@duckmind/dm-darwin-x64 0.66.5 → 0.66.7

package/extensions/dm-mcp-adapter/init.js

@@ -1,14 +1,14 @@
 import { formatToolName, isServerDisabled, resolveToolPrefix } from "./types.js";
-import { existsSync } from "node:fs";
 import { cloneMcpConfig, loadMcpConfig, resolveConfiguredClaudePluginMcp } from "./config.js";
+import { applyProjectServerTrustToConfig, describeProjectServerBlock, excludeProjectServersAtLoadTime } from "./project-server-trust.js";
 import { ConsentManager } from "./consent-manager.js";
 import { McpLifecycleManager } from "./lifecycle.js";
 import {
   computeServerHash,
   createCachedToolSelectorCandidateIndex,
-  getMetadataCachePath,
   getMissingConfiguredDirectToolServers,
   isServerCacheValid,
+  keepOutputShapes,
   loadMetadataCache,
   reconstructPromptMetadata,
   reconstructToolMetadata,
@@ -21,7 +21,7 @@ import { McpServerManager, isTransientHttpConnectError } from "./server-manager.
 import { buildToolMetadata, totalToolCount } from "./tool-metadata.js";
 import { resourceNameToToolName } from "./resource-tools.js";
 import { UiResourceHandler } from "./ui-resource-handler.js";
-import { formatMcpFooterStatus, formatMcpStatus, openUrl, parallelLimit, sanitizeTerminalText } from "./utils.js";
+import { formatMcpFooterStatus, formatMcpStatus, openUrl, parallelLimit, providerSignInMessage, sanitizeTerminalText } from "./utils.js";
 import { logger } from "./logger.js";
 import { throwIfAborted } from "./abort.js";
 import { getAuthStorageOptions } from "./mcp-auth.js";
@@ -38,7 +38,8 @@ import {
   createSessionApprovalWriter,
   restoreSessionApprovalState
 } from "./session-approvals.js";
-export { getFailureAgeSeconds, getFailureMessage, isServerInActiveFailureBackoff } from "./failure-backoff.js";
+import { seedObservedOutputs } from "./output-shape.js";
+export { getFailureAgeSeconds, getFailureMessage } from "./failure-backoff.js";
 const MAX_FAILURE_MESSAGE_CHARS = 8 * 1024;
 const failureExpiryTimers = new WeakMap;
 function getFailureExpiryTimers(state) {
@@ -113,7 +114,9 @@ export async function initializeMcp(pi, ctx, owner = createMcpRuntimeOwner(), op
   }
   const ui = rawUi ? createOwnedUi(rawUi, owner) : undefined;
   const runtimeSignal = combineAbortSignals(owner.signal, initialSignal);
-  const config = options.config !== undefined ? resolveConfiguredClaudePluginMcp(cloneMcpConfig(options.config), cwd) : loadMcpConfig(configPath, cwd);
+  const trustResult = options.config !== undefined ? { config: resolveConfiguredClaudePluginMcp(cloneMcpConfig(options.config), cwd), blockedServers: new Map } : options.excludeProjectServers ? { config: excludeProjectServersAtLoadTime(loadMcpConfig(configPath, cwd)), blockedServers: new Map } : await applyProjectServerTrustToConfig(loadMcpConfig(configPath, cwd), ctx);
+  options.onProjectTrustResolved?.();
+  const config = trustResult.config;
   const authStorageOptions = getAuthStorageOptions(config.settings?.oauthDir, cwd, config.settings?.oauthCredentialStore);
   const ownsOAuthRuntime = options.oauthRuntime === undefined;
   const oauthRuntime = options.oauthRuntime ?? createOAuthRuntime(owner.signal);
@@ -123,6 +126,9 @@ export async function initializeMcp(pi, ctx, owner = createMcpRuntimeOwner(), op
   manager.setDefaultRequestTimeoutMs(config.settings?.requestTimeoutMs);
   manager.setTraceConfig?.(config.settings?.trace);
   manager.setAuthStorageOptions(authStorageOptions);
+  if (typeof modelRegistry?.getApiKeyForProvider === "function") {
+    manager.setProviderToken((provider) => modelRegistry.getApiKeyForProvider(provider));
+  }
   const samplingAutoApprove = config.settings?.samplingAutoApprove === true;
   if (config.settings?.sampling !== false && (hasUI || samplingAutoApprove)) {
