@modelcontextprotocol/inspector 2.11.0 → 2.12.0

package/clients/web/build/index.js

@@ -159,6 +159,12 @@ var DirectoryReadResultSchema = z.looseObject({
   resources: z.array(DirectoryChildSchema),
   nextCursor: z.string().optional()
 });
+var ModernDirectoryReadResultSchema = DirectoryReadResultSchema.extend(
+  {
+    ttlMs: z.int().min(0),
+    cacheScope: z.enum(["public", "private"])
+  }
+);
 
 // ../../core/mcp/sha256.ts
 var K = new Uint32Array([
@@ -1061,14 +1067,25 @@ function readInspectorVersionSafe(callerUrl) {
 // ../../core/node/openUrl.ts
 import open from "open";
 var OPEN_URL_TIMEOUT_MS = 5e3;
-function launched(child) {
-  return new Promise((resolve10, reject) => {
-    child.on("error", reject);
-    child.once("spawn", () => resolve10());
+var OPENABLE_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
+function toOpenableHref(href) {
+  let parsed;
+  try {
+    parsed = new URL(href);
+  } catch {
+    throw new Error("refusing to open an invalid URL");
+  }
+  if (!OPENABLE_PROTOCOLS.has(parsed.protocol)) {
+    throw new Error(`refusing to open a non-http(s) URL (${parsed.protocol})`);
+  }
+  return parsed.href;
+}
+function absorbLateErrors(child) {
+  child.on("error", () => {
   });
 }
 async function openUrl(url, timeoutMs = OPEN_URL_TIMEOUT_MS) {
-  const href = typeof url === "string" ? url : url.href;
+  const href = toOpenableHref(typeof url === "string" ? url : url.href);
   let timer;
   const timeout = new Promise((_, reject) => {
     timer = setTimeout(
@@ -1077,8 +1094,7 @@ async function openUrl(url, timeoutMs = OPEN_URL_TIMEOUT_MS) {
     );
   });
   try {
-    const opened = Promise.resolve().then(() => open(href)).then(launched);
-    await Promise.race([opened, timeout]);
+    await Promise.race([open(href).then(absorbLateErrors), timeout]);
   } finally {
     clearTimeout(timer);
   }
@@ -1589,6 +1605,153 @@ function resolveAppOriginPublicOrigin(raw, allowedOrigins, sandboxUrl) {
   return url.origin;
 }
 
+// server/tls.ts
+import { readFileSync as readFileSync4 } from "fs";
+import { createSecureContext } from "tls";
+var TLS_KEY_PATH_ENV = "INSPECTOR_TLS_KEY_PATH";
+var TLS_CERT_PATH_ENV = "INSPECTOR_TLS_CERT_PATH";
+function webScheme(tls) {
+  return tls ? "https" : "http";
+}
+function readPem(env, path6) {
+  try {
+    return readFileSync4(path6, "utf-8");
+  } catch (err) {
+    const { code } = err;
+    throw new Error(
+      `Cannot read ${env}="${path6}" (${code}): check that the file exists and is readable.`,
+      { cause: err }
+    );
+  }
+}
+function resolveTlsConfig(env = process.env) {
+  const keyPath = env[TLS_KEY_PATH_ENV]?.trim();
+  const certPath = env[TLS_CERT_PATH_ENV]?.trim();
+  if (!keyPath && !certPath) return void 0;
+  if (!keyPath || !certPath) {
+    const missing = keyPath ? TLS_CERT_PATH_ENV : TLS_KEY_PATH_ENV;
+    throw new Error(
+      `TLS needs both ${TLS_KEY_PATH_ENV} and ${TLS_CERT_PATH_ENV}; ${missing} is not set. Set both to enable https, or neither for plain http.`
+    );
+  }
+  const key = readPem(TLS_KEY_PATH_ENV, keyPath);
+  const cert = readPem(TLS_CERT_PATH_ENV, certPath);
+  try {
+    if (!key.trim() || !cert.trim()) throw new Error("empty PEM file");
+    createSecureContext({ key, cert });
+  } catch (err) {
+    const reason = err.message;
+    throw new Error(
+      `${TLS_KEY_PATH_ENV}="${keyPath}" and ${TLS_CERT_PATH_ENV}="${certPath}" are not a usable PEM key/certificate pair (${reason}).`,
+      { cause: err }
+    );
+  }
+  return { key, cert };
+}
+
+// server/host-allow-list.ts
+import { isIPv4, isIPv6 as isIPv62 } from "net";
+import { domainToASCII } from "url";
+var ALLOWED_HOSTS_ENV = "MCP_INSPECTOR_ALLOWED_HOSTS";
+var HOSTNAME_RE = /^[a-z0-9._-]+$/;
+function normalizeHostname(hostname) {
+  return hostname.trim().toLowerCase().replace(/\.$/, "");
+}
+function parseHostHeader(value) {
+  const raw = value.trim().toLowerCase();
+  let hostname;
+  let port;
+  if (raw.startsWith("[")) {
+    const end = raw.indexOf("]");
+    if (end < 0) return null;
+    hostname = raw.slice(0, end + 1);
+    if (!isIPv62(hostname.slice(1, -1))) return null;
+    const rest = raw.slice(end + 1);
+    if (rest !== "") {
+      if (!rest.startsWith(":")) return null;
+      port = rest.slice(1);
+    }
+  } else {
+    const colon = raw.indexOf(":");
+    hostname = colon < 0 ? raw : raw.slice(0, colon);
+    port = colon < 0 ? void 0 : raw.slice(colon + 1);
+  }
+  if (port !== void 0) {
+    if (!/^\d{1,5}$/.test(port) || Number(port) > 65535) return null;
+  }
+  if (hostname.startsWith("[")) return hostname;
+  const name = normalizeHostname(hostname);
+  return HOSTNAME_RE.test(name) ? name : null;
+}
+function parseAllowedHostsEnv(value) {
+  if (!value) return [];
+  const out = [];
+  for (const entry of value.split(",")) {
+    const trimmed = entry.trim();
+    if (trimmed === "") continue;
+    const domain = trimmed.startsWith(".") ? "." : "";
+    const ascii = /[\s/:*@]/.test(trimmed) ? "" : domainToASCII(normalizeHostname(trimmed.slice(domain.length)));
+    if (!HOSTNAME_RE.test(ascii)) {
+      console.warn(
+        `Ignoring invalid ${ALLOWED_HOSTS_ENV} entry: ${trimmed} (list bare hostnames, e.g. inspector.example.com or .example.com)`
+      );
+      continue;
+    }
+    out.push(domain + ascii);
+  }
+  return out;
+}
+function configuredAllowedHosts(options) {
+  const hosts = /* @__PURE__ */ new Set();
+  if (!isAllInterfacesHost(options.bindHost)) {
+    hosts.add(normalizeHostname(canonicalUrlHost(options.bindHost)));
+  }
+  for (const origin of options.allowedOrigins) {
+    try {
