@modelcontextprotocol/inspector 2.10.1 → 2.12.0

package/clients/web/build/index.js

@@ -159,6 +159,12 @@ var DirectoryReadResultSchema = z.looseObject({
   resources: z.array(DirectoryChildSchema),
   nextCursor: z.string().optional()
 });
+var ModernDirectoryReadResultSchema = DirectoryReadResultSchema.extend(
+  {
+    ttlMs: z.int().min(0),
+    cacheScope: z.enum(["public", "private"])
+  }
+);
 
 // ../../core/mcp/sha256.ts
 var K = new Uint32Array([
@@ -821,16 +827,30 @@ function buildConfigFromOptions(options) {
   const target = options.target ?? [];
   const first = target[0];
   const rest = target.slice(1);
+  if (first && options.serverUrl) {
+    throw new Error(
+      `Cannot combine a positional target (${first}) with --server-url (${options.serverUrl}). Pass one or the other.`
+    );
+  }
   const urlFromTarget = first && (first.startsWith("http://") || first.startsWith("https://")) ? first : null;
   const url = urlFromTarget ?? options.serverUrl ?? null;
   if (url) {
-    if (rest.length > 0 && urlFromTarget) {
+    if (rest.length > 0) {
       throw new Error("Arguments cannot be passed to a URL-based MCP server.");
     }
+    if (options.transport === "stdio") {
+      throw new Error(
+        `stdio transport cannot be used with a URL (${url}). Use --transport http or --transport sse, or pass a local command instead.`
+      );
+    }
     let transportType;
     const t = options.transport === "http" ? "streamable-http" : options.transport;
     if (t === "sse" || t === "streamable-http") {
       transportType = t;
+    } else if (t) {
+      throw new Error(
+        `Invalid transport type: ${t}. Valid types are: sse, http, stdio`
+      );
     } else {
       const u = new URL(url);
       if (u.pathname.endsWith("/mcp")) {
@@ -1047,14 +1067,25 @@ function readInspectorVersionSafe(callerUrl) {
 // ../../core/node/openUrl.ts
 import open from "open";
 var OPEN_URL_TIMEOUT_MS = 5e3;
-function launched(child) {
-  return new Promise((resolve10, reject) => {
-    child.on("error", reject);
-    child.once("spawn", () => resolve10());
+var OPENABLE_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
+function toOpenableHref(href) {
+  let parsed;
+  try {
+    parsed = new URL(href);
+  } catch {
+    throw new Error("refusing to open an invalid URL");
+  }
+  if (!OPENABLE_PROTOCOLS.has(parsed.protocol)) {
+    throw new Error(`refusing to open a non-http(s) URL (${parsed.protocol})`);
+  }
+  return parsed.href;
+}
+function absorbLateErrors(child) {
+  child.on("error", () => {
   });
 }
 async function openUrl(url, timeoutMs = OPEN_URL_TIMEOUT_MS) {
-  const href = typeof url === "string" ? url : url.href;
+  const href = toOpenableHref(typeof url === "string" ? url : url.href);
   let timer;
   const timeout = new Promise((_, reject) => {
     timer = setTimeout(
@@ -1063,8 +1094,7 @@ async function openUrl(url, timeoutMs = OPEN_URL_TIMEOUT_MS) {
     );
   });
   try {
-    const opened = Promise.resolve().then(() => open(href)).then(launched);
-    await Promise.race([opened, timeout]);
+    await Promise.race([open(href).then(absorbLateErrors), timeout]);
   } finally {
     clearTimeout(timer);
   }
@@ -1575,6 +1605,153 @@ function resolveAppOriginPublicOrigin(raw, allowedOrigins, sandboxUrl) {
   return url.origin;
 }
 
+// server/tls.ts
+import { readFileSync as readFileSync4 } from "fs";
+import { createSecureContext } from "tls";
+var TLS_KEY_PATH_ENV = "INSPECTOR_TLS_KEY_PATH";
+var TLS_CERT_PATH_ENV = "INSPECTOR_TLS_CERT_PATH";
+function webScheme(tls) {
+  return tls ? "https" : "http";
+}
+function readPem(env, path6) {
+  try {
+    return readFileSync4(path6, "utf-8");
+  } catch (err) {
+    const { code } = err;
+    throw new Error(
+      `Cannot read ${env}="${path6}" (${code}): check that the file exists and is readable.`,
+      { cause: err }
+    );
+  }
+}
+function resolveTlsConfig(env = process.env) {
+  const keyPath = env[TLS_KEY_PATH_ENV]?.trim();
+  const certPath = env[TLS_CERT_PATH_ENV]?.trim();
+  if (!keyPath && !certPath) return void 0;
+  if (!keyPath || !certPath) {
+    const missing = keyPath ? TLS_CERT_PATH_ENV : TLS_KEY_PATH_ENV;
+    throw new Error(
+      `TLS needs both ${TLS_KEY_PATH_ENV} and ${TLS_CERT_PATH_ENV}; ${missing} is not set. Set both to enable https, or neither for plain http.`
+    );
+  }
+  const key = readPem(TLS_KEY_PATH_ENV, keyPath);
+  const cert = readPem(TLS_CERT_PATH_ENV, certPath);
+  try {
+    if (!key.trim() || !cert.trim()) throw new Error("empty PEM file");
+    createSecureContext({ key, cert });
+  } catch (err) {
+    const reason = err.message;
+    throw new Error(
+      `${TLS_KEY_PATH_ENV}="${keyPath}" and ${TLS_CERT_PATH_ENV}="${certPath}" are not a usable PEM key/certificate pair (${reason}).`,
+      { cause: err }
+    );
+  }
+  return { key, cert };
+}
+
+// server/host-allow-list.ts
+import { isIPv4, isIPv6 as isIPv62 } from "net";
+import { domainToASCII } from "url";
+var ALLOWED_HOSTS_ENV = "MCP_INSPECTOR_ALLOWED_HOSTS";
+var HOSTNAME_RE = /^[a-z0-9._-]+$/;
+function normalizeHostname(hostname) {
+  return hostname.trim().toLowerCase().replace(/\.$/, "");
+}
+function parseHostHeader(value) {
+  const raw = value.trim().toLowerCase();
+  let hostname;
+  let port;
+  if (raw.startsWith("[")) {
+    const end = raw.indexOf("]");
+    if (end < 0) return null;
+    hostname = raw.slice(0, end + 1);
+    if (!isIPv62(hostname.slice(1, -1))) return null;
+    const rest = raw.slice(end + 1);
+    if (rest !== "") {
+      if (!rest.startsWith(":")) return null;
+      port = rest.slice(1);
+    }
+  } else {
+    const colon = raw.indexOf(":");
+    hostname = colon < 0 ? raw : raw.slice(0, colon);
+    port = colon < 0 ? void 0 : raw.slice(colon + 1);
+  }
+  if (port !== void 0) {
+    if (!/^\d{1,5}$/.test(port) || Number(port) > 65535) return null;
+  }
+  if (hostname.startsWith("[")) return hostname;
+  const name = normalizeHostname(hostname);
+  return HOSTNAME_RE.test(name) ? name : null;
+}
+function parseAllowedHostsEnv(value) {
+  if (!value) return [];
+  const out = [];
+  for (const entry of value.split(",")) {
+    const trimmed = entry.trim();
+    if (trimmed === "") continue;
+    const domain = trimmed.startsWith(".") ? "." : "";
+    const ascii = /[\s/:*@]/.test(trimmed) ? "" : domainToASCII(normalizeHostname(trimmed.slice(domain.length)));
+    if (!HOSTNAME_RE.test(ascii)) {
+      console.warn(
+        `Ignoring invalid ${ALLOWED_HOSTS_ENV} entry: ${trimmed} (list bare hostnames, e.g. inspector.example.com or .example.com)`
+      );
+      continue;
+    }
+    out.push(domain + ascii);
+  }
+  return out;
+}
+function configuredAllowedHosts(options) {
+  const hosts = /* @__PURE__ */ new Set();
+  if (!isAllInterfacesHost(options.bindHost)) {
+    hosts.add(normalizeHostname(canonicalUrlHost(options.bindHost)));
+  }
+  for (const origin of options.allowedOrigins) {
+    try {
+      const { hostname } = new URL(origin);
+      if (hostname !== "") hosts.add(normalizeHostname(hostname));
+    } catch {
+    }
+  }
+  for (const extra of options.extraHosts ?? []) {
+    hosts.add(normalizeHostname(extra));
+  }
+  return [...hosts];
+}
+function createHostAllowList(options) {
+  const configured = configuredAllowedHosts(options);
+  return (hostHeader) => {
+    if (hostHeader === void 0) return false;
+    const hostname = parseHostHeader(hostHeader);
+    if (hostname === null) return false;
+    if (hostname.startsWith("[")) return true;