     manager.setSamplingConfig({
@@ -175,6 +181,7 @@ export async function initializeMcp(pi, ctx, owner = createMcpRuntimeOwner(), op
     failureTracker,
     failureMessages,
     approvedToolCalls,
+    blockedProjectServers: trustResult.blockedServers,
     approvedServers: new Map,
     ...persistSessionApproval !== undefined ? { persistSessionApproval } : {},
     ...sessionManager !== undefined ? { sessionManager } : {},
@@ -238,26 +245,21 @@ export async function initializeMcp(pi, ctx, owner = createMcpRuntimeOwner(), op
   });
   const allServerEntries = Object.entries(config.mcpServers);
   const serverEntries = allServerEntries.filter(([, definition]) => !isServerDisabled(definition));
-  if (serverEntries.length === 0) {
-    if (allServerEntries.length > 0 && hasUI) {
-      ui?.notify(`MCP: All ${allServerEntries.length} server(s) are disabled`, "info");
-    }
-    publishMcpStatusSnapshot(state);
-    return state;
+  if (serverEntries.length === 0 && allServerEntries.length > 0 && hasUI) {
+    ui?.notify(`MCP: All ${allServerEntries.length} server(s) are disabled`, "info");
+  }
+  if (trustResult.blockedServers.size > 0) {
+    const summary = [...trustResult.blockedServers].map(([name, entry]) => `${name} (${describeProjectServerBlock(entry.reason)})`).join(", ");
+    if (hasUI)
+      ui?.notify(`MCP: Project servers blocked: ${summary}`, "warning");
+    else
+      console.warn(`MCP: Project servers blocked: ${summary}`);
   }
   const idleSetting = typeof config.settings?.idleTimeout === "number" ? config.settings.idleTimeout : 10;
   lifecycle.setGlobalIdleTimeout(idleSetting);
-  const cachePath = getMetadataCachePath();
-  const cacheFileExists = existsSync(cachePath);
-  let cache = loadMetadataCache();
-  let bootstrapAll = false;
-  if (!cacheFileExists) {
-    bootstrapAll = true;
-    saveMetadataCache({ version: 1, servers: {} });
-  } else if (!cache) {
-    cache = { version: 1, servers: {} };
-    saveMetadataCache(cache);
-  }
+  const cache = serverEntries.length > 0 ? loadMetadataCache() : null;
+  const needsDiscovery = new Set;
+  const failedDiscovery = new Set;
   const prefix = config.settings?.toolPrefix ?? "server";
   let cachedSelectorCandidateIndex;
   for (const [name, definition] of serverEntries) {
@@ -285,37 +287,59 @@ export async function initializeMcp(pi, ctx, owner = createMcpRuntimeOwner(), op
       if (cachedEntry.instructions) {
         serverInstructions.set(name, cachedEntry.instructions);
       }
+      seedObservedOutputs(state, name, cachedEntry);
+    } else if (cachedEntry?.discoveryFailed && cachedEntry.configHash === tryComputeServerHash(definition)) {
+      failedDiscovery.add(name);
+    } else if (cachedEntry?.cacheScope !== "private") {
+      needsDiscovery.add(name);
     }
   }
-  const startupServers = bootstrapAll ? serverEntries : serverEntries.filter(([, definition]) => {
+  const startupServers = serverEntries.filter(([name, definition]) => {
     const mode = definition.lifecycle ?? "lazy";
-    return mode === "keep-alive" || mode === "eager";
-  });
+    return mode === "keep-alive" || mode === "eager" || needsDiscovery.has(name);
+  }).filter(([, definition]) => !(options.excludeProjectServers && typeof definition.auth === "object"));
   if (ui && startupServers.length > 0) {
     const status = formatMcpStatus(state.config, `connecting to ${startupServers.length} servers...`);
     ui.setStatus("mcp", status);
   }
   const results = await parallelLimit(startupServers, 10, async ([name, definition]) => {
+    const resident = (definition.lifecycle ?? "lazy") !== "lazy" || getEffectiveIdleTimeoutMinutes(state, name) === 0;
     try {