+      const { hostname } = new URL(origin);
+      if (hostname !== "") hosts.add(normalizeHostname(hostname));
+    } catch {
+    }
+  }
+  for (const extra of options.extraHosts ?? []) {
+    hosts.add(normalizeHostname(extra));
+  }
+  return [...hosts];
+}
+function createHostAllowList(options) {
+  const configured = configuredAllowedHosts(options);
+  return (hostHeader) => {
+    if (hostHeader === void 0) return false;
+    const hostname = parseHostHeader(hostHeader);
+    if (hostname === null) return false;
+    if (hostname.startsWith("[")) return true;
+    if (isIPv4(hostname)) return true;
+    if (hostname === "localhost" || hostname.endsWith(".localhost")) {
+      return true;
+    }
+    for (const allowed of configured) {
+      if (allowed === hostname) return true;
+      if (allowed.startsWith(".") && (allowed.slice(1) === hostname || hostname.endsWith(allowed))) {
+        return true;
+      }
+    }
+    return false;
+  };
+}
+function hostAllowListMiddleware(options) {
+  const isAllowed = createHostAllowList(options);
+  return async (c, next) => {
+    const host = c.req.header("host");
+    if (!isAllowed(host)) {
+      return c.text(
+        `Forbidden: Host "${host ?? ""}" is not allowed. To serve the Inspector under this name, add it to ${ALLOWED_HOSTS_ENV} (or to ALLOWED_ORIGINS).`,
+        403
+      );
+    }
+    await next();
+  };
+}
+
 // server/web-server-config.ts
 var inspectorVersion = readInspectorVersionSafe(import.meta.url);
 function defaultEnvironmentFromProcess(extra) {
@@ -1670,7 +1833,7 @@ function transportDefaults(config) {
 function printServerBanner(config, actualPort, resolvedToken, sandboxUrl, secretStorage) {
   const h = canonicalUrlHost(config.hostname);
   const bannerHost = isAllInterfacesHost(h) ? "localhost" : h;
-  const baseUrl = httpOrigin(bannerHost, actualPort);
+  const baseUrl = webOrigin(webScheme(config.tls), bannerHost, actualPort);
   const url = config.dangerouslyOmitAuth || !resolvedToken ? baseUrl : `${baseUrl}?${API_SERVER_ENV_VARS.AUTH_TOKEN}=${resolvedToken}`;
   console.log(`
 MCP Inspector Web is up and running at:
@@ -1695,6 +1858,9 @@ MCP Inspector Web is up and running at:
   }
   return url;
 }
+function portInUseMessage(config) {
+  return `MCP Inspector PORT IS IN USE at ${webScheme(config.tls)}://${formatHostForUrl(config.hostname)}:${config.port}`;
+}
 function openBrowser(url) {
   openUrl(url).catch((err) => {
     const reason = err instanceof Error ? err.message : String(err);
@@ -1704,29 +1870,30 @@ function openBrowser(url) {
   });
 }
 var LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
-function httpOrigin(host, port) {
-  return port === 80 ? `http://${host}` : `http://${host}:${port}`;
+function webOrigin(scheme, host, port) {
+  const defaultPort = scheme === "https" ? 443 : 80;
+  return port === defaultPort ? `${scheme}://${host}` : `${scheme}://${host}:${port}`;
 }
-function loopbackOrigins(port) {
+function loopbackOrigins(scheme, port) {
   return [
-    httpOrigin("localhost", port),
-    httpOrigin("127.0.0.1", port),
-    httpOrigin("[::1]", port)
+    webOrigin(scheme, "localhost", port),
+    webOrigin(scheme, "127.0.0.1", port),
+    webOrigin(scheme, "[::1]", port)
   ];
 }
-function defaultAllowedOrigins(hostname, port) {
+function defaultAllowedOrigins(hostname, port, scheme = "http") {
   const h = canonicalUrlHost(hostname);
   if (LOOPBACK_HOSTNAMES.has(h)) {
-    return loopbackOrigins(port);
+    return loopbackOrigins(scheme, port);
   }
   if (isAllInterfacesHost(h)) {
     return [
-      ...loopbackOrigins(port),
-      httpOrigin("0.0.0.0", port),
-      httpOrigin("[::]", port)
+      ...loopbackOrigins(scheme, port),
+      webOrigin(scheme, "0.0.0.0", port),
+      webOrigin(scheme, "[::]", port)
     ];
   }
-  return [httpOrigin(h, port)];
+  return [webOrigin(scheme, h, port)];
 }
 function buildWebServerConfig(options = {}) {
   const {
@@ -1743,6 +1910,7 @@ function buildWebServerConfig(options = {}) {
     );
   }
   const hostname = resolveBindHostname();
+  const tls = resolveTlsConfig();
   const dangerouslyOmitAuth = isEnvFlagEnabled(
     process.env.DANGEROUSLY_OMIT_AUTH
   );
@@ -1778,7 +1946,7 @@ function buildWebServerConfig(options = {}) {
       return null;
     }
   }).filter((o) => o !== null);
-  const allowedOrigins = configuredOrigins?.length ? configuredOrigins : defaultAllowedOrigins(hostname, port);
+  const allowedOrigins = configuredOrigins?.length ? configuredOrigins : defaultAllowedOrigins(hostname, port, webScheme(tls));
   const sandboxPublicUrl = resolveSandboxPublicUrl(
     process.env[SANDBOX_FULL_ADDRESS_ENV],
     allowedOrigins
@@ -1799,13 +1967,15 @@ function buildWebServerConfig(options = {}) {
     initialServers,
     storageDir: process.env.MCP_STORAGE_DIR,
     allowedOrigins,
+    allowedHosts: parseAllowedHostsEnv(process.env[ALLOWED_HOSTS_ENV]),
     sandboxPort,
     sandboxHost: hostname,
     appOriginPort,
     sandboxPublicUrl,
     appOriginPublicOrigin,
     logger,
-    autoOpen: resolveAutoOpen()
+    autoOpen: resolveAutoOpen(),
+    ...tls ? { tls } : {}
   };
 }
 function resolveAutoOpen() {
@@ -1823,7 +1993,7 @@ import react from "@vitejs/plugin-react";
 
 // ../../core/mcp/remote/node/server.ts
 import { randomBytes as randomBytes3, timingSafeEqual } from "crypto";
-import { existsSync as existsSync3, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync7 } from "fs";
 import { stat as fsStat } from "fs/promises";
 import { homedir } from "os";
 import { Hono } from "hono";
@@ -2640,11 +2810,95 @@ function createTransportNode(config, options = {}) {
   }
 }
 
