@assistant-ui/react-mcp 0.1.16 → 0.1.17

package/src/resources/McpServerResource.test.ts

@@ -3,6 +3,7 @@ import type { ClientOutput } from "@assistant-ui/store";
 import { useEffect, useState } from "react";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import type { MCPAuthConfig } from "../mcp-scope";
+import type { MCPPersistedAuthState } from "../auth/types";
 import type { MCPStorage } from "./storage/types";
 import type { McpServerResourceProps } from "./McpServerResource";
 
@@ -189,9 +190,191 @@ const mount = (
   });
 };
 
+const unboundAuthMessage =
+  'MCP server "docs" has saved authentication for a different URL. Authenticate again to connect to https://example.com/mcp.';
+
 describe("McpServerResource automatic authentication", () => {
   beforeEach(resetMocks);
 
+  it("does not auto-connect with authentication from another server URL", async () => {
+    const storage = createStorage();
+    vi.mocked(storage.loadAuthState).mockResolvedValue({
+      serverUrl: "https://other.example.com/mcp",
+      token: "secret",
+    });
+    const root = mount({
+      auth: { type: "bearer" },
+      storage,
+      autoConnect: true,
+    });
+
+    try {
+      await waitForResourceUpdate(
+        () => root.getValue().getState().lastError !== null,
+      );
+
+      expect(root.getValue().getState()).toMatchObject({
+        connectionState: "disconnected",
+        lastError: { message: unboundAuthMessage },
+      });
+      expect(mocks.StreamableHTTPClientTransport).not.toHaveBeenCalled();
+    } finally {
+      root.unmount();
+    }
+  });
+
+  it("does not auto-connect with an unbound legacy bearer token", async () => {
+    const storage = createStorage();
+    vi.mocked(storage.loadAuthState).mockResolvedValue({ token: "secret" });
+    const root = mount({
+      auth: { type: "bearer" },
+      storage,
+      autoConnect: true,
+    });
+
+    try {
+      await waitForResourceUpdate(
+        () => root.getValue().getState().lastError !== null,
+      );
+
+      expect(root.getValue().getState()).toMatchObject({
+        connectionState: "disconnected",
+        lastError: { message: unboundAuthMessage },
+      });
+      expect(mocks.StreamableHTTPClientTransport).not.toHaveBeenCalled();
+    } finally {
+      root.unmount();
+    }
+  });
+
+  it("does not auto-connect with unbound legacy OAuth tokens", async () => {
+    const storage = createStorage();
+    vi.mocked(storage.loadAuthState).mockResolvedValue({
+      tokens: { access_token: "secret", token_type: "bearer" },
+    });
+    const root = mount({
+      auth: { type: "oauth" },
+      storage,
+      autoConnect: true,
+    });
+
+    try {
+      await waitForResourceUpdate(
+        () => root.getValue().getState().lastError !== null,
+      );
+
+      expect(root.getValue().getState()).toMatchObject({
+        connectionState: "disconnected",
+        lastError: { message: unboundAuthMessage },
+      });
+      expect(mocks.StreamableHTTPClientTransport).not.toHaveBeenCalled();
+    } finally {
+      root.unmount();
+    }
+  });
+
+  it("does not auto-connect OAuth tokens for a different client", async () => {
+    const storage = createStorage();
+    vi.mocked(storage.loadAuthState).mockResolvedValue({
+      serverUrl: "https://example.com/mcp",
+      clientInformation: {
+        client_id: "client-a",
+        redirect_uris: ["https://example.com/callback"],
+      },
+      clientInformationSource: "registered",
+      tokens: { access_token: "secret", token_type: "bearer" },
+      tokensClientId: "client-a",
+    });
+    const root = mount({
+      auth: { type: "oauth", clientId: "client-b" },
+      storage,
+      autoConnect: true,
+    });
+
+    try {
+      await waitFor(() => storage.loadAuthState.mock.calls.length > 0);
+      await flushMacrotask();
+
+      expect(root.getValue().getState()).toMatchObject({
+        connectionState: "disconnected",
+        lastError: null,
+      });
+      expect(mocks.StreamableHTTPClientTransport).not.toHaveBeenCalled();
+    } finally {
+      root.unmount();
+    }
+  });
+
+  it("keeps a static bearer token usable when the saved record is unbound", async () => {
+    const storage = createStorage();
+    vi.mocked(storage.loadAuthState).mockResolvedValue({ token: "stale" });
+    const root = mount({
+      auth: { type: "bearer", token: "static" },
+      storage,
+      autoConnect: true,
+    });
+
+    try {
+      await waitFor(() => mocks.transports.length > 0);
+      await flushMacrotask();
+
+      expect(mocks.StreamableHTTPClientTransport).toHaveBeenCalledWith(
+        new URL("https://example.com/mcp"),
+        { requestInit: { headers: { Authorization: "Bearer static" } } },
+      );
+      expect(root.getValue().getState().lastError).toBeNull();
+    } finally {
+      root.unmount();
+    }
+  });
+
+  it("does not report a record that holds no credentials", async () => {
+    const storage = createStorage();
+    vi.mocked(storage.loadAuthState).mockResolvedValue({});
+    const root = mount({
+      auth: { type: "bearer" },
+      storage,
+      autoConnect: true,
+    });
+
+    try {
+      await waitFor(() => storage.loadAuthState.mock.calls.length > 0);
+      await flushMacrotask();
+
+      expect(root.getValue().getState()).toMatchObject({
+        connectionState: "disconnected",
+        lastError: null,
+      });
+      expect(mocks.StreamableHTTPClientTransport).not.toHaveBeenCalled();
+    } finally {
+      root.unmount();
+    }
+  });
+
+  it("reports an unbound bearer record on a manual connect", async () => {
+    const storage = createStorage();
+    vi.mocked(storage.loadAuthState).mockResolvedValue({
+      serverUrl: "https://other.example.com/mcp",
+      token: "secret",
+    });
+    const root = mount({ auth: { type: "bearer" }, storage });
+
+    try {
+      await expect(root.getValue().connect()).resolves.toBeUndefined();
+      await waitForResourceUpdate(
+        () => root.getValue().getState().connectionState === "error",
+      );
+
+      expect(root.getValue().getState()).toMatchObject({
+        connectionState: "error",
+        lastError: { message: unboundAuthMessage },
+      });
+      expect(mocks.StreamableHTTPClientTransport).not.toHaveBeenCalled();
+    } finally {
+      root.unmount();
+    }
+  });
+
   it("reports auth storage load failures", async () => {
     const storage = createStorage();
     vi.mocked(storage.loadAuthState).mockRejectedValue(
@@ -562,9 +745,8 @@ describe("McpServerResource completeAuth", () => {
   beforeEach(resetMocks);
 
