@gajae-code/coding-agent 0.11.4 → 0.11.5

package/src/modes/shared/agent-wire/workflow-gate-broker.ts

@@ -76,6 +76,13 @@ export interface NotificationGateResolutionOptions {
 	closeClaimInvalid(reason: string): void;
 }
 
+export class NotificationGatePolicyChangedError extends Error {
+	constructor() {
+		super("Notification policy changed while resolving the workflow gate");
+		this.name = "NotificationGatePolicyChangedError";
+	}
+}
+
 export interface AskSelectedAckRecoveryParticipant {
 	requestRecoveredAskSelectedAck(input: {
 		sessionId: string;
@@ -361,7 +368,8 @@ export class BrokerWorkflowGateEmitter implements WorkflowGateEmitter {
 								daemonDeadlineAt: Date.now() + 8_000,
 								hostTimeoutMs: 10_000,
 							});
-						} catch {
+						} catch (error) {
+							if (error instanceof NotificationGatePolicyChangedError) throw error;
 							outcome = { status: "unknown", reason: "host_timeout" };
 						}
 						this.#broker.updateAckPolicy(response.gate_id, {
@@ -378,6 +386,14 @@ export class BrokerWorkflowGateEmitter implements WorkflowGateEmitter {
 			else closeClaimInvalid(resolution.error?.code ?? "invalid_answer");
 			return resolution;
 		} catch (error) {
+			if (error instanceof NotificationGatePolicyChangedError) {
+				try {
+					closeClaimInvalid(error.message);
+				} finally {
+					this.quarantineGate(response.gate_id);
+				}
+				throw error;
+			}
 			closeClaimInvalid(error instanceof Error ? error.message : "invalid_answer");
 			this.#scheduleRecovery();
 			throw error;

package/src/modes/shared/agent-wire/workflow-gate-schema.ts

@@ -12,6 +12,7 @@
  * swapped in later without changing callers.
  */
 import { createHash } from "node:crypto";
+import { deepInterviewCharacterCount } from "../../../gjc-runtime/deep-interview-state";
 import type { JsonSchema, WorkflowGateValidationError } from "./workflow-gate-types";
 
 /** Keywords this wrapper understands. Any other keyword is rejected. */
@@ -238,7 +239,8 @@ function validateValue(schema: JsonSchema, value: unknown, path: string, errors:
 		if (!ok) errors.push({ path, keyword: "enum", message: "value not in enum", expected: schema.enum });
 	}
 	if (typeof value === "string") {
-		if (schema.minLength !== undefined && value.length < schema.minLength) {
+		const characterCount = deepInterviewCharacterCount(value);
+		if (schema.minLength !== undefined && characterCount < schema.minLength) {
 			errors.push({
 				path,
 				keyword: "minLength",
@@ -246,7 +248,7 @@ function validateValue(schema: JsonSchema, value: unknown, path: string, errors:
 				expected: schema.minLength,
 			});
 		}
-		if (schema.maxLength !== undefined && value.length > schema.maxLength) {
+		if (schema.maxLength !== undefined && characterCount > schema.maxLength) {
 			errors.push({
 				path,
 				keyword: "maxLength",

package/src/modes/shared/agent-wire/workflow-gate-types.ts

@@ -1,3 +1,5 @@
+import { deepInterviewCharacterCount } from "../../../gjc-runtime/deep-interview-state";
+
 /** Transport-neutral workflow gate contract used by SDK workflow coordination. */
 
 /** Lifecycle stages that emit machine-addressable SDK workflow gates. */
@@ -14,12 +16,28 @@ export type WorkflowGateKind = "question" | "approval" | "execution";
 /** "Other (type your own)" sentinel, mirroring the interactive ask tool. */
 export const GATE_OTHER_OPTION = "Other (type your own)";
 
