@google/gemini-cli-core 0.64.0-preview.0 → 0.65.0-nightly.20261007.gef59c532f

package/dist/docs/changelogs/index.md

@@ -18,6 +18,20 @@ on GitHub.
 | [Preview](preview.md) | Experimental features ready for early feedback. |
 | [Stable](latest.md)   | Stable, recommended for general use.            |
 
+## Announcements: v0.63.0 - 2026-10-06
+
+- **Autonomous Plan Execution:** Enabled autonomous plan execution in
+  non-interactive mode to support unattended agent workflows
+  ([#29539](https://github.com/google-gemini/gemini-cli/pull/29539) by
+  @urielefrenvirtusa).
+- **Core Stability and Memory Lifecycle:** Bounded tool output sizes and
+  optimized memory management in long-running agent loops while preventing
+  infinite authentication loops across headless and supervisor environments
+  ([#29451](https://github.com/google-gemini/gemini-cli/pull/29451) by
+  @diegogodinezr,
+  [#29448](https://github.com/google-gemini/gemini-cli/pull/29448) by
+  @villahernandez-coder).
+
 ## Announcements: v0.61.0 - 2026-09-23
 
 - **Core Security Hardening:** Prevented indirect prompt injection

package/dist/docs/changelogs/latest.md

@@ -1,6 +1,6 @@
-# Latest stable release: v0.61.0
+# Latest stable release: v0.63.0
 
-Released: September 23, 2026
+Released: October 6, 2026
 
 For most users, our latest stable release is the recommended release. Install
 the latest stable version with:
@@ -11,41 +11,62 @@ npm install -g @google/gemini-cli
 
 ## Highlights
 
-- **Prompt Injection Defense:** Enhanced security by preventing indirect prompt
-  injection attacks through build file modifications and untrusted command
-  flags.
-- **Sandbox & State Hardening:** Hardened filesystem boundaries and isolated
-  internal runtime state to ensure more secure execution environments.
-- **Agent Loop Robustness:** Guaranteed that internal state properties within
-  `AgentLoopContext` are fully preserved during object spread operations,
-  improving agent reliability.
-- **Versioned Model Preserves:** Ensured explicit versioned Flash model IDs are
-  correctly preserved and used directly during routing and execution.
+- **Autonomous Plan Execution:** Enabled autonomous plan execution in
+  non-interactive mode, allowing automated agent workflows to run multi-step
+  plans without requiring interactive user confirmation.
+- **Memory Lifecycle & Output Bounding:** Bounded tool output sizes and
+  optimized the memory lifecycle in long-running agent loops to prevent memory
+  exhaustion, while formatting full output when truncation is disabled.
+- **Authentication Resilience:** Prevented infinite authentication loops caused
+  by file contention, headless keyring environments, and supervisor state drops,
+  ensuring reliable credential handling across environments.
+- **CLI & Connection Recovery UX:** Displayed a retry progress indicator during
+  connection recovery, restored paused stdin after capability detection, and
+  ensured automatic temporary directory cleanup upon background shell execution
+  exit.
 