+// ../../core/mcp/remote/node/cappedBody.ts
+async function readCappedText(body, maxBytes) {
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let text = "";
+  let bytes = 0;
+  for (; ; ) {
+    const next = await reader.read();
+    if (next.done) return { kind: "complete", text: text + decoder.decode() };
+    bytes += next.value.byteLength;
+    if (bytes > maxBytes) {
+      void reader.cancel().catch(() => {
+      });
+      return { kind: "overflow" };
+    }
+    text += decoder.decode(next.value, { stream: true });
+  }
+}
+function declaresOversizeBody(contentLength, maxBytes) {
+  if (contentLength === null || !/^\s*\d+\s*$/.test(contentLength)) {
+    return false;
+  }
+  return Number(contentLength) > maxBytes;
+}
+
 // ../../core/auth/requestTimeout.ts
 var OAUTH_TIMEOUT_WIRE_CODE = "oauth_request_timeout";
 
+// ../../core/mcp/rateLimit.ts
+import {
+  SdkHttpError
+} from "@modelcontextprotocol/client";
+
+// ../../core/mcp/connectionDiagnostics.ts
+import { SdkError, SdkErrorCode } from "@modelcontextprotocol/client";
+
+// ../../core/mcp/rateLimit.ts
+var HTTP_TOO_MANY_REQUESTS = 429;
+function requestIdsOf(body) {
+  if (body === void 0) return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return [];
+  }
+  const messages = Array.isArray(parsed) ? parsed : [parsed];
+  const ids = [];
+  for (const message of messages) {
+    if (typeof message !== "object" || message === null) continue;
+    if (!("method" in message) || !("id" in message)) continue;
+    const { id } = message;
+    if (typeof id === "string" || typeof id === "number") ids.push(id);
+  }
+  return ids;
+}
+var MAX_UNCLAIMED_RATE_LIMITS = 100;
+var RateLimitLedger = class {
+  // `undefined` is a real value here: a 429 that carried no header.
+  byRequestId = /* @__PURE__ */ new Map();
+  /** File a tracked fetch, if it was a 429. Anything else is ignored. */
+  record(entry) {
+    if (entry.responseStatus !== HTTP_TOO_MANY_REQUESTS) return;
+    const retryAfter = findHeader(entry.responseHeaders, "retry-after");
+    for (const id of requestIdsOf(entry.requestBody)) {
+      this.byRequestId.delete(id);
+      this.byRequestId.set(id, retryAfter);
+      if (this.byRequestId.size > MAX_UNCLAIMED_RATE_LIMITS) {
+        const [oldest] = this.byRequestId.keys();
+        if (oldest !== void 0) this.byRequestId.delete(oldest);
+      }
+    }
+  }
+  /** The `Retry-After` filed for `id`, removed as it is read. */
+  take(id) {
+    const retryAfter = this.byRequestId.get(id);
+    this.byRequestId.delete(id);
+    return retryAfter;
+  }
+  clear() {
+    this.byRequestId.clear();
+  }
+};
+function isRateLimitError(err) {
+  return SdkHttpError.isInstance(err) && err.status === HTTP_TOO_MANY_REQUESTS;
+}
+
 // ../../core/mcp/remote/node/server.ts
-import { SdkHttpError } from "@modelcontextprotocol/client";
+import { SdkHttpError as SdkHttpError2 } from "@modelcontextprotocol/client";
 
 // ../../core/auth/oauth-persist.ts
 import { OAuthTokensSchema } from "@modelcontextprotocol/core";
@@ -3273,7 +3527,7 @@ import * as path4 from "path";
 
 // ../../core/auth/node/file-secret-store.ts
 import * as crypto2 from "crypto";
-import { readFileSync as readFileSync4, statSync as statSync2 } from "fs";
+import { readFileSync as readFileSync5, statSync as statSync2 } from "fs";
 import * as fs3 from "fs/promises";
 import * as path3 from "path";
 var scrypt2 = (passphrase, salt, keylen, options) => new Promise((resolve10, reject) => {
@@ -3326,7 +3580,7 @@ function resolveSecretPassphrase(env = process.env, secretFilePath) {
   }
   let contents;
   try {
-    contents = readFileSync4(resolved2, "utf-8");
+    contents = readFileSync5(resolved2, "utf-8");
   } catch (err) {
     return {
       // `String(err)` rather than `.message`: `readFileSync` only ever throws
@@ -4356,7 +4610,7 @@ async function resolveConcreteSecretStore(store) {
 import { resolve as resolve6 } from "path";
 
 // ../../core/auth/node/oauth-secrets.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { createHmac, randomUUID as randomUUID2 } from "crypto";
 import { OAuthTokensSchema as OAuthTokensSchema2 } from "@modelcontextprotocol/core";
 var PERSIST_TOKENS_ENV = "MCP_INSPECTOR_PERSIST_TOKENS";
 var warnedPolicyValues = /* @__PURE__ */ new Set();
@@ -4389,6 +4643,29 @@ var LEGACY_REGISTRATION_TOKEN_FIELD = "registration-token";
 var PREREG_CLIENT_SECRET_FIELD = "prereg-client-secret";
 var PREREG_REGISTRATION_TOKEN_FIELD = "prereg-registration-token";
 var IDP_SESSION_FIELD = "idp-session";
+var clientCredentialStampField = (field) => `${field}#owner`;
+var credentialMac = (clientId, value) => createHmac("sha256", value).update(clientId).digest("hex");
+function clientCredentialStamp(clientId, value) {
+  return JSON.stringify({
+    client_id: clientId,
+    mac: credentialMac(clientId, value)
+  });
+}
+function stampedOwner(stamp, value) {
+  if (stamp === void 0) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(stamp);
+  } catch {
+    return void 0;
+  }
+  if (typeof parsed !== "object" || parsed === null) return void 0;
+  const { client_id: clientId, mac } = parsed;
+  if (typeof clientId !== "string" || mac !== credentialMac(clientId, value)) {
+    return void 0;
+  }
+  return clientId;
+}
 function applyTokensPolicy(tokens, policy) {
   if (policy === "none") return void 0;
   if (policy === "access" && tokens.refresh_token !== void 0) {
@@ -4417,12 +4694,18 @@ function splitClientInformation(info, fields, secrets) {
   if (client_secret === void 0 && registration_access_token === void 0) {
     return info;
   }
-  if (client_secret !== void 0) {
