@modelcontextprotocol/inspector 2.3.0 → 2.4.0

package/clients/tui/build/index.js

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
-import "./chunk-MCKGQKYU.js";
 
 // index.ts
-import { resolve as resolve3 } from "path";
+import { resolve as resolve6 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // tui.tsx
@@ -132,6 +131,22 @@ var SECRET_FIELD_IDP_CLIENT_SECRET = "idp-client-secret";
 var envSecretField = (envKey) => `env:${envKey}`;
 
 // ../../core/json/jsonUtils.ts
+function isSerializableJson(value) {
+  if (value === null) return true;
+  switch (typeof value) {
+    case "string":
+    case "boolean":
+      return true;
+    case "number":
+      return Number.isFinite(value);
+    case "object":
+      return Array.isArray(value) ? value.every(isSerializableJson) : Object.values(value).every(
+        isSerializableJson
+      );
+    default:
+      return false;
+  }
+}
 function toRecord(value) {
   return value;
 }
@@ -241,6 +256,60 @@ function envPairsToRecord(pairs) {
   }
   return out;
 }
+function normalizeStoredMetadata(metadata) {
+  if (metadata === void 0 || metadata === null) return {};
+  if (Array.isArray(metadata)) {
+    const out = {};
+    for (const entry of metadata) {
+      if (typeof entry !== "object" || entry === null || typeof entry.key !== "string") {
+        console.warn(
+          "Ignoring malformed legacy metadata entry (expected `{ key, value }`)."
+        );
+        continue;
+      }
+      const { key, value } = entry;
+      if (key.trim() === "") continue;
+      const resolved2 = value === void 0 ? "" : value;
+      if (!keepSerializable(key, resolved2)) continue;
+      defineMetadataKey(out, key, resolved2);
+    }
+    return out;
+  }
+  if (typeof metadata === "object") {
+    const out = {};
+    for (const [key, value] of Object.entries(metadata)) {
+      if (keepSerializable(key, value)) defineMetadataKey(out, key, value);
+    }
+    return out;
+  }
+  console.warn(
+    `Ignoring malformed \`metadata\` (expected a JSON object, got ${describeJsonType(metadata)}).`
+  );
+  return {};
+}
+function defineMetadataKey(out, key, value) {
+  Object.defineProperty(out, key, {
+    value,
+    writable: true,
+    enumerable: true,
+    configurable: true
+  });
+}
+function keepSerializable(key, value) {
+  if (isSerializableJson(value)) return true;
+  console.warn(
+    `Ignoring metadata key "${key}" \u2014 its value is not JSON that can be sent (got ${describeJsonType(value)}; note \`1e400\` parses to Infinity).`
+  );
+  return false;
+}
+function describeJsonType(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "array";
+  if (typeof value === "number" && !Number.isFinite(value)) {
+    return Number.isNaN(value) ? "NaN" : "a non-finite number";
+  }
+  return typeof value;
+}
 function cleanAuthorizationParams(params) {
   if (params === void 0) return void 0;
   if (typeof params !== "object" || params === null || Array.isArray(params)) {
@@ -294,7 +363,7 @@ function storedFieldsToInspectorSettings(stored) {
   const settings = {
     headers: headersPairs,
     env: envRecordToPairs(stored.env),
-    metadata: stored.metadata ?? [],
+    metadata: normalizeStoredMetadata(stored.metadata),
     connectionTimeout: stored.connectionTimeout ?? 0,
     requestTimeout: stored.requestTimeout ?? 0,
     // Unlike the timeouts (0 = "SDK default"), task TTL has a concrete product
@@ -343,6 +412,9 @@ function storedFieldsToInspectorSettings(stored) {
   if (stored.oauth?.enterpriseManaged === true) {
     settings.enterpriseManaged = true;
   }
+  if (stored.oauth?.requestRefreshToken === false) {
+    settings.oauthRequestRefreshToken = false;
+  }
   if (stored.cwd) settings.cwd = stored.cwd;
   return settings;
 }
@@ -657,155 +729,1427 @@ function resolveServerConfigs(options, mode) {
           cwd: options.cwd
         })
       );
-      return configs;
+      return configs;
+    }
+    return [buildConfigFromOptions(options)];
+  }
+  return [];
+}
+
+// ../../core/auth/node/secret-store-selection.ts
+import { randomUUID } from "crypto";
+import * as fsSync from "fs";
+import * as fs4 from "fs/promises";
+import * as path4 from "path";
+
+// ../../core/auth/secret-storage-info.ts
+function secretStorageLabel(info) {
+  switch (info.kind) {
+    case "keyring":
+      return "OS keychain";
+    case "file":
+      if (info.encryptionUnknown !== void 0) return "File (unreadable)";
+      return info.plaintext ? "File (unencrypted)" : "File (encrypted)";
+    case "memory":
+      return "Memory (this session only)";
+  }
+}
+function secretStorageCaveat(info) {
+  if (info.kind === "memory") {
+    return "Secrets are not written anywhere and are lost on exit.";
+  }
+  if (info.looseMode !== void 0) {
+    const mode = info.looseMode.toString(8).padStart(4, "0");
+    if (info.encryptionUnknown !== void 0) {
+      return `The secrets file is mode ${mode}, not 0600, and could not be tightened \u2014 others can copy it, and whether that exposes the secrets depends on encryption this build could not determine (${info.encryptionUnknown}).`;