+    if (isIPv4(hostname)) return true;
+    if (hostname === "localhost" || hostname.endsWith(".localhost")) {
+      return true;
+    }
+    for (const allowed of configured) {
+      if (allowed === hostname) return true;
+      if (allowed.startsWith(".") && (allowed.slice(1) === hostname || hostname.endsWith(allowed))) {
+        return true;
+      }
+    }
+    return false;
+  };
+}
+function hostAllowListMiddleware(options) {
+  const isAllowed = createHostAllowList(options);
+  return async (c, next) => {
+    const host = c.req.header("host");
+    if (!isAllowed(host)) {
+      return c.text(
+        `Forbidden: Host "${host ?? ""}" is not allowed. To serve the Inspector under this name, add it to ${ALLOWED_HOSTS_ENV} (or to ALLOWED_ORIGINS).`,
+        403
+      );
+    }
+    await next();
+  };
+}
+
 // server/web-server-config.ts
 var inspectorVersion = readInspectorVersionSafe(import.meta.url);
 function defaultEnvironmentFromProcess(extra) {
@@ -1656,7 +1833,7 @@ function transportDefaults(config) {
 function printServerBanner(config, actualPort, resolvedToken, sandboxUrl, secretStorage) {
   const h = canonicalUrlHost(config.hostname);
   const bannerHost = isAllInterfacesHost(h) ? "localhost" : h;
-  const baseUrl = httpOrigin(bannerHost, actualPort);
+  const baseUrl = webOrigin(webScheme(config.tls), bannerHost, actualPort);
   const url = config.dangerouslyOmitAuth || !resolvedToken ? baseUrl : `${baseUrl}?${API_SERVER_ENV_VARS.AUTH_TOKEN}=${resolvedToken}`;
   console.log(`
 MCP Inspector Web is up and running at:
@@ -1681,35 +1858,42 @@ MCP Inspector Web is up and running at:
   }
   return url;
 }
+function portInUseMessage(config) {
+  return `MCP Inspector PORT IS IN USE at ${webScheme(config.tls)}://${formatHostForUrl(config.hostname)}:${config.port}`;
+}
 function openBrowser(url) {
   openUrl(url).catch((err) => {
-    console.warn("Could not open a browser automatically:", err);
+    const reason = err instanceof Error ? err.message : String(err);
+    console.warn(
+      `Could not open a browser automatically (${reason}). Open the URL above manually.`
+    );
   });
 }
 var LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
-function httpOrigin(host, port) {
-  return port === 80 ? `http://${host}` : `http://${host}:${port}`;
+function webOrigin(scheme, host, port) {
+  const defaultPort = scheme === "https" ? 443 : 80;
+  return port === defaultPort ? `${scheme}://${host}` : `${scheme}://${host}:${port}`;
 }
-function loopbackOrigins(port) {
+function loopbackOrigins(scheme, port) {
   return [
-    httpOrigin("localhost", port),
-    httpOrigin("127.0.0.1", port),
-    httpOrigin("[::1]", port)
+    webOrigin(scheme, "localhost", port),
+    webOrigin(scheme, "127.0.0.1", port),
+    webOrigin(scheme, "[::1]", port)
   ];
 }
-function defaultAllowedOrigins(hostname, port) {
+function defaultAllowedOrigins(hostname, port, scheme = "http") {
   const h = canonicalUrlHost(hostname);
   if (LOOPBACK_HOSTNAMES.has(h)) {
-    return loopbackOrigins(port);
+    return loopbackOrigins(scheme, port);
   }
   if (isAllInterfacesHost(h)) {
     return [
-      ...loopbackOrigins(port),
-      httpOrigin("0.0.0.0", port),
-      httpOrigin("[::]", port)
+      ...loopbackOrigins(scheme, port),
+      webOrigin(scheme, "0.0.0.0", port),
+      webOrigin(scheme, "[::]", port)
     ];
   }
-  return [httpOrigin(h, port)];
+  return [webOrigin(scheme, h, port)];
 }
 function buildWebServerConfig(options = {}) {
   const {
@@ -1726,6 +1910,7 @@ function buildWebServerConfig(options = {}) {
     );
   }
   const hostname = resolveBindHostname();
+  const tls = resolveTlsConfig();
   const dangerouslyOmitAuth = isEnvFlagEnabled(
     process.env.DANGEROUSLY_OMIT_AUTH
   );
@@ -1761,7 +1946,7 @@ function buildWebServerConfig(options = {}) {
       return null;
     }
   }).filter((o) => o !== null);
-  const allowedOrigins = configuredOrigins?.length ? configuredOrigins : defaultAllowedOrigins(hostname, port);
+  const allowedOrigins = configuredOrigins?.length ? configuredOrigins : defaultAllowedOrigins(hostname, port, webScheme(tls));
   const sandboxPublicUrl = resolveSandboxPublicUrl(
     process.env[SANDBOX_FULL_ADDRESS_ENV],
     allowedOrigins
@@ -1782,13 +1967,15 @@ function buildWebServerConfig(options = {}) {
     initialServers,
     storageDir: process.env.MCP_STORAGE_DIR,
     allowedOrigins,
+    allowedHosts: parseAllowedHostsEnv(process.env[ALLOWED_HOSTS_ENV]),
     sandboxPort,
     sandboxHost: hostname,
     appOriginPort,
     sandboxPublicUrl,
     appOriginPublicOrigin,
     logger,
-    autoOpen: resolveAutoOpen()
+    autoOpen: resolveAutoOpen(),
+    ...tls ? { tls } : {}
   };
 }
 function resolveAutoOpen() {
@@ -1806,7 +1993,7 @@ import react from "@vitejs/plugin-react";
 
 // ../../core/mcp/remote/node/server.ts
 import { randomBytes as randomBytes3, timingSafeEqual } from "crypto";
-import { existsSync as existsSync3, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync7 } from "fs";
 import { stat as fsStat } from "fs/promises";
 import { homedir } from "os";
 import { Hono } from "hono";
@@ -2291,7 +2478,10 @@ function parseAuthChallengeFromResponse(response, context) {
   if (status !== 401 && status !== 403) {
     return void 0;
   }
-  const wwwAuthenticate = response.headers.get("WWW-Authenticate") ?? void 0;
+  const wwwAuthenticate = response.headers.get("WWW-Authenticate") || void 0;
+  if (status === 403 && !wwwAuthenticate) {
+    return void 0;
+  }
   const bearer = wwwAuthenticate ? parseWwwAuthenticateBearer(wwwAuthenticate) : {};
   const requiredScopes = parseScopeString(bearer.scope);
   return {
@@ -2620,9 +2810,96 @@ function createTransportNode(config, options = {}) {
   }
 }
 
+// ../../core/mcp/remote/node/cappedBody.ts
+async function readCappedText(body, maxBytes) {
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let text = "";
+  let bytes = 0;
+  for (; ; ) {
+    const next = await reader.read();
+    if (next.done) return { kind: "complete", text: text + decoder.decode() };
+    bytes += next.value.byteLength;
+    if (bytes > maxBytes) {
+      void reader.cancel().catch(() => {
+      });
+      return { kind: "overflow" };
+    }
+    text += decoder.decode(next.value, { stream: true });
+  }
+}
+function declaresOversizeBody(contentLength, maxBytes) {
+  if (contentLength === null || !/^\s*\d+\s*$/.test(contentLength)) {
+    return false;
+  }
+  return Number(contentLength) > maxBytes;
+}
+
 // ../../core/auth/requestTimeout.ts
 var OAUTH_TIMEOUT_WIRE_CODE = "oauth_request_timeout";
 
+// ../../core/mcp/rateLimit.ts
+import {
+  SdkHttpError
+} from "@modelcontextprotocol/client";
+
+// ../../core/mcp/connectionDiagnostics.ts
+import { SdkError, SdkErrorCode } from "@modelcontextprotocol/client";
+
+// ../../core/mcp/rateLimit.ts
+var HTTP_TOO_MANY_REQUESTS = 429;
+function requestIdsOf(body) {
+  if (body === void 0) return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return [];
+  }
+  const messages = Array.isArray(parsed) ? parsed : [parsed];
+  const ids = [];
+  for (const message of messages) {
+    if (typeof message !== "object" || message === null) continue;
+    if (!("method" in message) || !("id" in message)) continue;
+    const { id } = message;
+    if (typeof id === "string" || typeof id === "number") ids.push(id);
+  }
+  return ids;
+}
+var MAX_UNCLAIMED_RATE_LIMITS = 100;
+var RateLimitLedger = class {
+  // `undefined` is a real value here: a 429 that carried no header.
