@code-yeongyu/senpi 2026.10.26-1 → 2026.10.27-1

package/dist/core/extensions/builtin/anthropic-subscription/auth-lane.js

@@ -1,7 +1,4 @@
 import { createHash } from "node:crypto";
-import { loadAnthropicOAuth } from "@earendil-works/pi-ai/oauth";
-import { getAgentDir } from "../../../../config.js";
-import { AuthStorage } from "../../../auth-storage.js";
 import { CredentialStoreBusyError } from "../../../lockfile-policy.js";
 import { emitProviderAccountFailover, emitProviderAccountsChanged } from "./account-events.js";
 import { ANTHROPIC_SUBSCRIPTION_PROVIDER_ID } from "./account-management.js";
@@ -9,6 +6,7 @@ import { emptyCredential, envSlotToken, listAccounts, refreshSlot, } from "./acc
 import { isBlockedFor, selectAccount } from "./affinity.js";
 import { createAttemptMessages } from "./auth-attempt.js";
 import { recoverAuthBlockedSlots } from "./auth-block-recovery.js";
+import { activeBoundary } from "./auth-lane-boundary.js";
 import { hasRequestOauthToken, mergeRequestAuthEnvironment, stripManagedAuthEnvironment } from "./auth-environment.js";
 import { writeConfigDirCredential } from "./config-dir-credentials.js";
 import { asksLegacyLongContext } from "./context-window.js";
@@ -17,33 +15,11 @@ import { markLongContextRefused } from "./long-context.js";
 import { classifyForRequest, retryAtStandardWindowOnce, sdkFailure, visibleSdkMessage } from "./long-context-retry.js";
 import { isGrantRejected, refreshFailure } from "./refresh-failure.js";
 export { ANTHROPIC_SUBSCRIPTION_PROVIDER_ID } from "./account-management.js";
+export { authLaneRefresher, overrideAuthLaneBoundary, resetAuthLaneBoundary } from "./auth-lane-boundary.js";
 export const EXPIRING_WITHIN_MS = 5 * 60_000;
 /** A managed lane with an empty pool must refuse rather than spawn the SDK against ambient host credentials. */
 const NO_MANAGED_ACCOUNTS_ERROR = "authentication_failed: No Anthropic Subscription accounts configured for the managed lane; " +
     "run /login anthropic-subscription or set CLAUDE_CODE_OAUTH_TOKEN";
-async function refreshWithAnthropicOAuth(refresh, signal) {
-    const oauth = await loadAnthropicOAuth();
-    const credential = await oauth.refresh({ type: "oauth", access: "", refresh, expires: 0 }, signal);
-    return { access: credential.access, refresh: credential.refresh, expires: credential.expires };
-}
-const defaultBoundary = {
-    createStore: () => AuthStorage.create(),
-    env: () => process.env,
-    getAgentDir,
-    now: () => Date.now(),
-    refresher: refreshWithAnthropicOAuth,
-};
-let activeBoundary = defaultBoundary;
-export function overrideAuthLaneBoundary(override) {
-    activeBoundary = { ...activeBoundary, ...override };
-}
-export function resetAuthLaneBoundary() {
-    activeBoundary = defaultBoundary;
-}
-/** The refresher turns use, so the usage poller renews an expiring account the same way (senpi#3684). */
-export function authLaneRefresher() {
-    return activeBoundary.refresher;
-}
 export function resolveEffectiveLane(settings, accounts) {
     return settings.tokenInjection ?? (accounts.length > 0 ? "oauth-slots" : "ambient");
 }
@@ -193,6 +169,7 @@ export async function* queryWithAuthLane(input) {
                 accountName: slot.name,
                 accounts,
                 authLane: pool.lane,
+                pinSource: input.pinnedAccount !== undefined ? "cli" : pool.pinSource,
                 options,
                 credentialDigest: prepared.credentialDigest,
             });

