@herbertgao/pi-extensions 2026.8.1 → 2026.8.2

package/node_modules/pi-mcp-adapter/errors.ts

@@ -17,8 +17,8 @@ export interface McpUiErrorContext {
 export class McpUiError extends Error {
   readonly code: string;
   readonly context: McpUiErrorContext;
-  readonly recoveryHint?: string;
-  readonly cause?: Error;
+  readonly recoveryHint: string | undefined;
+  readonly cause: Error | undefined;
 
   constructor(
     message: string,
@@ -65,9 +65,9 @@ export class ResourceFetchError extends McpUiError {
   ) {
     super(`Failed to fetch UI resource "${uri}": ${reason}`, {
       code: "RESOURCE_FETCH_ERROR",
-      context: { uri, server: options?.server },
+      context: { uri, ...(options?.server !== undefined ? { server: options.server } : {}) },
       recoveryHint: "Check that the MCP server is connected and the resource URI is valid.",
-      cause: options?.cause,
+      ...(options?.cause !== undefined ? { cause: options.cause } : {}),
     });
     this.name = "ResourceFetchError";
   }
@@ -84,7 +84,11 @@ export class ResourceParseError extends McpUiError {
   ) {
     super(`Invalid UI resource "${uri}": ${reason}`, {
       code: "RESOURCE_PARSE_ERROR",
-      context: { uri, server: options?.server, mimeType: options?.mimeType },
+      context: {
+        uri,
+        ...(options?.server !== undefined ? { server: options.server } : {}),
+        ...(options?.mimeType !== undefined ? { mimeType: options.mimeType } : {}),
+      },
       recoveryHint: "Ensure the resource returns valid HTML with the correct MIME type.",
     });
     this.name = "ResourceParseError";
@@ -98,9 +102,9 @@ export class BridgeConnectionError extends McpUiError {
   constructor(reason: string, options?: { session?: string; cause?: Error }) {
     super(`AppBridge connection failed: ${reason}`, {
       code: "BRIDGE_CONNECTION_ERROR",
-      context: { session: options?.session },
+      context: options?.session !== undefined ? { session: options.session } : {},
       recoveryHint: "Check browser console for detailed errors. The iframe may have failed to load.",
-      cause: options?.cause,
+      ...(options?.cause !== undefined ? { cause: options.cause } : {}),
     });
     this.name = "BridgeConnectionError";
   }
@@ -142,9 +146,9 @@ export class SessionError extends McpUiError {
   ) {
     super(`Session error: ${reason}`, {
       code: "SESSION_ERROR",
-      context: { session: options?.session },
+      context: options?.session !== undefined ? { session: options.session } : {},
       recoveryHint: "The session may have expired or been closed. Try opening the UI again.",
-      cause: options?.cause,
+      ...(options?.cause !== undefined ? { cause: options.cause } : {}),
     });
     this.name = "SessionError";
   }
@@ -160,9 +164,9 @@ export class ServerError extends McpUiError {
   ) {
     super(`UI server error: ${reason}`, {
       code: "SERVER_ERROR",
-      context: { port: options?.port },
+      context: options?.port !== undefined ? { port: options.port } : {},
       recoveryHint: "Check if the port is available. Another process may be using it.",
-      cause: options?.cause,
+      ...(options?.cause !== undefined ? { cause: options.cause } : {}),
     });
     this.name = "ServerError";
   }
@@ -179,9 +183,9 @@ export class McpServerError extends McpUiError {
   ) {
     super(`MCP server "${server}" error: ${reason}`, {
       code: "MCP_SERVER_ERROR",
-      context: { server, tool: options?.tool },
+      context: { server, ...(options?.tool !== undefined ? { tool: options.tool } : {}) },
       recoveryHint: "Check that the MCP server is running and responsive.",
-      cause: options?.cause,
+      ...(options?.cause !== undefined ? { cause: options.cause } : {}),
     });
     this.name = "McpServerError";
   }
@@ -196,8 +200,8 @@ export function wrapError(error: unknown, context?: McpUiErrorContext): McpUiErr
     return new McpUiError(error.message, {
       code: error.code,
       context: { ...error.context, ...context },
-      recoveryHint: error.recoveryHint,
-      cause: error.cause,
+      ...(error.recoveryHint !== undefined ? { recoveryHint: error.recoveryHint } : {}),
+      ...(error.cause !== undefined ? { cause: error.cause } : {}),
     });
   }
 
