@bibobonking/opensol 3.1.0 → 3.1.1

package/dist/index.html

@@ -6,9 +6,9 @@
     <meta name="theme-color" content="#ffffff" />
     <meta
       name="description"
-      content="OpenSol by OpenSoft is a local-first coding agent. Work in a real folder, run commands, edit files and deploy with your own model keys. Keys stay encrypted on your machine."
+      content="OpenSol by OpenSoftX is a local-first coding agent. Work in a real folder, run commands, edit files and deploy with your own model keys. Keys stay encrypted on your machine."
     />
-    <title>OpenSol — Local coding agent by OpenSoft</title>
+    <title>OpenSol — Local coding agent by OpenSoftX</title>
     <link rel="icon" type="image/svg+xml" href="./favicon.svg" />
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
@@ -31,8 +31,8 @@
         if (DARK.includes(theme)) root.classList.add('dark')
       } catch {}
     </script>
-    <script type="module" crossorigin src="./assets/index-egG5Bgfo.js"></script>
-    <link rel="stylesheet" crossorigin href="./assets/index-DdI1_iPD.css">
+    <script type="module" crossorigin src="./assets/index-fhIO9a7_.js"></script>
+    <link rel="stylesheet" crossorigin href="./assets/index-CeN54A2N.css">
   </head>
   <body>
     <div id="root"><div class="splash" id="boot-splash" aria-hidden="true">

package/index.html

@@ -6,9 +6,9 @@
     <meta name="theme-color" content="#ffffff" />
     <meta
       name="description"
-      content="OpenSol by OpenSoft is a local-first coding agent. Work in a real folder, run commands, edit files and deploy with your own model keys. Keys stay encrypted on your machine."
+      content="OpenSol by OpenSoftX is a local-first coding agent. Work in a real folder, run commands, edit files and deploy with your own model keys. Keys stay encrypted on your machine."
     />
-    <title>OpenSol — Local coding agent by OpenSoft</title>
+    <title>OpenSol — Local coding agent by OpenSoftX</title>
     <link rel="icon" type="image/svg+xml" href="./favicon.svg" />
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@bibobonking/opensol",
   "private": false,
-  "version": "3.1.0",
+  "version": "3.1.1",
   "type": "module",
   "bin": {
     "opensol": "./server/opensol.mjs"

package/server/README.md

@@ -1,6 +1,6 @@
 # OpenSol
 
-A local-first AI coding agent by OpenSoft. OpenSol pairs a warm React chat interface with a zero-dependency Node daemon that owns the real workspace, shell, git, search, deploy and provider credentials on your machine.
+A local-first AI coding agent by OpenSoftX. OpenSol pairs a warm React chat interface with a zero-dependency Node daemon that owns the real workspace, shell, git, search, deploy and provider credentials on your machine.
 
 The daemon binds to `127.0.0.1` only. It serves the prebuilt app from `dist/` and stores everything under `~/.maxcode`. API keys and hosting tokens are encrypted with AES-256-GCM using a local `master.key`; the browser only ever receives a masked hint.
 
@@ -61,7 +61,7 @@ OpenCode free-tier models only work inside OpenCode itself, so they are hidden h
 - `secrets.enc` and `master.key` are created with mode `600`.
 - All API routes require the local session cookie and a CSRF header; Host and Origin are checked.
 - The daemon rejects code execution outside the selected workspace except for an explicit, existing deploy folder.
-- No telemetry or OpenSoft-hosted proxy. Provider requests go directly from the daemon to the provider you configured.
+- No telemetry or OpenSoftX-hosted proxy. Provider requests go directly from the daemon to the provider you configured.
 
