@google/gemini-cli-a2a-server 0.66.0-nightly.20261019.ged96faedf → 0.66.0-preview.0

package/dist/a2a-server.mjs

@@ -34497,7 +34497,7 @@ var require_request = __commonJS({
   "node_modules/express/lib/request.js"(exports2, module2) {
     "use strict";
     var accepts = require_accepts();
-    var isIP4 = __require("node:net").isIP;
+    var isIP5 = __require("node:net").isIP;
     var typeis = require_type_is();
     var http7 = __require("node:http");
     var fresh = require_fresh();
@@ -34588,7 +34588,7 @@ var require_request = __commonJS({
       var hostname3 = this.hostname;
       if (!hostname3) return [];
       var offset = this.app.get("subdomain offset");
-      var subdomains2 = !isIP4(hostname3) ? hostname3.split(".").reverse() : [hostname3];
+      var subdomains2 = !isIP5(hostname3) ? hostname3.split(".").reverse() : [hostname3];
       return subdomains2.slice(offset);
     });
     defineGetter(req, "path", function path103() {
@@ -67278,12 +67278,26 @@ function parseResponseData(error2) {
   }
   return void 0;
 }
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 function isAuthenticationError(error2) {
-  if (error2 && typeof error2 === "object" && "code" in error2) {
-    const errorCode = error2["code"];
-    if (typeof errorCode === "number" && errorCode === 401) {
+  const friendly = toFriendlyError(error2);
+  if (friendly instanceof UnauthorizedError) {
+    return true;
+  }
+  if (isRecord(error2)) {
+    const code = error2["code"] ?? error2["status"] ?? error2["statusCode"];
+    if (code === 401 || code === "401") {
       return true;
     }
+    const response = error2["response"];
+    if (isRecord(response)) {
+      const responseCode = response["status"] ?? response["statusCode"];
+      if (responseCode === 401 || responseCode === "401") {
+        return true;
+      }
+    }
   }
   if (error2 instanceof Error && error2.name === "UnauthorizedError") {
     return true;
@@ -67292,12 +67306,12 @@ function isAuthenticationError(error2) {
     return true;
   }
   const message = getErrorMessage(error2);
-  if (message.includes("401")) {
+  if (HTTP_401_REGEX.test(message)) {
     return true;
   }
   return false;
 }
-var FatalError, FatalAuthenticationError, FatalConfigError, FatalCancellationError, ForbiddenError, AccountSuspendedError, UnauthorizedError, BadRequestError, ChangeAuthRequestedError;
+var FatalError, FatalAuthenticationError, FatalConfigError, FatalCancellationError, ForbiddenError, AccountSuspendedError, UnauthorizedError, BadRequestError, ChangeAuthRequestedError, HTTP_401_REGEX;
 var init_errors2 = __esm({
   "packages/core/dist/src/utils/errors.js"() {
     "use strict";
@@ -67362,6 +67376,7 @@ var init_errors2 = __esm({
         this.name = "ChangeAuthRequestedError";
       }
     };
+    HTTP_401_REGEX = /(?:\bHTTP(?:\/\d(?:\.\d)?)?(?:\s+(?:status|error))?|(?<!\b(?:exit|exited)\s+(?:with\s+)?)\bstatus(?:code|\s*code)?)[:\s]+401\b|(?:\b401\b[^\w\r\n]{1,4}\bUnauthorized\b|\bUnauthorized\b[^\w\r\n]{1,4}\b401\b)/i;
   }
 });
 
@@ -121054,8 +121069,8 @@ var require_utils7 = __commonJS({
     var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
     var HOST_DELIM_RE = /[@/?#:]/g;
     var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
-    function reescapeHostDelimiters(host, isIP4) {
-      const re3 = isIP4 ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
+    function reescapeHostDelimiters(host, isIP5) {
+      const re3 = isIP5 ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
       re3.lastIndex = 0;
       return host.replace(re3, (ch) => HOST_DELIMS[ch]);
     }
@@ -121537,7 +121552,7 @@ var require_fast_uri = __commonJS({
         fragment: void 0
       };
       let malformedAuthorityOrPort = false;
-      let isIP4 = false;
+      let isIP5 = false;
       if (options.reference === "suffix") {
         if (options.scheme) {
           uri = options.scheme + ":" + uri;
@@ -121567,9 +121582,9 @@ var require_fast_uri = __commonJS({
           if (ipv4result === false) {
             const ipv6result = normalizeIPv6(parsed.host);
             parsed.host = ipv6result.host.toLowerCase();
-            isIP4 = ipv6result.isIPV6;
+            isIP5 = ipv6result.isIPV6;
           } else {
-            isIP4 = true;
+            isIP5 = true;
           }
         }
         if (parsed.scheme === void 0 && parsed.userinfo === void 0 && parsed.host === void 0 && parsed.port === void 0 && parsed.query === void 0 && !parsed.path) {
@@ -121586,7 +121601,7 @@ var require_fast_uri = __commonJS({
         }
         const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
         if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-          if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP4 === false && nonSimpleDomain(parsed.host)) {
+          if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP5 === false && nonSimpleDomain(parsed.host)) {
             try {
               parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
             } catch (e3) {
@@ -121600,7 +121615,7 @@ var require_fast_uri = __commonJS({
               parsed.scheme = unescape(parsed.scheme);
             }
             if (parsed.host !== void 0) {
-              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP4);
+              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP5);
             }
           }
           if (parsed.path) {
@@ -131230,7 +131245,7 @@ var init_schemaValidator = __esm({
 });
 
 // packages/core/dist/src/utils/markdownUtils.js
-function isRecord(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 var init_markdownUtils = __esm({
@@ -131668,7 +131683,7 @@ var init_tools = __esm({
        * Type guard to check if an unknown value represents a ToolParameterSchema object.
        */
       isParameterSchema(obj) {
-        return isRecord(obj) && "type" in obj;
+        return isRecord2(obj) && "type" in obj;
       }
       /**
        * Adds the `wait_for_previous` parameter to the tool's schema.