       const connection = await manager.connect(name, definition, runtimeSignal);
       if (connection.status === "needs-auth") {
-        return { name, definition, connection: null, error: `OAuth authentication required. Run /mcp-auth ${name}.`, transient: false };
+        const error = typeof definition.auth === "object" ? providerSignInMessage(name, definition.auth.provider) : `OAuth authentication required. Run /mcp-auth ${name}.`;
+        return { name, definition, resident, connection: null, error, transient: false };
       }
-      return { name, definition, connection, error: null, transient: false };
+      captureMetadata(state, name, connection, () => cache);
+      if (!resident)
+        await manager.close(name);
+      return { name, definition, resident, connection, error: null, transient: false };
     } catch (error) {
       if (isAbortError(error, runtimeSignal)) {
         if (owner.signal.aborted)
           throw error;
-        return { name, definition, connection: null, error: null, transient: false };
+        return { name, definition, resident, connection: null, error: null, transient: false };
       }
       const transient = isTransientHttpConnectError(error);
       const message = error instanceof Error ? error.message : String(error);
-      return { name, definition, connection: null, error: message, transient };
+      return { name, definition, resident, connection: null, error: message, transient };
     }
   });
   if (initialSignal?.aborted)
     return state;
   owner.throwIfInactive();
+  const captured = results.flatMap(({ name, definition, connection, error, transient }) => {
+    if (connection) {
+      const entry = state.sessionMetadata?.get(name);
+      return entry ? [[name, entry]] : [];
+    }
+    if (!error || transient || !needsDiscovery.has(name))
+      return [];
+    const configHash = tryComputeServerHash(definition);
+    return configHash ? [[name, { configHash, tools: [], resources: [], discoveryFailed: true, cachedAt: Date.now() }]] : [];
+  });
+  if (captured.length > 0)
+    saveMetadataCache({ version: 1, servers: Object.fromEntries(captured) }, { startupSnapshot: cache?.servers ?? {} });
   const startupKnownMetadata = new Map;
   for (const { name, definition, connection } of results) {
     if (!connection)
@@ -374,18 +398,18 @@ export async function initializeMcp(pi, ctx, owner = createMcpRuntimeOwner(), op
     } else {
       serverInstructions.delete(name);
     }
-    updateMetadataCache(state, name);
     notifyToolMetadataUpdated(state, name, "startup");
     markKeepAliveAfterConnect(state, name);
     if (failedTools.length > 0 && ui) {
       ui.notify(`MCP: ${name} - ${failedTools.length} tools skipped`, "warning");
     }
   }
-  const connectedCount = results.filter((r) => r.connection).length;
-  const failedCount = results.filter((r) => r.error).length;
+  const residentResults = results.filter((r) => r.resident);
+  const connectedCount = residentResults.filter((r) => r.connection).length;
+  const failedCount = residentResults.filter((r) => r.error).length;
   if (ui && connectedCount > 0 && config.settings?.notifyOnStartupConnect !== false) {
     const totalTools = totalToolCount(state);
-    const msg = failedCount > 0 ? `MCP: ${connectedCount}/${startupServers.length} servers connected (${totalTools} tools)` : `MCP: ${connectedCount} servers connected (${totalTools} tools)`;
+    const msg = failedCount > 0 ? `MCP: ${connectedCount}/${residentResults.length} servers connected (${totalTools} tools)` : `MCP: ${connectedCount} servers connected (${totalTools} tools)`;
     ui.notify(msg, "info");
   }
   const envDirect = process.env.MCP_DIRECT_TOOLS;