+  byRequestId = /* @__PURE__ */ new Map();
+  /** File a tracked fetch, if it was a 429. Anything else is ignored. */
+  record(entry) {
+    if (entry.responseStatus !== HTTP_TOO_MANY_REQUESTS) return;
+    const retryAfter = findHeader(entry.responseHeaders, "retry-after");
+    for (const id of requestIdsOf(entry.requestBody)) {
+      this.byRequestId.delete(id);
+      this.byRequestId.set(id, retryAfter);
+      if (this.byRequestId.size > MAX_UNCLAIMED_RATE_LIMITS) {
+        const [oldest] = this.byRequestId.keys();
+        if (oldest !== void 0) this.byRequestId.delete(oldest);
+      }
+    }
+  }
+  /** The `Retry-After` filed for `id`, removed as it is read. */
+  take(id) {
+    const retryAfter = this.byRequestId.get(id);
+    this.byRequestId.delete(id);
+    return retryAfter;
+  }
+  clear() {
+    this.byRequestId.clear();
+  }
+};
+function isRateLimitError(err) {
+  return SdkHttpError.isInstance(err) && err.status === HTTP_TOO_MANY_REQUESTS;
+}
+
+// ../../core/mcp/remote/node/server.ts
+import { SdkHttpError as SdkHttpError2 } from "@modelcontextprotocol/client";
+
 // ../../core/auth/oauth-persist.ts
 import { OAuthTokensSchema } from "@modelcontextprotocol/core";
 var OAUTH_PERSIST_STORE_ID = "oauth";
@@ -3250,7 +3527,7 @@ import * as path4 from "path";
 
 // ../../core/auth/node/file-secret-store.ts
 import * as crypto2 from "crypto";
-import { readFileSync as readFileSync4, statSync as statSync2 } from "fs";
+import { readFileSync as readFileSync5, statSync as statSync2 } from "fs";
 import * as fs3 from "fs/promises";
 import * as path3 from "path";
 var scrypt2 = (passphrase, salt, keylen, options) => new Promise((resolve10, reject) => {
@@ -3303,7 +3580,7 @@ function resolveSecretPassphrase(env = process.env, secretFilePath) {
   }
   let contents;
   try {
-    contents = readFileSync4(resolved2, "utf-8");
+    contents = readFileSync5(resolved2, "utf-8");
   } catch (err) {
     return {
       // `String(err)` rather than `.message`: `readFileSync` only ever throws
@@ -4333,7 +4610,7 @@ async function resolveConcreteSecretStore(store) {
 import { resolve as resolve6 } from "path";
 
 // ../../core/auth/node/oauth-secrets.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { createHmac, randomUUID as randomUUID2 } from "crypto";
 import { OAuthTokensSchema as OAuthTokensSchema2 } from "@modelcontextprotocol/core";
 var PERSIST_TOKENS_ENV = "MCP_INSPECTOR_PERSIST_TOKENS";
 var warnedPolicyValues = /* @__PURE__ */ new Set();
@@ -4366,6 +4643,29 @@ var LEGACY_REGISTRATION_TOKEN_FIELD = "registration-token";
 var PREREG_CLIENT_SECRET_FIELD = "prereg-client-secret";
 var PREREG_REGISTRATION_TOKEN_FIELD = "prereg-registration-token";
 var IDP_SESSION_FIELD = "idp-session";
+var clientCredentialStampField = (field) => `${field}#owner`;
+var credentialMac = (clientId, value) => createHmac("sha256", value).update(clientId).digest("hex");
+function clientCredentialStamp(clientId, value) {
+  return JSON.stringify({
+    client_id: clientId,
+    mac: credentialMac(clientId, value)
+  });
+}
+function stampedOwner(stamp, value) {
+  if (stamp === void 0) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(stamp);
+  } catch {
+    return void 0;
+  }
+  if (typeof parsed !== "object" || parsed === null) return void 0;
+  const { client_id: clientId, mac } = parsed;
+  if (typeof clientId !== "string" || mac !== credentialMac(clientId, value)) {
+    return void 0;
+  }
+  return clientId;
+}
 function applyTokensPolicy(tokens, policy) {
   if (policy === "none") return void 0;
   if (policy === "access" && tokens.refresh_token !== void 0) {
@@ -4394,12 +4694,18 @@ function splitClientInformation(info, fields, secrets) {
   if (client_secret === void 0 && registration_access_token === void 0) {
     return info;
   }
-  if (client_secret !== void 0) {
-    secrets[fields.clientSecret] = client_secret;
-  }
-  if (registration_access_token !== void 0) {
-    secrets[fields.registrationToken] = registration_access_token;
-  }
+  const put = (field, value) => {
+    if (value === void 0) return;
+    secrets[field] = value;
+    if (fields.stamped && typeof info.client_id === "string") {
+      secrets[clientCredentialStampField(field)] = clientCredentialStamp(
+        info.client_id,
+        value
+      );
+    }
+  };
+  put(fields.clientSecret, client_secret);
+  put(fields.registrationToken, registration_access_token);
   return publicInfo;
 }
 function joinClientInformation(info, fields, secrets) {
@@ -4418,15 +4724,18 @@ function joinClientInformation(info, fields, secrets) {
 }
 var issuerClientInfoFields = (issuer) => ({
   clientSecret: issuerClientSecretField(issuer),
-  registrationToken: issuerRegistrationTokenField(issuer)
+  registrationToken: issuerRegistrationTokenField(issuer),
+  stamped: true
 });
 var LEGACY_CLIENT_INFO_FIELDS = {
   clientSecret: LEGACY_CLIENT_SECRET_FIELD,
-  registrationToken: LEGACY_REGISTRATION_TOKEN_FIELD
+  registrationToken: LEGACY_REGISTRATION_TOKEN_FIELD,
+  stamped: true
 };
 var PREREG_CLIENT_INFO_FIELDS = {
   clientSecret: PREREG_CLIENT_SECRET_FIELD,
-  registrationToken: PREREG_REGISTRATION_TOKEN_FIELD
+  registrationToken: PREREG_REGISTRATION_TOKEN_FIELD,
+  stamped: false
 };
 function splitServerOAuthState(state, policy) {
   const secrets = {};
@@ -4576,20 +4885,54 @@ function joinIdpSession(residue, secrets) {
   return stored ? { ...residue, ...stored } : { ...residue };
 }
 function serverSecretFields(state) {
+  const stamped = (field) => [
+    field,
+    clientCredentialStampField(field)
+  ];
   const fields = /* @__PURE__ */ new Set([
     LEGACY_TOKENS_FIELD,
-    LEGACY_CLIENT_SECRET_FIELD,
-    LEGACY_REGISTRATION_TOKEN_FIELD,
+    ...stamped(LEGACY_CLIENT_SECRET_FIELD),
+    ...stamped(LEGACY_REGISTRATION_TOKEN_FIELD),
     PREREG_CLIENT_SECRET_FIELD,
     PREREG_REGISTRATION_TOKEN_FIELD
   ]);
   for (const issuer of Object.keys(state?.byIssuer ?? {})) {
     fields.add(issuerTokensField(issuer));
-    fields.add(issuerClientSecretField(issuer));
-    fields.add(issuerRegistrationTokenField(issuer));
+    for (const field of stamped(issuerClientSecretField(issuer))) {
+      fields.add(field);
+    }
+    for (const field of stamped(issuerRegistrationTokenField(issuer))) {
+      fields.add(field);
+    }
   }
   return [...fields];
 }
+function clientCredentialOwners(state) {
+  const owners = /* @__PURE__ */ new Map();
+  const add = (info, fields) => {
+    if (typeof info?.client_id !== "string") return;
+    owners.set(fields.clientSecret, info.client_id);
+    owners.set(fields.registrationToken, info.client_id);
+  };
+  add(state.clientInformation, LEGACY_CLIENT_INFO_FIELDS);
+  for (const [issuer, slot] of Object.entries(state.byIssuer ?? {})) {
+    add(slot.clientInformation, issuerClientInfoFields(issuer));
+  }
+  return owners;
+}
+function restampClientCredentials(state, secrets) {
