ]] && continue
         if [[ ! -f "${workdir}/${arch}/${remote}" ]]; then
           echo "  deleting stale ${arch}/${remote}"
-          aws s3 rm "s3://${RPM_BUCKET}/${arch}/${remote}" --no-progress
+          aws s3 rm "s3://${RPM_BUCKET}/${arch}/${remote}" --quiet
         fi
       done
   done
   aws s3 cp "${workdir}/mcpproxy.repo" "s3://${RPM_BUCKET}/mcpproxy.repo" \
-    --cache-control "public, max-age=3600" --no-progress
+    --cache-control "public, max-age=3600" --quiet
   aws s3 cp "${workdir}/mcpproxy.gpg" "s3://${RPM_BUCKET}/mcpproxy.gpg" \
-    --cache-control "public, max-age=86400" --no-progress
+    --cache-control "public, max-age=86400" --quiet
   aws s3 cp "${workdir}/mcpproxy.gpg.asc" "s3://${RPM_BUCKET}/mcpproxy.gpg.asc" \
-    --cache-control "public, max-age=86400" --no-progress
+    --cache-control "public, max-age=86400" --quiet
 fi
 
 echo "rpm-publish: OK"

docs/cli-management-commands.md

@@ -352,6 +352,14 @@ mcpproxy upstream restart --all
 
 **Note:** Restart does not require confirmation as it's non-destructive.
 
+**Locally-launched HTTP/SSE upstreams:** when a server is configured with both
+`command` and an HTTP/SSE `url` (see [docs/configuration.md](configuration.md#locally-launched-http--sse-servers)),
+`restart` stops the spawned child (`SIGTERM` → grace → `SIGKILL`) before
+re-running Connect. The grace timeout is fixed at 5s today; the next start
+won't begin until the previous child is fully reaped, so you can rely on the
+port being free after the command returns. Stop ordering is: close MCP client
+→ stop launched child → release per-server state.
+
 ---
 
 ### `mcpproxy doctor`

docs/configuration.md

@@ -147,8 +147,9 @@ MCPProxy looks for configuration in these locations (in order):
 | `args` | array | No | Command arguments |
 | `url` | string | Yes* | Server URL (required for `http`/`sse`/`streamable-http` protocols) |
 | `headers` | object | No | HTTP headers for HTTP-based protocols |
-| `working_dir` | string | No | Working directory for stdio servers (default: current directory) |
-| `env` | object | No | Environment variables for stdio servers |
+| `working_dir` | string | No | Working directory for stdio servers, or for the locally-launched child of an HTTP/SSE server (default: current directory) |
+| `env` | object | No | Environment variables for stdio servers, or for the locally-launched child of an HTTP/SSE server |
+| `launcher_wait_timeout` | duration | No | When `command` is set together with an HTTP/SSE `url`, how long mcpproxy waits for that URL to become reachable after spawning the child (e.g. `"15s"`, default `"30s"`) |
 | `oauth` | object | No | OAuth configuration (see [OAuth Configuration](#oauth-configuration)) |
 | `isolation` | object | No | Per-server Docker isolation settings (see [Docker Isolation](#docker-isolation)) |
 | `enabled` | boolean | No | Enable/disable server (default: `true`) |
@@ -210,6 +211,54 @@ MCPProxy looks for configuration in these locations (in order):
 }
 ```
 
+### Locally-launched HTTP / SSE servers
+
+By default `command` is only used for `stdio` servers. When you set `command`
+together with an HTTP/SSE `url` and an explicit `protocol` of `http`, `sse`,
+or `streamable-http`, mcpproxy will:
+
+1. Spawn the command (with `args`, `env`, `working_dir`, and Docker isolation
+   exactly like a stdio server).
+2. Wait up to `launcher_wait_timeout` (default 30s) for `url` to accept a TCP
+   connection.
+3. Connect via the configured HTTP/SSE transport.
+4. Own the child's lifecycle — the process is stopped (`SIGTERM`, then
+   `SIGKILL` after a grace period) on disconnect, restart, server-disable, or
+   mcpproxy shutdown. Unexpected exits trigger an automatic disconnect, which
+   the existing reconnect path picks up.
+
+```json
+{
+  "name": "local-http-mcp",
+  "protocol": "http",
+  "url": "http://127.0.0.1:9999/mcp",
+  "command": "node",
+  "args": ["./examples/echo-http-server.js", "--port", "9999"],
+  "working_dir": "/path/to/repo",
+  "launcher_wait_timeout": "15s",
+  "enabled": true
+}
+```
+
+`stdout` and `stderr` of the child are routed to the per-server log, so
+`mcpproxy upstream logs <name>` continues to work the same way it does for
+stdio servers.
+
+#### Behaviour matrix when both `command` and `url` are set
+
+| `protocol` | `command` | `url` | Behaviour |
+|---|---|---|---|
+| `stdio` (explicit) | set | any | Stdio transport, child via stdin/stdout — `url` ignored. |
+| `http` / `sse` / `streamable-http` (explicit) | set | set | **Locally-launched HTTP/SSE** — spawn child, wait for URL, connect via network. |
+| `http` / `sse` / `streamable-http` (explicit) | unset | set | Connect to remote URL — no spawn. |
+| `auto` or unset | set | any | Stdio (`command` wins over `url` for back-compat — set `protocol` explicitly to opt into the launcher). |
+| `auto` or unset | unset | set | HTTP/SSE remote — no spawn. |
+
+The "command wins" rule under `auto` is intentional: it preserves backwards
+compatibility with configurations written before the launcher feature
+existed. To launch a local HTTP/SSE server you **must** set `protocol`
+explicitly to one of `http`, `sse`, or `streamable-http`.
+
 ### OAuth Configuration
 