 ## What's Changed
 
-- Changelog for v0.60.0-preview.0 by @gemini-cli-robot in
-  [#29251](https://github.com/google-gemini/gemini-cli/pull/29251)
-- chore(release): bump version to 0.61.0-nightly.20260908.gc647533d6 by
+- fix(cli): display retry progress indicator during connection recovery (#28340)
+  by @amelidev in
+  [#29468](https://github.com/google-gemini/gemini-cli/pull/29468)
+- Changelog for v0.61.0-preview.1 by @gemini-cli-robot in
+  [#29469](https://github.com/google-gemini/gemini-cli/pull/29469)
+- Changelog for v0.61.0 by @gemini-cli-robot in
+  [#29472](https://github.com/google-gemini/gemini-cli/pull/29472)
+- fix(cli): distinguish missing MCP enablement config from malformed JSON by
+  @jesussamuel-byte in
+  [#29446](https://github.com/google-gemini/gemini-cli/pull/29446)
+- fix(cli): restore paused stdin after capability detection by @ugorla-dev in
+  [#29487](https://github.com/google-gemini/gemini-cli/pull/29487)
+- fix(core): bound tool output size and optimize memory lifecycle in
+  long-running agent loops by @diegogodinezr in
+  [#29451](https://github.com/google-gemini/gemini-cli/pull/29451)
+- fix(core): remove invalid diff.external override by @urielefrenvirtusa in
+  [#29467](https://github.com/google-gemini/gemini-cli/pull/29467)
+- chore(release): bump version to 0.63.0-nightly.20260923.gf50ba8608 by
   @gemini-cli-robot in
-  [#29254](https://github.com/google-gemini/gemini-cli/pull/29254)
-- Changelog for v0.59.0 by @gemini-cli-robot in
-  [#29253](https://github.com/google-gemini/gemini-cli/pull/29253)
-- fix(core): preserve explicit versioned Flash model IDs by @SandyTao520 in
-  [#29252](https://github.com/google-gemini/gemini-cli/pull/29252)
-- fix(core): prevent indirect prompt injection via build file modifications and
-  untrusted flags by @villahernandez-coder in
-  [#29250](https://github.com/google-gemini/gemini-cli/pull/29250)
-- fix(sandbox): harden filesystem boundaries and isolate runtime state by
-  @diegogodinezr in
-  [#29214](https://github.com/google-gemini/gemini-cli/pull/29214)
-- fix(core): ensure AgentLoopContext properties are preserved across object
-  spread by @diegogodinezr in
-  [#29335](https://github.com/google-gemini/gemini-cli/pull/29335)
-- fix(patch): cherry-pick 62364cb to release/v0.61.0-preview.0-pr-29443 to patch
-  version v0.61.0-preview.0 and create version 0.61.0-preview.1 by
-  @gemini-cli-robot in
-  [#29455](https://github.com/google-gemini/gemini-cli/pull/29455)
+  [#29471](https://github.com/google-gemini/gemini-cli/pull/29471)
+- Changelog for v0.62.0-preview.0 by @gemini-cli-robot in
+  [#29470](https://github.com/google-gemini/gemini-cli/pull/29470)
+- fix(core): clean up temporary directory when background shell execution exits
+  by @jesussamuel-byte in
+  [#29437](https://github.com/google-gemini/gemini-cli/pull/29437)
+- fix(acp): resolve session before config initialization and avoid same-minute
+  filename collisions by @jesussamuel-byte in
+  [#29463](https://github.com/google-gemini/gemini-cli/pull/29463)
+- fix(core): align policy redirection gates, path validation, and workflow
+  parsing by @DavidAPierce in
+  [#29506](https://github.com/google-gemini/gemini-cli/pull/29506)
+- fix(auth): prevent infinite auth loop from file contention, headless keyring,
+  and supervisor state drops (#28341) by @villahernandez-coder in
+  [#29448](https://github.com/google-gemini/gemini-cli/pull/29448)
+- fix(core): enable autonomous plan execution in non-interactive mode by
+  @urielefrenvirtusa in
+  [#29539](https://github.com/google-gemini/gemini-cli/pull/29539)
+- fix(core): disable truncation when maxChars <= 0 in formatTruncatedToolOutput
+  by @diegogodinezr in
+  [#29542](https://github.com/google-gemini/gemini-cli/pull/29542)
 
 **Full Changelog**:
-https://github.com/google-gemini/gemini-cli/compare/v0.60.0...v0.61.0
+https://github.com/google-gemini/gemini-cli/compare/v0.62.0...v0.63.0

package/dist/docs/changelogs/preview.md

@@ -1,6 +1,6 @@
-# Preview release: v0.63.0-preview.0
+# Preview release: v0.64.0-preview.0
 
-Released: September 29, 2026
+Released: October 6, 2026
 
 Our preview release includes the latest, new, and experimental features. This
 release may not be as stable as our [latest weekly release](latest.md).
@@ -13,62 +13,67 @@ npm install -g @google/gemini-cli@preview
 