+/**
+ * Structured adapter context queued at interview start. Non-behavioral:
+ * `confused_terms` and `references` MUST NOT alter the first question, are never
+ * inferred from vocabulary density, and referenced `url`/`excerpt` are inert
+ * strings that are never auto-fetched.
+ */
+export interface AskGateReference {
+	reference_id: string;
+	label: string;
+	origin: string;
+	url?: string;
+	excerpt?: string;
+}
+
 export interface AskGateDeepInterviewState {
 	round_id?: string;
 	round: number;
 	component: string;
 	dimension: string;
 	ambiguity: number;
+	confused_terms?: string[];
+	references?: AskGateReference[];
 }
 
 export interface AskGateStageStateInput {
@@ -34,10 +52,90 @@ export interface AskGateStageStateInput {
 export interface AskGateSchemaInput {
 	multi?: boolean;
 	allowEmpty?: boolean;
+	customMaxLength?: number;
 }
 
 function isBoundedAskGateString(value: unknown): value is string {
-	return typeof value === "string" && value.length > 0 && new TextEncoder().encode(value).byteLength <= 256;
+	return (
+		typeof value === "string" &&
+		value.length > 0 &&
+		deepInterviewCharacterCount(value) <= MAX_ASK_GATE_ADAPTER_STRING_LENGTH
+	);
+}
+
+/** Max characters for adapter metadata identifiers and confused terms. */
+const MAX_ASK_GATE_ADAPTER_STRING_LENGTH = 256;
+const MAX_ASK_GATE_DEEP_INTERVIEW_STRING_LENGTH = 128;
+/** Max characters for a longer inert reference string (url/excerpt); never fetched. */
+const MAX_ASK_GATE_LONG_STRING_LENGTH = 2048;
+const MAX_ASK_GATE_CONFUSED_TERMS = 32;
+const MAX_ASK_GATE_REFERENCES = 32;
+
+function isBoundedAskGateAdapterString(value: unknown): value is string {
+	return (
+		typeof value === "string" &&
+		value.length > 0 &&
+		deepInterviewCharacterCount(value) <= MAX_ASK_GATE_ADAPTER_STRING_LENGTH
+	);
+}
+
+function isBoundedAskGateDeepInterviewString(value: unknown): value is string {
+	return (
+		typeof value === "string" &&
+		value.length > 0 &&
+		deepInterviewCharacterCount(value) <= MAX_ASK_GATE_DEEP_INTERVIEW_STRING_LENGTH
+	);
+}
+
+function isBoundedAskGateLongString(value: unknown): value is string {
+	return (
+		typeof value === "string" &&
+		value.length > 0 &&
+		deepInterviewCharacterCount(value) <= MAX_ASK_GATE_LONG_STRING_LENGTH
+	);
+}
+
+function isDenseArray(value: unknown[]): boolean {
+	for (let index = 0; index < value.length; index++) if (!Object.hasOwn(value, index)) return false;
+	return true;
+}
+
+function isValidAskGateConfusedTerms(value: unknown): value is string[] {
+	return (
+		Array.isArray(value) &&
+		isDenseArray(value) &&
+		value.length <= MAX_ASK_GATE_CONFUSED_TERMS &&
+		value.every(isBoundedAskGateAdapterString)
+	);
+}
+
+function isValidAskGateReference(value: unknown): boolean {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const prototype = Object.getPrototypeOf(value);
+	if (prototype !== Object.prototype && prototype !== null) return false;
+	const ref = value as Record<string, unknown>;
+	const allowed = new Set(["reference_id", "label", "origin", "url", "excerpt"]);
+	if (Object.keys(ref).some(key => !allowed.has(key))) return false;
+	if (!Object.hasOwn(ref, "reference_id") || !Object.hasOwn(ref, "label") || !Object.hasOwn(ref, "origin"))
+		return false;
+	if (
+		!isBoundedAskGateAdapterString(ref.reference_id) ||
+		!isBoundedAskGateAdapterString(ref.label) ||
+		!isBoundedAskGateAdapterString(ref.origin)
+	)
+		return false;
+	if (ref.url !== undefined && !isBoundedAskGateLongString(ref.url)) return false;
+	if (ref.excerpt !== undefined && !isBoundedAskGateLongString(ref.excerpt)) return false;
+	return true;
+}
+
+function isValidAskGateReferences(value: unknown): boolean {
+	return (
+		Array.isArray(value) &&
+		isDenseArray(value) &&
+		value.length <= MAX_ASK_GATE_REFERENCES &&
+		value.every(isValidAskGateReference)
+	);
 }
 