 ```json

docs/getting-started/installation.md

@@ -4,7 +4,7 @@ title: Installation
 sidebar_label: Installation
 sidebar_position: 1
 description: Install MCPProxy on macOS, Windows, or Linux
-keywords: [install, setup, homebrew, dmg, windows, linux, deb, rpm, apt, dnf]
+keywords: [install, setup, homebrew, dmg, windows, linux, deb, rpm, apt, dnf, arch, aur]
 ---
 
 # Installation
@@ -73,6 +73,29 @@ sudo dnf install -y mcpproxy
 
 Supported architectures: `x86_64`, `aarch64`.
 
+### Arch Linux — AUR (community-maintained)
+
+MCPProxy is available on the [Arch User Repository](https://aur.archlinux.org/) as [`mcpproxy-bin`](https://aur.archlinux.org/packages/mcpproxy-bin), which installs the official upstream binary plus a hardened systemd unit.
+
+```bash
+# With an AUR helper (recommended)
+yay -S mcpproxy-bin
+
+# Or manually with makepkg
+git clone https://aur.archlinux.org/mcpproxy-bin.git
+cd mcpproxy-bin
+makepkg -si
+```
+
+The package installs `mcpproxy` to `/usr/bin` and ships a systemd user unit at `/usr/lib/systemd/user/mcpproxy.service`.
+
+Enable it with:
+:::note Update cadence
+
+Unlike the apt/dnf repositories above, AUR is community-driven: new versions land via the `mcpproxy-bin` PKGBUILD being bumped, not via a project-controlled mirror. The package is currently kept current by automation in the maintainer's [updater repo](https://github.com/JasonLandbridge/Arch-Linux-AUR-Packages-Updater), so bumps usually appear within a day of a GitHub release. If `yay` reports an old version after a recent release, you can flag the package "out-of-date" on AUR or fall back to the [Tarball install](#tarball-any-distro) below.
+
+:::
+
 ### Debian / Ubuntu — direct `.deb` download (fallback)
 
 If the apt repository isn't reachable (air-gapped installs, behind corporate proxies blocking `mcpproxy.app`, etc.), download the `.deb` from the [releases page](https://github.com/smart-mcp-proxy/mcpproxy-go/releases) and install it locally.