@aexol/spectral 0.9.254 → 0.9.256

package/dist/mcp/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/mcp/commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,YAAY,CAAC;AASzD,wBAAsB,UAAU,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsC/F;AAED,wBAAsB,SAAS,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB9F;AAED,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,gBAAgB,EACrB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAiDf;AAED,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,IAAI,CAAC,CA6Cf;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBpJ"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/mcp/commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,YAAY,CAAC;AASzD,wBAAsB,UAAU,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsC/F;AAED,wBAAsB,SAAS,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB9F;AAED,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,gBAAgB,EACrB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAiDf;AAED,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,IAAI,CAAC,CAkDf;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBpJ"}

package/dist/mcp/commands.js

@@ -122,6 +122,9 @@ export async function authenticateServer(serverName, config, ctx) {
             ctx.ui.notify(`OAuth authentication successful for "${serverName}"!\n` +
                 `Run /mcp reconnect ${serverName} to connect with the new token.`, "info");
         }
+        else if (status === "in_progress") {
+            ctx.ui.notify(`OAuth authentication for "${serverName}" is already in progress — deferring to the in-flight flow.`, "info");
+        }
         else {
             ctx.ui.notify(`OAuth authentication failed for "${serverName}".`, "error");
         }

package/dist/mcp/direct-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"direct-tools.d.ts","sourceRoot":"","sources":["../../src/mcp/direct-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAc,MAAM,YAAY,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAwEzD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,aAAa,GAAG,IAAI,EAC3B,MAAM,EAAE,QAAQ,GAAG,MAAM,GAAG,OAAO,EACnC,WAAW,CAAC,EAAE,MAAM,EAAE,GACrB,cAAc,EAAE,CAoGlB;AAED,wBAAgB,qCAAqC,CACnD,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,aAAa,GAAG,IAAI,GAC1B,MAAM,EAAE,CAkBV;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,aAAa,GAAG,IAAI,EAC3B,WAAW,EAAE,cAAc,EAAE,GAC5B,MAAM,CAoDR;AAED,KAAK,iBAAiB,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;AAEnD,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,iBAAiB,GAAG,IAAI,EACxC,cAAc,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,EACvD,IAAI,EAAE,cAAc,GACnB,iBAAiB,CAwJnB"}
+{"version":3,"file":"direct-tools.d.ts","sourceRoot":"","sources":["../../src/mcp/direct-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAc,MAAM,YAAY,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAwEzD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,aAAa,GAAG,IAAI,EAC3B,MAAM,EAAE,QAAQ,GAAG,MAAM,GAAG,OAAO,EACnC,WAAW,CAAC,EAAE,MAAM,EAAE,GACrB,cAAc,EAAE,CAoGlB;AAED,wBAAgB,qCAAqC,CACnD,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,aAAa,GAAG,IAAI,GAC1B,MAAM,EAAE,CAkBV;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,aAAa,GAAG,IAAI,EAC3B,WAAW,EAAE,cAAc,EAAE,GAC5B,MAAM,CAqDR;AAED,KAAK,iBAAiB,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;AAEnD,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,iBAAiB,GAAG,IAAI,EACxC,cAAc,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,EACvD,IAAI,EAAE,cAAc,GACnB,iBAAiB,CAwJnB"}

package/dist/mcp/direct-tools.js

@@ -8,7 +8,7 @@ import { resourceNameToToolName } from "./resource-tools.js";
 import { authenticate, supportsOAuth } from "./mcp-auth-flow.js";
 import { formatAuthRequiredMessage } from "./utils.js";
 const BUILTIN_NAMES = new Set(["read", "bash", "edit", "write", "grep", "ls", "mcp"]);
-function getDirectAuthRequiredMessage(state, serverName, defaultMessage = `MCP server "${serverName}" requires OAuth authentication. Run /mcp-auth ${serverName} first.`) {
+function getDirectAuthRequiredMessage(state, serverName, defaultMessage = `MCP server "${serverName}" requires OAuth authentication. Run /mcp-auth ${serverName} first, or call mcp({ auth: "${serverName}" }) to start the OAuth flow (a browser opens on this machine).`) {
     return formatAuthRequiredMessage(state.config, serverName, defaultMessage);
 }
 function getDirectAuthFailedMessage(state, serverName, message) {
@@ -16,7 +16,7 @@ function getDirectAuthFailedMessage(state, serverName, message) {
     if (customGuidance) {
         return `OAuth authentication failed for "${serverName}": ${message}. ${getDirectAuthRequiredMessage(state, serverName)}`;
     }
-    return `OAuth authentication failed for "${serverName}": ${message}. Run /mcp-auth ${serverName} first.`;
+    return `OAuth authentication failed for "${serverName}": ${message}. Run /mcp-auth ${serverName} first, or call mcp({ auth: "${serverName}" }) to start the OAuth flow.`;
 }
 async function attemptDirectAutoAuth(state, serverName) {
     if (state.config.settings?.autoAuth !== true) {
@@ -31,7 +31,7 @@ async function attemptDirectAutoAuth(state, serverName) {
     if (!state.ui && grantType !== "client_credentials") {
         return {
             status: "failed",
-            message: getDirectAuthRequiredMessage(state, serverName, `MCP server "${serverName}" requires OAuth authentication. Run /mcp-auth ${serverName} in an interactive session.`),
+            message: getDirectAuthRequiredMessage(state, serverName, `MCP server "${serverName}" requires OAuth authentication. Call mcp({ auth: "${serverName}" }) to start the OAuth flow (a browser opens on this machine), or run /mcp-auth ${serverName} in an interactive session.`),
         };
     }
     try {
@@ -206,6 +206,7 @@ export function buildProxyDescription(config, cache, directSpecs) {
     desc += `  mcp({ search: "query" })              → Search MCP tools by name/description\n`;
     desc += `  mcp({ describe: "tool_name" })        → Show tool details and parameters\n`;
     desc += `  mcp({ connect: "server-name" })       → Connect to a server and refresh metadata\n`;
+    desc += `  mcp({ auth: "server-name" })          → Start OAuth for a server (non-blocking; opens a browser on this machine)\n`;
     desc += `  mcp({ tool: "name", args: '{"key": "value"}' })    → Call a tool (args is JSON string)\n`;
     desc += `  mcp({ action: "ui-messages" })        → Retrieve accumulated messages from completed UI sessions\n`;
     desc += `\nMode: tool (call) > connect > describe > search > server (list) > action > nothing (status)`;