-    secrets[fields.clientSecret] = client_secret;
-  }
-  if (registration_access_token !== void 0) {
-    secrets[fields.registrationToken] = registration_access_token;
-  }
+  const put = (field, value) => {
+    if (value === void 0) return;
+    secrets[field] = value;
+    if (fields.stamped && typeof info.client_id === "string") {
+      secrets[clientCredentialStampField(field)] = clientCredentialStamp(
+        info.client_id,
+        value
+      );
+    }
+  };
+  put(fields.clientSecret, client_secret);
+  put(fields.registrationToken, registration_access_token);
   return publicInfo;
 }
 function joinClientInformation(info, fields, secrets) {
@@ -4441,15 +4724,18 @@ function joinClientInformation(info, fields, secrets) {
 }
 var issuerClientInfoFields = (issuer) => ({
   clientSecret: issuerClientSecretField(issuer),
-  registrationToken: issuerRegistrationTokenField(issuer)
+  registrationToken: issuerRegistrationTokenField(issuer),
+  stamped: true
 });
 var LEGACY_CLIENT_INFO_FIELDS = {
   clientSecret: LEGACY_CLIENT_SECRET_FIELD,
-  registrationToken: LEGACY_REGISTRATION_TOKEN_FIELD
+  registrationToken: LEGACY_REGISTRATION_TOKEN_FIELD,
+  stamped: true
 };
 var PREREG_CLIENT_INFO_FIELDS = {
   clientSecret: PREREG_CLIENT_SECRET_FIELD,
-  registrationToken: PREREG_REGISTRATION_TOKEN_FIELD
+  registrationToken: PREREG_REGISTRATION_TOKEN_FIELD,
+  stamped: false
 };
 function splitServerOAuthState(state, policy) {
   const secrets = {};
@@ -4599,20 +4885,54 @@ function joinIdpSession(residue, secrets) {
   return stored ? { ...residue, ...stored } : { ...residue };
 }
 function serverSecretFields(state) {
+  const stamped = (field) => [
+    field,
+    clientCredentialStampField(field)
+  ];
   const fields = /* @__PURE__ */ new Set([
     LEGACY_TOKENS_FIELD,
-    LEGACY_CLIENT_SECRET_FIELD,
-    LEGACY_REGISTRATION_TOKEN_FIELD,
+    ...stamped(LEGACY_CLIENT_SECRET_FIELD),
+    ...stamped(LEGACY_REGISTRATION_TOKEN_FIELD),
     PREREG_CLIENT_SECRET_FIELD,
     PREREG_REGISTRATION_TOKEN_FIELD
   ]);
   for (const issuer of Object.keys(state?.byIssuer ?? {})) {
     fields.add(issuerTokensField(issuer));
-    fields.add(issuerClientSecretField(issuer));
-    fields.add(issuerRegistrationTokenField(issuer));
+    for (const field of stamped(issuerClientSecretField(issuer))) {
+      fields.add(field);
+    }
+    for (const field of stamped(issuerRegistrationTokenField(issuer))) {
+      fields.add(field);
+    }
   }
   return [...fields];
 }
+function clientCredentialOwners(state) {
+  const owners = /* @__PURE__ */ new Map();
+  const add = (info, fields) => {
+    if (typeof info?.client_id !== "string") return;
+    owners.set(fields.clientSecret, info.client_id);
+    owners.set(fields.registrationToken, info.client_id);
+  };
+  add(state.clientInformation, LEGACY_CLIENT_INFO_FIELDS);
+  for (const [issuer, slot] of Object.entries(state.byIssuer ?? {})) {
+    add(slot.clientInformation, issuerClientInfoFields(issuer));
+  }
+  return owners;
+}
+function restampClientCredentials(state, secrets) {
+  const out = { ...secrets };
+  for (const [field, clientId] of clientCredentialOwners(state)) {
+    const stampField = clientCredentialStampField(field);
+    const value = Object.hasOwn(out, field) ? out[field] : void 0;
+    if (value === void 0) {
+      delete out[stampField];
+    } else if (stampedOwner(out[stampField], value) === void 0) {
+      setOwnEntry(out, stampField, clientCredentialStamp(clientId, value));
+    }
+  }
+  return out;
+}
 function clientInfoHasPlaintext(info) {
   return info !== void 0 && (info.client_secret !== void 0 || info.registration_access_token !== void 0);
 }
@@ -4653,6 +4973,44 @@ function coveredLocations(location, byLocation) {
     ([recorded]) => recorded === location || location === KEYRING_LOCATION && recorded.startsWith(FILE_LOCATION_PREFIX)
   ).map(([recorded, keys]) => ({ location: recorded, keys }));
 }
+var emptyKeys = () => ({
+  servers: /* @__PURE__ */ new Set(),
+  idpSessions: /* @__PURE__ */ new Set(),
+  owners: /* @__PURE__ */ new Map()
+});
+function candidateFields(location, byLocation) {
+  const fields = /* @__PURE__ */ new Map();
+  for (const { keys } of coveredLocations(location, byLocation)) {
+    for (const [url, owned] of keys.owners) {
+      const kept = fields.get(url) ?? /* @__PURE__ */ new Set();
+      for (const field of owned.keys()) kept.add(field);
+      fields.set(url, kept);
+    }
+  }
+  return fields;
+}
+function addMissingOwners(target, source) {
+  for (const [url, fields] of source) {
+    const kept = target.get(url) ?? /* @__PURE__ */ new Map();
+    for (const [field, clientId] of fields) {
+      if (!kept.has(field)) kept.set(field, clientId);
+    }
+    if (kept.size > 0) target.set(url, kept);
+  }
+}
+function mergeOwners(target, source) {
+  let changed = false;
+  for (const [url, fields] of source) {
+    const kept = target.get(url) ?? /* @__PURE__ */ new Map();
+    for (const [field, clientId] of fields) {
+      if (kept.get(field) === clientId) continue;
+      kept.set(field, clientId);
+      changed = true;
+    }
+    if (kept.size > 0) target.set(url, kept);
+  }
+  return changed;
+}
 var warnedLedgerFailures = /* @__PURE__ */ new Set();
 function warnLedgerFailure(what, error) {
   const reason = error instanceof Error ? error.message : String(error);
@@ -4666,6 +5024,19 @@ function warnLedgerFailure(what, error) {
 function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function parseOwners(value) {
+  const owners = /* @__PURE__ */ new Map();
+  if (!isRecord3(value)) return owners;
+  for (const [url, fields] of Object.entries(value)) {