 ## Highlights
 
-- **Autonomous Plan Execution**: Enabled autonomous plan execution in
-  non-interactive mode, allowing automated agent workflows to run multi-step
-  plans without requiring interactive user confirmation.
-- **Memory Lifecycle & Output Bounding**: Bounded tool output sizes and
-  optimized the memory lifecycle in long-running agent loops to prevent memory
-  leaks, while ensuring full output formatting when truncation is disabled.
-- **Authentication Resilience**: Prevented infinite authentication loops caused
-  by file contention, headless keyring environments, and supervisor state drops,
-  ensuring reliable credential handling across environments.
-- **CLI & Connection Recovery UX**: Displayed a retry progress indicator during
-  connection recovery, restored paused stdin after capability detection, and
-  ensured automatic temporary directory cleanup upon background shell execution
-  exit.
+- **Atomic File Operations & State Recovery**: Serialized file tool operations
+  with atomic writes and introduced atomic CLI state persistence with automatic
+  recovery from backup on corruption.
+- **Chat Recording Optimization**: Implemented append-only delta patching and
+  bounded history windowing in ChatRecordingService to optimize memory and disk
+  efficiency during long-running sessions.
+- **CLI Input & Reference Resolution**: Added support for resolving `@file:line`
+  references, resolved CPU hangs and quote swallowing on `@` symbols within code
+  blocks, and prevented ghost text wrap hangs.
+- **Terminal UI & Interaction Stability**: Ensured Ctrl+C emergency aborts reach
+  active cancellation handlers, made selection list confirmation with Enter and
+  Spacebar reliable, and fixed Windows ConPTY IME cursor forwarding.
 
 ## What's Changed
 
-- fix(cli): display retry progress indicator during connection recovery (#28340)
-  by @amelidev in
-  [#29468](https://github.com/google-gemini/gemini-cli/pull/29468)
-- Changelog for v0.61.0-preview.1 by @gemini-cli-robot in
-  [#29469](https://github.com/google-gemini/gemini-cli/pull/29469)
-- Changelog for v0.61.0 by @gemini-cli-robot in
-  [#29472](https://github.com/google-gemini/gemini-cli/pull/29472)
-- fix(cli): distinguish missing MCP enablement config from malformed JSON by
-  @jesussamuel-byte in
-  [#29446](https://github.com/google-gemini/gemini-cli/pull/29446)
-- fix(cli): restore paused stdin after capability detection by @ugorla-dev in
-  [#29487](https://github.com/google-gemini/gemini-cli/pull/29487)
-- fix(core): bound tool output size and optimize memory lifecycle in
-  long-running agent loops by @diegogodinezr in
-  [#29451](https://github.com/google-gemini/gemini-cli/pull/29451)
-- fix(core): remove invalid diff.external override by @urielefrenvirtusa in
-  [#29467](https://github.com/google-gemini/gemini-cli/pull/29467)
-- chore(release): bump version to 0.63.0-nightly.20260923.gf50ba8608 by
+- refactor(a2a-server): implement V1 to V2 settings migration logic by
+  @jvargassanchez-dot in
+  [#29450](https://github.com/google-gemini/gemini-cli/pull/29450)
+- fix(acp): bridge PromptResponse.usage and emit usage_update notifications
+  (#29389) by @elberthc-byte in
+  [#29549](https://github.com/google-gemini/gemini-cli/pull/29549)
+- Changelog for v0.63.0-preview.0 by @gemini-cli-robot in
+  [#29565](https://github.com/google-gemini/gemini-cli/pull/29565)
+- fix(cli): propagate resolved folder trust state in headless mode (#29031) by
+  @amelidev in [#29528](https://github.com/google-gemini/gemini-cli/pull/29528)
+- chore(release): bump version to 0.64.0-nightly.20260929.gd75234cae by
   @gemini-cli-robot in
-  [#29471](https://github.com/google-gemini/gemini-cli/pull/29471)
-- Changelog for v0.62.0-preview.0 by @gemini-cli-robot in
-  [#29470](https://github.com/google-gemini/gemini-cli/pull/29470)
-- fix(core): clean up temporary directory when background shell execution exits
-  by @jesussamuel-byte in
-  [#29437](https://github.com/google-gemini/gemini-cli/pull/29437)
-- fix(acp): resolve session before config initialization and avoid same-minute
-  filename collisions by @jesussamuel-byte in
-  [#29463](https://github.com/google-gemini/gemini-cli/pull/29463)
-- fix(core): align policy redirection gates, path validation, and workflow
-  parsing by @DavidAPierce in
-  [#29506](https://github.com/google-gemini/gemini-cli/pull/29506)
-- fix(auth): prevent infinite auth loop from file contention, headless keyring,
-  and supervisor state drops (#28341) by @villahernandez-coder in
-  [#29448](https://github.com/google-gemini/gemini-cli/pull/29448)
-- fix(core): enable autonomous plan execution in non-interactive mode by
+  [#29567](https://github.com/google-gemini/gemini-cli/pull/29567)
+- fix(cli): prevent CPU hang and quote swallowing on @ within code (#29434) by
+  @elberthc-byte in
+  [#29557](https://github.com/google-gemini/gemini-cli/pull/29557)
+- fix(core): serialize file tool operations and make writes atomic (#29078) by
+  @elberthc-byte in
+  [#29499](https://github.com/google-gemini/gemini-cli/pull/29499)
+- fix(core): implement append-only delta patching and bounded history windowing
+  in ChatRecordingService by @jvargassanchez-dot in
+  [#29568](https://github.com/google-gemini/gemini-cli/pull/29568)
+- fix(cli): persist state atomically and recover from backup on corruption by
   @urielefrenvirtusa in
-  [#29539](https://github.com/google-gemini/gemini-cli/pull/29539)
-- fix(core): disable truncation when maxChars <= 0 in formatTruncatedToolOutput
-  by @diegogodinezr in
-  [#29542](https://github.com/google-gemini/gemini-cli/pull/29542)
+  [#29558](https://github.com/google-gemini/gemini-cli/pull/29558)
+- fix(cli): ensure Ctrl+C emergency abort reaches cancellation handler during
+  active operations by @urielefrenvirtusa in
+  [#29586](https://github.com/google-gemini/gemini-cli/pull/29586)
+- fix(cli): resolve @file:line references and prevent ghost text wrap hang by
+  @jesussamuel-byte in
+  [#29581](https://github.com/google-gemini/gemini-cli/pull/29581)
+- fix(ui): ensure Windows ConPTY forwards IME cursor position by
+  @jesussamuel-byte in
+  [#29560](https://github.com/google-gemini/gemini-cli/pull/29560)
+- fix(cli): retry directory removal on Windows locking errors during extension
+  updates by @jesussamuel-byte in
+  [#29540](https://github.com/google-gemini/gemini-cli/pull/29540)
+- fix(acp): resolve session by exact id and handle listener cleanup on session
+  failure by @diegogodinezr in
+  [#29580](https://github.com/google-gemini/gemini-cli/pull/29580)
+- fix(cli): preserve scroll position and partition pending height budget by
+  @luisfelipe-alt in
+  [#29520](https://github.com/google-gemini/gemini-cli/pull/29520)
+- fix(cli): ensure Enter and Spacebar reliably confirm selection list options by
+  @ugorla-dev in
+  [#29502](https://github.com/google-gemini/gemini-cli/pull/29502)
 