@@ -131681,7 +131696,7 @@ var init_tools = __esm({
         const props = schema2.properties;
         let propertiesObj = {};
         if (props !== void 0) {
-          if (!isRecord(props)) {
+          if (!isRecord2(props)) {
             return schema2;
           }
           propertiesObj = props;
@@ -139286,7 +139301,7 @@ var init_keychainService = __esm({
       async loadKeychainModule() {
         const moduleName = "@github/keytar";
         const module2 = await import(moduleName);
-        const potential = isRecord(module2) && module2["default"] || module2;
+        const potential = isRecord2(module2) && module2["default"] || module2;
         const result2 = KeychainSchema.safeParse(potential);
         if (result2.success) {
           return potential;
@@ -221428,8 +221443,8 @@ var GIT_COMMIT_INFO, CLI_VERSION;
 var init_git_commit = __esm({
   "packages/core/dist/src/generated/git-commit.js"() {
     "use strict";
-    GIT_COMMIT_INFO = "ed96faedf";
-    CLI_VERSION = "0.66.0-nightly.20261019.ged96faedf";
+    GIT_COMMIT_INFO = "b041de017";
+    CLI_VERSION = "0.66.0-preview.0";
   }
 });
 
@@ -323899,7 +323914,7 @@ var require_dump = __commonJS({
 var require_dns = __commonJS({
   "packages/core/node_modules/undici/lib/interceptor/dns.js"(exports2, module2) {
     "use strict";
-    var { isIP: isIP4 } = __require("node:net");
+    var { isIP: isIP5 } = __require("node:net");
     var { lookup: lookup3 } = __require("node:dns");
     var DecoratorHandler = require_decorator_handler();
     var { InvalidArgumentError, InformationalError } = require_errors7();
@@ -324198,7 +324213,7 @@ var require_dns = __commonJS({
       return (dispatch) => {
         return function dnsInterceptor(origDispatchOpts, handler) {
           const origin = origDispatchOpts.origin.constructor === URL ? origDispatchOpts.origin : new URL(origDispatchOpts.origin);
-          if (isIP4(origin.hostname) !== 0) {
+          if (isIP5(origin.hostname) !== 0) {
             return dispatch(origDispatchOpts, handler);
           }
           instance2.runLookup(origin, origDispatchOpts, (err2, newOrigin) => {
@@ -337767,7 +337782,7 @@ function getVersion() {
   }
   versionPromise = (async () => {
     const pkgJson = await getPackageJson(__dirname4);
-    return "0.66.0-nightly.20261019.ged96faedf";
+    return "0.66.0-preview.0";
   })();
   return versionPromise;
 }
@@ -339540,8 +339555,8 @@ var init_baseLlmClient = __esm({
           }
         }, shouldRetryOnContent, "generateJson", role);
         const parsed = JSON.parse(this.cleanJsonResponse(getResponseText(result2).trim(), model));
-        const isRecord3 = (val) => typeof val === "object" && val !== null && !Array.isArray(val);
-        if (isRecord3(parsed)) {
+        const isRecord4 = (val) => typeof val === "object" && val !== null && !Array.isArray(val);
+        if (isRecord4(parsed)) {
           return parsed;
         }
         throw new Error("Invalid JSON response format from LLM");
@@ -345588,7 +345603,7 @@ function getSafeGitEnv(baseEnv = process.env) {
     GIT_SSH_COMMAND: gitSshCommand,
     GH_PROMPT_DISABLED: "1",
     GCM_INTERACTIVE: "never",
-    GIT_CONFIG_GLOBAL: devNullPath,
+    ...baseEnv["GIT_CONFIG_GLOBAL"] ? { GIT_CONFIG_GLOBAL: baseEnv["GIT_CONFIG_GLOBAL"] } : {},
     GIT_CONFIG_SYSTEM: devNullPath,
     GIT_CONFIG_NOSYSTEM: "1",
     GIT_CONFIG_COUNT: "7",
@@ -359579,12 +359594,14 @@ ${truncated}`;
         for (const key of gitConfigKeys) {
           baseEnv[key] = sourceEnv[key];
         }
+        if (!baseEnv["GIT_CONFIG_GLOBAL"]) {
+          delete baseEnv["GIT_CONFIG_GLOBAL"];
+        }
         let gitConfigCount = parseInt(baseEnv["GIT_CONFIG_COUNT"] || "0", 10);
         const devNullPath = os31.platform() === "win32" ? "NUL" : "/dev/null";
-        baseEnv["GIT_CONFIG_GLOBAL"] = devNullPath;
         baseEnv["GIT_CONFIG_SYSTEM"] = devNullPath;
         baseEnv["GIT_CONFIG_NOSYSTEM"] = "1";
-        sanitizationConfig.allowedEnvironmentVariables.push("GIT_CONFIG_COUNT", "GIT_CONFIG_GLOBAL", "GIT_CONFIG_SYSTEM", "GIT_CONFIG_NOSYSTEM");
+        sanitizationConfig.allowedEnvironmentVariables.push("GIT_CONFIG_COUNT", "GIT_CONFIG_SYSTEM", "GIT_CONFIG_NOSYSTEM");
         const defaultGitOverrides = [
           ["credential.helper", ""],
           ["core.fsmonitor", ""],
@@ -361815,6 +361832,31 @@ function isAddressPrivate(address) {
     return true;
   }
 }
+function isEnterprisePrivateAddress(addressOrHost) {
+  const normalized = sanitizeHostname(addressOrHost).toLowerCase();
+  if (normalized.endsWith(".internal") || normalized.endsWith(".local")) {
+    return true;
+  }
+  if (normalized === "localhost" || normalized.endsWith(".localhost")) {
+    return false;
+  }
+  try {
+    if (!import_ipaddr.default.isValid(normalized)) {
+      return false;
+    }
+    let addr2 = import_ipaddr.default.parse(normalized);
+    if (addr2 instanceof import_ipaddr.default.IPv6 && addr2.isIPv4MappedAddress()) {
+      addr2 = addr2.toIPv4Address();
+    }
+    if (isBenchmarkAddress(addr2)) {
+      return false;
+    }
+    const range2 = addr2.range();
+    return range2 === "private" || range2 === "carrierGradeNat" || range2 === "uniqueLocal";
+  } catch {
+    return false;
+  }
+}
 async function isPrivateIpAsync(url5) {
   let parsedUrl;
   try {
@@ -377161,6 +377203,7 @@ var init_http_provider = __esm({
 
 // packages/core/dist/src/mcp/oauth-utils.js
 import { lookup as lookup2 } from "node:dns/promises";
+import { isIP as isIP4 } from "node:net";
 function isLoopbackUrl(urlStr) {
   try {
     const url5 = new URL(urlStr);
@@ -377212,7 +377255,14 @@ async function validateOAuthEndpointUrl(urlStr, options) {
     return parsed.toString();
   }
   if (isAddressPrivate(hostname3)) {
-    throw new OAuthSecurityError(`OAuth endpoint "${resolvedUrl}" points to private or reserved IP address which is blocked.`);
+    const isEnterprisePrivate = isEnterprisePrivateAddress(hostname3);