+    if (!isRecord3(fields)) continue;
+    const byField = /* @__PURE__ */ new Map();
+    for (const [field, clientId] of Object.entries(fields)) {
+      if (typeof clientId === "string") byField.set(field, clientId);
+    }
+    if (byField.size > 0) owners.set(url, byField);
+  }
+  return owners;
+}
 function stringsOf(value) {
   return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
@@ -4687,7 +5058,9 @@ function parseLedger(raw) {
       if (!isRecord3(keys)) continue;
       byLocation.set(location, {
         servers: new Set(stringsOf(keys.servers)),
-        idpSessions: new Set(stringsOf(keys.idpSessions))
+        idpSessions: new Set(stringsOf(keys.idpSessions)),
+        owners: parseOwners(keys.owners),
+        ...isValidSecretsNamespace(keys.owedTo) && { owedTo: keys.owedTo }
       });
     }
     if (byLocation.size > 0) ledger.set(namespace, byLocation);
@@ -4701,7 +5074,19 @@ function serializeLedger(ledger) {
       Object.fromEntries(
         [...byLocation].map(([location, keys]) => [
           location,
-          { servers: [...keys.servers], idpSessions: [...keys.idpSessions] }
+          {
+            servers: [...keys.servers],
+            idpSessions: [...keys.idpSessions],
+            ...keys.owners.size > 0 && {
+              owners: Object.fromEntries(
+                [...keys.owners].map(([url, fields]) => [
+                  url,
+                  Object.fromEntries(fields)
+                ])
+              )
+            },
+            ...keys.owedTo !== void 0 && { owedTo: keys.owedTo }
+          }
         ])
       )
     ])
@@ -4713,7 +5098,7 @@ async function writeLedger(stateFilePath, ledger) {
   if (ledger.size === 0) await deleteStoreFile(path6);
   else await writeStoreFile(path6, serializeLedger(ledger));
 }
-async function recordNamespaceKeys(stateFilePath, secretStore, namespace, servers, idpSessions) {
+async function recordNamespaceKeys(stateFilePath, secretStore, namespace, servers, idpSessions, owners = /* @__PURE__ */ new Map()) {
   try {
     const ledger = parseLedger(
       await readStoreFile(namespaceLedgerPath(stateFilePath))
@@ -4727,7 +5112,7 @@ async function recordNamespaceKeys(stateFilePath, secretStore, namespace, server
     let keys = byLocation.get(location);
     let changed = false;
     if (!keys) {
-      keys = { servers: /* @__PURE__ */ new Set(), idpSessions: /* @__PURE__ */ new Set() };
+      keys = emptyKeys();
       byLocation.set(location, keys);
       changed = true;
     }
@@ -4741,11 +5126,93 @@ async function recordNamespaceKeys(stateFilePath, secretStore, namespace, server
       keys.idpSessions.add(issuer);
       changed = true;
     }
+    if (mergeOwners(keys.owners, owners)) changed = true;
     if (changed) await writeLedger(stateFilePath, ledger);
   } catch (error) {
     warnLedgerFailure("update", error);
   }
 }
+async function markUncarriedNamespaces(stateFilePath, secretStore, into) {
+  const ledger = parseLedger(
+    await readStoreFile(namespaceLedgerPath(stateFilePath))
+  );
+  const location = await secretStoreLocation(secretStore);
+  let changed = false;
+  for (const [namespace, byLocation] of ledger) {
+    if (namespace === into) continue;
+    for (const [recorded, keys] of byLocation) {
+      if (recorded === location || keys.owners.size === 0) continue;
+      if (keys.owedTo === into) continue;
+      keys.owedTo = into;
+      changed = true;
+    }
+  }
+  if (changed) await writeLedger(stateFilePath, ledger);
+}
+async function pendingCarries(stateFilePath, secretStore, current) {
+  const ledger = parseLedger(
+    await readStoreFile(namespaceLedgerPath(stateFilePath))
+  );
+  const location = await secretStoreLocation(secretStore);
+  const carries = [];
+  for (const [namespace, byLocation] of ledger) {
+    const owed = coveredLocations(location, byLocation).some(
+      ({ keys }) => keys.owedTo === current
+    );
+    if (owed) {
+      carries.push({
+        namespace,
+        fields: candidateFields(location, byLocation)
+      });
+    }
+  }
+  return carries.reverse();
+}
+async function carryOwed(stateFilePath, ledger, location, secretStore, namespace, current, recorded, now) {
+  let carried = true;
+  for (const [url, fields] of recorded) {
+    for (const field of fields) {
+      const clientId = now.get(url)?.get(field);
+      if (clientId === void 0) continue;
+      try {
+        const from = oauthSecretServerId(url, namespace);
+        const to = oauthSecretServerId(url, current);
+        const stampField = clientCredentialStampField(field);
+        const value = await secretStoreGetStrict(secretStore, from, field);
+        if (value === null) continue;
+        const stamp = await secretStoreGetStrict(secretStore, from, stampField);
+        if (stamp === null || stampedOwner(stamp, value) !== clientId) {
+          continue;
+        }
+        if (await secretStoreGetStrict(secretStore, to, field) !== null) {
+          continue;
+        }
+        let byLocation = ledger.get(current);
+        if (!byLocation) {
+          byLocation = /* @__PURE__ */ new Map();
+          ledger.set(current, byLocation);
+        }
+        const target = byLocation.get(location) ?? emptyKeys();
+        byLocation.set(location, target);
+        const isNew = !target.servers.has(url);
+        target.servers.add(url);
+        const owner = /* @__PURE__ */ new Map([[url, /* @__PURE__ */ new Map([[field, clientId]])]]);
+        if (mergeOwners(target.owners, owner) || isNew) {
+          await writeLedger(stateFilePath, ledger);
+        }
+        await secretStore.set(to, stampField, stamp);
