@introspection-ai/recipes 0.19.2 → 0.20.0

package/dist/mcp-chunks/{chunk-2FSDGCHW.js → chunk-WKUCIR2F.js}

@@ -3,48 +3,41 @@ import {
   NON_INTERACTIVE_ELICITATION_HINT,
   createNonInteractiveElicitationResponder,
   registerElicitationHandler
-} from "./chunk-CA5WFJZA.js";
+} from "./chunk-VC6SKXTI.js";
 import {
   RecordTransport,
   resolveRecordingPath
-} from "./chunk-E6T37ED6.js";
+} from "./chunk-FNQV2ONG.js";
 import {
   OAuthTimeoutError,
   connectWithAuth,
+  createOAuthSession,
   isOAuthFlowError,
   isPostAuthConnectError,
   resolveOAuthTimeoutFromEnv
-} from "./chunk-SRZZQ6TL.js";
+} from "./chunk-VJ2TSA5R.js";
 import {
-  buildOAuthPersistence,
-  buildStaticClientInformation,
   readCachedAccessToken
-} from "./chunk-3IZQW4H4.js";
+} from "./chunk-MNAVFYYV.js";
 import {
   isUnauthorizedError,
   maybeEnableOAuth
-} from "./chunk-7DH57OKF.js";
+} from "./chunk-MWD5PZ4G.js";
 import {
   STDIO_TRACE_ENABLED,
   flushStdioLogs,
   ignoreStdioEmitterError
-} from "./chunk-2MEHGB7D.js";
+} from "./chunk-RXSZ2W6Y.js";
 import {
   MCPORTER_VERSION
-} from "./chunk-SFREPU3D.js";
+} from "./chunk-NSZY5WLR.js";
 import {
   createPrefixedConsoleLogger,
   resolveLogLevelFromEnv
-} from "./chunk-GFYTST6N.js";
-import {
-  normalizeTimeout,
-  raceWithTimeout,
-  resolveCommandArgument,
-  resolveCommandArguments
-} from "./chunk-ETWN4IIA.js";
+} from "./chunk-54UGGTOX.js";
 import {
   analyzeConnectionError
-} from "./chunk-DEUU7WSN.js";
+} from "./chunk-ZNKNF2BV.js";
 import {
   Client,
   DEFAULT_REQUEST_TIMEOUT_MSEC,
@@ -56,17 +49,29 @@ import {
   SdkHttpError,
   StreamableHTTPClientTransport,
   serializeMessage,
-  specTypeSchemas,
-  validateClientMetadataUrl
-} from "./chunk-YPJ5EHXR.js";
+  specTypeSchemas
+} from "./chunk-K56RW4HB.js";
+import {
+  ChromeDevtoolsRelayRequiredError,
+  formatChromeDevtoolsRelayDecision,
+  recordChromeDevtoolsRelayDecision,
+  resolveChromeDevtoolsAutoConnectCommand,
+  resolveChromeDevtoolsRelayEnvironment,
+  rewriteChromeDevtoolsArgsForRelay
+} from "./chunk-XRRT3SZM.js";
+import {
+  normalizeTimeout,
+  raceWithTimeout,
+  resolveCommandArgument,
+  resolveCommandArguments
+} from "./chunk-LYZRCACV.js";
 import {
   loadServerDefinitions
-} from "./chunk-L4VKBFYI.js";
+} from "./chunk-5HQYKAE7.js";
 import {
   resolveEnvPlaceholders,
-  resolveEnvValue,
   withEnvOverrides
-} from "./chunk-HAO6PL7Z.js";
+} from "./chunk-DIIFWDZ7.js";
 import {
   __commonJS,
   __require,
@@ -550,27 +555,27 @@ var require_cross_spawn = __commonJS({
     var cp = __require("child_process");
     var parse = require_parse();
     var enoent = require_enoent();
-    function spawn3(command, args, options) {
+    function spawn2(command, args, options) {
       const parsed = parse(command, args, options);
       const spawned = cp.spawn(parsed.command, parsed.args, parsed.options);
       enoent.hookChildProcess(spawned, parsed);
       return spawned;
     }
-    function spawnSync(command, args, options) {
+    function spawnSync2(command, args, options) {
       const parsed = parse(command, args, options);
       const result = cp.spawnSync(parsed.command, parsed.args, parsed.options);
       result.error = result.error || enoent.verifyENOENTSync(result.status, parsed);
       return result;
     }
-    module.exports = spawn3;
-    module.exports.spawn = spawn3;
-    module.exports.sync = spawnSync;
+    module.exports = spawn2;
+    module.exports.spawn = spawn2;
+    module.exports.sync = spawnSync2;
     module.exports._parse = parse;
     module.exports._enoent = enoent;
   }
 });
 
-// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/runtime-process-utils.js
+// node_modules/.pnpm/mcporter@0.13.6/node_modules/mcporter/dist/runtime-process-utils.js
 import { execFile } from "node:child_process";
 async function closeTransportAndWait(logger, transport, options = {}) {
   const pidBeforeClose = getTransportPid(transport);
@@ -777,7 +782,7 @@ function delay(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/runtime/errors.js
+// node_modules/.pnpm/mcporter@0.13.6/node_modules/mcporter/dist/runtime/errors.js
 var NON_FATAL_MCP_ERROR_CODES = /* @__PURE__ */ new Set([
   ProtocolErrorCode.InvalidRequest,
   ProtocolErrorCode.MethodNotFound,
@@ -799,7 +804,7 @@ function protocolErrorCode(error) {
   return typeof error.code === "number" ? error.code : void 0;
 }
 
-// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/runtime/replay-transport.js
+// node_modules/.pnpm/mcporter@0.13.6/node_modules/mcporter/dist/runtime/replay-transport.js
 import fs from "node:fs";
 import { isDeepStrictEqual } from "node:util";
 var CLIENT_IDENTITY_META_KEYS = [
@@ -1021,13 +1026,13 @@ function formatReplayRemainder(server, expectedSends) {
   return `Replay ended for server '${server}' with ${count} recorded ${requestText} still unused; next expected recv ${expectedText}.`;
 }
 
-// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/chrome-devtools-compat.js
+// node_modules/.pnpm/mcporter@0.13.6/node_modules/mcporter/dist/chrome-devtools-compat.js
 import fs3 from "node:fs";
 import os from "node:os";
 import path2 from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
-// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/chrome-devtools-auto-connect-patch.js
+// node_modules/.pnpm/mcporter@0.13.6/node_modules/mcporter/dist/chrome-devtools-auto-connect-patch.js
 import fs2 from "node:fs";
 import path from "node:path";
 var MARKER = "MCPORTER_DEVTOOLS_TIMEOUT_PATCH";
@@ -1114,8 +1119,7 @@ ${helper}`);
   }
 }
 
-// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/chrome-devtools-compat.js
-var AUTO_CONNECT_FLAGS = /* @__PURE__ */ new Set(["--autoConnect", "--auto-connect"]);
+// node_modules/.pnpm/mcporter@0.13.6/node_modules/mcporter/dist/chrome-devtools-compat.js
 var FALLBACK_PATCH_FILENAME = "mcporter-chrome-devtools-auto-connect-patch.js";
 function applyChromeDevtoolsCompat(env, command, args) {
   if (!shouldApplyChromeDevtoolsCompat(command, args, env)) {
@@ -1143,11 +1147,7 @@ function shouldApplyChromeDevtoolsCompat(command, args, env = process.env) {
   if (env.MCPORTER_DISABLE_CHROME_DEVTOOLS_COMPAT === "1") {
     return false;
   }
-  const tokens = [command, ...args];
-  return tokens.some(isChromeDevtoolsToken) && args.some((arg) => AUTO_CONNECT_FLAGS.has(arg));
-}
-function isChromeDevtoolsToken(token) {
-  return token === "chrome-devtools-mcp" || token.startsWith("chrome-devtools-mcp@") || token.includes("/chrome-devtools-mcp");
+  return resolveChromeDevtoolsAutoConnectCommand(command, args).enabled;
 }
 function resolveChromeDevtoolsCompatPatchPath(candidates = defaultChromeDevtoolsPatchCandidates(), fallbackDir = os.tmpdir()) {
   const existing = candidates.find((candidate) => fs3.existsSync(candidate));
@@ -1173,88 +1173,232 @@ function writeFallbackPatch(fallbackDir) {
   }
 }
 
-// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/chrome-devtools-relay.js
+// node_modules/.pnpm/mcporter@0.13.6/node_modules/mcporter/dist/chrome-devtools-relay-handoff.js
+import { spawnSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import fs4 from "node:fs";
 import os2 from "node:os";
 import path3 from "node:path";
-var AUTO_CONNECT_FLAGS2 = /* @__PURE__ */ new Set(["--autoConnect", "--auto-connect"]);
-var RELAY_PROBE_TIMEOUT_MS = 750;
-var DEFAULT_RELAY_URL = "http://127.0.0.1:18799";
-function isChromeDevtoolsToken2(token) {
-  return token === "chrome-devtools-mcp" || token.startsWith("chrome-devtools-mcp@") || token.includes("/chrome-devtools-mcp");
-}
-function relayBaseUrl(env) {
-  const raw = env.MCPORTER_CHROME_DEVTOOLS_RELAY_URL?.trim() || DEFAULT_RELAY_URL;
-  let url;
+import { pathToFileURL as pathToFileURL2 } from "node:url";
+var CHROME_RELAY_HANDOFF_ENV = "MCPORTER_CHROME_RELAY_HANDOFF_PATH";
+var HANDOFF_DIR_PREFIX = "mcporter-chrome-relay-";
+var HANDOFF_FILENAME = "headers.json";
+var PRELOAD_FILENAME = "preload.mjs";
+var WINDOWS_ACL_PATH_ENV = "MCPORTER_CHROME_RELAY_ACL_PATH";
+function createChromeDevtoolsRelayHandoff(env, clientAuthorization) {
+  let directory;
   try {
-    url = new URL(raw);
-  } catch {
-    return void 0;
-  }
-  if (url.protocol !== "http:" || !["127.0.0.1", "localhost", "[::1]", "::1"].includes(url.hostname)) {
-    return void 0;
-  }
-  return url;
+    if (process.platform === "win32")
+      directory = createWindowsHandoffDirectory();
+    else {
+      directory = fs4.mkdtempSync(path3.join(os2.tmpdir(), HANDOFF_DIR_PREFIX));
+      fs4.chmodSync(directory, 448);
+    }
+    assertSecurePath(directory, "directory");
+    const handoffPath = path3.join(directory, HANDOFF_FILENAME);
+    const preloadPath = path3.join(directory, PRELOAD_FILENAME);
+    writeExclusiveFile(preloadPath, renderChromeDevtoolsRelayPreloadSource());
+    writeExclusiveFile(handoffPath, JSON.stringify({ Authorization: clientAuthorization }));
+    const importFlag = `--import=${pathToFileURL2(preloadPath).href}`;
+    const existingOptions = env.NODE_OPTIONS?.trim();
+    let closed = false;
+    return {
+      env: {
+        ...env,
+        NODE_OPTIONS: existingOptions ? `${existingOptions} ${importFlag}` : importFlag,
+        [CHROME_RELAY_HANDOFF_ENV]: handoffPath
+      },
+      handoffPath,
+      preloadPath,
+      async close() {
+        if (closed)
+          return;
+        closed = true;
+        cleanupHandoff(directory, handoffPath, preloadPath);
+      }
+    };
+  } catch (error) {
+    if (directory)
+      cleanupHandoff(directory, path3.join(directory, HANDOFF_FILENAME), path3.join(directory, PRELOAD_FILENAME));
+    const diagnostic = error instanceof Error && error.message.startsWith("Windows ACL setup failed:") ? ` ${error.message}` : "";
+    throw new Error(`Unable to install secure Chrome relay authorization handoff.${diagnostic}`, { cause: error });
+  }
+}
+function createWindowsHandoffDirectory() {
+  const directory = path3.join(os2.tmpdir(), `${HANDOFF_DIR_PREFIX}${randomBytes(16).toString("hex")}`);
+  const script = String.raw`
+$ErrorActionPreference = 'Stop'
+$stage = 'identity'
+try {
+$target = $env:${WINDOWS_ACL_PATH_ENV}
+if ([System.IO.Directory]::Exists($target)) { throw 'handoff path already exists' }
+$sid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+$stage = 'descriptor'
+$security = New-Object System.Security.AccessControl.DirectorySecurity
+$sidValue = $sid.Value
+$security.SetSecurityDescriptorSddlForm("O:$($sidValue)G:$($sidValue)D:P(A;OICI;FA;;;$($sidValue))")
+$directory = New-Object System.IO.DirectoryInfo -ArgumentList @($target)
+$stage = 'create'
+$directory.Create($security)
+$stage = 'acl-read'
+$check = $directory.GetAccessControl([System.Security.AccessControl.AccessControlSections]::All)
+$rules = @($check.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]))
+$ownerSid = $check.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
+$stage = 'acl-verify'
+if (-not $check.AreAccessRulesProtected -or $ownerSid -ne $sid.Value -or $rules.Count -ne 1) { throw 'unsafe ACL' }
+$ruleSid = $rules[0].IdentityReference.Value
+$hasFullControl = ($rules[0].FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -eq [System.Security.AccessControl.FileSystemRights]::FullControl
+if ($ruleSid -ne $sid.Value -or $rules[0].IsInherited -or -not $hasFullControl -or $rules[0].AccessControlType -ne [System.Security.AccessControl.AccessControlType]::Allow) { throw 'unsafe ACL' }
+} catch {
+  $type = $_.Exception.GetType().FullName
+  $hresult = ('0x{0:X8}' -f ($_.Exception.HResult -band 0xffffffffL))
+  [Console]::Error.WriteLine("stage=$stage type=$type hresult=$hresult")
+  exit 1
 }
-function defaultReadToken(env) {
-  const stateDir = env.OPENCLAW_STATE_DIR?.trim() || path3.join(os2.homedir(), ".openclaw");
-  const secretPath = path3.join(stateDir, "credentials", "browser-extension-relay.secret");
-  let raw;
-  try {
-    raw = fs4.readFileSync(secretPath, "utf8");
-  } catch {
-    return void 0;
+`;
+  const result = spawnSync(resolveSystemPowerShellPath(), ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], {
+    encoding: "utf8",
+    env: { ...process.env, [WINDOWS_ACL_PATH_ENV]: directory },
+    stdio: ["ignore", "ignore", "pipe"],
+    windowsHide: true
+  });
+  if (result.status !== 0) {
+    try {
+      fs4.rmdirSync(directory);
+    } catch {
+    }
+    const stderr = typeof result.stderr === "string" ? result.stderr.trim() : "";
+    const safeDetail = /^[A-Za-z0-9_.:=\- ]{1,240}$/u.test(stderr) ? stderr : `stage=spawn type=${result.error?.code ?? "unknown"} hresult=unknown`;
+    throw new Error(`Windows ACL setup failed: ${safeDetail}`);
   }
-  const token = raw.trim();
-  return /^[0-9a-f]{64}$/.test(token) ? token : void 0;
