@modelcontextprotocol/inspector 2.11.0 → 2.12.0

package/clients/cli/build/index.js

@@ -86,6 +86,12 @@ var DirectoryReadResultSchema = z.looseObject({
   resources: z.array(DirectoryChildSchema),
   nextCursor: z.string().optional()
 });
+var ModernDirectoryReadResultSchema = DirectoryReadResultSchema.extend(
+  {
+    ttlMs: z.int().min(0),
+    cacheScope: z.enum(["public", "private"])
+  }
+);
 
 // ../../core/mcp/sha256.ts
 var K = new Uint32Array([
@@ -2129,6 +2135,13 @@ var BaseOAuthClientProvider = class {
   requestRefreshToken;
   /** Server-configured scope, for the #2068 `offline_access` distinction. */
   configuredScope;
+  /** Per-flow verifier store (#2726); absent → the shared storage slot. */
+  flowStore;
+  /**
+   * The authId of the flow this provider is driving: set by {@link state} on the
+   * redirect leg and by {@link resumeAuthorizationFlow} on the callback leg.
+   */
+  flowId;
   constructor(serverUrl, oauthConfig) {
     this.serverUrl = serverUrl;
     this.storage = oauthConfig.storage;
@@ -2138,6 +2151,7 @@ var BaseOAuthClientProvider = class {
     this.authorizationParams = oauthConfig.authorizationParams;
     this.requestRefreshToken = oauthConfig.requestRefreshToken ?? true;
     this.configuredScope = oauthConfig.configuredScope;
+    this.flowStore = oauthConfig.flowStore;
   }
   /**
    * Load persisted scope into {@link cachedScope} before SDK `auth()` (which
@@ -2208,7 +2222,24 @@ var BaseOAuthClientProvider = class {
     return metadata;
   }
   state() {
-    return generateOAuthState();
+    const state = generateOAuthState();
+    this.flowId = state;
+    return state;
+  }
+  /**
+   * Bind this provider to the flow a callback's `state` names, so
+   * {@link codeVerifier} reads that flow's verifier and no other (#2726). A
+   * `state` that is not one of ours binds nothing — and, with a flow store, a
+   * flow-less read then fails rather than reaching for the shared slot.
+   */
+  resumeAuthorizationFlow(state) {
+    this.flowId = parseOAuthState(state)?.authId;
+  }
+  /** Drop the bound flow's verifier once its exchange has completed. */
+  async clearAuthorizationFlow() {
+    if (this.flowStore && this.flowId) {
+      await this.flowStore.clearCodeVerifier(this.flowId);
+    }
   }
   async clientInformation(ctx) {
     const preregistered = await this.storage.getClientInformation(
@@ -2353,9 +2384,26 @@ var BaseOAuthClientProvider = class {
     }
   }
   async saveCodeVerifier(codeVerifier) {
+    if (this.flowStore && this.flowId) {
+      await this.flowStore.saveCodeVerifier(
+        this.flowId,
+        this.serverUrl,
+        codeVerifier
+      );
+      return;
+    }
     await this.storage.saveCodeVerifier(this.serverUrl, codeVerifier);
   }
   async codeVerifier() {
+    if (this.flowStore) {
+      const verifier2 = this.flowId ? await this.flowStore.getCodeVerifier(this.flowId, this.serverUrl) : void 0;
+      if (!verifier2) {
+        throw new Error(
+          "No code verifier saved for this authorization flow. It may have been started in another browser tab or already completed; please re-authenticate."
+        );
+      }
+      return verifier2;
+    }
     const verifier = await this.storage.getCodeVerifier(this.serverUrl);
     if (!verifier) {
       throw new Error("No code verifier saved for session");
@@ -2402,6 +2450,10 @@ var BaseOAuthClientProvider = class {
         await this.storage.clearTokens(this.serverUrl);
         return;
       case "verifier":
+        if (this.flowStore) {
+          await this.clearAuthorizationFlow();
+          return;
+        }
         await this.storage.clearCodeVerifier(this.serverUrl);
         return;
       case "discovery":
@@ -4885,7 +4937,7 @@ async function resolveConcreteSecretStore(store) {
 import { resolve as resolve5 } from "path";
 
 // ../../core/auth/node/oauth-secrets.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { createHmac, randomUUID as randomUUID2 } from "crypto";
 import { OAuthTokensSchema as OAuthTokensSchema3 } from "@modelcontextprotocol/core";
 var PERSIST_TOKENS_ENV = "MCP_INSPECTOR_PERSIST_TOKENS";
 var warnedPolicyValues = /* @__PURE__ */ new Set();
@@ -4918,6 +4970,29 @@ var LEGACY_REGISTRATION_TOKEN_FIELD = "registration-token";
 var PREREG_CLIENT_SECRET_FIELD = "prereg-client-secret";
 var PREREG_REGISTRATION_TOKEN_FIELD = "prereg-registration-token";
 var IDP_SESSION_FIELD = "idp-session";
+var clientCredentialStampField = (field) => `${field}#owner`;
+var credentialMac = (clientId, value) => createHmac("sha256", value).update(clientId).digest("hex");
+function clientCredentialStamp(clientId, value) {
+  return JSON.stringify({
+    client_id: clientId,
+    mac: credentialMac(clientId, value)
+  });
+}
+function stampedOwner(stamp, value) {
+  if (stamp === void 0) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(stamp);
+  } catch {
+    return void 0;
+  }
+  if (typeof parsed !== "object" || parsed === null) return void 0;
+  const { client_id: clientId, mac } = parsed;
+  if (typeof clientId !== "string" || mac !== credentialMac(clientId, value)) {
+    return void 0;
+  }
+  return clientId;
+}
 function applyTokensPolicy(tokens, policy) {
   if (policy === "none") return void 0;
   if (policy === "access" && tokens.refresh_token !== void 0) {
@@ -4946,12 +5021,18 @@ function splitClientInformation(info, fields, secrets) {
   if (client_secret === void 0 && registration_access_token === void 0) {
     return info;
   }
-  if (client_secret !== void 0) {
-    secrets[fields.clientSecret] = client_secret;
-  }
-  if (registration_access_token !== void 0) {
-    secrets[fields.registrationToken] = registration_access_token;
-  }
+  const put = (field, value) => {
+    if (value === void 0) return;
+    secrets[field] = value;
+    if (fields.stamped && typeof info.client_id === "string") {
+      secrets[clientCredentialStampField(field)] = clientCredentialStamp(
+        info.client_id,
+        value
+      );
+    }
+  };
+  put(fields.clientSecret, client_secret);
+  put(fields.registrationToken, registration_access_token);
   return publicInfo;
 }
 function joinClientInformation(info, fields, secrets) {
@@ -4970,15 +5051,18 @@ function joinClientInformation(info, fields, secrets) {
 }
 var issuerClientInfoFields = (issuer) => ({
   clientSecret: issuerClientSecretField(issuer),
-  registrationToken: issuerRegistrationTokenField(issuer)
+  registrationToken: issuerRegistrationTokenField(issuer),
+  stamped: true
 });
 var LEGACY_CLIENT_INFO_FIELDS = {
   clientSecret: LEGACY_CLIENT_SECRET_FIELD,
-  registrationToken: LEGACY_REGISTRATION_TOKEN_FIELD
+  registrationToken: LEGACY_REGISTRATION_TOKEN_FIELD,
+  stamped: true
 };
 var PREREG_CLIENT_INFO_FIELDS = {
   clientSecret: PREREG_CLIENT_SECRET_FIELD,
-  registrationToken: PREREG_REGISTRATION_TOKEN_FIELD
+  registrationToken: PREREG_REGISTRATION_TOKEN_FIELD,
+  stamped: false
 };
 function splitServerOAuthState(state, policy) {
   const secrets = {};
@@ -5128,20 +5212,54 @@ function joinIdpSession(residue, secrets) {
   return stored ? { ...residue, ...stored } : { ...residue };
 }
 function serverSecretFields(state) {
+  const stamped = (field) => [
+    field,
+    clientCredentialStampField(field)
+  ];
   const fields = /* @__PURE__ */ new Set([
     LEGACY_TOKENS_FIELD,
-    LEGACY_CLIENT_SECRET_FIELD,
-    LEGACY_REGISTRATION_TOKEN_FIELD,
+    ...stamped(LEGACY_CLIENT_SECRET_FIELD),
+    ...stamped(LEGACY_REGISTRATION_TOKEN_FIELD),
     PREREG_CLIENT_SECRET_FIELD,
     PREREG_REGISTRATION_TOKEN_FIELD
   ]);
   for (const issuer of Object.keys(state?.byIssuer ?? {})) {
     fields.add(issuerTokensField(issuer));
-    fields.add(issuerClientSecretField(issuer));
-    fields.add(issuerRegistrationTokenField(issuer));
+    for (const field of stamped(issuerClientSecretField(issuer))) {
+      fields.add(field);
+    }
+    for (const field of stamped(issuerRegistrationTokenField(issuer))) {
+      fields.add(field);
+    }
   }
   return [...fields];
 }
+function clientCredentialOwners(state) {
+  const owners = /* @__PURE__ */ new Map();
+  const add2 = (info, fields) => {
+    if (typeof info?.client_id !== "string") return;
+    owners.set(fields.clientSecret, info.client_id);
+    owners.set(fields.registrationToken, info.client_id);
+  };
+  add2(state.clientInformation, LEGACY_CLIENT_INFO_FIELDS);
+  for (const [issuer, slot] of Object.entries(state.byIssuer ?? {})) {
+    add2(slot.clientInformation, issuerClientInfoFields(issuer));
+  }
+  return owners;
+}
+function restampClientCredentials(state, secrets) {
+  const out = { ...secrets };
+  for (const [field, clientId] of clientCredentialOwners(state)) {
+    const stampField = clientCredentialStampField(field);
+    const value = Object.hasOwn(out, field) ? out[field] : void 0;
+    if (value === void 0) {
+      delete out[stampField];
+    } else if (stampedOwner(out[stampField], value) === void 0) {
+      setOwnEntry(out, stampField, clientCredentialStamp(clientId, value));
+    }
+  }
+  return out;
+}
 function clientInfoHasPlaintext(info) {
   return info !== void 0 && (info.client_secret !== void 0 || info.registration_access_token !== void 0);
 }
@@ -5182,6 +5300,44 @@ function coveredLocations(location, byLocation) {
     ([recorded]) => recorded === location || location === KEYRING_LOCATION && recorded.startsWith(FILE_LOCATION_PREFIX)
   ).map(([recorded, keys]) => ({ location: recorded, keys }));
 }
+var emptyKeys = () => ({
+  servers: /* @__PURE__ */ new Set(),
+  idpSessions: /* @__PURE__ */ new Set(),
+  owners: /* @__PURE__ */ new Map()
+});
+function candidateFields(location, byLocation) {
+  const fields = /* @__PURE__ */ new Map();
+  for (const { keys } of coveredLocations(location, byLocation)) {
+    for (const [url, owned] of keys.owners) {
+      const kept = fields.get(url) ?? /* @__PURE__ */ new Set();
+      for (const field of owned.keys()) kept.add(field);
+      fields.set(url, kept);
+    }
+  }
+  return fields;
+}
+function addMissingOwners(target, source) {
+  for (const [url, fields] of source) {
+    const kept = target.get(url) ?? /* @__PURE__ */ new Map();
+    for (const [field, clientId] of fields) {
+      if (!kept.has(field)) kept.set(field, clientId);
+    }
+    if (kept.size > 0) target.set(url, kept);
+  }
+}
+function mergeOwners(target, source) {
+  let changed = false;
+  for (const [url, fields] of source) {
+    const kept = target.get(url) ?? /* @__PURE__ */ new Map();
+    for (const [field, clientId] of fields) {