+    }
+    return info.plaintext === false ? `The secrets file is mode ${mode}, not 0600, and could not be tightened \u2014 others can copy it, and the passphrase is then the only thing protecting its contents.` : `The secrets file is mode ${mode}, not 0600, and could not be tightened \u2014 anyone who can read it can read the secrets in it.`;
+  }
+  if (info.permissionsUnknown !== void 0) {
+    return `The secrets file's permissions could not be checked (${info.permissionsUnknown}), so it is not known whether others can read it.`;
+  }
+  if (info.encryptionUnknown !== void 0) {
+    return `The secrets file could not be read (${info.encryptionUnknown}). Saving a secret will fail rather than overwrite it.`;
+  }
+  if (info.plaintext) {
+    return info.pendingEncryption ? "Existing secrets in this file are still unencrypted (file mode 0600). They are re-encrypted the next time a secret is saved." : "Secrets are stored unencrypted (file mode 0600). Set MCP_INSPECTOR_SECRET_KEY to encrypt them.";
+  }
+  return void 0;
+}
+function secretStorageSummary(info) {
+  const parts = [secretStorageLabel(info)];
+  if (info.path) parts.push(`at ${info.path}`);
+  if (info.reason === "fallback") {
+    parts.push("\u2014 fell back from the OS keychain");
+  }
+  return parts.join(" ");
+}
+
+// ../../core/auth/node/file-secret-store.ts
+import * as crypto2 from "crypto";
+import * as fs3 from "fs/promises";
+import * as path3 from "path";
+
+// ../../core/auth/node/file-lock.ts
+import nodeFs, { statSync, rmdirSync } from "fs";
+import * as fs2 from "fs/promises";
+import * as path2 from "path";
+import properLockfile from "proper-lockfile";
+
+// ../../core/auth/node/secret-store.ts
+var SERVICE_NAME = "mcp-inspector";
+var keyringLoad;
+var KeyringModuleShapeError = class extends Error {
+  constructor(detail, options) {
+    super(`@napi-rs/keyring loaded but ${detail}`, options);
+    this.name = "KeyringModuleShapeError";
+  }
+};
+var checkKeyringShape = (mod) => {
+  try {
+    if (typeof mod.AsyncEntry === "function" && typeof mod.findCredentialsAsync === "function") {
+      return { ok: true, mod };
+    }
+    return {
+      ok: false,
+      err: new KeyringModuleShapeError(
+        "did not expose AsyncEntry / findCredentialsAsync"
+      )
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      err: new KeyringModuleShapeError(
+        `its exports could not be read: ${err instanceof Error ? err.message : String(err)}`,
+        { cause: err }
+      )
+    };
+  }
+};
+var loadKeyring = () => {
+  keyringLoad ??= import("@napi-rs/keyring").then(
+    checkKeyringShape,
+    (err) => ({ ok: false, err })
+  );
+  return keyringLoad;
+};
+function parseAccount(account) {
+  const idx = account.indexOf(":");
+  if (idx <= 0 || idx === account.length - 1) return null;
+  return {
+    serverId: account.slice(0, idx),
+    field: account.slice(idx + 1)
+  };
+}
+var buildAccount = (serverId, field) => `${serverId}:${field}`;
+var SecretStoreUnavailableError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "SecretStoreUnavailableError";
+  }
+};
+var KeychainUnavailableError = class extends SecretStoreUnavailableError {
+  constructor(cause) {
+    const message = cause instanceof Error ? cause.message : String(cause);
+    super(
+      `OS keychain is not available. ${hintFor(cause, message)} Underlying error: ${message}`
+    );
+    this.name = "KeychainUnavailableError";
+  }
+};
+var hintFor = (cause, message) => {
+  if (cause instanceof KeyringModuleShapeError) {
+    return `The @napi-rs/keyring package loaded but does not expose the API this build expects \u2014 most likely a version or packaging mismatch; reinstall the Inspector, and report this if it persists.`;
+  }
+  if (message.includes("Cannot find native binding")) {
+    return `The @napi-rs/keyring platform package for this OS is missing or unavailable \u2014 reinstall the Inspector (for npx, clear the npx cache under your npm cache directory first).`;
+  }
+  return `On Linux, install libsecret / gnome-keyring.`;
+};
+async function probeKeyringAvailable() {
+  const keyring = await loadKeyring();
+  if (!keyring.ok) {
+    const err = keyring.err;
+    return {
+      available: false,
+      detail: err instanceof Error ? err.message : String(err)
+    };
+  }
+  try {
+    const entry = new keyring.mod.AsyncEntry(SERVICE_NAME, PROBE_ACCOUNT);
+    await entry.getPassword();
+    return { available: true };
+  } catch (err) {
+    return {
+      available: false,
+      detail: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+var PROBE_ACCOUNT = "__inspector:probe";
+var KeyringSecretStore = class {
+  /**
+   * The intolerant read. Same lookup as {@link get}, minus the catch — a
+   * keychain that cannot answer must not be reported as an empty one to a
+   * caller that is about to write based on the answer.