 **Full Changelog**:
-https://github.com/google-gemini/gemini-cli/compare/v0.62.0-preview.0...v0.63.0-preview.0
+https://github.com/google-gemini/gemini-cli/compare/v0.63.0-preview.0...v0.64.0-preview.0

package/dist/docs/tools/mcp-server.md

@@ -326,17 +326,31 @@ This feature will not work in:
 
 <!-- prettier-ignore -->
 > [!IMPORTANT]
-> To protect against OAuth Identity Provider (IdP) mix-up attacks, Gemini CLI
-> validates the `iss` (issuer) parameter per
-> [RFC 9207](https://www.rfc-editor.org/rfc/rfc9207). When an expected issuer is
-> discovered or configured, authorization servers **must** return the `iss`
-> parameter in the callback redirect matching the issuer URL. Responses missing
-> `iss` or with mismatched issuers are rejected with HTTP 400.
+> Gemini CLI validates the `iss` (issuer) parameter in OAuth authorization
+> responses per [RFC 9207](https://www.rfc-editor.org/rfc/rfc9207) and the MCP
+> specification:
+>
+> - Whenever the `iss` parameter is present in the callback redirect and an
+>   expected `issuer` is discovered or configured, `iss` **must** match the
+>   expected issuer URL.
+> - When the authorization server metadata sets
+>   `authorization_response_iss_parameter_supported: true`, the callback
+>   redirect **must** include the `iss` parameter.
+> - When the discovered authorization server metadata omits
+>   `authorization_response_iss_parameter_supported` or sets it to `false` (for
+>   example, providers that do not declare RFC 9207 support), callbacks without
+>   `iss` are accepted.
+> - When you configure `issuer` explicitly in `settings.json` and Gemini CLI
+>   doesn't discover authorization server metadata, the callback redirect
+>   **must** include the `iss` parameter. To accept callbacks without `iss` for
+>   such a server, set `authorizationResponseIssParameterSupported` to `false`
+>   in the `oauth` configuration.
 