+      if (kept.get(field) === clientId) continue;
+      kept.set(field, clientId);
+      changed = true;
+    }
+    if (kept.size > 0) target.set(url, kept);
+  }
+  return changed;
+}
 var warnedLedgerFailures = /* @__PURE__ */ new Set();
 function warnLedgerFailure(what, error) {
   const reason = error instanceof Error ? error.message : String(error);
@@ -5195,6 +5351,19 @@ function warnLedgerFailure(what, error) {
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function parseOwners(value) {
+  const owners = /* @__PURE__ */ new Map();
+  if (!isRecord2(value)) return owners;
+  for (const [url, fields] of Object.entries(value)) {
+    if (!isRecord2(fields)) continue;
+    const byField = /* @__PURE__ */ new Map();
+    for (const [field, clientId] of Object.entries(fields)) {
+      if (typeof clientId === "string") byField.set(field, clientId);
+    }
+    if (byField.size > 0) owners.set(url, byField);
+  }
+  return owners;
+}
 function stringsOf(value) {
   return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
@@ -5216,7 +5385,9 @@ function parseLedger(raw) {
       if (!isRecord2(keys)) continue;
       byLocation.set(location, {
         servers: new Set(stringsOf(keys.servers)),
-        idpSessions: new Set(stringsOf(keys.idpSessions))
+        idpSessions: new Set(stringsOf(keys.idpSessions)),
+        owners: parseOwners(keys.owners),
+        ...isValidSecretsNamespace(keys.owedTo) && { owedTo: keys.owedTo }
       });
     }
     if (byLocation.size > 0) ledger.set(namespace, byLocation);
@@ -5230,7 +5401,19 @@ function serializeLedger(ledger) {
       Object.fromEntries(
         [...byLocation].map(([location, keys]) => [
           location,
-          { servers: [...keys.servers], idpSessions: [...keys.idpSessions] }
+          {
+            servers: [...keys.servers],
+            idpSessions: [...keys.idpSessions],
+            ...keys.owners.size > 0 && {
+              owners: Object.fromEntries(
+                [...keys.owners].map(([url, fields]) => [
+                  url,
+                  Object.fromEntries(fields)
+                ])
+              )
+            },
+            ...keys.owedTo !== void 0 && { owedTo: keys.owedTo }
+          }
         ])
       )
     ])
@@ -5242,7 +5425,7 @@ async function writeLedger(stateFilePath, ledger) {
   if (ledger.size === 0) await deleteStoreFile(path5);
   else await writeStoreFile(path5, serializeLedger(ledger));
 }
-async function recordNamespaceKeys(stateFilePath, secretStore, namespace, servers, idpSessions) {
+async function recordNamespaceKeys(stateFilePath, secretStore, namespace, servers, idpSessions, owners = /* @__PURE__ */ new Map()) {
   try {
     const ledger = parseLedger(
       await readStoreFile(namespaceLedgerPath(stateFilePath))
@@ -5256,7 +5439,7 @@ async function recordNamespaceKeys(stateFilePath, secretStore, namespace, server
     let keys = byLocation.get(location);
     let changed = false;
     if (!keys) {
-      keys = { servers: /* @__PURE__ */ new Set(), idpSessions: /* @__PURE__ */ new Set() };
+      keys = emptyKeys();
       byLocation.set(location, keys);
       changed = true;
     }
@@ -5270,11 +5453,93 @@ async function recordNamespaceKeys(stateFilePath, secretStore, namespace, server
       keys.idpSessions.add(issuer);
       changed = true;
     }
+    if (mergeOwners(keys.owners, owners)) changed = true;
     if (changed) await writeLedger(stateFilePath, ledger);
   } catch (error) {
     warnLedgerFailure("update", error);
   }
 }
+async function markUncarriedNamespaces(stateFilePath, secretStore, into) {
+  const ledger = parseLedger(
+    await readStoreFile(namespaceLedgerPath(stateFilePath))
+  );
+  const location = await secretStoreLocation(secretStore);
+  let changed = false;
+  for (const [namespace, byLocation] of ledger) {
+    if (namespace === into) continue;
+    for (const [recorded, keys] of byLocation) {
+      if (recorded === location || keys.owners.size === 0) continue;
+      if (keys.owedTo === into) continue;
+      keys.owedTo = into;
+      changed = true;
+    }
+  }
+  if (changed) await writeLedger(stateFilePath, ledger);
+}
+async function pendingCarries(stateFilePath, secretStore, current) {
+  const ledger = parseLedger(
+    await readStoreFile(namespaceLedgerPath(stateFilePath))
+  );
+  const location = await secretStoreLocation(secretStore);
+  const carries = [];
+  for (const [namespace, byLocation] of ledger) {
+    const owed = coveredLocations(location, byLocation).some(
+      ({ keys }) => keys.owedTo === current
+    );
+    if (owed) {
+      carries.push({
+        namespace,
+        fields: candidateFields(location, byLocation)
+      });
+    }
+  }
+  return carries.reverse();
+}
+async function carryOwed(stateFilePath, ledger, location, secretStore, namespace, current, recorded, now) {
+  let carried = true;
+  for (const [url, fields] of recorded) {
+    for (const field of fields) {
+      const clientId = now.get(url)?.get(field);
+      if (clientId === void 0) continue;
+      try {
+        const from = oauthSecretServerId(url, namespace);
+        const to = oauthSecretServerId(url, current);
+        const stampField = clientCredentialStampField(field);
+        const value = await secretStoreGetStrict(secretStore, from, field);
+        if (value === null) continue;
+        const stamp = await secretStoreGetStrict(secretStore, from, stampField);
+        if (stamp === null || stampedOwner(stamp, value) !== clientId) {
+          continue;
+        }
+        if (await secretStoreGetStrict(secretStore, to, field) !== null) {
+          continue;
+        }
+        let byLocation = ledger.get(current);
+        if (!byLocation) {
+          byLocation = /* @__PURE__ */ new Map();
+          ledger.set(current, byLocation);
+        }
+        const target = byLocation.get(location) ?? emptyKeys();
+        byLocation.set(location, target);
+        const isNew = !target.servers.has(url);
+        target.servers.add(url);
+        const owner = /* @__PURE__ */ new Map([[url, /* @__PURE__ */ new Map([[field, clientId]])]]);
+        if (mergeOwners(target.owners, owner) || isNew) {
+          await writeLedger(stateFilePath, ledger);
+        }
+        await secretStore.set(to, stampField, stamp);
+        await secretStore.set(to, field, value);
+      } catch (error) {
+        carried = false;
+        warnLedgerFailure(
+          "carry over a superseded namespace recorded in",
+          error
+        );
+      }
+    }
+  }
+  return carried;
+}
 async function recordedNamespaces(stateFilePath) {
   try {
     const ledger = parseLedger(
@@ -5286,7 +5551,7 @@ async function recordedNamespaces(stateFilePath) {
     return [];
   }
 }
-async function purgeSupersededNamespaces(stateFilePath, secretStore, current) {
+async function purgeSupersededNamespaces(stateFilePath, secretStore, current, owners = /* @__PURE__ */ new Map()) {
   let ledger;
   let location;
   try {
@@ -5299,8 +5564,22 @@ async function purgeSupersededNamespaces(stateFilePath, secretStore, current) {
     return;
   }
   let changed = false;
-  for (const [namespace, byLocation] of ledger) {
+  for (const [namespace, byLocation] of [...ledger].reverse()) {
     if (namespace === current) continue;
+    if (current !== void 0 && coveredLocations(location, byLocation).some(
+      ({ keys }) => keys.owedTo === current
+    ) && !await carryOwed(
+      stateFilePath,
+      ledger,
+      location,
+      secretStore,
+      namespace,
+      current,
+      candidateFields(location, byLocation),
+      owners
+    )) {
+      break;
+    }
     for (const { location: recorded, keys } of coveredLocations(
       location,
       byLocation
@@ -5325,12 +5604,11 @@ async function purgeSupersededNamespaces(stateFilePath, secretStore, current) {
       if (!purged || recorded !== location) continue;
       byLocation.delete(recorded);
       if (recorded.startsWith(FILE_LOCATION_PREFIX)) {
-        const keyring = byLocation.get(KEYRING_LOCATION) ?? {
-          servers: /* @__PURE__ */ new Set(),
-          idpSessions: /* @__PURE__ */ new Set()
-        };
+        const keyring = byLocation.get(KEYRING_LOCATION) ?? emptyKeys();
+        addMissingOwners(keyring.owners, keys.owners);
         for (const url of keys.servers) keyring.servers.add(url);
         for (const issuer of keys.idpSessions) keyring.idpSessions.add(issuer);
+        keyring.owedTo ??= keys.owedTo;
         byLocation.set(KEYRING_LOCATION, keyring);
       }
       changed = true;
@@ -5441,7 +5719,12 @@ async function adoptSecretsNamespace(filePath, secretStore, locked) {
   const existing = parseSecretsNamespace(raw);
   if (existing !== void 0) {
     if (locked) {
-      await purgeSupersededNamespaces(filePath, secretStore, existing);
+      await purgeSupersededNamespaces(
+        filePath,
+        secretStore,
+        existing,
+        snapshotClientOwners(parseOAuthPersistBlob(raw))
+      );
     }
     return existing;
   }
@@ -5461,25 +5744,33 @@ async function adoptSecretsNamespace(filePath, secretStore, locked) {
       `Could not save OAuth state: ${filePath} predates per-state-file secret namespaces, and migrating its secret-store entries needs the file lock, which is unavailable here (see the lock warning above). Migrating without it could lose credentials if two processes migrate at once. Nothing was changed; make the lock directory writable and retry \u2014 or, if you cannot, clear this file's stored OAuth state and re-authorize (clearing does not migrate, and the fresh state file mints its namespace without the lock).`
     );
   }
+  const values = await readEntrySecrets(
+    snapshot,
+    secretStore,
+    void 0,
+    await recordedNamespaces(filePath)
+  );
+  const owners = snapshotClientOwners(snapshot);
   await recordNamespaceKeys(
     filePath,
     secretStore,
     namespace,
     Object.keys(snapshot.servers),
-    Object.keys(snapshot.idpSessions)
+    Object.keys(snapshot.idpSessions),
+    writtenClientOwners(snapshot, (url) => values.servers.get(url) ?? {})
   );
+  await markUncarriedNamespaces(filePath, secretStore, namespace);
   const touched = [];
   try {
-    const values = await readEntrySecrets(
-      snapshot,
-      secretStore,
-      void 0,
-      await recordedNamespaces(filePath)
-    );
     const copies = [
+      // Restamped: a value read from the legacy ids predates stamps, and a
+      // fallback's stamp may belong to a value read from elsewhere (#2734).