   it("lets callback validation win over mount-time auto-connect", async () => {
-    const pendingLoads: Array<
-      (value: { state?: string; tokens?: { access_token: string } }) => void
-    > = [];
+    const pendingLoads: Array<(value: MCPPersistedAuthState | null) => void> =
+      [];
     const storage = createStorage();
     vi.mocked(storage.loadAuthState).mockImplementation(
       () =>
@@ -587,13 +769,25 @@ describe("McpServerResource completeAuth", () => {
       await waitFor(() => pendingLoads.length > callbackLoadIndex);
 
       for (const resolve of pendingLoads.slice(0, callbackLoadIndex)) {
-        resolve({ tokens: { access_token: "persisted" } });
+        resolve({
+          serverUrl: "https://example.com/mcp",
+          clientInformation: {
+            client_id: "registered-client",
+            redirect_uris: ["https://example.com/callback"],
+          },
+          clientInformationSource: "registered",
+          tokens: { access_token: "persisted", token_type: "bearer" },
+          tokensClientId: "registered-client",
+        });
       }
       await flushMacrotask();
 
       expect(mocks.StreamableHTTPClientTransport).not.toHaveBeenCalled();
 
-      pendingLoads[callbackLoadIndex]!({ state: "expected" });
+      pendingLoads[callbackLoadIndex]!({
+        serverUrl: "https://example.com/mcp",
+        state: "expected",
+      });
       await expect(completeAuth).resolves.toBeUndefined();
       await flushMacrotask();
 