@@ -206,8 +210,8 @@ export function wrapError(error: unknown, context?: McpUiErrorContext): McpUiErr
 
   return new McpUiError(message, {
     code: "UNKNOWN_ERROR",
-    context,
-    cause,
+    ...(context !== undefined ? { context } : {}),
+    ...(cause !== undefined ? { cause } : {}),
   });
 }
 

package/node_modules/pi-mcp-adapter/host-html-template.ts

@@ -2,9 +2,11 @@ import type { UiHostContext, UiResourceContent, UiResourceCsp } from "./types.ts
 
 // Use locally bundled AppBridge to avoid CDN Zod bundling issues
 const DEFAULT_APP_BRIDGE_MODULE_URL = "/app-bridge.bundle.js";
+const APP_SANDBOX = "allow-scripts allow-forms allow-modals allow-popups allow-downloads";
 
 export interface HostHtmlTemplateInput {
   sessionToken: string;
+  uiResourceToken: string;
   serverName: string;
   toolName: string;
   toolArgs: Record<string, unknown>;
@@ -20,6 +22,7 @@ export function buildHostHtmlTemplate(input: HostHtmlTemplateInput): string {
   const hostContext = input.hostContext ?? {};
 
   const sessionToken = safeInlineJSON(input.sessionToken);
+  const uiResourceToken = safeInlineJSON(input.uiResourceToken);
   const toolArgs = safeInlineJSON(input.toolArgs);
   const serverName = safeInlineJSON(input.serverName);
   const toolName = safeInlineJSON(input.toolName);
@@ -109,7 +112,7 @@ export function buildHostHtmlTemplate(input: HostHtmlTemplateInput): string {
     </div>
   </header>
   <main>
-    <iframe id="mcp-app" sandbox="allow-scripts allow-forms allow-modals allow-popups allow-popups-to-escape-sandbox allow-downloads" referrerpolicy="no-referrer"></iframe>
+    <iframe id="mcp-app" sandbox="${APP_SANDBOX}" referrerpolicy="no-referrer"></iframe>
   </main>
   <div class="overlay" id="error-overlay">
     <div class="panel">
@@ -127,6 +130,7 @@ export function buildHostHtmlTemplate(input: HostHtmlTemplateInput): string {
     import { AppBridge, PostMessageTransport } from ${moduleUrl};
 
     const SESSION_TOKEN = ${sessionToken};
+    const UI_RESOURCE_TOKEN = ${uiResourceToken};
     const SERVER_NAME = ${serverName};
     const TOOL_NAME = ${toolName};
     const TOOL_ARGS = ${toolArgs};
@@ -222,10 +226,10 @@ export function buildHostHtmlTemplate(input: HostHtmlTemplateInput): string {
       }
       const result = await post("/proxy/tools/call", params);
       // Notify agent about the tool call
-      await post("/proxy/ui/message", {
-        type: "intent",
-        intent: "call_tool",
-        params: { tool: params.name, arguments: params.arguments, isError: result.isError }
+      await post("/proxy/ui/generated-tool-call-intent", {
+        tool: params.name,
+        arguments: params.arguments,
+        isError: result.isError
       }).catch(() => {});
       return result;
     };
@@ -236,6 +240,7 @@ export function buildHostHtmlTemplate(input: HostHtmlTemplateInput): string {
     // Also listen for raw postMessage events with custom types (notify, prompt, intent, etc.)
     // These bypass the AppBridge protocol but are used by some MCP UI implementations
     window.addEventListener("message", async (event) => {
+      if (event.source !== iframe.contentWindow) return;
       const data = event.data;
       if (!data || typeof data !== "object") return;
       