       ...[...values.servers].map(([url, secrets]) => ({
         scopedId: oauthSecretServerId(url, namespace),
-        secrets
+        secrets: restampClientCredentials(
+          getOwnEntry(snapshot.servers, url) ?? {},
+          secrets
+        )
       })),
       ...[...values.idpSessions].map(([issuer, secrets]) => ({
         scopedId: oauthIdpSecretServerId(issuer, namespace),
@@ -5497,7 +5788,7 @@ async function adoptSecretsNamespace(filePath, secretStore, locked) {
     await restoreSecretFields(secretStore, touched, warnRestoreFailure);
     throw error;
   }
-  await purgeSupersededNamespaces(filePath, secretStore, namespace);
+  await purgeSupersededNamespaces(filePath, secretStore, namespace, owners);
   const legacyIds = [
     ...Object.keys(snapshot.servers).map((url) => oauthSecretServerId(url)),
     ...Object.keys(snapshot.idpSessions).map(
@@ -5704,7 +5995,22 @@ async function writeOAuthSectionsFrom(filePath, resolveSnapshot, sections, secre
           secretStore,
           namespace,
           Object.keys(merged.servers),
-          Object.keys(merged.idpSessions)
+          Object.keys(merged.idpSessions),
+          // Only the entries this save writes: another entry's secret in
+          // this store was written for whatever client it was written for,
+          // and relabeling it from the file would misattribute it (#2672).
+          writtenClientOwners(
+            {
+              servers: Object.fromEntries(
+                (effective.servers ?? []).flatMap((url) => {
+                  const entry = getOwnEntry(merged.servers, url);
+                  return entry === void 0 ? [] : [[url, entry]];
+                })
+              ),
+              idpSessions: {}
+            },
+            splitSecretsOf
+          )
         );
         for (const url of effective.servers ?? []) {
           const serverId = oauthSecretServerId(url, namespace);
@@ -5892,7 +6198,29 @@ function fillMissingSecrets(target, source) {
     if (!Object.hasOwn(target, field)) setOwnEntry(target, field, value);
   }
 }
-async function readEntrySecrets(snapshot, secretStore, namespace, fallbacks) {
+function writtenClientOwners(snapshot, secretsOf) {
+  const owners = /* @__PURE__ */ new Map();
+  for (const [url, state] of Object.entries(snapshot.servers)) {
+    const secrets = secretsOf(url, state);
+    const fields = new Map(
+      [...clientCredentialOwners(state)].filter(
+        ([field]) => Object.hasOwn(secrets, field)
+      )
+    );
+    if (fields.size > 0) owners.set(url, fields);
+  }
+  return owners;
+}
+var splitSecretsOf = (_url, state) => splitServerOAuthState(state, "all").secrets;
+function snapshotClientOwners(snapshot) {
+  const owners = /* @__PURE__ */ new Map();
+  for (const [url, state] of Object.entries(snapshot?.servers ?? {})) {
+    const fields = clientCredentialOwners(state);
+    if (fields.size > 0) owners.set(url, fields);
+  }
+  return owners;
+}
+async function readEntrySecrets(snapshot, secretStore, namespace, fallbacks, carries = []) {
   const servers = /* @__PURE__ */ new Map();
   const idpSessions = /* @__PURE__ */ new Map();
   for (const url of Object.keys(snapshot.servers)) servers.set(url, {});
@@ -5913,14 +6241,49 @@ async function readEntrySecrets(snapshot, secretStore, namespace, fallbacks) {
       );
     }
   }
+  const owners = snapshotClientOwners(snapshot);
+  for (const { namespace: from, fields: recorded } of carries) {
+    const requests = [];
+    for (const [url, fields] of recorded) {
+      const target = servers.get(url);
+      if (!target) continue;
+      const wanted = [...fields].filter(
+        (field) => owners.get(url)?.has(field) === true && !Object.hasOwn(target, field)
+      );
+      if (wanted.length > 0) {
+        requests.push({
+          serverId: oauthSecretServerId(url, from),
+          fields: wanted.flatMap((field) => [
+            field,
+            clientCredentialStampField(field)
+          ])
+        });
+      }
+    }
+    if (requests.length === 0) continue;
+    const values = await secretStoreGetManyStrict(secretStore, requests);
+    for (const [url, target] of servers) {
+      const found = values[oauthSecretServerId(url, from)] ?? {};
+      for (const [field, clientId] of owners.get(url) ?? []) {
+        const value = Object.hasOwn(found, field) ? found[field] : void 0;
+        const stampField = clientCredentialStampField(field);
+        if (value === void 0 || Object.hasOwn(target, field) || stampedOwner(found[stampField], value) !== clientId) {
+          continue;
+        }
+        setOwnEntry(target, field, value);
+        setOwnEntry(target, stampField, found[stampField]);
+      }
+    }
+  }
   return { servers, idpSessions };
 }
-async function joinSnapshot(snapshot, secretStore, namespace, fallbacks) {
+async function joinSnapshot(snapshot, secretStore, namespace, fallbacks, carries = []) {
   const values = await readEntrySecrets(
     snapshot,
     secretStore,
     namespace,
-    fallbacks
+    fallbacks,
+    carries
   );
   return {
     servers: Object.fromEntries(
@@ -5948,7 +6311,8 @@ async function migratePlaintextSecrets(filePath, secretStore) {
       secretStore,
       namespace,
       Object.keys(fresh.servers),
-      Object.keys(fresh.idpSessions)
+      Object.keys(fresh.idpSessions),
+      writtenClientOwners(fresh, splitSecretsOf)
     );
   }
   const migrateEntrySecrets = async (serverId, secrets) => {
@@ -6001,7 +6365,8 @@ async function readOAuthStore(filePath, secretStore = defaultSecretStore()) {
     }
     const namespace = parseSecretsNamespace(raw);
     const fallbacks = namespace === void 0 ? await recordedNamespaces(filePath) : [];
-    return joinSnapshot(snapshot, secretStore, namespace, fallbacks);
+    const carries = namespace === void 0 ? [] : await pendingCarries(filePath, secretStore, namespace);
+    return joinSnapshot(snapshot, secretStore, namespace, fallbacks, carries);
   });
 }
 async function removeOAuthStore(filePath, secretStore = defaultSecretStore()) {
@@ -6761,8 +7126,226 @@ function createTransportNode(config, options = {}) {
   }
 }
 
+// ../../core/mcp/remote/node/cappedBody.ts
+async function readCappedText(body, maxBytes) {
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let text = "";
+  let bytes = 0;
+  for (; ; ) {
+    const next = await reader.read();
+    if (next.done) return { kind: "complete", text: text + decoder.decode() };
+    bytes += next.value.byteLength;
+    if (bytes > maxBytes) {
+      void reader.cancel().catch(() => {
+      });
+      return { kind: "overflow" };
+    }
+    text += decoder.decode(next.value, { stream: true });
+  }
+}
+function declaresOversizeBody(contentLength, maxBytes) {
+  if (contentLength === null || !/^\s*\d+\s*$/.test(contentLength)) {
+    return false;
+  }
+  return Number(contentLength) > maxBytes;
+}
+
+// ../../core/mcp/rateLimit.ts
+import {
+  SdkHttpError
+} from "@modelcontextprotocol/client";
+
+// ../../core/mcp/connectionDiagnostics.ts
+import { SdkError, SdkErrorCode } from "@modelcontextprotocol/client";
+function isRequestTimeoutData(value) {
+  return typeof value === "object" && value !== null && typeof value.timeout === "number";
+}
+function isRequestTimeoutError(err) {
+  return SdkError.isInstance(err) && err.code === SdkErrorCode.RequestTimeout && isRequestTimeoutData(err.data);
+}
+function describeSendFailure(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  const status = httpStatusOf(err);
+  if (status === void 0 || message.includes(`HTTP ${status}`)) {
+    return message;
+  }
+  const statusText = httpStatusTextOf(err);
+  return `HTTP ${status}${statusText ? ` ${statusText}` : ""}: ${message}`;
+}
+function httpStatusOf(err) {
+  if (typeof err !== "object" || err === null || !("status" in err)) {
+    return void 0;
+  }
+  return typeof err.status === "number" ? err.status : void 0;
+}
+function httpStatusTextOf(err) {
+  if (typeof err !== "object" || err === null || !("statusText" in err)) {
+    return void 0;
+  }
+  return typeof err.statusText === "string" ? err.statusText : void 0;
+}
+function formatDuration(ms) {
+  const clamped = Math.max(0, ms);
+  if (clamped < 1e3) return `${Math.round(clamped)}ms`;
+  const totalSeconds = Math.round(clamped / 1e3);
+  const hours = Math.floor(totalSeconds / 3600);
+  const minutes = Math.floor(totalSeconds % 3600 / 60);
+  const seconds = totalSeconds % 60;
+  if (hours > 0) return `${hours}h${String(minutes).padStart(2, "0")}m`;
+  if (minutes > 0) return `${minutes}m${String(seconds).padStart(2, "0")}s`;
+  return `${seconds}s`;
+}
+var MAX_LISTED_OUTSTANDING_REQUESTS = 5;
+function describeStreamEndpoint(url) {
+  try {
+    return `GET ${new URL(url).pathname}`;
+  } catch {
+    return `GET ${url}`;
+  }
+}
+function plural(count, noun) {
+  return `${count} ${noun}${count === 1 ? "" : "s"}`;
+}
+function describeOutstanding(requests, now) {
+  if (requests.length === 0) return "No requests are unanswered.";
+  const listed = requests.slice(0, MAX_LISTED_OUTSTANDING_REQUESTS).map((r) => `${r.method} (sent ${formatDuration(now - r.sentAt)} ago)`);
+  const rest = requests.length - listed.length;
+  const tail = rest > 0 ? `, and ${rest} more` : "";
+  const verb = requests.length === 1 ? "is" : "are";
+  return `${plural(requests.length, "request")} ${verb} unanswered: ${listed.join(", ")}${tail}.`;
+}
+function describeLastResponse(lastResponse, now) {
+  if (!lastResponse) return "No response has been received this session.";
+  return `Last response received ${formatDuration(now - lastResponse.receivedAt)} ago (${lastResponse.method}).`;
+}
+function describeStream(stream, now) {
+  if (!stream) return void 0;
+  const endpoint = describeStreamEndpoint(stream.url);
+  const events = plural(stream.eventCount, "event");
+  if (stream.closedAt !== void 0) {
+    return `Notification stream (${endpoint}) closed ${formatDuration(now - stream.closedAt)} ago after ${formatDuration(stream.closedAt - stream.openedAt)}, ${events} delivered.`;
+  }
+  return `Notification stream (${endpoint}) open for ${formatDuration(now - stream.openedAt)}, ${events} delivered.`;
+}
+function describeConnectionDiagnostics(diagnostics) {
+  const now = diagnostics.capturedAt;
+  const parts = [
+    describeOutstanding(diagnostics.outstandingRequests, now),
+    describeLastResponse(diagnostics.lastResponse, now),
+    describeStream(diagnostics.notificationStream, now)
+  ];
+  return parts.filter((p) => p !== void 0).join(" ");
+}
+function annotateRequestTimeout(err, method, diagnostics) {
+  if (!isRequestTimeoutError(err)) return err;
+  const data = {
+    ...err.data,
+    method,
+    diagnostics
+  };
+  const message = `Request timed out after ${formatDuration(err.data.timeout)} (${method}). ${describeConnectionDiagnostics(diagnostics)}`;
+  const annotated = new SdkError(SdkErrorCode.RequestTimeout, message, data);
+  annotated.cause = err;
+  return annotated;
+}
+
+// ../../core/mcp/rateLimit.ts
+var HTTP_TOO_MANY_REQUESTS = 429;
+function requestIdsOf(body) {
+  if (body === void 0) return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return [];
+  }
+  const messages = Array.isArray(parsed) ? parsed : [parsed];
+  const ids = [];
+  for (const message of messages) {
+    if (typeof message !== "object" || message === null) continue;
+    if (!("method" in message) || !("id" in message)) continue;
+    const { id } = message;
+    if (typeof id === "string" || typeof id === "number") ids.push(id);
+  }
+  return ids;
+}
+var MAX_UNCLAIMED_RATE_LIMITS = 100;
+var RateLimitLedger = class {
+  // `undefined` is a real value here: a 429 that carried no header.