@@ -606,9 +800,8 @@ describe("McpServerResource completeAuth", () => {
   });
 
   it("resumes auto-connect when callback validation fails", async () => {
-    const pendingLoads: Array<
-      (value: { state?: string; tokens?: { access_token: string } }) => void
-    > = [];
+    const pendingLoads: Array<(value: MCPPersistedAuthState | null) => void> =
+      [];
     const storage = createStorage();
     vi.mocked(storage.loadAuthState).mockImplementation(
       () =>
@@ -631,13 +824,25 @@ describe("McpServerResource completeAuth", () => {
       await waitFor(() => pendingLoads.length > callbackLoadIndex);
 
       for (const resolve of pendingLoads.slice(0, callbackLoadIndex)) {
-        resolve({ tokens: { access_token: "persisted" } });
+        resolve({
+          serverUrl: "https://example.com/mcp",
+          clientInformation: {
+            client_id: "registered-client",
+            redirect_uris: ["https://example.com/callback"],
+          },
+          clientInformationSource: "registered",
+          tokens: { access_token: "persisted", token_type: "bearer" },
+          tokensClientId: "registered-client",
+        });
       }
       await flushMacrotask();
 
       expect(mocks.StreamableHTTPClientTransport).not.toHaveBeenCalled();
 
-      pendingLoads[callbackLoadIndex]!({ state: "different" });
+      pendingLoads[callbackLoadIndex]!({
+        serverUrl: "https://example.com/mcp",
+        state: "different",
+      });
       await expect(completeAuth).rejects.toThrow(
         "OAuth state does not match the authorization request",
       );
@@ -653,6 +858,7 @@ describe("McpServerResource completeAuth", () => {
   it("completes auth across the StrictMode effect replay", async () => {
     const storage = createStorage();
     vi.mocked(storage.loadAuthState).mockResolvedValue({
+      serverUrl: "https://example.com/mcp",
       state: "aui-mcp:ZG9jcw.nonce",
     });
     let completeAuth: Promise<void> | undefined;
@@ -682,7 +888,10 @@ describe("McpServerResource completeAuth", () => {
 
   it("rejects before transport setup without a usable authorization code", async () => {
     const storage = createStorage();
-    vi.mocked(storage.loadAuthState).mockResolvedValue({ state: "abc" });
+    vi.mocked(storage.loadAuthState).mockResolvedValue({
+      serverUrl: "https://example.com/mcp",
+      state: "abc",
+    });
     const root = mount({ auth: { type: "oauth" }, storage });
 
     try {
@@ -705,7 +914,10 @@ describe("McpServerResource completeAuth", () => {
 
   it("forwards OAuth error callbacks to the transport", async () => {
     const storage = createStorage();
-    vi.mocked(storage.loadAuthState).mockResolvedValue({ state: "expected" });
+    vi.mocked(storage.loadAuthState).mockResolvedValue({
+      serverUrl: "https://example.com/mcp",
+      state: "expected",
+    });
     mocks.finishAuthResults.push(() =>
       Promise.reject(new Error("access_denied: Denied")),
     );
@@ -758,6 +970,7 @@ describe("McpServerResource completeAuth", () => {
   it("rejects callbacks whose state does not match the authorization request", async () => {
     const storage = createStorage();
     vi.mocked(storage.loadAuthState).mockResolvedValue({
+      serverUrl: "https://example.com/mcp",
       state: "aui-mcp:ZG9jcw.expected",
     });
     const root = mount({ auth: { type: "oauth" }, storage });
@@ -787,7 +1000,10 @@ describe("McpServerResource completeAuth", () => {
   });
 
   it("does not resume authorization after disconnecting during validation", async () => {
-    let resolveAuthState!: (state: { state: string }) => void;
+    let resolveAuthState!: (state: {
+      serverUrl: string;
+      state: string;
+    }) => void;
     const storage = createStorage();
     vi.mocked(storage.loadAuthState).mockImplementation(
       () =>
@@ -804,7 +1020,10 @@ describe("McpServerResource completeAuth", () => {
       await waitFor(() => resolveAuthState !== undefined);
 
       await root.getValue().disconnect();
-      resolveAuthState({ state: "expected" });
+      resolveAuthState({
+        serverUrl: "https://example.com/mcp",
+        state: "expected",
+      });
 
       await expect(completeAuth).rejects.toThrow(
         'MCP server "docs" authorization was interrupted before completion.',
@@ -824,7 +1043,10 @@ describe("McpServerResource completeAuth", () => {
       Promise.reject(new Error("invalid_grant")),
     );
     const storage = createStorage();
-    vi.mocked(storage.loadAuthState).mockResolvedValue({ state: "expected" });
+    vi.mocked(storage.loadAuthState).mockResolvedValue({
+      serverUrl: "https://example.com/mcp",
+      state: "expected",
+    });
     const root = mount({ auth: { type: "oauth" }, storage });
 
     try {
@@ -859,7 +1081,10 @@ describe("McpServerResource completeAuth", () => {
         }),
     );
     const storage = createStorage();
-    vi.mocked(storage.loadAuthState).mockResolvedValue({ state: "expected" });
+    vi.mocked(storage.loadAuthState).mockResolvedValue({
+      serverUrl: "https://example.com/mcp",
+      state: "expected",
+    });
     const root = mount({ auth: { type: "oauth" }, storage });
     let didUnmount = false;
 