 ##### Expected authorization callback example
 
-When the authorization server redirects the user back to Gemini CLI, the
-redirect URI must include the `iss` parameter:
+When the authorization server declares
+`authorization_response_iss_parameter_supported: true`, the redirect URI must
+include the `iss` parameter:
 
 ```http
 HTTP/1.1 302 Found
@@ -344,10 +358,14 @@ Location: http://localhost:<port>/oauth/callback?code=AUTH_CODE&state=STATE&iss=
 ```
 
 - **Valid response (accepted):** `iss` matches the configured or discovered
-  issuer (`https://auth.example.com`).
-- **Missing `iss` (rejected):**
-  `http://localhost:<port>/oauth/callback?code=AUTH_CODE&state=STATE` (fails
-  with HTTP 400: `Missing issuer parameter in response`).
+  issuer (`https://auth.example.com`), or `iss` is omitted when the discovered
+  metadata doesn't set `authorization_response_iss_parameter_supported` to
+  `true`.
+- **Missing `iss` when required (rejected):**
+  `http://localhost:<port>/oauth/callback?code=AUTH_CODE&state=STATE` when
+  `authorization_response_iss_parameter_supported` is `true`, or when `issuer`
+  is configured explicitly without discovered metadata (fails with HTTP 400:
+  `Missing issuer parameter in response`).
 - **Mismatched `iss` (rejected):** `iss` points to a different domain or
   includes userinfo (fails with HTTP 400: `Issuer mismatch`).
 