@@ -300,7 +305,7 @@ export function buildHostHtmlTemplate(input: HostHtmlTemplateInput): string {
 
     // Connect bridge BEFORE loading iframe to ensure we're listening when the app sends ui/initialize
     try {
-      const transport = new PostMessageTransport(iframe.contentWindow, null);
+      const transport = new PostMessageTransport(iframe.contentWindow, iframe.contentWindow);
       await bridge.connect(transport);
     } catch (error) {
       console.error("[host] Bridge connection failed:", error);
@@ -310,7 +315,7 @@ export function buildHostHtmlTemplate(input: HostHtmlTemplateInput): string {
     const iframeLoaded = new Promise((resolve) => {
       iframe.onload = resolve;
     });
-    iframe.src = "/ui-app?session=" + encodeURIComponent(SESSION_TOKEN);
+    iframe.src = "/ui-app?resource=" + encodeURIComponent(UI_RESOURCE_TOKEN);
     await iframeLoaded;
 
     const eventSource = new EventSource("/events?session=" + encodeURIComponent(SESSION_TOKEN));
@@ -399,6 +404,7 @@ export function buildCspMetaContent(csp: UiResourceCsp | undefined): string {
 
   return [
     "default-src 'none'",
+    `sandbox ${APP_SANDBOX}`,
     toDirective("script-src", ["'self'", "'unsafe-inline'"], resourceDomains),
     toDirective("style-src", ["'self'", "'unsafe-inline'"], resourceDomains),
     toDirective("font-src", ["'self'"], resourceDomains),

package/node_modules/pi-mcp-adapter/index.ts

@@ -1,8 +1,9 @@
-import type { ExtensionAPI, ExtensionContext, ToolInfo } from "@earendil-works/pi-coding-agent";
+import type { AgentToolUpdateCallback, ExtensionAPI, ExtensionContext, ToolInfo } from "@earendil-works/pi-coding-agent";
 import type { McpExtensionState } from "./state.ts";
 import type { DirectToolSpec, McpAdapterOptions, McpConfig, PromptMetadata } from "./types.ts";
 import type { McpOAuthRuntime } from "./mcp-auth-flow.ts";
 import { Type } from "typebox";
+import type { TSchema } from "typebox";
 import { showStatus, showTools, showPrompts, reconnectServer, reconnectServers, authenticateServer, logoutServer, openMcpAuthPanel, openMcpPanel, openMcpSetup } from "./commands.ts";
 import { cloneMcpConfig, loadMcpConfig, writeProjectServerDisabledOverride } from "./config.ts";
 import { buildProxyDescription, createDirectToolExecutor, getMissingConfiguredDirectToolServers, resolveDirectTools } from "./direct-tools.ts";
@@ -23,9 +24,14 @@ export type { McpAdapterOptions } from "./types.ts";
 export {
   MCP_STATUS_EVENT,
   MCP_STATUS_SNAPSHOT_VERSION,
+  MCP_TOOL_APPROVAL_REQUEST_EVENT,
   type McpServerRuntimeStatus,
   type McpServerStatusSnapshot,
   type McpStatusSnapshot,
+  type McpToolApprovalDecision,
+  type McpToolApprovalHandler,
+  type McpToolApprovalOrigin,
+  type McpToolApprovalRequest,
 } from "./types.ts";
 
 const INIT_WAIT_TIMEOUT_MS = 30_000;
@@ -46,6 +52,18 @@ async function awaitWithTimeout<T>(promise: Promise<T>, timeoutMs: number): Prom
   }
 }
 