@@ -892,7 +1117,10 @@ describe("McpServerResource completeAuth", () => {
         }),
     );
     const storage = createStorage();
-    vi.mocked(storage.loadAuthState).mockResolvedValue({ state: "expected" });
+    vi.mocked(storage.loadAuthState).mockResolvedValue({
+      serverUrl: "https://example.com/mcp",
+      state: "expected",
+    });
     const root = mount({ auth: { type: "oauth" }, storage });
     let didUnmount = false;
 
@@ -1766,7 +1994,14 @@ describe("McpServerResource oauth storage swap", () => {
 
   it("reconnects onto the replacement storage when the scope changes", async () => {
     const persisted = {
+      serverUrl: "https://example.com/mcp",
+      clientInformation: {
+        client_id: "registered-client",
+        redirect_uris: ["https://example.com/callback"],
+      },
+      clientInformationSource: "registered" as const,
       tokens: { access_token: "tok", token_type: "bearer" },
+      tokensClientId: "registered-client",
     };
     const storageA = {
       ...createStorage(),

package/src/resources/McpServerResource.ts

@@ -1,6 +1,7 @@
 import { useState, useRef, useEffect, useMemo, useEffectEvent } from "react";
 import { resource, useResource, withKey } from "@assistant-ui/tap";
 import type { ClientOutput } from "@assistant-ui/store";
+import { shallowEqual } from "@assistant-ui/store/internal";
 import {
   Client,
   StreamableHTTPClientTransport,
@@ -13,9 +14,14 @@ import {
 import {
   clearOAuthProviderAuthState,
   createOAuthProvider,
+  hasUsableOAuthTokens,
 } from "../auth/createOAuthProvider";
 import { buildHeaders } from "../auth/buildHeaders";
 import { assertValidServerId } from "../utils/serverId";
+import {
+  hasPersistedCredentials,
+  isAuthStateForServerUrl,
+} from "../utils/serverUrl";
 import { validateElicitationContent } from "./validateElicitationContent";
 import type { MCPStorage } from "./storage/types";
 import type {
@@ -80,13 +86,6 @@ export const getConnectionDependencies = (
   ];
 };
 
-const areConnectionDependenciesEqual = (
-  left: readonly unknown[],
-  right: readonly unknown[],
-) =>
-  left.length === right.length &&
-  left.every((value, index) => Object.is(value, right[index]));
-
 const useMcpServerResourceInstance = (
   props: McpServerResourceInstanceProps,
 ): ClientOutput<"mcpServer"> => {
@@ -242,11 +241,23 @@ const useMcpServerResourceInstance = (
     },
   );
 