+    if (!options?.allowPrivateNetwork || !isEnterprisePrivate) {
+      const hint = isEnterprisePrivate ? ` ${PRIVATE_NETWORK_REMEDIATION_HINT}` : "";
+      throw new OAuthSecurityError(`OAuth endpoint "${resolvedUrl}" points to private or reserved IP address which is blocked.${hint}`);
+    }
+    if (isIP4(hostname3) !== 0) {
+      return parsed.toString();
+    }
   }
   try {
     const addresses = await lookup2(hostname3, { all: true });
@@ -377221,7 +377271,11 @@ async function validateOAuthEndpointUrl(urlStr, options) {
     }
     for (const addr2 of addresses) {
       if (isAddressPrivate(addr2.address)) {
-        throw new OAuthSecurityError(`OAuth endpoint "${resolvedUrl}" resolves to private network address "${addr2.address}" which is blocked.`);
+        const isEnterprisePrivate = isEnterprisePrivateAddress(addr2.address);
+        if (!options?.allowPrivateNetwork || !isEnterprisePrivate) {
+          const hint = isEnterprisePrivate ? ` ${PRIVATE_NETWORK_REMEDIATION_HINT}` : "";
+          throw new OAuthSecurityError(`OAuth endpoint "${resolvedUrl}" resolves to private network address "${addr2.address}" which is blocked.${hint}`);
+        }
       }
     }
   } catch (error2) {
@@ -377232,7 +377286,7 @@ async function validateOAuthEndpointUrl(urlStr, options) {
   }
   return parsed.toString();
 }
-var ResourceMismatchError, OAuthSecurityError, FIVE_MIN_BUFFER_MS, OAuthUtils;
+var ResourceMismatchError, OAuthSecurityError, PRIVATE_NETWORK_REMEDIATION_HINT, FIVE_MIN_BUFFER_MS, OAuthUtils;
 var init_oauth_utils = __esm({
   "packages/core/dist/src/mcp/oauth-utils.js"() {
     "use strict";
@@ -377251,6 +377305,7 @@ var init_oauth_utils = __esm({
         this.name = "OAuthSecurityError";
       }
     };
+    PRIVATE_NETWORK_REMEDIATION_HINT = 'Set "oauth.allowPrivateNetwork": true in settings.json for this MCP server if it is on a trusted private network.';
     FIVE_MIN_BUFFER_MS = 5 * 60 * 1e3;
     OAuthUtils = class {
       /**
@@ -377287,7 +377342,8 @@ var init_oauth_utils = __esm({
         try {
           const validatedUrl = await validateOAuthEndpointUrl(resourceMetadataUrl, {
             allowLoopback: options?.allowLoopback,
-            expectedOrigin: options?.expectedOrigin
+            expectedOrigin: options?.expectedOrigin,
+            allowPrivateNetwork: options?.allowPrivateNetwork
           });
           const response = await fetch(validatedUrl);
           if (!response.ok) {
@@ -377312,7 +377368,8 @@ var init_oauth_utils = __esm({
       static async fetchAuthorizationServerMetadata(authServerMetadataUrl, options) {
         try {
           const validatedUrl = await validateOAuthEndpointUrl(authServerMetadataUrl, {
-            allowLoopback: options?.allowLoopback
+            allowLoopback: options?.allowLoopback,
+            allowPrivateNetwork: options?.allowPrivateNetwork
           });
           const response = await fetch(validatedUrl);
           if (!response.ok) {
@@ -377358,7 +377415,8 @@ var init_oauth_utils = __esm({
        */
       static async discoverAuthorizationServerMetadata(authServerUrl, options) {
         const validatedBaseUrl = await validateOAuthEndpointUrl(authServerUrl, {
-          allowLoopback: options?.allowLoopback
+          allowLoopback: options?.allowLoopback,
+          allowPrivateNetwork: options?.allowPrivateNetwork
         });
         const authServerUrlObj = new URL(validatedBaseUrl);
         const base = `${authServerUrlObj.protocol}//${authServerUrlObj.host}`;
@@ -377385,17 +377443,18 @@ var init_oauth_utils = __esm({
        * @param serverUrl The base URL of the server
        * @returns The discovered OAuth configuration or null if not available
        */
-      static async discoverOAuthConfig(serverUrl) {
+      static async discoverOAuthConfig(serverUrl, options) {
         try {
           const allowLoopback = isLoopbackUrl(serverUrl);
+          const allowPrivateNetwork = options?.allowPrivateNetwork;
           const expectedOrigin = new URL(serverUrl).origin;
           const wellKnownUrls = this.buildWellKnownUrls(serverUrl);
-          let resourceMetadata = await this.fetchProtectedResourceMetadata(wellKnownUrls.protectedResource, { allowLoopback, expectedOrigin });
+          let resourceMetadata = await this.fetchProtectedResourceMetadata(wellKnownUrls.protectedResource, { allowLoopback, expectedOrigin, allowPrivateNetwork });
           if (!resourceMetadata) {
             const url5 = new URL(serverUrl);
             if (url5.pathname && url5.pathname !== "/") {
               const rootBasedUrls = this.buildWellKnownUrls(serverUrl, true);
-              resourceMetadata = await this.fetchProtectedResourceMetadata(rootBasedUrls.protectedResource, { allowLoopback, expectedOrigin });
+              resourceMetadata = await this.fetchProtectedResourceMetadata(rootBasedUrls.protectedResource, { allowLoopback, expectedOrigin, allowPrivateNetwork });
             }
           }
           if (resourceMetadata) {
@@ -377404,11 +377463,13 @@ var init_oauth_utils = __esm({
               throw new ResourceMismatchError(`Protected resource ${resourceMetadata.resource} does not match expected ${expectedResource}`);
             }
           }
+          const authServerDiscoveryOptions = {
+            allowLoopback,
+            ...allowPrivateNetwork !== void 0 ? { allowPrivateNetwork } : {}
+          };
           if (resourceMetadata?.authorization_servers?.length) {
             const authServerUrl = resourceMetadata.authorization_servers[0];
-            const authServerMetadata2 = await this.discoverAuthorizationServerMetadata(authServerUrl, {
-              allowLoopback
-            });
+            const authServerMetadata2 = await this.discoverAuthorizationServerMetadata(authServerUrl, authServerDiscoveryOptions);
             if (authServerMetadata2) {
               const config2 = this.metadataToOAuthConfig(authServerMetadata2);
               if (authServerMetadata2.registration_endpoint) {