 ## Stack
 

package/server/daemon.mjs

@@ -18,6 +18,7 @@ import {
   streamFile,
 } from './lib/http.mjs'
 import {
+  saveSecrets,
   addWorkspace,
   DATA_DIR,
   dataPaths,
@@ -545,12 +546,53 @@ async function handlePreview(req, res, rawPath) {
   streamFile(req, res, target.absolute, info.size, { 'Cache-Control': 'no-store' })
 }
 
+function oauthResultPage(ok, message) {
+  const safe = String(message).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c])
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>OpenSol · MCP sign-in</title><style>body{margin:0;min-height:100dvh;display:grid;place-items:center;font:15px system-ui,sans-serif;background:#faf9f5;color:#1f1e1d}main{max-width:360px;padding:32px;text-align:center}h1{font-size:20px;margin:0 0 8px}p{margin:0;color:#6b6a68;line-height:1.5}.dot{width:44px;height:44px;border-radius:50%;margin:0 auto 16px;display:grid;place-items:center;color:#fff;font-size:22px;background:${ok ? '#2f9e6b' : '#c4443a'}}@media(prefers-color-scheme:dark){body{background:#141413;color:#f2f1ee}p{color:#a5a39e}}</style></head><body><main><div class="dot">${ok ? '✓' : '!'}</div><h1>${ok ? 'Signed in' : 'Sign-in failed'}</h1><p>${safe}</p></main><script>try{var c=new BroadcastChannel('opensol-mcp-oauth');c.postMessage({ok:${ok ? 'true' : 'false'}});c.close()}catch(e){}${ok ? 'setTimeout(function(){window.close()},900)' : ''}</script></body></html>`
+}
+
+async function handleMcpOAuthCallback(req, res, url) {
+  const hostHeader = String(req.headers.host ?? '').toLowerCase()
+  if (!hostHeader || !allowedHosts().has(hostHeader)) {
+    throw new HttpError(403, 'OpenSol only answers requests addressed to localhost.', 'bad_host')
+  }
+  const send = (status, ok, message) => {
+    const body = Buffer.from(oauthResultPage(ok, message))
+    res.writeHead(status, { 'Content-Type': 'text/html; charset=utf-8', 'Content-Length': body.length, 'Cache-Control': 'no-store' })
+    res.end(body)
+  }
+  const state = url.searchParams.get('state') ?? ''
+  const providerError = url.searchParams.get('error')
+  if (providerError) {
+    mcp.pendingAuth.take(state)
+    send(400, false, url.searchParams.get('error_description') || providerError)
+    return
+  }
+  const code = url.searchParams.get('code') ?? ''
+  if (!state || !code) {
+    send(400, false, 'The authorization server did not return a code.')
+    return
+  }
+  try {
+    const config = await mcp.finishAuth(state, code)
+    send(200, true, `${config.name} is connected. You can close this window.`)
+  } catch (error) {
+    send(error instanceof HttpError ? error.status : 500, false, error instanceof Error ? error.message : 'Sign-in failed.')
+  }
+}
+
 async function route(req, res) {
   const rawPath = (req.url ?? '/').split('?')[0]
   if (rawPath.startsWith('/preview/')) {
     await handlePreview(req, res, rawPath)
     return
   }
+  if (rawPath === '/oauth/mcp/callback' && req.method === 'GET') {
+    // The browser arrives here from the authorization server, so Sec-Fetch-Site is cross-site.
+    // The one-time `state` created by an authenticated request is the CSRF protection.
+    await handleMcpOAuthCallback(req, res, new URL(req.url ?? '/', `http://${req.headers.host}`))
+    return
+  }
   guardRequest(req)
   const url = new URL(req.url ?? '/', `http://${req.headers.host}`)
   const pathname = url.pathname
@@ -785,6 +827,11 @@ async function route(req, res) {
         return config
       })
       await saveMcpServers(configs)
+      // Tokens belong to one server URL: drop them when the server is removed, moved, or OAuth is turned off.
+      for (const [id, old] of previous) {
+        const next = configs.find((config) => config.id === id)
+        if (!next || next.url !== old.url || !next.oauth?.enabled) await mcp.authStore.delete(id).catch(() => undefined)
+      }
       await mcp.setConfigs(configs)
       for (const config of configs) {
         const runtime = mcp.runtime.get(config.id)
@@ -805,6 +852,19 @@ async function route(req, res) {
       return
     }
 
