@mcp-use/client 2.0.0-beta.10 → 2.0.0-beta.11

package/dist/react/index.js

@@ -1473,7 +1473,7 @@ var HttpConnector = class extends BaseConnector {
 };
 
 // src/utils/version.ts
-var VERSION = "2.0.0-beta.9";
+var VERSION = "2.0.0-beta.10";
 function getPackageVersion() {
   return VERSION;
 }
@@ -1696,29 +1696,39 @@ var OAuthSessionStore = class _OAuthSessionStore {
     if (ctx) await this.store.set(this.credentialKey("tokens"), serialized);
     await this.store.remove(this.getKey("code_verifier"));
     await this.store.remove(this.getKey("last_auth_url"));
+    await this.store.remove(this.getKey("last_auth_callback_url"));
   }
   async clientInformation(ctx) {
+    if (!this.allowClientSecret) {
+      const registeredRedirectUri = await this.store.get(
+        this.getKey("client_info_redirect_uri")
+      );
+      if (registeredRedirectUri !== this.redirectUrl) {
+        await this.invalidateCredentials("registration");
+        console.info(
+          `[${this.storageKeyPrefix}] Re-registering browser OAuth client after its Inspector callback changed or could not be verified.`
+        );
+        return void 0;
+      }
+    }
     const stored = await this.readCredential("client_info", ctx);
     if (!stored) return void 0;
     const { key, value: clientInfo } = stored;
     try {
       if (!this.allowClientSecret && clientInfo.client_secret) {
-        await this.store.remove(key);
-        if (ctx) await this.store.remove(this.credentialKey("client_info"));
+        await this.invalidateCredentials("registration");
         console.warn(
-          `[${this.storageKeyPrefix}] Removed OAuth client information containing a browser client_secret.`
+          `[${this.storageKeyPrefix}] Recovered stale browser OAuth credentials containing a client_secret.`
         );
         return void 0;
       }
       const storedRedirectUris = Array.isArray(clientInfo.redirect_uris) ? clientInfo.redirect_uris : [];
-      const hasMatchingRedirect = storedRedirectUris.length === 0 || storedRedirectUris.includes(this.redirectUrl);
+      const hasMatchingRedirect = storedRedirectUris.length === 0 && this.allowClientSecret || storedRedirectUris.includes(this.redirectUrl);
       if (!hasMatchingRedirect) {
         console.info(
-          `[${this.storageKeyPrefix}] Invalidating cached OAuth client info due to redirect URI mismatch.`
+          `[${this.storageKeyPrefix}] Recovering cached OAuth credentials after a redirect URI change.`
         );
-        await this.store.remove(key);
-        await this.store.remove(this.credentialKey("tokens", ctx));
-        await this.store.remove(this.getKey("last_auth_url"));
+        await this.invalidateCredentials("registration");
         return void 0;
       }
       return clientInfo;
@@ -1736,11 +1746,20 @@ var OAuthSessionStore = class _OAuthSessionStore {
         "Browser OAuth clients must be public clients; client_secret persistence is not allowed."
       );
     }
-    const serialized = JSON.stringify(clientInformation);
+    const persistedClientInformation = !this.allowClientSecret && (!("redirect_uris" in clientInformation) || !Array.isArray(
+      clientInformation.redirect_uris
+    ) || clientInformation.redirect_uris.length === 0) ? { ...clientInformation, redirect_uris: [this.redirectUrl] } : clientInformation;
+    const serialized = JSON.stringify(persistedClientInformation);
     await this.store.set(this.credentialKey("client_info", ctx), serialized);
     if (ctx) {
       await this.store.set(this.credentialKey("client_info"), serialized);
     }
+    if (!this.allowClientSecret) {
+      await this.store.set(
+        this.getKey("client_info_redirect_uri"),
+        this.redirectUrl
+      );
+    }
   }
   async saveCodeVerifier(codeVerifier) {
     await this.store.set(this.getKey("code_verifier"), codeVerifier);
@@ -1765,11 +1784,22 @@ var OAuthSessionStore = class _OAuthSessionStore {
       }
     };
     switch (scope) {
+      case "registration":
+        await removeCredentialKeys("tokens");
+        await removeCredentialKeys("client_info");
+        await this.store.remove(this.getKey("code_verifier"));
+        await this.store.remove(this.getKey("last_auth_url"));
+        await this.store.remove(this.getKey("last_auth_callback_url"));
+        await this.store.remove(this.getKey("client_info_redirect_uri"));
+        await this.store.remove(this.getKey("token_endpoint"));
+        break;
       case "all":
         await removeCredentialKeys("tokens");
         await removeCredentialKeys("client_info");
         await this.store.remove(this.getKey("code_verifier"));
         await this.store.remove(this.getKey("last_auth_url"));
+        await this.store.remove(this.getKey("last_auth_callback_url"));
+        await this.store.remove(this.getKey("client_info_redirect_uri"));
         await this.store.remove(this.getKey("discovery_state"));
         await this.store.remove(this.getKey("token_endpoint"));
         break;
@@ -1839,6 +1869,10 @@ var OAuthSessionStore = class _OAuthSessionStore {
     authorizationUrl.searchParams.set("state", state);
     const sanitizedAuthUrl = sanitizeUrl(authorizationUrl.toString());