@@ -377418,9 +377479,7 @@ var init_oauth_utils = __esm({
             }
           }
           debugLogger.debug(`Trying OAuth discovery fallback at ${serverUrl}`);
-          const authServerMetadata = await this.discoverAuthorizationServerMetadata(serverUrl, {
-            allowLoopback
-          });
+          const authServerMetadata = await this.discoverAuthorizationServerMetadata(serverUrl, authServerDiscoveryOptions);
           if (authServerMetadata) {
             const config2 = this.metadataToOAuthConfig(authServerMetadata);
             if (authServerMetadata.registration_endpoint) {
@@ -377457,22 +377516,25 @@ var init_oauth_utils = __esm({
        * @param mcpServerUrl Optional MCP server URL to validate against the resource metadata
        * @returns The discovered OAuth configuration or null if not available
        */
-      static async discoverOAuthFromWWWAuthenticate(wwwAuthenticate, mcpServerUrl) {
+      static async discoverOAuthFromWWWAuthenticate(wwwAuthenticate, mcpServerUrl, options) {
         const resourceMetadataUri = this.parseWWWAuthenticateHeader(wwwAuthenticate);
         if (!resourceMetadataUri) {
           return null;
         }
         const allowLoopback = mcpServerUrl ? isLoopbackUrl(mcpServerUrl) : false;
+        const allowPrivateNetwork = options?.allowPrivateNetwork;
         const expectedOrigin = mcpServerUrl ? new URL(mcpServerUrl).origin : void 0;
         const validatedResourceMetadataUrl = await validateOAuthEndpointUrl(resourceMetadataUri, {
           allowLoopback,
           expectedOrigin,
           allowRelative: true,
-          baseUri: mcpServerUrl
+          baseUri: mcpServerUrl,
+          allowPrivateNetwork
         });
         const resourceMetadata = await this.fetchProtectedResourceMetadata(validatedResourceMetadataUrl, {
           allowLoopback,
-          expectedOrigin
+          expectedOrigin,
+          allowPrivateNetwork
         });
         if (resourceMetadata && mcpServerUrl) {
           const expectedResource = this.buildResourceParameter(mcpServerUrl);
@@ -377485,7 +377547,8 @@ var init_oauth_utils = __esm({
         }
         const authServerUrl = resourceMetadata.authorization_servers[0];
         const authServerMetadata = await this.discoverAuthorizationServerMetadata(authServerUrl, {
-          allowLoopback
+          allowLoopback,
+          ...allowPrivateNetwork !== void 0 ? { allowPrivateNetwork } : {}
         });
         if (authServerMetadata) {
           return this.metadataToOAuthConfig(authServerMetadata);
@@ -381423,7 +381486,7 @@ async function parseTokenEndpointResponse(response, operationName, defaultErrorC
     scope: scope || void 0
   };
 }
-async function exchangeCodeForToken(config2, code, codeVerifier, redirectPort, resource) {
+async function exchangeCodeForToken(config2, code, codeVerifier, redirectPort, resource, options) {
   const redirectUri = getRedirectUri(config2, redirectPort);
   const params = new URLSearchParams({
     grant_type: "authorization_code",
@@ -381443,7 +381506,8 @@ async function exchangeCodeForToken(config2, code, codeVerifier, redirectPort, r
   }
   const allowLoopback = resource ? isLoopbackUrl(resource) : isLoopbackUrl(config2.tokenUrl);
   const validatedTokenUrl = await validateOAuthEndpointUrl(config2.tokenUrl, {
-    allowLoopback
+    allowLoopback,
+    allowPrivateNetwork: options?.allowPrivateNetwork
   });
   const response = await fetch(validatedTokenUrl, {
     method: "POST",
@@ -381455,7 +381519,7 @@ async function exchangeCodeForToken(config2, code, codeVerifier, redirectPort, r
   });
   return parseTokenEndpointResponse(response, "Token exchange", "no_access_token");
 }
-async function refreshAccessToken(config2, refreshToken, tokenUrl, resource) {
+async function refreshAccessToken(config2, refreshToken, tokenUrl, resource, options) {
   const params = new URLSearchParams({
     grant_type: "refresh_token",
     refresh_token: refreshToken,
@@ -381475,7 +381539,8 @@ async function refreshAccessToken(config2, refreshToken, tokenUrl, resource) {
   }
   const allowLoopback = resource ? isLoopbackUrl(resource) : isLoopbackUrl(tokenUrl);
   const validatedTokenUrl = await validateOAuthEndpointUrl(tokenUrl, {
-    allowLoopback
+    allowLoopback,
+    allowPrivateNetwork: options?.allowPrivateNetwork
   });
   const response = await fetch(validatedTokenUrl, {
     method: "POST",
@@ -385582,7 +385647,7 @@ function isNumberArray(value) {
 }
 function isTaskArray(value) {
   return Array.isArray(value) && value.every((item) => {
-    if (!isRecord(item))
+    if (!isRecord2(item))
       return false;
     const id = item["id"];
     const desc = item["description"];
@@ -385599,7 +385664,7 @@ function isSnapshotState(text) {
   }
   try {
     const parsed = JSON.parse(trimmed2);
-    if (!isRecord(parsed))
+    if (!isRecord2(parsed))
       return false;
     const isSnap = Array.isArray(parsed["active_tasks"]) && Array.isArray(parsed["discovered_facts"]) && Array.isArray(parsed["constraints_and_preferences"]) && Array.isArray(parsed["recent_arc"]);
     if (!isSnap) {
@@ -385653,7 +385718,7 @@ var init_snapshotGenerator = __esm({
         if (previousStateJson) {
           try {
             const parsed = JSON.parse(previousStateJson);
-            if (isRecord(parsed)) {
+            if (isRecord2(parsed)) {
               let loadedArc = [];
               if (isStringArray(parsed["recent_arc"])) {
                 loadedArc = parsed["recent_arc"];
@@ -385750,7 +385815,7 @@ ${formatNodesForLlm(nodes)}`;
             promptId: this.env.promptId,
             abortSignal: new AbortController().signal
           });
-          if (isRecord(result2)) {
+          if (isRecord2(result2)) {
             patch = result2;
           }
         } catch {
@@ -385782,7 +385847,7 @@ ${formatNodesForLlm(nodes)}`;
         const newTasks = patch["new_tasks"];
         if (Array.isArray(newTasks)) {
           for (const t3 of newTasks) {
-            if (isRecord(t3)) {