package/dist/mcp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAY,MAAM,8BAA8B,CAAC;AAa3E,MAAM,CAAC,OAAO,UAAU,UAAU,CAAC,GAAG,EAAE,YAAY,QAqSnD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAY,MAAM,8BAA8B,CAAC;AAa3E,MAAM,CAAC,OAAO,UAAU,UAAU,CAAC,GAAG,EAAE,YAAY,QA0SnD"}

package/dist/mcp/index.js

@@ -5,7 +5,7 @@ import { loadMcpConfig } from "./config.js";
 import { buildProxyDescription, createDirectToolExecutor, getMissingConfiguredDirectToolServers, resolveDirectTools } from "./direct-tools.js";
 import { flushMetadataCache, initializeMcp, updateStatusBar } from "./init.js";
 import { loadMetadataCache } from "./metadata-cache.js";
-import { executeCall, executeConnect, executeDescribe, executeSearch, executeStatus, executeUiMessages } from "./proxy-modes.js";
+import { executeAuth, executeCall, executeConnect, executeDescribe, executeSearch, executeStatus, executeUiMessages } from "./proxy-modes.js";
 import { getConfigPathFromArgv, truncateAtWord } from "./utils.js";
 import { initializeOAuth, shutdownOAuth } from "./mcp-auth-flow.js";
 export default function mcpAdapter(ext) {
@@ -98,6 +98,7 @@ export default function mcpAdapter(ext) {
                     parameters: Type.Object({
                         tool: Type.Optional(Type.String({ description: "Tool name to call (e.g., 'xcodebuild_list_sims')" })),
                         args: Type.Optional(Type.String({ description: "Arguments as JSON string (e.g., '{\"key\": \"value\"}')" })),
+                        auth: Type.Optional(Type.String({ description: "Server name to authenticate via OAuth. Starts a non-blocking OAuth flow and opens a browser on this machine. Use when a server reports needs-auth." })),
                         connect: Type.Optional(Type.String({ description: "Server name to connect (closes any stale connection first, forces fresh reconnect)" })),
                         describe: Type.Optional(Type.String({ description: "Tool name to describe (shows parameters)" })),
                         search: Type.Optional(Type.String({ description: "Search tools by name/description" })),
@@ -142,6 +143,9 @@ export default function mcpAdapter(ext) {
                                 details: { error: "not_initialized" },
                             };
                         }
+                        if (params.auth) {
+                            return executeAuth(state, params.auth);
+                        }
                         if (params.action === "ui-messages") {
                             return executeUiMessages(state);
                         }

package/dist/mcp/mcp-auth-flow.d.ts

@@ -5,8 +5,22 @@
  */
 import { type StoredTokens } from "./mcp-auth.js";
 import type { ServerEntry } from "./types.js";
+/**
+ * Validation/startup errors thrown by the MCP OAuth entry points. The relay
+ * handler maps these to `BadRequestError` (HTTP 400); the agent tool surfaces
+ * the message as tool output.
+ *
+ * Defined here (rather than in mcp-auth-start.ts) because `startAuth` in this
+ * module throws it too — mcp-auth-start.ts re-exports it, so existing
+ * imports from mcp-auth-start.js keep working without a circular-import
+ * change (the two modules already reference each other via
+ * `inFlightMcpAuths`, and this re-export rides that existing edge).
+ */
+export declare class McpAuthStartError extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}
 /** Auth status for a server */
-export type AuthStatus = "authenticated" | "expired" | "not_authenticated";
+export type AuthStatus = "authenticated" | "expired" | "not_authenticated" | "in_progress";
 /**
  * Start OAuth authentication flow for a server.
  * Returns the authorization URL when browser authorization is required.
@@ -36,9 +50,13 @@ export declare function authenticate(serverName: string, serverUrl: string, defi
  *
  * @param serverName - The name of the MCP server
  * @param serverUrl - The URL of the MCP server
+ * @param definition - The server definition (optional). When provided, the
+ *   refresh provider is built from the real OAuth config so a
+ *   pre-registered client (clientId/clientSecret/scope) is available
+ *   during the refresh; without it, behavior is unchanged.
  * @returns The valid tokens or null if not authenticated
  */
-export declare function getValidToken(serverName: string, serverUrl: string): Promise<StoredTokens | null>;
+export declare function getValidToken(serverName: string, serverUrl: string, definition?: ServerEntry): Promise<StoredTokens | null>;
 /**
  * Check the authentication status for a server.
  *