+   */
+  async getStrict(serverId, field) {
+    try {
+      const keyring = await loadKeyring();
+      if (!keyring.ok) throw new KeychainUnavailableError(keyring.err);
+      const entry = new keyring.mod.AsyncEntry(
+        SERVICE_NAME,
+        buildAccount(serverId, field)
+      );
+      return await entry.getPassword() ?? null;
+    } catch (err) {
+      if (err instanceof KeychainUnavailableError) throw err;
+      throw new KeychainUnavailableError(err);
+    }
+  }
+  async get(serverId, field) {
+    try {
+      const keyring = await loadKeyring();
+      if (!keyring.ok) return null;
+      const entry = new keyring.mod.AsyncEntry(
+        SERVICE_NAME,
+        buildAccount(serverId, field)
+      );
+      const v = await entry.getPassword();
+      return v ?? null;
+    } catch {
+      return null;
+    }
+  }
+  async set(serverId, field, value) {
+    try {
+      const keyring = await loadKeyring();
+      if (!keyring.ok) throw new KeychainUnavailableError(keyring.err);
+      const entry = new keyring.mod.AsyncEntry(
+        SERVICE_NAME,
+        buildAccount(serverId, field)
+      );
+      await entry.setPassword(value);
+    } catch (err) {
+      if (err instanceof KeychainUnavailableError) throw err;
+      throw new KeychainUnavailableError(err);
+    }
+  }
+  async delete(serverId, field) {
+    try {
+      const keyring = await loadKeyring();
+      if (!keyring.ok) return;
+      const entry = new keyring.mod.AsyncEntry(
+        SERVICE_NAME,
+        buildAccount(serverId, field)
+      );
+      await entry.deleteCredential();
+    } catch {
+    }
+  }
+  async deleteAllForServer(serverId) {
+    let creds;
+    try {
+      const keyring = await loadKeyring();
+      if (!keyring.ok) return;
+      creds = await keyring.mod.findCredentialsAsync(SERVICE_NAME);
+    } catch {
+      return;
+    }
+    const prefix = `${serverId}:`;
+    for (const c of creds) {
+      if (!c.account.startsWith(prefix)) continue;
+      const parsed = parseAccount(c.account);
+      if (!parsed || parsed.serverId !== serverId) continue;
+      await this.delete(serverId, parsed.field);
+    }
+  }
+};
+async function secretStoreGetStrict(store, serverId, field) {
+  return store.getStrict ? store.getStrict(serverId, field) : store.get(serverId, field);
+}
+async function secretStoreGetMany(store, requests) {
+  if (store.getMany) return store.getMany(requests);
+  const out = {};
+  await Promise.all(
+    requests.map(async ({ serverId, fields }) => {
+      const entries = await Promise.all(
+        fields.map(
+          async (field) => [field, await store.get(serverId, field)]
+        )
+      );
+      const found = {};
+      for (const [field, value] of entries) {
+        if (value !== null) found[field] = value;
+      }
+      out[serverId] = found;
+    })
+  );
+  return out;
+}
+async function secretStoreSetMany(store, serverId, values) {
+  if (store.setMany) return store.setMany(serverId, values);
+  await Promise.all(
+    Object.entries(values).map(
+      ([field, value]) => store.set(serverId, field, value)
+    )
+  );
+}
+async function secretStoreIsDurable(store) {
+  return store.isDurable ? store.isDurable() : true;
+}
+var InMemorySecretStore = class {
+  map = /* @__PURE__ */ new Map();
+  async get(serverId, field) {
+    return this.map.get(buildAccount(serverId, field)) ?? null;
+  }
+  async set(serverId, field, value) {
+    this.map.set(buildAccount(serverId, field), value);
+  }
+  async delete(serverId, field) {
+    this.map.delete(buildAccount(serverId, field));
+  }
+  async deleteAllForServer(serverId) {
+    const prefix = `${serverId}:`;
+    for (const key of [...this.map.keys()]) {
+      if (key.startsWith(prefix)) this.map.delete(key);
+    }
+  }
+};
+var SessionSecretStore = class extends InMemorySecretStore {
+  async isDurable() {
+    return false;
+  }
+};
+
+// ../../core/auth/node/file-lock.ts
+var STALE_MS = 1e4;
+var RETRY = {
+  retries: 20,
+  factor: 2,
+  minTimeout: 20,
+  maxTimeout: 1e3
+};
+var RETRY_BUDGET_MS = (() => {
+  let total = 0;
+  let delay = RETRY.minTimeout;
+  for (let i = 0; i < RETRY.retries; i++) {
+    total += Math.min(delay, RETRY.maxTimeout);
+    delay *= RETRY.factor;
+  }
+  return total;
+})();
+var warned = /* @__PURE__ */ new Set();
+function warnOnce(message) {
+  if (warned.has(message)) return;
+  warned.add(message);
+  console.warn(`[mcp-inspector] ${message}`);
+}
+function isStuckOrHeld(err, lockPath) {
+  return isHeldElsewhere(err) || identifySync(lockPath) !== null;
+}
+var isHeldElsewhere = (err) => err.code === "ELOCKED";
+var describeError = (err) => err instanceof Error ? err.message : String(err);
+var lockPathOf = (target) => `${target}.lock`;
+function identifySync(lockPath) {
+  try {
+    const stat2 = statSync(lockPath);
+    return { ino: stat2.ino, birthtimeMs: stat2.birthtimeMs };
+  } catch {
+    return null;
+  }
+}
+function guardedFs(lockPath, owned, onRefused) {
+  const mine = () => {
+    if (owned.id === null) return true;
+    const now = identifySync(lockPath);
+    if (now === null) return false;
+    return now.ino === owned.id.ino && now.birthtimeMs === owned.id.birthtimeMs;
+  };
+  const removeIfMine = () => {
+    if (!mine()) {
+      onRefused();
+      return;
+    }
+    rmdirSync(lockPath);
+  };
+  return {
+    ...nodeFs,
+    // **Identity is captured here, not after `lock()` resolves.** `mkdir` is
+    // the moment the directory becomes ours, and it is synchronous with
+    // respect to this process: recording it in the callback, before yielding,
+    // leaves no window. Capturing after the acquire promise settled — as this
+    // did originally — spans the library's own `utimes`/`stat` probe, and a
+    // waiter replacing our directory inside that span would have us record
+    // *the winner's* identity as our own, after which the guard below would
+    // cheerfully delete their lock.
+    mkdir: (p, cb) => {
+      nodeFs.mkdir(p, (err) => {
+        if (!err) owned.id = identifySync(lockPath);
+        cb(err);
+      });
+    },
+    // Reported as success when refused: the library's bookkeeping should
+    // forget this lock either way. Leaving it registered would hand the
+    // `signal-exit` handler a record pointing at the winner's directory.
+    rmdir: (_p, cb) => {
+      try {
+        removeIfMine();
+        cb(null);
+      } catch (err) {
+        cb(err);
+      }
+    },
+    /* v8 ignore next 3 -- @preserve: only reachable from proper-lockfile's
+       signal-exit handler, i.e. at real process exit, which no in-process
+       test can drive. Its logic is `removeIfMine`, covered via `rmdir`. */
+    rmdirSync: () => {
+      removeIfMine();
+    }
+  };
+}
+function acquire(target, retries, fsShim) {
+  return properLockfile.lock(target, {
+    realpath: false,
+    stale: STALE_MS,
+    retries,
+    // Every directory removal the library performs — on release and from its
+    // exit handler — routes through here. See `guardedFs`.