package/dist/core/extensions/builtin/anthropic-subscription/errors.js

@@ -1,4 +1,5 @@
 import { rateLimitModelFamily } from "../../../credential-pool/model-scope.js";
+import { inheritAccountContext } from "./account-context.js";
 const SDK_ERROR_CLASSIFICATIONS = {
     authentication_failed: { kind: "auth_error", retryable: true },
     oauth_org_not_allowed: { kind: "org_not_allowed", retryable: true },
@@ -60,7 +61,7 @@ export function sdkResultFailure(message) {
     const status = "api_error_status" in message && message.api_error_status != null ? `HTTP ${message.api_error_status}` : "";
     const reason = "terminal_reason" in message && typeof message.terminal_reason === "string" ? message.terminal_reason : "";
     const suffix = [status, reason].filter(Boolean).join(", ");
-    return new SdkResultFailure(suffix ? `${detail} (${suffix})` : detail, message.usage);
+    return inheritAccountContext(message, new SdkResultFailure(suffix ? `${detail} (${suffix})` : detail, message.usage));
 }
 export function sdkAssistantFailure(message) {
     if (!message.error)
@@ -72,7 +73,7 @@ export function sdkAssistantFailure(message) {
             .filter((block) => block.type === "text" && "text" in block && typeof block.text === "string")
             .map((block) => ("text" in block && typeof block.text === "string" ? block.text : ""))
             .join(" ")).trim();
-    return new Error(text ? (message.error === "unknown" ? text : `${text} (${message.error})`) : message.error);
+    return inheritAccountContext(message, new Error(text ? (message.error === "unknown" ? text : `${text} (${message.error})`) : message.error));
 }
 /** Classifies Anthropic Subscription error codes and HTTP-shaped fallback text in one place. */
 export function classifySdkError(error) {

package/dist/core/extensions/builtin/anthropic-subscription/guidance.d.ts

@@ -1,8 +1,13 @@
-import type { UnavailableAccount } from "./affinity.ts";
+import type { PinSource, UnavailableAccount } from "./affinity.ts";
 import type { SdkErrorKind } from "./errors.ts";
 import type { ClaudeCodeRun } from "./executable.ts";
 export declare function noAccountGuidance(hasAnthropicCredential: boolean): string;
 export declare function allAccountsBlockedGuidance(soonestUnblockAt: number | undefined, blockReason?: "auth_error"): string;
+/**
+ * How to move off a pinned account. `/claude-account pin` only writes the stored pin, which a CLI or a
+ * settings pin outranks (`resolveClaudeAccountPin`), so for those it would change nothing (senpi#3672).
+ */
+export declare function switchAccountLine(pinnedBy: PinSource | undefined): string;
 /**
  * With account fallback off, only one account may serve (senpi#3465), so the pool-wide advice is wrong:
  * other accounts may be healthy, and adding one does not help because it is never used. Name the account

package/dist/core/extensions/builtin/anthropic-subscription/guidance.js

@@ -43,7 +43,7 @@ const ENABLE_ACCOUNT_FALLBACK = "  Set anthropicSubscriptionProvider.accountFall
  * How to move off a pinned account. `/claude-account pin` only writes the stored pin, which a CLI or a
  * settings pin outranks (`resolveClaudeAccountPin`), so for those it would change nothing (senpi#3672).
  */
-function switchAccountLine(pinnedBy) {
+export function switchAccountLine(pinnedBy) {
     switch (pinnedBy) {
         case "cli":
             return "  This session was started with --claude-account; start a new session with another --claude-account to switch.";

package/dist/core/extensions/builtin/anthropic-subscription/stream-guidance.js

@@ -1,12 +1,23 @@
 import { AllAccountsBlockedError } from "./affinity.js";
+import { errorAccountContext } from "./account-context.js";
 import { classifySdkError } from "./errors.js";
-import { allAccountsBlockedGuidance, claudeCodeVersionFloorGuidance, sdkErrorGuidance, singleAccountUnavailableGuidance, } from "./guidance.js";
+import { ClassifiedSdkError } from "./failover.js";
+import { allAccountsBlockedGuidance, claudeCodeVersionFloorGuidance, sdkErrorGuidance, singleAccountUnavailableGuidance, switchAccountLine, } from "./guidance.js";
 export function withAuthGuidance(error, message, ran) {
     if (error instanceof AllAccountsBlockedError)
         return error.unavailableAccount === undefined
             ? allAccountsBlockedGuidance(error.soonestUnblockAt, error.blockReason)
             : singleAccountUnavailableGuidance(error.unavailableAccount, error.soonestUnblockAt, error.blockReason);
-    const guidance = sdkErrorGuidance(classifySdkError(error).kind);
+    const kind = classifySdkError(error).kind;
+    const account = errorAccountContext(error instanceof ClassifiedSdkError ? error.original : error);
+    let guidance = sdkErrorGuidance(kind);
+    if (account && (kind === "billing" || /\bout of extra usage\b/i.test(message))) {
+        const selected = `Claude account '${account.accountLabel}' (source: ${account.accountSource}).`;
+        const action = account.accountSource === "ambient"
+            ? "Switch the Claude Code login, or top up at claude.ai/settings/usage."
+            : `${switchAccountLine(account.pinSource).trim()} Or top up this account at claude.ai/settings/usage.`;
+        guidance = `${selected} ${action}`;
+    }
     const versionGuidance = claudeCodeVersionFloorGuidance(message, ran);
     const hints = [guidance, versionGuidance].filter((hint) => hint !== undefined);
     return hints.length > 0 ? `${message}\n${hints.join("\n")}` : message;