+            if (isRecord2(t3)) {
               const desc = t3["description"];
               if (typeof desc === "string" && desc) {
                 newState.active_tasks.push({
@@ -395716,11 +395781,11 @@ var init_agent_tool = __esm({
       }
       mapParams(prompt, schema2) {
         const schemaObj = schema2;
-        if (!isRecord(schemaObj)) {
+        if (!isRecord2(schemaObj)) {
           return { prompt };
         }
         const properties = schemaObj["properties"];
-        if (isRecord(properties)) {
+        if (isRecord2(properties)) {
           const keys = Object.keys(properties);
           if (keys.length === 1) {
             return { [keys[0]]: prompt };
@@ -395802,11 +395867,11 @@ var init_agent_tool = __esm({
           return agentArgs;
         }
         const schemaObj = this.definition.inputConfig.inputSchema;
-        if (!isRecord(schemaObj)) {
+        if (!isRecord2(schemaObj)) {
           return agentArgs;
         }
         const properties = schemaObj["properties"];
-        if (isRecord(properties)) {
+        if (isRecord2(properties)) {
           const keys = Object.keys(properties);
           const primaryKey = keys.length === 1 ? keys[0] : "prompt";
           const value = agentArgs[primaryKey];
@@ -396344,8 +396409,8 @@ ${reminder}`;
             throw new Error("Invalid response from Local Gemini API: No text found");
           }
           const parsed = JSON.parse(result2.text);
-          const isRecord3 = (val) => typeof val === "object" && val !== null && !Array.isArray(val);
-          if (isRecord3(parsed)) {
+          const isRecord4 = (val) => typeof val === "object" && val !== null && !Array.isArray(val);
+          if (isRecord4(parsed)) {
             return parsed;
           }
           throw new Error("Invalid JSON response format from Local LLM");
@@ -401411,7 +401476,7 @@ Please fix the configuration file and try again.`);
 function parseTrustedFoldersJson(content) {
   return JSON.parse((0, import_strip_json_comments.default)(content));
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function getRealPath(location) {
@@ -401438,7 +401503,7 @@ function loadTrustedFolders() {
     if (fs72.existsSync(userPath)) {
       const content = fs72.readFileSync(userPath, "utf-8");
       const parsed = parseTrustedFoldersJson(content);
-      if (!isRecord2(parsed)) {
+      if (!isRecord3(parsed)) {
         errors.push({
           message: "Trusted folders file is not a valid JSON object.",
           path: userPath
@@ -401582,7 +401647,7 @@ Please fix the file manually before trying to update it.`);
           const config2 = {};
           try {
             const parsed = parseTrustedFoldersJson(content);
-            if (isRecord2(parsed)) {
+            if (isRecord3(parsed)) {
               for (const [rawPath, value] of Object.entries(parsed)) {
                 if (isTrustLevel(value)) {
                   config2[rawPath] = value;
@@ -405457,7 +405522,7 @@ var init_policy_engine = __esm({
         let decision;
         const toolNamesToTry = toolCall.name ? getToolAliases(toolCall.name) : [];
         if (toolCall.name === AGENT_TOOL_NAME) {
-          if (isRecord(toolCall.args)) {
+          if (isRecord2(toolCall.args)) {
             const subagentName = toolCall.args["agent_name"];
             if (typeof subagentName === "string") {
               toolNamesToTry.push(subagentName);
@@ -410840,7 +410905,8 @@ var init_oauth_provider = __esm({
       async registerClient(registrationUrl, config2, redirectPort, mcpServerUrl) {
         const allowLoopback = mcpServerUrl ? isLoopbackUrl(mcpServerUrl) : isLoopbackUrl(registrationUrl);
         const validatedRegistrationUrl = await validateOAuthEndpointUrl(registrationUrl, {
-          allowLoopback
+          allowLoopback,
+          allowPrivateNetwork: config2.allowPrivateNetwork
         });
         const redirectUri = getRedirectUri(config2, redirectPort);
         const registrationRequest = {
@@ -410871,10 +410937,10 @@ var init_oauth_provider = __esm({
        * @param mcpServerUrl The MCP server URL
        * @returns OAuth configuration if discovered, null otherwise
        */
-      async discoverOAuthFromMCPServer(mcpServerUrl) {
-        return OAuthUtils.discoverOAuthConfig(mcpServerUrl);
+      async discoverOAuthFromMCPServer(mcpServerUrl, options) {
+        return OAuthUtils.discoverOAuthConfig(mcpServerUrl, options);
       }
-      async discoverAuthServerMetadataForRegistration(issuer, mcpServerUrl) {
+      async discoverAuthServerMetadataForRegistration(issuer, mcpServerUrl, options) {
         const allowLoopback = mcpServerUrl ? isLoopbackUrl(mcpServerUrl) : isLoopbackUrl(issuer);
         const authUrl = new URL9(issuer);
         const oidcPatterns = [
@@ -410910,7 +410976,10 @@ var init_oauth_provider = __esm({
         let discoveredMetadata = null;
         for (const issuerCandidate of attemptedIssuers) {
           debugLogger.debug(`   Trying issuer URL: ${issuerCandidate}`);
-          const metadata2 = await OAuthUtils.discoverAuthorizationServerMetadata(issuerCandidate, { allowLoopback });
+          const metadata2 = await OAuthUtils.discoverAuthorizationServerMetadata(issuerCandidate, {
+            allowLoopback,
+            ...options?.allowPrivateNetwork !== void 0 ? { allowPrivateNetwork: options.allowPrivateNetwork } : {}
+          });
           if (metadata2) {
             selectedIssuer = issuerCandidate;
             discoveredMetadata = metadata2;
@@ -410958,7 +411027,7 @@ var init_oauth_provider = __esm({
           clientSecret: config2.clientSecret,
           scopes: config2.scopes,
           audiences: config2.audiences
-        }, refreshToken, tokenUrl, this.buildResourceParam(mcpServerUrl));
+        }, refreshToken, tokenUrl, this.buildResourceParam(mcpServerUrl), { allowPrivateNetwork: config2.allowPrivateNetwork });
       }
       /**
        * Perform the full OAuth authorization code flow with PKCE.