+  byRequestId = /* @__PURE__ */ new Map();
+  /** File a tracked fetch, if it was a 429. Anything else is ignored. */
+  record(entry) {
+    if (entry.responseStatus !== HTTP_TOO_MANY_REQUESTS) return;
+    const retryAfter = findHeader(entry.responseHeaders, "retry-after");
+    for (const id of requestIdsOf(entry.requestBody)) {
+      this.byRequestId.delete(id);
+      this.byRequestId.set(id, retryAfter);
+      if (this.byRequestId.size > MAX_UNCLAIMED_RATE_LIMITS) {
+        const [oldest] = this.byRequestId.keys();
+        if (oldest !== void 0) this.byRequestId.delete(oldest);
+      }
+    }
+  }
+  /** The `Retry-After` filed for `id`, removed as it is read. */
+  take(id) {
+    const retryAfter = this.byRequestId.get(id);
+    this.byRequestId.delete(id);
+    return retryAfter;
+  }
+  clear() {
+    this.byRequestId.clear();
+  }
+};
+var IMF_FIXDATE = /^[A-Z][a-z]{2}, \d{2} [A-Z][a-z]{2} \d{4} \d{2}:\d{2}:\d{2} GMT$/;
+function parseRetryAfter(value, now) {
+  if (value === void 0) return void 0;
+  const trimmed = value.trim();
+  if (/^\d+$/.test(trimmed)) return Number(trimmed) * 1e3;
+  if (!IMF_FIXDATE.test(trimmed)) return void 0;
+  const at = Date.parse(trimmed);
+  if (Number.isNaN(at) || new Date(at).toUTCString() !== trimmed) {
+    return void 0;
+  }
+  return Math.max(0, at - now);
+}
+function isRateLimitError(err) {
+  return SdkHttpError.isInstance(err) && err.status === HTTP_TOO_MANY_REQUESTS;
+}
+function retryAfterOn(err) {
+  const value = err.data.retryAfter;
+  return typeof value === "string" ? value : void 0;
+}
+function attachRetryAfter(err, retryAfter) {
+  if (!isRateLimitError(err) || retryAfter === void 0) return;
+  if (retryAfterOn(err) !== void 0) return;
+  err.data.retryAfter = retryAfter;
+}
+function describeRetry(retryAfter, retryAfterMs) {
+  if (retryAfterMs !== void 0) {
+    return `The server asked to retry after ${formatDuration(retryAfterMs)}.`;
+  }
+  if (retryAfter !== void 0) {
+    return `The server sent an unparseable Retry-After (${retryAfter}).`;
+  }
+  return "The server sent no Retry-After header.";
+}
+function annotateRateLimit(err, method, now = Date.now()) {
+  if (!isRateLimitError(err)) return err;
+  const header2 = retryAfterOn(err);
+  const retryAfterMs = parseRetryAfter(header2, now);
+  const data = {
+    ...err.data,
+    method,
+    ...header2 !== void 0 && { retryAfter: header2 },
+    ...retryAfterMs !== void 0 && { retryAfterMs }
+  };
+  const message = `Rate limited by the server (HTTP 429) on ${method}. ${describeRetry(header2, retryAfterMs)} ${err.message}`;
+  return new SdkHttpError(err.code, message, data, { cause: err });
+}
+
 // ../../core/mcp/remote/node/server.ts
-import { SdkHttpError } from "@modelcontextprotocol/client";
+import { SdkHttpError as SdkHttpError2 } from "@modelcontextprotocol/client";
 
 // ../../core/json/xMcpHeader.ts
 var X_MCP_HEADER_KEY = "x-mcp-header";
@@ -8393,6 +8976,8 @@ var RemoteSession = class _RemoteSession {
   requestWaits = /* @__PURE__ */ new Map();
   authProviderHandle = null;
   appliedProtocolVersion;
+  /** Each upstream `429`'s `Retry-After`, by the JSON-RPC id that drew it (#2442). */
+  rateLimits = new RateLimitLedger();
   /** A protocol version is a dated token (`2025-11-25`, `2026-07-28`, …). */
   static PROTOCOL_VERSION_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
   constructor(sessionId) {
@@ -8604,6 +9189,7 @@ var RemoteSession = class _RemoteSession {
     this.pushEvent({ type: "message", data: message });
   }
   onFetchRequest(entry) {
+    this.rateLimits.record(entry);
     this.pushEvent({
       type: "fetch_request",
       data: {
@@ -8612,6 +9198,14 @@ var RemoteSession = class _RemoteSession {
       }
     });
   }
+  /**
+   * The `Retry-After` of the upstream `429` that answered request `id` — read
+   * by the send route, so the header rides back on the send's own error rather
+   * than on a fetch event racing it (#2442).
+   */
+  takeRetryAfter(id) {
+    return this.rateLimits.take(id);
+  }
   onFetchResponseBody(id, responseBody) {
     this.pushEvent({
       type: "fetch_request_body_update",
@@ -9064,6 +9658,17 @@ var MAX_APP_DOCUMENT_CHARS = 8 * 1024 * 1024;
 var MAX_APP_DOCUMENT_BODY_BYTES = 24 * 1024 * 1024;
 var MAX_APP_CSP_CHARS = 8 * 1024;
 var MAX_STORAGE_BODY_BYTES = 4 * 1024 * 1024;
+var MAX_PROXIED_RESPONSE_BYTES = 4 * 1024 * 1024;
+var BODY_FRAMING_HEADERS = /* @__PURE__ */ new Set([
+  "content-length",
+  "transfer-encoding",
+  "content-encoding"
+]);
+function withoutBodyFraming(headers) {
+  return Object.fromEntries(
+    Object.entries(headers).filter(([k]) => !BODY_FRAMING_HEADERS.has(k))
+  );
+}
 function isHeaderSafeValue(value) {
   return !/[^\t\x20-\x7e]/.test(value);
 }
@@ -9519,8 +10124,10 @@ function createRemoteApp(options) {
         });
       }
       const msg = err instanceof Error ? err.message : String(err);
-      if (err instanceof SdkHttpError) {
+      if (err instanceof SdkHttpError2) {
         const text = err.data.text;
+        const sentId = "id" in message ? message.id : void 0;
+        const retryAfter = isRateLimitError(err) && (typeof sentId === "string" || typeof sentId === "number") ? session.takeRetryAfter(sentId) : void 0;
         return c.json({
           ok: false,
           kind: "transport_error",
@@ -9531,7 +10138,8 @@ function createRemoteApp(options) {
             ...err.statusText !== void 0 && {
               statusText: err.statusText
             },
-            ...typeof text === "string" && { text }
+            ...typeof text === "string" && { text },
+            ...retryAfter !== void 0 && { retryAfter }
           }
         });
       }
@@ -9664,7 +10272,28 @@ function createRemoteApp(options) {
       const isStream = contentType?.includes("text/event-stream") || contentType?.includes("application/x-ndjson");
       let resBody;
       if (!isStream && res.body) {
-        resBody = await res.text();
+        const refuseOversize = () => res.ok ? c.json(
+          {
+            error: `response from ${safeUrl} exceeds the ${MAX_PROXIED_RESPONSE_BYTES}-byte limit for a proxied response`
+          },
+          502
+        ) : c.json({
+          ok: res.ok,
+          status: res.status,
+          statusText: res.statusText,
+          headers: withoutBodyFraming(resHeaders)
+        });
+        if (declaresOversizeBody(
+          res.headers.get("content-length"),
+          MAX_PROXIED_RESPONSE_BYTES
+        )) {
+          void res.body.cancel().catch(() => {
+          });
+          return refuseOversize();
+        }
+        const read = await readCappedText(res.body, MAX_PROXIED_RESPONSE_BYTES);
+        if (read.kind === "overflow") return refuseOversize();
+        resBody = read.text;
       } else if (isStream) {
         void res.body?.cancel().catch(() => {
         });
@@ -11792,12 +12421,12 @@ function countFindings(results) {
   }
   return { errors, warnings };
 }
-function plural(count, noun) {
+function plural2(count, noun) {
   return `${count} ${noun}${count === 1 ? "" : "s"}`;
 }
 function summarizeFindings(results) {
   const { errors, warnings } = countFindings(results);
-  return `${plural(errors, "error")}, ${plural(warnings, "warning")} across ${plural(results.length, "tool")}`;
+  return `${plural2(errors, "error")}, ${plural2(warnings, "warning")} across ${plural2(results.length, "tool")}`;
 }
 function formatSchemaLintReport(results) {
   const lines = [];
@@ -12935,11 +13564,11 @@ import {
 } from "@modelcontextprotocol/core";
 
 // ../../core/mcp/subscriptionAck.ts
-import { SdkError, SdkErrorCode } from "@modelcontextprotocol/client";
+import { SdkError as SdkError2, SdkErrorCode as SdkErrorCode2 } from "@modelcontextprotocol/client";
 var NEVER_ACKNOWLEDGED_SDK_MESSAGE = "closed the subscription gracefully before acknowledging";
 var NEVER_ACKNOWLEDGED_SUBSCRIPTION_MESSAGE = "The server closed the subscription without acknowledging it. A subscriptions/listen request must first be answered with a notifications/subscriptions/acknowledged notification; a JSON-RPC result for the listen id means graceful closure. Not retrying \u2014 the server would answer the same way again.";
 function isNeverAcknowledgedSubscriptionClose(error) {
-  return SdkError.isInstance(error) && error.code === SdkErrorCode.ConnectionClosed && error.message.includes(NEVER_ACKNOWLEDGED_SDK_MESSAGE);
+  return SdkError2.isInstance(error) && error.code === SdkErrorCode2.ConnectionClosed && error.message.includes(NEVER_ACKNOWLEDGED_SDK_MESSAGE);
 }
 function subscriptionFailureMessage(error) {
   if (isNeverAcknowledgedSubscriptionClose(error)) {
@@ -12948,6 +13577,23 @@ function subscriptionFailureMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
+// ../../core/mcp/subscriptionRefusal.ts
+import { SdkErrorCode as SdkErrorCode3, SdkHttpError as SdkHttpError3 } from "@modelcontextprotocol/client";
+var REFUSAL_STATUSES = /* @__PURE__ */ new Set([400, 403, 404, 405]);
+function subscriptionListenRefusal(error) {
+  if (!SdkHttpError3.isInstance(error) || error.code !== SdkErrorCode3.ClientHttpNotImplemented || !REFUSAL_STATUSES.has(error.status)) {
+    return void 0;
+  }
+  return {
+    status: error.status,
+    ...error.statusText ? { statusText: error.statusText } : {}
+  };
+}
+function subscriptionListenRefusalMessage(refusal) {
+  const status = refusal.statusText ? `${refusal.status} ${refusal.statusText}` : String(refusal.status);
+  return `The server refused subscriptions/listen (HTTP ${status}). Not retrying \u2014 the server would answer the same way again.`;
+}
+
 // ../../core/mcp/messageTrackingTransport.ts
 var MessageTrackingTransport = class {
   baseTransport;
@@ -13177,7 +13823,7 @@ var TaskProgressRouter = class {
 };
 
 // ../../core/extension/tasks/rawWireChannel.ts
-import { SdkError as SdkError2, SdkErrorCode as SdkErrorCode2 } from "@modelcontextprotocol/client";