+  const out = { ...secrets };
+  for (const [field, clientId] of clientCredentialOwners(state)) {
+    const stampField = clientCredentialStampField(field);
+    const value = Object.hasOwn(out, field) ? out[field] : void 0;
+    if (value === void 0) {
+      delete out[stampField];
+    } else if (stampedOwner(out[stampField], value) === void 0) {
+      setOwnEntry(out, stampField, clientCredentialStamp(clientId, value));
+    }
+  }
+  return out;
+}
 function clientInfoHasPlaintext(info) {
   return info !== void 0 && (info.client_secret !== void 0 || info.registration_access_token !== void 0);
 }
@@ -4630,6 +4973,44 @@ function coveredLocations(location, byLocation) {
     ([recorded]) => recorded === location || location === KEYRING_LOCATION && recorded.startsWith(FILE_LOCATION_PREFIX)
   ).map(([recorded, keys]) => ({ location: recorded, keys }));
 }
+var emptyKeys = () => ({
+  servers: /* @__PURE__ */ new Set(),
+  idpSessions: /* @__PURE__ */ new Set(),
+  owners: /* @__PURE__ */ new Map()
+});
+function candidateFields(location, byLocation) {
+  const fields = /* @__PURE__ */ new Map();
+  for (const { keys } of coveredLocations(location, byLocation)) {
+    for (const [url, owned] of keys.owners) {
+      const kept = fields.get(url) ?? /* @__PURE__ */ new Set();
+      for (const field of owned.keys()) kept.add(field);
+      fields.set(url, kept);
+    }
+  }
+  return fields;
+}
+function addMissingOwners(target, source) {
+  for (const [url, fields] of source) {
+    const kept = target.get(url) ?? /* @__PURE__ */ new Map();
+    for (const [field, clientId] of fields) {
+      if (!kept.has(field)) kept.set(field, clientId);
+    }
+    if (kept.size > 0) target.set(url, kept);
+  }
+}
+function mergeOwners(target, source) {
+  let changed = false;
+  for (const [url, fields] of source) {
+    const kept = target.get(url) ?? /* @__PURE__ */ new Map();
+    for (const [field, clientId] of fields) {
+      if (kept.get(field) === clientId) continue;
+      kept.set(field, clientId);
+      changed = true;
+    }
+    if (kept.size > 0) target.set(url, kept);
+  }
+  return changed;
+}
 var warnedLedgerFailures = /* @__PURE__ */ new Set();
 function warnLedgerFailure(what, error) {
   const reason = error instanceof Error ? error.message : String(error);
@@ -4643,6 +5024,19 @@ function warnLedgerFailure(what, error) {
 function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function parseOwners(value) {
+  const owners = /* @__PURE__ */ new Map();
+  if (!isRecord3(value)) return owners;
+  for (const [url, fields] of Object.entries(value)) {
+    if (!isRecord3(fields)) continue;
+    const byField = /* @__PURE__ */ new Map();
+    for (const [field, clientId] of Object.entries(fields)) {
+      if (typeof clientId === "string") byField.set(field, clientId);
+    }
+    if (byField.size > 0) owners.set(url, byField);
+  }
+  return owners;
+}
 function stringsOf(value) {
   return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
@@ -4664,7 +5058,9 @@ function parseLedger(raw) {
       if (!isRecord3(keys)) continue;
       byLocation.set(location, {
         servers: new Set(stringsOf(keys.servers)),
-        idpSessions: new Set(stringsOf(keys.idpSessions))
+        idpSessions: new Set(stringsOf(keys.idpSessions)),
+        owners: parseOwners(keys.owners),
+        ...isValidSecretsNamespace(keys.owedTo) && { owedTo: keys.owedTo }
       });
     }
     if (byLocation.size > 0) ledger.set(namespace, byLocation);
@@ -4678,7 +5074,19 @@ function serializeLedger(ledger) {
       Object.fromEntries(
         [...byLocation].map(([location, keys]) => [
           location,
-          { servers: [...keys.servers], idpSessions: [...keys.idpSessions] }
+          {
+            servers: [...keys.servers],
+            idpSessions: [...keys.idpSessions],
+            ...keys.owners.size > 0 && {
+              owners: Object.fromEntries(
+                [...keys.owners].map(([url, fields]) => [
+                  url,
+                  Object.fromEntries(fields)
+                ])
+              )
+            },
+            ...keys.owedTo !== void 0 && { owedTo: keys.owedTo }
+          }
         ])
       )
     ])
@@ -4690,7 +5098,7 @@ async function writeLedger(stateFilePath, ledger) {
   if (ledger.size === 0) await deleteStoreFile(path6);
   else await writeStoreFile(path6, serializeLedger(ledger));
 }
-async function recordNamespaceKeys(stateFilePath, secretStore, namespace, servers, idpSessions) {
+async function recordNamespaceKeys(stateFilePath, secretStore, namespace, servers, idpSessions, owners = /* @__PURE__ */ new Map()) {
   try {
     const ledger = parseLedger(
       await readStoreFile(namespaceLedgerPath(stateFilePath))
@@ -4704,7 +5112,7 @@ async function recordNamespaceKeys(stateFilePath, secretStore, namespace, server
     let keys = byLocation.get(location);
     let changed = false;
     if (!keys) {
-      keys = { servers: /* @__PURE__ */ new Set(), idpSessions: /* @__PURE__ */ new Set() };
+      keys = emptyKeys();
       byLocation.set(location, keys);
       changed = true;
     }
@@ -4718,12 +5126,105 @@ async function recordNamespaceKeys(stateFilePath, secretStore, namespace, server
       keys.idpSessions.add(issuer);
       changed = true;
     }
+    if (mergeOwners(keys.owners, owners)) changed = true;
     if (changed) await writeLedger(stateFilePath, ledger);
   } catch (error) {
     warnLedgerFailure("update", error);
   }
 }
-async function purgeSupersededNamespaces(stateFilePath, secretStore, current) {
+async function markUncarriedNamespaces(stateFilePath, secretStore, into) {
+  const ledger = parseLedger(
+    await readStoreFile(namespaceLedgerPath(stateFilePath))
+  );
+  const location = await secretStoreLocation(secretStore);
+  let changed = false;
+  for (const [namespace, byLocation] of ledger) {
+    if (namespace === into) continue;
+    for (const [recorded, keys] of byLocation) {
+      if (recorded === location || keys.owners.size === 0) continue;
+      if (keys.owedTo === into) continue;
+      keys.owedTo = into;
+      changed = true;
+    }
+  }
+  if (changed) await writeLedger(stateFilePath, ledger);
+}
+async function pendingCarries(stateFilePath, secretStore, current) {
+  const ledger = parseLedger(
+    await readStoreFile(namespaceLedgerPath(stateFilePath))
+  );
+  const location = await secretStoreLocation(secretStore);
+  const carries = [];
+  for (const [namespace, byLocation] of ledger) {
+    const owed = coveredLocations(location, byLocation).some(
+      ({ keys }) => keys.owedTo === current
+    );
+    if (owed) {
+      carries.push({
+        namespace,
+        fields: candidateFields(location, byLocation)
+      });
+    }
+  }
+  return carries.reverse();
+}
+async function carryOwed(stateFilePath, ledger, location, secretStore, namespace, current, recorded, now) {