package/dist/core/extensions/builtin/compaction/index.js

@@ -648,8 +648,14 @@ export default function compactionExtension(pi, remoteCompactionDependencies = {
             catch (error) {
                 const message = error instanceof Error ? error.message : String(error);
                 const failureKind = classifyRequiredCompactionFallbackFailure(error);
+                // A terminal provider failure (dead model, dead credential) has no cheaper
+                // recovery on any compaction kind: without this, a soft-threshold pre_prompt
+                // compaction cancelled instead, the session rejected it, and the pending
+                // prompt failed with RequiredCompactionError while shouldCompact still said
+                // compact (the "Compaction rejected: compaction generator failed" wedge).
                 if ((requiresDeterministicCompactionFallback(event, ctx.getContextUsage()) ||
-                    failureKind === "unsafe-retained-content") &&
+                    failureKind === "unsafe-retained-content" ||
+                    failureKind === "summarization-provider-failure") &&
                     failureKind !== undefined &&
                     !event.signal.aborted) {
                     const recovery = recoverRequiredCompaction(ctx, snapshot, failureKind, error);

package/dist/core/extensions/builtin/herdr/index.js

@@ -2,6 +2,7 @@ import { closeSync, openSync, readdirSync, readFileSync, readSync } from "node:f
 import { createConnection } from "node:net";
 import { join, win32 } from "node:path";
 import { debuglog } from "node:util";
+import { APP_COMMAND } from "../../../../config.js";
 import { isTerminalMonitorStateEvent, isWakeSourceStateEvent, TERMINAL_MONITOR_STATE_EVENT, WAKE_SOURCE_STATE_EVENT, } from "../monitor-state-event.js";
 import { HerdrClient } from "./herdr-client.js";
 import { initialHerdrState, isHerdrBlockedEvent, reduceHerdrState, selectHerdrReport } from "./herdr-state.js";
@@ -115,11 +116,14 @@ export function createHerdrExtension(deps) {
                 void publish();
             }, 4000);
             poll.unref();
-            await Promise.all([
-                reportTitle(ctx),
-                send("pane.report_agent_session", { agent: "pi", ...sessionRef(), session_start_source: _event.reason }),
-                publish(),
-            ]);
+            // Herdr accepts a resume command only after this reporter holds the pane.
+            await Promise.all([reportTitle(ctx), publish()]);
+            await send("pane.report_agent_session", {
+                agent: "pi",
+                ...sessionRef(),
+                resume_argv: [APP_COMMAND, "--session", bound.getSessionFile() ?? bound.getSessionId()],
+                session_start_source: _event.reason,
+            });
         });
         pi.on("session_info_changed", (_event, ctx) => {
             if (owns(ctx))

package/dist/core/extensions/builtin/mcp/auth/oauth-issuer.d.ts

@@ -0,0 +1,6 @@
+import type { OAuthServerInfo } from "@modelcontextprotocol/sdk/client/auth.js";
+import type { McpStoredAuth } from "./token-store.ts";
+export declare function canonicalAuthorizationServerIssuer(issuer: string): string;
+export declare function validatedAuthorizationServerIssuer(info: OAuthServerInfo, serverName: string): string;
+export declare function credentialsMatchIssuer(record: McpStoredAuth | undefined, issuer: string): boolean;
+//# sourceMappingURL=oauth-issuer.d.ts.map