@@ -373,6 +391,12 @@ If your remote MCP server uses an authorization server with a known issuer URL:
 }
 ```
 
+With this configuration, Gemini CLI requires the `iss` parameter in the
+authorization callback. If the authorization server doesn't return `iss` in its
+redirects, add `"authorizationResponseIssParameterSupported": false` to the
+`oauth` block. Gemini CLI then accepts callbacks without `iss` while still
+rejecting any `iss` value that doesn't match the configured `issuer`.
+
 #### Managing OAuth authentication
 
 Use the `/mcp auth` command to manage OAuth authentication:
@@ -398,6 +422,11 @@ Use the `/mcp auth` command to manage OAuth authentication:
   if omitted)
 - **`issuer`** (string): Authorization server issuer URL (auto-discovered if
   omitted; validated per RFC 9207)
+- **`authorizationResponseIssParameterSupported`** (boolean): Whether the
+  authorization server returns the `iss` parameter in authorization responses
+  (RFC 9207). Auto-discovered from the authorization server metadata; defaults
+  to `true` when `issuer` is configured explicitly without discovered metadata.
+  Set to `false` to accept callbacks without `iss` for such a server.
 - **`tokenUrl`** (string): OAuth token endpoint (auto-discovered if omitted)
 - **`scopes`** (string[]): Required OAuth scopes
 - **`redirectUri`** (string): Custom redirect URI (defaults to an OS-assigned

package/dist/src/generated/git-commit.d.ts

@@ -3,5 +3,5 @@
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-export declare const GIT_COMMIT_INFO = "fb972b2f8";
-export declare const CLI_VERSION = "0.64.0-preview.0";
+export declare const GIT_COMMIT_INFO = "ef59c532f";
+export declare const CLI_VERSION = "0.65.0-nightly.20261007.gef59c532f";

package/dist/src/generated/git-commit.js

@@ -5,6 +5,6 @@
  */
 // This file is auto-generated by the build script (scripts/generate-git-commit-info.js)
 // Do not edit this file manually.
-export const GIT_COMMIT_INFO = 'fb972b2f8';
-export const CLI_VERSION = '0.64.0-preview.0';
+export const GIT_COMMIT_INFO = 'ef59c532f';
+export const CLI_VERSION = '0.65.0-nightly.20261007.gef59c532f';
 //# sourceMappingURL=git-commit.js.map

package/dist/src/generated/git-commit.js.map

@@ -1 +1 @@
-{"version":3,"file":"git-commit.js","sourceRoot":"","sources":["../../../src/generated/git-commit.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,wFAAwF;AACxF,kCAAkC;AAClC,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAC3C,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC"}
+{"version":3,"file":"git-commit.js","sourceRoot":"","sources":["../../../src/generated/git-commit.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,wFAAwF;AACxF,kCAAkC;AAClC,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAC3C,MAAM,CAAC,MAAM,WAAW,GAAG,oCAAoC,CAAC"}

package/dist/src/mcp/oauth-callback-iss-handling.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export {};

package/dist/src/mcp/oauth-callback-iss-handling.test.js

@@ -0,0 +1,251 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect, vi, beforeEach, afterEach, afterAll, } from 'vitest';
+const mockOpenBrowserSecurely = vi.hoisted(() => vi.fn());
+vi.mock('../utils/secure-browser-launcher.js', () => ({
+    openBrowserSecurely: mockOpenBrowserSecurely,
+}));
+vi.mock('./oauth-token-storage.js', () => {
+    const mockSaveToken = vi.fn();
+    const mockGetCredentials = vi.fn();
+    const mockIsTokenExpired = vi.fn();
+    const mockDeleteCredentials = vi.fn();
+    return {
+        MCPOAuthTokenStorage: vi.fn(() => ({
+            saveToken: mockSaveToken,
+            getCredentials: mockGetCredentials,
+            isTokenExpired: mockIsTokenExpired,
+            deleteCredentials: mockDeleteCredentials,
+        })),
+    };
+});
+vi.mock('../utils/events.js', () => ({
+    coreEvents: {
+        emitFeedback: vi.fn(),
+        emitConsoleLog: vi.fn(),
+    },
+}));
+vi.mock('../utils/authConsent.js', () => ({
+    getConsentForOauth: vi.fn(() => Promise.resolve(true)),
+}));
+vi.mock('../utils/headless.js', () => ({
+    isHeadlessMode: vi.fn(() => false),
+}));
+vi.mock('node:dns/promises', () => ({
+    lookup: vi.fn(),
+}));
+import * as dnsPromises from 'node:dns/promises';
+import ipaddr from 'ipaddr.js';
+import { MCPOAuthProvider } from './oauth-provider.js';
+import { MCPOAuthTokenStorage } from './oauth-token-storage.js';
+import { OAuthUtils } from './oauth-utils.js';
+import { startCallbackServer, REDIRECT_PATH } from '../utils/oauth-flow.js';
+const realFetch = global.fetch;
+const mockFetch = vi.fn();
+global.fetch = mockFetch;
+const createMockResponse = (options) => {
+    const status = options.status ?? (options.ok ? 200 : 400);
+    const headers = new Headers(options.headers ?? {});
+    if (options.contentType) {
+        headers.set('content-type', options.contentType);
+    }
+    return {
+        ok: options.ok,
+        status,
+        headers,
+        text: () => Promise.resolve(options.text ?? ''),
+        json: () => Promise.resolve(options.json ?? {}),
+    };
+};
+describe('OAuth callback iss parameter handling (RFC 9207 & MCP Spec)', () => {