+  let carried = true;
+  for (const [url, fields] of recorded) {
+    for (const field of fields) {
+      const clientId = now.get(url)?.get(field);
+      if (clientId === void 0) continue;
+      try {
+        const from = oauthSecretServerId(url, namespace);
+        const to = oauthSecretServerId(url, current);
+        const stampField = clientCredentialStampField(field);
+        const value = await secretStoreGetStrict(secretStore, from, field);
+        if (value === null) continue;
+        const stamp = await secretStoreGetStrict(secretStore, from, stampField);
+        if (stamp === null || stampedOwner(stamp, value) !== clientId) {
+          continue;
+        }
+        if (await secretStoreGetStrict(secretStore, to, field) !== null) {
+          continue;
+        }
+        let byLocation = ledger.get(current);
+        if (!byLocation) {
+          byLocation = /* @__PURE__ */ new Map();
+          ledger.set(current, byLocation);
+        }
+        const target = byLocation.get(location) ?? emptyKeys();
+        byLocation.set(location, target);
+        const isNew = !target.servers.has(url);
+        target.servers.add(url);
+        const owner = /* @__PURE__ */ new Map([[url, /* @__PURE__ */ new Map([[field, clientId]])]]);
+        if (mergeOwners(target.owners, owner) || isNew) {
+          await writeLedger(stateFilePath, ledger);
+        }
+        await secretStore.set(to, stampField, stamp);
+        await secretStore.set(to, field, value);
+      } catch (error) {
+        carried = false;
+        warnLedgerFailure(
+          "carry over a superseded namespace recorded in",
+          error
+        );
+      }
+    }
+  }
+  return carried;
+}
+async function recordedNamespaces(stateFilePath) {
+  try {
+    const ledger = parseLedger(
+      await readStoreFile(namespaceLedgerPath(stateFilePath))
+    );
+    return [...ledger.keys()].reverse();
+  } catch (error) {
+    warnLedgerFailure("read", error);
+    return [];
+  }
+}
+async function purgeSupersededNamespaces(stateFilePath, secretStore, current, owners = /* @__PURE__ */ new Map()) {
   let ledger;
   let location;
   try {
@@ -4736,8 +5237,22 @@ async function purgeSupersededNamespaces(stateFilePath, secretStore, current) {
     return;
   }
   let changed = false;
-  for (const [namespace, byLocation] of ledger) {
+  for (const [namespace, byLocation] of [...ledger].reverse()) {
     if (namespace === current) continue;
+    if (current !== void 0 && coveredLocations(location, byLocation).some(
+      ({ keys }) => keys.owedTo === current
+    ) && !await carryOwed(
+      stateFilePath,
+      ledger,
+      location,
+      secretStore,
+      namespace,
+      current,
+      candidateFields(location, byLocation),
+      owners
+    )) {
+      break;
+    }
     for (const { location: recorded, keys } of coveredLocations(
       location,
       byLocation
@@ -4762,12 +5277,11 @@ async function purgeSupersededNamespaces(stateFilePath, secretStore, current) {
       if (!purged || recorded !== location) continue;
       byLocation.delete(recorded);
       if (recorded.startsWith(FILE_LOCATION_PREFIX)) {
-        const keyring = byLocation.get(KEYRING_LOCATION) ?? {
-          servers: /* @__PURE__ */ new Set(),
-          idpSessions: /* @__PURE__ */ new Set()
-        };
+        const keyring = byLocation.get(KEYRING_LOCATION) ?? emptyKeys();
+        addMissingOwners(keyring.owners, keys.owners);
         for (const url of keys.servers) keyring.servers.add(url);
         for (const issuer of keys.idpSessions) keyring.idpSessions.add(issuer);
+        keyring.owedTo ??= keys.owedTo;
         byLocation.set(KEYRING_LOCATION, keyring);
       }
       changed = true;
@@ -4878,7 +5392,12 @@ async function adoptSecretsNamespace(filePath, secretStore, locked) {
   const existing = parseSecretsNamespace(raw);
   if (existing !== void 0) {
     if (locked) {
-      await purgeSupersededNamespaces(filePath, secretStore, existing);
+      await purgeSupersededNamespaces(
+        filePath,
+        secretStore,
+        existing,
+        snapshotClientOwners(parseOAuthPersistBlob(raw))
+      );
     }
     return existing;
   }
@@ -4886,42 +5405,53 @@ async function adoptSecretsNamespace(filePath, secretStore, locked) {
   if (raw !== null && snapshot === null) {
     throw new OAuthStateFileUnrecognizedError(filePath, "save");
   }
-  if (locked) {
-    await purgeSupersededNamespaces(filePath, secretStore, void 0);
-  }
   const namespace = newSecretsNamespace();
-  if (snapshot === null) return namespace;
-  const moves = [
-    ...Object.entries(snapshot.servers).map(([url, state]) => ({
-      legacyId: oauthSecretServerId(url),
-      scopedId: oauthSecretServerId(url, namespace),
-      fields: serverSecretFields(state)
-    })),
-    ...Object.keys(snapshot.idpSessions).map((issuer) => ({
-      legacyId: oauthIdpSecretServerId(issuer),
-      scopedId: oauthIdpSecretServerId(issuer, namespace),
-      fields: [IDP_SESSION_FIELD]
-    }))
-  ];
-  if (moves.length === 0) return namespace;
+  if (snapshot === null || Object.keys(snapshot.servers).length === 0 && Object.keys(snapshot.idpSessions).length === 0) {
+    if (locked) {
+      await purgeSupersededNamespaces(filePath, secretStore, void 0);
+    }
+    return namespace;
+  }
   if (!locked) {
     throw new SecretStoreUnavailableError(
       `Could not save OAuth state: ${filePath} predates per-state-file secret namespaces, and migrating its secret-store entries needs the file lock, which is unavailable here (see the lock warning above). Migrating without it could lose credentials if two processes migrate at once. Nothing was changed; make the lock directory writable and retry \u2014 or, if you cannot, clear this file's stored OAuth state and re-authorize (clearing does not migrate, and the fresh state file mints its namespace without the lock).`
     );
   }
+  const values = await readEntrySecrets(
+    snapshot,
+    secretStore,
+    void 0,
+    await recordedNamespaces(filePath)
+  );
+  const owners = snapshotClientOwners(snapshot);
   await recordNamespaceKeys(
     filePath,
     secretStore,
     namespace,
     Object.keys(snapshot.servers),
-    Object.keys(snapshot.idpSessions)
+    Object.keys(snapshot.idpSessions),
+    writtenClientOwners(snapshot, (url) => values.servers.get(url) ?? {})
   );
+  await markUncarriedNamespaces(filePath, secretStore, namespace);
   const touched = [];
   try {
-    for (const { legacyId, scopedId, fields } of moves) {
-      for (const field of fields) {
-        const value = await secretStoreGetStrict(secretStore, legacyId, field);
-        if (value === null) continue;
+    const copies = [
+      // Restamped: a value read from the legacy ids predates stamps, and a
+      // fallback's stamp may belong to a value read from elsewhere (#2734).