+        await secretStore.set(to, field, value);
+      } catch (error) {
+        carried = false;
+        warnLedgerFailure(
+          "carry over a superseded namespace recorded in",
+          error
+        );
+      }
+    }
+  }
+  return carried;
+}
 async function recordedNamespaces(stateFilePath) {
   try {
     const ledger = parseLedger(
@@ -4757,7 +5224,7 @@ async function recordedNamespaces(stateFilePath) {
     return [];
   }
 }
-async function purgeSupersededNamespaces(stateFilePath, secretStore, current) {
+async function purgeSupersededNamespaces(stateFilePath, secretStore, current, owners = /* @__PURE__ */ new Map()) {
   let ledger;
   let location;
   try {
@@ -4770,8 +5237,22 @@ async function purgeSupersededNamespaces(stateFilePath, secretStore, current) {
     return;
   }
   let changed = false;
-  for (const [namespace, byLocation] of ledger) {
+  for (const [namespace, byLocation] of [...ledger].reverse()) {
     if (namespace === current) continue;
+    if (current !== void 0 && coveredLocations(location, byLocation).some(
+      ({ keys }) => keys.owedTo === current
+    ) && !await carryOwed(
+      stateFilePath,
+      ledger,
+      location,
+      secretStore,
+      namespace,
+      current,
+      candidateFields(location, byLocation),
+      owners
+    )) {
+      break;
+    }
     for (const { location: recorded, keys } of coveredLocations(
       location,
       byLocation
@@ -4796,12 +5277,11 @@ async function purgeSupersededNamespaces(stateFilePath, secretStore, current) {
       if (!purged || recorded !== location) continue;
       byLocation.delete(recorded);
       if (recorded.startsWith(FILE_LOCATION_PREFIX)) {
-        const keyring = byLocation.get(KEYRING_LOCATION) ?? {
-          servers: /* @__PURE__ */ new Set(),
-          idpSessions: /* @__PURE__ */ new Set()
-        };
+        const keyring = byLocation.get(KEYRING_LOCATION) ?? emptyKeys();
+        addMissingOwners(keyring.owners, keys.owners);
         for (const url of keys.servers) keyring.servers.add(url);
         for (const issuer of keys.idpSessions) keyring.idpSessions.add(issuer);
+        keyring.owedTo ??= keys.owedTo;
         byLocation.set(KEYRING_LOCATION, keyring);
       }
       changed = true;
@@ -4912,7 +5392,12 @@ async function adoptSecretsNamespace(filePath, secretStore, locked) {
   const existing = parseSecretsNamespace(raw);
   if (existing !== void 0) {
     if (locked) {
-      await purgeSupersededNamespaces(filePath, secretStore, existing);
+      await purgeSupersededNamespaces(
+        filePath,
+        secretStore,
+        existing,
+        snapshotClientOwners(parseOAuthPersistBlob(raw))
+      );
     }
     return existing;
   }
@@ -4932,25 +5417,33 @@ async function adoptSecretsNamespace(filePath, secretStore, locked) {
       `Could not save OAuth state: ${filePath} predates per-state-file secret namespaces, and migrating its secret-store entries needs the file lock, which is unavailable here (see the lock warning above). Migrating without it could lose credentials if two processes migrate at once. Nothing was changed; make the lock directory writable and retry \u2014 or, if you cannot, clear this file's stored OAuth state and re-authorize (clearing does not migrate, and the fresh state file mints its namespace without the lock).`
     );
   }
+  const values = await readEntrySecrets(
+    snapshot,
+    secretStore,
+    void 0,
+    await recordedNamespaces(filePath)
+  );
+  const owners = snapshotClientOwners(snapshot);
   await recordNamespaceKeys(
     filePath,
     secretStore,
     namespace,
     Object.keys(snapshot.servers),
-    Object.keys(snapshot.idpSessions)
+    Object.keys(snapshot.idpSessions),
+    writtenClientOwners(snapshot, (url) => values.servers.get(url) ?? {})
   );
+  await markUncarriedNamespaces(filePath, secretStore, namespace);
   const touched = [];
   try {
-    const values = await readEntrySecrets(
-      snapshot,
-      secretStore,
-      void 0,
-      await recordedNamespaces(filePath)
-    );
     const copies = [
+      // Restamped: a value read from the legacy ids predates stamps, and a
+      // fallback's stamp may belong to a value read from elsewhere (#2734).
       ...[...values.servers].map(([url, secrets]) => ({
         scopedId: oauthSecretServerId(url, namespace),
-        secrets
+        secrets: restampClientCredentials(
+          getOwnEntry(snapshot.servers, url) ?? {},
+          secrets
+        )
       })),
       ...[...values.idpSessions].map(([issuer, secrets]) => ({
         scopedId: oauthIdpSecretServerId(issuer, namespace),
@@ -4968,7 +5461,7 @@ async function adoptSecretsNamespace(filePath, secretStore, locked) {
     await restoreSecretFields(secretStore, touched, warnRestoreFailure);
     throw error;
   }
-  await purgeSupersededNamespaces(filePath, secretStore, namespace);
+  await purgeSupersededNamespaces(filePath, secretStore, namespace, owners);
   const legacyIds = [
     ...Object.keys(snapshot.servers).map((url) => oauthSecretServerId(url)),
     ...Object.keys(snapshot.idpSessions).map(
@@ -5145,7 +5638,22 @@ async function writeOAuthSectionsFrom(filePath, resolveSnapshot, sections, secre
           secretStore,
           namespace,
           Object.keys(merged.servers),
-          Object.keys(merged.idpSessions)
+          Object.keys(merged.idpSessions),
+          // Only the entries this save writes: another entry's secret in
+          // this store was written for whatever client it was written for,
+          // and relabeling it from the file would misattribute it (#2672).