package/dist/core/extensions/builtin/mcp/auth/oauth-issuer.js

@@ -0,0 +1,25 @@
+import { OAuthFlowError } from "./oauth-errors.js";
+// Credential stamps tolerate only the slash spelling of an origin-only URL, not URL normalization.
+export function canonicalAuthorizationServerIssuer(issuer) {
+    return issuer.replace(/^(https?:\/\/[^/?#]+)\/$/, "$1");
+}
+// RFC 8414 section 3.3: identifiers from metadata are compared verbatim, not as normalized URLs.
+export function validatedAuthorizationServerIssuer(info, serverName) {
+    // The SDK's legacy fallback discovers root metadata and spells the origin with a trailing slash.
+    // Only that configured-resource fallback is normalized; PRM-provided identifiers remain exact.
+    const origin = new URL(info.authorizationServerUrl).origin;
+    const issuer = !info.resourceMetadata?.authorization_servers?.length && info.authorizationServerUrl === `${origin}/`
+        ? canonicalAuthorizationServerIssuer(info.authorizationServerUrl)
+        : info.authorizationServerUrl;
+    if (info.authorizationServerMetadata !== undefined && info.authorizationServerMetadata.issuer !== issuer) {
+        throw new OAuthFlowError("needs_auth", `MCP server ${serverName} authorization server metadata issuer mismatch; restart authorization after correcting the server metadata.`, { serverName });
+    }
+    return issuer;
+}
+export function credentialsMatchIssuer(record, issuer) {
+    const grantIssuer = record?.issuer ?? record?.discoveryState?.authorizationServerUrl;
+    const clientIssuer = record?.clientInfo?.issuer ?? grantIssuer;
+    return [grantIssuer, clientIssuer].every((stamp) => stamp === undefined ||
+        canonicalAuthorizationServerIssuer(stamp) === canonicalAuthorizationServerIssuer(issuer));
+}
+//# sourceMappingURL=oauth-issuer.js.map

package/dist/core/extensions/builtin/mcp/auth/oauth-provider.d.ts

@@ -15,8 +15,6 @@ export interface McpOAuthProviderOptions {
     onRedirect?: (url: URL) => void | Promise<void>;
 }
 export declare function tokenExpiresAt(tokens: OAuthTokens, now?: number): number | undefined;
-/** Compares authorization server identifiers the way the SDK does: parsed, tolerating one trailing `/`. */
-export declare function sameAuthorizationServer(a: string, b: string): boolean;
 /**
  * The authorization server a stored grant belongs to (senpi#2940, GHSA-6qxp-vccf-f47h): its `issuer` stamp, or
  * for a record saved before the stamp existed, the authorization server its sign-in discovered. A record with
@@ -37,7 +35,9 @@ export declare class McpOAuthProvider implements OAuthClientProvider {
     get lastAuthorizationUrl(): URL | undefined;
     get redirectUrl(): string | URL | undefined;
     get clientMetadataUrl(): string | undefined;
-    get clientMetadata(): OAuthClientMetadata;
+    get clientMetadata(): OAuthClientMetadata & {
+        application_type?: "native" | "web";
+    };
     state(): string;
     consumeState(candidate: string | undefined): boolean;
     clientInformation(): OAuthClientInformationMixed | undefined;