+import { SdkError as SdkError3, SdkErrorCode as SdkErrorCode4 } from "@modelcontextprotocol/client";
 import { DispatchError as DispatchError2 } from "@modelcontextprotocol/ext-tasks/client";
 var RAW_WIRE_ID_PREFIX = "inspector-ext-";
 var RawWireChannel = class {
@@ -13250,8 +13896,8 @@ var RawWireChannel = class {
             `Raw MCP request "${message.method}" timed out after ${timeoutMs} ms`,
             false,
             {
-              cause: this.host.annotateTimeout(
-                new SdkError2(SdkErrorCode2.RequestTimeout, "Request timed out", {
+              cause: this.host.annotateError(
+                new SdkError3(SdkErrorCode4.RequestTimeout, "Request timed out", {
                   timeout: timeoutMs
                 }),
                 message.method
@@ -13291,7 +13937,7 @@ var RawWireChannel = class {
         if (!pending) return;
         pending.cleanup();
         reject(
-          this.host.annotateTimeout(
+          this.host.annotateError(
             error instanceof Error ? error : new Error(String(error)),
             message.method
           )
@@ -13591,7 +14237,7 @@ function validateToolOutput(provider, tool, result) {
 
 // ../../core/mcp/listSalvage.ts
 import { z as z4 } from "zod/v4";
-import { SdkError as SdkError3, SdkErrorCode as SdkErrorCode3 } from "@modelcontextprotocol/client";
+import { SdkError as SdkError4, SdkErrorCode as SdkErrorCode5 } from "@modelcontextprotocol/client";
 import { ToolSchema } from "@modelcontextprotocol/core";
 var LIST_MAX_PAGES = 64;
 function listPaginationExceeded(method) {
@@ -13600,10 +14246,10 @@ function listPaginationExceeded(method) {
   );
 }
 function isClientDecodeRejection(err) {
-  return SdkError3.isInstance(err) && (err.code === SdkErrorCode3.InvalidResult || err.code === SdkErrorCode3.UnsupportedResultType);
+  return SdkError4.isInstance(err) && (err.code === SdkErrorCode5.InvalidResult || err.code === SdkErrorCode5.UnsupportedResultType);
 }
 function isSalvageableRejection(err) {
-  return SdkError3.isInstance(err) && err.code === SdkErrorCode3.InvalidResult;
+  return SdkError4.isInstance(err) && err.code === SdkErrorCode5.InvalidResult;
 }
 function lenientListPageSchema(resultSchema, itemsKey) {
   return resultSchema.extend({ [itemsKey]: z4.array(z4.unknown()) });
@@ -14209,79 +14855,6 @@ var ToolCallCancelledError = class extends Error {
   }
 };
 
-// ../../core/mcp/connectionDiagnostics.ts
-import { SdkError as SdkError4, SdkErrorCode as SdkErrorCode4 } from "@modelcontextprotocol/client";
-function isRequestTimeoutData(value) {
-  return typeof value === "object" && value !== null && typeof value.timeout === "number";
-}
-function isRequestTimeoutError(err) {
-  return SdkError4.isInstance(err) && err.code === SdkErrorCode4.RequestTimeout && isRequestTimeoutData(err.data);
-}
-function formatDuration(ms) {
-  const clamped = Math.max(0, ms);
-  if (clamped < 1e3) return `${Math.round(clamped)}ms`;
-  const totalSeconds = Math.round(clamped / 1e3);
-  const hours = Math.floor(totalSeconds / 3600);
-  const minutes = Math.floor(totalSeconds % 3600 / 60);
-  const seconds = totalSeconds % 60;
-  if (hours > 0) return `${hours}h${String(minutes).padStart(2, "0")}m`;
-  if (minutes > 0) return `${minutes}m${String(seconds).padStart(2, "0")}s`;
-  return `${seconds}s`;
-}
-var MAX_LISTED_OUTSTANDING_REQUESTS = 5;
-function describeStreamEndpoint(url) {
-  try {
-    return `GET ${new URL(url).pathname}`;
-  } catch {
-    return `GET ${url}`;
-  }
-}
-function plural2(count, noun) {
-  return `${count} ${noun}${count === 1 ? "" : "s"}`;
-}
-function describeOutstanding(requests, now) {
-  if (requests.length === 0) return "No requests are unanswered.";
-  const listed = requests.slice(0, MAX_LISTED_OUTSTANDING_REQUESTS).map((r) => `${r.method} (sent ${formatDuration(now - r.sentAt)} ago)`);
-  const rest = requests.length - listed.length;
-  const tail = rest > 0 ? `, and ${rest} more` : "";
-  const verb = requests.length === 1 ? "is" : "are";
-  return `${plural2(requests.length, "request")} ${verb} unanswered: ${listed.join(", ")}${tail}.`;
-}
-function describeLastResponse(lastResponse, now) {
-  if (!lastResponse) return "No response has been received this session.";
-  return `Last response received ${formatDuration(now - lastResponse.receivedAt)} ago (${lastResponse.method}).`;
-}
-function describeStream(stream, now) {
-  if (!stream) return void 0;
-  const endpoint = describeStreamEndpoint(stream.url);
-  const events = plural2(stream.eventCount, "event");
-  if (stream.closedAt !== void 0) {
-    return `Notification stream (${endpoint}) closed ${formatDuration(now - stream.closedAt)} ago after ${formatDuration(stream.closedAt - stream.openedAt)}, ${events} delivered.`;
-  }
-  return `Notification stream (${endpoint}) open for ${formatDuration(now - stream.openedAt)}, ${events} delivered.`;
-}
-function describeConnectionDiagnostics(diagnostics) {
-  const now = diagnostics.capturedAt;
-  const parts = [
-    describeOutstanding(diagnostics.outstandingRequests, now),
-    describeLastResponse(diagnostics.lastResponse, now),
-    describeStream(diagnostics.notificationStream, now)
-  ];
-  return parts.filter((p) => p !== void 0).join(" ");
-}
-function annotateRequestTimeout(err, method, diagnostics) {
-  if (!isRequestTimeoutError(err)) return err;
-  const data = {
-    ...err.data,
-    method,
-    diagnostics
-  };
-  const message = `Request timed out after ${formatDuration(err.data.timeout)} (${method}). ${describeConnectionDiagnostics(diagnostics)}`;
-  const annotated = new SdkError4(SdkErrorCode4.RequestTimeout, message, data);
-  annotated.cause = err;
-  return annotated;
-}
-
 // ../../core/auth/ema/clientConfigError.ts
 function emaClientNotConfiguredMessage(reason) {
   if (reason === "disabled") {
@@ -14714,11 +15287,6 @@ async function mintEmaResourceTokens(config, resourceContext) {
       "EMA requires resource authorization server clientId (per-server oauth.clientId)"
     );
   }
-  if (!config.resourceClientSecret?.trim()) {
-    throw new Error(
-      "EMA requires resource authorization server client secret in server OAuth settings (Test Client secret from xaa.dev resource registration)"
-    );
-  }
   const idToken = await getValidIdToken({
     idp: config.idp,
     storage: config.storage,
@@ -14984,7 +15552,9 @@ var OAuthManager = class {
       requestRefreshToken: this.oauthConfig.requestRefreshToken,
       // #2068: lets the provider tell an `offline_access` the user asked for
       // from one inherited from a previous grant's persisted scope.
-      configuredScope: this.oauthConfig.scope
+      configuredScope: this.oauthConfig.scope,
+      // #2726: in-flight PKCE verifiers keyed by flow, not by server URL.
+      flowStore: this.oauthConfig.flowStore
     });
     provider.setEventTarget(this.params.getEventTarget());
     await provider.prepareForAuth();
@@ -15148,7 +15718,12 @@ var OAuthManager = class {
   recordAuthorizationRequestScope(authorizationUrl, requestedScope) {
     this.pendingAuthorizationScope = authorizationUrl.searchParams.get("scope")?.trim() || requestedScope;
   }
-  async completeOAuthFlow(authorizationCode, iss) {
+  /**
+   * `state` is the OAuth `state` the callback was redirected back with. It
+   * selects the flow whose PKCE verifier the exchange uses (#2726); without it
+   * a provider with a flow store has no verifier to send.
+   */
+  async completeOAuthFlow(authorizationCode, iss, state) {
     try {
       if (this.isEnterpriseManaged()) {
         const emaConfig = await this.getEmaFlowConfig();
@@ -15172,6 +15747,9 @@ var OAuthManager = class {
       }
       const provider = await this.createOAuthProvider();
       const serverUrl = this.getServerUrl();
+      if (state !== void 0) {
+        provider.resumeAuthorizationFlow(state);
+      }
       const result = await mcpAuth(provider, {
         serverUrl,
         authorizationCode,
@@ -15183,6 +15761,7 @@ var OAuthManager = class {
           `Expected AUTHORIZED after providing authorization code, got: ${result}`
         );
       }
+      await provider.clearAuthorizationFlow();
       const tokens = await provider.tokens();
       if (!tokens) {
         throw new Error("Failed to retrieve tokens after authorization");
@@ -15314,15 +15893,21 @@ var OAuthManager = class {
    * Re-read persisted OAuth state and determine whether `challenge` is already
    * satisfied without an authorization-server round-trip.
    *
-   * Returns `true` for `insufficient_scope` when stored + token scope cover the
-   * SEP-2350 union. For `token_expired`, returns `true` only when storage holds
-   * a *provably* unexpired token — a JWT whose `exp` is still in the future. An
-   * opaque token carries no local expiry evidence, so the resource server's
-   * verdict stands and re-authorization proceeds. `invalid_token` and
-   * `unauthorized` always return `false` — the resource server explicitly
-   * rejected the credential.
+   * For `token_expired` and `insufficient_scope`, returns `true` only when
+   * storage holds a *provably* unexpired token — a JWT whose `exp` is still in
+   * the future. An opaque token carries no local expiry evidence, so the
+   * resource server's verdict stands and re-authorization proceeds.
+   * `insufficient_scope` additionally requires stored + token scope to cover
+   * the SEP-2350 union: some resource servers answer an *expired* token with
+   * `insufficient_scope`, and a scope-only check would replay that dead token
+   * instead of refreshing it (#2724, the same gap #2051 closed for
+   * `token_expired`). `invalid_token` and `unauthorized` always return
+   * `false` — the resource server explicitly rejected the credential.
+   *
+   * A caller that has just completed a grant passes `scopeOnly` — see
+   * {@link CheckAuthChallengeSatisfiedOptions}.