+    const mcpAuthRoute = /^\/api\/mcp\/([a-z0-9][a-z0-9-]{0,39})\/(authorize|logout)$/.exec(pathname)
+    if (mcpAuthRoute && method === 'POST') {
+      const [, id, action] = mcpAuthRoute
+      if (action === 'authorize') {
+        const redirectUri = `http://${req.headers.host}/oauth/mcp/callback`
+        json(res, 200, await mcp.startAuth(id, redirectUri))
+      } else {
+        await mcp.signOut(id)
+        json(res, 200, { servers: mcp.list() })
+      }
+      return
+    }
+
     if (pathname === '/api/mcp/call' && method === 'POST') {
       const body = await readJson(req, 4 * 1024 * 1024)
       const result = await mcp.callTool(String(body.server ?? ''), String(body.tool ?? ''), body.args ?? {})
@@ -1047,6 +1107,20 @@ async function findPort(start) {
 export async function startServer({ port: requested = 4174, open = false } = {}) {
   await mkdir(DATA_DIR, { recursive: true, mode: 0o700 })
   mcp.getCwd = async () => (await workspaceRoot().catch(() => '')) || os.homedir()
+  // OAuth clients and tokens live in the encrypted secrets file, never in state.json.
+  mcp.authStore = {
+    get: async (id) => (await loadSecrets()).mcpOAuth?.[id] ?? null,
+    set: async (id, value) => {
+      const secrets = await loadSecrets()
+      await saveSecrets({ ...secrets, mcpOAuth: { ...(secrets.mcpOAuth ?? {}), [id]: value } })
+    },
+    delete: async (id) => {
+      const secrets = await loadSecrets()
+      if (!secrets.mcpOAuth?.[id]) return
+      const { [id]: _removed, ...rest } = secrets.mcpOAuth
+      await saveSecrets({ ...secrets, mcpOAuth: rest })
+    },
+  }
   await mcp.setConfigs(await getMcpServers())
   void mcp.connectAll().catch(() => undefined)
   port = requested === 0 ? await findPort(4174) : requested