+    fs: fsShim,
+    // The library's default `onCompromised` *throws* — from a timer, with no
+    // caller on the stack, so it lands as an uncaught exception and takes the
+    // process down. This is also the library's *only* signal for the
+    // stale-takeover race described at the top of this file — someone
+    // declared our lock stale and replaced it — so it is the one place a user
+    // learns the guarantee was lost. Worth saying; not worth killing an
+    // Inspector session over.
+    onCompromised: (err) => warnOnce(
+      `The lock on the secrets file at ${target} was taken over by another process while a write was in progress (${err.message}). If a secret you just saved is missing, save it again.`
+    )
+  });
+}
+async function isFileLockHeld(filePath) {
+  try {
+    return await properLockfile.check(path2.resolve(filePath), {
+      realpath: false,
+      stale: STALE_MS
+    });
+  } catch {
+    return false;
+  }
+}
+async function openSecretFileLock(filePath) {
+  const target = path2.resolve(filePath);
+  await fs2.mkdir(path2.dirname(target), { recursive: true }).catch(() => {
+  });
+  const owned = { id: null };
+  const fsShim = guardedFs(
+    lockPathOf(target),
+    owned,
+    () => warnOnce(
+      `The lock on the secrets file at ${target} was taken over by another process while a write was in progress, so it was left alone rather than removed. If a secret you just saved is missing, save it again.`
+    )
+  );
+  let release;
+  try {
+    release = await acquire(target, 0, fsShim).catch((err) => {
+      if (!isStuckOrHeld(err, lockPathOf(target))) throw err;
+      return acquire(target, RETRY, fsShim);
+    });
+  } catch (err) {
+    if (isStuckOrHeld(err, lockPathOf(target))) {
+      throw new SecretStoreUnavailableError(
+        `Could not save to the secrets file at ${target}: its lock (${lockPathOf(target)}) was still held after the ${Math.round(RETRY_BUDGET_MS / 1e3)} seconds this save waited. Its secrets are intact; the value you just entered was not saved. If no other Inspector is running, remove that lock and try again.`
+      );
+    }
+    warnOnce(
+      `Could not take a lock on the secrets file at ${target} (${describeError(err)}), so writes to it are not protected against another process writing at the same moment.`
+    );
+    return null;
+  }
+  return async () => {
+    try {
+      await release();
+    } catch (err) {
+      if (err.code === "ERELEASED") return;
+      warnOnce(
+        // **Conditional, not an instruction.** Two blanket versions of this
+        // have now been wrong in opposite directions: "it expires on its own"
+        // (false whenever the same `rmdir` that blocked us also blocks stale
+        // takeover — `ENOTEMPTY`, `EACCES`, `EPERM`, `EROFS`), and "remove it
+        // by hand" (false whenever the failure was transient, since the path
+        // may by then hold a *different, live* Inspector's lock, and deleting
+        // that destroys the exclusion of a process that did nothing wrong).
+        //
+        // `proper-lockfile` forwards whatever the filesystem returned, and
+        // nothing here can tell a permanent refusal from a passing one. So
+        // this reports what happened and states the two conditions the
+        // operator can check for themselves, rather than asserting an outcome
+        // this code does not know.
+        `Could not release the lock on the secrets file at ${target} (${describeError(err)}). It may clear on its own \u2014 stale takeover reclaims a lock through the same directory removal, so it will not if whatever blocked this persists. If saves keep failing against this file and no other Inspector is running, remove ${lockPathOf(target)} by hand.`
+      );
+    }
+  };
+}
+async function withSecretFileLock(filePath, fn) {
+  const release = await openSecretFileLock(filePath);
+  if (release === null) return fn();
+  try {
+    return await fn();
+  } finally {
+    await release();
+  }
+}
+
+// ../../core/auth/node/file-secret-store.ts
+var scrypt2 = (passphrase, salt, keylen, options) => new Promise((resolve7, reject) => {
+  crypto2.scrypt(passphrase, salt, keylen, options, (err, key) => {
+    if (err) reject(err);
+    else resolve7(key);
+  });
+});
+var FORMAT_VERSION = 1;
+var CIPHER = "aes-256-gcm";
+var KEY_BYTES = 32;
+var IV_BYTES = 12;
+var GCM_TAG_BYTES = 16;
+var SCRYPT_N = 16384;
+var SCRYPT_R = 8;
+var SCRYPT_P = 1;
+var SECRET_KEY_ENV = "MCP_INSPECTOR_SECRET_KEY";
+var buildAccount2 = (serverId, field) => `${serverId}:${field}`;
+function asSecretMap(value, filePath) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new SecretStoreUnavailableError(
+      `The secrets file at ${filePath} does not hold a secret map (found ${Array.isArray(value) ? "an array" : typeof value}). Refusing to write, which would replace it. Move the file aside to start over.`
+    );
+  }
+  for (const [key, entry] of Object.entries(value)) {
+    if (typeof entry !== "string") {
+      throw new SecretStoreUnavailableError(
+        `The secrets file at ${filePath} holds a non-string value for "${key}". Refusing to write, which would replace it. Move the file aside to start over.`
+      );
+    }
+  }
+  return { ...value };
+}
+var SecretFileKeyMismatchError = class extends SecretStoreUnavailableError {
+  constructor(filePath, hasKey) {
+    super(
+      hasKey ? `The secrets file at ${filePath} could not be decrypted with the current ${SECRET_KEY_ENV}. Refusing to write, which would overwrite the existing secrets. Restore the original passphrase, or delete the file to start over.` : `The secrets file at ${filePath} is encrypted but ${SECRET_KEY_ENV} is not set. Refusing to write, which would overwrite the existing secrets. Set the passphrase this file was written with, or delete the file to start over.`
+    );
+    this.name = "SecretFileKeyMismatchError";
+  }
+};
+var encodeParts = (iv, tag, body) => `${iv.toString("base64")}.${tag.toString("base64")}.${body.toString("base64")}`;
+function decodeParts(payload) {
+  const parts = payload.split(".");