+      ...[...values.servers].map(([url, secrets]) => ({
+        scopedId: oauthSecretServerId(url, namespace),
+        secrets: restampClientCredentials(
+          getOwnEntry(snapshot.servers, url) ?? {},
+          secrets
+        )
+      })),
+      ...[...values.idpSessions].map(([issuer, secrets]) => ({
+        scopedId: oauthIdpSecretServerId(issuer, namespace),
+        secrets
+      }))
+    ];
+    for (const { scopedId, secrets } of copies) {
+      for (const [field, value] of Object.entries(secrets)) {
         touched.push({ serverId: scopedId, field, value: null });
         await secretStore.set(scopedId, field, value);
       }
@@ -4931,7 +5461,14 @@ async function adoptSecretsNamespace(filePath, secretStore, locked) {
     await restoreSecretFields(secretStore, touched, warnRestoreFailure);
     throw error;
   }
-  for (const { legacyId } of moves) {
+  await purgeSupersededNamespaces(filePath, secretStore, namespace, owners);
+  const legacyIds = [
+    ...Object.keys(snapshot.servers).map((url) => oauthSecretServerId(url)),
+    ...Object.keys(snapshot.idpSessions).map(
+      (issuer) => oauthIdpSecretServerId(issuer)
+    )
+  ];
+  for (const legacyId of legacyIds) {
     try {
       await secretStore.deleteAllForServer(legacyId);
     } catch (error) {
@@ -4984,6 +5521,14 @@ function preserveNonDurableSecrets(diskSecrets, secrets) {
   return keep;
 }
 async function writeOAuthSections(filePath, snapshot, sections, secretStore = defaultSecretStore()) {
+  await writeOAuthSectionsFrom(
+    filePath,
+    async () => snapshot,
+    sections,
+    secretStore
+  );
+}
+async function writeOAuthSectionsFrom(filePath, resolveSnapshot, sections, secretStore) {
   const policy = getPersistTokensPolicy();
   const durable = await secretStoreIsDurable(secretStore);
   await withOAuthStateLock(filePath, "save", async (locked) => {
@@ -5067,6 +5612,7 @@ async function writeOAuthSections(filePath, snapshot, sections, secretStore = de
           unconfirmed = null;
           namespace = diskNamespace;
         }
+        const snapshot = await resolveSnapshot(disk, namespace);
         const effective = sections ? {
           servers: sections.servers && [...new Set(sections.servers)],
           idpSessions: sections.idpSessions && [
@@ -5092,7 +5638,22 @@ async function writeOAuthSections(filePath, snapshot, sections, secretStore = de
           secretStore,
           namespace,
           Object.keys(merged.servers),
-          Object.keys(merged.idpSessions)
+          Object.keys(merged.idpSessions),
+          // Only the entries this save writes: another entry's secret in
+          // this store was written for whatever client it was written for,
+          // and relabeling it from the file would misattribute it (#2672).
+          writtenClientOwners(
+            {
+              servers: Object.fromEntries(
+                (effective.servers ?? []).flatMap((url) => {
+                  const entry = getOwnEntry(merged.servers, url);
+                  return entry === void 0 ? [] : [[url, entry]];
+                })
+              ),
+              idpSessions: {}
+            },
+            splitSecretsOf
+          )
         );
         for (const url of effective.servers ?? []) {
           const serverId = oauthSecretServerId(url, namespace);
@@ -5100,7 +5661,8 @@ async function writeOAuthSections(filePath, snapshot, sections, secretStore = de
           const candidates = [
             .../* @__PURE__ */ new Set([
               ...serverSecretFields(getOwnEntry(disk?.servers, url)),
-              ...serverSecretFields(next)
+              ...serverSecretFields(next),
+              ...[...restoreBaseline.values()].filter((prior) => prior.serverId === serverId).map(({ field }) => field)
             ])
           ];
           const entryPrior = await snapshotSecretFields(
@@ -5109,8 +5671,12 @@ async function writeOAuthSections(filePath, snapshot, sections, secretStore = de
             candidates
           );
           priorSecrets.push(...entryPrior);
+          const entryPriorValue = new Map(
+            entryPrior.map(({ field, value }) => [field, value])
+          );
           if (next === void 0) {
             for (const field of candidates) {
+              if (entryPriorValue.get(field) === null) continue;
               ourWrites.set(priorKey({ serverId, field }), null);
             }
             await secretStore.deleteAllForServer(serverId);
@@ -5125,10 +5691,9 @@ async function writeOAuthSections(filePath, snapshot, sections, secretStore = de
           }
           const { residue, secrets } = splitServerOAuthState(next, policy);
           for (const field of candidates) {
-            ourWrites.set(
-              priorKey({ serverId, field }),
-              secrets[field] ?? null
-            );
+            const value = secrets[field] ?? null;
+            if (value === entryPriorValue.get(field)) continue;
+            ourWrites.set(priorKey({ serverId, field }), value);
           }
           setOwnEntry(merged.servers, url, residue);
           if (!durable) {
@@ -5271,26 +5836,109 @@ function secretRequestsFor(snapshot, namespace) {
   }
   return requests;
 }
-async function joinSnapshot(snapshot, secretStore, namespace) {
-  const requests = secretRequestsFor(snapshot, namespace);
-  const values = requests.length > 0 ? await secretStoreGetManyStrict(secretStore, requests) : {};
+function fillMissingSecrets(target, source) {
+  for (const [field, value] of Object.entries(source ?? {})) {
+    if (!Object.hasOwn(target, field)) setOwnEntry(target, field, value);
+  }
+}
+function writtenClientOwners(snapshot, secretsOf) {
+  const owners = /* @__PURE__ */ new Map();
+  for (const [url, state] of Object.entries(snapshot.servers)) {
+    const secrets = secretsOf(url, state);