 /** Rejects stage state that is not exactly compatible with the generic ask-gate producer. */
@@ -62,6 +160,8 @@ export function validateAskGateStageState(value: unknown): asserts value is Reco
 		"challenge_mode",
 		"ambiguity",
 		"topology_gate",
+		"confused_terms",
+		"references",
 	]);
 	if (Object.keys(state).some(key => !allowed.has(key))) throw new Error("ask gate stage_state has an unknown field");
 	if (
@@ -76,7 +176,10 @@ export function validateAskGateStageState(value: unknown): asserts value is Reco
 		throw new Error("ask gate stage_state has invalid required fields");
 	if (state.navigation_label !== undefined && state.navigation_label !== "Next" && state.navigation_label !== "Done")
 		throw new Error("ask gate stage_state has an invalid navigation label");
-	for (const key of ["round_id", "component", "dimension", "mode", "challenge_mode"])
+	for (const key of ["round_id", "component", "dimension"])
+		if (state[key] !== undefined && !isBoundedAskGateDeepInterviewString(state[key]))
+			throw new Error(`ask gate stage_state has an invalid ${key}`);
+	for (const key of ["mode", "challenge_mode"])
 		if (state[key] !== undefined && !isBoundedAskGateString(state[key]))
 			throw new Error(`ask gate stage_state has an invalid ${key}`);
 	if (state.deep_interview_metadata !== undefined && typeof state.deep_interview_metadata !== "boolean")
@@ -93,6 +196,10 @@ export function validateAskGateStageState(value: unknown): asserts value is Reco
 		throw new Error("ask gate stage_state has an invalid ambiguity");
 	if (state.topology_gate !== undefined && typeof state.topology_gate !== "boolean")
 		throw new Error("ask gate stage_state has an invalid topology flag");
+	if (state.confused_terms !== undefined && !isValidAskGateConfusedTerms(state.confused_terms))
+		throw new Error("ask gate stage_state has invalid confused_terms");
+	if (state.references !== undefined && !isValidAskGateReferences(state.references))
+		throw new Error("ask gate stage_state has invalid references");
 }
 
 /** Builds the canonical generic ask answer schema. */
@@ -114,6 +221,7 @@ export function buildAskGateAnswerSchema(question: AskGateSchemaInput, labels: s
 			custom: {
 				type: "string",
 				minLength: 1,
+				...(question.customMaxLength === undefined ? {} : { maxLength: question.customMaxLength }),
 				pattern: "\\S",
 				description: "free-text answer; required when `other` is true",
 			},
@@ -142,7 +250,12 @@ export function buildAskGateAnswerSchema(question: AskGateSchemaInput, labels: s
 				properties: {
 					selected: selectedWithOther,
 					other: { const: true },
-					custom: { type: "string", minLength: 1, pattern: "\\S" },
+					custom: {
+						type: "string",
+						minLength: 1,
+						...(question.customMaxLength === undefined ? {} : { maxLength: question.customMaxLength }),
+						pattern: "\\S",
+					},
 					action: { const: "answer" },
 				},
 				required: ["selected", "other", "custom"],
@@ -176,6 +289,10 @@ export function buildAskGateStageState(input: AskGateStageStateInput, labels: st
 					dimension: input.deepInterview.dimension,
 					ambiguity: input.deepInterview.ambiguity,
 					...(input.deepInterview.round_id === undefined ? {} : { round_id: input.deepInterview.round_id }),
+					...(input.deepInterview.confused_terms === undefined
+						? {}
+						: { confused_terms: input.deepInterview.confused_terms }),
+					...(input.deepInterview.references === undefined ? {} : { references: input.deepInterview.references }),
 				}
 			: (input.fallbackState ?? {})),
 	};