+  if (parts.length !== 3) return null;
+  const [iv, tag, body] = parts;
+  return {
+    iv: Buffer.from(iv, "base64"),
+    tag: Buffer.from(tag, "base64"),
+    body: Buffer.from(body, "base64")
+  };
+}
+var MAX_WRITE_ATTEMPTS = 5;
+var fileQueues = /* @__PURE__ */ new Map();
+function sameMap(a, b) {
+  const ak = Object.keys(a);
+  if (ak.length !== Object.keys(b).length) return false;
+  return ak.every(
+    (k) => Object.prototype.hasOwnProperty.call(b, k) && a[k] === b[k]
+  );
+}
+var isPositiveInt = (v) => typeof v === "number" && Number.isInteger(v) && v > 0;
+function encryptedEnvelopeProblem(parsed) {
+  if (!parsed.kdf || typeof parsed.data !== "string") {
+    return "encrypted envelope is missing its kdf or data";
+  }
+  const parts = decodeParts(parsed.data);
+  if (!parts) return "encrypted payload is not iv.tag.ciphertext";
+  if (parts.iv.length !== IV_BYTES) {
+    return `initialization vector is ${parts.iv.length} bytes, expected ${IV_BYTES}`;
+  }
+  if (parts.tag.length !== GCM_TAG_BYTES) {
+    return `authentication tag is ${parts.tag.length} bytes, expected ${GCM_TAG_BYTES}`;
+  }
+  if (parts.body.length === 0) return "ciphertext is empty";
+  const { algorithm, salt, N, r, p } = parsed.kdf;
+  if (algorithm !== "scrypt") return `unsupported kdf "${String(algorithm)}"`;
+  if (typeof salt !== "string" || Buffer.from(salt, "base64").length === 0) {
+    return "kdf salt is missing or not base64";
+  }
+  if (!isPositiveInt(N) || N < 2 || (N & N - 1) !== 0) {
+    return `kdf N is ${String(N)}, which is not a power of two above 1`;
+  }
+  if (!isPositiveInt(r) || !isPositiveInt(p)) {
+    return `kdf r/p are ${String(r)}/${String(p)}, which are not positive integers`;
+  }
+  if (N > SCRYPT_N || r > SCRYPT_R || p > SCRYPT_P) {
+    return `kdf cost parameters (N=${N}, r=${r}, p=${p}) exceed the supported maximum (N=${SCRYPT_N}, r=${SCRYPT_R}, p=${SCRYPT_P})`;
+  }
+  return null;
+}
+var FileSecretStore = class {
+  filePath;
+  passphrase;
+  constructor(options) {
+    this.filePath = options.filePath;
+    const raw = options.passphrase ?? process.env[SECRET_KEY_ENV];
+    this.passphrase = raw && raw.trim() ? raw : void 0;
+  }
+  /**
+   * True when the *next write* will encrypt. This is the configured policy,
+   * not the state of the file — see {@link readOnDiskEncryption}, which is
+   * what the user-facing descriptor is built from.
+   */
+  get encrypted() {
+    return this.passphrase !== void 0;
+  }
+  /**
+   * What the file on disk is *currently* written as — `null` when there is
+   * no file yet, or when it cannot be read or parsed.
+   *
+   * Separate from {@link encrypted} because the two genuinely disagree for a
+   * whole session: adding `MCP_INSPECTOR_SECRET_KEY` to an install that
+   * already has a plaintext file flips `encrypted` to true immediately,
+   * while the bytes stay readable until the next `set`. A descriptor built
+   * from the policy would tell that user "File (encrypted)" while their
+   * existing secrets sat in the clear — the precise reassurance this whole
+   * subsystem exists not to give.
+   *
+   * Reads the envelope, and for an encrypted one **attempts to open it**.
+   * Structure alone is not access: a well-formed file this passphrase cannot
+   * decrypt answers `null` from every `get` and refuses every `set`, so
+   * reporting it as a healthy "encrypted" store hands the quiet footer to
+   * exactly the state the unreadable one exists to warn about. The
+   * authentication costs one scrypt derivation per call, which is once per
+   * `/api/config`, and the decrypted bytes are discarded.
+   *
+   * `absent` and `unreadable` are kept apart deliberately. Collapsing them
+   * (as a bare `null` did) means an existing file that is corrupt, or
+   * written in an envelope this build does not know, is reported as "no
+   * file yet" — and the descriptor then falls back to the configured write
+   * policy, so a passphrase-configured install claims "Encrypted file"
+   * about a file whose encryption state was never established and which
+   * `set` is in fact about to refuse.
+   */
+  async readOnDiskEncryption() {
+    let raw;
+    try {
+      raw = await readStoreFile(this.filePath);
+    } catch (err) {
+      return {
+        state: "unreadable",
+        detail: err instanceof Error ? err.message : String(err)
+      };
+    }
+    if (raw === null) return { state: "absent" };
+    try {
+      const parsed = JSON.parse(raw);
+      if (parsed.version !== FORMAT_VERSION) {
+        return {
+          state: "unreadable",
+          detail: `format version ${String(parsed.version)}, expected ${FORMAT_VERSION}`
+        };
+      }
+      if (parsed.encryption === "none") {
+        try {
+          asSecretMap(parsed.secrets ?? {}, this.filePath);
+        } catch (err) {
+          return {
+            state: "unreadable",
+            detail: err instanceof Error ? err.message : String(err)
+          };
+        }
+        return { state: "plaintext" };
+      }
+      if (parsed.encryption === CIPHER) {
+        const problem = encryptedEnvelopeProblem(parsed);
+        if (problem) return { state: "unreadable", detail: problem };
+        try {
+          await this.readMap();
+        } catch (err) {
+          return {
+            state: "unreadable",
+            detail: err instanceof SecretFileKeyMismatchError ? `it cannot be decrypted with the current ${SECRET_KEY_ENV}` : err instanceof Error ? err.message : String(err)
+          };
+        }
+        return { state: "encrypted" };
+      }
+      return {
+        state: "unreadable",
+        detail: `unsupported envelope (encryption="${String(parsed.encryption)}", version=${String(parsed.version)})`
+      };
+    } catch {
+      return { state: "unreadable", detail: "not valid JSON" };
+    }
+  }
+  async deriveKey(kdf) {
+    return scrypt2(
+      // Only reached when the passphrase is set — every caller checks first,
+      // which is what makes the non-null assertion safe here rather than a
+      // widened `string | undefined` threaded through the crypto helpers.