@@ -394,7 +418,7 @@ export async function initializeMcp(pi, ctx, owner = createMcpRuntimeOwner(), op
     const envDirectToolOverride = envDirect?.split(",").map((selector) => selector.trim()).filter(Boolean);
     const missingCacheServers = getMissingConfiguredDirectToolServers(config, currentCache, envDirectToolOverride);
     if (missingCacheServers.length > 0) {
-      const bootstrapResults = await parallelLimit(missingCacheServers.filter((name) => !results.some((r) => r.name === name && r.connection)), 10, async (name) => {
+      const bootstrapResults = await parallelLimit(missingCacheServers.filter((name) => !failedDiscovery.has(name) && !results.some((r) => r.name === name)), 10, async (name) => {
         try {
           const definition = config.mcpServers[name];
           if (!definition)
@@ -515,23 +539,37 @@ export function updateServerMetadata(state, serverName) {
   }
 }
 export function updateMetadataCache(state, serverName) {
-  if (state.provisionalInstalls?.has(serverName))
-    return;
   const connection = state.manager.getConnection(serverName);
   if (!connection || connection.status !== "connected")
     return;
+  const entry = captureMetadata(state, serverName, connection, loadMetadataCache);
+  if (entry)
+    saveMetadataCache({ version: 1, servers: { [serverName]: entry } });
+}
+function captureMetadata(state, serverName, connection, loadCache) {
+  if (state.provisionalInstalls?.has(serverName))
+    return;
   const definition = state.config.mcpServers[serverName];
   if (!definition || isServerDisabled(definition))
     return;
   const configHash = computeServerHash(definition);
-  const existing = loadMetadataCache();
-  const existingEntry = existing?.servers?.[serverName];
+  if (connection.definition && computeServerHash(connection.definition) !== configHash)
+    return;
+  const existingEntry = loadCache()?.servers?.[serverName];
   const tools = serializeTools(connection.tools);
   let resources = definition.exposeResources === false ? [] : serializeResources(connection.resources);
-  const prompts = connection.promptDiscoveryFailed ? existingEntry?.configHash === configHash ? existingEntry.prompts : undefined : serializePrompts(connection.prompts ?? []);
-  if (definition.exposeResources !== false && connection.resourceDiscoveryFailed === true && existingEntry?.resources?.length && isServerCacheValid(existingEntry, definition)) {
-    resources = existingEntry.resources;
+  const sessionEntry = state.sessionMetadata?.get(serverName);
+  const cacheScope = connection.toolListHints?.cacheScope;
+  const sessionFallback = sessionEntry?.configHash === configHash && (sessionEntry.cacheScope !== "private" || cacheScope === "private") ? sessionEntry : undefined;
+  const prompts = connection.promptDiscoveryFailed ? sessionFallback ? sessionFallback.prompts : existingEntry?.configHash === configHash && isServerCacheValid(existingEntry, definition) ? existingEntry.prompts : undefined : serializePrompts(connection.prompts ?? []);
+  if (definition.exposeResources !== false && connection.resourceDiscoveryFailed === true) {
+    if (sessionFallback) {
+      resources = sessionFallback.resources ?? [];
+    } else if (existingEntry?.resources?.length && isServerCacheValid(existingEntry, definition)) {
+      resources = existingEntry.resources;
+    }
   }
+  const outputShapes = keepOutputShapes(existingEntry, configHash, tools);
   const entry = {
     configHash,
     tools,
@@ -539,10 +577,13 @@ export function updateMetadataCache(state, serverName) {
     ...prompts !== undefined ? { prompts } : {},
     ...connection.instructions !== undefined ? { instructions: connection.instructions } : {},