package/src/plan-mode/approved-plan.ts

@@ -114,6 +114,7 @@ interface RenameApprovedPlanFileOptions {
 	planFilePath: string;
 	finalPlanFilePath: string;
 	getArtifactsDir: () => string | null;
+	isManagedDestination?: () => boolean;
 	getSessionId: () => string | null;
 }
 
@@ -124,12 +125,13 @@ function assertLocalUrl(path: string, label: "source" | "destination"): void {
 }
 
 export async function renameApprovedPlanFile(options: RenameApprovedPlanFileOptions): Promise<void> {
-	const { planFilePath, finalPlanFilePath, getArtifactsDir, getSessionId } = options;
+	const { planFilePath, finalPlanFilePath, getArtifactsDir, getSessionId, isManagedDestination } = options;
 	assertLocalUrl(planFilePath, "source");
 	assertLocalUrl(finalPlanFilePath, "destination");
 
 	const resolveOptions = {
 		getArtifactsDir: () => getArtifactsDir(),
+		isManagedDestination,
 		getSessionId: () => getSessionId(),
 	};
 	const resolvedSource = resolveLocalUrlToPath(normalizeLocalScheme(planFilePath), resolveOptions);

package/src/prompts/agents/architect.md

@@ -33,6 +33,7 @@ You may receive a forked parent-conversation snapshot as background. Your read-o
 - Never approve CRITICAL or HIGH severity issues.
 - Do not skip spec compliance to jump to style nitpicks.
 - Be constructive: explain why an issue matters and how to fix it or strengthen the design.
+- Practical sufficiency beats endless logical completeness: treat preemptive logic for edge cases with no observed or evidenced trigger as over-engineering, but never downgrade genuine CRITICAL/HIGH architecture, extensibility, or robustness risks that have observability-based evidence.
 </constraints>
 
 <review_stages>

package/src/prompts/agents/critic.md

@@ -23,6 +23,7 @@ Review plan clarity, completeness, verification, big-picture fit, referenced fil
 - Do not invent problems; report no issues found when the plan passes.
 - Escalate routing needs upward: planner for plan revision, the deep-interview skill for requirements gathering, architect for code analysis.
 - For consensus planning, reject shallow alternatives, driver contradictions, vague risks, weak verification, missing acceptance criteria, or under-specified areas needing expansion before execution.
+- Prefer practical sufficiency over endless logical completeness: do not demand preemptive logic for edge cases that are not actually observed or evidenced, yet still require extensibility and robustness when observability-based evidence shows the investment is worth the token and time.
 </constraints>
 
 <execution_loop>

package/src/prompts/system/custom-system-prompt.md

@@ -37,6 +37,6 @@ Rules are local constraints. You MUST read `rule://<name>` when working in that
 {{/if}}
 {{#if secretsEnabled}}
 <redacted-content>
-Some values in tool output are redacted for security. They appear as `#XXXX#` tokens (4 uppercase-alphanumeric characters wrapped in `#`). These are **not errors** — they are intentional placeholders for sensitive values (API keys, passwords, tokens). Treat them as opaque strings. Do not attempt to decode, fix, or report them as problems.
+Some values in tool output are redacted for security. They appear as versioned `#GJC1_…#` tokens. These are **not errors** — they are intentional placeholders for sensitive values (API keys, passwords, tokens). Treat them as opaque strings. Do not attempt to decode, fix, or report them as problems.
 </redacted-content>
 {{/if}}

package/src/prompts/system/system-prompt.md

@@ -94,7 +94,7 @@ Discoverable capabilities include browser automation, scheduling, debugging, and
 