+    const mcpServerUrl = 'https://mcp.notion.com/mcp';
+    const expectedIssuer = 'https://mcp.notion.com';
+    const mismatchIssuer = 'https://other-idp.example.com';
+    const mockTokenResponse = {
+        access_token: 'notion_access_token_123',
+        token_type: 'Bearer',
+        expires_in: 3600,
+        refresh_token: 'notion_refresh_token_456',
+        scope: 'read write',
+    };
+    beforeEach(() => {
+        vi.clearAllMocks();
+        mockOpenBrowserSecurely.mockClear();
+        vi.spyOn(console, 'log').mockImplementation(() => { });
+        vi.spyOn(console, 'warn').mockImplementation(() => { });
+        vi.spyOn(console, 'error').mockImplementation(() => { });
+        vi.mocked(dnsPromises.lookup).mockImplementation(async (hostname) => {
+            if (ipaddr.isValid(hostname)) {
+                return [{ address: hostname, family: hostname.includes(':') ? 6 : 4 }];
+            }
+            return [{ address: '93.184.216.34', family: 4 }];
+        });
+        const tokenStorage = new MCPOAuthTokenStorage();
+        vi.mocked(tokenStorage.saveToken).mockResolvedValue(undefined);
+        vi.mocked(tokenStorage.getCredentials).mockResolvedValue(null);
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+        vi.unstubAllEnvs();
+    });
+    afterAll(() => {
+        // global.fetch is assigned directly (not via vi.spyOn), so
+        // vi.restoreAllMocks() does not revert it. Restore it explicitly to avoid
+        // affecting other suites that share the same worker process.
+        global.fetch = realFetch;
+    });
+    /**
+     * Simulates the browser redirect back to the local callback server and the
+     * token exchange for a given MCPOAuthConfig.
+     */
+    async function runOAuthFlow(oauthAuthConfig, callbackQueryParams) {
+        mockOpenBrowserSecurely.mockImplementation(async (authUrlStr) => {
+            const authUrl = new URL(authUrlStr);
+            const redirectUri = authUrl.searchParams.get('redirect_uri');
+            const state = authUrl.searchParams.get('state');
+            const callbackUrl = new URL(redirectUri);
+            callbackUrl.searchParams.set('code', 'notion_auth_code_abc');
+            callbackUrl.searchParams.set('state', state);
+            for (const [key, value] of Object.entries(callbackQueryParams)) {
+                callbackUrl.searchParams.set(key, value);
+            }
+            // Trigger the real local HTTP callback server asynchronously. The
+            // provider awaits the callback server port before opening the browser,
+            // so the server is already listening and no arbitrary delay is needed.
+            setImmediate(() => {
+                realFetch(callbackUrl.toString()).catch(() => { });
+            });
+        });
+        mockFetch.mockResolvedValueOnce(createMockResponse({
+            ok: true,
+            contentType: 'application/json',
+            text: JSON.stringify(mockTokenResponse),
+            json: mockTokenResponse,
+        }));
+        const authProvider = new MCPOAuthProvider(new MCPOAuthTokenStorage());
+        return authProvider.authenticate('notion', oauthAuthConfig, mcpServerUrl);
+    }
+    /**
+     * Simulates the OAuth authorization server metadata discovery and browser
+     * callback flow for an MCP server.
+     */
+    async function runOAuthFlowWithMetadata(metadataOverrides, callbackQueryParams) {
+        const authServerMetadata = {
+            issuer: expectedIssuer,
+            authorization_endpoint: `${expectedIssuer}/authorize`,
+            token_endpoint: `${expectedIssuer}/token`,
+            registration_endpoint: `${expectedIssuer}/register`,
+            response_types_supported: ['code'],
+            grant_types_supported: ['authorization_code', 'refresh_token'],
+            code_challenge_methods_supported: ['S256'],
+            ...metadataOverrides,
+        };
+        const discoveredConfig = OAuthUtils.metadataToOAuthConfig(authServerMetadata);
+        // Simulate mcp-client.ts constructing oauthAuthConfig from discoveredConfig
+        const oauthAuthConfig = {
+            enabled: true,
+            authorizationUrl: discoveredConfig.authorizationUrl,
+            issuer: discoveredConfig.issuer,
+            tokenUrl: discoveredConfig.tokenUrl,
+            scopes: discoveredConfig.scopes || [],
+            registrationUrl: discoveredConfig.registrationUrl,
+            authorizationResponseIssParameterSupported: discoveredConfig.authorizationResponseIssParameterSupported,
+            clientId: 'notion-dynamic-client-id',
+        };
+        return runOAuthFlow(oauthAuthConfig, callbackQueryParams);
+    }
+    /**
+     * Simulates a settings.json entry where the user configured the OAuth
+     * endpoints and issuer explicitly, so no metadata discovery takes place.
+     */
+    async function runOAuthFlowWithExplicitConfig(configOverrides, callbackQueryParams) {
+        const oauthAuthConfig = {
+            enabled: true,
+            authorizationUrl: `${expectedIssuer}/authorize`,
+            tokenUrl: `${expectedIssuer}/token`,
+            issuer: expectedIssuer,