     ...connection.toolListHints?.ttlMs !== undefined ? { ttlMs: connection.toolListHints.ttlMs } : {},
-    ...connection.toolListHints?.cacheScope !== undefined ? { cacheScope: connection.toolListHints.cacheScope } : {},
+    ...cacheScope !== undefined ? { cacheScope } : {},
+    ...outputShapes !== undefined ? { outputShapes } : {},
     cachedAt: Date.now()
   };
-  saveMetadataCache({ version: 1, servers: { [serverName]: entry } });
+  (state.sessionMetadata ??= new Map).set(serverName, entry);
+  seedObservedOutputs(state, serverName, entry);
+  return entry;
 }
 export function notifyToolMetadataUpdated(state, serverName, reason) {
   try {
@@ -577,7 +618,7 @@ export function updateStatusBar(state) {
     const definition = state.config.mcpServers[name];
     return connection.status === "connected" && definition !== undefined && !isServerDisabled(definition);
   }).length;
-  const formattedStatus = formatMcpFooterStatus(state.config, enabledCount, disabledCount, connectedCount);
+  const formattedStatus = state.blockedProjectServers?.size ? formatMcpStatus(state.config, `${enabledCount} ${enabledCount === 1 ? "server" : "servers"} enabled (${state.blockedProjectServers.size} blocked by project trust)`) : formatMcpFooterStatus(state.config, enabledCount, disabledCount, connectedCount);
   if (formattedStatus === undefined) {
     ui.setStatus("mcp", undefined);
     return;
@@ -645,3 +686,10 @@ function getEffectiveIdleTimeoutMinutes(state, serverName) {
     return 0;
   return typeof state.config.settings?.idleTimeout === "number" ? state.config.settings.idleTimeout : 10;
 }
+function tryComputeServerHash(definition) {
+  try {
+    return computeServerHash(definition);
+  } catch {
+    return;
+  }
+}

package/extensions/dm-mcp-adapter/jev-client.js

@@ -1,7 +1,7 @@
 import { TypeSafeClient } from "@typesafe-ai/sdk";
 import { isServerDisabled } from "./types.js";
 import { combineAbortSignals } from "./runtime-owner.js";
-import { JEV_SDK_PATH, resolveJevCredential, resolveJevEndpoint } from "./jev-key-store.js";
+import { JEV_SDK_PATH, OPENROUTER_ORIGIN, resolveJevCredential, resolveJevEndpoint } from "./jev-key-store.js";
 const DEFAULTS = {
   semanticSearch: false,
   scriptEvaluation: false,
@@ -18,6 +18,7 @@ const DEFAULTS = {
   semanticMinProbability: 0.2
 };
 const DANGEROUS_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+const OPENROUTER_DEFAULT_MODEL = "typesafe/jev-1.13";
 const hosts = new WeakMap;
 const credentials = new WeakMap;
 function resolveCredential(state, endpoint) {
@@ -223,7 +224,6 @@ function sameKeys(actual, expected) {
 }
 function validateResponse(value, input) {
   const response = record(value, "response");
-  exactKeys(response, ["model", "answers", "usage"], "response");
   const answers = record(response.answers, "response answers");
   const questionNames = Object.keys(input.questions);
   if (!sameKeys(answers, questionNames))
@@ -261,8 +261,6 @@ function validateResponse(value, input) {
   if (typeof response.model !== "string" || response.model.length === 0 || response.model.length > 128)
     throw new Error("Invalid response model");
   const usage = record(response.usage, "response usage");
-  if (!sameKeys(usage, ["input_tokens", "output_tokens"]))
-    throw new Error("Invalid response usage");
   return { answers: validated, model: response.model, usage: { inputTokens: safeNumber(usage.input_tokens, "input tokens", true), outputTokens: safeNumber(usage.output_tokens, "output tokens", true) } };
 }
 function createPinnedEndpointFetch(endpoint) {
@@ -344,7 +342,9 @@ export async function evaluateJev(state, value, options) {
   }, settings.requestTimeoutMs);
   const signal = combineAbortSignals(options.signal, state.owner.signal, deadline.signal);