+  const unboundAuthMessage = () =>
+    `MCP server "${props.id}" has saved authentication for a different URL. Authenticate again to connect to ${props.url}.`;
+
+  const loadAuthState = useEffectEvent(async () => {
+    const state = await props.storage.loadAuthState(props.id);
+    if (isAuthStateForServerUrl(state, props.url)) {
+      return { state, unbound: false };
+    }
+    return { state: null, unbound: hasPersistedCredentials(state) };
+  });
+
   const buildTransport = useEffectEvent(
     async (): Promise<StreamableHTTPClientTransport> => {
       if (props.auth.type === "oauth") {
         const authProvider = createOAuthProvider({
           serverId: props.id,
+          serverUrl: props.url,
           config: props.auth,
           storage: props.storage,
           redirectUri: props.redirectUri,
@@ -257,8 +268,9 @@ const useMcpServerResourceInstance = (
         });
       }
       if (props.auth.type === "bearer") {
-        const persisted = await props.storage.loadAuthState(props.id);
-        const headers = buildHeaders(props.auth, persisted);
+        const { state, unbound } = await loadAuthState();
+        const headers = buildHeaders(props.auth, state);
+        if (!headers && unbound) throw new Error(unboundAuthMessage());
         const transportOpts: StreamableHTTPClientTransportOptions = {};
         if (headers) transportOpts.requestInit = { headers };
         return new StreamableHTTPClientTransport(
@@ -488,10 +500,11 @@ const useMcpServerResourceInstance = (
     }
     pendingAuthValidation.count += 1;
     try {
-      const persisted = await props.storage.loadAuthState(props.id);
+      const { state: persisted, unbound } = await loadAuthState();
       if (!isCurrentConnection(validationGeneration)) {
         throw createInterruptedAuthError();
       }
+      if (unbound) throw new Error(unboundAuthMessage());
       if (!persisted?.state) {
         throw new Error(
           "no pending OAuth authorization request for this server",
@@ -563,9 +576,9 @@ const useMcpServerResourceInstance = (
         return;
       }
       const generation = connectionGenerationRef.current;
-      let persisted: Awaited<ReturnType<MCPStorage["loadAuthState"]>>;
+      let loaded: Awaited<ReturnType<typeof loadAuthState>>;
       try {
-        persisted = await props.storage.loadAuthState(props.id);
+        loaded = await loadAuthState();
       } catch (error) {
         if (signal.cancelled || !isCurrentConnection(generation)) return;
         const message = error instanceof Error ? error.message : String(error);
@@ -576,8 +589,13 @@ const useMcpServerResourceInstance = (
         return;
       }
       if (signal.cancelled || !isCurrentConnection(generation)) return;
+      if (loaded.unbound) {
+        setLastError({ message: unboundAuthMessage() });
+        return;
+      }
+      const persisted = loaded.state;
       if (props.auth.type === "oauth") {
-        if (!persisted?.tokens) return;
+        if (!hasUsableOAuthTokens(persisted, props.auth)) return;
       } else if (!persisted?.token) {
         return;
       }
@@ -599,6 +617,9 @@ const useMcpServerResourceInstance = (
     pendingDisposalRef.current = pendingDisposal;
     mountedRef.current = true;
     const signal = { cancelled: false };
+    // Auto-connect opens a transport, so it belongs to the same effect as the
+    // disposal that closes it.
+    // eslint-disable-next-line react-hooks/set-state-in-effect
     void tryAutoConnect(signal);
     return () => {
       mountedRef.current = false;
@@ -744,7 +765,7 @@ export const McpServerResource = resource(function useMcpServerResource(
   const dependencies = getConnectionDependencies(props);
   const [connection, setConnection] = useState({ dependencies, generation: 0 });
   let currentConnection = connection;
-  if (!areConnectionDependenciesEqual(connection.dependencies, dependencies)) {
+  if (!shallowEqual(connection.dependencies, dependencies)) {
     currentConnection = {
       dependencies,
       generation: connection.generation + 1,

package/src/resources/storage/McpLocalStorage.test.ts

@@ -136,6 +136,27 @@ describe("normalizePersistedAuthState", () => {
     });
   });
 
+  it("keeps valid server URL bindings", () => {
+    expect(
+      normalizePersistedAuthState({
+        serverUrl: "http://mcp.example.com/docs",
+        token: "bearer-token",
+      }),
+    ).toEqual({
+      serverUrl: "http://mcp.example.com/docs",
+      token: "bearer-token",
+    });
+  });
+
+  it("rejects auth state with an unsafe server URL binding", () => {
+    expect(
+      normalizePersistedAuthState({
+        serverUrl: "javascript:alert(1)",
+        token: "bearer-token",
+      }),
+    ).toBeNull();
+  });
+
   it("keeps valid OAuth tokens and client information", () => {
     const tokens = {
       access_token: "access-token",
@@ -153,11 +174,15 @@ describe("normalizePersistedAuthState", () => {
     expect(
       normalizePersistedAuthState({
         tokens,
+        tokensClientId: "client-id",
         clientInformation,
+        clientInformationSource: "registered",
       }),
     ).toEqual({
       tokens,
+      tokensClientId: "client-id",
       clientInformation,
+      clientInformationSource: "registered",
     });
   });
 
@@ -377,6 +402,7 @@ describe("McpLocalStorage auth state", () => {
     const createProvider = () =>
       createOAuthProvider({
         serverId: "docs",
+        serverUrl: "https://mcp.example.com/mcp",
         config: { type: "oauth", clientId: "client-id" },
         storage: loadStorage(storage),
         redirectUri: "http://localhost/callback",

package/src/resources/storage/McpLocalStorage.ts

@@ -6,6 +6,7 @@ import {
   OAuthProtectedResourceMetadataSchema,
   OAuthTokensSchema,
 } from "@modelcontextprotocol/core";
+import { normalizeMcpServerUrl } from "../../utils/serverUrl";
 import type { MCPAuthConfig, MCPCustomServerRecord } from "../../mcp-scope";
 import type { MCPPersistedAuthState } from "../../auth/types";
 import { assertValidServerId } from "../../utils/serverId";
@@ -160,6 +161,16 @@ const isSecureNetworkUrl = (value: unknown): value is string => {
   }
 };
 