package/dist/core/extensions/builtin/mcp/auth/oauth-provider.js

@@ -1,6 +1,7 @@
 import { randomBytes } from "node:crypto";
 import { fingerprintSecret } from "../log.js";
 import { OAuthFlowError } from "./oauth-errors.js";
+import { canonicalAuthorizationServerIssuer, credentialsMatchIssuer, validatedAuthorizationServerIssuer, } from "./oauth-issuer.js";
 // Buffer before absolute token expiry at which a refresh is considered due.
 export const REFRESH_LEEWAY_MS = 5 * 60 * 1000;
 export function tokenExpiresAt(tokens, now = Date.now()) {
@@ -8,20 +9,6 @@ export function tokenExpiresAt(tokens, now = Date.now()) {
         return undefined;
     return now + tokens.expires_in * 1000;
 }
-/** Compares authorization server identifiers the way the SDK does: parsed, tolerating one trailing `/`. */
-export function sameAuthorizationServer(a, b) {
-    const normalize = (value) => {
-        try {
-            return new URL(value).href.replace(/\/$/, "");
-        }
-        catch (error) {
-            if (error instanceof TypeError)
-                return value.replace(/\/$/, "");
-            throw error;
-        }
-    };
-    return normalize(a) === normalize(b);
-}
 /**
  * The authorization server a stored grant belongs to (senpi#2940, GHSA-6qxp-vccf-f47h): its `issuer` stamp, or
  * for a record saved before the stamp existed, the authorization server its sign-in discovered. A record with
@@ -101,6 +88,14 @@ export class McpOAuthProvider {
     get clientMetadata() {
         const redirect = this.#options.redirectUrl;
         return {
+            ...(redirect === undefined
+                ? {}
+                : {
+                    application_type: !["http:", "https:"].includes(new URL(redirect).protocol) ||
+                        ["127.0.0.1", "localhost", "[::1]"].includes(new URL(redirect).hostname)
+                        ? "native"
+                        : "web",
+                }),
             redirect_uris: redirect === undefined ? [] : [String(redirect)],
             grant_types: ["authorization_code", "refresh_token"],
             response_types: ["code"],
@@ -127,20 +122,56 @@ export class McpOAuthProvider {
         return this.#store.read()?.clientInfo;
     }
     async saveClientInformation(info) {
-        // The SDK stamps `info.issuer`; it is persisted with the rest so the binding survives a restart.
-        await this.#store.update((current) => ({ ...(current ?? {}), clientInfo: info }));
+        const discovery = this.discoveryState();
+        const issuer = discovery === undefined
+            ? info.issuer && canonicalAuthorizationServerIssuer(info.issuer)
+            : validatedAuthorizationServerIssuer(discovery, this.serverName);
+        await this.#store.update((current) => ({ ...(current ?? {}), clientInfo: { ...info, issuer } }));
     }
     async saveDiscoveryState(state) {
-        await this.#store.update((current) => ({ ...freezeGrantAttribution(current), discoveryState: state }));
+        const issuer = validatedAuthorizationServerIssuer(state, this.serverName);
+        const discoveryState = { ...state, authorizationServerUrl: issuer };
+        await this.#store.update((current) => {
+            const attributed = freezeGrantAttribution(current);
+            if (!credentialsMatchIssuer(attributed, issuer))
+                return { discoveryState };
+            const clientIssuer = attributed.clientInfo?.issuer ?? storedGrantIssuer(attributed);
+            return {
+                ...attributed,
+                // Unattributed legacy registrations cannot be sent to the server discovered now.
+                clientInfo: clientIssuer === undefined || attributed.clientInfo === undefined
+                    ? undefined
+                    : { ...attributed.clientInfo, issuer },
+                discoveryState,
+            };
+        });
     }
     discoveryState() {
-        return this.#store.read()?.discoveryState;
+        const current = this.#store.read();
+        const state = current?.discoveryState;
+        if (state !== undefined) {
+            try {
+                const issuer = validatedAuthorizationServerIssuer(state, this.serverName);
+                if (!credentialsMatchIssuer(current, issuer))
+                    return undefined;
+            }
+            catch (error) {
+                if (error instanceof OAuthFlowError)
+                    return undefined;
+                throw error;
+            }
+        }
+        return state;
     }
     tokens() {
         return storedAuthToTokens(this.#store.read());
     }
     async saveTokens(tokens) {
-        await this.#store.update((current) => mergeTokensIntoStoredAuth(current, tokens, this.serverUrl));
+        const discovery = this.discoveryState();
+        const issuer = discovery === undefined
+            ? tokens.issuer && canonicalAuthorizationServerIssuer(tokens.issuer)
+            : validatedAuthorizationServerIssuer(discovery, this.serverName);
+        await this.#store.update((current) => mergeTokensIntoStoredAuth(current, { ...tokens, issuer }, this.serverUrl));
         this.#logFingerprint("saveTokens", tokens.access_token);
     }
     async saveCodeVerifier(codeVerifier) {

package/dist/core/extensions/builtin/mcp/auth/oauth-refresh.js

@@ -2,7 +2,8 @@ import { loadMcpSdkAuth } from "../sdk.lazy.js";
 import { safeDelay } from "../wrap.js";
 import { isInvalidGrant, isTransientTokenError, OAuthFlowError } from "./oauth-errors.js";
 import { oauthFetch } from "./oauth-fetch.js";
-import { mergeTokensIntoStoredAuth, REFRESH_LEEWAY_MS, sameAuthorizationServer, storedAuthToTokens, storedGrantIssuer, } from "./oauth-provider.js";
+import { credentialsMatchIssuer, validatedAuthorizationServerIssuer } from "./oauth-issuer.js";
+import { mergeTokensIntoStoredAuth, REFRESH_LEEWAY_MS, storedAuthToTokens, storedGrantIssuer, } from "./oauth-provider.js";
 export function isTokenStale(record, now) {
     const token = record?.accessToken;
     if (token === undefined || token.length === 0)
@@ -67,8 +68,8 @@ export class McpRefreshManager {
         // elsewhere, or one that cannot be attributed at all, is a continuity break: drop it and require a fresh
         // sign-in rather than refreshing silently against whatever server discovery now names.
         const issuer = storedGrantIssuer(current);
-        const authorizationServer = String(info.authorizationServerUrl);
-        if (issuer === undefined || !sameAuthorizationServer(issuer, authorizationServer)) {
+        const authorizationServer = validatedAuthorizationServerIssuer(info, this.#provider.serverName);
+        if (issuer === undefined || !credentialsMatchIssuer(current, authorizationServer)) {
             this.#provider.store.writeUnlocked(undefined);
             throw new OAuthFlowError("needs_auth", issuer === undefined
                 ? `MCP server ${this.#provider.serverName} has a saved sign-in with no record of the authorization server that issued it; credentials cleared, re-authentication required.`