+    const fields = new Map(
+      [...clientCredentialOwners(state)].filter(
+        ([field]) => Object.hasOwn(secrets, field)
+      )
+    );
+    if (fields.size > 0) owners.set(url, fields);
+  }
+  return owners;
+}
+var splitSecretsOf = (_url, state) => splitServerOAuthState(state, "all").secrets;
+function snapshotClientOwners(snapshot) {
+  const owners = /* @__PURE__ */ new Map();
+  for (const [url, state] of Object.entries(snapshot?.servers ?? {})) {
+    const fields = clientCredentialOwners(state);
+    if (fields.size > 0) owners.set(url, fields);
+  }
+  return owners;
+}
+async function readEntrySecrets(snapshot, secretStore, namespace, fallbacks, carries = []) {
+  const servers = /* @__PURE__ */ new Map();
+  const idpSessions = /* @__PURE__ */ new Map();
+  for (const url of Object.keys(snapshot.servers)) servers.set(url, {});
+  for (const issuer of Object.keys(snapshot.idpSessions)) {
+    idpSessions.set(issuer, {});
+  }
+  for (const source of [namespace, ...fallbacks]) {
+    const requests = secretRequestsFor(snapshot, source);
+    if (requests.length === 0) break;
+    const values = await secretStoreGetManyStrict(secretStore, requests);
+    for (const [url, target] of servers) {
+      fillMissingSecrets(target, values[oauthSecretServerId(url, source)]);
+    }
+    for (const [issuer, target] of idpSessions) {
+      fillMissingSecrets(
+        target,
+        values[oauthIdpSecretServerId(issuer, source)]
+      );
+    }
+  }
+  const owners = snapshotClientOwners(snapshot);
+  for (const { namespace: from, fields: recorded } of carries) {
+    const requests = [];
+    for (const [url, fields] of recorded) {
+      const target = servers.get(url);
+      if (!target) continue;
+      const wanted = [...fields].filter(
+        (field) => owners.get(url)?.has(field) === true && !Object.hasOwn(target, field)
+      );
+      if (wanted.length > 0) {
+        requests.push({
+          serverId: oauthSecretServerId(url, from),
+          fields: wanted.flatMap((field) => [
+            field,
+            clientCredentialStampField(field)
+          ])
+        });
+      }
+    }
+    if (requests.length === 0) continue;
+    const values = await secretStoreGetManyStrict(secretStore, requests);
+    for (const [url, target] of servers) {
+      const found = values[oauthSecretServerId(url, from)] ?? {};
+      for (const [field, clientId] of owners.get(url) ?? []) {
+        const value = Object.hasOwn(found, field) ? found[field] : void 0;
+        const stampField = clientCredentialStampField(field);
+        if (value === void 0 || Object.hasOwn(target, field) || stampedOwner(found[stampField], value) !== clientId) {
+          continue;
+        }
+        setOwnEntry(target, field, value);
+        setOwnEntry(target, stampField, found[stampField]);
+      }
+    }
+  }
+  return { servers, idpSessions };
+}
+async function joinSnapshot(snapshot, secretStore, namespace, fallbacks, carries = []) {
+  const values = await readEntrySecrets(
+    snapshot,
+    secretStore,
+    namespace,
+    fallbacks,
+    carries
+  );
   return {
     servers: Object.fromEntries(
       Object.entries(snapshot.servers).map(([url, state]) => [
         url,
-        joinServerOAuthState(
-          state,
-          values[oauthSecretServerId(url, namespace)] ?? {}
-        )
+        joinServerOAuthState(state, values.servers.get(url) ?? {})
       ])
     ),
     idpSessions: Object.fromEntries(
       Object.entries(snapshot.idpSessions).map(([issuer, session]) => [
         issuer,
-        joinIdpSession(
-          session,
-          values[oauthIdpSecretServerId(issuer, namespace)] ?? {}
-        )
+        joinIdpSession(session, values.idpSessions.get(issuer) ?? {})
       ])
     )
   };
@@ -5306,7 +5954,8 @@ async function migratePlaintextSecrets(filePath, secretStore) {
       secretStore,
       namespace,
       Object.keys(fresh.servers),
-      Object.keys(fresh.idpSessions)
+      Object.keys(fresh.idpSessions),
+      writtenClientOwners(fresh, splitSecretsOf)
     );
   }
   const migrateEntrySecrets = async (serverId, secrets) => {
@@ -5357,7 +6006,10 @@ async function readOAuthStore(filePath, secretStore = defaultSecretStore()) {
         warnMigrationFailure(error);
       }
     }
-    return joinSnapshot(snapshot, secretStore, parseSecretsNamespace(raw));
+    const namespace = parseSecretsNamespace(raw);
+    const fallbacks = namespace === void 0 ? await recordedNamespaces(filePath) : [];
+    const carries = namespace === void 0 ? [] : await pendingCarries(filePath, secretStore, namespace);
+    return joinSnapshot(snapshot, secretStore, namespace, fallbacks, carries);
   });
 }
 async function removeOAuthStore(filePath, secretStore = defaultSecretStore()) {
@@ -5597,6 +6249,8 @@ var RemoteSession = class _RemoteSession {
   requestWaits = /* @__PURE__ */ new Map();
   authProviderHandle = null;
   appliedProtocolVersion;
+  /** Each upstream `429`'s `Retry-After`, by the JSON-RPC id that drew it (#2442). */
+  rateLimits = new RateLimitLedger();
   /** A protocol version is a dated token (`2025-11-25`, `2026-07-28`, …). */
   static PROTOCOL_VERSION_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
   constructor(sessionId) {
@@ -5808,6 +6462,7 @@ var RemoteSession = class _RemoteSession {
     this.pushEvent({ type: "message", data: message });
   }
   onFetchRequest(entry) {
+    this.rateLimits.record(entry);
     this.pushEvent({
       type: "fetch_request",
       data: {
@@ -5816,6 +6471,14 @@ var RemoteSession = class _RemoteSession {
       }
     });
   }
+  /**
+   * The `Retry-After` of the upstream `429` that answered request `id` — read
+   * by the send route, so the header rides back on the send's own error rather
+   * than on a fetch event racing it (#2442).