+// TypeBox 1.x annotates raw objects passed to Type.Optional with an enumerable
+// "~optional" key that survives serialization into provider tool schemas (Gemini
+// rejects it with 400 INVALID_ARGUMENT). Prefer a real Type.Number schema; fall
+// back to a plain raw schema for host TypeBox shims that omit Type.Number, since
+// a property left out of `required` is optional by default.
+function optionalNumber(options: { minimum?: number; description: string }): TSchema {
+  const number = (Type as { Number?: (opts: typeof options) => TSchema }).Number;
+  return typeof number === "function"
+    ? Type.Optional(number(options))
+    : ({ type: "number", ...options } as unknown as TSchema);
+}
+
 function installMcpAdapter(pi: ExtensionAPI, options: McpAdapterOptions) {
   const sessionConfig = options.config !== undefined ? cloneMcpConfig(options.config) : undefined;
   const programmaticConfig = sessionConfig !== undefined;
@@ -259,7 +277,10 @@ function installMcpAdapter(pi: ExtensionAPI, options: McpAdapterOptions) {
   function startInitialization(ctx: ExtensionContext, owner: McpRuntimeOwner, oauthRuntime: McpOAuthRuntime, generation: number, staleReason: string): Promise<void> {
     const promise = initializeMcp(pi, ctx, owner, {
       ...(programmaticConfig || options.configPath !== undefined
-        ? { configPath: earlyConfigPath, config: sessionConfig }
+        ? {
+            ...(earlyConfigPath !== undefined ? { configPath: earlyConfigPath } : {}),
+            ...(sessionConfig !== undefined ? { config: sessionConfig } : {}),
+          }
         : {}),
       oauthRuntime,
       statusEvents: pi.events,
@@ -427,7 +448,11 @@ function installMcpAdapter(pi: ExtensionAPI, options: McpAdapterOptions) {
       }
 
       const [, subcommand, argumentPrefix] = argumentMatch;
-      if ((subcommand !== "reconnect" && subcommand !== "logout" && subcommand !== "disable" && subcommand !== "enable") || !state) return null;
+      if (
+        (subcommand !== "reconnect" && subcommand !== "logout" && subcommand !== "disable" && subcommand !== "enable")
+        || argumentPrefix === undefined
+        || !state
+      ) return null;
 
       const servers = Object.keys(state.config.mcpServers)
         .filter((serverName) => serverName.startsWith(argumentPrefix.trimStart()))
@@ -609,17 +634,16 @@ function installMcpAdapter(pi: ExtensionAPI, options: McpAdapterOptions) {
 