    */
-  async checkAuthChallengeSatisfied(challenge) {
+  async checkAuthChallengeSatisfied(challenge, options) {
     const storage = this.oauthConfig.storage;
     if (!storage) {
       return false;
@@ -15335,6 +15920,14 @@ var OAuthManager = class {
     if (challenge.reason !== "insufficient_scope") {
       return challenge.reason === "token_expired" && isAccessTokenProvablyUnexpired(tokens);
     }
+    if (!options?.scopeOnly && !isAccessTokenProvablyUnexpired(tokens)) {
+      return false;
+    }
+    return this.isStepUpScopeCovered(challenge, storage, tokens);
+  }
+  /** Stored + token scope cover the challenge's SEP-2350 union. */
+  async isStepUpScopeCovered(challenge, storage, tokens) {
+    const serverUrl = this.getServerUrl();
     const enriched = await this.enrichChallengeWithAuthorizationScopes(
       challenge,
       tokens.scope
@@ -15438,14 +16031,14 @@ var OAuthManager = class {
   }
   async handleEnterpriseManagedAuthChallenge(challenge, options) {
     const enriched = await this.enrichChallengeWithAuthorizationScopes(challenge);
-    if (enriched.reason === "insufficient_scope" && !options?.confirmedStepUp) {
+    if (enriched.reason === "insufficient_scope" && !options?.confirmedStepUp && !await this.checkAuthChallengeSatisfied(enriched, { scopeOnly: true })) {
       return { kind: "step_up_confirm", challenge: enriched };
     }
     const config = await this.emaFlowConfigForChallenge(enriched);
     if (enriched.reason === "insufficient_scope") {
       const silent = await trySilentEmaAuth(config);
       if (silent.status === "success") {
-        if (await this.checkAuthChallengeSatisfied(enriched)) {
+        if (await this.checkAuthChallengeSatisfied(enriched, { scopeOnly: true })) {
           const minted = await this.requireStorage().getTokens(
             this.getServerUrl()
           );
@@ -15523,9 +16116,16 @@ var OAuthManager = class {
         fetchFn: this.params.effectiveAuthFetch,
         resourceMetadataUrl,
         ...enriched.reason === "insufficient_scope" && {
+          // Judge coverage the way checkAuthChallengeSatisfied does: a token
+          // response that omitted `scope` granted what was stored, so a
+          // covered challenge on an expired token refreshes rather than
+          // forcing interactive authorization (#2724).
           forceReauthorization: isStrictScopeSuperset(
             scopeForAuth,
-            tokens?.scope
+            resolveEffectiveGrantedScope(
+              await this.oauthConfig.storage?.getScope(serverUrl),
+              tokens?.scope
+            )
           )
         }
       });
@@ -15534,7 +16134,7 @@ var OAuthManager = class {
     }
     if (result === "AUTHORIZED") {
       if (enriched.reason === "insufficient_scope") {
-        if (await this.checkAuthChallengeSatisfied(enriched)) {
+        if (await this.checkAuthChallengeSatisfied(enriched, { scopeOnly: true })) {
           const freshTokens = await provider.tokens();
           const scopeToPersist = resolvePersistedScopeAfterGrant(
             freshTokens?.scope,
@@ -15636,7 +16236,7 @@ var OAuthManager = class {
     if (result !== "AUTHORIZED") {
       return null;
     }
-    if (await this.checkAuthChallengeSatisfied(enriched)) {
+    if (await this.checkAuthChallengeSatisfied(enriched, { scopeOnly: true })) {
       const freshTokens = await provider.tokens();
       const scopeToPersist = resolvePersistedScopeAfterGrant(
         freshTokens?.scope,
@@ -15668,8 +16268,8 @@ var OAuthManager = class {
 // ../../core/mcp/remote/remoteClientTransport.ts
 import {
   SdkError as SdkError5,
-  SdkErrorCode as SdkErrorCode5,
-  SdkHttpError as SdkHttpError2
+  SdkErrorCode as SdkErrorCode6,
+  SdkHttpError as SdkHttpError4
 } from "@modelcontextprotocol/client";
 
 // ../../core/mcp/remote/types.ts
@@ -15704,14 +16304,15 @@ function isConnectTransportError(json) {
   return typeof json === "object" && json !== null && "ok" in json && json.ok === false && "kind" in json && json.kind === "transport_error";
 }
 var SDK_ERROR_CODES = new Set(
-  Object.values(SdkErrorCode5)
+  Object.values(SdkErrorCode6)
 );
 function toSdkHttpError(message, http) {
-  const code = SDK_ERROR_CODES.has(http.code) ? http.code : SdkErrorCode5.ClientHttpNotImplemented;
-  return new SdkHttpError2(code, message, {
+  const code = SDK_ERROR_CODES.has(http.code) ? http.code : SdkErrorCode6.ClientHttpNotImplemented;
+  return new SdkHttpError4(code, message, {
     status: http.status,
     ...http.statusText !== void 0 && { statusText: http.statusText },
-    ...http.text !== void 0 && { text: http.text }
+    ...http.text !== void 0 && { text: http.text },
+    ...http.retryAfter !== void 0 && { retryAfter: http.retryAfter }
   });
 }
 function legacySessionId(json) {
@@ -16145,7 +16746,7 @@ var RemoteClientTransport = class {
         timer = setTimeout(() => {
           this.sseResponseWaits.delete(requestId);
           reject(
-            new SdkError5(SdkErrorCode5.RequestTimeout, "Request timed out", {
+            new SdkError5(SdkErrorCode6.RequestTimeout, "Request timed out", {
               timeout: this.sseResponseTimeoutMs
             })
           );
@@ -16357,7 +16958,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
     transport: () => this.transport,
     defaultTimeoutMs: () => this.requestTimeout ?? DEFAULT_REQUEST_TIMEOUT_MSEC,
     resetTimeoutOnProgress: () => this.resetTimeoutOnProgress,
-    annotateTimeout: (error, method) => annotateRequestTimeout(error, method, this.getConnectionDiagnostics())
+    annotateError: (error, method) => this.annotateRequestError(error, method)
   });
   dispatchTaskRequest = (request, options) => this.rawWire.dispatch(request, options);
   // Every outbound request still awaiting a response, keyed by JSON-RPC id.
@@ -16377,6 +16978,10 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
   // `GET` on Streamable HTTP). Both per-session, reset with the maps above.
   lastResponse;
   notificationStream;
+  // Each tracked `429`'s `Retry-After`, by the JSON-RPC id that drew it, until
+  // that id's failed send claims it (#2442). Per-session, reset with the
+  // diagnostics above.
+  rateLimits = new RateLimitLedger();
   /** True when the cached transport was built with an OAuth authProvider attached. */
   transportHasAuthProvider = false;
   /** Dedupes concurrent ambient auth challenges (reason + scopes). */
@@ -16521,6 +17126,10 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
   // site to the two failure handlers. Cleared by any user-initiated refresh (a
   // subscribe/unsubscribe is a fresh attempt, and the server may have changed).
   modernNeverAcknowledged = false;
+  // Set when the last `listen()` was refused at the HTTP layer with a status a
+  // retry cannot change (#2722) — the sibling of `modernNeverAcknowledged`,
+  // carried and cleared the same way, holding the HTTP answer the UI reports.
+  modernListenRefusal = null;
   /** Which in-flight task calls own each progress token (#2316). */
   taskProgress = new TaskProgressRouter();
   // Abort controller for the in-flight ordinary (non-task) tool call. Aborting
@@ -16778,7 +17387,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       this.clientInfo,
       Object.keys(clientOptions).length > 0 ? clientOptions : void 0
     );
-    this.annotateSdkRequestTimeouts(this.client);
+    this.annotateSdkRequestErrors(this.client);
     if (this.tasksCapabilityAdvertised) {
       this.bindReceiverTasks();
     }
@@ -16786,7 +17395,8 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
   /**
    * Decorate the SDK Client's `request` so a per-request timeout rejects with
    * the connection's state at that moment instead of a bare `Request timed
-   * out` (#2318).
+   * out` (#2318), and a `429` rejects as rate limiting with the server's
+   * `Retry-After` instead of a bare `Error POSTing to endpoint` (#2442).
    *
    * `Protocol.request` is the one funnel every SDK verb goes through —
    * `listTools`, `callTool`, `readResource`, the handshake's `initialize`,
@@ -16804,21 +17414,30 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
    * implementation signature serves both at runtime; the single cast on the
    * way back is what the overloads cost.
    */
-  annotateSdkRequestTimeouts(client) {
+  annotateSdkRequestErrors(client) {
     const sdkRequest = client.request.bind(client);
     const decorated = async (...args) => {
       try {
         return await sdkRequest(...args);
       } catch (err) {
-        throw annotateRequestTimeout(
-          err,
-          args[0].method,
-          this.getConnectionDiagnostics()
-        );
+        throw this.annotateRequestError(err, args[0].method);
       }
     };
     client.request = decorated;
   }
+  /**
+   * The one place a failed request's error is decorated, shared by the SDK
+   * funnel above and the raw-wire channel that bypasses it (modern-era tool
+   * calls and task operations), so a caller sees the same error whichever
+   * path its request took: a timeout with the connection's state (#2318), a
+   * `429` named as rate limiting (#2442), anything else untouched.
+   */
+  annotateRequestError(err, method) {
+    return annotateRateLimit(
+      annotateRequestTimeout(err, method, this.getConnectionDiagnostics()),
+      method
+    );
+  }
   /**
    * @param base - the composed OAuth-path fetch, deadline innermost (#2319).
    *
@@ -16862,9 +17481,14 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       },
       trackSendFailure: (message, error) => {
         if (isRequestTimeoutError(error)) return;
+        attachRetryAfter(error, this.rateLimits.take(message.id));
         if (this.outstandingRequests.delete(message.id)) {
           this.dispatchConnectionDiagnosticsChange();
         }
+        this.dispatchTypedEvent("requestFailed", {
+          id: message.id,
+          reason: describeSendFailure(error)
+        });
       },
       trackResponse: (message, origin) => {
         const responseId = message.id;
@@ -16930,6 +17554,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
     };
     baseTransport.onerror = (error) => {
       if (this.status === "connecting") return;
+      if (subscriptionListenRefusal(error) !== void 0) return;
       this.status = "error";
       this.dispatchTypedEvent("statusChange", this.status);
       this.dispatchTypedEvent("error", error);
@@ -17175,6 +17800,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
     this.clearModernReconnectTimer();
     this.modernReconnectAttempts = 0;
     this.modernNeverAcknowledged = false;
+    this.modernListenRefusal = null;
     this.modernSubscription = null;
     this.setModernStreamState(INACTIVE_SUBSCRIPTION_STREAM_STATE);
     this.dispatchSubscriptionsChange();
@@ -17213,6 +17839,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
     this.taskProgress.clear();
     this.lastResponse = void 0;
     this.notificationStream = void 0;
+    this.rateLimits.clear();
     this.dispatchConnectionDiagnosticsChange();
     if (this.malformedListItems.size > 0) {
       this.malformedListItems.clear();
@@ -17315,6 +17942,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
           onFetchRequest: (entry) => {
             this.dispatchFetchRequest({ ...entry, category: "transport" });
             this.noteTransportStream(entry);
+            this.rateLimits.record(entry);
           },
           onFetchResponseBody: (id, body) => {
             this.dispatchFetchRequestBodyUpdate(id, body);
@@ -18031,7 +18659,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
     }
     const wrapped = withInputRequired(resultSchema);
     const signal = requestOptions.signal;
-    let round = 0;
+    let round2 = 0;
     let nextParams = params;
     while (true) {
       const outcome = await client.request(
@@ -18045,8 +18673,8 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       if (!isInputRequiredResult(outcome)) {
         return outcome;
       }
-      round += 1;
-      if (round > _InspectorClient.MRTR_MAX_ROUNDS) {
+      round2 += 1;
+      if (round2 > _InspectorClient.MRTR_MAX_ROUNDS) {
         throw new Error(
           `Multi-round-trip "${method}" exceeded ${_InspectorClient.MRTR_MAX_ROUNDS} input_required rounds without completing.`
         );
@@ -19654,11 +20282,12 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       // for page one.