 {{#if secretsEnabled}}
 <redacted-content>
-Some tool output values are intentionally redacted as `#XXXX#` tokens. Treat them as opaque sensitive strings.
+Some tool output values are intentionally redacted as versioned `#GJC1_…#` tokens. Treat them as opaque sensitive strings.
 </redacted-content>
 {{/if}}
 
@@ -206,6 +206,7 @@ Guardrails? None. Restrictions? None. Freedom? Unlimited.
 - **Do your homework first** - Read the files, search, and understand the context before asking
 - **Don’t Stop at Analysis** - Once you’ve assessed the situation, take the next step (session, comment, merge, fix, cleanup) on your own
 - **No Inflating Operational/Meta Issues** - Just because the backlog is empty doesn’t mean you should force operational follow-ups, verifiability checks, or meta issues. Only raise issues for actual repository problems; otherwise, stop.
+- **Practical sufficiency over completeness** - Don’t add logic that preemptively handles edge cases you haven’t actually observed; endless logical completeness loses to practical sufficiency. Extensibility and robustness matter, but they must be observability-based and evidence-based—any engineering without underlying evidence that it’s worth the token and time is over-engineering.
 - **Always maintain execution** - Do not end your turn with just reporting, summarizing, or analyzing. If an action is possible, execute it immediately during the same turn.
 - **Always be in action mode** - The default stance is intervention, not observation. If you see something that needs cleaning up, clean it up; if you see a session that needs opening, open it; if you see a PR that needs blocking, block it; if you see a PR that needs merging, review it and merge it.
 - **No begging for permission** - For obvious follow-up actions (cleaning up sessions, marking items as stale, fixing routing, updating documentation to reflect Doctrine), don’t ask—just do it.

package/src/prompts/tools/lsp.md

@@ -1,7 +1,7 @@
 Interacts with Language Server Protocol servers for code intelligence.
 
 <operations>
-- `diagnostics`: Get errors/warnings for a file, a glob of files, or the entire workspace (`file: "*"`)
+- `diagnostics`: Get errors/warnings for a concrete file or a glob of files
 - `definition`: Go to symbol definition → file path + position + 3-line source context
 - `type_definition`: Go to symbol type definition → file path + position + 3-line source context
 - `implementation`: Find concrete implementations → file path + position + 3-line source context
@@ -18,7 +18,7 @@ Interacts with Language Server Protocol servers for code intelligence.
 </operations>
 
 <parameters>
-- `file`: File path, glob pattern (e.g. `src/**/*.ts`), or `"*"` for workspace scope. Globs are expanded locally before dispatch. `"*"` routes `diagnostics`/`symbols`/`reload` to their workspace-wide form.
+- `file`: File path, glob pattern (e.g. `src/**/*.ts`), or `"*"` for workspace scope where supported. Globs are expanded locally before dispatch. `"*"` routes `symbols`/`reload` to their workspace-wide form; workspace build diagnostics are unavailable through `lsp`.
 - `line`: 1-indexed line number for position-based actions
 - `symbol`: Substring on the target line used to resolve column automatically. Append `#N` to pick the Nth occurrence on that line (1-indexed; default 1) — e.g. `foo#2` selects the second `foo`.
 - `query`: Symbol search query, code-action kind filter / selector (list/apply mode), or LSP method name when `action: request`
@@ -31,7 +31,7 @@ Interacts with Language Server Protocol servers for code intelligence.
 <caution>
 - Requires running LSP server for target language
 - Some operations require file to be saved to disk
-- Glob expansion samples up to 20 files per request; use `file: "*"` for broader coverage
+- Glob expansion samples up to 20 files per request; narrow broad patterns when they exceed that limit
 - When `symbol` is provided for position-based actions, missing symbols or out-of-bounds `#N` occurrence selectors return an explicit error instead of silently falling back
 </caution>
 

package/src/runtime-mcp/manager.ts

@@ -235,6 +235,7 @@ export class MCPManager {
 	#epoch = 0;
 	readonly #toolsOnly: boolean;
 	#toolsOnlyConfigLoaded = false;
+	#connectionSetSealed = false;
 