+            clientId: 'notion-static-client-id',
+            scopes: ['read'],
+            ...configOverrides,
+        };
+        return runOAuthFlow(oauthAuthConfig, callbackQueryParams);
+    }
+    it('T1: allows callback without iss when authorization_response_iss_parameter_supported is omitted in metadata (MCP Spec Row 4)', async () => {
+        const token = await runOAuthFlowWithMetadata({
+        // Notion-style metadata: issuer is present, but authorization_response_iss_parameter_supported is omitted
+        }, {
+        // Notion callback: returns code and state, omits iss
+        });
+        expect(token.accessToken).toBe('notion_access_token_123');
+    });
+    it('T2: validates iss when authorization_response_iss_parameter_supported is true and iss is present (MCP Spec Row 1)', async () => {
+        // Matching iss succeeds
+        const token = await runOAuthFlowWithMetadata({
+            authorization_response_iss_parameter_supported: true,
+        }, {
+            iss: expectedIssuer,
+        });
+        expect(token.accessToken).toBe('notion_access_token_123');
+        // Mismatched iss is rejected
+        await expect(runOAuthFlowWithMetadata({
+            authorization_response_iss_parameter_supported: true,
+        }, {
+            iss: mismatchIssuer,
+        })).rejects.toThrow(/Issuer mismatch in authorization response/);
+    });
+    it('T3: rejects callback without iss when authorization_response_iss_parameter_supported is true (MCP Spec Row 2)', async () => {
+        await expect(runOAuthFlowWithMetadata({
+            authorization_response_iss_parameter_supported: true,
+        }, {
+        // Callback omits iss even though server declared support
+        })).rejects.toThrow('Missing "iss" parameter in authorization response per RFC 9207');
+    });
+    it('T4: validates iss when present even if authorization_response_iss_parameter_supported is omitted or false (MCP Spec Row 3)', async () => {
+        // Mismatched iss when authorization_response_iss_parameter_supported is omitted -> rejected
+        await expect(runOAuthFlowWithMetadata({}, {
+            iss: mismatchIssuer,
+        })).rejects.toThrow(/Issuer mismatch in authorization response/);
+        // Mismatched iss when authorization_response_iss_parameter_supported is false -> rejected
+        await expect(runOAuthFlowWithMetadata({
+            authorization_response_iss_parameter_supported: false,
+        }, {
+            iss: mismatchIssuer,
+        })).rejects.toThrow(/Issuer mismatch in authorization response/);
+        // Matching iss when authorization_response_iss_parameter_supported is omitted -> succeeds
+        const token = await runOAuthFlowWithMetadata({}, {
+            iss: expectedIssuer,
+        });
+        expect(token.accessToken).toBe('notion_access_token_123');
+    });
+    it('T5: accepts an iss-less callback at startCallbackServer level when expectedIssuer is passed with requireIssInResponse=false', async () => {
+        // When the discovered metadata does not advertise iss support, the provider
+        // passes requireIssInResponse=false. A callback omitting iss (like Notion
+        // MCP) must then resolve rather than reject.
+        const server = startCallbackServer('repro-state', undefined, expectedIssuer, false);
+        const port = await server.port;
+        const responsePromise = server.response;
+        const res = await realFetch(`http://localhost:${port}${REDIRECT_PATH}?code=notion-code-789&state=repro-state`);
+        expect(res.status).toBe(200);
+        const authResponse = await responsePromise;
+        expect(authResponse.code).toBe('notion-code-789');
+        expect(authResponse.state).toBe('repro-state');
+        expect(authResponse.iss).toBeUndefined();
+    });
+    it('T6: requires iss when issuer is configured explicitly without discovery metadata, unless authorizationResponseIssParameterSupported is false', async () => {
+        // Explicit issuer in settings.json, no discovery metadata, callback omits
+        // iss -> rejected (documented strict behavior is preserved).
+        await expect(runOAuthFlowWithExplicitConfig({}, {})).rejects.toThrow('Missing "iss" parameter in authorization response per RFC 9207');
+        // Explicit issuer with a matching iss in the callback -> succeeds.
+        const strictToken = await runOAuthFlowWithExplicitConfig({}, { iss: expectedIssuer });
+        expect(strictToken.accessToken).toBe('notion_access_token_123');
+        // Explicit issuer with the opt-out flag set to false and no iss -> succeeds.
+        const optOutToken = await runOAuthFlowWithExplicitConfig({ authorizationResponseIssParameterSupported: false }, {});
+        expect(optOutToken.accessToken).toBe('notion_access_token_123');
+        // The opt-out flag never disables the comparison when iss is present.
+        await expect(runOAuthFlowWithExplicitConfig({ authorizationResponseIssParameterSupported: false }, { iss: mismatchIssuer })).rejects.toThrow(/Issuer mismatch in authorization response/);
+    });
+});
+//# sourceMappingURL=oauth-callback-iss-handling.test.js.map