package/dist/core/extensions/builtin/mcp/auth/oauth.js

@@ -1,6 +1,7 @@
 import { loadMcpSdkAuth } from "../sdk.lazy.js";
 import { isInvalidGrant, OAuthFlowError } from "./oauth-errors.js";
 import { oauthFetch } from "./oauth-fetch.js";
+import { validatedAuthorizationServerIssuer } from "./oauth-issuer.js";
 import { assertS256Supported } from "./oauth-refresh.js";
 // Pre-flight: discover the authorization server and REFUSE (typed) if it does
 // not advertise PKCE S256. Runs before any authorize redirect.
@@ -20,7 +21,7 @@ export async function beginAuthorization(provider, options = {}) {
 }
 // Paste flow: validates single-use state itself, then exchanges the code.
 export async function completeAuthorization(provider, redirectInput, options = {}) {
-    const { code, state, iss } = parseRedirect(redirectInput, provider.serverName);
+    const { code, state, iss } = parseRedirect(redirectInput, provider);
     if (!provider.consumeState(state)) {
         throw new OAuthFlowError("state_mismatch", `MCP server ${provider.serverName} authorization state did not match (possible CSRF or a stale/replayed link); restart with /mcp auth-start.`, { serverName: provider.serverName });
     }
@@ -56,15 +57,19 @@ export async function finishAuthorization(provider, code, options = {}, iss) {
 // RFC 9207: an authorization response that names another authorization server, or that omits `iss`
 // although this server promises to send it, may have been injected by a mix-up attack; never exchange its code.
 function assertAuthorizationResponseIssuer(provider, iss) {
-    const metadata = provider.discoveryState()?.authorizationServerMetadata;
-    if (metadata === undefined)
-        return;
+    const discovery = provider.discoveryState();
+    if (discovery === undefined) {
+        throw new OAuthFlowError("needs_auth", `MCP server ${provider.serverName} has no trusted authorization discovery; restart with /mcp auth-start ${provider.serverName}.`, { serverName: provider.serverName });
+    }
+    const metadata = discovery.authorizationServerMetadata;
+    const issuer = validatedAuthorizationServerIssuer(discovery, provider.serverName);
     // The SDK keeps unknown metadata fields (loose schema) but does not type this RFC 9207 one.
-    const promised = metadata
-        .authorization_response_iss_parameter_supported === true;
+    const promised = metadata !== undefined &&
+        "authorization_response_iss_parameter_supported" in metadata &&
+        metadata.authorization_response_iss_parameter_supported === true;
     if (iss === undefined && !promised)
         return;
-    if (iss !== undefined && iss === metadata.issuer)
+    if (iss !== undefined && iss === issuer)
         return;
     throw new OAuthFlowError("needs_auth", iss === undefined
         ? `MCP server ${provider.serverName} authorization response has no issuer although its authorization server promises one; restart with /mcp auth-start ${provider.serverName}.`
@@ -111,19 +116,19 @@ export async function clientCredentialsGrant(provider, options = {}) {
         resource: new URL(provider.serverUrl),
         fetchFn: oauthFetch(options.fetchFn),
     });
-    await provider.saveTokens({ ...tokens, issuer: String(info.authorizationServerUrl) });
+    await provider.saveTokens({ ...tokens, issuer: validatedAuthorizationServerIssuer(info, provider.serverName) });
 }
 export async function logout(provider) {
     await provider.store.clear();
 }
 async function discover(provider, options) {
-    if (options.discover !== undefined)
-        return options.discover(provider.serverUrl);
     const cached = provider.discoveryState();
     if (cached !== undefined)
         return cached;
     const { discoverOAuthServerInfo } = await loadMcpSdkAuth();
-    const info = await discoverOAuthServerInfo(provider.serverUrl, { fetchFn: oauthFetch(options.fetchFn) });
+    const info = options.discover !== undefined
+        ? await options.discover(provider.serverUrl)
+        : await discoverOAuthServerInfo(provider.serverUrl, { fetchFn: oauthFetch(options.fetchFn) });
     await provider.saveDiscoveryState(toDiscoveryState(info));
     return info;
 }
@@ -134,7 +139,8 @@ function toDiscoveryState(info) {
         resourceMetadata: info.resourceMetadata,
     };
 }
-function parseRedirect(input, serverName) {
+function parseRedirect(input, provider) {
+    const serverName = provider.serverName;
     let url;
     try {
         url = new URL(input.trim());
@@ -142,6 +148,7 @@ function parseRedirect(input, serverName) {
     catch {
         throw new OAuthFlowError("needs_auth", `MCP server ${serverName} received a malformed redirect URL; paste the full http://127.0.0.1/... address from your browser.`, { serverName });
     }
+    assertAuthorizationResponseIssuer(provider, url.searchParams.get("iss") ?? undefined);
     const error = url.searchParams.get("error");
     if (error !== null) {
         throw new OAuthFlowError("needs_auth", `MCP server ${serverName} authorization failed: ${error}`, { serverName });