package/dist/mcp/mcp-auth-flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-auth-flow.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp-auth-flow.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,OAAO,EAQL,KAAK,YAAY,EAClB,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,+BAA+B;AAC/B,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,SAAS,GAAG,mBAAmB,CAAA;AAkD1E;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,WAAW,GACvB,OAAO,CAAC;IAAE,gBAAgB,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAyD5D;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,UAAU,CAAC,CAcrB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,WAAW,GACvB,OAAO,CAAC,UAAU,CAAC,CAuErB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA2C9B;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAM3E;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAalE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,WAAW,GAAG,OAAO,CAU9D;AAED;;;GAGG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAErD;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAEnD"}
+{"version":3,"file":"mcp-auth-flow.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp-auth-flow.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,OAAO,EAQL,KAAK,YAAY,EAClB,MAAM,eAAe,CAAA;AAEtB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C;;;;;;;;;;GAUG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAIpD;AAED,+BAA+B;AAC/B,MAAM,MAAM,UAAU,GAClB,eAAe,GACf,SAAS,GACT,mBAAmB,GACnB,aAAa,CAAA;AA2FjB;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,WAAW,GACvB,OAAO,CAAC;IAAE,gBAAgB,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAsE5D;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,UAAU,CAAC,CAcrB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,WAAW,GACvB,OAAO,CAAC,UAAU,CAAC,CAqFrB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,WAAW,GACvB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA8C9B;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAM3E;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAalE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,WAAW,GAAG,OAAO,CAU9D;AAED;;;GAGG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAErD;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAEnD"}