@@ -410985,7 +411054,7 @@ var init_oauth_provider = __esm({
             if (response.status === 401 || response.status === 307) {
               const wwwAuthenticate = response.headers.get("www-authenticate");
               if (wwwAuthenticate) {
-                const discoveredConfig = await OAuthUtils.discoverOAuthFromWWWAuthenticate(wwwAuthenticate, mcpServerUrl);
+                const discoveredConfig = await OAuthUtils.discoverOAuthFromWWWAuthenticate(wwwAuthenticate, mcpServerUrl, { allowPrivateNetwork: config2.allowPrivateNetwork });
                 if (discoveredConfig) {
                   config2 = {
                     ...config2,
@@ -411008,7 +411077,7 @@ var init_oauth_provider = __esm({
             debugLogger.debug(`Failed to check endpoint for authentication requirements: ${getErrorMessage(error2)}`);
           }
           if (!config2.authorizationUrl) {
-            const discoveredConfig = await this.discoverOAuthFromMCPServer(mcpServerUrl);
+            const discoveredConfig = await this.discoverOAuthFromMCPServer(mcpServerUrl, { allowPrivateNetwork: config2.allowPrivateNetwork });
             if (discoveredConfig) {
               config2 = {
                 ...config2,
@@ -411027,74 +411096,91 @@ var init_oauth_provider = __esm({
             }
           }
         }
+        const allowLoopback = mcpServerUrl ? isLoopbackUrl(mcpServerUrl) : (config2.authorizationUrl ? isLoopbackUrl(config2.authorizationUrl) : false) || (config2.tokenUrl ? isLoopbackUrl(config2.tokenUrl) : false);
+        if (config2.authorizationUrl) {
+          await validateOAuthEndpointUrl(config2.authorizationUrl, {
+            allowLoopback,
+            allowPrivateNetwork: config2.allowPrivateNetwork
+          });
+        }
+        if (config2.tokenUrl) {
+          await validateOAuthEndpointUrl(config2.tokenUrl, {
+            allowLoopback,
+            allowPrivateNetwork: config2.allowPrivateNetwork
+          });
+        }
         const pkceParams = generatePKCEParams();
         const preferredPort = getPortFromUrl(config2.redirectUri);
         debugLogger.debug(`Starting callback server for "${serverName}" (expected issuer: ${config2.issuer || "none"})...`);
         const requireIssInResponse = config2.authorizationResponseIssParameterSupported ?? Boolean(config2.issuer);
         const callbackServer = startCallbackServer(pkceParams.state, preferredPort, config2.issuer, requireIssInResponse);
-        const redirectPort = await callbackServer.port;
-        debugLogger.debug(`Callback server listening on port ${redirectPort}`);
-        if (!config2.clientId) {
-          let registrationUrl = config2.registrationUrl;
-          if (!registrationUrl) {
-            if (!config2.issuer) {
-              throw new Error("Cannot perform dynamic registration without issuer");
-            }
-            debugLogger.debug("\u2192 Attempting dynamic client registration...");
-            const { metadata: authServerMetadata } = await this.discoverAuthServerMetadataForRegistration(config2.issuer, mcpServerUrl);
-            registrationUrl = authServerMetadata.registration_endpoint;
-          }
-          if (registrationUrl) {
-            const clientRegistration = await this.registerClient(registrationUrl, config2, redirectPort, mcpServerUrl);
-            config2.clientId = clientRegistration.client_id;
-            if (clientRegistration.client_secret) {
-              config2.clientSecret = clientRegistration.client_secret;
-            }
-            debugLogger.debug("\u2713 Dynamic client registration successful");
-          } else {
-            throw new Error("No client ID provided and dynamic registration not supported");
-          }
-        }
-        if (!config2.clientId || !config2.authorizationUrl || !config2.tokenUrl) {
-          throw new Error("Missing required OAuth configuration after discovery and registration");
-        }
-        const allowLoopback = mcpServerUrl ? isLoopbackUrl(mcpServerUrl) : (config2.authorizationUrl ? isLoopbackUrl(config2.authorizationUrl) : false) || (config2.tokenUrl ? isLoopbackUrl(config2.tokenUrl) : false);
-        await validateOAuthEndpointUrl(config2.authorizationUrl, {
-          allowLoopback
-        });
-        await validateOAuthEndpointUrl(config2.tokenUrl, {
-          allowLoopback
+        callbackServer.response.catch(() => {
         });
-        const flowConfig = {
-          clientId: config2.clientId,
-          clientSecret: config2.clientSecret,
-          authorizationUrl: config2.authorizationUrl,
-          tokenUrl: config2.tokenUrl,
-          scopes: config2.scopes,
-          audiences: config2.audiences,
-          redirectUri: config2.redirectUri
-        };
-        const resource = this.buildResourceParam(mcpServerUrl);
-        const authUrl = buildAuthorizationUrl(flowConfig, pkceParams, redirectPort, resource);
-        const userConsent = await getConsentForOauth(`Authentication required for MCP Server: '${serverName}.'`);
-        if (!userConsent) {
-          throw new FatalCancellationError("Authentication cancelled by user.");
-        }
-        displayMessage(`\u2192 Opening your browser for OAuth sign-in...