+  return directory;
+}
+function resolveSystemPowerShellPath() {
+  const systemRoot = process.env.SystemRoot?.trim() || process.env.WINDIR?.trim();
+  if (!systemRoot || !path3.win32.isAbsolute(systemRoot))
+    throw new Error("unsafe Windows system root");
+  const executable = path3.win32.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+  const stat = fs4.lstatSync(executable);
+  if (!stat.isFile() || stat.isSymbolicLink())
+    throw new Error("unsafe Windows PowerShell path");
+  return executable;
 }
-async function defaultProbe(versionUrl, token) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), RELAY_PROBE_TIMEOUT_MS);
-  timer.unref?.();
+function writeExclusiveFile(filePath, contents) {
+  const descriptor = fs4.openSync(filePath, fs4.constants.O_WRONLY | fs4.constants.O_CREAT | fs4.constants.O_EXCL | (fs4.constants.O_NOFOLLOW ?? 0), 384);
   try {
-    const response = await fetch(versionUrl, {
-      headers: { Authorization: `Bearer ${token}` },
-      signal: controller.signal
-    });
-    return response.status === 200;
-  } catch {
-    return false;
+    if (process.platform !== "win32")
+      fs4.fchmodSync(descriptor, 384);
+    fs4.writeFileSync(descriptor, contents, "utf8");
   } finally {
-    clearTimeout(timer);
+    fs4.closeSync(descriptor);
   }
+  assertSecurePath(filePath, "file");
 }
-function shouldAttemptChromeDevtoolsRelay(command, args, env = process.env) {
-  if (env.MCPORTER_DISABLE_CHROME_DEVTOOLS_RELAY === "1") {
-    return false;
-  }
-  const tokens = [command, ...args];
-  return tokens.some(isChromeDevtoolsToken2) && args.some((arg) => AUTO_CONNECT_FLAGS2.has(arg));
+function assertSecurePath(filePath, kind) {
+  const stat = fs4.lstatSync(filePath);
+  if ((kind === "directory" ? !stat.isDirectory() : !stat.isFile()) || stat.isSymbolicLink())
+    throw new Error("unsafe");
+  if (process.platform === "win32")
+    return;
+  if ((stat.mode & 63) !== 0)
+    throw new Error("unsafe");
+  if (typeof process.getuid === "function" && stat.uid !== process.getuid())
+    throw new Error("unsafe");
 }
-async function rewriteChromeDevtoolsArgsForRelay(command, args, env = process.env, options = {}) {
-  if (!shouldAttemptChromeDevtoolsRelay(command, args, env)) {
-    return { args, applied: false };
+function cleanupHandoff(directory, handoffPath, preloadPath) {
+  for (const filePath of [handoffPath, preloadPath]) {
+    try {
+      fs4.unlinkSync(filePath);
+    } catch {
+    }
+  }
+  try {
+    fs4.rmdirSync(directory);
+  } catch {
   }
-  const base = relayBaseUrl(env);
-  if (!base) {
-    return { args, applied: false };
+}
+function renderChromeDevtoolsRelayPreloadSource() {
+  return `import fs from 'node:fs';
+import path from 'node:path';
+
+const targetPath = process.argv[1]?.replaceAll('\\\\', '/').toLowerCase();
+if (targetPath?.includes('chrome-devtools-mcp')) {
+  const failureMessage = 'MCPorter Chrome relay authorization handoff unavailable.';
+  const fail = () => {
+    throw new Error(failureMessage);
+  };
+  const envName = ${JSON.stringify(CHROME_RELAY_HANDOFF_ENV)};
+  const handoffPath = process.env[envName];
+  delete process.env[envName];
+  if (!handoffPath || !path.isAbsolute(handoffPath)) fail();
+
+  const directoryStat = (() => {
+    try {
+      return fs.lstatSync(path.dirname(handoffPath));
+    } catch {
+      return fail();
+    }
+  })();
+  if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink()) fail();
+  if (process.platform !== 'win32') {
+    if ((directoryStat.mode & 0o077) !== 0) fail();
+    if (typeof process.getuid === 'function' && directoryStat.uid !== process.getuid()) fail();
   }
-  const token = (options.readToken ?? (() => defaultReadToken(env)))();
-  if (!token) {
-    return { args, applied: false };
+
+  const descriptor = (() => {
+    try {
+      return fs.openSync(handoffPath, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+    } catch {
+      return fail();
+    }
+  })();
+
+  let raw = '';
+  let consumed = false;
+  try {
+    const stat = fs.fstatSync(descriptor);
+    if (!stat.isFile() || stat.size <= 0 || stat.size > 4_096) fail();
+    if (process.platform !== 'win32') {
+      if ((stat.mode & 0o077) !== 0) fail();
+      if (typeof process.getuid === 'function' && stat.uid !== process.getuid()) fail();
+    }
+    raw = fs.readFileSync(descriptor, 'utf8');
+    try {
+      fs.unlinkSync(handoffPath);
+      consumed = true;
+    } catch {
+      try {
+        fs.ftruncateSync(descriptor, 0);
+        consumed = true;
+      } catch {
+        fail();
+      }
+    }
+  } finally {
+    fs.closeSync(descriptor);
   }
-  const versionUrl = new URL("/json/version", base).toString();
-  const alive = await (options.probe ?? defaultProbe)(versionUrl, token);
-  if (!alive) {
-    return { args, applied: false };
+  if (!consumed) fail();
+
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    fail();
   }
-  const wsEndpoint = `ws://${base.host}/cdp`;
-  const rewritten = args.filter((arg) => !AUTO_CONNECT_FLAGS2.has(arg));
-  rewritten.push("--wsEndpoint", wsEndpoint, "--wsHeaders", JSON.stringify({ Authorization: `Bearer ${token}` }));
-  return { args: rewritten, applied: true, endpoint: wsEndpoint };
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) fail();
+  const entries = Object.entries(parsed);
+  if (entries.length !== 1 || entries[0]?.[0] !== 'Authorization') fail();
+  const authorization = entries[0]?.[1];
+  if (typeof authorization !== 'string' || !/^Bearer [A-Za-z0-9_-]{43}$/u.test(authorization)) fail();
+
+  const terminatorIndex = process.argv.indexOf('--', 2);
+  const insertionIndex = terminatorIndex >= 0 ? terminatorIndex : process.argv.length;
+  process.argv.splice(insertionIndex, 0, '--wsHeaders', JSON.stringify({ Authorization: authorization }));
+}
+`;
 }
 
-// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/runtime/cached-auth.js
+// node_modules/.pnpm/mcporter@0.13.6/node_modules/mcporter/dist/runtime/cached-auth.js
 function hasAuthorizationHeader(headers) {
   return Boolean(headers && Object.keys(headers).some((key) => key.toLowerCase() === "authorization"));
 }
@@ -1317,392 +1461,7 @@ async function applyCachedAuthIfAvailable(definition, logger, allowCachedAuth) {
   }
 }
 
-// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/oauth.js
-import { spawn } from "node:child_process";
-import { createHash, randomUUID } from "node:crypto";
-import http from "node:http";
-import { URL as URL2 } from "node:url";
-var CALLBACK_HOST = "127.0.0.1";
-var CALLBACK_PATH = "/callback";
-var INTERACTIVE_AUTHORIZATION_TTL_MS = 3e5;
-function createDeferred() {
-  let resolve;
-  let reject;
-  const promise = new Promise((res, rej) => {
-    resolve = res;
-    reject = rej;
-  });
-  return { promise, resolve, reject };
-}
-function openExternal(url, platform = process.platform, launch = spawn) {
-  const stdio = "ignore";
-  try {
-    if (platform === "darwin") {
-      const child = launch("open", [url], { stdio, detached: true });
-      child.unref();
-    } else if (platform === "win32") {
-      const child = launch("rundll32", ["url.dll,FileProtocolHandler", url], {
-        stdio,
-        detached: true,
-        windowsHide: true
-      });
-      child.unref();
-    } else {
-      try {
-        const child = launch("xdg-open", [url], { stdio, detached: true });
-        child.on("error", () => {
-        });
-        child.unref();
-      } catch {
-      }
-    }
-  } catch {
-  }
-}
-var PersistentOAuthClientProvider = class _PersistentOAuthClientProvider {
-  definition;
-  options;
-  metadata;
-  logger;
-  persistence;
-  redirectUrlValue;
-  authorizationDeferred = null;
-  authorizationRedirectStarted = false;
-  // One interactive authorization transaction per provider: concurrent SDK auth() flows
-  // (background GET reconnect + bridged POST both hitting 401) must not each open a
-  // prompt, because only one persisted PKCE verifier can complete (issue #247).
-  interactiveAuthorization = null;
-  pendingVerifiersByChallenge = /* @__PURE__ */ new Map();
-  server;
-  constructor(definition, persistence, redirectUrl, logger, options = {}) {
-    this.definition = definition;
-    this.options = options;
-    this.redirectUrlValue = redirectUrl;
-    this.logger = logger;
-    this.persistence = persistence;
-    this.metadata = {
-      client_name: definition.clientName ?? `mcporter (${definition.name})`,
-      redirect_uris: [this.redirectUrlValue.toString()],
-      grant_types: ["authorization_code", "refresh_token"],
-      response_types: ["code"],
-      token_endpoint_auth_method: "none",
-      // Omit scope so the MCP SDK can derive it from the server's metadata
-      // (resource metadata scopes_supported or auth server scopes_supported).
-      // Hardcoding 'mcp:tools' breaks providers like Granola whose auth server
-      // does not recognise that scope value.
-      // If oauthScope is explicitly configured, prefer that exact value.
-      ...definition.oauthScope !== void 0 ? { scope: definition.oauthScope || void 0 } : {}
-    };
-  }
-  static async create(definition, logger, options = {}) {
-    validateClientMetadataUrl(definition.oauthClientMetadataUrl);
-    const persistence = await buildOAuthPersistence(definition, logger);
-    const server = http.createServer();
-    const overrideRedirect = definition.oauthRedirectUrl ? new URL2(definition.oauthRedirectUrl) : null;
-    const listenHost = overrideRedirect?.hostname ?? CALLBACK_HOST;
-    const overridePort = overrideRedirect?.port ?? "";
-    const usesDynamicPort = !overrideRedirect || overridePort === "" || overridePort === "0";
-    const desiredPort = usesDynamicPort ? void 0 : Number.parseInt(overridePort, 10);
-    const callbackPath = overrideRedirect?.pathname && overrideRedirect.pathname !== "/" ? overrideRedirect.pathname : CALLBACK_PATH;
-    const port = await new Promise((resolve, reject) => {
-      server.listen(desiredPort ?? 0, listenHost, () => {
-        const address = server.address();
-        if (typeof address === "object" && address && "port" in address) {
-          resolve(address.port);
-        } else {
-          reject(new Error("Failed to determine callback port"));
-        }
-      });
-      server.once("error", (error) => reject(error));
-    });
-    const redirectUrl = overrideRedirect ? new URL2(overrideRedirect.toString()) : new URL2(`http://${listenHost}:${port}${callbackPath}`);
-    if (usesDynamicPort) {
-      redirectUrl.port = String(port);
-    }
-    if (!overrideRedirect || overrideRedirect.pathname === "/" || overrideRedirect.pathname === "") {
-      redirectUrl.pathname = callbackPath;
-    }
-    if (usesDynamicPort) {
-      try {
-        const cachedClient = await persistence.readClientInfo();
-        const cachedRedirect = firstRedirectUri(cachedClient);
-        if (cachedRedirect && cachedRedirect !== redirectUrl.toString()) {
-          logger.info(`Redirect URI changed (${cachedRedirect} \u2192 ${redirectUrl.toString()}); clearing stale client registration.`);
-          await persistence.clear("client");
-        }
-      } catch (error) {
-        await new Promise((resolve) => {
-          server.close(() => resolve());
-        });
-        throw error;
-      }
-    }
-    const provider = new _PersistentOAuthClientProvider(definition, persistence, redirectUrl, logger, options);
-    provider.attachServer(server);
-    return {
-      provider,
-      close: async () => {
-        await provider.close();
-      }
-    };
-  }
-  // attachServer listens for the OAuth redirect and resolves/rejects the deferred code promise.
-  attachServer(server) {
-    this.server = server;
-    server.on("request", async (req, res) => {
-      try {
-        const url = req.url ?? "";
-        const parsed = new URL2(url, this.redirectUrlValue);
-        const expectedPath = this.redirectUrlValue.pathname || "/callback";
-        if (parsed.pathname !== expectedPath) {
-          res.statusCode = 404;
-          res.end("Not found");
-          return;
-        }
-        const code = parsed.searchParams.get("code");
-        const error = parsed.searchParams.get("error");
-        const receivedState = parsed.searchParams.get("state");
-        const iss = parsed.searchParams.get("iss") ?? void 0;
-        const expectedState = await this.persistence.readState();
-        if (expectedState && receivedState !== expectedState) {
-          res.statusCode = 400;
-          res.setHeader("Content-Type", "text/html");
-          res.end("<html><body><h1>Authorization failed</h1><p>Invalid OAuth state</p></body></html>");
-          this.authorizationDeferred?.reject(new Error("Invalid OAuth state"));
-          this.authorizationDeferred = null;
-          this.clearInteractiveAuthorization();
-          return;
-        }
-        if (code) {
-          this.logger.info(`Received OAuth authorization code for ${this.definition.name}`);
-          res.statusCode = 200;
-          res.setHeader("Content-Type", "text/html");
-          res.end("<html><body><h1>Authorization successful</h1><p>You can return to the CLI.</p></body></html>");
-          this.authorizationDeferred?.resolve({ code, iss });
-          this.authorizationDeferred = null;
-          this.clearInteractiveAuthorization();
-        } else if (error) {
-          res.statusCode = 400;
-          res.setHeader("Content-Type", "text/html");
-          res.end("<html><body><h1>Authorization failed</h1><p>Return to the CLI for details.</p></body></html>");
-          this.authorizationDeferred?.reject(new Error("OAuth authorization failed."));
-          this.authorizationDeferred = null;
-          this.clearInteractiveAuthorization();
-        } else {
-          res.statusCode = 400;
-          res.end("Missing authorization code");