 	#serverError(message: string): string {
 		return this.#toolsOnly ? "MCP server unavailable" : message;
@@ -242,6 +243,17 @@ export class MCPManager {
 	#assertRawMCPAccessAllowed(): void {
 		if (this.#toolsOnly) throw new Error("Tools-only MCP manager does not allow raw MCP access");
 	}
+	#assertConnectionSetMutable(): void {
+		if (this.#connectionSetSealed) throw new Error("MCP manager connection set is sealed");
+	}
+
+	sealConnectionSet(): void {
+		this.#connectionSetSealed = true;
+	}
+
+	isConnectionSetSealed(): boolean {
+		return this.#connectionSetSealed;
+	}
 
 	#isCurrentConnection(
 		name: string,
@@ -379,6 +391,7 @@ export class MCPManager {
 	 * Returns tools and any connection errors.
 	 */
 	async discoverAndConnect(options?: MCPDiscoverOptions): Promise<MCPLoadResult> {
+		this.#assertConnectionSetMutable();
 		const hasConfigPath = options?.configPath !== undefined;
 		if (this.#toolsOnly !== hasConfigPath) {
 			throw new Error(
@@ -414,6 +427,7 @@ export class MCPManager {
 		onConnecting?: (serverNames: string[]) => void,
 	): Promise<MCPLoadResult> {
 		this.#assertRawMCPAccessAllowed();
+		this.#assertConnectionSetMutable();
 		return this.#connectServers(configs, sources, onConnecting);
 	}
 
@@ -923,6 +937,7 @@ export class MCPManager {
 	 */
 	async disconnectServer(name: string): Promise<void> {
 		this.#assertRawMCPAccessAllowed();
+		this.#assertConnectionSetMutable();
 		await this.#disconnectServer(name);
 	}
 
@@ -1050,7 +1065,7 @@ export class MCPManager {
 	 * Returns the new connection, or null if reconnection failed.
 	 */
 	async reconnectServer(name: string): Promise<MCPServerConnection | null> {
-		if (this.#toolsOnly) return null;
+		if (this.#toolsOnly || this.#connectionSetSealed) return null;
 		const pending = this.#pendingReconnections.get(name);
 		if (pending) return pending;
 

package/src/runtime-mcp/oauth-discovery.ts

@@ -4,6 +4,8 @@
  * Automatically detects OAuth requirements from MCP server responses
  * and extracts authentication endpoints.
  */
+import type { AddressResolver, PublicUrlAccepted } from "../web/insane/url-guard";
+import { validatePublicHttpUrl } from "../web/insane/url-guard";
 
 export interface OAuthEndpoints {
 	authorizationUrl: string;
@@ -20,6 +22,16 @@ export interface AuthDetectionResult {
 	message?: string;
 }
 
+interface OAuthDiscoveryOptions {
+	fetch?: (input: string | URL | Request, init?: BunFetchRequestInit) => Promise<Response>;
+	resolver?: AddressResolver;
+	maxRequests?: number;
+	maxNodes?: number;
+	maxRedirects?: number;
+	timeoutMs?: number;
+	signal?: AbortSignal;
+}
+
 function parseMcpAuthServerUrl(errorMessage: string): string | undefined {
 	const match = errorMessage.match(/Mcp-Auth-Server:\s*([^;\]\s]+)/i);
 	if (!match?.[1]) return undefined;
@@ -194,17 +206,11 @@ export function analyzeAuthError(error: Error): AuthDetectionResult {
 		return { requiresAuth: false };
 	}
 