       ...cursor2 !== void 0 ? { cursor: cursor2 } : {}
     };
+    const resultSchema = this.isModernEra() ? ModernDirectoryReadResultSchema : DirectoryReadResultSchema;
     try {
       return await this.invokeMcpClient(
         () => this.client.request(
           { method: RESOURCES_DIRECTORY_READ_METHOD, params },
-          DirectoryReadResultSchema,
+          resultSchema,
           this.getRequestOptions(this.progressTokenOf(metadata))
         ),
         { method: RESOURCES_DIRECTORY_READ_METHOD }
@@ -20113,6 +20742,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       this.clearModernReconnectTimer();
       this.modernReconnectAttempts = 0;
       this.modernNeverAcknowledged = false;
+      this.modernListenRefusal = null;
     }
     const generation = ++this.modernListenGeneration;
     const previous = this.modernSubscription;
@@ -20131,8 +20761,11 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
         this.getRequestOptions()
       );
     } catch (error) {
-      if (generation === this.modernListenGeneration && isNeverAcknowledgedSubscriptionClose(error)) {
-        this.modernNeverAcknowledged = true;
+      if (generation === this.modernListenGeneration) {
+        if (isNeverAcknowledgedSubscriptionClose(error)) {
+          this.modernNeverAcknowledged = true;
+        }
+        this.modernListenRefusal = subscriptionListenRefusal(error) ?? null;
       }
       throw error;
     }
@@ -20213,6 +20846,10 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
    * its error either way — the retry is about the subscriptions, not the call.
    */
   reconcileModernStreamStateAfterFailedRefresh() {
+    if (this.modernListenRefusal) {
+      this.endModernStreamRefused(this.modernListenRefusal);
+      return;
+    }
     if (!this.wantsModernStream()) {
       this.setModernStreamState(INACTIVE_SUBSCRIPTION_STREAM_STATE);
       return;
@@ -20245,6 +20882,23 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       honoredUris: []
     });
   }
+  /**
+   * Settle the stream on an HTTP refusal of the listen (#2722): the
+   * `"refused"` status carrying the HTTP answer, no reconnect, and a log line
+   * with the sentence the UI shows. Reported whatever `active` says — see
+   * `ResourceSubscriptionStreamState`.
+   */
+  endModernStreamRefused(refusal) {
+    this.clearModernReconnectTimer();
+    const message = subscriptionListenRefusalMessage(refusal);
+    this.logger.warn({ message }, "subscriptions/listen refused over HTTP");
+    this.setModernStreamState({
+      active: this.modernStreamActive(),
+      status: "refused",
+      honoredUris: [],
+      refusal
+    });
+  }
   /**
    * Schedule a reconnect re-listen after the current backoff delay (#1630).
    * `modernReconnectAttempts` reflects the number of *consecutive failed*
@@ -20282,6 +20936,10 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       this.endModernStreamNeverAcknowledged();
       return;
     }
+    if (this.modernListenRefusal && !isTerminalStatus(this.status)) {
+      this.endModernStreamRefused(this.modernListenRefusal);
+      return;
+    }
     this.modernReconnectAttempts += 1;
     if (this.modernReconnectAttempts > MODERN_RECONNECT_MAX_ATTEMPTS || isTerminalStatus(this.status) || !this.wantsModernStream()) {
       this.setModernStreamState({
@@ -20436,8 +21094,11 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
    * Re-read OAuth storage and test whether a challenge is already satisfied.
    * See {@link OAuthManager.checkAuthChallengeSatisfied}.
    */
-  async checkAuthChallengeSatisfied(challenge) {
-    return this.ensureOAuthManager().checkAuthChallengeSatisfied(challenge);
+  async checkAuthChallengeSatisfied(challenge, options) {
+    return this.ensureOAuthManager().checkAuthChallengeSatisfied(
+      challenge,
+      options
+    );
   }
   /**
    * Push recovered OAuth auth state to the remote backend (same MCP session).
@@ -20601,8 +21262,12 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
    * Direct transports reconnect after token exchange so the live MCP session
    * picks up the new Bearer token (mirrors silent recovery reconnect).
    */
-  async completeOAuthFlow(authorizationCode, iss) {
-    await this.ensureOAuthManager().completeOAuthFlow(authorizationCode, iss);
+  async completeOAuthFlow(authorizationCode, iss, state) {
+    await this.ensureOAuthManager().completeOAuthFlow(
+      authorizationCode,
+      iss,
+      state
+    );
     if (this.usesDirectAuthRecovery()) {
       await this.reconnectAfterAuthRecovery();
     }
@@ -20626,7 +21291,11 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
    * Finish OAuth after a full-page redirect and reconnect (or reattach) the MCP session.
    */
   async resumeAfterOAuth(authorizationCode, options) {
-    await this.completeOAuthFlow(authorizationCode, options?.iss);
+    await this.completeOAuthFlow(
+      authorizationCode,
+      options?.iss,
+      options?.state
+    );
     const remoteSessionId = options?.remoteSessionId;
     const transport = this.baseTransport;
     if (remoteSessionId && transport instanceof RemoteClientTransport) {
@@ -21064,6 +21733,16 @@ var MessageLogState = class extends TypedEventTarget {
         return;
       }
     };
+    const onRequestFailed = (event) => {
+      const { id, reason } = event.detail;
+      const requestEntry = this.pendingRequestEntries.get(id);
+      if (!requestEntry) return;
+      this.pendingRequestEntries.delete(id);
+      requestEntry.clientError = reason;
+      requestEntry.duration = Date.now() - requestEntry.timestamp.getTime();
+      this.dispatchTypedEvent("message", requestEntry);
+      this.dispatchTypedEvent("messagesChange", this.getMessages());
+    };
     const onStatusChange = () => {
       if (isTerminalStatus(this.client?.getStatus())) {
         this.messages = [];
@@ -21073,11 +21752,13 @@ var MessageLogState = class extends TypedEventTarget {
     };
     this.client.addEventListener("message", onMessage);
     this.client.addEventListener("responseRejected", onResponseRejected);
+    this.client.addEventListener("requestFailed", onRequestFailed);
     this.client.addEventListener("statusChange", onStatusChange);
     this.unsubscribe = () => {
       if (this.client) {
         this.client.removeEventListener("message", onMessage);
         this.client.removeEventListener("responseRejected", onResponseRejected);
+        this.client.removeEventListener("requestFailed", onRequestFailed);
         this.client.removeEventListener("statusChange", onStatusChange);
       }
       this.client = null;
@@ -21526,6 +22207,192 @@ var ManagedSkillsState = class extends TypedEventTarget {
   }
 };
 
+// ../../core/cli/handlers/load-test.ts
+var DEFAULT_LOAD_CONCURRENCY = 10;
+var DEFAULT_LOAD_DURATION_MS = 1e4;
+function positiveIntegerParser(flag) {
+  return (value) => {
+    const trimmed = value.trim();
+    const n = /^\d+$/.test(trimmed) ? Number(trimmed) : NaN;
+    if (!Number.isSafeInteger(n) || n <= 0) {
+      throw new Error(`${flag} must be a positive integer.`);
+    }
+    return n;
+  };
+}
+function positiveNumberParser(flag) {
+  return (value) => {
+    const n = value.trim() === "" ? NaN : Number(value);
+    if (!Number.isFinite(n) || n <= 0) {
+      throw new Error(`${flag} must be a positive number.`);
+    }
+    return n;
+  };
+}
+function resolveLoadOptions(flags) {
+  const durationMs = flags.durationSec !== void 0 ? flags.durationSec * 1e3 : flags.requests === void 0 ? DEFAULT_LOAD_DURATION_MS : void 0;
+  return {
+    concurrency: flags.concurrency ?? DEFAULT_LOAD_CONCURRENCY,
+    ...durationMs !== void 0 && { durationMs },
+    ...flags.requests !== void 0 && { requests: flags.requests },
+    ...flags.rate !== void 0 && { rate: flags.rate }
+  };
+}
+var MAX_ERROR_KINDS = 10;
+var OTHER_ERRORS = "(other)";
+var realClock = {
+  now: () => performance.now(),
+  sleep: (ms) => new Promise((resolve9) => setTimeout(resolve9, ms))
+};
+function percentile(sorted, p) {
+  const rank = Math.ceil(p / 100 * sorted.length);
+  return sorted[Math.min(Math.max(rank, 1), sorted.length) - 1];
+}
+function round(n, places = 2) {
+  const scale = 10 ** places;
+  return Math.round(n * scale) / scale;
+}
+function summarizeLatency(latencies) {
+  if (latencies.length === 0) return null;
+  const sorted = [...latencies].sort((a, b) => a - b);
+  const total = sorted.reduce((sum, n) => sum + n, 0);
+  return {
+    min: round(sorted[0]),
+    mean: round(total / sorted.length),
+    p50: round(percentile(sorted, 50)),
+    p90: round(percentile(sorted, 90)),
+    p99: round(percentile(sorted, 99)),
+    max: round(sorted[sorted.length - 1])
+  };
+}
+var ErrorTally = class {
+  counts = /* @__PURE__ */ new Map();
+  other = 0;
+  add(message) {
+    const count = this.counts.get(message);
+    if (count !== void 0) this.counts.set(message, count + 1);
+    else if (this.counts.size < MAX_ERROR_KINDS) this.counts.set(message, 1);
+    else this.other++;
+  }
+  entries() {
+    const list = [...this.counts].map(([message, count]) => ({
+      message,
+      count
+    }));
+    list.sort((a, b) => b.count - a.count);
+    if (this.other > 0) list.push({ message: OTHER_ERRORS, count: this.other });
+    return list;
+  }
+};
+async function runLoad(call, options, clock = realClock) {
+  const { concurrency, durationMs, requests, rate } = options;
+  const latencies = [];
+  const tally = new ErrorTally();
+  let ok = 0;
+  let toolErrors = 0;
+  let errors = 0;
+  let started = 0;
+  const start = clock.now();
+  const deadline = durationMs === void 0 ? Infinity : start + durationMs;
+  const interval = rate === void 0 ? 0 : 1e3 / rate;
+  let nextStart = start;
+  let turnstile = Promise.resolve();
+  const claimSlot = async () => {
+    const ahead = turnstile;
+    let release;
+    turnstile = new Promise((resolve9) => release = resolve9);
+    await ahead;
+    try {
+      for (; ; ) {
+        if (requests !== void 0 && started >= requests) return false;
+        const now = clock.now();
+        if (now >= deadline) return false;
+        const scheduled = Math.max(nextStart, now);
+        if (scheduled >= deadline) return false;
+        if (scheduled <= now) {
+          started++;
+          nextStart = now - nextStart < interval ? nextStart + interval : now + interval;
+          return true;
+        }
+        await clock.sleep(scheduled - now);
+      }
+    } finally {
+      release();
+    }
+  };
+  const worker = async () => {
+    while (await claimSlot()) {
+      const t0 = clock.now();
+      try {
+        const outcome = await call();
+        if (outcome === "ok") ok++;
+        else toolErrors++;
+      } catch (err) {
+        errors++;
+        tally.add(err instanceof Error ? err.message : String(err));
+      }
+      latencies.push(clock.now() - t0);
+    }
+  };
+  await Promise.all(Array.from({ length: concurrency }, worker));
+  const elapsedMs = clock.now() - start;
+  const completed = ok + toolErrors + errors;
+  return {
+    concurrency,
+    ...durationMs !== void 0 && { durationMs },
+    ...requests !== void 0 && { requestLimit: requests },
+    ...rate !== void 0 && { rate },
+    requests: completed,
+    ok,
+    toolErrors,
+    errors,
+    // Four places, so a rare failure under heavy load (23 in 41k) still shows.