-          this.authorizationDeferred?.reject(new Error("Missing authorization code"));
-          this.authorizationDeferred = null;
-          this.clearInteractiveAuthorization();
-        }
-      } catch (error) {
-        this.authorizationDeferred?.reject(error);
-        this.authorizationDeferred = null;
-        this.clearInteractiveAuthorization();
-      }
-    });
-  }
-  get redirectUrl() {
-    return this.redirectUrlValue;
-  }
-  get clientMetadata() {
-    return this.metadata;
-  }
-  get clientMetadataUrl() {
-    return this.definition.oauthClientMetadataUrl;
-  }
-  async state() {
-    const existing = await this.persistence.readState();
-    if (existing) {
-      return existing;
-    }
-    const state = randomUUID();
-    await this.persistence.saveState(state);
-    return state;
-  }
-  async clientInformation(ctx) {
-    const staticClient = buildStaticClientInformation(this.definition, { redirectUrl: this.redirectUrlValue });
-    if (staticClient) {
-      return { ...staticClient, ...ctx ? { issuer: ctx.issuer } : {} };
-    }
-    const stored = await this.persistence.readClientInfo();
-    if (ctx && stored?.issuer && !issuersMatch(stored.issuer, ctx.issuer)) {
-      await this.persistence.clear("client");
-      this.logger.info(`Discarded OAuth client registration for ${this.definition.name} after issuer changed.`);
-      return void 0;
-    }
-    return stored;
-  }
-  async saveClientInformation(clientInformation) {
-    await this.persistence.saveClientInfo(clientInformation);
-  }
-  async tokens(ctx) {
-    const stored = await this.persistence.readTokens();
-    if (ctx && stored?.issuer && !issuersMatch(stored.issuer, ctx.issuer)) {
-      await this.persistence.clear("tokens");
-      this.logger.info(`Discarded OAuth tokens for ${this.definition.name} after issuer changed.`);
-      return void 0;
-    }
-    return stored;
-  }
-  async saveTokens(tokens) {
-    await this.persistence.saveTokens(tokens);
-    this.logger.info(`Saved OAuth tokens for ${this.definition.name} (${this.persistence.describe()})`);
-  }
-  async redirectToAuthorization(authorizationUrl) {
-    this.authorizationRedirectStarted = true;
-    this.ensureAuthorizationDeferred();
-    const challenge = authorizationUrl.searchParams.get("code_challenge");
-    if (this.hasActiveInteractiveAuthorization()) {
-      if (challenge) {
-        this.pendingVerifiersByChallenge.delete(challenge);
-      }
-      this.logger.info(`Authorization already pending for ${this.definition.name}; suppressing duplicate prompt.`);
-      return;
-    }
-    this.interactiveAuthorization = { challenge, claimedAt: Date.now() };
-    const claimedVerifier = challenge ? this.pendingVerifiersByChallenge.get(challenge) : void 0;
-    if (challenge) {
-      this.pendingVerifiersByChallenge.delete(challenge);
-    }
-    if (claimedVerifier) {
-      await this.persistence.saveCodeVerifier(claimedVerifier);
-    }
-    const request = {
-      authorizationUrl: authorizationUrl.toString(),
-      redirectUrl: this.redirectUrlValue.toString()
-    };
-    if (this.options.suppressBrowserLaunch) {
-      await this.options.onAuthorizationUrl?.(request);
-      return;
-    }
-    this.logger.info(`Authorization required for ${this.definition.name}. Opening browser...`);
-    __oauthInternals.openExternal(request.authorizationUrl);
-    this.logger.warn(`If the browser did not open, visit ${request.authorizationUrl} manually.`);
-  }
-  hasAuthorizationRedirectStarted() {
-    return this.authorizationRedirectStarted;
-  }
-  async saveCodeVerifier(codeVerifier) {
-    this.pendingVerifiersByChallenge.set(challengeForVerifier(codeVerifier), codeVerifier);
-    if (this.hasActiveInteractiveAuthorization()) {
-      return;
-    }
-    await this.persistence.saveCodeVerifier(codeVerifier);
-  }
-  async codeVerifier() {
-    const value = await this.persistence.readCodeVerifier();
-    if (!value) {
-      throw new Error(`Missing PKCE code verifier for ${this.definition.name}`);
-    }
-    return value.trim();
-  }
-  // invalidateCredentials removes cached files to force the next OAuth flow.
-  async invalidateCredentials(scope) {
-    if (scope === "all" || scope === "verifier") {
-      this.clearInteractiveAuthorization();
-    }
-    await this.persistence.clear(scope);
-  }
-  async saveDiscoveryState(state) {
-    await this.persistence.saveDiscoveryState(state);
-  }
-  async discoveryState() {
-    return this.persistence.readDiscoveryState();
-  }
-  async saveAuthorizationServerUrl(url) {
-    await this.persistence.saveAuthorizationServerUrl(url);
-  }
-  async authorizationServerUrl() {
-    return this.persistence.readAuthorizationServerUrl();
-  }
-  async saveResourceUrl(url) {
-    await this.persistence.saveResourceUrl(url);
-  }
-  async resourceUrl() {
-    return this.persistence.readResourceUrl();
-  }
-  // waitForAuthorizationCode resolves once the local callback server captures a redirect.
-  // The same deferred is shared with redirectToAuthorization so callback resolution is stable.
-  async waitForAuthorizationCode() {
-    return (await this.waitForAuthorizationResponse()).code;
-  }
-  async waitForAuthorizationResponse() {
-    return this.ensureAuthorizationDeferred().promise;
-  }
-  // close stops the temporary callback server created for the OAuth session.
-  async close() {
-    if (this.authorizationDeferred) {
-      this.authorizationDeferred.reject(new Error("OAuth session closed before receiving authorization code."));
-      this.authorizationDeferred = null;
-      this.clearInteractiveAuthorization();
-    }
-    if (!this.server) {
-      return;
-    }
-    this.server.closeAllConnections?.();
-    const server = this.server;
-    this.server = void 0;
-    await new Promise((resolve) => {
-      server.close(() => resolve());
-    });
-  }
-  ensureAuthorizationDeferred() {
-    if (!this.authorizationDeferred) {
-      this.authorizationDeferred = createDeferred();
-    }
-    return this.authorizationDeferred;
-  }
-  hasActiveInteractiveAuthorization() {
-    if (!this.interactiveAuthorization) {
-      return false;
-    }
-    if (Date.now() - this.interactiveAuthorization.claimedAt > INTERACTIVE_AUTHORIZATION_TTL_MS) {
-      this.interactiveAuthorization = null;
-      return false;
-    }
-    return true;
-  }
-  clearInteractiveAuthorization() {
-    this.interactiveAuthorization = null;
-    this.pendingVerifiersByChallenge.clear();
-  }
-};
-async function createOAuthSession(definition, logger, options = {}) {
-  const { provider, close } = await PersistentOAuthClientProvider.create(definition, logger, options);
-  const waitForAuthorizationCode = () => provider.waitForAuthorizationCode();
-  const waitForAuthorizationResponse = () => provider.waitForAuthorizationResponse();
-  const hasAuthorizationRedirectStarted = () => provider.hasAuthorizationRedirectStarted();
-  return {
-    provider,
-    waitForAuthorizationCode,
-    waitForAuthorizationResponse,
-    hasAuthorizationRedirectStarted,
-    close
-  };
-}
-function challengeForVerifier(verifier) {
-  return createHash("sha256").update(verifier).digest("base64url");
-}
-function firstRedirectUri(client) {
-  if (!client || typeof client !== "object") {
-    return void 0;
-  }
-  const redirectUris = client.redirect_uris;
-  if (!Array.isArray(redirectUris)) {
-    return void 0;
-  }
-  const [first] = redirectUris;
-  return typeof first === "string" ? first : void 0;
-}
-function issuersMatch(first, second) {
-  return first === second || first.endsWith("/") && first.slice(0, -1) === second || second.endsWith("/") && second.slice(0, -1) === first;
-}
-var __oauthInternals = {
-  openExternal
-};
-
-// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/runtime-header-utils.js
+// node_modules/.pnpm/mcporter@0.13.6/node_modules/mcporter/dist/runtime-header-utils.js
 function materializeHeaders(headers, serverName) {
   if (!headers) {
     return void 0;
@@ -1719,8 +1478,8 @@ function materializeHeaders(headers, serverName) {
   return resolved;
 }
 
-// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/runtime/node-http-fetch.js
-import http2 from "node:http";
+// node_modules/.pnpm/mcporter@0.13.6/node_modules/mcporter/dist/runtime/node-http-fetch.js
+import http from "node:http";
 import https from "node:https";
 import { Buffer as Buffer2 } from "node:buffer";
 import { Readable } from "node:stream";
@@ -1755,7 +1514,7 @@ async function nodeHttp1FetchWithRedirects(input, init, redirectCount) {
     headers["content-length"] = String(Buffer2.byteLength(body));
   }
   return new Promise((resolve, reject) => {
-    const client = url.protocol === "https:" ? https : http2;
+    const client = url.protocol === "https:" ? https : http;
     const request = client.request(url, {
       method: init.method ?? "GET",
       headers
@@ -1875,7 +1634,7 @@ async function materializeRequestBody(body) {
   throw new TypeError("node-http1 fetch does not support streaming request bodies.");
 }
 
-// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/runtime/http-transport.js
+// node_modules/.pnpm/mcporter@0.13.6/node_modules/mcporter/dist/runtime/http-transport.js
 function extractTransportStatusCode(error) {
   if (!error || typeof error !== "object")
     return void 0;
@@ -1910,6 +1669,7 @@ function removeAuthorizationHeader(headers) {
   return Object.keys(headers).length > 0 ? headers : void 0;
 }
 var NODE_HTTP1_FETCH_HOSTS = /* @__PURE__ */ new Set(["api.sunsama.com"]);
+var STANDALONE_SSE_START_GRACE_MS = 250;
 function resolveHttpFetchOverride(definition) {
   if (definition.command.kind !== "http" || definition.httpFetch === "default")
     return void 0;
@@ -1954,6 +1714,26 @@ function trackStandaloneSseFetch(fetchOverride) {
     }
   };
 }
+function waitForStandaloneSseStart(started, signal) {
+  if (signal?.aborted)
+    return Promise.resolve();
+  return new Promise((resolve) => {
+    let settled = false;
+    const finish = () => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", finish);
+      resolve();
+    };
+    const timer = setTimeout(finish, STANDALONE_SSE_START_GRACE_MS);
+    signal?.addEventListener("abort", finish, { once: true });
+    if (signal?.aborted)
+      finish();
+    void started.then(finish);
+  });
+}
 async function closeOAuthSession(oauthSession) {
   await oauthSession?.close().catch(() => {
   });
@@ -1961,7 +1741,11 @@ async function closeOAuthSession(oauthSession) {
 function shouldAbortSseFallback(error) {
   if (isPostAuthConnectError(error))
     return !isLegacySseTransportMismatch(error);
-  return isOAuthFlowError(error) || error instanceof OAuthTimeoutError;
+  if (isOAuthFlowError(error) || error instanceof OAuthTimeoutError)
+    return true;
+  if (isUnauthorizedError(error))
+    return false;
+  return !isLegacySseTransportMismatch(error);
 }
 function isEraNegotiationFailure(error) {
   return !!error && typeof error === "object" && "code" in error && error.code === SdkErrorCode.EraNegotiationFailed;
@@ -2042,18 +1826,20 @@ async function connectPrimaryHttpTransport(client, definition, command, transpor
     recreateTransport: async () => createStreamableTransport()
   });
   if (typeof client.getProtocolEra === "function" && client.getProtocolEra() === "legacy") {
-    await transportOptions.standaloneSseStarted;
+    await waitForStandaloneSseStart(transportOptions.standaloneSseStarted, options.signal);
   }
   return { client, transport, definition, oauthSession };
 }
 async function connectSseFallbackTransport(client, definition, command, transportOptions, oauthSession, logger, options, wrapRecordTransport2, clientFactory) {
+  const createSseTransport = () => wrapRecordTransport2(new SSEClientTransport(command.url, transportOptions), definition, options);
   try {
-    const transport = await connectHttpTransport(client, wrapRecordTransport2(new SSEClientTransport(command.url, transportOptions), definition, options), oauthSession, logger, {
+    const transport = await connectHttpTransport(client, createSseTransport(), oauthSession, logger, {
       serverName: definition.name,
       serverUrl: command.url,
       maxAttempts: options.maxOAuthAttempts,
       oauthTimeoutMs: options.oauthTimeoutMs,
-      signal: options.signal
+      signal: options.signal,
+      recreateTransport: async () => createSseTransport()
     });
     return { client, transport, definition, oauthSession };
   } catch (sseError) {
@@ -2066,8 +1852,7 @@ async function connectSseFallbackTransport(client, definition, command, transpor
         options.onDefinitionPromoted?.(promoted);
         return createHttpClientContext(promoted, logger, options, wrapRecordTransport2, clientFactory);
       }
-      if (definition.auth)
-        throw sseError;
+      throw sseError;
     }
     throw sseError;
   }
@@ -2279,8 +2064,9 @@ var StdioClientTransport = class {
   }
 };
 
-// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/runtime/stdio-transport.js
+// node_modules/.pnpm/mcporter@0.13.6/node_modules/mcporter/dist/runtime/stdio-transport.js
 var McporterStdioTransport = class extends StdioClientTransport {
+  parameters;
   meta;
   closing = false;
   closeDelegate;
@@ -2288,6 +2074,7 @@ var McporterStdioTransport = class extends StdioClientTransport {
   closeInterceptor = () => {
     this.meta.code = this.closing ? 0 : 1;
     flushStdioLogs(this.meta);
+    void this.cleanup();
     this.closeDelegate?.();
   };
   messageInterceptor = (message) => {
@@ -2295,8 +2082,10 @@ var McporterStdioTransport = class extends StdioClientTransport {
       this.meta.stdoutChunks?.push(JSON.stringify(message));
     this.messageDelegate?.(message);
   };
+  cleanupPromise;
   constructor(parameters) {
     super({ ...parameters, stderr: "pipe" });
+    this.parameters = parameters;
     this.meta = {
       stderrChunks: [],
       stdoutChunks: STDIO_TRACE_ENABLED ? [] : void 0,
@@ -2339,8 +2128,14 @@ var McporterStdioTransport = class extends StdioClientTransport {
     } finally {
       this.meta.code ??= 0;
       flushStdioLogs(this.meta);
+      await this.cleanup();
     }
   }
+  cleanup() {
+    this.cleanupPromise ??= Promise.resolve(this.parameters.cleanup?.()).catch(() => {
+    });
+    return this.cleanupPromise;
+  }
   installInterceptors() {
     if (this.onclose !== this.closeInterceptor) {
       this.closeDelegate = this.onclose;
@@ -2353,7 +2148,7 @@ var McporterStdioTransport = class extends StdioClientTransport {
   }
 };
 
-// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/runtime/transport.js
+// node_modules/.pnpm/mcporter@0.13.6/node_modules/mcporter/dist/runtime/transport.js
 function shouldUseModeForServer(definition, serverFilter) {
   return !serverFilter || serverFilter === definition.name;
 }
@@ -2414,33 +2209,85 @@ async function createReplayClientContext(definition, replayPath, clientInfo, opt
   return { client, transport, definition, oauthSession: void 0 };
 }
 async function createStdioClientContext(client, definition, logger, options) {
-  const resolvedEnvOverrides = definition.env && Object.keys(definition.env).length > 0 ? Object.fromEntries(Object.entries(definition.env).map(([key, raw]) => [key, resolveEnvValue(raw)]).filter(([, value]) => value !== "")) : void 0;
-  const mergedEnv = resolvedEnvOverrides && Object.keys(resolvedEnvOverrides).length > 0 ? { ...process.env, ...resolvedEnvOverrides } : { ...process.env };
+  const mergedEnv = resolveChromeDevtoolsRelayEnvironment(definition.env);
   const command = resolveCommandArgument(definition.command.command);
   const resolvedArgs = resolveCommandArguments(definition.command.args);
-  const relay = await rewriteChromeDevtoolsArgsForRelay(command, resolvedArgs, mergedEnv);
-  if (relay.applied) {
-    logger.info(`Routing chrome-devtools-mcp through the OpenClaw extension relay at ${relay.endpoint} (no dialog).`);
-  }
-  const commandArgs = [...relay.args];
-  const compat = applyChromeDevtoolsCompat(mergedEnv, command, commandArgs);
-  if (compat.applied) {
-    logger.info(`Injecting chrome-devtools-mcp --autoConnect compatibility patch from ${compat.patchPath}.`);
-  }
-  const rawTransport = new McporterStdioTransport({
-    command,
-    args: commandArgs,
-    cwd: definition.command.cwd,
-    env: compat.env
-  });
-  const transport = wrapRecordTransport(rawTransport, definition, options);
+  const publishRelayDecision = (decision) => {
+    if (decision.reason === "not-eligible")
+      return;
+    recordChromeDevtoolsRelayDecision(definition.name, decision);
+    logger.info(`Chrome DevTools relay decision ${formatChromeDevtoolsRelayDecision(decision)}`);
+  };
+  let relayDecision;
+  let relay;
+  try {
+    relay = await rewriteChromeDevtoolsArgsForRelay(command, resolvedArgs, mergedEnv, { onDecision: (decision) => relayDecision = decision }, definition.chromeDevtoolsRelay);
+  } catch (error) {
+    if (relayDecision)
+      publishRelayDecision(relayDecision);
+    throw error;
+  }
+  let commandArgs = [...relay.args];
+  let activeProxy = relay.proxy;
+  let handoff;
+  let rawTransport;
+  try {
+    if (activeProxy) {
+      try {
+        handoff = createChromeDevtoolsRelayHandoff(mergedEnv, activeProxy.consumeClientAuthorization());
+      } catch {
+        await activeProxy.close().catch(() => {
+        });
+        activeProxy = void 0;
+        relayDecision = {
+          ...relay.decision,
+          route: relay.decision.policy === "require" ? "unavailable" : "legacy",
+          reason: "handoff-error"
+        };
+        if (relay.decision.policy === "require") {
+          publishRelayDecision(relayDecision);
+          throw new ChromeDevtoolsRelayRequiredError(relayDecision);
+        }
+        commandArgs = [...resolvedArgs];
+      }
+    }
+    const transportEnv = handoff?.env ?? mergedEnv;
+    const compat = applyChromeDevtoolsCompat(transportEnv, command, commandArgs);
+    if (compat.applied) {
+      logger.info(`Injecting chrome-devtools-mcp --autoConnect compatibility patch from ${compat.patchPath}.`);
+    }
+    if (relayDecision)
+      publishRelayDecision(relayDecision);
+    rawTransport = new McporterStdioTransport({
+      command,
+      args: commandArgs,
+      cwd: definition.command.cwd,
+      env: compat.env,
+      cleanup: activeProxy ? async () => {
+        await handoff?.close();
+        await activeProxy?.close();
+      } : void 0
+    });
+  } catch (error) {
+    await handoff?.close().catch(() => {
+    });
+    await activeProxy?.close().catch(() => {
+    });
+    throw error;
+  }
+  let transport;
+  try {
+    transport = wrapRecordTransport(rawTransport, definition, options);
+  } catch (error) {
+    await closeTransportAndWait(logger, rawTransport).catch(() => {
+    });
+    throw error;
+  }
   try {
     await client.connect(transport, { signal: options.signal });
   } catch (error) {
-    if (!options.signal?.aborted) {
-      await closeTransportAndWait(logger, transport).catch(() => {
-      });
-    }
+    await closeTransportAndWait(logger, transport).catch(() => {
+    });
     throw error;
   }
   return { client, transport, definition, oauthSession: void 0 };
@@ -2477,7 +2324,7 @@ async function createClientContext(definition, logger, clientInfo, options = {})
   });
 }
 
-// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/runtime/connection-cache.js
+// node_modules/.pnpm/mcporter@0.13.6/node_modules/mcporter/dist/runtime/connection-cache.js
 var RuntimeConnectionCache = class {
   definitions;
   options;
@@ -3030,7 +2877,7 @@ function connectionInfoFromClient(client) {
   };
 }
 
-// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/tool-filters.js
+// node_modules/.pnpm/mcporter@0.13.6/node_modules/mcporter/dist/tool-filters.js
 function validateToolFilters(name, filter) {
   if (filter.allowedTools !== void 0 && filter.blockedTools !== void 0) {
     throw new Error(`Server '${name}' cannot specify both allowedTools and blockedTools.`);
@@ -3052,7 +2899,7 @@ function filterTools(tools, filter) {
   return tools.filter((tool) => isToolAllowed(tool.name, filter));
 }
 
-// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/runtime.js
+// node_modules/.pnpm/mcporter@0.13.6/node_modules/mcporter/dist/runtime.js
 var PACKAGE_NAME = "mcporter";
 var OAUTH_CODE_TIMEOUT_MS = resolveOAuthTimeoutFromEnv();
 var MAX_RESOURCE_LIST_PAGES = 100;