package/dist/core/extensions/builtin/mcp/modern/consent-queue.js

@@ -47,6 +47,7 @@ export function queuedForm(binding, signal, run) {
                 current.jobs.splice(index, 1);
                 signal.removeEventListener("abort", job.abort);
                 reject(new McpMrtrError("MCP_MRTR_PROCESSING_UNAVAILABLE"));
+                pump();
             }
         };
         current.jobs.push(job);

package/dist/core/extensions/builtin/mcp/modern/dispatch.js

@@ -39,6 +39,7 @@ export async function materializeNegotiatedTransport(options, serverName, timeou
                 clientInfo,
                 clientCapabilities: {},
                 protocolVersion: outcome.version,
+                logger,
             }), outcome.discovery, outcome.version);
             const version = outcome.version;
             logVersion(transport, () => version);

package/dist/core/extensions/builtin/mcp/modern/parameter-headers.d.ts

@@ -2,10 +2,13 @@
 export declare function encodeMcpHeaderValue(value: string): string;
 /** Configured headers must never supply parameter metadata absent from the request body. */
 export declare function clearMcpParameterHeaders(headers: Headers): void;
+/** A local argument error, not a failed transport or an untrusted server diagnostic. */
+export declare class ParameterHeaderValidationError extends Error {
+}
 /** Connection-local catalog: never shared with another server or transport generation. */
 export declare class ModernParameterHeaders {
     #private;
-    filterTools(tools: readonly unknown[], firstPage: boolean): unknown[];
+    filterTools(tools: readonly unknown[], firstPage: boolean, warn: (message: string) => void): unknown[];
     append(headers: Headers, name: unknown, args: unknown): void;
 }
 //# sourceMappingURL=parameter-headers.d.ts.map

package/dist/core/extensions/builtin/mcp/modern/parameter-headers.js

@@ -18,22 +18,31 @@ export function clearMcpParameterHeaders(headers) {
 function parseParameterHeaders(schema) {
     const headers = [];
     const names = new Set();
+    let reason = "";
     const visit = (node, path) => {
+        if (Array.isArray(node))
+            return node.every((child) => visit(child, undefined));
         if (!isRecord(node))
             return true;
         if (Object.hasOwn(node, "x-mcp-header")) {
             const name = node["x-mcp-header"];
             const type = node.type;
-            if (!path?.length ||
-                typeof name !== "string" ||
-                !/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(name) ||
-                names.has(name.toLowerCase()) ||
-                (type !== "string" && type !== "integer" && type !== "boolean"))
+            if (!path?.length)
+                reason = "x-mcp-header must be on a properties-only path";
+            else if (typeof name !== "string" || !/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(name))
+                reason = "x-mcp-header must be a nonempty HTTP field-name token";
+            else if (names.has(name.toLowerCase()))
+                reason = "x-mcp-header names must be case-insensitively unique";
+            else if (type !== "string" && type !== "integer" && type !== "boolean")
+                reason = "x-mcp-header type must be string, integer, or boolean";
+            else {
+                names.add(name.toLowerCase());
+                headers.push({ name, path, type });
+            }
+            if (reason)
                 return false;
-            names.add(name.toLowerCase());
-            headers.push({ name, path, type });
         }
-        // Only schema-valued keywords are traversed: examples/default/const are instance data.
+        // "Anywhere else" includes unknown keywords; instance-data keywords are not schemas.
         for (const [keyword, value] of Object.entries(node)) {
             if (["properties", "patternProperties", "$defs", "definitions", "dependentSchemas", "dependencies"].includes(keyword)) {
                 if (!isRecord(value))
@@ -44,46 +53,31 @@ function parseParameterHeaders(schema) {
                         return false;
                 }
             }
-            else if ([
-                "items",
-                "prefixItems",
-                "allOf",
-                "anyOf",
-                "oneOf",
-                "additionalItems",
-                "additionalProperties",
-                "unevaluatedItems",
-                "unevaluatedProperties",
-                "contains",
-                "propertyNames",
-                "not",
-                "if",
-                "then",
-                "else",
-                "contentSchema",
-            ].includes(keyword)) {
-                for (const child of Array.isArray(value) ? value : [value]) {
-                    if (!visit(child, undefined))
-                        return false;
-                }
+            else if (!["examples", "default", "const", "enum"].includes(keyword)) {
+                if (!visit(value, undefined))
+                    return false;
             }
         }
         return true;
     };
-    return visit(schema, []) ? headers : undefined;
+    return visit(schema, []) ? headers : reason;
+}
+/** A local argument error, not a failed transport or an untrusted server diagnostic. */
+export class ParameterHeaderValidationError extends Error {
 }
 /** Connection-local catalog: never shared with another server or transport generation. */
 export class ModernParameterHeaders {
     #tools = new Map();
-    filterTools(tools, firstPage) {
+    filterTools(tools, firstPage, warn) {
         if (firstPage)
             this.#tools.clear();
         return tools.filter((tool) => {
             if (!isRecord(tool) || typeof tool.name !== "string")
                 return true;
             const headers = parseParameterHeaders(tool.inputSchema);
-            if (headers === undefined) {
+            if (typeof headers === "string") {
                 this.#tools.delete(tool.name);
+                warn(`Rejected MCP tool ${JSON.stringify(tool.name)}: ${headers}`);
                 return false;
             }
             this.#tools.set(tool.name, headers);
@@ -98,11 +92,15 @@ export class ModernParameterHeaders {
             for (const key of parameter.path) {
                 value = isRecord(value) && Object.hasOwn(value, key) ? value[key] : undefined;
             }
+            if (value === undefined)
+                continue;
             const valid = (parameter.type === "string" && typeof value === "string") ||
                 (parameter.type === "boolean" && typeof value === "boolean") ||
                 (parameter.type === "integer" && typeof value === "number" && Number.isSafeInteger(value));
-            if (valid)
-                headers.set(`Mcp-Param-${parameter.name}`, encodeMcpHeaderValue(String(value)));
+            if (!valid) {
+                throw new ParameterHeaderValidationError(`MCP tool ${JSON.stringify(name)} argument ${JSON.stringify(parameter.path)} must be ${parameter.type === "integer" ? "a safe integer" : `a ${parameter.type}`}`);
+            }
+            headers.set(`Mcp-Param-${parameter.name}`, encodeMcpHeaderValue(String(value)));
         }
     }
 }

