@modelcontextprotocol/inspector 2.14.0 → 2.15.0

package/clients/mcpdo/build/mcp-bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $ as withDefaultCatalogPath, A as resolveLoadOptions, B as assertSocketPathWithinLimit, C as clearAllOAuthClientState, D as loadSummaryWarnings, E as LOAD_FLAG_CONFLICT, F as generateDaemonToken, G as getDaemonSocketPath, H as ensureDaemonDir, I as getDaemonTokenFromEnv, J as loadServerEntries, K as readInspectorVersion, L as readDaemonTokenFile, M as sanitizeDeep, N as sanitizeText, O as positiveIntegerParser, P as encodeRequest, Q as resolveServerSource, R as DAEMON_DIR_ENV, S as NodeOAuthStorage, T as resetNodeOAuthStorageCache, U as getDaemonDir, V as createPrivateDaemonDir, W as getDaemonLogPath, X as parseHeaderPair, Y as selectServerEntry, Z as parseKeyValuePair, _ as isCliAutoOpenForced, _t as awaitableError, a as obtainPendingUrlForKey, at as readOAuthStore, b as DEFAULT_CONNECT_TIMEOUT_MS, c as runAuthHelper, ct as setSecretStorageWarningsQuiet, d as emaLogin, dt as CallbackNavigation, et as DEFAULT_MAX_FETCH_REQUESTS, f as emaLogout, ft as clearEmaIdpSession, g as runEmaIdpInteractiveFlow, gt as parseIdpOAuthStorageKey, h as requireIdp, ht as normalizeIdpIssuer, i as obtainPendingAuthUrl, it as handleError, j as isSafeLinkTarget, k as positiveNumberParser, l as writePendingAuthMarker, lt as warnAboutSecretStorage, m as loadEmaIdpConfig, mt as idpOAuthStorageKey, n as AUTH_HELPER_COMMAND, nt as CliExitCodeError, o as pendingAuthMarkerPath, ot as disallowMemorySecretStoreFallback, p as getEmaStatus, pt as getEmaIdpLoginState, q as readInspectorVersionSafe, r as PENDING_AUTH_TTL_MS, rt as EXIT_CODES, s as removeOwnPendingAuthMarker, st as getSecretStorageInfo, tt as DEFAULT_TASK_TTL_MS, u as authorizeInFrontend, ut as InMemorySecretStore, v as PLAIN, vt as awaitableLog, w as getStateFilePath, x as withConnectTimeout, y as styleFromOpts, z as DAEMON_TOKEN_ENV } from "./server-Dv339Ejx.js";
+import { $ as getDaemonTokenFromEnv, A as resolveLoadOptions, At as CallbackNavigation, B as LOAD_SCENARIO_INVALID, C as clearAllOAuthClientState, Ct as EXIT_CODES, D as LOAD_FLAG_CONFLICT, Dt as setSecretStorageWarningsQuiet, E as MAX_REQUEST_LINE_BYTES, Et as getSecretStorageInfo, F as maxP99Parser, Ft as parseIdpOAuthStorageKey, G as loadArgsError, H as parseLoadScenario, I as minThroughputParser, It as decodeJwtPayload, J as sanitizeDeep, K as parseLoadArgsRows, L as resolveLoadThresholds, Lt as awaitableError, M as fractionParser, Mt as getEmaIdpLoginState, N as maxP50Parser, Nt as idpOAuthStorageKey, O as formatLoadProgress, Ot as warnAboutSecretStorage, P as maxP95Parser, Pt as normalizeIdpIssuer, Q as generateDaemonToken, R as positiveIntegerParser, Rt as awaitableLog, S as NodeOAuthStorage, St as CliExitCodeError, T as resetNodeOAuthStorageCache, Tt as disallowMemorySecretStoreFallback, U as LOAD_ARGS_INVALID, V as loadScenarioError, W as assertLoadArgsTemplate, X as encodeRequest, Y as sanitizeText, Z as generateDaemonNonce, _ as isCliAutoOpenForced, _t as resolveServerSource, a as obtainPendingUrlForKey, at as createPrivateDaemonDir, b as DEFAULT_CONNECT_TIMEOUT_MS, bt as DEFAULT_TASK_TTL_MS, c as runAuthHelper, ct as getDaemonLogPath, d as emaLogin, dt as readInspectorVersion, et as readDaemonTokenFile, f as emaLogout, ft as readInspectorVersionSafe, g as runEmaIdpInteractiveFlow, gt as parseKeyValuePair, h as requireIdp, ht as parseHeaderPair, i as obtainPendingAuthUrl, it as assertSocketPathWithinLimit, j as checkLoadThresholds, jt as clearEmaIdpSession, k as loadSummaryWarnings, kt as InMemorySecretStore, l as writePendingAuthMarker, lt as getDaemonSocketPath, m as loadEmaIdpConfig, mt as selectServerEntry, n as AUTH_HELPER_COMMAND, nt as DAEMON_DIR_ENV, o as pendingAuthMarkerPath, ot as ensureDaemonDir, p as getEmaStatus, pt as loadServerEntries, q as isSafeLinkTarget, r as PENDING_AUTH_TTL_MS, rt as DAEMON_TOKEN_ENV, s as removeOwnPendingAuthMarker, st as getDaemonDir, tt as verifyDaemonProof, u as authorizeInFrontend, ut as getDaemonTokenPath, v as PLAIN, vt as withDefaultCatalogPath, w as getStateFilePath, wt as readOAuthStore, x as withConnectTimeout, xt as handleError, y as styleFromOpts, yt as DEFAULT_MAX_FETCH_REQUESTS, z as positiveNumberParser } from "./server-B-CUVIBj.js";
 import { realpathSync } from "fs";
 import { resolve } from "path";
 import { fileURLToPath } from "url";
@@ -8,41 +8,95 @@ import path, * as path$1 from "node:path";
 import * as fs from "node:fs";
 import nodeFs, { existsSync as existsSync$1, readFileSync as readFileSync$1 } from "node:fs";
 import { randomBytes, randomUUID } from "node:crypto";
+import * as net from "node:net";
 import { Command } from "commander";
 import { fileURLToPath as fileURLToPath$1 } from "node:url";
 import { getDefaultEnvironment } from "@modelcontextprotocol/client/stdio";
-import * as net from "node:net";
 import { spawn } from "node:child_process";
 import * as readline from "node:readline";
 import { createInterface as createInterface$1 } from "node:readline/promises";
-//#region src/daemon/client.ts
+// ../../core/cli/utils/prompt-args.ts
+function parsePromptArgPair(pair, previous = {}) {
+	const eq = pair.indexOf("=");
+	if (eq <= 0) throw new Error(`Invalid parameter format: ${pair}. Use key=value format.`);
+	return {
+		...previous,
+		[pair.slice(0, eq)]: pair.slice(eq + 1)
+	};
+}
+// src/daemon/handshake.ts
+function createDaemonHello() {
+	const id = randomUUID();
+	const nonce = generateDaemonNonce();
+	return {
+		id,
+		nonce,
+		line: encodeRequest({
+			id,
+			op: "hello",
+			params: { nonce }
+		})
+	};
+}
+function daemonUnverifiedError(socketPath) {
+	return new CliExitCodeError(EXIT_CODES.UNREACHABLE, `Could not verify the connection daemon at ${socketPath}: it did not prove it holds this user's daemon token, so nothing was sent to it. Either MCP_INSPECTOR_DAEMON_TOKEN does not match the running daemon's token, or a daemon from an older mcpdo release is still running (end the \`mcpdod\` process, then re-run the command), or another process is impersonating the daemon.`, { code: "daemon_unverified" });
+}
+function daemonTokenMissingError(tokenPath) {
+	return new CliExitCodeError(EXIT_CODES.UNREACHABLE, `No connection daemon token found (${tokenPath}), so the daemon cannot be verified and nothing was sent. Re-run the command to start a fresh daemon; if this persists, another process may be holding the daemon endpoint.`, { code: "daemon_unverified" });
+}
+function checkDaemonHelloLine(line, hello, token, socketPath) {
+	if (token === void 0) return daemonUnverifiedError(socketPath);
+	let parsed;
+	try {
+		parsed = JSON.parse(line);
+	} catch {
+		return daemonUnverifiedError(socketPath);
+	}
+	if (parsed === null || typeof parsed !== "object") return daemonUnverifiedError(socketPath);
+	const response = parsed;
+	if (response.id !== hello.id || response.ok !== true) return daemonUnverifiedError(socketPath);
+	const result = response.result;
+	if (!verifyDaemonProof(token, hello.nonce, result?.proof)) return daemonUnverifiedError(socketPath);
+}
+// src/daemon/client.ts
 function daemonTokenDir(options) {
 	if (options.dir !== void 0) return options.dir;
 	if (options.socketPath !== void 0 && !options.socketPath.startsWith("\\\\.\\pipe\\")) return path$1.dirname(options.socketPath);
 	return getDaemonDir();
 }
+function resolveDaemonToken(options) {
+	const dir = daemonTokenDir(options);
+	return {
+		token: options.token ?? getDaemonTokenFromEnv() ?? readDaemonTokenFile(dir),
+		tokenPath: getDaemonTokenPath(dir)
+	};
+}
 function relayedEnvelope(error) {
 	return {
 		code: error.code,
 		...error.status !== void 0 && { status: error.status },
 		...error.method !== void 0 && { method: error.method },
 		...error.retryAfter !== void 0 && { retryAfter: sanitizeText(error.retryAfter) },
-		...error.retryAfterMs !== void 0 && { retryAfterMs: error.retryAfterMs }
+		...error.retryAfterMs !== void 0 && { retryAfterMs: error.retryAfterMs },
+		...error.oauthError !== void 0 && { oauthError: sanitizeText(error.oauthError) },
+		...error.oauthErrorDescription !== void 0 && { oauthErrorDescription: sanitizeText(error.oauthErrorDescription) }
 	};
 }
 async function callDaemon(op, params, options = {}) {
 	const socketPath = options.socketPath ?? getDaemonSocketPath();
 	const timeoutMs = options.timeoutMs ?? 6e4;
 	const id = randomUUID();
-	const token = options.token ?? getDaemonTokenFromEnv() ?? readDaemonTokenFile(daemonTokenDir(options));
+	const { token, tokenPath } = resolveDaemonToken(options);
 	const request = {
 		id,
 		op,
-		params
+		params,
+		token
 	};
-	if (token !== void 0) request.token = token;
+	const hello = createDaemonHello();
 	return new Promise((resolve, reject) => {
 		let settled = false;
+		let verified = false;
 		let buffer = "";
 		let queue = Promise.resolve();
 		let timer;
@@ -76,6 +130,15 @@ async function callDaemon(op, params, options = {}) {
 		function handleLine(line) {
 			const trimmed = line.trim();
 			if (!trimmed) return Promise.resolve();
+			if (!verified) {
+				const error = checkDaemonHelloLine(trimmed, hello, token, socketPath);
+				if (error) fail(error);
+				else {
+					verified = true;
+					socket.write(encodeRequest(request));
+				}
+				return Promise.resolve();
+			}
 			let parsed;
 			try {
 				parsed = JSON.parse(trimmed);
@@ -84,6 +147,11 @@ async function callDaemon(op, params, options = {}) {
 				return Promise.resolve();
 			}
 			if (parsed !== null && typeof parsed === "object" && "kind" in parsed && parsed.kind === "elicitation-request") return handleElicitationRequest(parsed);
+			if (parsed !== null && typeof parsed === "object" && "kind" in parsed && parsed.kind === "load-progress") {
+				const frame = parsed;