+    errorRate: completed === 0 ? 0 : round((toolErrors + errors) / completed, 4),
+    elapsedMs: round(elapsedMs),
+    throughput: elapsedMs > 0 ? round(completed * 1e3 / elapsedMs) : 0,
+    latencyMs: summarizeLatency(latencies),
+    errorMessages: tally.entries()
+  };
+}
+async function runToolLoad(inspectorClient, args, options, clock) {
+  if (!args.toolName) {
+    throw new Error("--load requires --tool-name.");
+  }
+  const toolsState = new ManagedToolsState(inspectorClient);
+  let found;
+  try {
+    toolsState.setMetadata(args.metadata);
+    await toolsState.refresh();
+    found = toolsState.getTools().find((t) => t.name === args.toolName);
+  } finally {
+    toolsState.destroy();
+  }
+  if (!found) {
+    throw new CliExitCodeError(
+      EXIT_CODES.TOOL_ERROR,
+      `Tool '${args.toolName}' not found on server.`,
+      { code: "tool_not_found" }
+    );
+  }
+  const tool = found;
+  const useTask = tool.execution?.taskSupport === "required";
+  const call = async () => {
+    const params = [
+      tool,
+      args.toolArg ?? {},
+      args.metadata,
+      args.toolMeta
+    ];
+    const invocation = useTask ? await inspectorClient.callToolStream(...params) : await inspectorClient.callTool(...params);
+    if (invocation.result === null) {
+      throw new Error(invocation.error ?? "Tool call failed");
+    }
+    return invocation.result.isError === true ? "tool_error" : "ok";
+  };
+  const summary = await runLoad(call, options, clock);
+  return { tool: tool.name, ...summary };
+}
+
 // ../../core/mcp/apps.ts
 import { getToolUiResourceUri } from "@modelcontextprotocol/ext-apps/app-bridge";
 function getAppResourceUri(tool) {
@@ -22512,7 +23379,11 @@ async function runRunnerInteractiveOAuth(options) {
         path: options.callbackListen.pathname,
         onCallback: async (params) => {
           try {
-            await options.client.completeOAuthFlow(params.code, params.iss);
+            await options.client.completeOAuthFlow(
+              params.code,
+              params.iss,
+              params.state
+            );
             flowResolve();
           } catch (err) {
             flowReject(toRunnerOAuthError(err));
@@ -22564,7 +23435,10 @@ async function runRunnerInteractiveOAuth(options) {
     }
     if (options.authChallenge) {
       const satisfied = await racingSignals(
-        options.client.checkAuthChallengeSatisfied(options.authChallenge)
+        // The token exchange just completed, so only scope is in question.
+        options.client.checkAuthChallengeSatisfied(options.authChallenge, {
+          scopeOnly: true
+        })
       );
       if (!satisfied) {
         return {
@@ -22590,14 +23464,25 @@ async function runRunnerInteractiveOAuth(options) {
 // ../../core/node/openUrl.ts
 import open from "open";
 var OPEN_URL_TIMEOUT_MS = 5e3;
-function launched(child) {
-  return new Promise((resolve9, reject) => {
-    child.on("error", reject);
-    child.once("spawn", () => resolve9());
+var OPENABLE_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
+function toOpenableHref(href) {
+  let parsed;
+  try {
+    parsed = new URL(href);
+  } catch {
+    throw new Error("refusing to open an invalid URL");
+  }
+  if (!OPENABLE_PROTOCOLS.has(parsed.protocol)) {
+    throw new Error(`refusing to open a non-http(s) URL (${parsed.protocol})`);
+  }
+  return parsed.href;
+}
+function absorbLateErrors(child) {
+  child.on("error", () => {
   });
 }
 async function openUrl(url, timeoutMs = OPEN_URL_TIMEOUT_MS) {
-  const href = typeof url === "string" ? url : url.href;
+  const href = toOpenableHref(typeof url === "string" ? url : url.href);
   let timer;
   const timeout = new Promise((_, reject) => {
     timer = setTimeout(
@@ -22606,8 +23491,7 @@ async function openUrl(url, timeoutMs = OPEN_URL_TIMEOUT_MS) {
     );
   });
   try {
-    const opened = Promise.resolve().then(() => open(href)).then(launched);
-    await Promise.race([opened, timeout]);
+    await Promise.race([open(href).then(absorbLateErrors), timeout]);
   } finally {
     clearTimeout(timer);
   }
@@ -23061,7 +23945,7 @@ var validLogLevels = Object.values(
   LoggingLevelSchema2.enum
 );
 var CLI_CLIENT_NAME = "inspector-cli";
-async function callMethod(serverConfig, serverSettings, args, clientConfig, cliAuthOverrides, callbackUrlConfig, storedAuthOnly, relogin, revoke) {
+async function callMethod(serverConfig, serverSettings, args, clientConfig, cliAuthOverrides, callbackUrlConfig, storedAuthOnly, relogin, revoke, load) {
   if (relogin) {
     if (!("url" in serverConfig && serverConfig.url)) {
       throw new Error(
@@ -23167,6 +24051,22 @@ async function callMethod(serverConfig, serverSettings, args, clientConfig, cliA
       serverSettings,
       { storedAuthOnly, autoOpenControl, quiet: args.quiet }
     );
+    if (load) {
+      const summary = await withCliAuthRecoveryRetry(
+        inspectorClient,
+        serverConfig,
+        redirectUrlProvider,
+        callbackUrlConfig,
+        serverSettings,
+        () => runToolLoad(inspectorClient, args, load),
+        { storedAuthOnly, autoOpenControl, quiet: args.quiet }
+      );
+      await writeFormattedResult(
+        summary,
+        args.format === "json" ? "json" : "text"
+      );
+      return;
+    }
     const outcome = await withCliAuthRecoveryRetry(
       inspectorClient,
       serverConfig,
@@ -23357,6 +24257,7 @@ function buildHandoff(serverUrl, statePath, transport) {
   const host = process.env.HOST || "127.0.0.1";
   const linkHost = isAllInterfacesHost(host) ? "localhost" : canonicalUrlHost(host);
   const clientPort = process.env.CLIENT_PORT || "6274";
+  const scheme = process.env.INSPECTOR_TLS_KEY_PATH?.trim() && process.env.INSPECTOR_TLS_CERT_PATH?.trim() ? "https" : "http";
   const sandboxPort = process.env.MCP_SANDBOX_PORT || "6275";
   const appOriginPort = process.env.MCP_APP_ORIGIN_PORT || "6278";
   const apiToken = process.env.MCP_INSPECTOR_API_TOKEN || void 0;
@@ -23368,7 +24269,7 @@ function buildHandoff(serverUrl, statePath, transport) {
   if (apiToken) params.set("autoConnect", apiToken);
   return {
     serverUrl: normalizedUrl,
-    deepLink: `http://${linkHost}:${clientPort}/?${params.toString()}`,
+    deepLink: `${scheme}://${linkHost}:${clientPort}/?${params.toString()}`,
     portForwardCmd: `coder port-forward <workspace> --tcp ${clientPort}:${clientPort} --tcp ${sandboxPort}:${sandboxPort} --tcp ${appOriginPort}:${appOriginPort}`,
     oauthStatePath: statePath,
     apiToken: apiToken ?? null,
@@ -23528,6 +24429,25 @@ async function parseArgs(argv) {
   ).option(
     "--require-digests",
     'With --verify: exit 9 when a skill advertises no digests (resources: "dynamic"), instead of reporting it as unverifiable and exiting 0.'
+  ).option(
+    "--load",
+    "Load-test one tool: call it repeatedly and concurrently, then print a latency and error-rate summary instead of a result. Use with --method tools/call --tool-name <name>. Bounded by --load-duration (default 10s) and/or --load-requests."
+  ).option(
+    "--load-concurrency <n>",
+    "With --load: most calls in flight at once (positive integer; default 10).",
+    positiveIntegerParser("--load-concurrency")
+  ).option(
+    "--load-duration <sec>",
+    "With --load: stop starting calls after this many seconds; in-flight calls still finish (default 10 when --load-requests is not set).",
+    positiveNumberParser("--load-duration")
+  ).option(
+    "--load-requests <n>",
+    "With --load: stop after starting this many calls (positive integer).",
+    positiveIntegerParser("--load-requests")
+  ).option(
+    "--load-rate <n>",
+    "With --load: start at most this many calls per second, spread evenly (positive number; default unlimited).",
+    positiveNumberParser("--load-rate")
   ).option(
     "--connect-timeout <ms>",
     `Connection timeout in ms (default ${DEFAULT_CONNECT_TIMEOUT_MS} for ad-hoc --server-url / target invocations; 0 = no timeout).`,
@@ -23680,6 +24600,35 @@ async function parseArgs(argv) {
   if (options.skillCatalogMaxBytes !== void 0 && !options.verify) {
     throw new Error("--skill-catalog-max-bytes requires --verify.");
   }
+  const loadBounds = [
+    ["--load-concurrency", options.loadConcurrency],
+    ["--load-duration", options.loadDuration],
+    ["--load-requests", options.loadRequests],
+    ["--load-rate", options.loadRate]
+  ];
+  for (const [flag, value] of loadBounds) {
+    if (value !== void 0 && !options.load) {
+      throw new Error(`${flag} requires --load.`);
+    }
+  }
+  if (options.load) {
+    if (options.method !== "tools/call") {
+      throw new Error("--load requires --method tools/call.");
+    }
+    if (options.appInfo) {
+      throw new Error("--load cannot be combined with --app-info.");
+    }
+    if (options.listStoredAuth || options.printHandoff) {
+      throw new Error(
+        "--load cannot be combined with --list-stored-auth or --print-handoff."
+      );
+    }
+    if (options.output !== void 0 || options.outputFormat !== void 0) {
+      throw new Error(
+        "--load cannot be combined with --output or --output-format; redirect stdout to keep the summary."
+      );
+    }
+  }
   if (options.advertiseApps && (options.listStoredAuth || options.printHandoff || options.method === "servers/list" || options.method === "servers/show" || isCatalogWriteMethod(options.method))) {
     throw new Error(
       "--advertise-apps requires a command that connects to a server; it has no effect with --list-stored-auth, --print-handoff, or a --method servers/* catalog command."
@@ -23902,7 +24851,15 @@ async function parseArgs(argv) {
     relogin: options.relogin === true,
     // Commander's `--no-revoke` defaults this to true; only an explicit
     // `--no-revoke` makes it false.
-    revoke: options.revoke !== false
+    revoke: options.revoke !== false,
+    ...options.load && {
+      load: resolveLoadOptions({
+        concurrency: options.loadConcurrency,
+        durationSec: options.loadDuration,
+        requests: options.loadRequests,
+        rate: options.loadRate
+      })
+    }
   };
 }
 function discardWarning() {
@@ -23929,7 +24886,8 @@ async function runParsedCli(argv) {
     callbackUrl,
     storedAuthOnly,
     relogin,
-    revoke
+    revoke,
+    load
   } = parsed;
   const clientConfig = await loadRunnerClientConfig({ clientConfigPath });
   let callbackUrlConfig;
@@ -23954,7 +24912,8 @@ async function runParsedCli(argv) {
     callbackUrlConfig,
     storedAuthOnly === true,
     relogin === true,
-    revoke !== false
+    revoke !== false,
+    load
   );
 }