+      this.passphrase,
+      Buffer.from(kdf.salt, "base64"),
+      KEY_BYTES,
+      { N: kdf.N, r: kdf.r, p: kdf.p }
+    );
+  }
+  /**
+   * Read and decode the file into a plain map.
+   *
+   * Distinguishes three outcomes that callers treat differently: `null` for
+   * "no file yet" (a first write should create one), a map for success, and a
+   * throw for "there is a file and we cannot read it" — which must never be
+   * flattened into an empty map, or `set` would cheerfully overwrite it.
+   */
+  /**
+   * Every secret in the file, keyed by `${serverId}:${field}` — `null` when
+   * there is no file.
+   *
+   * Exists for one caller: the hand-off performed when a keychain becomes
+   * available on a box that had been falling back to a file (see
+   * `absorbFileSecretsIntoKeyring`). Nothing in the normal request path
+   * enumerates secrets, and deliberately so — this is the widest possible
+   * read of the store and it should stay a one-purpose seam rather than a
+   * general convenience.
+   *
+   * Throws for the same reasons `get` swallows: an unreadable or
+   * undecryptable file must not present as "no secrets", because the caller
+   * would conclude there was nothing to migrate and move on.
+   */
+  async readAll() {
+    return this.serialize(() => this.readMap());
+  }
+  async readMap() {
+    const raw = await readStoreFile(this.filePath);
+    if (raw === null) return null;
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch (err) {
+      throw new SecretStoreUnavailableError(
+        `The secrets file at ${this.filePath} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    if (parsed.version !== FORMAT_VERSION) {
+      throw new SecretStoreUnavailableError(
+        `The secrets file at ${this.filePath} declares format version ${String(parsed.version)}, but this Inspector only understands version ${FORMAT_VERSION}. It was probably written by a newer Inspector; upgrade, or move the file aside to start over.`
+      );
+    }
+    if (parsed.encryption === "none") {
+      return asSecretMap(parsed.secrets ?? {}, this.filePath);
+    }
+    if (parsed.encryption !== CIPHER || !parsed.kdf || !parsed.data) {
+      throw new SecretStoreUnavailableError(
+        `The secrets file at ${this.filePath} declares an unsupported format (encryption="${String(parsed.encryption)}", version=${String(parsed.version)}). It may have been written by a newer Inspector.`
+      );
+    }
+    if (!this.passphrase)
+      throw new SecretFileKeyMismatchError(this.filePath, false);
+    const structural = encryptedEnvelopeProblem(parsed);
+    if (structural) {
+      throw new SecretStoreUnavailableError(
+        `The secrets file at ${this.filePath} is not readable: ${structural}. Restoring a passphrase will not repair it; the file itself is malformed.`
+      );
+    }
+    const parts = decodeParts(parsed.data);
+    if (!parts) throw new SecretFileKeyMismatchError(this.filePath, true);
+    let plain;
+    try {
+      const key = await this.deriveKey(parsed.kdf);
+      const decipher = crypto2.createDecipheriv(CIPHER, key, parts.iv);
+      decipher.setAuthTag(parts.tag);
+      plain = Buffer.concat([
+        decipher.update(parts.body),
+        decipher.final()
+      ]).toString("utf-8");
+    } catch {
+      throw new SecretFileKeyMismatchError(this.filePath, true);
+    }
+    let payload;
+    try {
+      payload = JSON.parse(plain);
+    } catch (err) {
+      throw new SecretStoreUnavailableError(
+        `The secrets file at ${this.filePath} decrypted successfully but its contents are not valid JSON: ${err instanceof Error ? err.message : String(err)}. The passphrase is correct; the file itself is corrupt.`
+      );
+    }
+    return asSecretMap(payload, this.filePath);
+  }
+  async writeMap(map) {
+    let file;
+    if (this.passphrase) {
+      const kdf = {
+        algorithm: "scrypt",
+        // A fresh salt per write, not per file: rewriting with the same salt
+        // and a fresh IV would still be safe for GCM, but re-salting costs one
+        // scrypt derivation we were doing anyway and removes the question.
+        salt: crypto2.randomBytes(16).toString("base64"),
+        N: SCRYPT_N,
+        r: SCRYPT_R,
+        p: SCRYPT_P
+      };
+      const key = await this.deriveKey(kdf);
+      const iv = crypto2.randomBytes(IV_BYTES);
+      const cipher = crypto2.createCipheriv(CIPHER, key, iv);
+      const body = Buffer.concat([
+        cipher.update(JSON.stringify(map), "utf-8"),
+        cipher.final()
+      ]);
+      file = {
+        version: FORMAT_VERSION,
+        encryption: CIPHER,
+        kdf,
+        data: encodeParts(iv, cipher.getAuthTag(), body)
+      };
+    } else {
+      file = { version: FORMAT_VERSION, encryption: "none", secrets: map };
+    }
+    await writeStoreFile(this.filePath, `${JSON.stringify(file, null, 2)}
+`);
+  }
+  /**
+   * Apply a mutation to the file, under a cross-process lock, and confirm it
+   * survived.
+   *
+   * **Two mechanisms, and they answer different questions** — this is not
+   * belt-and-braces.
+   *
+   * The lock ({@link withSecretFileLock}, #2082) is the one that provides
+   * mutual exclusion: a durable secrets file is shared state, and a second
+   * Inspector on the same box — a CLI run beside a web session is the
+   * ordinary case, not a contrived one — otherwise reads the same "before"
+   * map and then atomically replaces the file, dropping whatever the first
+   * process had just added. Both writes report success; one secret is simply
+   * gone. Held across the read *and* the write, so no other holder can
+   * observe or replace the map in between.