+				if (frame.id === id) options.onLoadProgress?.(frame.progress);
+				return Promise.resolve();
+			}
 			handleResponse(parsed);
 			return Promise.resolve();
 		}
@@ -122,7 +190,11 @@ async function callDaemon(op, params, options = {}) {
 		if (options.signal?.aborted) onAbort();
 		else options.signal?.addEventListener("abort", onAbort, { once: true });
 		socket.once("connect", () => {
-			socket.write(encodeRequest(request));
+			if (token === void 0) {
+				fail(daemonTokenMissingError(tokenPath));
+				return;
+			}
+			socket.write(hello.line);
 		});
 		socket.on("data", (chunk) => {
 			buffer += String(chunk);
@@ -136,21 +208,22 @@ async function callDaemon(op, params, options = {}) {
 		if (!settled) socket.connect(socketPath);
 	});
 }
-//#endregion
-//#region src/daemon/stream-client.ts
+// src/daemon/stream-client.ts
 async function streamDaemon(params, options) {
 	const socketPath = options.socketPath ?? getDaemonSocketPath();
 	const timeoutMs = options.timeoutMs ?? 6e4;
 	const id = randomUUID();
-	const token = options.token ?? getDaemonTokenFromEnv() ?? readDaemonTokenFile(daemonTokenDir(options));
+	const { token, tokenPath } = resolveDaemonToken(options);
 	const request = {
 		id,
 		op: "stream",
-		params
+		params,
+		token
 	};
-	if (token !== void 0) request.token = token;
+	const hello = createDaemonHello();
 	return new Promise((resolve, reject) => {
 		let settled = false;
+		let verified = false;
 		let buffer = "";
 		let streaming = false;
 		let pendingCallbacks = 0;
@@ -184,6 +257,16 @@ async function streamDaemon(params, options) {
 		function handleLine(line) {
 			const trimmed = line.trim();
 			if (!trimmed) return;
+			if (!verified) {
+				const error = checkDaemonHelloLine(trimmed, hello, token, socketPath);
+				if (error) {
+					fail(error);
+					return;
+				}
+				verified = true;
+				socket.write(encodeRequest(request));
+				return;
+			}
 			if (!streaming) {
 				let response;
 				try {
@@ -247,7 +330,11 @@ async function streamDaemon(params, options) {
 		if (options.signal?.aborted) onAbort();
 		else options.signal?.addEventListener("abort", onAbort, { once: true });
 		socket.once("connect", () => {
-			socket.write(encodeRequest(request));
+			if (token === void 0) {
+				fail(daemonTokenMissingError(tokenPath));
+				return;
+			}
+			socket.write(hello.line);
 		});
 		socket.on("data", (chunk) => {
 			buffer += String(chunk);
@@ -261,8 +348,7 @@ async function streamDaemon(params, options) {
 		if (!settled) socket.connect(socketPath);
 	});
 }
-//#endregion
-//#region src/daemon/ensure.ts
+// src/daemon/ensure.ts
 const READY_TIMEOUT_MS = 1e4;
 const READY_POLL_MS = 50;
 function resolveDaemonScriptPath() {
@@ -363,6 +449,7 @@ async function ensureDaemon(options) {
 		token ??= readDaemonTokenFile(dir);
 		const pong = await callDaemon("ping", {}, {
 			socketPath,
+			dir,
 			timeoutMs: 2e3,
 			token
 		});
@@ -409,8 +496,7 @@ async function ensureDaemon(options) {
 		spawned: true
 	};
 }
-//#endregion
-//#region ../../core/cli/handlers/servers-list.ts
+// ../../core/cli/handlers/servers-list.ts
 function resolveServerListSource(serverOptions = {}) {
 	const source = resolveServerSource(withDefaultCatalogPath(serverOptions));
 	if (!source) return null;
@@ -524,8 +610,7 @@ function isSensitiveHeader(key) {
 	const k = key.toLowerCase();
 	return k.includes("auth") || k.includes("cookie") || k.includes("secret") || k.includes("token") || k.includes("password") || k.includes("api-key") || k.includes("apikey");
 }
-//#endregion
-//#region ../../core/cli/handlers/method-types.ts
+// ../../core/cli/handlers/method-types.ts
 const CONNECTION_RPC_METHODS = [
 	"tools/list",
 	"tools/call",
@@ -550,58 +635,369 @@ const CONNECTION_RPC_METHODS = [
 	"skills/list",
 	"skills/get"
 ];
-//#endregion
-//#region ../../core/cli/handlers/load-thresholds.ts
-const LOAD_ERROR_RATE_EXCEEDED = "load_error_rate_exceeded";
-const LOAD_P99_EXCEEDED = "load_p99_exceeded";
-function fractionParser(flag) {
-	return (value) => {
-		const n = value.trim() === "" ? NaN : Number(value);
-		if (!Number.isFinite(n) || n < 0 || n > 1) throw new Error(`${flag} must be a number from 0 to 1.`);
-		return n;
+// ../../core/cli/handlers/load-baseline.ts
+const LOAD_BASELINE_INVALID = "load_baseline_invalid";
+const LOAD_BASELINE_MISMATCH = "load_baseline_mismatch";
+const LOAD_REGRESSION = "load_regression";
+function resolveLoadBaseline(flags) {
+	if (flags.baseline === void 0) {
+		if (flags.maxRegressionPct !== void 0) throw new CliExitCodeError(EXIT_CODES.USAGE, "--load-max-regression requires --load-baseline.", { code: LOAD_FLAG_CONFLICT });
+		return;
+	}
+	return {
+		baseline: readLoadBaselineFile(flags.baseline),
+		...flags.maxRegressionPct !== void 0 && { maxRegressionPct: flags.maxRegressionPct }
 	};
 }
-const maxP99Parser = positiveNumberParser("--load-max-p99");
-function resolveLoadThresholds(flags) {
-	const { maxErrorRate, maxP99Ms } = flags;
-	if (maxErrorRate === void 0 && maxP99Ms === void 0) return void 0;
+function maxRegressionParser(value) {
+	const trimmed = value.trim().replace(/%$/, "").trim();
+	const n = trimmed === "" ? NaN : Number(trimmed);
+	if (!Number.isFinite(n) || n < 0) throw new Error("--load-max-regression must be a percentage of 0 or more, e.g. 10 or 10%.");
+	return n;
+}
+function invalid(source, problem) {
+	return new CliExitCodeError(EXIT_CODES.USAGE, `--load-baseline ${source}: ${problem}`, { code: LOAD_BASELINE_INVALID });
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+const NUMERIC_FIELDS = [
+	"concurrency",
+	"requests",
+	"ok",
+	"toolErrors",
+	"errors",
+	"elapsedMs",
+	"errorRate",
+	"okThroughput"
+];
+function summaryProblem(value) {
+	if (!isRecord$1(value)) return "is not a JSON object";
+	for (const field of NUMERIC_FIELDS) if (typeof value[field] !== "number") return `is not a --load summary (no numeric ${field}); save one with --format json`;
+	const latency = value.latencyMs;
+	if (latency !== null && !(isRecord$1(latency) && typeof latency.p50 === "number" && typeof latency.p99 === "number")) return "is not a --load summary (latencyMs is neither null nor a set of percentiles)";
+	if (value.stoppedEarly !== void 0 && !isRecord$1(value.stoppedEarly)) return "has a stoppedEarly field that is not an object";
+	if (value.steps !== void 0) {
+		if (!Array.isArray(value.steps)) return "has a steps field that is not an array";
+		for (const step of value.steps) if (!isRecord$1(step) || typeof step.name !== "string" || typeof step.method !== "string" || typeof step.target !== "string" || typeof step.weight !== "number") return "has a scenario step without a name, method, target and weight";
+	}
+	if (value.stages !== void 0) {
+		if (!Array.isArray(value.stages)) return "has a stages field that is not an array";
+		for (const stage of value.stages) {
+			const problem = summaryProblem(stage);
+			if (problem !== void 0) return `has a stage that ${problem}`;
+		}
+	}
+}
+function parseLoadBaseline(text, source) {
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch (err) {
+		throw invalid(source, `is not valid JSON (${err instanceof Error ? err.message : String(err)}); save the baseline with --format json`);
+	}
+	const candidate = isRecord$1(parsed) && isRecord$1(parsed.result) && !("requests" in parsed) ? parsed.result : parsed;
+	const problem = summaryProblem(candidate);
+	if (problem !== void 0) throw invalid(source, problem);
+	const summary = candidate;
+	if (summary.stoppedEarly !== void 0) throw invalid(source, `the baseline run stopped early (${String(summary.stoppedEarly.reason)}), so it is not a baseline`);
 	return {
-		...maxErrorRate !== void 0 && { maxErrorRate },
-		...maxP99Ms !== void 0 && { maxP99Ms }
+		source,
+		summary
 	};
 }
-function exactErrorRate(summary) {
-	return summary.requests === 0 ? 0 : (summary.toolErrors + summary.errors) / summary.requests;
+function readLoadBaselineFile(path) {
+	let text;
+	try {
+		text = readFileSync$1(path, "utf8");
+	} catch (err) {
+		throw invalid(path, `cannot be read: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	return parseLoadBaseline(text, path);
+}
+function shown(value) {
+	return value === void 0 ? "unset" : JSON.stringify(value);
 }
-function errorRateBreach(summary, max) {
-	if (exactErrorRate(summary) <= max) return void 0;
-	const failed = summary.toolErrors + summary.errors;
+function stepsShape(summary) {
+	return summary.steps?.map(({ name, method, target, weight }) => ({
+		name,
+		method,
+		target,
+		weight
+	}));
+}
+function shapeDifferences(run, base) {
+	return [
+		[
+			"tool",
+			run.tool,
+			base.tool
+		],
+		[
+			"scenario steps",
+			stepsShape(run),
+			stepsShape(base)
+		],
+		[
+			"concurrency",
+			run.concurrency,
+			base.concurrency
+		],
+		[
+			"durationMs",
+			run.durationMs,
+			base.durationMs
+		],
+		[
+			"requestLimit",
+			run.requestLimit,
+			base.requestLimit
+		],
+		[
+			"rate",
+			run.rate,
+			base.rate
+		],
+		[
+			"openLoop",
+			run.openLoop === true,
+			base.openLoop === true
+		],
+		[
+			"connections",
+			run.connections?.requested ?? 1,
+			base.connections?.requested ?? 1
+		],
+		[
+			"fan-out",
+			run.fanout && {
+				uri: run.fanout.uri,
+				subscribers: run.fanout.requested,
+				mode: run.fanout.mode
+			},
+			base.fanout && {
+				uri: base.fanout.uri,
+				subscribers: base.fanout.requested,
+				mode: base.fanout.mode
+			}
+		],
+		[
+			"churn calls per session",
+			run.churn?.callsPerSession,
+			base.churn?.callsPerSession
+		]
+	].filter(([, a, b]) => JSON.stringify(a) !== JSON.stringify(b)).map(([label, a, b]) => `${label} is ${shown(a)} here but ${shown(b)} in the baseline`);
+}
+function mismatches(run, base) {
+	const found = shapeDifferences(run, base);