+          writtenClientOwners(
+            {
+              servers: Object.fromEntries(
+                (effective.servers ?? []).flatMap((url) => {
+                  const entry = getOwnEntry(merged.servers, url);
+                  return entry === void 0 ? [] : [[url, entry]];
+                })
+              ),
+              idpSessions: {}
+            },
+            splitSecretsOf
+          )
         );
         for (const url of effective.servers ?? []) {
           const serverId = oauthSecretServerId(url, namespace);
@@ -5333,7 +5841,29 @@ function fillMissingSecrets(target, source) {
     if (!Object.hasOwn(target, field)) setOwnEntry(target, field, value);
   }
 }
-async function readEntrySecrets(snapshot, secretStore, namespace, fallbacks) {
+function writtenClientOwners(snapshot, secretsOf) {
+  const owners = /* @__PURE__ */ new Map();
+  for (const [url, state] of Object.entries(snapshot.servers)) {
+    const secrets = secretsOf(url, state);
+    const fields = new Map(
+      [...clientCredentialOwners(state)].filter(
+        ([field]) => Object.hasOwn(secrets, field)
+      )
+    );
+    if (fields.size > 0) owners.set(url, fields);
+  }
+  return owners;
+}
+var splitSecretsOf = (_url, state) => splitServerOAuthState(state, "all").secrets;
+function snapshotClientOwners(snapshot) {
+  const owners = /* @__PURE__ */ new Map();
+  for (const [url, state] of Object.entries(snapshot?.servers ?? {})) {
+    const fields = clientCredentialOwners(state);
+    if (fields.size > 0) owners.set(url, fields);
+  }
+  return owners;
+}
+async function readEntrySecrets(snapshot, secretStore, namespace, fallbacks, carries = []) {
   const servers = /* @__PURE__ */ new Map();
   const idpSessions = /* @__PURE__ */ new Map();
   for (const url of Object.keys(snapshot.servers)) servers.set(url, {});
@@ -5354,14 +5884,49 @@ async function readEntrySecrets(snapshot, secretStore, namespace, fallbacks) {
       );
     }
   }
+  const owners = snapshotClientOwners(snapshot);
+  for (const { namespace: from, fields: recorded } of carries) {
+    const requests = [];
+    for (const [url, fields] of recorded) {
+      const target = servers.get(url);
+      if (!target) continue;
+      const wanted = [...fields].filter(
+        (field) => owners.get(url)?.has(field) === true && !Object.hasOwn(target, field)
+      );
+      if (wanted.length > 0) {
+        requests.push({
+          serverId: oauthSecretServerId(url, from),
+          fields: wanted.flatMap((field) => [
+            field,
+            clientCredentialStampField(field)
+          ])
+        });
+      }
+    }
+    if (requests.length === 0) continue;
+    const values = await secretStoreGetManyStrict(secretStore, requests);
+    for (const [url, target] of servers) {
+      const found = values[oauthSecretServerId(url, from)] ?? {};
+      for (const [field, clientId] of owners.get(url) ?? []) {
+        const value = Object.hasOwn(found, field) ? found[field] : void 0;
+        const stampField = clientCredentialStampField(field);
+        if (value === void 0 || Object.hasOwn(target, field) || stampedOwner(found[stampField], value) !== clientId) {
+          continue;
+        }
+        setOwnEntry(target, field, value);
+        setOwnEntry(target, stampField, found[stampField]);
+      }
+    }
+  }
   return { servers, idpSessions };
 }
-async function joinSnapshot(snapshot, secretStore, namespace, fallbacks) {
+async function joinSnapshot(snapshot, secretStore, namespace, fallbacks, carries = []) {
   const values = await readEntrySecrets(
     snapshot,
     secretStore,
     namespace,
-    fallbacks
+    fallbacks,
+    carries
   );
   return {
     servers: Object.fromEntries(
@@ -5389,7 +5954,8 @@ async function migratePlaintextSecrets(filePath, secretStore) {
       secretStore,
       namespace,
       Object.keys(fresh.servers),
-      Object.keys(fresh.idpSessions)
+      Object.keys(fresh.idpSessions),
+      writtenClientOwners(fresh, splitSecretsOf)
     );
   }
   const migrateEntrySecrets = async (serverId, secrets) => {
@@ -5442,7 +6008,8 @@ async function readOAuthStore(filePath, secretStore = defaultSecretStore()) {
     }
     const namespace = parseSecretsNamespace(raw);
     const fallbacks = namespace === void 0 ? await recordedNamespaces(filePath) : [];
-    return joinSnapshot(snapshot, secretStore, namespace, fallbacks);
+    const carries = namespace === void 0 ? [] : await pendingCarries(filePath, secretStore, namespace);
+    return joinSnapshot(snapshot, secretStore, namespace, fallbacks, carries);
   });
 }
 async function removeOAuthStore(filePath, secretStore = defaultSecretStore()) {
@@ -5682,6 +6249,8 @@ var RemoteSession = class _RemoteSession {
   requestWaits = /* @__PURE__ */ new Map();
   authProviderHandle = null;
   appliedProtocolVersion;
+  /** Each upstream `429`'s `Retry-After`, by the JSON-RPC id that drew it (#2442). */
+  rateLimits = new RateLimitLedger();
   /** A protocol version is a dated token (`2025-11-25`, `2026-07-28`, …). */
   static PROTOCOL_VERSION_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
   constructor(sessionId) {
@@ -5893,6 +6462,7 @@ var RemoteSession = class _RemoteSession {
     this.pushEvent({ type: "message", data: message });
   }
   onFetchRequest(entry) {
+    this.rateLimits.record(entry);
     this.pushEvent({
       type: "fetch_request",
       data: {
@@ -5901,6 +6471,14 @@ var RemoteSession = class _RemoteSession {
       }
     });
   }
+  /**
+   * The `Retry-After` of the upstream `429` that answered request `id` — read
+   * by the send route, so the header rides back on the send's own error rather
+   * than on a fetch event racing it (#2442).
+   */
+  takeRetryAfter(id) {
+    return this.rateLimits.take(id);
+  }
   onFetchResponseBody(id, responseBody) {
     this.pushEvent({
       type: "fetch_request_body_update",
@@ -6344,6 +6922,17 @@ var MAX_APP_DOCUMENT_CHARS = 8 * 1024 * 1024;
 var MAX_APP_DOCUMENT_BODY_BYTES = 24 * 1024 * 1024;
 var MAX_APP_CSP_CHARS = 8 * 1024;
 var MAX_STORAGE_BODY_BYTES = 4 * 1024 * 1024;
+var MAX_PROXIED_RESPONSE_BYTES = 4 * 1024 * 1024;
+var BODY_FRAMING_HEADERS = /* @__PURE__ */ new Set([
+  "content-length",
+  "transfer-encoding",
+  "content-encoding"
+]);
+function withoutBodyFraming(headers) {
+  return Object.fromEntries(
+    Object.entries(headers).filter(([k]) => !BODY_FRAMING_HEADERS.has(k))
+  );
+}
 function isHeaderSafeValue(value) {
   return !/[^\t\x20-\x7e]/.test(value);
 }
@@ -6799,8 +7388,10 @@ function createRemoteApp(options) {
         });
       }
       const msg = err instanceof Error ? err.message : String(err);
-      if (err instanceof SdkHttpError) {
+      if (err instanceof SdkHttpError2) {
         const text = err.data.text;
+        const sentId = "id" in message ? message.id : void 0;
+        const retryAfter = isRateLimitError(err) && (typeof sentId === "string" || typeof sentId === "number") ? session.takeRetryAfter(sentId) : void 0;
         return c.json({
           ok: false,
           kind: "transport_error",
@@ -6811,7 +7402,8 @@ function createRemoteApp(options) {
             ...err.statusText !== void 0 && {
               statusText: err.statusText
             },