+   */
+  takeRetryAfter(id) {
+    return this.rateLimits.take(id);
+  }
   onFetchResponseBody(id, responseBody) {
     this.pushEvent({
       type: "fetch_request_body_update",
@@ -6259,6 +6922,17 @@ var MAX_APP_DOCUMENT_CHARS = 8 * 1024 * 1024;
 var MAX_APP_DOCUMENT_BODY_BYTES = 24 * 1024 * 1024;
 var MAX_APP_CSP_CHARS = 8 * 1024;
 var MAX_STORAGE_BODY_BYTES = 4 * 1024 * 1024;
+var MAX_PROXIED_RESPONSE_BYTES = 4 * 1024 * 1024;
+var BODY_FRAMING_HEADERS = /* @__PURE__ */ new Set([
+  "content-length",
+  "transfer-encoding",
+  "content-encoding"
+]);
+function withoutBodyFraming(headers) {
+  return Object.fromEntries(
+    Object.entries(headers).filter(([k]) => !BODY_FRAMING_HEADERS.has(k))
+  );
+}
 function isHeaderSafeValue(value) {
   return !/[^\t\x20-\x7e]/.test(value);
 }
@@ -6714,6 +7388,25 @@ function createRemoteApp(options) {
         });
       }
       const msg = err instanceof Error ? err.message : String(err);
+      if (err instanceof SdkHttpError2) {
+        const text = err.data.text;
+        const sentId = "id" in message ? message.id : void 0;
+        const retryAfter = isRateLimitError(err) && (typeof sentId === "string" || typeof sentId === "number") ? session.takeRetryAfter(sentId) : void 0;
+        return c.json({
+          ok: false,
+          kind: "transport_error",
+          error: msg,
+          http: {
+            code: err.code,
+            status: err.status,
+            ...err.statusText !== void 0 && {
+              statusText: err.statusText
+            },
+            ...typeof text === "string" && { text },
+            ...retryAfter !== void 0 && { retryAfter }
+          }
+        });
+      }
       return c.json({ ok: false, kind: "transport_error", error: msg });
     } finally {
       clientSignal.removeEventListener("abort", onClientDisconnect);
@@ -6843,7 +7536,28 @@ function createRemoteApp(options) {
       const isStream = contentType?.includes("text/event-stream") || contentType?.includes("application/x-ndjson");
       let resBody;
       if (!isStream && res.body) {
-        resBody = await res.text();
+        const refuseOversize = () => res.ok ? c.json(
+          {
+            error: `response from ${safeUrl} exceeds the ${MAX_PROXIED_RESPONSE_BYTES}-byte limit for a proxied response`
+          },
+          502
+        ) : c.json({
+          ok: res.ok,
+          status: res.status,
+          statusText: res.statusText,
+          headers: withoutBodyFraming(resHeaders)
+        });
+        if (declaresOversizeBody(
+          res.headers.get("content-length"),
+          MAX_PROXIED_RESPONSE_BYTES
+        )) {
+          void res.body.cancel().catch(() => {
+          });
+          return refuseOversize();
+        }
+        const read = await readCappedText(res.body, MAX_PROXIED_RESPONSE_BYTES);
+        if (read.kind === "overflow") return refuseOversize();
+        resBody = read.text;
       } else if (isStream) {
         void res.body?.cancel().catch(() => {
         });
@@ -7656,7 +8370,7 @@ function createRemoteApp(options) {
       type,
       process.platform,
       homedir(),
-      (path6) => existsSync3(path6) ? readFileSync6(path6, "utf-8") : null
+      (path6) => existsSync3(path6) ? readFileSync7(path6, "utf-8") : null
     );
     if (!result) {
       return c.json(
@@ -8072,6 +8786,30 @@ function handleNodeHealthRequest(req, res) {
   return true;
 }
 
+// server/node-request-bridge.ts
+function fetchUrlForNodeRequest(headers, pathname, scheme) {
+  const authority = headers.host ?? headers[":authority"];
+  return `${scheme}://${authority}${pathname}`;
+}
+function fetchHeadersFromNode(headers) {
+  const out = new Headers();
+  for (const [key, value] of Object.entries(headers)) {
+    if (!value || key.startsWith(":")) continue;
+    out.set(key, Array.isArray(value) ? value.join(", ") : value);
+  }
+  return out;
+}
+var CONNECTION_SPECIFIC_HEADERS = /* @__PURE__ */ new Set([
+  "connection",
+  "keep-alive",
+  "proxy-connection",
+  "transfer-encoding",
+  "upgrade"
+]);
+function isResponseHeaderAllowed(name, httpVersionMajor) {
+  return httpVersionMajor < 2 || !CONNECTION_SPECIFIC_HEADERS.has(name.toLowerCase());
+}
+
 // server/vite-hono-plugin.ts
 function honoMiddlewarePlugin(config) {
   let resolvedAuthToken = "";
@@ -8179,18 +8917,12 @@ function honoMiddlewarePlugin(config) {
           if (!pathname.startsWith("/api")) {
             return next();
           }
-          const url = `http://${req.headers.host}${pathname}`;
-          const headers = new Headers();
-          Object.entries(req.headers).forEach(
-            ([key, value]) => {
-              if (value) {
-                headers.set(
-                  key,
-                  Array.isArray(value) ? value.join(", ") : value
-                );
-              }
-            }
+          const url = fetchUrlForNodeRequest(
+            req.headers,
+            pathname,
+            webScheme(config.tls)
           );
+          const headers = fetchHeadersFromNode(req.headers);
           const init = { method: req.method, headers };
           if (req.method !== "GET" && req.method !== "HEAD") {
             const chunks = [];
@@ -8207,13 +8939,17 @@ function honoMiddlewarePlugin(config) {
           const response = await honoApp.fetch(new Request(url, init));
           res.statusCode = response.status;
           response.headers.forEach((value, key) => {
-            res.setHeader(key, value);
+            if (isResponseHeaderAllowed(key, req.httpVersionMajor)) {
+              res.setHeader(key, value);
+            }
           });
           const isSSE = response.headers.get("content-type")?.includes("text/event-stream");
           if (isSSE) {
             res.setHeader("X-Accel-Buffering", "no");
             res.setHeader("Cache-Control", "no-cache");
-            res.setHeader("Connection", "keep-alive");
+            if (isResponseHeaderAllowed("connection", req.httpVersionMajor)) {
+              res.setHeader("Connection", "keep-alive");
+            }
           }
           if (response.body) {
             res.flushHeaders?.();
@@ -8566,6 +9302,10 @@ async function startViteDevServer(config) {
       // `config.port`, so a drifted bind would 403 every connect and CSP-block
       // the MCP Apps iframe while the banner advertises the unusable port.
       strictPort: true,
+      // The same TLS pair the prod listener uses (#2446), matching
+      // `vite.config.ts`. Vite serves it over HTTP/2 with an HTTP/1.1
+      // fallback; the Hono plugin's /api bridge handles both.
+      https: config.tls,
       // Allow Vite to serve source files from the repo root (core/ lives
       // outside clients/web), matching `vite.config.ts`'s `server.fs.allow`.
       fs: {
@@ -8584,10 +9324,11 @@ async function startViteDevServer(config) {
 }
 
 // server/server.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync8 } from "fs";
 import { join as join8, dirname as dirname8 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import { randomBytes as randomBytes4 } from "crypto";
+import { createServer as createHttpsServer } from "https";
 import { serve } from "@hono/node-server";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono as Hono2 } from "hono";
@@ -8634,12 +9375,20 @@ async function startHonoServer(config) {
   });
   const app = new Hono2();
   app.get(HEALTH_PATH, (c) => healthResponse(c.req.method));
+  app.use(
+    "*",
+    hostAllowListMiddleware({
+      bindHost: config.hostname,
+      allowedOrigins: config.allowedOrigins,
+      extraHosts: config.allowedHosts
+    })
+  );
   app.use("/api/*", async (c) => {
     return apiApp.fetch(c.req.raw);
   });
   const serveIndexHtml = (c) => {
     const indexPath = join8(rootPath, "index.html");
-    const html = readFileSync7(indexPath, "utf-8");
+    const html = readFileSync8(indexPath, "utf-8");
     c.header("Cache-Control", "no-store");
     return c.html(injectAuthToken(html, resolvedAuthToken));
   };
@@ -8667,7 +9416,10 @@ async function startHonoServer(config) {
     {
       fetch: app.fetch,
       port: config.port,
-      hostname: config.hostname
+      hostname: config.hostname,
+      // https only when both TLS paths were set (#2446); otherwise
+      // @hono/node-server's default plain `http.createServer`.
+      ...config.tls ? { createServer: createHttpsServer, serverOptions: config.tls } : {}
     },
     (info) => {
       const sandboxUrl = sandboxController.getUrl();
@@ -8685,9 +9437,7 @@ async function startHonoServer(config) {
   );
   httpServer.on("error", (err) => {
     if (err.message.includes("EADDRINUSE")) {
-      console.error(
-        `MCP Inspector PORT IS IN USE at http://${formatHostForUrl(config.hostname)}:${config.port}`
-      );
+      console.error(portInUseMessage(config));
       process.exit(1);
     } else {
       throw err;
@@ -8768,7 +9518,11 @@ async function runWeb(argv) {
     preArgs = argv.slice(0, argSeparatorIndex);
     postArgs = argv.slice(argSeparatorIndex + 1);
   }
-  program.name("mcp-inspector-web").description("Web UI for MCP Inspector").allowExcessArguments().allowUnknownOption().option(
+  program.name("mcp-inspector-web").description("Web UI for MCP Inspector").version(
+    readInspectorVersionSafe(import.meta.url) ?? "unknown",
+    "-V, --version",
+    "Print the Inspector version"
+  ).allowExcessArguments().allowUnknownOption().option(
     "-e <env>",
     "environment variables in KEY=VALUE format",
     parseKeyValuePair,