+	const runStages = run.stages ?? [];
+	const baseStages = base.stages ?? [];
+	if (run.stages === void 0 !== (base.stages === void 0)) {
+		found.push(run.stages === void 0 ? "the baseline is a stepped run (--load-steps / --load-ramp) and this one is not" : "this is a stepped run (--load-steps / --load-ramp) and the baseline is not");
+		return found;
+	}
+	const shared = Math.min(runStages.length, baseStages.length);
+	for (let i = 0; i < shared; i++) {
+		const r = runStages[i];
+		const b = baseStages[i];
+		if (r.stepBy !== b.stepBy || r.level !== b.level || r.durationMs !== b.durationMs) found.push(`stage ${r.stage} is ${r.stepBy} ${r.level} for ${shown(r.durationMs)}ms here but ${b.stepBy} ${b.level} for ${shown(b.durationMs)}ms in the baseline`);
+		if (r.rate !== b.rate) found.push(`stage ${r.stage} rate is ${shown(r.rate)} here but ${shown(b.rate)} in the baseline`);
+	}
+	if (runStages.length !== baseStages.length && run.stoppedEarly === void 0) found.push(`this run has ${runStages.length} stages but the baseline has ${baseStages.length}`);
+	return found;
+}
+function round2(n) {
+	return Math.round(n * 100) / 100;
+}
+function shownNumber(n) {
+	return n !== 0 && Math.abs(n) < .01 ? Number(n.toPrecision(2)) : round2(n);
+}
+function relativeChange(baseline, value, worseWhen) {
+	return (worseWhen === "higher" ? value - baseline : baseline - value) / baseline * 100;
+}
+function exactErrorRate(s) {
+	return s.requests === 0 ? 0 : (s.toolErrors + s.errors) / s.requests;
+}
+function exactOkThroughput(s) {
+	return s.elapsedMs > 0 ? s.ok * 1e3 / s.elapsedMs : 0;
+}
+function latencyFigure(figure, run, base) {
+	const baseline = base.latencyMs?.[figure] ?? null;
+	const value = run.latencyMs?.[figure] ?? null;
 	return {
-		code: LOAD_ERROR_RATE_EXCEEDED,
-		message: `error rate ${summary.errorRate} (${failed} of ${summary.requests} calls failed) is above --load-max-error-rate ${max}`
+		figure,
+		baseline,
+		value,
+		change: baseline === null || baseline === 0 ? null : value === null ? Infinity : relativeChange(baseline, value, "higher")
 	};
 }
-function p99Breach(summary, max) {
-	const p99 = summary.latencyMs?.p99;
-	if (p99 === void 0) return {
-		code: LOAD_P99_EXCEEDED,
-		message: `no call succeeded, so there is no p99 latency to check against --load-max-p99 ${max}`
+function compareFigures(run, base) {
+	const baseRate = exactErrorRate(base);
+	const runRate = exactErrorRate(run);
+	const baseThroughput = exactOkThroughput(base);
+	const runThroughput = exactOkThroughput(run);
+	return [
+		latencyFigure("p50", run, base),
+		latencyFigure("p99", run, base),
+		{
+			figure: "errorRate",
+			baseline: baseRate,
+			value: runRate,
+			change: (runRate - baseRate) * 100
+		},
+		{
+			figure: "okThroughput",
+			baseline: base.okThroughput,
+			value: run.okThroughput,
+			change: baseThroughput > 0 ? relativeChange(baseThroughput, runThroughput, "lower") : null
+		}
+	];
+}
+function compareLoadToBaseline(summary, baseline) {
+	const base = baseline.summary;
+	const found = mismatches(summary, base);
+	if (found.length > 0) throw new CliExitCodeError(EXIT_CODES.USAGE, `--load-baseline ${baseline.source} is not comparable with this run: ${found.join("; ")}.`, { code: LOAD_BASELINE_MISMATCH });
+	if (summary.stages !== void 0) {
+		const baseStages = base.stages;
+		return {
+			source: baseline.source,
+			rows: summary.stages.map((stage, i) => ({
+				where: ` at stage ${stage.stage} (${stage.stepBy} ${stage.level})`,
+				figures: compareFigures(stage, baseStages[i])
+			}))
+		};
+	}
+	return {
+		source: baseline.source,
+		rows: [{
+			where: "",
+			figures: compareFigures(summary, base)
+		}]
 	};
-	if (p99 <= max) return void 0;
+}
+const FIGURE_LABEL = {
+	p50: "p50",
+	p99: "p99",
+	errorRate: "error rate",
+	okThroughput: "ok throughput"
+};
+function figureValue(f, n) {
+	if (n === null) return "none";
+	switch (f.figure) {
+		case "p50":
+		case "p99": return `${n}ms`;
+		case "errorRate": return `${shownNumber(n * 100)}%`;
+		case "okThroughput": return `${n}/s`;
+	}
+}
+function changeText(f) {
+	if (f.change === null) return "not compared";
+	if (f.change === Infinity) return "no call succeeded";
+	const unit = f.figure === "errorRate" ? " pts" : "%";
+	return `${f.change > 0 ? "+" : ""}${shownNumber(f.change)}${unit} worse`;
+}
+function figureLine(f) {
+	return `${FIGURE_LABEL[f.figure]} ${figureValue(f, f.baseline)} -> ${figureValue(f, f.value)} (${changeText(f)})`;
+}
+function formatLoadBaselineComparison(comparison) {
+	return comparison.rows.map((row) => `Baseline ${comparison.source}${row.where}: ${row.figures.map(figureLine).join(", ")}`);
+}
+const BUDGET_EPSILON = 1e-9;
+function checkLoadRegression(comparison, maxRegressionPct) {
+	if (maxRegressionPct === void 0) return;
+	for (const row of comparison.rows) {
+		const regressed = row.figures.filter((f) => f.change !== null && f.change > maxRegressionPct + BUDGET_EPSILON);
+		if (regressed.length === 0) continue;
+		throw new CliExitCodeError(EXIT_CODES.LOAD_THRESHOLD_EXCEEDED, `Load regression${row.where} against --load-baseline ${comparison.source}: ${regressed.map(figureLine).join("; ")}; over --load-max-regression ${maxRegressionPct}%.`, { code: LOAD_REGRESSION });
+	}
+}
+// ../../core/cli/handlers/load-files.ts
+function readLoadScenarioFile(path) {
+	let text;
+	try {
+		text = readFileSync$1(path, "utf8");
+	} catch (err) {
+		throw loadScenarioError(path, `cannot be read: ${err.message}`);
+	}
+	return parseLoadScenario(text, path);
+}
+function readLoadArgsFile(path) {
+	let text;
+	try {
+		text = readFileSync$1(path, "utf8");
+	} catch (err) {
+		throw loadArgsError(`--load-args-file ${path}: cannot be read: ${err.message}`);
+	}
+	try {
+		return parseLoadArgsRows(text);
+	} catch (err) {
+		throw loadArgsError(`--load-args-file ${path}: ${err.message}`);
+	}
+}
+function loadStepsParser(value) {
+	const levels = value.split(",").map((p) => p.trim()).map((p) => p === "" ? NaN : Number(p));
+	if (levels.length === 0 || levels.some((n) => !Number.isFinite(n) || n <= 0)) throw new Error("--load-steps must be a comma-separated list of positive numbers, e.g. 10,25,50.");
+	return levels;
+}
+function loadRampParser(value) {
+	const parts = value.split(":").map((p) => p.trim());
+	const [from, to, durationSec] = parts.map((p) => p === "" ? NaN : Number(p));
+	if (parts.length !== 3 || ![
+		from,
+		to,
+		durationSec
+	].every((n) => Number.isFinite(n) && n > 0)) throw new Error("--load-ramp must be <from>:<to>:<seconds>, three positive numbers, e.g. 10:100:60.");
 	return {
-		code: LOAD_P99_EXCEEDED,
-		message: `p99 latency ${p99}ms is above --load-max-p99 ${max}ms`
+		from,
+		to,
+		durationSec
 	};
 }
-function checkLoadThresholds(summary, thresholds) {
-	if (!thresholds) return;
-	const breaches = [thresholds.maxErrorRate !== void 0 ? errorRateBreach(summary, thresholds.maxErrorRate) : void 0, thresholds.maxP99Ms !== void 0 ? p99Breach(summary, thresholds.maxP99Ms) : void 0].filter((b) => b !== void 0);
-	const [first] = breaches;
-	if (!first) return;
-	throw new CliExitCodeError(EXIT_CODES.LOAD_THRESHOLD_EXCEEDED, `Load threshold exceeded: ${breaches.map((b) => b.message).join("; ")}.`, { code: first.code });
+function loadStepByParser(value) {
+	if (value !== "concurrency" && value !== "rate") throw new Error("--load-step-by must be concurrency or rate.");
+	return value;
+}
+function rampLevels(ramp, count, by) {
+	const levels = Array.from({ length: count }, (_, i) => count === 1 ? ramp.to : ramp.from + (ramp.to - ramp.from) * i / (count - 1));
+	return by === "concurrency" ? levels.map((l) => Math.max(1, Math.round(l))) : levels;
+}
+function resolveLoadStages(flags) {
+	const { steps, ramp } = flags;
+	if (steps === void 0 && ramp === void 0) {
+		for (const [flag, value] of [
+			["--load-step-by", flags.stepBy],
+			["--load-step-duration", flags.stepDurationSec],
+			["--load-stop-on-breach", flags.stopOnBreach]
+		]) if (value !== void 0) throw new Error(`${flag} requires --load-steps or --load-ramp.`);
+		return;
+	}
+	if (steps !== void 0 && ramp !== void 0) throw new Error("--load-steps cannot be combined with --load-ramp.");
+	const shape = steps !== void 0 ? "--load-steps" : "--load-ramp";
+	if (flags.durationSec !== void 0 || flags.requests !== void 0) throw new Error(`${shape} cannot be combined with --load-duration or --load-requests; each stage runs for --load-step-duration.`);
+	const by = flags.stepBy ?? "concurrency";
+	if (by === "concurrency" && flags.concurrency !== void 0) throw new Error(`${shape} sets the concurrency of each stage, so it cannot be combined with --load-concurrency; use --load-step-by rate to step the rate over a fixed pool.`);
+	if (by === "rate" && flags.rate !== void 0) throw new Error(`${shape} with --load-step-by rate sets the rate of each stage, so it cannot be combined with --load-rate.`);
+	if (by === "concurrency" && steps !== void 0 && steps.some((n) => !Number.isInteger(n))) throw new Error("--load-steps must be whole numbers when stepping concurrency.");
+	if (flags.stopOnBreach === true && flags.thresholds === void 0) throw new Error("--load-stop-on-breach requires a threshold (--load-max-error-rate, --load-max-p50, --load-max-p95, --load-max-p99 or --load-min-throughput).");
+	const stepSec = flags.stepDurationSec ?? 10;
+	let levels;
+	let stageMs;
+	if (ramp !== void 0) {
+		const count = Math.max(1, Math.round(ramp.durationSec / stepSec));
+		levels = rampLevels(ramp, count, by);
+		stageMs = ramp.durationSec * 1e3 / count;
+	} else {
+		levels = steps;
+		stageMs = stepSec * 1e3;
+	}
+	return {
+		by,
+		levels,
+		stageMs,
+		...flags.stopOnBreach === true && { stopOnBreach: flags.thresholds }
+	};
 }
-//#endregion