-            ...typeof text === "string" && { text }
+            ...typeof text === "string" && { text },
+            ...retryAfter !== void 0 && { retryAfter }
           }
         });
       }
@@ -6944,7 +7536,28 @@ function createRemoteApp(options) {
       const isStream = contentType?.includes("text/event-stream") || contentType?.includes("application/x-ndjson");
       let resBody;
       if (!isStream && res.body) {
-        resBody = await res.text();
+        const refuseOversize = () => res.ok ? c.json(
+          {
+            error: `response from ${safeUrl} exceeds the ${MAX_PROXIED_RESPONSE_BYTES}-byte limit for a proxied response`
+          },
+          502
+        ) : c.json({
+          ok: res.ok,
+          status: res.status,
+          statusText: res.statusText,
+          headers: withoutBodyFraming(resHeaders)
+        });
+        if (declaresOversizeBody(
+          res.headers.get("content-length"),
+          MAX_PROXIED_RESPONSE_BYTES
+        )) {
+          void res.body.cancel().catch(() => {
+          });
+          return refuseOversize();
+        }
+        const read = await readCappedText(res.body, MAX_PROXIED_RESPONSE_BYTES);
+        if (read.kind === "overflow") return refuseOversize();
+        resBody = read.text;
       } else if (isStream) {
         void res.body?.cancel().catch(() => {
         });
@@ -7757,7 +8370,7 @@ function createRemoteApp(options) {
       type,
       process.platform,
       homedir(),
-      (path6) => existsSync3(path6) ? readFileSync6(path6, "utf-8") : null
+      (path6) => existsSync3(path6) ? readFileSync7(path6, "utf-8") : null
     );
     if (!result) {
       return c.json(
@@ -8173,6 +8786,30 @@ function handleNodeHealthRequest(req, res) {
   return true;
 }
 
+// server/node-request-bridge.ts
+function fetchUrlForNodeRequest(headers, pathname, scheme) {
+  const authority = headers.host ?? headers[":authority"];
+  return `${scheme}://${authority}${pathname}`;
+}
+function fetchHeadersFromNode(headers) {
+  const out = new Headers();
+  for (const [key, value] of Object.entries(headers)) {
+    if (!value || key.startsWith(":")) continue;
+    out.set(key, Array.isArray(value) ? value.join(", ") : value);
+  }
+  return out;
+}
+var CONNECTION_SPECIFIC_HEADERS = /* @__PURE__ */ new Set([
+  "connection",
+  "keep-alive",
+  "proxy-connection",
+  "transfer-encoding",
+  "upgrade"
+]);
+function isResponseHeaderAllowed(name, httpVersionMajor) {
+  return httpVersionMajor < 2 || !CONNECTION_SPECIFIC_HEADERS.has(name.toLowerCase());
+}
+
 // server/vite-hono-plugin.ts
 function honoMiddlewarePlugin(config) {
   let resolvedAuthToken = "";
@@ -8280,18 +8917,12 @@ function honoMiddlewarePlugin(config) {
           if (!pathname.startsWith("/api")) {
             return next();
           }
-          const url = `http://${req.headers.host}${pathname}`;
-          const headers = new Headers();
-          Object.entries(req.headers).forEach(
-            ([key, value]) => {
-              if (value) {
-                headers.set(
-                  key,
-                  Array.isArray(value) ? value.join(", ") : value
-                );
-              }
-            }
+          const url = fetchUrlForNodeRequest(
+            req.headers,
+            pathname,
+            webScheme(config.tls)
           );
+          const headers = fetchHeadersFromNode(req.headers);
           const init = { method: req.method, headers };
           if (req.method !== "GET" && req.method !== "HEAD") {
             const chunks = [];
@@ -8308,13 +8939,17 @@ function honoMiddlewarePlugin(config) {
           const response = await honoApp.fetch(new Request(url, init));
           res.statusCode = response.status;
           response.headers.forEach((value, key) => {
-            res.setHeader(key, value);
+            if (isResponseHeaderAllowed(key, req.httpVersionMajor)) {
+              res.setHeader(key, value);
+            }
           });
           const isSSE = response.headers.get("content-type")?.includes("text/event-stream");
           if (isSSE) {
             res.setHeader("X-Accel-Buffering", "no");
             res.setHeader("Cache-Control", "no-cache");
-            res.setHeader("Connection", "keep-alive");
+            if (isResponseHeaderAllowed("connection", req.httpVersionMajor)) {
+              res.setHeader("Connection", "keep-alive");
+            }
           }
           if (response.body) {
             res.flushHeaders?.();
@@ -8667,6 +9302,10 @@ async function startViteDevServer(config) {
       // `config.port`, so a drifted bind would 403 every connect and CSP-block
       // the MCP Apps iframe while the banner advertises the unusable port.
       strictPort: true,
+      // The same TLS pair the prod listener uses (#2446), matching
+      // `vite.config.ts`. Vite serves it over HTTP/2 with an HTTP/1.1
+      // fallback; the Hono plugin's /api bridge handles both.
+      https: config.tls,
       // Allow Vite to serve source files from the repo root (core/ lives
       // outside clients/web), matching `vite.config.ts`'s `server.fs.allow`.
       fs: {
@@ -8685,10 +9324,11 @@ async function startViteDevServer(config) {
 }
 
 // server/server.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync8 } from "fs";
 import { join as join8, dirname as dirname8 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import { randomBytes as randomBytes4 } from "crypto";
+import { createServer as createHttpsServer } from "https";
 import { serve } from "@hono/node-server";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono as Hono2 } from "hono";
@@ -8735,12 +9375,20 @@ async function startHonoServer(config) {
   });
   const app = new Hono2();
   app.get(HEALTH_PATH, (c) => healthResponse(c.req.method));
+  app.use(
+    "*",
+    hostAllowListMiddleware({
+      bindHost: config.hostname,
+      allowedOrigins: config.allowedOrigins,
+      extraHosts: config.allowedHosts
+    })
+  );
   app.use("/api/*", async (c) => {
     return apiApp.fetch(c.req.raw);
   });
   const serveIndexHtml = (c) => {
     const indexPath = join8(rootPath, "index.html");
-    const html = readFileSync7(indexPath, "utf-8");
+    const html = readFileSync8(indexPath, "utf-8");
     c.header("Cache-Control", "no-store");
     return c.html(injectAuthToken(html, resolvedAuthToken));
   };
@@ -8768,7 +9416,10 @@ async function startHonoServer(config) {
     {
       fetch: app.fetch,
       port: config.port,
-      hostname: config.hostname
+      hostname: config.hostname,
+      // https only when both TLS paths were set (#2446); otherwise
+      // @hono/node-server's default plain `http.createServer`.
+      ...config.tls ? { createServer: createHttpsServer, serverOptions: config.tls } : {}
     },
     (info) => {
       const sandboxUrl = sandboxController.getUrl();
@@ -8786,9 +9437,7 @@ async function startHonoServer(config) {
   );
   httpServer.on("error", (err) => {
     if (err.message.includes("EADDRINUSE")) {
-      console.error(
-        `MCP Inspector PORT IS IN USE at http://${formatHostForUrl(config.hostname)}:${config.port}`
-      );
+      console.error(portInUseMessage(config));
       process.exit(1);
     } else {
       throw err;