package/server/lib/mcp-oauth.mjs

@@ -0,0 +1,219 @@
+// OAuth 2.1 for remote MCP servers: protected-resource + authorization-server discovery,
+// dynamic client registration (RFC 7591), PKCE (S256) and token refresh. Zero dependencies.
+// Tokens never reach the browser; the daemon keeps them in the encrypted secrets file.
+import { createHash, randomBytes } from 'node:crypto'
+
+const FETCH_TIMEOUT_MS = 15_000
+const PENDING_TTL_MS = 10 * 60_000
+
+export class AuthRequiredError extends Error {
+  constructor(wwwAuthenticate = '') {
+    super('This MCP server needs you to sign in.')
+    this.name = 'AuthRequiredError'
+    this.wwwAuthenticate = wwwAuthenticate
+  }
+}
+
+const b64url = (buffer) => buffer.toString('base64url')
+
+async function fetchJson(url, init = {}) {
+  const response = await fetch(url, {
+    ...init,
+    headers: { Accept: 'application/json', ...(init.headers ?? {}) },
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+  })
+  const text = await response.text()
+  let body = null
+  try {
+    body = text ? JSON.parse(text) : null
+  } catch {
+    body = null
+  }
+  return { response, body, text }
+}
+
+function assertHttp(value, label) {
+  let parsed
+  try {
+    parsed = new URL(value)
+  } catch {
+    throw new Error(`${label} is not a valid URL.`)
+  }
+  if (!['http:', 'https:'].includes(parsed.protocol)) throw new Error(`${label} must use http or https.`)
+  return parsed
+}
+
+/** Reads `resource_metadata="…"` from a WWW-Authenticate header. */
+export function parseResourceMetadataUrl(header) {
+  const match = /resource_metadata="?([^",\s]+)"?/i.exec(header ?? '')
+  return match ? match[1] : ''
+}
+
+function wellKnownCandidates(base, name) {
+  const parsed = new URL(base)
+  const out = []
+  const pathPart = parsed.pathname.replace(/\/+$/, '')
+  if (pathPart) out.push(`${parsed.origin}/.well-known/${name}${pathPart}`)
+  out.push(`${parsed.origin}/.well-known/${name}`)
+  return out
+}
+
+async function firstJson(urls, accept = (body) => body && typeof body === 'object') {
+  for (const url of urls) {
+    try {
+      const { response, body } = await fetchJson(url)
+      if (response.ok && accept(body)) return body
+    } catch {
+      // Try the next candidate.
+    }
+  }
+  return null
+}
+
+/** Finds the authorization server metadata that protects an MCP server URL. */
+export async function discover(serverUrl, wwwAuthenticate = '') {
+  assertHttp(serverUrl, 'The MCP server URL')
+  const hinted = parseResourceMetadataUrl(wwwAuthenticate)
+  const resourceUrls = [...(hinted ? [hinted] : []), ...wellKnownCandidates(serverUrl, 'oauth-protected-resource')]
+  const resource = await firstJson(resourceUrls, (body) => body && Array.isArray(body.authorization_servers))
+  const issuer = resource?.authorization_servers?.[0] || new URL(serverUrl).origin
+  assertHttp(issuer, 'The authorization server')
+  const metadata =
+    (await firstJson(
+      [
+        ...wellKnownCandidates(issuer, 'oauth-authorization-server'),
+        ...wellKnownCandidates(issuer, 'openid-configuration'),
+        `${issuer.replace(/\/+$/, '')}/.well-known/openid-configuration`,
+      ],
+      (body) => body && typeof body.authorization_endpoint === 'string' && typeof body.token_endpoint === 'string',
+    )) ?? null
+  if (metadata) return { ...metadata, resource: resource?.resource || serverUrl }
+  // Servers without metadata fall back to the conventional endpoints on the issuer origin.
+  const origin = new URL(issuer).origin
+  return {
+    issuer: origin,
+    authorization_endpoint: `${origin}/authorize`,
+    token_endpoint: `${origin}/token`,
+    registration_endpoint: `${origin}/register`,
+    resource: resource?.resource || serverUrl,
+    fallback: true,
+  }
+}
+
+export async function registerClient(metadata, redirectUri, clientName) {
+  if (!metadata.registration_endpoint) {
+    throw new Error('This server does not support automatic sign-in setup. Enter an OAuth client ID in the server settings.')
+  }
+  const { response, body, text } = await fetchJson(metadata.registration_endpoint, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      client_name: clientName,
+      redirect_uris: [redirectUri],
+      grant_types: ['authorization_code', 'refresh_token'],