package/dist/mcp/mcp-auth-flow.js

@@ -9,10 +9,57 @@ import open from "open";
 import { McpOAuthProvider, setOAuthCallbackPort } from "./mcp-oauth-provider.js";
 import { ensureCallbackServer, waitForCallback, cancelPendingCallback, stopCallbackServer, } from "./mcp-callback-server.js";
 import { getAuthForUrl, isTokenExpired, hasStoredTokens, clearAllCredentials, updateOAuthState, getOAuthState, clearOAuthState, } from "./mcp-auth.js";
+import { inFlightMcpAuths } from "./mcp-auth-start.js";
+/**
+ * Validation/startup errors thrown by the MCP OAuth entry points. The relay
+ * handler maps these to `BadRequestError` (HTTP 400); the agent tool surfaces
+ * the message as tool output.
+ *
+ * Defined here (rather than in mcp-auth-start.ts) because `startAuth` in this
+ * module throws it too — mcp-auth-start.ts re-exports it, so existing
+ * imports from mcp-auth-start.js keep working without a circular-import
+ * change (the two modules already reference each other via
+ * `inFlightMcpAuths`, and this re-export rides that existing edge).
+ */
+export class McpAuthStartError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "McpAuthStartError";
+    }
+}
 // Track pending transports for auth completion
 const pendingTransports = new Map();
 // Deduplicate concurrent authenticate() calls per server.
 const pendingAuthentications = new Map();
+/**
+ * The SDK's dynamic-registration failure message
+ * ("Incompatible auth server: does not support dynamic client registration").
+ */
+const DCR_FAILURE_RE = /does not support dynamic client registration/i;
+/**
+ * Tolerant match: when no pre-registered client is configured, any
+ * registration-related failure points at the same missing configuration.
+ */
+const REGISTRATION_FAILURE_RE = /dynamic client registration|registration (request )?failed/i;
+/**
+ * Wrap an SDK `auth()` failure: when the authorization server does not
+ * support dynamic client registration (and no pre-registered client is
+ * configured), rethrow a self-explanatory error pointing at mcp.json,
+ * preserving the original error as `cause`. Non-DCR failures pass through
+ * untouched.
+ */
+function rethrowDcrFailure(error, serverName, clientId) {
+    const message = error instanceof Error ? error.message : String(error);
+    const isDcr = DCR_FAILURE_RE.test(message) ||
+        (!clientId && REGISTRATION_FAILURE_RE.test(message));
+    if (!isDcr) {
+        throw error;
+    }
+    throw new McpAuthStartError(`MCP server '${serverName}' OAuth failed: the provider does not support dynamic client registration and no pre-registered client is configured. ` +
+        `Add \`oauth: { clientId: '...', clientSecret?: '...' }\` to this server's config in mcp.json. ` +
+        `If the authorization server supports Client ID Metadata Documents (client_id_metadata_document_supported), ` +
+        `you can also use \`oauth: { clientMetadataUrl: 'https://.../client-metadata.json' }\` instead of a clientId.`, { cause: error instanceof Error ? error : new Error(message) });
+}
 /**
  * Generate a cryptographically secure random state parameter.
  */
@@ -50,6 +97,7 @@ function extractOAuthConfig(definition) {
         clientId: definition.oauth?.clientId,
         clientSecret: definition.oauth?.clientSecret,
         scope: definition.oauth?.scope,
+        clientMetadataUrl: definition.oauth?.clientMetadataUrl,
         redirectUri: definition.oauth?.redirectUri,
     };
 }
@@ -68,7 +116,13 @@ export async function startAuth(serverName, serverUrl, definition) {
                 throw new Error("Browser redirect is not used for client_credentials flow");
             },
         });
-        const result = await runSdkAuth(authProvider, { serverUrl });
+        let result;
+        try {
+            result = await runSdkAuth(authProvider, { serverUrl });
+        }
+        catch (error) {
+            rethrowDcrFailure(error, serverName, config.clientId);
+        }
         if (result !== "AUTHORIZED") {
             throw new UnauthorizedError("Failed to authorize");
         }
@@ -77,13 +131,15 @@ export async function startAuth(serverName, serverUrl, definition) {
     // Start the callback server.
     // Pre-registered OAuth clients require an exact redirect URI, so enforce strict port binding.
     // When a custom redirectUri is specified, also use strict port binding and set the port.
+    // CIMD clients (clientMetadataUrl) are the same: the redirect URI in the
+    // hosted metadata document must match, so the callback port is fixed.
     const hasCustomRedirect = Boolean(config.redirectUri);
     const redirectPort = hasCustomRedirect ? parseRedirectPort(config.redirectUri) : undefined;
     if (redirectPort) {
         setOAuthCallbackPort(redirectPort);
     }
     await ensureCallbackServer({
-        strictPort: Boolean(config.clientId) || hasCustomRedirect,
+        strictPort: Boolean(config.clientId || config.clientMetadataUrl) || hasCustomRedirect,
         preferredPort: redirectPort,
     });
     const oauthState = generateState();
@@ -95,7 +151,12 @@ export async function startAuth(serverName, serverUrl, definition) {
         },
     });
     try {
-        const result = await runSdkAuth(authProvider, { serverUrl });
+        const result = await runSdkAuth(authProvider, {
+            serverUrl,
+            // Thread the configured scope into the authorization_code flow;
+            // omitted (undefined) when unset so existing behavior is unchanged.
+            scope: config.scope,
+        });
         if (result === "AUTHORIZED") {
             await clearOAuthState(serverName);
             return { authorizationUrl: "" };
@@ -108,7 +169,7 @@ export async function startAuth(serverName, serverUrl, definition) {
     }
     catch (error) {
         await clearOAuthState(serverName);
-        throw error;
+        rethrowDcrFailure(error, serverName, config.clientId);
     }
 }
 /**
@@ -138,10 +199,21 @@ export async function completeAuth(serverName, authorizationCode) {
  * @returns The final auth status
  */
 export async function authenticate(serverName, serverUrl, definition) {
+    // Canonical cross-entry-point in-flight guard: a non-blocking flow
+    // (startMcpAuthFlow) may already be in flight for this server. Starting
+    // startAuth again would overwrite the persisted OAuth state and the
+    // pending transport the in-flight browser callback completes against,
+    // breaking the first flow. Defer to it instead.
+    if (inFlightMcpAuths.has(serverName)) {
+        return "in_progress";
+    }
     const inFlight = pendingAuthentications.get(serverName);
     if (inFlight) {
         return inFlight;
     }
+    // Track this blocking flow in the same canonical guard so a concurrent
+    // non-blocking start (relay / agent tool) defers to us as well.
+    inFlightMcpAuths.add(serverName);
     const operation = (async () => {
         // Start auth flow
         const { authorizationUrl, oauthState } = await startAuth(serverName, serverUrl, definition);
@@ -197,6 +269,7 @@ export async function authenticate(serverName, serverUrl, definition) {
         if (pendingAuthentications.get(serverName) === operation) {
             pendingAuthentications.delete(serverName);
         }
+        inFlightMcpAuths.delete(serverName);
     }
 }
 /**
@@ -204,9 +277,13 @@ export async function authenticate(serverName, serverUrl, definition) {
  *
  * @param serverName - The name of the MCP server
  * @param serverUrl - The URL of the MCP server
+ * @param definition - The server definition (optional). When provided, the
+ *   refresh provider is built from the real OAuth config so a
+ *   pre-registered client (clientId/clientSecret/scope) is available
+ *   during the refresh; without it, behavior is unchanged.
  * @returns The valid tokens or null if not authenticated
  */
-export async function getValidToken(serverName, serverUrl) {
+export async function getValidToken(serverName, serverUrl, definition) {
     // Check if we have valid tokens
     const entry = await getAuthForUrl(serverName, serverUrl);
     if (!entry?.tokens) {
@@ -221,8 +298,11 @@ export async function getValidToken(serverName, serverUrl) {
         // Token is expired, try to refresh
         console.log(`MCP Auth: Token expired for ${serverName}, attempting refresh`);
         try {
-            // Create auth provider for token refresh
-            const authProvider = new McpOAuthProvider(serverName, serverUrl, {}, {
+            // Create auth provider for token refresh. Use the real server config
+            // so a pre-registered client (clientId/clientSecret/scope) is
+            // available; an undefined definition keeps the legacy empty config.
+            const refreshConfig = definition ? extractOAuthConfig(definition) : {};
+            const authProvider = new McpOAuthProvider(serverName, serverUrl, refreshConfig, {
                 onRedirect: async () => { },
             });
             const clientInfo = await authProvider.clientInformation();