+const isMcpServerUrl = (value: unknown): value is string => {
+  if (typeof value !== "string") return false;
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" || url.protocol === "http:";
+  } catch {
+    return false;
+  }
+};
+
 const normalizeDiscoveryState = (
   value: unknown,
 ): MCPPersistedAuthState["discoveryState"] | undefined => {
@@ -195,9 +206,16 @@ export const normalizePersistedAuthState = (
   value: unknown,
 ): MCPPersistedAuthState | null => {
   if (!isRecord(value)) return null;
+  if ("serverUrl" in value && !isMcpServerUrl(value.serverUrl)) return null;
 
   const state: MCPPersistedAuthState = {};
+  if (isMcpServerUrl(value.serverUrl)) {
+    state.serverUrl = normalizeMcpServerUrl(value.serverUrl);
+  }
   if (isNonEmptyString(value.token)) state.token = value.token;
+  if (isNonEmptyString(value.tokensClientId)) {
+    state.tokensClientId = value.tokensClientId;
+  }
   if (isNonEmptyString(value.codeVerifier)) {
     state.codeVerifier = value.codeVerifier;
   }
@@ -208,6 +226,9 @@ export const normalizePersistedAuthState = (
 
   const clientInformation = normalizeClientInformation(value.clientInformation);
   if (clientInformation) state.clientInformation = clientInformation;
+  if (value.clientInformationSource === "registered") {
+    state.clientInformationSource = value.clientInformationSource;
+  }
 
   const discoveryState = normalizeDiscoveryState(value.discoveryState);
   if (discoveryState) state.discoveryState = discoveryState;

package/src/utils/serverUrl.test.ts

@@ -0,0 +1,66 @@
+import { describe, expect, it } from "vitest";
+import {
+  hasPersistedCredentials,
+  isAuthStateForServerUrl,
+  normalizeMcpServerUrl,
+} from "./serverUrl";
+
+describe("normalizeMcpServerUrl", () => {
+  it("normalizes host case and the default port", () => {
+    expect(normalizeMcpServerUrl("https://MCP.Example.com:443/mcp")).toBe(
+      "https://mcp.example.com/mcp",
+    );
+  });
+});
+
+describe("isAuthStateForServerUrl", () => {
+  it("matches equivalent spellings of the same endpoint", () => {
+    expect(
+      isAuthStateForServerUrl(
+        { serverUrl: "https://MCP.Example.com/mcp" },
+        "https://mcp.example.com:443/mcp",
+      ),
+    ).toBe(true);
+  });
+
+  it("rejects a different endpoint, an unbound record, and no record", () => {
+    expect(
+      isAuthStateForServerUrl(
+        { serverUrl: "https://a.example.com/mcp" },
+        "https://b.example.com/mcp",
+      ),
+    ).toBe(false);
+    expect(
+      isAuthStateForServerUrl({ token: "t" }, "https://a.example.com/mcp"),
+    ).toBe(false);
+    expect(isAuthStateForServerUrl(null, "https://a.example.com/mcp")).toBe(
+      false,
+    );
+  });
+
+  it("rejects an unparsable URL on either side", () => {
+    expect(
+      isAuthStateForServerUrl({ serverUrl: "not a url" }, "https://a.test/mcp"),
+    ).toBe(false);
+    expect(
+      isAuthStateForServerUrl({ serverUrl: "https://a.test/mcp" }, "not a url"),
+    ).toBe(false);
+  });
+});
+
+describe("hasPersistedCredentials", () => {
+  it("counts bearer and OAuth tokens, not flow state", () => {
+    expect(hasPersistedCredentials({ token: "t" })).toBe(true);
+    expect(hasPersistedCredentials({ token: "" })).toBe(false);
+    expect(
+      hasPersistedCredentials({
+        tokens: { access_token: "a", token_type: "bearer" },
+      }),
+    ).toBe(true);
+    expect(hasPersistedCredentials({ codeVerifier: "v", state: "s" })).toBe(
+      false,
+    );
+    expect(hasPersistedCredentials({})).toBe(false);
+    expect(hasPersistedCredentials(null)).toBe(false);
+  });
+});