+      response_types: ['code'],
+      token_endpoint_auth_method: 'none',
+    }),
+  })
+  if (!response.ok || !body?.client_id) {
+    throw new Error(`Client registration failed (${response.status}). ${(body?.error_description || text || '').slice(0, 200)}`.trim())
+  }
+  return { clientId: String(body.client_id), clientSecret: body.client_secret ? String(body.client_secret) : '' }
+}
+
+export function createPkce() {
+  const verifier = b64url(randomBytes(48))
+  const challenge = b64url(createHash('sha256').update(verifier).digest())
+  return { verifier, challenge }
+}
+
+export function buildAuthorizationUrl({ metadata, clientId, redirectUri, state, challenge, scope, resource }) {
+  const url = new URL(metadata.authorization_endpoint)
+  url.searchParams.set('response_type', 'code')
+  url.searchParams.set('client_id', clientId)
+  url.searchParams.set('redirect_uri', redirectUri)
+  url.searchParams.set('state', state)
+  url.searchParams.set('code_challenge', challenge)
+  url.searchParams.set('code_challenge_method', 'S256')
+  if (scope) url.searchParams.set('scope', scope)
+  if (resource) url.searchParams.set('resource', resource)
+  return url.toString()
+}
+
+async function tokenRequest(metadata, client, params, resource) {
+  const form = new URLSearchParams({ ...params, client_id: client.clientId })
+  if (resource) form.set('resource', resource)
+  const headers = { 'Content-Type': 'application/x-www-form-urlencoded' }
+  if (client.clientSecret) {
+    const methods = metadata.token_endpoint_auth_methods_supported
+    if (Array.isArray(methods) && !methods.includes('client_secret_post') && methods.includes('client_secret_basic')) {
+      headers.Authorization = `Basic ${Buffer.from(`${client.clientId}:${client.clientSecret}`).toString('base64')}`
+    } else {
+      form.set('client_secret', client.clientSecret)
+    }
+  }
+  const { response, body, text } = await fetchJson(metadata.token_endpoint, { method: 'POST', headers, body: form.toString() })
+  if (!response.ok || !body?.access_token) {
+    const detail = body?.error_description || body?.error || text || ''
+    const error = new Error(`Token request failed (${response.status}). ${String(detail).slice(0, 200)}`.trim())
+    error.status = response.status
+    error.oauthError = body?.error
+    throw error
+  }
+  return normalizeTokens(body)
+}
+
+function normalizeTokens(body, previous) {
+  const expiresIn = Number(body.expires_in)
+  return {
+    accessToken: String(body.access_token),
+    refreshToken: body.refresh_token ? String(body.refresh_token) : previous?.refreshToken || '',
+    tokenType: body.token_type ? String(body.token_type) : 'Bearer',
+    scope: typeof body.scope === 'string' ? body.scope : previous?.scope || '',
+    expiresAt: Number.isFinite(expiresIn) && expiresIn > 0 ? Date.now() + expiresIn * 1000 : 0,
+  }
+}
+
+export function exchangeCode({ metadata, client, code, verifier, redirectUri, resource }) {
+  return tokenRequest(metadata, client, {
+    grant_type: 'authorization_code',
+    code,
+    code_verifier: verifier,
+    redirect_uri: redirectUri,
+  }, resource)
+}
+
+export async function refreshTokens({ metadata, client, tokens, resource }) {
+  if (!tokens?.refreshToken) throw new Error('No refresh token; sign in again.')
+  const next = await tokenRequest(metadata, client, { grant_type: 'refresh_token', refresh_token: tokens.refreshToken }, resource)
+  return { ...next, refreshToken: next.refreshToken || tokens.refreshToken }
+}
+
+export const tokenIsFresh = (tokens, skewMs = 60_000) =>
+  Boolean(tokens?.accessToken) && (!tokens.expiresAt || tokens.expiresAt - skewMs > Date.now())
+
+/** In-flight authorization requests keyed by the OAuth `state` value. */
+export class PendingAuthorizations {
+  constructor() {
+    this.map = new Map()
+  }
+
+  create(entry) {
+    this.#purge()
+    const state = b64url(randomBytes(24))
+    this.map.set(state, { ...entry, createdAt: Date.now() })
+    return state
+  }
+
+  take(state) {
+    this.#purge()
+    const entry = this.map.get(state)
+    if (entry) this.map.delete(state)
+    return entry ?? null
+  }
+
+  #purge() {
+    const cutoff = Date.now() - PENDING_TTL_MS
+    for (const [key, value] of this.map) if (value.createdAt < cutoff) this.map.delete(key)
+  }
+}