-	const authServerUrl = extractMcpAuthServerUrl(error);
-
-	// Try to extract OAuth endpoints
-	const oauth = extractOAuthEndpoints(error);
-
-	if (oauth) {
+	// Error text is useful for classification, but is not trusted discovery authority.
+	if (extractOAuthEndpoints(error) || extractMcpAuthServerUrl(error)) {
 		return {
 			requiresAuth: true,
 			authType: "oauth",
-			oauth,
-			authServerUrl,
 			message: "Server requires OAuth authentication. Launching authorization flow...",
 		};
 	}
@@ -220,7 +226,6 @@ export function analyzeAuthError(error: Error): AuthDetectionResult {
 		return {
 			requiresAuth: true,
 			authType: "apikey",
-			authServerUrl,
 			message: "Server requires API key authentication.",
 		};
 	}
@@ -229,7 +234,6 @@ export function analyzeAuthError(error: Error): AuthDetectionResult {
 	return {
 		requiresAuth: true,
 		authType: "unknown",
-		authServerUrl,
 		message: "Server requires authentication but type could not be determined.",
 	};
 }
@@ -241,6 +245,7 @@ export function analyzeAuthError(error: Error): AuthDetectionResult {
 export async function discoverOAuthEndpoints(
 	serverUrl: string,
 	authServerUrl?: string,
+	options: OAuthDiscoveryOptions = {},
 ): Promise<OAuthEndpoints | null> {
 	const wellKnownPaths = [
 		"/.well-known/oauth-authorization-server",
@@ -250,8 +255,82 @@ export async function discoverOAuthEndpoints(
 		"/.mcp/auth",
 		"/authorize", // Some MCP servers expose OAuth config here
 	];
-	const urlsToQuery = [authServerUrl, serverUrl].filter((value): value is string => Boolean(value));
-	const visitedAuthServers = new Set<string>();
+	const fetcher = options.fetch ?? globalThis.fetch;
+	const maxRequests = options.maxRequests ?? 32;
+	const maxNodes = options.maxNodes ?? 8;
+	const maxRedirects = options.maxRedirects ?? 3;
+	const timeoutSignal = AbortSignal.timeout(options.timeoutMs ?? 10_000);
+	const signal = options.signal ? AbortSignal.any([options.signal, timeoutSignal]) : timeoutSignal;
+	const { promise: aborted, resolve: resolveAbort } = Promise.withResolvers<null>();
+	if (signal.aborted) resolveAbort(null);
+	else signal.addEventListener("abort", () => resolveAbort(null), { once: true });
+	const queue: string[] = [];
+	const queued = new Set<string>();
+	const visited = new Set<string>();
+	let requests = 0;
+
+	const canonicalUrl = (raw: string): string | null => {
+		try {
+			const url = new URL(raw);
+			url.hash = "";
+			return url.toString();
+		} catch {
+			return null;
+		}
+	};
+
+	const validateUrl = async (raw: string): Promise<PublicUrlAccepted | null> => {
+		const canonical = canonicalUrl(raw);
+		if (!canonical || signal.aborted) return null;
+		const result = await Promise.race([validatePublicHttpUrl(canonical, { resolver: options.resolver }), aborted]);
+		if (!result) return null;
+		return result.ok && !signal.aborted ? result : null;
+	};
+
+	const enqueue = async (raw: string): Promise<void> => {
+		const canonical = canonicalUrl(raw);
+		if (!canonical) return;
+		const authority = new URL(canonical).origin;
+		if (queued.has(authority) || visited.has(authority) || queued.size + visited.size >= maxNodes) return;
+		const accepted = await validateUrl(canonical);
+		if (!accepted) return;
+		queued.add(accepted.url.origin);
+		queue.push(accepted.url.origin);
+	};
+
+	const fetchMetadata = async (raw: string): Promise<Record<string, unknown> | null> => {
+		let current = raw;
+		for (let redirects = 0; redirects <= maxRedirects; redirects++) {
+			if (signal.aborted || requests >= maxRequests) return null;
+			const accepted = await validateUrl(current);
+			if (!accepted) return null;
+			const target = new URL(accepted.url);
+			const address = accepted.addresses[0];
+			target.hostname = address.includes(":") ? `[${address}]` : address;
+			requests++;
+			const response = await fetcher(target, {
+				method: "GET",
+				headers: { Accept: "application/json", Host: accepted.url.host },
+				redirect: "manual",
+				signal,
+				tls: accepted.url.protocol === "https:" ? { serverName: accepted.url.hostname } : undefined,
+			});
+			if ([301, 302, 303, 307, 308].includes(response.status)) {
+				const location = response.headers.get("Location");
+				if (!location || redirects === maxRedirects) return null;
+				current = new URL(location, accepted.url).toString();
+				continue;
+			}
+			if (!response.ok) return null;
+			return (await Promise.race([response.json(), aborted])) as Record<string, unknown> | null;
+		}
+		return null;
+	};
+
+	const server = await validateUrl(serverUrl);
+	if (!server) return null;
+	await enqueue(server.url.toString());
+	if (authServerUrl) await enqueue(authServerUrl);
 