+        let code;
+        let redirectPort;
+        let flowConfig;
+        let resource;
+        try {
+          redirectPort = await callbackServer.port;
+          debugLogger.debug(`Callback server listening on port ${redirectPort}`);
+          if (!config2.clientId) {
+            let registrationUrl = config2.registrationUrl;
+            if (!registrationUrl) {
+              if (!config2.issuer) {
+                throw new Error("Cannot perform dynamic registration without issuer");
+              }
+              debugLogger.debug("\u2192 Attempting dynamic client registration...");
+              const { metadata: authServerMetadata } = await this.discoverAuthServerMetadataForRegistration(config2.issuer, mcpServerUrl, { allowPrivateNetwork: config2.allowPrivateNetwork });
+              registrationUrl = authServerMetadata.registration_endpoint;
+            }
+            if (registrationUrl) {
+              const clientRegistration = await this.registerClient(registrationUrl, config2, redirectPort, mcpServerUrl);
+              config2.clientId = clientRegistration.client_id;
+              if (clientRegistration.client_secret) {
+                config2.clientSecret = clientRegistration.client_secret;
+              }
+              debugLogger.debug("\u2713 Dynamic client registration successful");
+            } else {
+              throw new Error("No client ID provided and dynamic registration not supported");
+            }
+          }
+          if (!config2.clientId || !config2.authorizationUrl || !config2.tokenUrl) {
+            throw new Error("Missing required OAuth configuration after discovery and registration");
+          }
+          flowConfig = {
+            clientId: config2.clientId,
+            clientSecret: config2.clientSecret,
+            authorizationUrl: config2.authorizationUrl,
+            tokenUrl: config2.tokenUrl,
+            scopes: config2.scopes,
+            audiences: config2.audiences,
+            redirectUri: config2.redirectUri
+          };
+          resource = this.buildResourceParam(mcpServerUrl);
+          const authUrl = buildAuthorizationUrl(flowConfig, pkceParams, redirectPort, resource);
+          const userConsent = await getConsentForOauth(`Authentication required for MCP Server: '${serverName}.'`);
+          if (!userConsent) {
+            throw new FatalCancellationError("Authentication cancelled by user.");
+          }
+          displayMessage(`\u2192 Opening your browser for OAuth sign-in...
 
 If the browser does not open, copy and paste this URL into your browser:
 ${authUrl}
 
 \u{1F4A1} TIP: Triple-click to select the entire URL, then copy and paste it into your browser.
 \u26A0\uFE0F  Make sure to copy the COMPLETE URL - it may wrap across multiple lines.`);
-        try {
-          await openBrowserSecurely(authUrl);
+          try {
+            await openBrowserSecurely(authUrl);
+          } catch (error2) {
+            debugLogger.warn("Failed to open browser automatically:", getErrorMessage(error2));
+          }
+          ({ code } = await callbackServer.response);
         } catch (error2) {
-          debugLogger.warn("Failed to open browser automatically:", getErrorMessage(error2));
+          callbackServer.cancel?.(error2 instanceof Error ? error2 : void 0);
+          throw error2;
         }
-        const { code } = await callbackServer.response;
         debugLogger.debug("\u2713 Authorization code received, exchanging for tokens...");
-        const tokenResponse = await exchangeCodeForToken(flowConfig, code, pkceParams.codeVerifier, redirectPort, resource);
+        const tokenResponse = await exchangeCodeForToken(flowConfig, code, pkceParams.codeVerifier, redirectPort, resource, { allowPrivateNetwork: config2.allowPrivateNetwork });
         if (!tokenResponse.access_token) {
           throw new Error("No access token received from token endpoint");
         }
@@ -411247,7 +411333,7 @@ var init_stored_token_provider = __esm({
         if (this.isCachedTokenValid()) {
           return this.cachedToken;
         }
-        const oauthConfig = this.serverConfig.oauth?.enabled && this.serverConfig.oauth ? this.serverConfig.oauth : {};
+        const oauthConfig = this.serverConfig.oauth ?? {};
         const tokenMeta = await this.oauthProvider.getValidTokenWithMetadata(this.serverName, oauthConfig);
         if (!tokenMeta?.accessToken) {
           this.cachedToken = void 0;
@@ -411414,10 +411500,13 @@ async function handleAutomaticOAuth(mcpServerName, mcpServerConfig, wwwAuthentic
   try {
     debugLogger.log(`\u{1F510} '${mcpServerName}' requires OAuth authentication`);
     const serverUrl = mcpServerConfig.httpUrl || mcpServerConfig.url;
-    let oauthConfig = await OAuthUtils.discoverOAuthFromWWWAuthenticate(wwwAuthenticate, serverUrl);
+    const discoveryOptions = {
+      allowPrivateNetwork: mcpServerConfig.oauth?.allowPrivateNetwork
+    };
+    let oauthConfig = await OAuthUtils.discoverOAuthFromWWWAuthenticate(wwwAuthenticate, serverUrl, discoveryOptions);
     if (!oauthConfig && hasNetworkTransport(mcpServerConfig)) {
       const baseUrl = OAuthUtils.extractBaseUrl(serverUrl);
-      oauthConfig = await OAuthUtils.discoverOAuthConfig(baseUrl);
+      oauthConfig = await OAuthUtils.discoverOAuthConfig(baseUrl, discoveryOptions);
     }
     if (!oauthConfig) {
       cliConfig.emitMcpDiagnostic("error", `Could not configure OAuth for '${mcpServerName}' - please authenticate manually with /mcp auth ${mcpServerName}`, void 0, mcpServerName);
@@ -411429,7 +411518,8 @@ async function handleAutomaticOAuth(mcpServerName, mcpServerConfig, wwwAuthentic
       issuer: oauthConfig.issuer,
       tokenUrl: oauthConfig.tokenUrl,
       scopes: oauthConfig.scopes || [],
-      authorizationResponseIssParameterSupported: mcpServerConfig.oauth?.authorizationResponseIssParameterSupported ?? oauthConfig.authorizationResponseIssParameterSupported
+      authorizationResponseIssParameterSupported: mcpServerConfig.oauth?.authorizationResponseIssParameterSupported ?? oauthConfig.authorizationResponseIssParameterSupported,
+      allowPrivateNetwork: mcpServerConfig.oauth?.allowPrivateNetwork
     };