-//#region src/connection/load-flags.ts
+// src/connection/load-flags.ts
 function resolveLoadFlags(flags) {
 	const bounds = [
 		["--load-concurrency", flags.loadConcurrency],
@@ -609,41 +1005,118 @@ function resolveLoadFlags(flags) {
 		["--load-duration", flags.loadDuration],
 		["--load-requests", flags.loadRequests],
 		["--load-rate", flags.loadRate],
+		["--load-scenario", flags.loadScenario],
+		["--load-args-file", flags.loadArgsFile],
+		["--load-args-random", flags.loadArgsRandom],
+		["--load-steps", flags.loadSteps],
+		["--load-ramp", flags.loadRamp],
+		["--load-step-by", flags.loadStepBy],
+		["--load-step-duration", flags.loadStepDuration],
+		["--load-stop-on-breach", flags.loadStopOnBreach],
+		["--load-interval", flags.loadInterval],
+		["--load-warmup", flags.loadWarmup],
+		["--load-progress", flags.loadProgress],
+		["--load-open-loop", flags.loadOpenLoop],
+		["--load-churn", flags.loadChurn],
+		["--load-churn-calls", flags.loadChurnCalls],
+		["--load-subscribe", flags.loadSubscribe],
+		["--load-subscribers", flags.loadSubscribers],
+		["--load-subscribe-wait", flags.loadSubscribeWait],
 		["--load-max-error-rate", flags.loadMaxErrorRate],
-		["--load-max-p99", flags.loadMaxP99]
+		["--load-max-p99", flags.loadMaxP99],
+		["--load-max-p50", flags.loadMaxP50],
+		["--load-max-p95", flags.loadMaxP95],
+		["--load-min-throughput", flags.loadMinThroughput],
+		["--load-baseline", flags.loadBaseline],
+		["--load-max-regression", flags.loadMaxRegression]
 	];
 	if (flags.load !== true) {
 		for (const [flag, value] of bounds) if (value !== void 0) throw usage(`${flag} requires --load.`);
 		return;
 	}
 	if (flags.appInfo === true) throw usage("--load cannot be combined with --app-info.");
-	if (!flags.toolName) throw usage("--load requires a tool name.", "missing_tool_name");
+	if (flags.loadScenario !== void 0) {
+		const named = [
+			["a tool name", flags.toolName !== void 0],
+			["tool arguments", Object.keys(flags.toolArg ?? {}).length > 0],
+			["--tool-metadata", Object.keys(flags.toolMetadata ?? {}).length > 0]
+		];
+		for (const [what, given] of named) if (given) throw usage(`--load-scenario cannot be combined with ${what}; each scenario step names its own tool and arguments.`);
+		if (flags.loadArgsFile !== void 0) throw usage("--load-args-file cannot be combined with --load-scenario; put placeholders in each step's args instead.");
+	} else if (!flags.toolName && flags.loadSubscribe === void 0) throw usage("--load requires a tool name.", "missing_tool_name");
+	if (flags.loadArgsRandom === true && flags.loadArgsFile === void 0) throw usage("--load-args-random requires --load-args-file.");
+	assertLoadArgsTemplate(flags.toolArg, "tool arguments");
+	const scenario = flags.loadScenario !== void 0 ? readLoadScenarioFile(flags.loadScenario) : void 0;
+	const argRows = flags.loadArgsFile !== void 0 ? {
+		rows: readLoadArgsFile(flags.loadArgsFile),
+		order: flags.loadArgsRandom === true ? "random" : "sequential"
+	} : void 0;
+	const thresholds = resolveLoadThresholds({
+		maxErrorRate: flags.loadMaxErrorRate,
+		maxP50Ms: flags.loadMaxP50,
+		maxP95Ms: flags.loadMaxP95,
+		maxP99Ms: flags.loadMaxP99,
+		minThroughput: flags.loadMinThroughput
+	});
 	let options;
 	try {
+		const stages = resolveLoadStages({
+			steps: flags.loadSteps,
+			ramp: flags.loadRamp,
+			stepBy: flags.loadStepBy,
+			stepDurationSec: flags.loadStepDuration,
+			stopOnBreach: flags.loadStopOnBreach,
+			thresholds,
+			concurrency: flags.loadConcurrency,
+			rate: flags.loadRate,
+			durationSec: flags.loadDuration,
+			requests: flags.loadRequests
+		});
 		options = resolveLoadOptions({
 			concurrency: flags.loadConcurrency,
 			connections: flags.loadConnections,
 			durationSec: flags.loadDuration,
 			requests: flags.loadRequests,
-			rate: flags.loadRate
+			rate: flags.loadRate,
+			scenario,
+			argRows,
+			stages,
+			intervalSec: flags.loadInterval,
+			warmupSec: flags.loadWarmup,
+			openLoop: flags.loadOpenLoop,
+			churn: flags.loadChurn,
+			churnCalls: flags.loadChurnCalls,
+			subscribe: flags.loadSubscribe,
+			subscribers: flags.loadSubscribers,
+			subscribeWaitSec: flags.loadSubscribeWait,
+			progressSec: flags.loadProgress ?? 5
 		});
 	} catch (err) {
 		throw usage(err.message);
 	}
-	const thresholds = resolveLoadThresholds({
-		maxErrorRate: flags.loadMaxErrorRate,
-		maxP99Ms: flags.loadMaxP99
+	assertFitsOneRequest(options);
+	const baseline = resolveLoadBaseline({
+		baseline: flags.loadBaseline,
+		maxRegressionPct: flags.loadMaxRegression
 	});
 	return {
 		options,
-		...thresholds && { thresholds }
+		...thresholds && { thresholds },
+		...baseline && { baseline }
 	};
 }
+const LOAD_REQUEST_HEADROOM_BYTES = 65536;
+function assertFitsOneRequest(options) {
+	const budget = MAX_REQUEST_LINE_BYTES - LOAD_REQUEST_HEADROOM_BYTES;
+	const bytes = Buffer.byteLength(JSON.stringify(options));
+	if (bytes <= budget) return;
+	const [flag, code] = options.argRows !== void 0 ? ["--load-args-file", LOAD_ARGS_INVALID] : ["--load-scenario", LOAD_SCENARIO_INVALID];
+	throw usage(`${flag} is too large for mcpdo: the run's options encode to ${bytes} bytes, over the ${budget}-byte limit of one daemon request. Use fewer or smaller rows, or the one-shot CLI (mcp-inspector --cli), which has no such limit.`, code);
+}
 function usage(message, code = LOAD_FLAG_CONFLICT) {
 	return new CliExitCodeError(EXIT_CODES.USAGE, message, { code });
 }
-//#endregion
-//#region src/connection/ema-login-helper.ts
+// src/connection/ema-login-helper.ts
 const EMA_LOGIN_HELPER_COMMAND = "auth/complete-ema-login";
 function emaLoginMarkerKey(issuer) {
 	return `ema-idp:${issuer}`;
@@ -704,8 +1177,7 @@ async function runEmaLoginHelper() {
 		if (markerPath !== void 0) removeOwnPendingAuthMarker(markerPath);
 	}
 }
-//#endregion
-//#region src/connection/parse-tool-args.ts
+// src/connection/parse-tool-args.ts
 function assertJsonRoundTrips(value, context) {
 	if (typeof value === "number" && !Number.isFinite(value)) throw new Error(`Invalid ${context}: ${value} has no JSON representation (it would silently reach the tool as null).`);
 	if (Array.isArray(value)) for (const item of value) assertJsonRoundTrips(item, context);
@@ -787,8 +1259,7 @@ function parseJsonObject(raw, flag) {
 	assertJsonRoundTrips(parsed, flag);
 	return parsed;
 }
-//#endregion
-//#region src/connection/resolve-command.ts
+// src/connection/resolve-command.ts
 function resolveCommandPath(command, env = process.env) {
 	if (!command || command.includes("/") || command.includes(path.sep)) return command;
 	const pathVar = env.PATH ?? "";
@@ -804,8 +1275,7 @@ function resolveCommandPath(command, env = process.env) {
 	}
 	return command;
 }
-//#endregion
-//#region src/connection/form-schema.ts
+// src/connection/form-schema.ts
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -951,8 +1421,245 @@ function parseFormSchema(schema) {
 	}
 	return fields;
 }
-//#endregion
-//#region src/connection/format-human.ts
+// ../../core/cli/handlers/load-format.ts
+function code$1(style, name) {
+	return `\`${style.bold(name)}\``;
+}
+function heading$1(style, text) {
+	return style.bold(text);
+}
+function formatLoadSummaryHuman(summary, style = PLAIN) {
+	const tool = summary.tool !== void 0 ? ` ${code$1(style, summary.tool)}` : summary.steps !== void 0 ? ` scenario (${summary.steps.length} ${summary.steps.length === 1 ? "step" : "steps"})` : "";
+	const bounds = [
+		`concurrency ${summary.concurrency}`,
+		...summary.durationMs !== void 0 ? [`duration ${summary.durationMs / 1e3}s`] : [],
+		...summary.requestLimit !== void 0 ? [`limit ${summary.requestLimit}`] : [],
+		...summary.rate !== void 0 ? [`rate ${summary.rate}/s`] : [],
+		...summary.openLoop === true ? ["open loop"] : [],
+		...summary.churn !== void 0 ? ["churn"] : [],
+		...summary.workers !== void 0 ? [`${summary.workers} worker processes`] : []
+	];
+	const failed = summary.toolErrors + summary.errors;
+	const rate = `${(summary.errorRate * 100).toFixed(2)}%`;
+	const lines = [
+		`${heading$1(style, "Load test")}${tool} ${style.dim(`(${bounds.join(", ")})`)}`,
+		`  Requests:   ${summary.requests} in ${(summary.elapsedMs / 1e3).toFixed(2)}s (${summary.throughput}/s, ${summary.okThroughput}/s ok)`,
+		`  Outcomes:   ${style.green(`${summary.ok} ok`)}, ${summary.toolErrors} tool errors, ${summary.errors} errors`,
+		`  Error rate: ${failed > 0 ? style.red(rate) : rate}`
+	];
+	if (summary.plannedStarts !== void 0) {
+		const dropped = `${summary.droppedSlots} dropped`;
+		lines.push(`  Rate:       ${summary.achievedRate}/s achieved; ${summary.plannedStarts} planned, ${summary.droppedSlots > 0 ? style.red(dropped) : dropped}`);
+	}
+	const l = summary.latencyMs;
+	lines.push(l === null ? `  Latency:    ${style.dim("no calls succeeded")}` : `  Latency:    ${latencyLine(l)}`);
+	const e = summary.errorLatencyMs;
+	if (e !== null) lines.push(`  Failed in:  ${latencyLine(e)}`);
+	if (summary.errorMessages.length > 0) {
+		lines.push(`  ${style.bold("Top errors:")}`);
+		for (const { message, count } of summary.errorMessages) lines.push(`    ${count}× ${message}`);
+	}
+	if (summary.toolErrorMessages.length > 0) {
+		lines.push(`  ${style.bold("Top tool errors:")}`);
+		for (const { message, count } of summary.toolErrorMessages) lines.push(`    ${count}× ${message}`);
+	}
+	if (summary.stoppedEarly !== void 0) lines.push(`  ${style.red("Stopped early")} (${summary.stoppedEarly.reason}): ${summary.stoppedEarly.detail}`);
+	const w = summary.warmup;
+	if (w !== void 0) {
+		const stopped = w.stoppedEarly !== void 0 ? ` ${style.red(`(stopped: ${w.stoppedEarly.reason})`)}` : "";
+		lines.push(`  Warm-up:    ${w.durationMs / 1e3}s, ${w.requests} calls excluded (${w.ok} ok, ${w.failed} failed)${stopped}`);