package/dist/mcp/mcp-auth-start.d.ts

@@ -0,0 +1,63 @@
+/**
+ * MCP Auth Start — shared, non-blocking OAuth flow starter.
+ *
+ * Single code path used by:
+ *   - the relay handler (`POST /api/mcp-auth`)
+ *   - the agent-facing `mcp` tool (`auth` action) and `connect` auto-trigger
+ *
+ * The flow is non-blocking: `startAuth` captures the authorization URL, and
+ * the local callback server completes the exchange in the background
+ * (waitForCallback → completeAuth → reloadMcpConfig).
+ */
+import { McpAuthStartError } from "./mcp-auth-flow.js";
+import type { McpExtensionState } from "./state.js";
+/**
+ * Validation/in-flight errors thrown by `startMcpAuthFlow`. Defined in
+ * mcp-auth-flow.js (its `startAuth` throws the same type for DCR failures)
+ * and re-exported here so existing imports keep working.
+ */
+export { McpAuthStartError };
+export interface StartMcpAuthFlowOptions {
+    /** Best-effort: open the authorization URL in the system browser. */
+    openBrowser?: boolean;
+}
+export type StartMcpAuthFlowResult = {
+    status: "already-authenticated";
+} | {
+    status: "auth_url_ready";
+    authUrl: string;
+    openedBrowser: boolean;
+};
+/**
+ * Per-server in-flight guard. `startAuth` keys its pending transports and
+ * persisted OAuth state by server name, so two concurrent flows for the same
+ * server would clobber each other. Reject the second start until the first
+ * flow's background chain finishes.
+ */
+export declare const inFlightMcpAuths: Set<string>;
+/**
+ * An authorization URL may be opened in a real browser, so it must never be
+ * a `javascript:` / `data:` / malformed URL coming from a malicious MCP
+ * server's OAuth metadata. Defense in depth: the landing UI applies the
+ * same check before `window.open`.
+ */
+export declare function assertSafeAuthorizationUrl(authUrl: string): void;
+/**
+ * Start a non-blocking OAuth flow for a configured MCP server.
+ *
+ * - Looks up the server definition (throws `McpAuthStartError` when missing,
+ *   not OAuth-capable, or url-less).
+ * - Enforces the per-server in-flight guard.
+ * - Calls `startAuth`: an empty `authorizationUrl` means the server is
+ *   already authenticated (or was via client_credentials).
+ * - Optionally opens the authorization URL in the system browser
+ *   (best-effort — a failed `open` never fails the call).
+ * - Kicks off the background completion chain
+ *   (waitForCallback → completeAuth → reloadMcpConfig) fire-and-forget.
+ *
+ * @param state - The live MCP extension state (config + reload target).
+ * @param name - Configured MCP server name.
+ * @param opts - `openBrowser` to launch the system browser on the auth URL.
+ */
+export declare function startMcpAuthFlow(state: McpExtensionState, name: string, opts?: StartMcpAuthFlowOptions): Promise<StartMcpAuthFlowResult>;
+//# sourceMappingURL=mcp-auth-start.d.ts.map

package/dist/mcp/mcp-auth-start.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-auth-start.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp-auth-start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAIL,iBAAiB,EAClB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD;;;;GAIG;AACH,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,MAAM,EAAE,uBAAuB,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAE,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,aAAoB,CAAC;AAElD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAUhE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,iBAAiB,EACxB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,uBAA4B,GACjC,OAAO,CAAC,sBAAsB,CAAC,CA+EjC"}

