@desplega.ai/agent-swarm 1.161.0 → 1.162.0

package/dist/{cli-we0q7t0e.js → cli-2zy95vhm.js}

@@ -1,59 +1,38 @@
 import {
-  PermissionVerbSchema
-} from "./cli-tsk3nz8a.js";
-import {
-  seedPricingFromModelsDev
-} from "./cli-ecfxwnyb.js";
+  PermissionVerbSchema,
+  init_rbac
+} from "./cli-kdkwd3yr.js";
 import {
   getDb,
   getDbClient,
   init_db
-} from "./cli-1cz0c18q.js";
+} from "./cli-jf7wmv1r.js";
 import {
-  init_env_flag
+  init_env_flag,
+  isEnvFlagEnabled
 } from "./cli-ej6gbxfb.js";
-
-// src/be/boot-seeds.ts
-init_db();
+import {
+  __esm
+} from "./cli-bc05qbss.js";
 
 // src/be/rbac-roles.ts
-init_env_flag();
-init_db();
-var DEFAULT_ROLE_ID = "rbac-role-admin";
-var BUILTIN_ROLES = [
-  {
-    id: DEFAULT_ROLE_ID,
-    name: "admin",
-    description: "Full access including verb-less routes (legacy-equivalent default).",
-    isBuiltin: true,
-    grantsAll: true,
-    verbs: []
-  },
-  {
-    id: "rbac-role-requester",
-    name: "requester",
-    description: "Own-task lifecycle: what legacy policy grants user principals.",
-    isBuiltin: true,
-    grantsAll: false,
-    verbs: [
-      "task.create.own",
-      "task.read.own",
-      "task.cancel.own",
-      "task.action.own",
-      "task.fs.mutate",
-      "favorite.write.own"
-    ]
+function roleRowToUserRole(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    description: row.description,
+    isBuiltin: row.isBuiltin === 1,
+    grantsAll: row.grantsAll === 1,
+    createdAt: row.createdAt
+  };
+}
+async function requireRoleId(roleName) {
+  const row = await getDbClient().get("SELECT id FROM roles WHERE name = ?", [roleName]);
+  if (!row) {
+    throw new Error(`Unknown RBAC role: ${roleName}`);
   }
-];
-var CREATE_USER_DEFAULT_ROLE_TRIGGER_SQL = `
-CREATE TRIGGER IF NOT EXISTS trg_users_default_role
-AFTER INSERT ON users
-BEGIN
-  INSERT OR IGNORE INTO principal_roles (principalType, principalId, roleId)
-  SELECT 'user', NEW.id, 'rbac-role-admin'
-  WHERE EXISTS (SELECT 1 FROM roles WHERE id = 'rbac-role-admin');
-END;
-`;
+  return row.id;
+}
 function validateBuiltinVerb(roleName, verb) {
   const parsed = PermissionVerbSchema.safeParse(verb);
   if (!parsed.success) {
@@ -72,7 +51,6 @@ function validatedBuiltinVerbSets() {
   }
   return byRoleId;
 }
-var loggedInvalidGrantVerbs = new Set;
 function parseDatabaseGrantVerb(roleId, verb) {
   const parsed = PermissionVerbSchema.safeParse(verb);
   if (parsed.success) {
@@ -109,6 +87,28 @@ async function getUserGrant(userId) {
   }
   return { grantsAll: false, verbs };
 }
+async function attachRole(userId, roleName) {
+  await getDbClient().transaction(async (tx) => {
+    const roleId = await requireRoleId(roleName);
+    await tx.run(`INSERT OR IGNORE INTO principal_roles (principalType, principalId, roleId)
+       VALUES ('user', ?, ?)`, [userId, roleId]);
+  });
+}
+async function detachRole(userId, roleName) {
+  await getDbClient().transaction(async (tx) => {
+    const roleId = await requireRoleId(roleName);
+    await tx.run(`DELETE FROM principal_roles
+       WHERE principalType = 'user' AND principalId = ? AND roleId = ?`, [userId, roleId]);
+  });
+}
+async function listUserRoles(userId) {
+  const rows = await getDbClient().query(`SELECT r.id, r.name, r.description, r.isBuiltin, r.grantsAll, r.createdAt
+     FROM principal_roles pr
+     JOIN roles r ON r.id = pr.roleId
+     WHERE pr.principalType = 'user' AND pr.principalId = ?