+	}
+	if (summary.intervals !== void 0) {
+		lines.push(`  ${style.bold("Intervals:")}`);
+		for (const row of summary.intervals) lines.push(formatLoadInterval(row));
+	}
+	if (summary.stages !== void 0) {
+		lines.push(`  ${style.bold("Stages:")}`);
+		for (const stage of summary.stages) {
+			lines.push(formatLoadStage(stage, style));
+			for (const row of stage.intervals ?? []) lines.push(`  ${formatLoadInterval(row)}`);
+		}
+	}
+	if (summary.steps !== void 0) {
+		lines.push(`  ${style.bold("Steps:")}`);
+		for (const step of summary.steps) lines.push(...formatLoadStep(step, style));
+	}
+	const c = summary.connections;
+	if (c !== void 0) {
+		const failed = `${c.failed} failed`;
+		const connect = c.connectMs === null ? "" : ` (connect p50 ${c.connectMs.p50} / max ${c.connectMs.max} ms)`;
+		lines.push(`  Sessions:   ${c.opened} of ${c.requested} opened, ${c.failed > 0 ? style.red(failed) : failed}${connect}`);
+		for (const { message, count } of c.errorMessages) lines.push(`    ${count}× ${message}`);
+	}
+	const f = summary.fanout;
+	if (f !== void 0) lines.push(...formatLoadFanout(f, style));
+	const churn = summary.churn;
+	if (churn !== void 0) {
+		const failed = `${churn.failed} failed to open`;
+		const connect = churn.connectMs === null ? "" : ` (connect p50 ${churn.connectMs.p50} / p99 ${churn.connectMs.p99} / max ${churn.connectMs.max} ms)`;
+		const closeFailed = churn.closeFailed > 0 ? `, ${churn.closeFailed} failed to close` : "";
+		lines.push(`  Churn:      ${churn.opened} sessions of ${churn.callsPerSession} ${churn.callsPerSession === 1 ? "call" : "calls"}, ${churn.failed > 0 ? style.red(failed) : failed}${closeFailed}${connect}`);
+		for (const { message, count } of churn.errorMessages) lines.push(`    ${count}× ${message}`);
+	}
+	return lines.join("\n");
+}
+function formatLoadFanout(f, style) {
+	const failed = `${f.failed} failed`;
+	const subscribe = f.subscribeMs === null ? "" : ` (subscribe p50 ${f.subscribeMs.p50} / max ${f.subscribeMs.max} ms)`;
+	const missed = `${f.missed} missed`;
+	const lines = [`  Fan-out:    ${code$1(style, f.uri)}, ${f.mode}; ${f.subscribed} of ${f.requested} sessions subscribed, ${f.failed > 0 ? style.red(failed) : failed}${subscribe}`, `  Delivered:  ${f.delivered} of ${f.updates * f.subscribed} notifications (${f.updates} updates × ${f.subscribed}), ${f.missed > 0 ? style.red(missed) : missed} across ${f.sessionsMissed} sessions, ${f.unexpected} unexpected`];
+	if (f.deliveryMs !== null) lines.push(`  Delivery:   ${latencyLine(f.deliveryMs)}`);
+	for (const { message, count } of f.errorMessages) lines.push(`    ${count}× ${message}`);
+	return lines;
+}
+function latencyLine(l) {
+	return `min ${l.min} / mean ${l.mean} / p50 ${l.p50} / p90 ${l.p90} / p95 ${l.p95} / p99 ${l.p99} / p99.9 ${l.p999} / max ${l.max} ms`;
+}
+function formatLoadInterval(row) {
+	const failed = row.toolErrors + row.errors;
+	const l = row.latencyMs;
+	const latency = l === null ? "no successes" : `p50 ${l.p50} / p99 ${l.p99} ms`;
+	return `    ${row.startMs / 1e3}–${row.endMs / 1e3}s: ${row.requests} calls (${row.throughput}/s), ${failed} failed; ${latency}`;
+}
+function formatLoadStage(stage, style) {
+	const failed = stage.toolErrors + stage.errors;
+	const rate = `${(stage.errorRate * 100).toFixed(2)}%`;
+	const l = stage.latencyMs;
+	const latency = l === null ? style.dim("no calls succeeded") : `p50 ${l.p50} / p99 ${l.p99} ms`;
+	const level = stage.stepBy === "rate" ? `rate ${stage.level}/s` : `concurrency ${stage.level}`;
+	const achieved = stage.achievedRate !== void 0 ? `, ${stage.achievedRate}/s started` : "";
+	const stopped = stage.stoppedEarly !== void 0 ? ` ${style.red(`(stopped: ${stage.stoppedEarly.reason})`)}` : "";
+	return `    ${stage.stage}. ${level}: ${stage.requests} requests (${stage.okThroughput}/s ok${achieved}), ${failed > 0 ? style.red(rate) : rate} errors; ${latency}${stopped}`;
+}
+function formatLoadStep(step, style) {
+	const failed = step.toolErrors + step.errors;
+	const rate = `${(step.errorRate * 100).toFixed(2)}%`;
+	const l = step.latencyMs;
+	const latency = l === null ? style.dim("no calls succeeded") : `p50 ${l.p50} / p99 ${l.p99} ms`;
+	const lines = [`    ${code$1(style, step.name)} ${style.dim(`(${step.method} ${step.target}, weight ${step.weight})`)}`, `      ${step.requests} requests (${step.throughput}/s): ${style.green(`${step.ok} ok`)}, ${step.toolErrors} tool errors, ${step.errors} errors (${failed > 0 ? style.red(rate) : rate}); ${latency}`];
+	for (const { message, count } of [...step.errorMessages, ...step.toolErrorMessages]) lines.push(`      ${count}× ${message}`);
+	return lines;
+}
+// ../../core/auth/accessTokenClaims.ts
+const CONTROL_CHARS = /[\u0000-\u001F\u007F-\u009F]/g;
+function clean(value) {
+	return value.replace(CONTROL_CHARS, "");
+}
+function stringClaim(value) {
+	if (typeof value !== "string") return void 0;
+	const cleaned = clean(value).trim();
+	return cleaned.length > 0 ? cleaned : void 0;
+}
+function listClaim(value) {
+	const strings = (Array.isArray(value) ? value : [value]).map(stringClaim).filter((s) => s !== void 0);
+	return strings.length > 0 ? strings : void 0;
+}
+function scopeString(value) {
+	const s = stringClaim(value);
+	if (s === void 0) return void 0;
+	return s.split(/\s+/).filter(Boolean);
+}
+function numericClaim(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function summarizeAccessToken(tokens) {
+	const claims = decodeJwtPayload(tokens.access_token)?.payload;
+	if (claims && typeof claims === "object" && !Array.isArray(claims)) return {
+		format: "jwt",
+		issuer: stringClaim(claims.iss),
+		audience: listClaim(claims.aud),
+		subject: stringClaim(claims.sub),
+		clientId: stringClaim(claims.client_id) ?? stringClaim(claims.azp),
+		scopes: scopeString(claims.scope) ?? (typeof claims.scp === "string" ? scopeString(claims.scp) : listClaim(claims.scp)),
+		issuedAt: numericClaim(claims.iat),
+		expiresAt: numericClaim(claims.exp)
+	};
+	return {
+		format: "opaque",
+		scopes: scopeString(tokens.scope),
+		expiresIn: numericClaim(tokens.expires_in)
+	};
+}
+function isAccessTokenSummaryExpired(summary, nowMs) {
+	return summary.expiresAt !== void 0 && summary.expiresAt * 1e3 <= nowMs;
+}
+function formatDuration(seconds) {
+	const s = Math.floor(Math.abs(seconds));
+	if (s < 60) return `${s}s`;
+	const m = Math.floor(s / 60);
+	if (m < 60) return `${m}m`;
+	const h = Math.floor(m / 60);
+	if (h < 24) return m % 60 === 0 ? `${h}h` : `${h}h ${m % 60}m`;
+	const d = Math.floor(h / 24);
+	return h % 24 === 0 ? `${d}d` : `${d}d ${h % 24}h`;
+}
+function formatEpoch(epochSeconds) {
+	const date = /* @__PURE__ */ new Date(epochSeconds * 1e3);
+	return Number.isNaN(date.getTime()) ? String(epochSeconds) : date.toISOString();
+}
+function relativeTo(epochSeconds, nowMs) {
+	const delta = epochSeconds - nowMs / 1e3;
+	return delta >= 0 ? `in ${formatDuration(delta)}` : `${formatDuration(delta)} ago`;
+}
+function accessTokenDetailLines(summary, nowMs) {
+	const lines = [];
+	if (summary.format === "jwt") {
+		lines.push({
+			label: "Format",
+			value: "JWT (signature not verified)"
+		});
+		if (summary.issuer) lines.push({
+			label: "Issuer",
+			value: summary.issuer
+		});
+		if (summary.audience) lines.push({
+			label: "Audience",
+			value: summary.audience.join(", ")
+		});
+		if (summary.subject) lines.push({
+			label: "Subject",
+			value: summary.subject
+		});
+		if (summary.clientId) lines.push({
+			label: "Client",
+			value: summary.clientId
+		});
+		if (summary.scopes) lines.push({
+			label: "Scopes",
+			value: summary.scopes.join(", ")
+		});
+		if (summary.issuedAt !== void 0) lines.push({
+			label: "Issued",
+			value: `${formatEpoch(summary.issuedAt)} (${relativeTo(summary.issuedAt, nowMs)})`
+		});
+		if (summary.expiresAt !== void 0) {
+			const expired = isAccessTokenSummaryExpired(summary, nowMs);
+			const rel = relativeTo(summary.expiresAt, nowMs);
+			lines.push({
+				label: "Expires",
+				value: `${formatEpoch(summary.expiresAt)} (${expired ? `expired ${rel}` : rel})`
+			});
+		} else lines.push({
+			label: "Expires",
+			value: "no exp claim"
+		});
+		return lines;
+	}
+	lines.push({
+		label: "Format",
+		value: "Opaque (not a JWT)"
+	});
+	if (summary.scopes) lines.push({
+		label: "Scopes",
+		value: summary.scopes.join(", ")
+	});
+	lines.push({
+		label: "Expires in",
+		value: summary.expiresIn !== void 0 ? `${formatDuration(summary.expiresIn)} from issuance (token response expires_in)` : "not stated by the token response"
+	});
+	return lines;
+}
+// src/connection/format-human.ts
 function asArray(value) {
 	return Array.isArray(value) ? value : [];
 }
@@ -1285,6 +1992,17 @@ function formatAuthListHuman(list, style = PLAIN) {
 	if (servers.length === 0) lines.push(style.dim("(none)"));
 	return lines.join("\n");
 }
+function formatAuthShowHuman(result, nowMs, style = PLAIN) {
+	const title = `${heading(style, "Stored auth")} ${code(style, result.url)}${result.shownByName ? style.dim(` (${result.shownByName})`) : ""}`;
+	if (!result.hasTokens || !result.accessToken) return [title, style.dim("No stored access token.")].join("\n");
+	const rows = accessTokenDetailLines(result.accessToken, nowMs);
+	const width = Math.max(...rows.map((r) => r.label.length));
+	return [
+		title,
+		...rows.map((r) => `  ${style.dim(`${r.label}:`.padEnd(width + 1))} ${r.value}`),
+		`  ${style.dim("Refresh:".padEnd(width + 1))} ${result.hasRefreshToken ? "stored" : "none"}`
+	].join("\n");
+}
 function formatEmaStatusHuman(status, style = PLAIN) {
 	const lines = [heading(style, "EMA (enterprise-managed auth):")];
 	lines.push(style.dim(String(status.clientConfigPath ?? "")));
@@ -1484,48 +2202,6 @@ function formatStreamEventHuman(data, style = PLAIN) {