package/dist/mcp/mcp-auth-start.js

@@ -0,0 +1,131 @@
+/**
+ * MCP Auth Start — shared, non-blocking OAuth flow starter.
+ *
+ * Single code path used by:
+ *   - the relay handler (`POST /api/mcp-auth`)
+ *   - the agent-facing `mcp` tool (`auth` action) and `connect` auto-trigger
+ *
+ * The flow is non-blocking: `startAuth` captures the authorization URL, and
+ * the local callback server completes the exchange in the background
+ * (waitForCallback → completeAuth → reloadMcpConfig).
+ */
+import open from "open";
+import { completeAuth, startAuth, supportsOAuth, McpAuthStartError, } from "./mcp-auth-flow.js";
+import { clearOAuthState } from "./mcp-auth.js";
+import { waitForCallback } from "./mcp-callback-server.js";
+import { reloadMcpConfig } from "./init.js";
+/**
+ * Validation/in-flight errors thrown by `startMcpAuthFlow`. Defined in
+ * mcp-auth-flow.js (its `startAuth` throws the same type for DCR failures)
+ * and re-exported here so existing imports keep working.
+ */
+export { McpAuthStartError };
+/**
+ * Per-server in-flight guard. `startAuth` keys its pending transports and
+ * persisted OAuth state by server name, so two concurrent flows for the same
+ * server would clobber each other. Reject the second start until the first
+ * flow's background chain finishes.
+ */
+export const inFlightMcpAuths = new Set();
+/**
+ * An authorization URL may be opened in a real browser, so it must never be
+ * a `javascript:` / `data:` / malformed URL coming from a malicious MCP
+ * server's OAuth metadata. Defense in depth: the landing UI applies the
+ * same check before `window.open`.
+ */
+export function assertSafeAuthorizationUrl(authUrl) {
+    let parsed;
+    try {
+        parsed = new URL(authUrl);
+    }
+    catch {
+        throw new McpAuthStartError("Invalid authorization URL");
+    }
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+        throw new McpAuthStartError("Invalid authorization URL");
+    }
+}
+/**
+ * Start a non-blocking OAuth flow for a configured MCP server.
+ *
+ * - Looks up the server definition (throws `McpAuthStartError` when missing,
+ *   not OAuth-capable, or url-less).
+ * - Enforces the per-server in-flight guard.
+ * - Calls `startAuth`: an empty `authorizationUrl` means the server is
+ *   already authenticated (or was via client_credentials).
+ * - Optionally opens the authorization URL in the system browser
+ *   (best-effort — a failed `open` never fails the call).
+ * - Kicks off the background completion chain
+ *   (waitForCallback → completeAuth → reloadMcpConfig) fire-and-forget.
+ *
+ * @param state - The live MCP extension state (config + reload target).
+ * @param name - Configured MCP server name.
+ * @param opts - `openBrowser` to launch the system browser on the auth URL.
+ */
+export async function startMcpAuthFlow(state, name, opts = {}) {
+    const definition = state.config.mcpServers[name];
+    if (!definition) {
+        throw new McpAuthStartError(`Unknown MCP server: ${name}`);
+    }
+    if (!definition.url || !supportsOAuth(definition)) {
+        throw new McpAuthStartError(`MCP server "${name}" does not support OAuth`);
+    }
+    if (inFlightMcpAuths.has(name)) {
+        throw new McpAuthStartError("OAuth authentication already in progress for this server");
+    }
+    inFlightMcpAuths.add(name);
+    let authorizationUrl;
+    let oauthState;
+    try {
+        ({ authorizationUrl, oauthState } = await startAuth(name, definition.url, definition));
+        if (authorizationUrl === "") {
+            inFlightMcpAuths.delete(name);
+            return { status: "already-authenticated" };
+        }
+        // Fail loudly instead of skipping background completion — a flow without
+        // its persisted state could never be completed nor cleanly aborted.
+        if (!oauthState) {
+            throw new McpAuthStartError("OAuth state missing after authorization start");
+        }
+        assertSafeAuthorizationUrl(authorizationUrl);
+    }
+    catch (error) {
+        // Release the guard so a failed start does not wedge the server.
+        inFlightMcpAuths.delete(name);
+        throw error;
+    }
+    if (opts.openBrowser) {
+        // Best-effort: a failed `open` must not fail the call — the user can
+        // always open authUrl manually.
+        open(authorizationUrl).catch((error) => {
+            console.warn(`MCP Auth: failed to open browser for ${name}`, error);
+        });
+    }
+    // Complete the flow in the background from the local callback server:
+    // waitForCallback resolves with the authorization code, completeAuth
+    // exchanges it for tokens, and the MCP config is reloaded so the server
+    // comes up authenticated. Fire-and-forget — auth progress is observable
+    // via server status, so failures are logged, not surfaced. The finally
+    // block releases the per-server in-flight guard and clears the
+    // now-stale OAuth state (idempotent) on every path.
+    waitForCallback(oauthState)
+        .then((code) => completeAuth(name, code))
+        .then(() => reloadMcpConfig(state))
+        .catch((error) => {
+        console.warn(`MCP Auth: background completion failed for ${name}`, error);
+    })
+        .finally(() => {
+        inFlightMcpAuths.delete(name);
+        try {
+            clearOAuthState(name);
+        }
+        catch {
+            // Storage errors must not surface as unhandled rejections.
+        }
+    });
+    return {
+        status: "auth_url_ready",
+        authUrl: authorizationUrl,
+        openedBrowser: !!opts.openBrowser,
+    };
+}