package/dist/core/extensions/builtin/mcp/modern/request.js

@@ -1,12 +1,13 @@
 import { beginLegacyMcpOperation, physicalMcpClient, takeMcpRequestOrigin, } from "../request-origin.js";
 import { AuthError } from "../errors.js";
-import { loadMcpSdkTypes, loadMcpSdkZodCompat } from "../sdk.lazy.js";
+import { loadMcpSdkProtocol, loadMcpSdkTypes, loadMcpSdkZodCompat } from "../sdk.lazy.js";
 import { mcpElapsedClock } from "../wrap.js";
 import { collectMrtrForm } from "./elicitation.js";
 import { isRecord, validateMrtrForm } from "./form-schema.js";
 import { McpMrtrError } from "./errors.js";
 import { queuedForm } from "./consent-queue.js";
 import { parseInputs } from "./inputs.js";
+import { ParameterHeaderValidationError } from "./parameter-headers.js";
 export const MAX_MCP_MRTR_ROUNDS = 8;
 const capableMethods = new Set(["tools/call", "resources/read", "prompts/get"]);
 const capabilitiesKey = "io.modelcontextprotocol/clientCapabilities";
@@ -44,8 +45,9 @@ export function installModernRequestAdapter(client, protocol, clock = mcpElapsed
         if (own(request.params ?? {}, "requestState") || own(request.params ?? {}, "inputResponses") || options?.task)
             throw new McpMrtrError("MCP_MRTR_INVALID_INPUT");
         const params = structuredClone(request.params ?? {});
+        const { DEFAULT_REQUEST_TIMEOUT_MSEC } = await loadMcpSdkProtocol();
         const start = clock.now();
-        const timeout = sdkOptions.timeout ?? 60_000;
+        const timeout = sdkOptions.timeout ?? DEFAULT_REQUEST_TIMEOUT_MSEC;
         const duration = Math.min(sdkOptions.maxTotalTimeout ?? Infinity, 9 * timeout + 300_000);
         const deadline = start + duration;
         const operation = new AbortController();
@@ -259,6 +261,8 @@ export function installModernRequestAdapter(client, protocol, clock = mcpElapsed
                 throw error;
             if (error instanceof AuthError)
                 throw error;
+            if (error instanceof ParameterHeaderValidationError)
+                throw error;
             const remoteCode = isRecord(error) && typeof error.code === "number" ? error.code : undefined;
             throw new McpMrtrError("MCP_MRTR_TRANSPORT_FAILED", remoteCode);
         }