+     ORDER BY r.name`, [userId]);
+  return rows.map(roleRowToUserRole);
+}
 function ensureRbacSeedsSynced(opts) {
   const db = getDb();
   const desiredVerbsByRoleId = validatedBuiltinVerbSets();
@@ -185,23 +185,96 @@ function ensureRbacSeedsSynced(opts) {
   }
   return stats;
 }
-
-// src/be/boot-seeds.ts
-var pricingSeededDbs = new WeakSet;
-var rbacSyncedDbs = new WeakSet;
-function ensurePricingSeeded() {
-  const db = getDb();
-  if (pricingSeededDbs.has(db))
-    return;
-  seedPricingFromModelsDev();
-  pricingSeededDbs.add(db);
+function describeRbacFlag() {
+  const raw = process.env.RBAC_ENABLED;
+  if (raw === undefined)
+    return "unset (on)";
+  return `${raw} (${isEnvFlagEnabled("RBAC_ENABLED", true) ? "on" : "off"})`;
 }
-function ensureRbacSeeded() {
-  const db = getDb();
-  if (rbacSyncedDbs.has(db))
-    return;
-  ensureRbacSeedsSynced();
-  rbacSyncedDbs.add(db);
+function printRolesTable(rows) {
+  const tableRows = rows.map((row) => [
+    row.name,
+    row.isBuiltin === 1 ? "yes" : "no",
+    row.grantsAll === 1 ? "yes" : "no",
+    String(row.verbCount),
+    String(row.attachedUserCount)
+  ]);
+  const headers = ["name", "builtin", "grantsAll", "verbs", "attachedUsers"];
+  const widths = headers.map((header, column) => Math.max(header.length, ...tableRows.map((row) => row[column]?.length ?? 0)));
+  const format = (row) => row.map((cell, column) => cell.padEnd(widths[column] ?? cell.length)).join("  ");
+  console.log("Roles:");
+  console.log(format(headers));
+  console.log(format(widths.map((width) => "-".repeat(width))));
+  for (const row of tableRows) {
+    console.log(format(row));
+  }
+}
+async function getRbacRoleSummary() {
+  return getDbClient().query(`SELECT
+       r.name,
+       r.isBuiltin,
+       r.grantsAll,
+       COUNT(DISTINCT rp.verb) AS verbCount,
+       COUNT(DISTINCT CASE WHEN pr.principalType = 'user' THEN pr.principalId END)
+         AS attachedUserCount
+     FROM roles r
+     LEFT JOIN role_permissions rp ON rp.roleId = r.id
+     LEFT JOIN principal_roles pr ON pr.roleId = r.id
+     GROUP BY r.id, r.name, r.isBuiltin, r.grantsAll
+     ORDER BY r.isBuiltin DESC, r.name`);
+}
+async function runRbacCliCommand(args) {
+  const subcommand = args[0];
+  if (args.length !== 1 || subcommand !== "bootstrap") {
+    throw new Error(`Unknown RBAC command: ${args.join(" ") || "(none)"}`);
+  }
+  const stats = ensureRbacSeedsSynced({ quiet: true });
+  const roles = await getRbacRoleSummary();
+  console.log("RBAC bootstrap complete");
+  console.log(`RBAC_ENABLED: ${describeRbacFlag()}`);
+  console.log(`Users backfilled this run: ${stats.usersBackfilled}`);
+  console.log("");
+  printRolesTable(roles);
 }
+var DEFAULT_ROLE_ID = "rbac-role-admin", BUILTIN_ROLES, CREATE_USER_DEFAULT_ROLE_TRIGGER_SQL = `
+CREATE TRIGGER IF NOT EXISTS trg_users_default_role
+AFTER INSERT ON users
+BEGIN
+  INSERT OR IGNORE INTO principal_roles (principalType, principalId, roleId)
+  SELECT 'user', NEW.id, 'rbac-role-admin'
+  WHERE EXISTS (SELECT 1 FROM roles WHERE id = 'rbac-role-admin');
+END;
+`, loggedInvalidGrantVerbs;
+var init_rbac_roles = __esm(() => {
+  init_rbac();
+  init_env_flag();
+  init_db();
+  BUILTIN_ROLES = [
+    {
+      id: DEFAULT_ROLE_ID,
+      name: "admin",
+      description: "Full access including verb-less routes (legacy-equivalent default).",
+      isBuiltin: true,
+      grantsAll: true,
+      verbs: []
+    },
+    {
+      id: "rbac-role-requester",
+      name: "requester",