   try {
-    const request = { state: input.state, questions: input.questions, model: settings.model };
+    const configured = state.config.settings?.jev;
+    const model = resolved.endpoint.origin === OPENROUTER_ORIGIN && (!configured || configured.model === undefined) ? OPENROUTER_DEFAULT_MODEL : settings.model;
+    const request = { state: input.state, questions: input.questions, model };
     const raw = await resolved.client.systemOne(request, { ...signal ? { signal } : {}, timeout: settings.requestTimeoutMs, retry: { maxRetries: settings.maxRetries } });
     try {
       return { ok: true, data: validateResponse(raw, input) };

package/extensions/dm-mcp-adapter/jev-key-store.js

@@ -3,6 +3,8 @@ export const JEV_DEFAULT_ENDPOINT = "https://api.typesafe.ai/v1/systemone";
 const SYSTEMONE_ENDPOINT_ENV = "SYSTEMONE_ENDPOINT";
 const SYSTEMONE_API_KEY_ENV = "SYSTEMONE_API_KEY";
 const LEGACY_TYPESAFE_API_KEY_ENV = "TYPESAFE_API_KEY";
+const OPENROUTER_API_KEY_ENV = "OPENROUTER_API_KEY";
+export const OPENROUTER_ORIGIN = "https://openrouter.ai";
 export const TYPESAFE_API_ORIGIN = "https://api.typesafe.ai";
 export const JEV_KEYRING_ACCOUNT = "typesafe@sha256(https://api.typesafe.ai)";
 export const JEV_KEYRING_SERVICE = "dm-mcp-adapter.service-key";
@@ -24,6 +26,9 @@ function validateApiKey(value) {
   }
   return value;
 }
+function isLoopbackHostname(hostname) {
+  return hostname === "localhost" || hostname === "[::1]" || /^127\.\d+\.\d+\.\d+$/.test(hostname);
+}
 function parseEndpoint(raw, label) {
   if (typeof raw !== "string" || raw.trim().length === 0)
     throw new Error(`${label} must be a non-empty URL`);
@@ -37,8 +42,9 @@ function parseEndpoint(raw, label) {
   } catch {
     throw new Error(`${label} must be an absolute URL`);
   }
-  if (url.protocol !== "https:")
-    throw new Error(`${label} must use https`);
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopbackHostname(url.hostname))) {
+    throw new Error(`${label} must use https, except http on localhost, 127.0.0.0/8, or [::1]`);
+  }
   if (url.username !== "" || url.password !== "")
     throw new Error(`${label} must not embed credentials`);
   if (url.search !== "")
@@ -137,6 +143,13 @@ export function resolveJevCredential(env = process.env, endpoint, secretStore =
       return { status: "unavailable", message: `${LEGACY_TYPESAFE_API_KEY_ENV} is present but invalid.` };
     }
   }
+  if (target.origin === OPENROUTER_ORIGIN && Object.hasOwn(env, OPENROUTER_API_KEY_ENV)) {
+    try {
+      return { status: "present", source: "environment", apiKey: validateApiKey(env[OPENROUTER_API_KEY_ENV]) };
+    } catch {
+      return { status: "unavailable", message: `${OPENROUTER_API_KEY_ENV} is present but invalid.` };
+    }
+  }
   let stored;
   try {
     stored = readStoredKey(secretStore, target);

package/extensions/dm-mcp-adapter/mcp-auth-flow.js

@@ -2,6 +2,7 @@ import {
   auth as runSdkAuth,
   extractWWWAuthenticateParams,
   LATEST_PROTOCOL_VERSION,
+  RegistrationRejectedError,
   UnauthorizedError,
   validateClientMetadataUrl
 } from "@modelcontextprotocol/client";
@@ -334,6 +335,10 @@ function parseOAuthRedirectUri(redirectUri) {
     resolveRedirectUri: (assignedPort) => dynamicPort ? redirectUri.replace(dynamicPortPlaceholder, String(assignedPort)) : redirectUri
   };
 }
+export function explainRegistrationRejection(error, serverUrl) {
+  const hint = new URL(serverUrl).hostname === "mcp.figma.com" ? "Figma's remote MCP server only accepts approved clients, and DM isn't approved yet. Use the Figma desktop app's local server instead: run /mcp-adapter setup." : "This server only accepts pre-registered OAuth clients. If the provider gave you a client ID, set oauth.clientId (and oauth.clientSecret if required) for this server.";