 	}
 	return JSON.stringify(ev, null, 2);
 }
-function formatLoadSummaryHuman(summary, style = PLAIN) {
-	const tool = summary.tool !== void 0 ? ` ${code(style, summary.tool)}` : "";
-	const bounds = [
-		`concurrency ${summary.concurrency}`,
-		...summary.durationMs !== void 0 ? [`duration ${summary.durationMs / 1e3}s`] : [],
-		...summary.requestLimit !== void 0 ? [`limit ${summary.requestLimit}`] : [],
-		...summary.rate !== void 0 ? [`rate ${summary.rate}/s`] : []
-	];
-	const failed = summary.toolErrors + summary.errors;
-	const rate = `${(summary.errorRate * 100).toFixed(2)}%`;
-	const lines = [
-		`${heading(style, "Load test")}${tool} ${style.dim(`(${bounds.join(", ")})`)}`,
-		`  Requests:   ${summary.requests} in ${(summary.elapsedMs / 1e3).toFixed(2)}s (${summary.throughput}/s, ${summary.okThroughput}/s ok)`,
-		`  Outcomes:   ${style.green(`${summary.ok} ok`)}, ${summary.toolErrors} tool errors, ${summary.errors} errors`,
-		`  Error rate: ${failed > 0 ? style.red(rate) : rate}`
-	];
-	if (summary.plannedStarts !== void 0) {
-		const dropped = `${summary.droppedSlots} dropped`;
-		lines.push(`  Rate:       ${summary.achievedRate}/s achieved; ${summary.plannedStarts} planned, ${summary.droppedSlots > 0 ? style.red(dropped) : dropped}`);
-	}
-	const l = summary.latencyMs;
-	lines.push(l === null ? `  Latency:    ${style.dim("no calls succeeded")}` : `  Latency:    min ${l.min} / mean ${l.mean} / p50 ${l.p50} / p90 ${l.p90} / p99 ${l.p99} / max ${l.max} ms`);
-	const e = summary.errorLatencyMs;
-	if (e !== null) lines.push(`  Failed in:  min ${e.min} / mean ${e.mean} / p50 ${e.p50} / p90 ${e.p90} / p99 ${e.p99} / max ${e.max} ms`);
-	if (summary.errorMessages.length > 0) {
-		lines.push(`  ${style.bold("Top errors:")}`);
-		for (const { message, count } of summary.errorMessages) lines.push(`    ${count}× ${message}`);
-	}
-	if (summary.toolErrorMessages.length > 0) {
-		lines.push(`  ${style.bold("Top tool errors:")}`);
-		for (const { message, count } of summary.toolErrorMessages) lines.push(`    ${count}× ${message}`);
-	}
-	if (summary.stoppedEarly !== void 0) lines.push(`  ${style.red("Stopped early")} (${summary.stoppedEarly.reason}): ${summary.stoppedEarly.detail}`);
-	const c = summary.connections;
-	if (c !== void 0) {
-		const failed = `${c.failed} failed`;
-		const connect = c.connectMs === null ? "" : ` (connect p50 ${c.connectMs.p50} / max ${c.connectMs.max} ms)`;
-		lines.push(`  Sessions:   ${c.opened} of ${c.requested} opened, ${c.failed > 0 ? style.red(failed) : failed}${connect}`);
-		for (const { message, count } of c.errorMessages) lines.push(`    ${count}× ${message}`);
-	}
-	return lines.join("\n");
-}
 function formatRpcResultHuman(method, result, style = PLAIN) {
 	switch (method) {
 		case "tools/list": return formatToolsHuman(asArray(result.tools), style);
@@ -1550,8 +2226,7 @@ function formatRpcResultHuman(method, result, style = PLAIN) {
 		default: return null;
 	}
 }
-//#endregion
-//#region src/connection/format-connection.ts
+// src/connection/format-connection.ts
 function formatConnectionJson(data) {
 	return JSON.stringify(data, null, 2).replace(/[\u0080-\u009F]/g, (ch) => `\\u${ch.charCodeAt(0).toString(16).padStart(4, "0")}`) + "\n";
 }
@@ -1600,6 +2275,7 @@ function jsonPayload(payload) {
 		case "daemon/stop": return payload.result;
 		case "auth/list": return payload.list;
 		case "auth/clear": return payload.result;
+		case "auth/show": return payload.result;
 		case "auth/ema-status": return payload.status;
 		case "auth/ema-login": return payload.result;
 		case "auth/ema-logout": return payload.result;
@@ -1673,6 +2349,7 @@ function humanPayload(payload, style, interactive) {
 		case "auth/clear":
 			if (payload.result.all === true) return style.green(`Cleared ${String(payload.result.cleared ?? 0)} stored auth entr${payload.result.cleared === 1 ? "y" : "ies"}.`);
 			return `${style.green("Cleared")} \`${style.bold(String(payload.result.url ?? ""))}\`${payload.result.clearedByName ? style.dim(` (${String(payload.result.clearedByName)})`) : ""}`;
+		case "auth/show": return formatAuthShowHuman(payload.result, payload.nowMs, style);
 		case "auth/ema-status": return formatEmaStatusHuman(payload.status, style);
 		case "auth/ema-login":
 			if (payload.result.alreadyLoggedIn) return `${style.green("Already signed in")} to \`${style.bold(payload.result.issuer)}\` ${style.dim("(use auth/ema-login --relogin for a fresh connection)")}`;
@@ -1714,8 +2391,7 @@ function applyExitCodes(payload) {
 		if (payload.result.isError === true) throw new CliExitCodeError(EXIT_CODES.TOOL_ERROR, `Tool '${sanitizeText(payload.toolName ?? "tool")}' returned isError:true.`, { code: "tool_is_error" });
 	}
 }
-//#endregion
-//#region src/connection/form-prompt.ts
+// src/connection/form-prompt.ts
 function watchForClose(rl) {
 	return new Promise((_, reject) => {
 		rl.once("close", () => reject(/* @__PURE__ */ new Error("stdin closed before an answer was given")));
@@ -1857,8 +2533,7 @@ async function promptForm(rl, message, fields, style) {
 		values.set(field.name, await promptField(rl, closed, field, style));
 	}
 }
-//#endregion
-//#region src/connection/prompt-reader.ts
+// src/connection/prompt-reader.ts
 function exhaustedError() {
 	return /* @__PURE__ */ new Error("stdin closed before an answer was given");
 }
@@ -1947,8 +2622,7 @@ function getSharedPromptReader() {
 	shared ??= new PromptReader();
 	return shared;
 }
-//#endregion
-//#region src/connection/elicitation-prompt.ts
+// src/connection/elicitation-prompt.ts
 function cancelResponse(frame) {
 	return {
 		id: frame.id,
@@ -2013,10 +2687,15 @@ async function promptElicitation(frame, opts) {
 		return cancelResponse(frame);
 	}
 }
-//#endregion
-//#region src/connection/dispatch.ts
+// src/connection/dispatch.ts
 const STREAM_METHODS = /* @__PURE__ */ new Set(["logging/tail", "resources/subscribe"]);
 const NDJSON_VARIANTS = /* @__PURE__ */ new Set(["skills/list", "skills/get"]);
+function loadOptionsFor(load, format) {
+	if (format === "text") return load.options;
+	const rest = { ...load.options };
+	delete rest.progressMs;
+	return rest;
+}
 async function dispatchConnectionRpc(method, methodArgs, opts) {
 	const format = opts.format ?? "text";
 	const style = styleFromOpts({
@@ -2028,7 +2707,7 @@ async function dispatchConnectionRpc(method, methodArgs, opts) {
 		method,
 		name: stripAt(opts.connection),
 		requireExplicit: opts.requireExplicit,
-		...opts.load !== void 0 && { load: opts.load.options }
+		...opts.load !== void 0 && { load: loadOptionsFor(opts.load, format) }
 	};
 	const { socketPath } = await ensureDaemon();
 	if (STREAM_METHODS.has(method)) {
@@ -2072,6 +2751,10 @@ async function dispatchConnectionRpc(method, methodArgs, opts) {
 			socketPath,
 			timeoutMs: 0,
 			signal: ac.signal,
+			onLoadProgress: (progress) => {
+				if (process.stderr.writableNeedDrain) return;
+				process.stderr.write(`${formatLoadProgress(progress)}\n`);
+			},
 			onElicitation: (frame) => promptElicitation(frame, {
 				style,
 				interactive
@@ -2087,7 +2770,11 @@ async function dispatchConnectionRpc(method, methodArgs, opts) {
 	}, method, methodArgs.toolName, outcome);
 	if (outcome.kind === "load") {
 		for (const warning of loadSummaryWarnings(outcome.summary)) await awaitableError(`${warning}\n`);
+		const baseline = opts.load?.baseline;
+		const comparison = baseline !== void 0 ? compareLoadToBaseline(outcome.summary, baseline.baseline) : void 0;
+		for (const line of comparison !== void 0 ? formatLoadBaselineComparison(comparison) : []) await awaitableError(`${line}\n`);
 		checkLoadThresholds(outcome.summary, opts.load?.thresholds);
+		if (comparison !== void 0) checkLoadRegression(comparison, baseline.maxRegressionPct);
 	}
 }
 async function writeRpcOutcome(out, method, toolName, outcome) {
@@ -2167,8 +2854,7 @@ function hoistAtConnection(argv) {
 	}
 	return { argv };
 }
-//#endregion
-//#region src/connection/private-env.ts
+// src/connection/private-env.ts
 function createPrivateBinding() {
 	return {
 		dir: createPrivateDaemonDir(),
@@ -2185,8 +2871,7 @@ function formatPrivateEnvExports(binding) {
 function shellSingleQuote(value) {
 	return `'${value.replace(/'/g, `'\\''`)}'`;
 }
-//#endregion
-//#region src/connection/stored-auth.ts
+// src/connection/stored-auth.ts
 function normalizeServerUrl(serverUrl) {
 	try {
 		return new URL(serverUrl).href;
@@ -2238,6 +2923,21 @@ async function resolveStoredAuthKey(key) {
 	if (normalized !== trimmed || /^https?:\/\//i.test(trimmed)) return normalized;
 	throw new CliExitCodeError(EXIT_CODES.USAGE, `No stored auth entry for '${trimmed}'. Use auth/list to see keys.`, { code: "usage" });
 }
+async function showStoredAuth(key) {
+	const url = await resolveStoredAuthKey(key);
+	const tokens = await new NodeOAuthStorage().getTokens(url);
+	if (!tokens?.access_token) return {
+		url,
+		hasTokens: false,
+		hasRefreshToken: false
+	};
+	return {
+		url,
+		hasTokens: true,
+		hasRefreshToken: Boolean(tokens.refresh_token),
+		accessToken: summarizeAccessToken(tokens)
+	};
+}
 async function clearStoredAuth(key) {
 	const url = await resolveStoredAuthKey(key);
 	await new NodeOAuthStorage().clear(url);
@@ -2256,8 +2956,7 @@ async function clearStoredAuthForRelogin(serverUrl) {
 	await new NodeOAuthStorage().clear(url);
 	resetNodeOAuthStorageCache();
 }
-//#endregion
-//#region src/connection/auth-names.ts
+// src/connection/auth-names.ts
 function urlIfHttp(value) {
 	if (value && /^https?:\/\//i.test(value)) return normalizeServerUrl(value);
 }
@@ -2322,8 +3021,7 @@ function resolveFriendlyName(name, index) {
 		name
 	};
 }
-//#endregion
-//#region src/connection/mcp.ts
+// src/connection/mcp.ts
 function isDaemonUnreachable(error) {