package/server/lib/mcp-oauth.test.mjs

@@ -0,0 +1,175 @@
+import assert from 'node:assert/strict'
+import { createHash } from 'node:crypto'
+import http from 'node:http'
+import test from 'node:test'
+import { McpManager, sanitizeServerConfig } from './mcp.mjs'
+
+function readBody(req) {
+  return new Promise((resolve) => {
+    let data = ''
+    req.on('data', (chunk) => (data += chunk))
+    req.on('end', () => resolve(data))
+  })
+}
+
+/** One fake host: OAuth endpoints, a Streamable HTTP MCP endpoint and a legacy SSE endpoint. */
+async function fakeServer() {
+  const seen = { registrations: 0, refreshes: 0, challenge: '', code: 'code-1' }
+  const sseClients = []
+  let accessToken = 'access-1'
+  const rpc = (message) => {
+    if (message.method === 'initialize') return { protocolVersion: '2025-03-26', capabilities: {}, serverInfo: { name: 'fake', version: '1' } }
+    if (message.method === 'tools/list') return { tools: [{ name: 'hello', description: 'Say hi', inputSchema: { type: 'object', properties: {} } }] }
+    if (message.method === 'tools/call') return { content: [{ type: 'text', text: 'hi from fake' }] }
+    return {}
+  }
+  const server = http.createServer(async (req, res) => {
+    const base = `http://127.0.0.1:${server.address().port}`
+    const url = new URL(req.url, base)
+    const send = (status, body, headers = {}) => {
+      res.writeHead(status, { 'Content-Type': 'application/json', ...headers })
+      res.end(JSON.stringify(body))
+    }
+    if (url.pathname === '/.well-known/oauth-protected-resource/mcp') return send(200, { resource: `${base}/mcp`, authorization_servers: [base] })
+    if (url.pathname === '/.well-known/oauth-authorization-server') {
+      return send(200, {
+        issuer: base,
+        authorization_endpoint: `${base}/authorize`,
+        token_endpoint: `${base}/token`,
+        registration_endpoint: `${base}/register`,
+      })
+    }
+    if (url.pathname === '/register') {
+      seen.registrations += 1
+      const body = JSON.parse(await readBody(req))
+      assert.equal(body.token_endpoint_auth_method, 'none')
+      return send(201, { client_id: 'client-1' })
+    }
+    if (url.pathname === '/token') {
+      const form = new URLSearchParams(await readBody(req))
+      if (form.get('grant_type') === 'authorization_code') {
+        const expected = createHash('sha256').update(form.get('code_verifier')).digest('base64url')
+        if (form.get('code') !== seen.code || expected !== seen.challenge) return send(400, { error: 'invalid_grant' })
+        return send(200, { access_token: 'access-1', refresh_token: 'refresh-1', expires_in: 3600 })
+      }
+      if (form.get('grant_type') === 'refresh_token' && form.get('refresh_token') === 'refresh-1') {
+        seen.refreshes += 1
+        accessToken = 'access-2'
+        return send(200, { access_token: 'access-2', expires_in: 3600 })
+      }
+      return send(400, { error: 'invalid_grant' })
+    }
+    if (url.pathname === '/mcp' && req.method === 'POST') {
+      if (req.headers.authorization !== `Bearer ${accessToken}`) {
+        return send(401, { error: 'unauthorized' }, { 'WWW-Authenticate': `Bearer resource_metadata="${base}/.well-known/oauth-protected-resource/mcp"` })
+      }
+      const message = JSON.parse(await readBody(req))
+      if (message.id === undefined) {
+        res.writeHead(202)
+        return res.end()
+      }
+      return send(200, { jsonrpc: '2.0', id: message.id, result: rpc(message) })
+    }
+    if (url.pathname === '/sse' && req.method === 'GET') {
+      res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache' })
+      res.write('event: endpoint\ndata: /messages?session=1\n\n')
+      sseClients.push(res)
+      return
+    }
+    if (url.pathname === '/messages' && req.method === 'POST') {
+      const message = JSON.parse(await readBody(req))
+      res.writeHead(202)
+      res.end('Accepted')
+      if (message.id !== undefined) {