+      description: "Own-task lifecycle: what legacy policy grants user principals.",
+      isBuiltin: true,
+      grantsAll: false,
+      verbs: [
+        "task.create.own",
+        "task.read.own",
+        "task.cancel.own",
+        "task.action.own",
+        "task.fs.mutate",
+        "favorite.write.own"
+      ]
+    }
+  ];
+  loggedInvalidGrantVerbs = new Set;
+});
 
-export { getUserGrant, ensurePricingSeeded, ensureRbacSeeded };
+export { DEFAULT_ROLE_ID, BUILTIN_ROLES, getUserGrant, attachRole, detachRole, listUserRoles, ensureRbacSeedsSynced, runRbacCliCommand, init_rbac_roles };

package/dist/{cli-35pj2yva.js → cli-4cwxn7gp.js}

@@ -2,13 +2,13 @@ import {
   mcpNamespace,
   require_proper_lockfile,
   validateMcpServerConfig
-} from "./cli-bh7jed3k.js";
+} from "./cli-8ev9xqnx.js";
 import {
   CONFIG_DIR_NAME,
   canonicalizePath,
   resolvePath,
   stripBom
-} from "./cli-vnnz5ncg.js";
+} from "./cli-s3hwpt9v.js";
 import {
   __toESM
 } from "./cli-bc05qbss.js";
@@ -212,6 +212,10 @@ function openBrowser(target) {
 // node_modules/@earendil-works/pi-coding-agent/dist/extensions/mcp/config.js
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname2, join as join2 } from "node:path";
+var OVERRIDE_KEYS = ["enabled", "exposure", "toolExposure"];
+function isOverride(value) {
+  return value.command === undefined && value.url === undefined && value.type === undefined;
+}
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -235,6 +239,22 @@ function readConfigFile(path, scope, state) {
   else if (parsed.autoEnableCodemode !== undefined)
     errors.push(`${path}: autoEnableCodemode must be a boolean`);
   for (const [name, value] of Object.entries(parsed.mcpServers ?? {})) {
+    if (scope === "project" && isRecord(value) && isOverride(value)) {
+      const base = servers.get(name);
+      const extra = Object.keys(value).filter((key) => !OVERRIDE_KEYS.includes(key));
+      if (!base) {
+        errors.push(`${path}: server "${name}" needs "command" or "url", or a global server to override`);
+      } else if (extra.length > 0) {
+        errors.push(`${path}: server "${name}": an override can only set ${OVERRIDE_KEYS.join(", ")}`);
+      } else {
+        const config2 = validateMcpServerConfig(name, { ...base.config, ...value });
+        if (typeof config2 === "string")
+          errors.push(`${path}: ${config2}`);
+        else
+          servers.set(name, { ...base, config: config2, override: path });
+      }
+      continue;
+    }
     const config = validateMcpServerConfig(name, value);
     if (typeof config === "string") {
       errors.push(`${path}: ${config}`);
@@ -255,27 +275,34 @@ function readConfigFile(path, scope, state) {
 function loadMcpConfig(options) {
   const state = { servers: new Map, errors: [] };
   readConfigFile(join2(options.agentDir, "mcp.json"), "global", state);
-  if (options.projectTrusted)
-    readConfigFile(join2(options.cwd, CONFIG_DIR_NAME, "mcp.json"), "project", state);
+  const projectConfig = options.projectTrusted ? join2(options.cwd, CONFIG_DIR_NAME, "mcp.json") : undefined;
+  if (projectConfig)
+    readConfigFile(projectConfig, "project", state);
   return {
     servers: [...state.servers.values()],
     ...state.autoEnableCodemode === undefined ? {} : { autoEnableCodemode: state.autoEnableCodemode },
-    errors: state.errors
+    errors: state.errors,
+    ...projectConfig ? { projectConfig } : {}
   };
 }
-function updateMcpServerConfig(path, name, patch) {
-  editMcpServers(path, (servers) => {
-    const server = servers?.[name];