 	return error instanceof CliExitCodeError && error.envelope?.code === "daemon_unreachable";
 }
@@ -2486,7 +3184,7 @@ function registerConnect(program) {
 			"both"
 		].includes(value)) throw new Error(`Invalid --elicit: ${value}. Use off, url, form, or both.`);
 		return value;
-	}).option("--ema", "Treat the server as enterprise-managed (EMA): mint tokens from the signed-in enterprise IdP session instead of standard OAuth. Overrides the catalog/config entry's oauth.enterpriseManaged. Requires install-level IdP config (see auth/ema-status) and per-server OAuth client id/secret from the catalog entry, so it cannot be used with an ad-hoc target.").action(async (target, cmdOpts) => {
+	}).option("--ema", "Treat the server as enterprise-managed (EMA): mint tokens from the signed-in enterprise IdP session instead of standard OAuth. Overrides the catalog/config entry's oauth.enterpriseManaged. Requires install-level IdP config (see auth/ema-status) and per-server OAuth client id/secret from the catalog entry, so it cannot be used with an ad-hoc target.").option("--oauth-debug", "Print each OAuth step to stderr: protected-resource and authorization-server metadata URLs and statuses, the client registration request and response, the authorization URL, and the token request and response, with tokens, codes and secrets redacted. Runs the sign-in in this process before the daemon connects, so the whole flow is traced here (an HTTP/SSE server with a valid stored token makes no OAuth requests; add --relogin to trace a fresh login).").action(async (target, cmdOpts) => {
 		const opts = program.opts();
 		const { name: positionalConnection, rest } = splitConnectionTarget(target);
 		const connectionName = stripAt(opts.connection) ?? positionalConnection ?? cmdOpts.server?.trim() ?? rest[0];
@@ -2515,6 +3213,10 @@ function registerConnect(program) {
 		const { detail } = summarizeServerConfig(serverConfig);
 		const name = stripAt(connectionName);
 		if (relogin && "url" in serverConfig && serverConfig.url) await clearStoredAuthForRelogin(serverConfig.url);
+		if (cmdOpts.oauthDebug === true) await authorizeInFrontend(serverConfig, serverSettings, {
+			storedAuthOnly: opts.storedAuthOnly === true,
+			oauthDebug: true
+		});
 		const { socketPath } = await ensureDaemon();
 		const connectParams = {
 			name,
@@ -2531,7 +3233,7 @@ function registerConnect(program) {
 		} catch (error) {
 			if (!(error instanceof CliExitCodeError) || error.envelope?.code !== "auth_required") throw error;
 			if (opts.storedAuthOnly) throw error;
-			if (!(process.stdin.isTTY === true || process.stderr.isTTY === true) && !isCliAutoOpenForced()) {
+			if (!(process.stdin.isTTY === true || process.stderr.isTTY === true) && !isCliAutoOpenForced() && cmdOpts.oauthDebug !== true) {
 				const authUrl = await obtainPendingAuthUrl(serverConfig, serverSettings);
 				const { socketPath: pendingSocketPath } = await ensureDaemon();
 				const pending = await callDaemon("connect", {
@@ -2548,7 +3250,10 @@ function registerConnect(program) {
 				});
 				return;
 			}
-			await authorizeInFrontend(serverConfig, serverSettings, { storedAuthOnly: false });
+			await authorizeInFrontend(serverConfig, serverSettings, {
+				storedAuthOnly: false,
+				oauthDebug: cmdOpts.oauthDebug === true
+			});
 			const { socketPath: freshSocketPath } = await ensureDaemon();
 			result = await callDaemon("connect", connectParams, {
 				socketPath: freshSocketPath,
@@ -2575,6 +3280,24 @@ async function collectAuthNameIndex(opts) {
 	}
 	return buildAuthNameIndex(entries, connections);
 }
+async function resolveAuthKeyArgument(trimmed, opts, action) {
+	const storedKeys = (await listStoredAuth()).servers.map((s) => s.url);
+	if (storedKeys.includes(trimmed)) return { key: trimmed };
+	if (/^https?:\/\//i.test(trimmed)) {
+		const idpKey = idpOAuthStorageKey(trimmed);
+		return { key: storedKeys.includes(idpKey) && !storedKeys.includes(normalizeServerUrl(trimmed)) ? idpKey : trimmed };
+	}
+	const resolution = resolveFriendlyName(trimmed, await collectAuthNameIndex(opts));
+	switch (resolution.kind) {
+		case "no-url": throw new CliExitCodeError(EXIT_CODES.USAGE, `'${trimmed}' is a stdio server — it has no stored OAuth entry to ${action}.`, { code: "usage" });
+		case "ambiguous": throw new CliExitCodeError(EXIT_CODES.USAGE, `'${trimmed}' maps to multiple server URLs (${resolution.urls.join(", ")}). Pass the explicit URL from auth/list.`, { code: "usage" });
+		case "unknown": throw new CliExitCodeError(EXIT_CODES.USAGE, `No server named '${trimmed}'. Use auth/list or servers/list to see names, or pass a URL.`, { code: "usage" });
+		case "url": return {
+			key: resolution.url,
+			byName: trimmed
+		};
+	}
+}
 function registerAuthCommands(program) {
 	program.command(AUTH_HELPER_COMMAND, { hidden: true }).description("Internal: complete an OAuth sign-in (params JSON on stdin)").action(async () => {
 		await runAuthHelper();
@@ -2638,42 +3361,30 @@ function registerAuthCommands(program) {
 			});
 			return;
 		}
-		const trimmed = key.trim();
-		const storedKeys = (await listStoredAuth()).servers.map((s) => s.url);
-		if (storedKeys.includes(trimmed)) {
-			const result = await clearStoredAuth(trimmed);
-			await writeConnectionOutput(outOpts(opts), {
-				kind: "auth/clear",
-				result: { url: result.url }
-			});
-			return;
-		}
-		if (/^https?:\/\//i.test(trimmed)) {
-			const idpKey = idpOAuthStorageKey(trimmed);
-			const result = await clearStoredAuth(storedKeys.includes(idpKey) && !storedKeys.includes(normalizeServerUrl(trimmed)) ? idpKey : trimmed);
-			await writeConnectionOutput(outOpts(opts), {
-				kind: "auth/clear",
-				result: { url: result.url }
-			});
-			return;
-		}
-		const resolution = resolveFriendlyName(trimmed, await collectAuthNameIndex(opts));
-		switch (resolution.kind) {
-			case "no-url": throw new CliExitCodeError(EXIT_CODES.USAGE, `'${trimmed}' is a stdio server — it has no stored OAuth entry to clear.`, { code: "usage" });
-			case "ambiguous": throw new CliExitCodeError(EXIT_CODES.USAGE, `'${trimmed}' maps to multiple server URLs (${resolution.urls.join(", ")}). Pass the explicit URL from auth/list.`, { code: "usage" });
-			case "unknown": throw new CliExitCodeError(EXIT_CODES.USAGE, `No server named '${trimmed}'. Use auth/list or servers/list to see names, or pass a URL.`, { code: "usage" });
-			case "url": {
-				const result = await clearStoredAuth(resolution.url);
-				await writeConnectionOutput(outOpts(opts), {
-					kind: "auth/clear",
-					result: {
-						url: result.url,
-						clearedByName: trimmed
-					}
-				});
-				return;
+		const target = await resolveAuthKeyArgument(key.trim(), opts, "clear");
+		const result = await clearStoredAuth(target.key);
+		await writeConnectionOutput(outOpts(opts), {
+			kind: "auth/clear",
+			result: {
+				url: result.url,
+				...target.byName !== void 0 && { clearedByName: target.byName }
 			}
-		}
+		});
+	});
+	program.command("auth/show").description("Show the stored access token's decoded claims (issuer, audience, scopes, expiry) for one server — never the token itself").argument("<key>", "Server URL or catalog/connection name from auth/list").action(async (key) => {
+		const opts = program.opts();
+		const trimmed = key.trim();
+		if (!trimmed) throw new CliExitCodeError(EXIT_CODES.USAGE, "auth/show requires a server URL key (from auth/list)", { code: "usage" });
+		const target = await resolveAuthKeyArgument(trimmed, opts, "show");
+		const result = await showStoredAuth(target.key);
+		await writeConnectionOutput(outOpts(opts), {
+			kind: "auth/show",
+			result: {
+				...result,
+				...target.byName !== void 0 && { shownByName: target.byName }
+			},
+			nowMs: Date.now()
+		});
 	});
 	program.command("auth/ema-status").description("Show enterprise-managed auth (EMA) configuration and IdP login state").action(async () => {
 		const opts = program.opts();
@@ -2863,7 +3574,7 @@ function registerRpcCommands(program) {
 				});
 				break;
 			case "tools/call":
-				cmd.argument("[toolName]", "Tool name").argument("[toolArgs...]", "Arguments as key:=value pairs or a JSON object").option("--tool-name <name>", "Tool name").option("--tool-arg <pairs...>", "Tool argument as key=value pair (alternative to key:=value positionals)", parseKeyValue, {}).option("--tool-args-json <json>", "Tool arguments as a JSON object (alternative to inline JSON positional)").option("--tool-metadata <pairs...>", "Tool-specific metadata", parseKeyValue, {}).option("--task", "Request a task-augmented tool call (legacy servers; on modern the server decides)").option("--app-info", "Probe MCP App metadata only").option("--load", "Load-test the tool: call it repeatedly and concurrently, then print a latency and error-rate summary instead of a result. Bounded by --load-duration (default 10s) and/or --load-requests. Later commands on this connection wait until the run ends.").option("--load-concurrency <n>", "With --load: most calls in flight at once (positive integer; default 10).", positiveIntegerParser("--load-concurrency")).option("--load-connections <n>", "With --load: spread the calls over this many independent sessions to the connection's HTTP or SSE server, opened before timing starts with stored credentials only (positive integer, at most --load-concurrency; default 1).", positiveIntegerParser("--load-connections")).option("--load-duration <sec>", "With --load: stop starting calls after this many seconds; in-flight calls still finish (default 10 when --load-requests is not set).", positiveNumberParser("--load-duration")).option("--load-requests <n>", "With --load: stop after starting this many calls (positive integer).", positiveIntegerParser("--load-requests")).option("--load-rate <n>", "With --load: start at most this many calls per second, spread evenly (positive number; default unlimited).", positiveNumberParser("--load-rate")).option("--load-max-error-rate <fraction>", "With --load: exit 10 (load_error_rate_exceeded) when the share of failed calls is above this value, after printing the summary (0 to 1; 0 fails on any failed call).", fractionParser("--load-max-error-rate")).option("--load-max-p99 <ms>", "With --load: exit 10 (load_p99_exceeded) when the p99 latency of the successful calls is above this many milliseconds, or when no call succeeded, after printing the summary (positive number).", maxP99Parser);