+        sseClients.at(-1)?.write(`event: message\ndata: ${JSON.stringify({ jsonrpc: '2.0', id: message.id, result: rpc(message) })}\n\n`)
+      }
+      return
+    }
+    send(404, {})
+  })
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve))
+  const base = `http://127.0.0.1:${server.address().port}`
+  const close = () => {
+    for (const client of sseClients) client.end()
+    server.closeAllConnections()
+    return new Promise((resolve) => server.close(resolve))
+  }
+  return { base, seen, close, expireAccess: () => (accessToken = 'rotated-away') }
+}
+
+test('OAuth: discovery, dynamic registration, PKCE sign-in and token refresh', async () => {
+  const fake = await fakeServer()
+  const manager = new McpManager()
+  const config = sanitizeServerConfig({ name: 'Secure', transport: 'http', url: `${fake.base}/mcp`, oauth: { enabled: true } })
+  await manager.setConfigs([config])
+
+  let view = await manager.connect(config.id)
+  assert.equal(view.status, 'needs_auth')
+  assert.equal(view.oauth.authorized, false)
+
+  const redirectUri = 'http://127.0.0.1:4174/oauth/mcp/callback'
+  const { url } = await manager.startAuth(config.id, redirectUri)
+  const authorize = new URL(url)
+  assert.equal(authorize.pathname, '/authorize')
+  assert.equal(authorize.searchParams.get('client_id'), 'client-1')
+  assert.equal(authorize.searchParams.get('code_challenge_method'), 'S256')
+  assert.equal(authorize.searchParams.get('resource'), `${fake.base}/mcp`)
+  fake.seen.challenge = authorize.searchParams.get('code_challenge')
+
+  await assert.rejects(() => manager.finishAuth('wrong-state', 'code-1'), /expired|already used/)
+  await manager.finishAuth(authorize.searchParams.get('state'), 'code-1')
+  view = manager.list()[0]
+  assert.equal(view.status, 'connected', view.error)
+  assert.equal(view.oauth.authorized, true)
+  assert.equal(view.tools[0].name, 'hello')
+
+  // The access token stops working: the manager refreshes once and retries the call.
+  fake.expireAccess()
+  const result = await manager.callTool(config.id, 'hello', {})
+  assert.deepEqual(result, { text: 'hi from fake', isError: false })
+  assert.equal(fake.seen.refreshes, 1)
+
+  // A second sign-in reuses the registered client.
+  await manager.startAuth(config.id, redirectUri)
+  assert.equal(fake.seen.registrations, 1)
+
+  await manager.signOut(config.id)
+  assert.equal(manager.list()[0].status, 'needs_auth')
+  await manager.shutdown()
+  await fake.close()
+})
+
+test('a 401 without OAuth explains how to fix it', async () => {
+  const fake = await fakeServer()
+  const manager = new McpManager()
+  const config = sanitizeServerConfig({ name: 'Plain', transport: 'http', url: `${fake.base}/mcp` })
+  await manager.setConfigs([config])
+  const view = await manager.connect(config.id)
+  assert.equal(view.status, 'error')
+  assert.match(view.error, /401/)
+  await fake.close()
+})
+
+test('legacy HTTP+SSE servers connect and answer tool calls', async () => {
+  const fake = await fakeServer()
+  const manager = new McpManager()
+  const config = sanitizeServerConfig({ name: 'Legacy', transport: 'sse', url: `${fake.base}/sse` })
+  assert.equal(config.transport, 'sse')
+  await manager.setConfigs([config])
+  const view = await manager.connect(config.id)
+  assert.equal(view.status, 'connected', view.error)
+  assert.equal(view.tools[0].name, 'hello')
+  assert.deepEqual(await manager.callTool(config.id, 'hello', {}), { text: 'hi from fake', isError: false })
+  await manager.shutdown()
+  await fake.close()
+})
+
+test('OAuth client secrets are masked and kept on save', () => {
+  const config = sanitizeServerConfig({ name: 'x', transport: 'http', url: 'https://example.com/mcp', oauth: { enabled: true, clientId: 'abc', clientSecret: 's3cret' } })
+  const manager = new McpManager()
+  manager.configs.set(config.id, config)
+  const view = manager.list()[0]
+  assert.notEqual(view.oauth.clientSecret, 's3cret')
+  const again = sanitizeServerConfig(view, config)
+  assert.equal(again.oauth.clientSecret, 's3cret')
+})