package/dist/mcp/mcp-oauth-provider.d.ts

@@ -8,6 +8,15 @@ import type { OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.
 import type { OAuthClientMetadata, OAuthTokens, OAuthClientInformation, OAuthClientInformationFull } from "@modelcontextprotocol/sdk/shared/auth.js";
 declare const DEFAULT_OAUTH_CALLBACK_PORT = 19876;
 declare const OAUTH_CALLBACK_PATH = "/callback";
+/**
+ * Default hosted Client ID Metadata Document (SEP-991 / CIMD), served by
+ * aexol.ai (landing/public/mcp-client-metadata.json). Used as the client_id
+ * when the AS supports client_id_metadata_document_supported, no DCR, and no
+ * explicit clientId / clientMetadataUrl is configured (e.g. Bubble).
+ * The callback port must stay 19876 — it is fixed in the document's
+ * redirect_uris (changing MCP_OAUTH_CALLBACK_PORT requires a custom document).
+ */
+export declare const DEFAULT_CIMD_METADATA_URL = "https://aexol.ai/mcp-client-metadata.json";
 export declare function getConfiguredOAuthCallbackPort(): number;
 export declare function getOAuthCallbackPort(): number;
 export declare function setOAuthCallbackPort(port: number): void;
@@ -17,6 +26,12 @@ export interface McpOAuthConfig {
     clientId?: string;
     clientSecret?: string;
     scope?: string;
+    /**
+     * HTTPS URL of a hosted Client ID Metadata Document (SEP-991 / CIMD).
+     * Used when the AS does not support DCR and no pre-registered clientId
+     * is configured; the SDK uses this URL as the client_id.
+     */
+    clientMetadataUrl?: string;
     redirectUri?: string;
 }
 /** Callbacks for OAuth flow interactions */
@@ -39,6 +54,15 @@ export declare class McpOAuthProvider implements OAuthClientProvider {
      * Uses configured redirectUri if provided, otherwise falls back to default.
      */
     get redirectUrl(): string | undefined;
+    /**
+     * External URL of the hosted Client ID Metadata Document (SEP-991).
+     * The MCP SDK uses this as the client_id when the AS signals
+     * `client_id_metadata_document_supported` and no pre-registered
+     * clientId is available (clientInformation() wins over this field).
+     * Falls back to the default aexol.ai document so CIMD-capable ASes
+     * (e.g. Bubble) work out-of-the-box.
+     */
+    get clientMetadataUrl(): string | undefined;
     /**
      * Client metadata for dynamic registration.
      * Describes this client to the OAuth authorization server.

package/dist/mcp/mcp-oauth-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-oauth-provider.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp-oauth-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAA;AAEnF,OAAO,KAAK,EACV,mBAAmB,EACnB,WAAW,EACX,sBAAsB,EACtB,0BAA0B,EAC3B,MAAM,0CAA0C,CAAA;AAgBjD,QAAA,MAAM,2BAA2B,QAAQ,CAAA;AACzC,QAAA,MAAM,mBAAmB,cAAc,CAAA;AAavC,wBAAgB,8BAA8B,IAAI,MAAM,CAEvD;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEvD;AAED,sCAAsC;AACtC,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAAA;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,4CAA4C;AAC5C,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/C;AAED;;;GAGG;AACH,qBAAa,gBAAiB,YAAW,mBAAmB;IAExD,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,SAAS;gBAHT,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,iBAAiB;IAGtC,OAAO,KAAK,qBAAqB,GAEhC;IAED;;;OAGG;IACH,IAAI,WAAW,IAAI,MAAM,GAAG,SAAS,CAIpC;IAED;;;OAGG;IACH,IAAI,cAAc,IAAI,mBAAmB,CAuBxC;IAED;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IA2BtE;;OAEG;IACG,qBAAqB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAU5E;;;OAGG;IACG,MAAM,IAAI,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAgBhD;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAUpD;;;;;;;;OAQG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAenE;;OAEG;IACG,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3D;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAWrC;;OAEG;IACG,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7C;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAa9B;;;OAGG;IACG,qBAAqB,CAAC,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAc7E,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;CAYjE;AAED,OAAO,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,CAAA"}
+{"version":3,"file":"mcp-oauth-provider.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp-oauth-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAA;AAEnF,OAAO,KAAK,EACV,mBAAmB,EACnB,WAAW,EACX,sBAAsB,EACtB,0BAA0B,EAC3B,MAAM,0CAA0C,CAAA;AAgBjD,QAAA,MAAM,2BAA2B,QAAQ,CAAA;AACzC,QAAA,MAAM,mBAAmB,cAAc,CAAA;AAEvC;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,8CAA8C,CAAA;AAapF,wBAAgB,8BAA8B,IAAI,MAAM,CAEvD;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEvD;AAED,sCAAsC;AACtC,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAAA;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,4CAA4C;AAC5C,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/C;AAED;;;GAGG;AACH,qBAAa,gBAAiB,YAAW,mBAAmB;IAExD,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,SAAS;gBAHT,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,iBAAiB;IAGtC,OAAO,KAAK,qBAAqB,GAEhC;IAED;;;OAGG;IACH,IAAI,WAAW,IAAI,MAAM,GAAG,SAAS,CAIpC;IAED;;;;;;;OAOG;IACH,IAAI,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAE1C;IAED;;;OAGG;IACH,IAAI,cAAc,IAAI,mBAAmB,CAuBxC;IAED;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IA2BtE;;OAEG;IACG,qBAAqB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAU5E;;;OAGG;IACG,MAAM,IAAI,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAgBhD;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAUpD;;;;;;;;OAQG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAenE;;OAEG;IACG,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3D;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAWrC;;OAEG;IACG,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7C;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAa9B;;;OAGG;IACG,qBAAqB,CAAC,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAc7E,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;CAYjE;AAED,OAAO,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,CAAA"}