+function updateMcpServerConfig(path, name, patch, options = {}) {
+  editMcpServers(path, (servers, parsed) => {
+    let server = servers?.[name];
+    if (server === undefined && options.override) {
+      server = {};
+      parsed.mcpServers = { ...servers, [name]: server };
+    }
     if (!isRecord(server))
       throw new Error(`${path} does not define MCP server "${name}"`);
+    const keepDefaults = isOverride(server);
     if (patch.enabled !== undefined) {
-      if (patch.enabled)
+      if (patch.enabled && !keepDefaults)
         delete server.enabled;
       else
-        server.enabled = false;
+        server.enabled = patch.enabled;
     }
     if (patch.exposure !== undefined) {
-      if (patch.exposure === "codemode")
+      if (patch.exposure === "codemode" && !keepDefaults)
         delete server.exposure;
       else
         server.exposure = patch.exposure;

package/dist/{cli-ad4qxm6j.js → cli-4dcpaefp.js}

@@ -6,7 +6,7 @@ import {
 import {
   parseModelStr,
   resolveCredential
-} from "./cli-sqm3r5ps.js";
+} from "./cli-5bcd7sfy.js";
 import {
   DEFAULT_OPENROUTER_BASE_URL,
   getOpenRouterBaseUrl
@@ -14,7 +14,7 @@ import {
 import {
   complete,
   getBuiltinModel
-} from "./cli-ee8bc46j.js";
+} from "./cli-nt8hecg9.js";
 import {
   exports_typebox
 } from "./cli-rb9m6rpe.js";

package/dist/{cli-82c1pacn.js → cli-4x0csdjq.js}

@@ -15,12 +15,12 @@ import {
   require_proper_lockfile,
   resolveConfigValueOrThrow,
   resolveHeadersOrThrow
-} from "./cli-bh7jed3k.js";
+} from "./cli-8ev9xqnx.js";
 import {
   APP_NAME,
   VERSION,
   getAgentDir
-} from "./cli-vnnz5ncg.js";
+} from "./cli-s3hwpt9v.js";
 import {
   oauthErrorHtml,
   oauthSuccessHtml
@@ -47,14 +47,14 @@ ${page.details}` : page.message;
 class OAuthCallbackServer {
   redirectUrl;
   server;
-  path;
+  paths;
   timeoutMs;
   renderPage;
   pending = new Map;
-  constructor(server, redirectUrl, path, timeoutMs, renderPage) {
+  constructor(server, redirectUrl, paths, timeoutMs, renderPage) {
     this.server = server;
     this.redirectUrl = redirectUrl;
-    this.path = path;
+    this.paths = paths;
     this.timeoutMs = timeoutMs;
     this.renderPage = renderPage;
   }
@@ -74,10 +74,10 @@ class OAuthCallbackServer {
     const address = server.address();
     if (!address || typeof address === "string")
       throw new Error("OAuth callback server did not bind to TCP");
-    instance = new OAuthCallbackServer(server, `http://${redirectHost.includes(":") ? `[${redirectHost}]` : redirectHost}:${address.port}${path}`, path, options.timeoutMs ?? 5 * 60000, options.renderPage);
+    instance = new OAuthCallbackServer(server, `http://${redirectHost.includes(":") ? `[${redirectHost}]` : redirectHost}:${address.port}${path}`, [path, ...options.extraPaths ?? []], options.timeoutMs ?? 5 * 60000, options.renderPage);
     return instance;
   }
-  waitForCallback(state) {
+  waitForCallback(state, path) {
     if (this.pending.has(state))
       throw new Error("OAuth state is already pending");
     return new Promise((resolve, reject) => {
@@ -85,7 +85,7 @@ class OAuthCallbackServer {
         this.pending.delete(state);
         reject(new Error("OAuth callback timed out"));
       }, this.timeoutMs);
-      this.pending.set(state, { resolve, reject, timer });
+      this.pending.set(state, { resolve, reject, timer, path });
     });
   }
   async close() {
@@ -108,7 +108,7 @@ class OAuthCallbackServer {
   }
   handle(rawUrl, response) {
     const url = new URL(rawUrl, this.redirectUrl);
-    if (url.pathname !== this.path) {