   if (earlyConfig.settings?.scriptMode !== false) {
     (pi.registerTool as (tool: unknown) => unknown)({
-      name: "mcp_script",
+      name: "mcpScript",
       label: "MCP Script",
       description: "Run trusted JavaScript that makes multiple MCP tool calls in one request — loop, filter, chain, or fan out between calls. For a single MCP call, search, describe, status check, or auth action, use the mcp tool instead. Discover with await tools.search({ query }) — resolves to { items: [{ path, name, server, description? }], total, hasMore, nextOffset }, not an { ok, data } envelope. Inspect with await tools.describe({ path }) — resolves to the tool descriptor with inputTypeScript, or { path, error: { code, message, suggestions } }. Then call tools.call(path, args) — resolves to { ok: true, data } or { ok: false, error: { code, message } } — or use direct flat calls when the name is already known; use emit(value) for user-visible output. Load the mcp-scripting skill for the full workflow guide.",
       promptSnippet: "Batch multiple MCP tool calls in one JavaScript request (loop, filter, chain)",
       parameters: Type.Object({
         code: Type.String({ description: "Trusted JavaScript MCP script. Use tools.<prefixedToolName>(args) and emit(value)." }),
-        // Raw JSON schema: host TypeBox shims may omit Type.Number (see index-lifecycle shim test).
-        timeoutMs: Type.Optional({ type: "number", minimum: 1, description: "Execution timeout in milliseconds (default: 30000)" } as any),
+        timeoutMs: optionalNumber({ minimum: 1, description: "Execution timeout in milliseconds (default: 30000)" }),
       }),
       renderResult: renderMcpToolResult,
-      async execute(_toolCallId, params: { code: string; timeoutMs?: number }, signal) {
+      async execute(_toolCallId: string, params: { code: string; timeoutMs?: number }, signal: AbortSignal | undefined) {
         const executeOwner = currentOwner;
         if (!state && initPromise) {
           try {
@@ -675,14 +699,13 @@ function installMcpAdapter(pi: ExtensionAPI, options: McpAdapterOptions) {
         search: Type.Optional(Type.String({ description: "Search tools by name/description" })),
         regex: Type.Optional(Type.Boolean({ description: "Treat search as regex (default: substring match)" })),
         includeSchemas: Type.Optional(Type.Boolean({ description: "Include parameter schemas in search results (default: true)" })),
-        // Raw JSON schema: host TypeBox shims may omit Type.Number (see index-lifecycle shim test).
-        limit: Type.Optional({ type: "number", minimum: 1, description: "Maximum search results to return (default: 12)" } as any),
-        offset: Type.Optional({ type: "number", minimum: 0, description: "Search result offset (default: 0)" } as any),
+        limit: optionalNumber({ minimum: 1, description: "Maximum search results to return (default: 12)" }),
+        offset: optionalNumber({ minimum: 0, description: "Search result offset (default: 0)" }),
         server: Type.Optional(Type.String({ description: "Filter to specific server (also disambiguates tool calls)" })),
         action: Type.Optional(Type.String({ description: "Action: 'ui-messages', 'auth-start', or 'auth-complete'" })),
       }),
       renderResult: renderMcpToolResult,
-      async execute(_toolCallId, params: {
+      async execute(_toolCallId: string, params: {
         tool?: string;
         args?: string | Record<string, unknown>;
         connect?: string;
@@ -695,7 +718,7 @@ function installMcpAdapter(pi: ExtensionAPI, options: McpAdapterOptions) {
         offset?: number;
         server?: string;
         action?: string;
-      }, signal, _onUpdate, _ctx) {
+      }, signal: AbortSignal | undefined, _onUpdate: AgentToolUpdateCallback<Record<string, unknown>> | undefined, _ctx: ExtensionContext) {
         const executeOwner = currentOwner;
         let parsedArgs: Record<string, unknown> | undefined;
         if (params.args !== undefined && params.args !== "") {
@@ -849,8 +872,8 @@ export function createMcpAdapter(options: McpAdapterOptions = {}) {
   const factoryConfig = options.config !== undefined ? cloneMcpConfig(options.config) : undefined;
   return function mcpAdapter(pi: ExtensionAPI) {
     installMcpAdapter(pi, {
-      configPath: options.configPath,
-      config: factoryConfig !== undefined ? cloneMcpConfig(factoryConfig) : undefined,
+      ...(options.configPath !== undefined ? { configPath: options.configPath } : {}),
+      ...(factoryConfig !== undefined ? { config: cloneMcpConfig(factoryConfig) } : {}),
     });
   };
 }