     debugLogger.log(`Starting OAuth authentication for server '${mcpServerName}'...`);
     const authProvider = new MCPOAuthProvider(new MCPOAuthTokenStorage());
@@ -411631,15 +411721,16 @@ async function invokeMcpPrompt(mcpServerName, mcpClient, promptName, promptParam
 function hasNetworkTransport(config2) {
   return !!(config2.url || config2.httpUrl);
 }
-async function getStoredOAuthToken(serverName) {
+async function getStoredOAuthToken(serverName, oauthConfig) {
   const tokenStorage = new MCPOAuthTokenStorage();
   const credentials3 = await tokenStorage.getCredentials(serverName);
   if (!credentials3)
     return null;
   const authProvider = new MCPOAuthProvider(tokenStorage);
   return authProvider.getValidToken(serverName, {
+    ...oauthConfig,
     // Pass client ID if available
-    clientId: credentials3.clientId
+    clientId: oauthConfig?.clientId ?? credentials3.clientId
   });
 }
 function createSSETransportWithAuth(config2, accessToken) {
@@ -411659,8 +411750,8 @@ async function connectWithSSETransport(client, config2, accessToken) {
     timeout: config2.timeout ?? MCP_DEFAULT_TIMEOUT_MSEC
   });
 }
-async function showAuthRequiredMessage(serverName, cliConfig) {
-  const hasRejectedToken = !!await getStoredOAuthToken(serverName);
+async function showAuthRequiredMessage(serverName, cliConfig, oauthConfig) {
+  const hasRejectedToken = !!await getStoredOAuthToken(serverName, oauthConfig);
   const message = hasRejectedToken ? `MCP server '${serverName}' rejected stored OAuth token. Please re-authenticate using: /mcp auth ${serverName}` : `MCP server '${serverName}' requires authentication using: /mcp auth ${serverName}`;
   cliConfig.emitMcpDiagnostic("info", message, void 0, serverName);
   throw new UnauthorizedError(message);
@@ -411760,7 +411851,7 @@ async function connectToMcpServer(clientVersion, mcpServerName, mcpServerConfig,
       const logMessage = httpReturned404 ? `HTTP returned 404, trying SSE transport...` : `HTTP connection failed, attempting SSE fallback...`;
       debugLogger.log(`MCP server '${mcpServerName}': ${logMessage}`);
       try {
-        await connectWithSSETransport(mcpClient, mcpServerConfig, await getStoredOAuthToken(mcpServerName));
+        await connectWithSSETransport(mcpClient, mcpServerConfig, await getStoredOAuthToken(mcpServerName, mcpServerConfig.oauth));
         debugLogger.log(`MCP server '${mcpServerName}': Successfully connected using SSE transport.`);
         return mcpClient;
       } catch (sseFallbackError) {
@@ -411778,7 +411869,7 @@ async function connectToMcpServer(clientVersion, mcpServerName, mcpServerConfig,
       mcpServerRequiresOAuth.set(mcpServerName, true);
       const shouldTriggerOAuth = mcpServerConfig.oauth?.enabled;
       if (!shouldTriggerOAuth) {
-        await showAuthRequiredMessage(mcpServerName, cliConfig);
+        await showAuthRequiredMessage(mcpServerName, cliConfig, mcpServerConfig.oauth);
       }
       const errorString = String(error2);
       let wwwAuthenticate = extractWWWAuthenticateHeader(errorString);
@@ -411819,7 +411910,7 @@ async function connectToMcpServer(clientVersion, mcpServerName, mcpServerConfig,
         debugLogger.log(`Received 401 with www-authenticate header: ${wwwAuthenticate}`);
         const oauthSuccess = await handleAutomaticOAuth(mcpServerName, mcpServerConfig, wwwAuthenticate, cliConfig);
         if (oauthSuccess) {
-          const accessToken = await getStoredOAuthToken(mcpServerName);
+          const accessToken = await getStoredOAuthToken(mcpServerName, mcpServerConfig.oauth);
           if (!accessToken) {
             throw new Error(`Failed to get OAuth token for server '${mcpServerName}'`);
           }
@@ -411831,13 +411922,16 @@ async function connectToMcpServer(clientVersion, mcpServerName, mcpServerConfig,
       } else {
         const shouldTryDiscovery = mcpServerConfig.oauth?.enabled;
         if (!shouldTryDiscovery) {
-          await showAuthRequiredMessage(mcpServerName, cliConfig);
+          await showAuthRequiredMessage(mcpServerName, cliConfig, mcpServerConfig.oauth);
         }
         debugLogger.log(`\u{1F50D} Attempting OAuth discovery for '${mcpServerName}'...`);
         if (hasNetworkTransport(mcpServerConfig)) {
           const serverUrl = new URL(mcpServerConfig.httpUrl || mcpServerConfig.url);
           const baseUrl = `${serverUrl.protocol}//${serverUrl.host}`;
-          const oauthConfig = await OAuthUtils.discoverOAuthConfig(baseUrl);
+          const discoveryOptions = {
+            allowPrivateNetwork: mcpServerConfig.oauth?.allowPrivateNetwork
+          };
+          const oauthConfig = await OAuthUtils.discoverOAuthConfig(baseUrl, discoveryOptions);
           if (oauthConfig) {
             debugLogger.log(`Discovered OAuth configuration from base URL for server '${mcpServerName}'`);
             const oauthAuthConfig = {
@@ -411846,13 +411940,14 @@ async function connectToMcpServer(clientVersion, mcpServerName, mcpServerConfig,
               issuer: oauthConfig.issuer,
               tokenUrl: oauthConfig.tokenUrl,
               scopes: oauthConfig.scopes || [],
-              authorizationResponseIssParameterSupported: mcpServerConfig.oauth?.authorizationResponseIssParameterSupported ?? oauthConfig.authorizationResponseIssParameterSupported
+              authorizationResponseIssParameterSupported: mcpServerConfig.oauth?.authorizationResponseIssParameterSupported ?? oauthConfig.authorizationResponseIssParameterSupported,
+              allowPrivateNetwork: mcpServerConfig.oauth?.allowPrivateNetwork
             };
             const authServerUrl = mcpServerConfig.httpUrl || mcpServerConfig.url;
             debugLogger.log(`Starting OAuth authentication for server '${mcpServerName}'...`);
             const authProvider = new MCPOAuthProvider(new MCPOAuthTokenStorage());
             await authProvider.authenticate(mcpServerName, oauthAuthConfig, authServerUrl);
-            const accessToken = await getStoredOAuthToken(mcpServerName);
+            const accessToken = await getStoredOAuthToken(mcpServerName, mcpServerConfig.oauth);
             if (!accessToken) {
               throw new Error(`Failed to get OAuth token for server '${mcpServerName}'`);
             }