+    if (!this.paths.includes(url.pathname)) {
       this.reply(response, 404, { ok: false, message: "Not found" });
       return;
     }
@@ -120,6 +120,11 @@ class OAuthCallbackServer {
     }
     clearTimeout(pending.timer);
     this.pending.delete(state);
+    if (pending.path !== undefined && url.pathname !== pending.path) {
+      pending.reject(new Error("The authorization response arrived on another redirect URI"));
+      this.reply(response, 400, { ok: false, message: "Unexpected redirect URI" });
+      return;
+    }
     const error = url.searchParams.get("error");
     if (error) {
       const description = url.searchParams.get("error_description") ?? error;
@@ -574,28 +579,28 @@ async function runFlow(provider, options) {
   const metadata = discovered.authorizationServerMetadata;
   const resource = selectResource(options.serverUrl, discovered.resourceMetadata);
   const scope = options.scope || discovered.resourceMetadata?.scopes_supported?.join(" ") || provider.clientMetadata.scope;
-  let client = await provider.clientInformation();
+  const stored = await provider.clientInformation();
+  const clientDocument = stored ? undefined : provider.clientMetadataDocument?.(metadata);
+  if (clientDocument) {
+    const url = new URL(clientDocument.url);
+    if (url.protocol !== "https:" || url.pathname === "/")
+      throw new Error("Invalid OAuth client metadata URL");
+  }
+  let client = stored ?? (clientDocument && { client_id: clientDocument.url });
   if (!client) {
     if (options.authorizationCode)
       throw new Error("OAuth client information is missing during code exchange");
-    if (metadata?.client_id_metadata_document_supported && provider.clientMetadataUrl) {
-      const url = new URL(provider.clientMetadataUrl);
-      if (url.protocol !== "https:" || url.pathname === "/")
-        throw new Error("Invalid OAuth client metadata URL");
-      client = { client_id: provider.clientMetadataUrl };
-      await provider.saveClientInformation?.(client);
-    } else {
-      if (!provider.saveClientInformation)
-        throw new Error("OAuth client information cannot be persisted");
-      client = await registerClient(discovered.authorizationServerUrl, {
-        metadata,
-        clientMetadata: provider.clientMetadata,
-        scope,
-        fetch: options.fetch
-      });
-      await provider.saveClientInformation(client);
-    }
+    if (!provider.saveClientInformation)
+      throw new Error("OAuth client information cannot be persisted");
+    client = await registerClient(discovered.authorizationServerUrl, {
+      metadata,
+      clientMetadata: provider.clientMetadata,
+      scope,
+      fetch: options.fetch
+    });
+    await provider.saveClientInformation(client);
   }
+  const redirectUrl = clientDocument?.redirectUrl ?? provider.redirectUrl;
   const tokenOptions = {
     metadata,
     clientInformation: client,
@@ -613,7 +618,7 @@ async function runFlow(provider, options) {
       ...tokenOptions,
       code: options.authorizationCode,
       codeVerifier: await provider.codeVerifier(),
-      redirectUrl: provider.redirectUrl
+      redirectUrl
     });
     await provider.saveTokens(withScope(tokens, scope));
     return "AUTHORIZED";
@@ -638,7 +643,7 @@ async function runFlow(provider, options) {
   const authorization = await startAuthorization(discovered.authorizationServerUrl, {
     metadata,
     clientInformation: client,
-    redirectUrl: provider.redirectUrl,
+    redirectUrl,
     scope,
     state,
     resource
@@ -676,6 +681,7 @@ class MemoryOAuthStateStore {