package/node_modules/pi-mcp-adapter/init.ts

@@ -124,7 +124,7 @@ export async function initializeMcp(
   if (config.settings?.sampling !== false && (hasUI || samplingAutoApprove)) {
     manager.setSamplingConfig({
       autoApprove: samplingAutoApprove,
-      ui,
+      ...(ui !== undefined ? { ui } : {}),
       modelRegistry,
       getCurrentModel: () => owner.isActive() ? ctx.model : undefined,
       getSignal: () => owner.isActive()
@@ -166,6 +166,7 @@ export async function initializeMcp(
     failureTracker,
     failureMessages,
     approvedToolCalls,
+    approvalEvents: pi.events,
     uiResourceHandler,
     consentManager,
     uiServer: null,
@@ -175,12 +176,12 @@ export async function initializeMcp(
       await openUrl(pi, url, process.env.BROWSER, owner.signal);
       owner.throwIfInactive();
     },
-    ui,
+    ...(ui !== undefined ? { ui } : {}),
     sendMessage: (message, options) => {
       if (!owner.isActive()) return;
       pi.sendMessage(message as unknown as Parameters<typeof pi.sendMessage>[0], options);
     },
-    statusEvents: options.statusEvents,
+    ...(options.statusEvents !== undefined ? { statusEvents: options.statusEvents } : {}),
   };
   if (ownsOAuthRuntime) owner.addCleanup(() => shutdownOAuth(oauthRuntime));
   manager.setMetadataListChangedListener?.((serverName, reason) => {
@@ -345,8 +346,9 @@ export async function initializeMcp(
         missingCacheServers.filter(name => !results.some(r => r.name === name && r.connection)),
         10,
         async (name) => {
-          const definition = config.mcpServers[name];
           try {
+            const definition = config.mcpServers[name];
+            if (!definition) throw new Error(`MCP server "${name}" is not configured`);
             const connection = await manager.connect(name, definition, runtimeSignal);
             if (connection.status === "needs-auth") {
               return { name, ok: false };
@@ -412,8 +414,8 @@ export async function initializeMcp(
 
 export function markKeepAliveAfterConnect(state: McpExtensionState, serverName: string): void {
   const definition = state.config.mcpServers[serverName];
-  if (isServerDisabled(definition)) return;
-  if ((definition?.lifecycle ?? "lazy") === "lazy-keep-alive") {
+  if (!definition || isServerDisabled(definition)) return;
+  if ((definition.lifecycle ?? "lazy") === "lazy-keep-alive") {
     state.lifecycle.markKeepAlive(serverName, definition);
   }
 }
@@ -485,7 +487,7 @@ export function updateMetadataCache(
     tools,
     resources,
     ...(prompts !== undefined ? { prompts } : {}),
-    instructions: connection.instructions,
+    ...(connection.instructions !== undefined ? { instructions: connection.instructions } : {}),
     cachedAt: Date.now(),
   };
 

package/node_modules/pi-mcp-adapter/json-schema-validator.ts

@@ -1,12 +1,12 @@
 import { Ajv } from "ajv";
 import Ajv2020Import from "ajv/dist/2020.js";
 import addFormatsImport from "ajv-formats";
-import { AjvJsonSchemaValidator } from "@modelcontextprotocol/sdk/validation/ajv";
+import { AjvJsonSchemaValidator } from "@modelcontextprotocol/client/validators/ajv";
 import type {
   JsonSchemaType,
   JsonSchemaValidator,
   jsonSchemaValidator as JsonSchemaValidatorProvider,
-} from "@modelcontextprotocol/sdk/validation/types.js";
+} from "@modelcontextprotocol/client";
 
 // ajv-formats types target its bundled ajv; the runtime accepts both instances.
 const addFormats = addFormatsImport as unknown as (instance: Ajv) => void;

package/node_modules/pi-mcp-adapter/lifecycle.ts

@@ -12,15 +12,15 @@ export class McpLifecycleManager {
   private allServers = new Map<string, ServerDefinition>();
   private serverSettings = new Map<string, { idleTimeout?: number }>();
   private globalIdleTimeout = 10 * 60 * 1000;
-  private healthCheckInterval?: NodeJS.Timeout;
-  private onReconnect?: ReconnectCallback;
-  private onReconnectFailure?: ReconnectFailureCallback;
-  private onIdleShutdown?: (serverName: string) => void;
-  private activeHealthCheck?: Promise<void>;
-  private shutdownPromise?: Promise<void>;
+  private healthCheckInterval: NodeJS.Timeout | undefined;
+  private onReconnect: ReconnectCallback | undefined;
+  private onReconnectFailure: ReconnectFailureCallback | undefined;
+  private onIdleShutdown: ((serverName: string) => void) | undefined;
+  private activeHealthCheck: Promise<void> | undefined;
+  private shutdownPromise: Promise<void> | undefined;
   private stopped = false;
-  private healthSignal?: AbortSignal;
-  private removeHealthAbortListener?: () => void;
+  private healthSignal: AbortSignal | undefined;
+  private removeHealthAbortListener: (() => void) | undefined;
 