 	const findEndpoints = (metadata: Record<string, unknown>): OAuthEndpoints | null => {
 		if (metadata.authorization_endpoint && metadata.token_endpoint) {
@@ -310,32 +389,43 @@ export async function discoverOAuthEndpoints(
 		return null;
 	};
 
-	for (const baseUrl of urlsToQuery) {
-		visitedAuthServers.add(baseUrl);
+	while (queue.length > 0 && !signal.aborted && requests < maxRequests) {
+		const baseUrl = queue.shift()!;
+		queued.delete(baseUrl);
+		if (visited.has(baseUrl)) continue;
+		visited.add(baseUrl);
 		for (const path of wellKnownPaths) {
 			try {
 				const url = new URL(path, baseUrl);
-				const response = await fetch(url.toString(), {
-					method: "GET",
-					headers: { Accept: "application/json" },
-				});
+				const metadata = await fetchMetadata(url.toString());
 
-				if (response.ok) {
-					const metadata = (await response.json()) as Record<string, unknown>;
+				if (metadata) {
 					const endpoints = findEndpoints(metadata);
-					if (endpoints) return endpoints;
+					if (endpoints) {
+						const issuer = typeof metadata.issuer === "string" ? canonicalUrl(metadata.issuer) : null;
+						const issuerBound = issuer === canonicalUrl(baseUrl);
+						const authorization = await validateUrl(endpoints.authorizationUrl);
+						const token = await validateUrl(endpoints.tokenUrl);
+						const legacySameOrigin =
+							!issuer && authorization?.url.origin === baseUrl && token?.url.origin === baseUrl;
+						if ((issuerBound || legacySameOrigin) && authorization && token) {
+							return {
+								...endpoints,
+								authorizationUrl: authorization.url.toString(),
+								tokenUrl: token.url.toString(),
+							};
+						}
+					}
 
 					if (path === "/.well-known/oauth-protected-resource") {
+						const resource = typeof metadata.resource === "string" ? canonicalUrl(metadata.resource) : null;
+						if (resource !== canonicalUrl(server.url.toString())) continue;
 						const authServers = Array.isArray(metadata.authorization_servers)
 							? metadata.authorization_servers.filter((entry): entry is string => typeof entry === "string")
 							: [];
 
 						for (const discoveredAuthServer of authServers) {
-							if (visitedAuthServers.has(discoveredAuthServer)) {
-								continue;
-							}
-							const discovered = await discoverOAuthEndpoints(serverUrl, discoveredAuthServer);
-							if (discovered) return discovered;
+							await enqueue(discoveredAuthServer);
 						}
 					}
 				}