+   *
+   * The verify covers what a lock structurally cannot. A lock is an advisory
+   * convention between the processes that take it, so it says nothing about
+   * a writer that does not: an editor, a restored backup, a `jq` one-liner,
+   * or an Inspector predating #2082. It is also the fallback when the lock
+   * is unavailable at all — `withSecretFileLock` runs the body anyway on a
+   * read-only or lock-hostile directory rather than failing a `set` on
+   * exactly the deployments this store exists for (#1848, #1905).
+   *
+   * So: read `M0`, apply the mutation to get `M1`, write it, then read back
+   * `M2`. If `M2` equals `M1` nothing interleaved. If it does not, someone
+   * wrote between our write and our read — so re-apply onto what they left
+   * and try again.
+   *
+   * The comparison is over the **whole map**, not just the entry we touched.
+   * Checking only our own key would pass in precisely the case that loses
+   * data: our entry is present, and it is the *other* writer's that is gone.
+   * When the verify does fire, the writer that was clobbered is the one that
+   * repairs it — A writes `MA`, B writes `MB` over it, B verifies `MB`
+   * correctly, A verifies, sees `M2 !== MA`, re-applies onto `MB`.
+   *
+   * **What is left, stated without overselling.** Against an unlocked writer
+   * the verify is not mutual exclusion: it only catches a clobber that has
+   * already landed, so ordering the two as write-A, verify-A, write-B,
+   * verify-B loses A's entry with both reporting success. That residual is
+   * now confined to a writer outside this codebase, or to a directory where
+   * no lock could be taken — and the latter announces itself, once, on the
+   * console.
+   *
+   * Reads deliberately do not participate: `writeStoreFile` is atomic
+   * (write-temp-then-rename), so a reader sees either the old file or the
+   * new one, never a torn one. Taking the lock for them would serialize
+   * every `GET /api/servers` behind whatever else holds it, to prevent
+   * nothing.
+   */
+  async mutate(apply) {
+    await withSecretFileLock(this.filePath, () => this.mutateLocked(apply));
+  }
+  /** {@link mutate}'s body, with the lock already held. */
+  async mutateLocked(apply) {
+    for (let attempt = 0; attempt < MAX_WRITE_ATTEMPTS; attempt++) {
+      let current;
+      try {
+        current = await this.readMap() ?? {};
+      } catch (err) {
+        if (err instanceof SecretStoreUnavailableError) throw err;
+        throw new SecretStoreUnavailableError(
+          `Could not read the secrets file at ${this.filePath}: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+      const next = apply(current);
+      if (next === null) return;
+      try {
+        await this.writeMap(next);
+      } catch (err) {
+        throw new SecretStoreUnavailableError(
+          `Could not write the secrets file at ${this.filePath}: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+      let observed;
+      try {
+        observed = await this.readMap() ?? {};
+      } catch {
+        continue;
+      }
+      if (sameMap(next, observed)) return;
+    }
+    throw new SecretStoreUnavailableError(
+      `Could not write the secrets file at ${this.filePath}: another process kept overwriting it (gave up after ${MAX_WRITE_ATTEMPTS} attempts). Its secrets are intact; the value you just entered was not saved.`
+    );
+  }
+  /**
+   * Run `fn` with the file to itself, so concurrent callers can't lose
+   * writes.
+   *
+   * Keyed on the **resolved path, process-wide** rather than on this
+   * instance. Two `FileSecretStore`s pointing at one file are ordinary —
+   * the resolved store holds one and `absorbFileSecretsIntoKeyring`
+   * constructs another — and a per-instance queue does not order them
+   * against each other at all. They then race in-process, which the
+   * optimistic verify is only *supposed* to catch for writers in different
+   * processes: both read the same map, both write, and whichever verifies
+   * before the other's write lands sees its own value and returns happy.
+   * Measured, not theorised — two instances racing `set` lost an entry on
+   * the first run of the convergence test below.
+   *
+   * So the in-process case is made correct by construction here, and
+   * {@link mutate}'s cross-process lock covers what this cannot see: a
+   * second Inspector process.
+   *
+   * The queue is *also* what keeps that lock usable. `proper-lockfile` is
+   * not reentrant — a second `lock()` on a path this process already holds
+   * fails `ELOCKED`, which is indistinguishable from a genuine remote
+   * holder. Serializing here means the lock is only ever contended between
+   * processes, which is the only contention it is asked to arbitrate.
+   */
+  serialize(fn) {
+    const key = path3.resolve(this.filePath);
+    const run = (fileQueues.get(key) ?? Promise.resolve()).then(fn);
+    const settled = run.then(
+      () => {
+      },
+      () => {
+      }
+    );
+    fileQueues.set(key, settled);
+    void settled.then(() => {
+      if (fileQueues.get(key) === settled) fileQueues.delete(key);
+    });
+    return run;
+  }
+  /**
+   * One read and one derivation for an entire rehydration.
+   *
+   * `get` reads and decrypts the whole file, so the cost is per *call*, not
+   * per field — which is why the batch has to span servers. A per-server
+   * version of this shipped first and left a 20-server catalog paying 20
+   * serialized derivations, the same stall it was written to remove.
+   * Tolerant like `get`: an unreadable store yields no fields for anyone
+   * rather than throwing.
+   */
+  async getMany(requests) {
+    let map;
+    try {
+      map = await this.serialize(() => this.readMap());
+    } catch {
+      map = null;
+    }
+    const out = {};
+    for (const { serverId, fields } of requests) {
+      const found = {};
+      for (const field of fields) {
+        const value = map?.[buildAccount2(serverId, field)];
+        if (value !== void 0) found[field] = value;
+      }
+      out[serverId] = found;
+    }
+    return out;
+  }
+  /**
+   * The intolerant read — same lookup as {@link get}, minus the catch.
+   *
+   * Without this, `secretStoreGetStrict` fell back to `get` for the file
+   * store and turned every read failure into `null`. Both plaintext
+   * migrations *write* on `null` and then strip the disk copy, so a
+   * transient read error that cleared before the write let an older
+   * on-disk value replace a newer stored one — the same inversion the
+   * strict seam was introduced to prevent, still open on the store the
+   * seam was introduced for.