     await this.store.set(stateKey, JSON.stringify(stateData));
+    await this.store.set(
+      this.getKey("last_auth_callback_url"),
+      this.redirectUrl
+    );
     await this.store.set(this.getKey("last_auth_url"), sanitizedAuthUrl);
     return sanitizedAuthUrl;
   }
@@ -2058,23 +2092,40 @@ var BrowserOAuthClientProvider = class {
         }
         return response2;
       }
-      const body = init?.body ? await serializeBody(init.body) : void 0;
+      const inputRequest = input instanceof Request ? input : void 0;
+      const method = init?.method ?? inputRequest?.method ?? "POST";
+      const requestHeaders = init?.headers ?? inputRequest?.headers;
+      let body;
+      if (init?.body !== void 0 && init.body !== null) {
+        body = await serializeBody(init.body);
+      } else if (inputRequest?.body && method !== "GET" && method !== "HEAD") {
+        body = await inputRequest.clone().text();
+      }
       const response = await base(proxyEndpoint, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
           serverUrl: this.serverUrl,
           url,
-          method: init?.method || "POST",
-          headers: init?.headers ? Object.fromEntries(new Headers(init.headers)) : {},
+          method,
+          headers: requestHeaders ? Object.fromEntries(new Headers(requestHeaders)) : {},
           body
         })
       });
       const data = await response.json();
+      if (!response.ok || typeof data.status !== "number") {
+        return new Response(JSON.stringify(data), {
+          status: response.status,
+          statusText: response.statusText,
+          headers: response.headers
+        });
+      }
       return new Response(JSON.stringify(data.body), {
         status: data.status,
-        statusText: data.statusText,
-        headers: new Headers(data.headers)
+        statusText: typeof data.statusText === "string" ? data.statusText : void 0,
+        headers: new Headers(
+          data.headers && typeof data.headers === "object" ? data.headers : void 0
+        )
       });
     };
   }
@@ -2218,7 +2269,31 @@ var BrowserOAuthClientProvider = class {
   getLastAttemptedAuthUrl() {
     const storedUrl = localStorage.getItem(this.getKey("last_auth_url"));
     if (!storedUrl) return null;
-    return sanitizeUrl(storedUrl);
+    const storedCallbackUrl = localStorage.getItem(
+      this.getKey("last_auth_callback_url")
+    );
+    if (storedCallbackUrl !== this.callbackUrl) {
+      console.info(
+        `[${this.storageKeyPrefix}] Recovering stale OAuth state whose callback cannot be verified.`
+      );
+      this.clearStorage();
+      return null;
+    }
+    const sanitized = sanitizeUrl(storedUrl);
+    try {
+      const redirectUri = new URL(sanitized).searchParams.get("redirect_uri");
+      if (redirectUri && new URL(redirectUri).toString() !== new URL(this.callbackUrl).toString()) {
+        console.info(
+          `[${this.storageKeyPrefix}] Recovering stale OAuth state after the Inspector callback path changed.`
+        );
+        this.clearStorage();
+        return null;
+      }
+    } catch {
+      this.clearStorage();
+      return null;
+    }
+    return sanitized;
   }
   clearStorage() {
     const prefixPattern = `${this.storageKeyPrefix}_${this.serverUrlHash}_`;
@@ -4062,9 +4137,14 @@ function startConnectionHealthMonitoring(params) {
         return;
       }
       const authHeaders = params.getAuthHeaders ? await params.getAuthHeaders() : {};
+      const healthCheckHeaders = {
+        ...params.allHeaders,
+        ...authHeaders,
+        ...params.gatewayUrl && params.url ? { "X-Target-URL": params.url } : {}
+      };
       const response = await fetch(healthCheckUrl, {
         method: "HEAD",
-        headers: { ...params.allHeaders, ...authHeaders },
+        headers: healthCheckHeaders,
         signal: AbortSignal.timeout(5e3)
       });
       if (response.status === 405 || response.status === 404) {
@@ -4908,9 +4988,22 @@ function useMcp(options) {
         });
         setTools(connection.tools || []);
         const [resourcesResult, promptsResult, templatesResult] = await Promise.all([
-          connection.listAllResources(),
-          connection.listPrompts(),
-          connection.supports("resources") ? connection.listResourceTemplates() : Promise.resolve({ resourceTemplates: [] })
+          connection.listAllResources().catch((error2) => {
+            addLog("warn", "Failed to load initial resources:", error2);
+            return { resources: [] };
+          }),
+          connection.listPrompts().catch((error2) => {
+            addLog("warn", "Failed to load initial prompts:", error2);
+            return { prompts: [] };
+          }),
+          connection.supports("resources") ? connection.listResourceTemplates().catch((error2) => {
+            addLog(
+              "warn",
+              "Failed to load initial resource templates:",
+              error2
+            );
+            return { resourceTemplates: [] };
+          }) : Promise.resolve({ resourceTemplates: [] })
         ]);
         if (!isMountedRef.current) {
           addLog(