 class McpOAuthProvider {
   redirectUrl;
   clientMetadata;
+  clientMetadataDocument;
   serverUrl;
   configuredClient;
   store;
@@ -691,6 +697,7 @@ class McpOAuthProvider {
       response_types: options.clientMetadata.response_types ?? ["code"],
       token_endpoint_auth_method: options.clientMetadata.token_endpoint_auth_method ?? (options.clientSecret ? "client_secret_post" : "none")
     };
+    this.clientMetadataDocument = options.clientMetadataDocument;
     this.configuredClient = options.clientId ? { client_id: options.clientId, ...options.clientSecret ? { client_secret: options.clientSecret } : {} } : undefined;
     this.store = options.store ?? new MemoryOAuthStateStore;
     this.onRedirect = options.onRedirect;
@@ -782,6 +789,7 @@ import { join } from "node:path";
 var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
 var CALLBACK_HOST = "127.0.0.1";
 var CALLBACK_PATH = "/callback";
+var CLIENT_METADATA_BASE_URL = "https://pi.dev/oauth";
 var FALLBACK_REDIRECT_URL = `http://${CALLBACK_HOST}${CALLBACK_PATH}`;
 var REFRESH_SKEW_MS = 30000;
 var REFRESH_REQUEST_TIMEOUT_MS = 15000;
@@ -901,11 +909,29 @@ class McpOAuthCredentialStore {
 function registeredRedirectUrls(client) {
   return client && "redirect_uris" in client ? client.redirect_uris : [];
 }
+function callbackId(serverUrl) {
+  const url = new URL(serverUrl);
+  url.hash = "";
+  return createHash("sha256").update(url.href).digest().subarray(0, 9).toString("base64url");
+}
+function clientMetadataDocument(serverUrl, redirectUrl, metadata) {
+  if (!metadata?.client_id_metadata_document_supported || !metadata.token_endpoint_auth_methods_supported?.includes("none")) {
+    throw new Error('The authorization server does not support Client ID Metadata Documents for public clients; remove oauth.clientRegistration "cimd"');
+  }
+  if (metadata.authorization_response_iss_parameter_supported) {
+    return { url: `${CLIENT_METADATA_BASE_URL}/client.json`, redirectUrl };
+  }
+  const id = callbackId(serverUrl);
+  const redirect = new URL(redirectUrl);
+  redirect.pathname = `${CALLBACK_PATH}/${id}`;
+  return { url: `${CLIENT_METADATA_BASE_URL}/${id}/client.json`, redirectUrl: redirect.href };
+}
 function createProvider(serverUrl, store, settings, redirectUrl, onRedirect) {
   return new McpOAuthProvider({
     serverUrl,
     redirectUrl,
     clientMetadata: { client_name: settings.clientName ?? APP_NAME },
+    clientMetadataDocument: settings.clientRegistration === "cimd" ? (metadata) => clientMetadataDocument(serverUrl, redirectUrl, metadata) : undefined,
     clientId: settings.clientId,
     clientSecret: settings.clientSecret,
     store,
@@ -975,13 +1001,16 @@ class McpSignInCancelledError extends Error {
     this.name = "McpSignInCancelledError";
   }
 }
-function responseFromRedirectUrl(input, state) {
+function responseFromRedirectUrl(input, state, redirectUrl) {
   let url;
   try {
     url = new URL(input.trim());
   } catch {
     throw new Error("Expected the full redirect URL from the browser address bar");
   }
+  if (url.origin !== redirectUrl.origin || url.pathname !== redirectUrl.pathname) {
+    throw new Error("The redirect URL does not match this sign-in's redirect URI");
+  }
   const error = url.searchParams.get("error");
   if (error)
     throw new Error(url.searchParams.get("error_description") ?? error);
@@ -992,13 +1021,13 @@ function responseFromRedirectUrl(input, state) {
     throw new Error("The redirect URL does not contain an authorization code");