   constructor(
     private readonly manager: McpServerManager,

package/node_modules/pi-mcp-adapter/logger.ts

@@ -69,7 +69,7 @@ class Logger {
       level,
       message,
       context: { ...this.defaultContext, ...context },
-      error,
+      ...(error !== undefined ? { error } : {}),
       timestamp: new Date(),
     };
 

package/node_modules/pi-mcp-adapter/mcp-auth-flow.ts

@@ -7,9 +7,10 @@
 import {
   auth as runSdkAuth,
   extractWWWAuthenticateParams,
+  LATEST_PROTOCOL_VERSION,
   UnauthorizedError,
-} from "@modelcontextprotocol/sdk/client/auth.js"
-import { LATEST_PROTOCOL_VERSION } from "@modelcontextprotocol/sdk/types.js"
+  type AuthOptions,
+} from "@modelcontextprotocol/client"
 import open from "open"
 import { McpOAuthProvider, type McpOAuthConfig } from "./mcp-oauth-provider.ts"
 import {
@@ -50,15 +51,17 @@ export interface AuthenticateOptions {
   authStorageOptions?: AuthStorageOptions
   signal?: AbortSignal
   runtime?: McpOAuthRuntime
+  skipIssuerMetadataValidation?: boolean
 }
 
-type AuthDiscovery = {
-  resourceMetadataUrl?: URL
-  scope?: string
-}
+type AuthDiscovery = Pick<AuthOptions, "resourceMetadataUrl" | "scope" | "skipIssuerMetadataValidation">
 
-function applyConfiguredScope(discovery: AuthDiscovery, config: McpOAuthConfig): AuthDiscovery {
-  return config.scope !== undefined ? { ...discovery, scope: config.scope } : discovery
+function applyOAuthConfig(discovery: AuthDiscovery, config: McpOAuthConfig): AuthDiscovery {
+  return {
+    ...discovery,
+    ...(config.scope !== undefined ? { scope: config.scope } : {}),
+    ...(config.skipIssuerMetadataValidation === true ? { skipIssuerMetadataValidation: true } : {}),
+  }
 }
 
 type PendingAuth = {
@@ -208,6 +211,12 @@ export function extractOAuthConfig(definition: ServerEntry): McpOAuthConfig {
     }
     config.clientUri = clientUri
   }
+  if (definition.oauth?.skipIssuerMetadataValidation !== undefined) {
+    if (typeof definition.oauth.skipIssuerMetadataValidation !== "boolean") {
+      throw new Error("OAuth skipIssuerMetadataValidation must be a boolean")
+    }
+    config.skipIssuerMetadataValidation = definition.oauth.skipIssuerMetadataValidation
+  }
   return config
 }
 
@@ -239,7 +248,7 @@ async function probeAuthDiscovery(serverUrl: string, definition?: ServerEntry, s
           clientInfo: { name: "pi-mcp-adapter", version: "2.11.0" },
         },
       }),
-      signal: discoverySignal,
+      ...(discoverySignal ? { signal: discoverySignal } : {}),
     })
     const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response)
     await response.body?.cancel().catch(() => {})
@@ -320,7 +329,7 @@ export async function startAuth(
       },
     }, authStorageOptions, runtime.signal)
     try {
-      const discovery = applyConfiguredScope(await probeAuthDiscovery(serverUrl, definition, signal), config)
+      const discovery = applyOAuthConfig(await probeAuthDiscovery(serverUrl, definition, signal), config)
       throwIfAborted(signal)
       const result = await abortable(runSdkAuth(authProvider, { serverUrl, ...discovery }), signal)
       throwIfAborted(signal)
@@ -386,7 +395,7 @@ export async function startAuth(
 
     throwIfAborted(signal)
 