package/dist/mcp/mcp-oauth-provider.js

@@ -9,6 +9,15 @@ import { getAuthEntry, getAuthForUrl, updateTokens, updateClientInfo, updateCode
 // Callback server configuration
 const DEFAULT_OAUTH_CALLBACK_PORT = 19876;
 const OAUTH_CALLBACK_PATH = "/callback";
+/**
+ * Default hosted Client ID Metadata Document (SEP-991 / CIMD), served by
+ * aexol.ai (landing/public/mcp-client-metadata.json). Used as the client_id
+ * when the AS supports client_id_metadata_document_supported, no DCR, and no
+ * explicit clientId / clientMetadataUrl is configured (e.g. Bubble).
+ * The callback port must stay 19876 — it is fixed in the document's
+ * redirect_uris (changing MCP_OAUTH_CALLBACK_PORT requires a custom document).
+ */
+export const DEFAULT_CIMD_METADATA_URL = "https://aexol.ai/mcp-client-metadata.json";
 let configuredOAuthCallbackPort = DEFAULT_OAUTH_CALLBACK_PORT;
 if (process.env.MCP_OAUTH_CALLBACK_PORT) {
     const parsedPort = Number.parseInt(process.env.MCP_OAUTH_CALLBACK_PORT, 10);
@@ -55,6 +64,17 @@ export class McpOAuthProvider {
             return this.config.redirectUri;
         return `http://localhost:${getOAuthCallbackPort()}${OAUTH_CALLBACK_PATH}`;
     }
+    /**
+     * External URL of the hosted Client ID Metadata Document (SEP-991).
+     * The MCP SDK uses this as the client_id when the AS signals
+     * `client_id_metadata_document_supported` and no pre-registered
+     * clientId is available (clientInformation() wins over this field).
+     * Falls back to the default aexol.ai document so CIMD-capable ASes
+     * (e.g. Bubble) work out-of-the-box.
+     */
+    get clientMetadataUrl() {
+        return this.config.clientMetadataUrl ?? DEFAULT_CIMD_METADATA_URL;
+    }
     /**
      * Client metadata for dynamic registration.
      * Describes this client to the OAuth authorization server.

package/dist/mcp/proxy-modes.d.ts

@@ -1,6 +1,13 @@
 import type { AgentToolResult, ToolInfo } from "../sdk/coding-agent/index.js";
 import type { McpExtensionState } from "./state.js";
 type ProxyToolResult = AgentToolResult<Record<string, unknown>>;
+/**
+ * Start the OAuth flow for a server (the `mcp({ auth: "<name>" })` action).
+ * Non-blocking: opens the browser on this machine and returns immediately;
+ * the local callback server completes the token exchange in the background
+ * and reloads the MCP config, so the next connect succeeds.
+ */
+export declare function executeAuth(state: McpExtensionState, serverName: string): Promise<ProxyToolResult>;
 export declare function executeUiMessages(state: McpExtensionState): ProxyToolResult;
 export declare function executeStatus(state: McpExtensionState): ProxyToolResult;
 export declare function executeDescribe(state: McpExtensionState, toolName: string): ProxyToolResult;

package/dist/mcp/proxy-modes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy-modes.d.ts","sourceRoot":"","sources":["../../src/mcp/proxy-modes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAUpD,KAAK,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAoDhE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,CA4E3E;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,CAsDvE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,CAuC3F;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,iBAAiB,EACxB,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,OAAO,EACf,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,OAAO,GACvB,eAAe,CAiFjB;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,CAqDrF;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAsD3G;AAED,wBAAsB,WAAW,CAC/B,KAAK,EAAE,iBAAiB,EACxB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,cAAc,CAAC,EAAE,MAAM,EACvB,gBAAgB,CAAC,EAAE,MAAM,QAAQ,EAAE,GAClC,OAAO,CAAC,eAAe,CAAC,CAkW1B"}
+{"version":3,"file":"proxy-modes.d.ts","sourceRoot":"","sources":["../../src/mcp/proxy-modes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAWpD,KAAK,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAuBhE;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,iBAAiB,EACxB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,eAAe,CAAC,CAoB1B;AA+BD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,CA4E3E;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,CAsDvE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,CAuC3F;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,iBAAiB,EACxB,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,OAAO,EACf,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,OAAO,GACvB,eAAe,CAiFjB;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,CAqDrF;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAuF3G;AAED,wBAAsB,WAAW,CAC/B,KAAK,EAAE,iBAAiB,EACxB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,cAAc,CAAC,EAAE,MAAM,EACvB,gBAAgB,CAAC,EAAE,MAAM,QAAQ,EAAE,GAClC,OAAO,CAAC,eAAe,CAAC,CAkW1B"}