+  return new Error(`${error.message}. ${hint}`, { cause: error });
+}
 export async function startAuth(serverName, serverUrl, definition, options = {}, operationAuthority) {
   if (isServerDisabled(definition))
     throw new Error(`MCP server "${serverName}" is disabled`);
@@ -346,6 +351,9 @@ export async function startAuth(serverName, serverUrl, definition, options = {},
   const signal = combineAbortSignals(runtime.signal, options.signal);
   const generation = runtimeState.generation;
   throwIfAborted(signal);
+  const explainRejection = (error) => {
+    throw error instanceof RegistrationRejectedError ? explainRegistrationRejection(error, serverUrl) : error;
+  };
   if (config.grantType === "client_credentials") {
     const storedAuth = await getAuthForUrl(serverName, serverUrl, authStorageOptions);
     authority();
@@ -366,7 +374,7 @@ export async function startAuth(serverName, serverUrl, definition, options = {},
       const discovery = applyOAuthConfig(await probeAuthDiscovery(serverUrl, definition, signal), config);
       authority();
       throwIfAborted(signal);
-      const result = await abortable(runSdkAuth(authProvider, { serverUrl, ...discovery, fetchFn }), signal);
+      const result = await abortable(runSdkAuth(authProvider, { serverUrl, ...discovery, fetchFn }).catch(explainRejection), signal);
       authority();
       throwIfAborted(signal);
       if (result !== "AUTHORIZED") {
@@ -447,7 +455,7 @@ export async function startAuth(serverName, serverUrl, definition, options = {},
     const discovery = applyOAuthConfig(await probeAuthDiscovery(serverUrl, definition, signal), config);
     authority();
     throwIfAborted(signal);
-    const result = await abortable(runSdkAuth(authProvider, { serverUrl, ...discovery, fetchFn }), signal);
+    const result = await abortable(runSdkAuth(authProvider, { serverUrl, ...discovery, fetchFn }).catch(explainRejection), signal);
     authority();
     throwIfAborted(signal);
     if (result === "AUTHORIZED") {

package/extensions/dm-mcp-adapter/mcp-auth.js

@@ -441,7 +441,8 @@ function shouldAttemptLinuxKeyringRecovery(error) {
 function runLinuxKeyringRecoveryOperation(operation, account, payload) {
   const keyctl = process.env[KEYRING_RECOVERY_KEYCTL_ENV]?.trim() || "keyctl";
   const node = process.env[KEYRING_RECOVERY_NODE_ENV]?.trim() || "node";
-  const helper = process.env[KEYRING_RECOVERY_HELPER_ENV]?.trim() || fileURLToPath(new URL("./mcp-keyring-helper.cjs", import.meta.url));
+  const adjacentHelper = new URL("./mcp-keyring-helper.cjs", import.meta.url);
+  const helper = process.env[KEYRING_RECOVERY_HELPER_ENV]?.trim() || fileURLToPath(existsSync(adjacentHelper) ? adjacentHelper : new URL("../mcp-keyring-helper.cjs", import.meta.url));
   const request = JSON.stringify({ operation, service: AUTH_SECRET_SERVICE, account, payload });
   const result = spawnSync(keyctl, ["session", "-", node, helper], {
     input: `${request}

package/extensions/dm-mcp-adapter/mcp-callback-server.js

@@ -1,6 +1,7 @@
 import { createServer } from "http";
 import { getAppName } from "./agent-dir.js";
 import {
+  DEFAULT_OAUTH_CALLBACK_HOST,
   DEFAULT_OAUTH_CALLBACK_PATH,
   getConfiguredOAuthCallbackPort,
   getOAuthCallbackPath,
@@ -130,7 +131,6 @@ let callbackGeneration = 0;
 const pendingAuths = new Map;
 const reservedAuthStates = new Set;
 const CALLBACK_TIMEOUT_MS = 5 * 60 * 1000;
-const DEFAULT_OAUTH_CALLBACK_HOST = "localhost";
 let callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST;
 function handleRequest(req, res) {
   const url = new URL(req.url || "/", `http://${req.headers.host}`);