-    const discovery = applyConfiguredScope(await probeAuthDiscovery(serverUrl, definition, signal), config)
+    const discovery = applyOAuthConfig(await probeAuthDiscovery(serverUrl, definition, signal), config)
     throwIfAborted(signal)
     const result = await abortable(runSdkAuth(authProvider, { serverUrl, ...discovery }), signal)
     throwIfAborted(signal)
@@ -606,6 +615,7 @@ export async function completeAuth(
     const result = await abortable(runSdkAuth(pendingAuth.authProvider, {
       serverUrl: pendingAuth.serverUrl,
       authorizationCode: code,
+      ...(iss !== undefined ? { iss } : {}),
       ...pendingAuth.discovery,
     }), signal)
     throwIfAborted(signal)
@@ -657,10 +667,12 @@ export async function authenticate(
   }
 
   const operation = (async (): Promise<AuthStatus> => {
-    // Start auth flow
-    const { authorizationUrl } = await startAuth(serverName, serverUrl, definition, { ...options, signal, runtime })
+    const { authorizationUrl } = await startAuth(serverName, serverUrl, definition, {
+      ...options,
+      ...(signal ? { signal } : {}),
+      runtime,
+    })
 
-    // If no auth URL needed, already authenticated
     if (!authorizationUrl) {
       return "authenticated"
     }
@@ -694,14 +706,16 @@ export async function authenticate(
         console.warn(`MCP Auth: Failed to open browser for ${serverName}; waiting for manual callback`, { error })
       }
 
-      // Wait for callback
       const callbackResult = await abortable(callbackPromise, signal)
 
       // The callback server accepted only the flow-local reserved state.
       throwIfAborted(signal)
 
-      // Complete the auth
-      return await completeAuth(serverName, callbackResult, { ...options, signal, runtime })
+      return await completeAuth(serverName, callbackResult, {
+        ...options,
+        ...(signal ? { signal } : {}),
+        runtime,
+      })
     } catch (error) {
       if (oauthState) cancelPendingCallback(oauthState)
       try {
@@ -740,25 +754,21 @@ export async function getValidToken(
   const authStorageOptions = options.authStorageOptions ?? {}
   const signal = combineAbortSignals(runtime.signal, options.signal)
   throwIfAborted(signal)
-  // Check if we have valid tokens
   const entry = await getAuthForUrl(serverName, serverUrl, authStorageOptions)
   throwIfAborted(signal)
   if (!entry?.tokens) {
     return null
   }
 
-  // Check expiration
   const expired = await isTokenExpired(serverName, authStorageOptions)
   if (expired === false) {
     return entry.tokens
   }
 
   if (expired === true && entry.tokens.refreshToken) {
-    // Token is expired, try to refresh
     console.log(`MCP Auth: Token expired for ${serverName}, attempting refresh`)
 
     try {
-      // Create auth provider for token refresh
       const authProvider = new McpOAuthProvider(serverName, serverUrl, {}, {
         onRedirect: async () => {},
       }, authStorageOptions, runtime.signal)
@@ -773,7 +783,11 @@ export async function getValidToken(
 
         const discovery = await probeAuthDiscovery(serverUrl, undefined, signal)
         throwIfAborted(signal)
-        const result = await abortable(runSdkAuth(authProvider, { serverUrl, ...discovery }), signal)
+        const result = await abortable(runSdkAuth(authProvider, {
+          serverUrl,
+          ...discovery,
+          ...(options.skipIssuerMetadataValidation === true ? { skipIssuerMetadataValidation: true } : {}),
+        }), signal)
         throwIfAborted(signal)
         if (result !== "AUTHORIZED") {
           return null