+				cmd.argument("[toolName]", "Tool name").argument("[toolArgs...]", "Arguments as key:=value pairs or a JSON object").option("--tool-name <name>", "Tool name").option("--tool-arg <pairs...>", "Tool argument as key=value pair (alternative to key:=value positionals)", parseKeyValue, {}).option("--tool-args-json <json>", "Tool arguments as a JSON object (alternative to inline JSON positional)").option("--tool-metadata <pairs...>", "Tool-specific metadata", parseKeyValue, {}).option("--task", "Request a task-augmented tool call (legacy servers; on modern the server decides)").option("--app-info", "Probe MCP App metadata only").option("--load", "Load-test the tool: call it repeatedly and concurrently, then print a latency and error-rate summary instead of a result. Bounded by --load-duration (default 10s) and/or --load-requests. Later commands on this connection wait until the run ends.").option("--load-scenario <file>", "With --load: run the weighted mix of tools/call, resources/read and prompts/get steps in this JSON file instead of one tool, and break the summary down per step. Replaces the tool name, its arguments and --tool-metadata.").option("--load-args-file <file>", "With --load: NDJSON file of argument objects, one per line; each call merges the next row over the tool arguments (row wins), cycling. Placeholders {{seq}}, {{worker}}, {{uuid}} and {{rand:<min>-<max>}} work in rows and in argument values.").option("--load-args-random", "With --load-args-file: pick each call's row at random instead of in turn.").option("--load-steps <list>", "With --load: run consecutive stages at these levels (comma-separated, e.g. 10,25,50,100), each for --load-step-duration, with one summary row per stage. Levels are concurrency unless --load-step-by rate.", loadStepsParser).option("--load-ramp <from:to:sec>", "With --load: a staircase of stages from <from> to <to> over <sec> seconds, one stage per --load-step-duration, levels spaced evenly (concurrency unless --load-step-by rate).", loadRampParser).option("--load-step-by <what>", "With --load-steps or --load-ramp: what each level sets, concurrency (default) or rate (calls per second over --load-concurrency workers).", loadStepByParser).option("--load-step-duration <sec>", "With --load-steps or --load-ramp: how long each stage runs (default 10).", positiveNumberParser("--load-step-duration")).option("--load-interval <sec>", "With --load: also report the run as a time series of buckets this many seconds long (completions, errors, latency per bucket) in an intervals array.", positiveNumberParser("--load-interval")).option("--load-warmup <sec>", "With --load: run this many seconds first at the same concurrency and rate, and leave those calls out of every statistic.", positiveNumberParser("--load-warmup")).option("--load-progress <sec>", "With --load: print a progress line on stderr this often (default 5). Shown with --format text only; --format json prints none.", positiveNumberParser("--load-progress")).option("--load-open-loop", "With --load-rate: open-loop mode. Keep every slot of the rate grid instead of dropping the ones no worker is free for, and time each call from its scheduled start, so queueing shows in the latency.").option("--load-stop-on-breach", "With --load-steps or --load-ramp and a --load-max-* threshold: stop after the first stage that breaches it (the run still exits 10).").option("--load-subscribe <uri>", "With --load: notification fan-out. Subscribe --load-subscribers sessions to this resource and report how notifications/resources/updated reaches them: per-notification delivery latency, misses per session, and subscribe cost. With a tool name (or --load-scenario) each successful call is a trigger and latency runs from its start; without one the run listens for --load-duration to the server's own updates. Triggers run one at a time.").option("--load-subscribers <n>", "With --load-subscribe: sessions to subscribe, this connection included (positive integer; default 1; above 1 needs an HTTP or SSE connection, and opens the rest with stored credentials).", positiveIntegerParser("--load-subscribers")).option("--load-subscribe-wait <sec>", "With --load-subscribe: how long subscribers get to catch up after the run before a notification counts as missed (default 2).", positiveNumberParser("--load-subscribe-wait")).option("--load-churn", "With --load: session churn. Each worker opens a session to the connection's HTTP or SSE server with stored credentials, makes --load-churn-calls calls, closes it, and repeats; connect times and failures are reported apart from call latency. Not with --load-connections.").option("--load-churn-calls <n>", "With --load-churn: calls per session before it is closed (positive integer; default 1).", positiveIntegerParser("--load-churn-calls")).option("--load-concurrency <n>", "With --load: most calls in flight at once (positive integer; default 10).", positiveIntegerParser("--load-concurrency")).option("--load-connections <n>", "With --load: spread the calls over this many independent sessions to the connection's HTTP or SSE server, opened before timing starts with stored credentials only (positive integer, at most --load-concurrency; default 1).", positiveIntegerParser("--load-connections")).option("--load-duration <sec>", "With --load: stop starting calls after this many seconds; in-flight calls still finish (default 10 when --load-requests is not set).", positiveNumberParser("--load-duration")).option("--load-requests <n>", "With --load: stop after starting this many calls (positive integer).", positiveIntegerParser("--load-requests")).option("--load-rate <n>", "With --load: start at most this many calls per second, spread evenly (positive number; default unlimited).", positiveNumberParser("--load-rate")).option("--load-max-error-rate <fraction>", "With --load: exit 10 (load_error_rate_exceeded) when the share of failed calls is above this value, after printing the summary (0 to 1; 0 fails on any failed call).", fractionParser("--load-max-error-rate")).option("--load-max-p99 <ms>", "With --load: exit 10 (load_p99_exceeded) when the p99 latency of the successful calls is above this many milliseconds, or when no call succeeded, after printing the summary (positive number).", maxP99Parser).option("--load-max-p50 <ms>", "With --load: exit 10 (load_p50_exceeded) when the p50 latency of the successful calls is above this many milliseconds, or when no call succeeded, after printing the summary (positive number).", maxP50Parser).option("--load-max-p95 <ms>", "With --load: exit 10 (load_p95_exceeded) when the p95 latency of the successful calls is above this many milliseconds, or when no call succeeded, after printing the summary (positive number).", maxP95Parser).option("--load-min-throughput <n>", "With --load: exit 10 (load_throughput_below) when fewer than this many calls per second succeeded (okThroughput), after printing the summary (positive number).", minThroughputParser).option("--load-baseline <file>", "With --load: compare the run's p50, p99, error rate and ok throughput against a summary saved from an earlier run with --format json, printing the comparison on stderr. The runs must be shaped alike (same tool or scenario, concurrency, bounds, rate, connections and stages), or the run exits 1 (load_baseline_mismatch).").option("--load-max-regression <pct>", "With --load-baseline: exit 10 (load_regression) when p50 or p99 is higher, or ok throughput lower, than the baseline by more than this percentage, or the error rate higher by more than this many percentage points (e.g. 10 or 10%).", maxRegressionParser);
 				cmd.action(async (toolNamePos, toolArgsPos, o) => {
 					const { toolName, toolArg } = resolveToolCallArgs({
 						toolNameFlag: o.toolName,
@@ -2874,7 +3585,9 @@ function registerRpcCommands(program) {
 					});
 					const load = resolveLoadFlags({
 						...o,
-						toolName
+						toolName,
+						toolArg,
+						toolMetadata: o.toolMetadata
 					});
 					await runRpc(program, method, {
 						toolName,
@@ -2927,7 +3640,7 @@ function registerRpcCommands(program) {
 				});
 				break;
 			case "prompts/get":
-				cmd.argument("[promptName]", "Prompt name").option("--prompt-name <name>", "Prompt name").option("--prompt-args <pairs...>", "Prompt arguments", parseKeyValue, {});
+				cmd.argument("[promptName]", "Prompt name").option("--prompt-name <name>", "Prompt name").option("--prompt-args <pairs...>", "Prompt arguments as key=value pairs (values are sent verbatim as strings)", parsePromptArgPair, {});
 				cmd.action(async (promptPos, o) => {
 					await runRpc(program, method, {
 						promptName: o.promptName ?? promptPos,
@@ -3133,8 +3846,7 @@ function splitConnectionTarget(target) {
 		rest: target
 	};
 }
-//#endregion
-//#region src/mcp-bin.ts
+// src/mcp-bin.ts
 disallowMemorySecretStoreFallback();
 setSecretStorageWarningsQuiet(true);
 const __filename = fileURLToPath(import.meta.url);
@@ -3148,5 +3860,4 @@ function isMainModule() {
 	}
 }
 if (isMainModule()) runMcp(process.argv).then(() => process.exit(0)).catch(handleError);
-//#endregion
 export { runMcp };