   return { code, iss: url.searchParams.get("iss") ?? undefined };
 }
-async function waitForAuthorizationResponse(callback, state, prompt) {
+async function waitForAuthorizationResponse(callback, state, redirectUrl, prompt) {
   const controller = new AbortController;
-  const fromBrowser = callback.waitForCallback(state);
+  const fromBrowser = callback.waitForCallback(state, redirectUrl.pathname);
   const fromUser = prompt.promptForRedirectUrl(controller.signal).then((input) => {
     if (!input?.trim())
       throw new McpSignInCancelledError;
-    return responseFromRedirectUrl(input, state);
+    return responseFromRedirectUrl(input, state, redirectUrl);
   });
   try {
     return await Promise.race([fromBrowser, fromUser]);
@@ -1012,11 +1041,12 @@ async function waitForAuthorizationResponse(callback, state, prompt) {
     });
   }
 }
-async function listenForCallback(settings, port, required) {
+async function listenForCallback(settings, extraPaths, port, required) {
   const options = {
     host: settings.host,
     redirectHost: settings.redirectHost,
     path: settings.path,
+    extraPaths,
     renderPage: (page) => page.ok ? oauthSuccessHtml("Signed in to the MCP server. You may now close this page.") : oauthErrorHtml(page.message, page.details)
   };
   try {
@@ -1034,13 +1064,15 @@ async function signInMcpServer(options) {
   const callbackOptions = callbackSettings(settings);
   const registered = registeredRedirectUrls(stored?.clientInformation)[0];
   const preferredPort = callbackOptions.port ?? (registered ? Number(new URL(registered).port) || undefined : undefined);
-  const callback = await listenForCallback(callbackOptions, preferredPort, callbackOptions.port !== undefined);
+  const cimd = settings.clientRegistration === "cimd";
+  const callback = await listenForCallback(callbackOptions, cimd ? [`${CALLBACK_PATH}/${callbackId(serverUrl)}`] : [], preferredPort, callbackOptions.port !== undefined);
   const redirectUrl = callbackOptions.fixedRedirectUrl ?? callback.redirectUrl;
   try {
     if (stored) {
       const next = { ...stored };
       delete next.oauthState;
-      if (!settings.clientId && !registeredRedirectUrls(stored.clientInformation).includes(redirectUrl)) {
+      const keepClient = settings.clientId || (cimd ? !stored.clientInformation : registeredRedirectUrls(stored.clientInformation).includes(redirectUrl));
+      if (!keepClient) {
         delete next.clientInformation;
         delete next.tokens;
         delete next.tokensExpireAt;
@@ -1063,8 +1095,9 @@ async function signInMcpServer(options) {
     if (!authorizationUrl)
       throw new Error("OAuth flow did not produce an authorization URL");
     const state = await provider.state();
+    const authorizationRedirectUrl = new URL(authorizationUrl.searchParams.get("redirect_uri") ?? redirectUrl);
     options.prompt.showAuthorizationUrl(authorizationUrl);
-    const { code, iss } = await waitForAuthorizationResponse(callback, state, options.prompt);
+    const { code, iss } = await waitForAuthorizationResponse(callback, state, authorizationRedirectUrl, options.prompt);
     await authorizeMcp(provider, { ...flow, authorizationCode: code, iss });
   } finally {
     await callback.close();
@@ -1261,6 +1294,7 @@ class McpServerConnection {
       callbackUrl: oauth.callbackUrl,
       scope: oauth.scope,
       clientName: oauth.clientName,
+      clientRegistration: oauth.clientRegistration,
       authServerMetadataUrl: oauth.authServerMetadataUrl ? new URL(oauth.authServerMetadataUrl) : undefined
     };
   }