+   */
+  async getStrict(serverId, field) {
+    try {
+      const map = await this.serialize(() => this.readMap());
+      return map?.[buildAccount2(serverId, field)] ?? null;
+    } catch (err) {
+      if (err instanceof SecretStoreUnavailableError) throw err;
+      throw new SecretStoreUnavailableError(
+        `Could not read the secrets file at ${this.filePath}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  async get(serverId, field) {
+    try {
+      const map = await this.serialize(() => this.readMap());
+      return map?.[buildAccount2(serverId, field)] ?? null;
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * One read-modify-write-verify cycle for a whole server's fields.
+   *
+   * `set` pays that cycle — and, encrypted, three scrypt derivations — per
+   * call, serialized behind this store's queue. The settings form resends a
+   * server's full `env` map on any edit, so a 10-variable stdio server spent
+   * ~30 derivations saving an unrelated timeout change.
+   */
+  async setMany(serverId, values) {
+    if (Object.keys(values).length === 0) return;
+    await this.serialize(
+      () => this.mutate((map) => {
+        const next = { ...map };
+        for (const [field, value] of Object.entries(values)) {
+          next[buildAccount2(serverId, field)] = value;
+        }
+        return next;
+      })
+    );
+  }
+  async set(serverId, field, value) {
+    await this.serialize(
+      () => this.mutate((map) => ({
+        ...map,
+        [buildAccount2(serverId, field)]: value
+      }))
+    );
+  }
+  async delete(serverId, field) {
+    await this.deleteWhere((key) => key === buildAccount2(serverId, field));
+  }
+  async deleteAllForServer(serverId) {
+    const prefix = `${serverId}:`;
+    await this.deleteWhere((key) => key.startsWith(prefix));
+  }
+  /**
+   * Shared delete body. Silent on every failure, matching the keyring store:
+   * every reason a delete can fail collapses to "the entry isn't there
+   * anymore", and `set` is the operation that reports a broken store.
+   */
+  async deleteWhere(match) {
+    try {
+      await this.serialize(
+        () => this.mutate((map) => {
+          const keys = Object.keys(map).filter(match);
+          if (keys.length === 0) return null;
+          const next = { ...map };
+          for (const key of keys) delete next[key];
+          return next;
+        })
+      );
+    } catch {
+    }
+  }
+};
+async function tightenSecretFilePermissions(filePath) {
+  try {
+    await fs3.chmod(filePath, 384);
+  } catch {
+  }
+  return readSecretFilePermissions(filePath);
+}
+async function readSecretFilePermissions(filePath) {
+  try {
+    if (process.platform === "win32") {
+      await fs3.stat(filePath);
+      return { state: "unknown", detail: "not checked on Windows" };
+    }
+    const mode = (await fs3.stat(filePath)).mode & 511;
+    if (mode === 384) return { state: "ok" };
+    return { state: "loose", mode };
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") {
+      return { state: "absent" };
+    }
+    return { state: "unknown", detail: code ?? "unknown error" };
+  }
+}
+
+// ../../core/auth/node/secret-store-selection.ts
+var SECRET_STORE_ENV = "MCP_INSPECTOR_SECRET_STORE";
+var SECRET_FILE_ENV = "MCP_INSPECTOR_SECRET_FILE";
+var STORAGE_DIR_ENV = "MCP_STORAGE_DIR";
+var KINDS = ["keyring", "file", "memory"];
+function parseSecretStoreEnv(raw) {
+  const value = raw?.trim().toLowerCase();
+  if (!value) return void 0;
+  if (KINDS.includes(value)) return value;
+  console.warn(
+    `[mcp-inspector] Ignoring ${SECRET_STORE_ENV}="${raw}": expected one of ${KINDS.join(", ")}.`
+  );
+  return void 0;
+}
+function defaultSecretFilePath() {
+  const override = process.env[SECRET_FILE_ENV]?.trim();
+  if (override) return path4.resolve(override);
+  const storageDir = process.env[STORAGE_DIR_ENV]?.trim();
+  if (storageDir) return path4.resolve(storageDir, "secrets.json");
+  const homeDir = process.env.HOME || process.env.USERPROFILE || ".";
+  return path4.resolve(homeDir, ".mcp-inspector", "secrets.json");
+}
+function isContainer() {
+  if (process.env.KUBERNETES_SERVICE_HOST) return true;
+  try {
+    if (fsSync.existsSync("/.dockerenv") || fsSync.existsSync("/run/.containerenv")) {
+      return true;
+    }
+  } catch {
+  }
+  try {
+    const cgroup = fsSync.readFileSync("/proc/1/cgroup", "utf-8");
+    return /\b(docker|containerd|kubepods|podman|libpod|lxc)\b/.test(cgroup);
+  } catch {
+    return false;
+  }
+}
+function nearestExisting(dir) {
+  let current = path4.resolve(dir);
+  while (!fsSync.existsSync(current)) {
+    const parent = path4.dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+  return current;
+}
+function unescapeMountPoint(point) {
+  return point.replace(
+    /\\(\d{3})/g,
+    (_match, octal) => String.fromCharCode(parseInt(octal, 8))
+  );
+}
+var EPHEMERAL_FSTYPES = /* @__PURE__ */ new Set(["tmpfs", "ramfs"]);
+function readMountPoints() {
+  try {
+    return fsSync.readFileSync("/proc/self/mountinfo", "utf-8").split("\n").flatMap((line) => {
+      const point = line.split(" ")[4];
+      if (!point) return [];
+      const after = line.split(" - ")[1];
+      const fstype = after?.trim().split(/\s+/)[0];
+      if (fstype && EPHEMERAL_FSTYPES.has(fstype)) return [];
+      return [unescapeMountPoint(point)];
+    }).filter((point) => point !== "/");
+  } catch {
+    return null;
+  }
+}
+function isOnMountPoint(dir) {
+  try {
+    const nearest = nearestExisting(dir);
+    if (nearest === null) return false;
+    let current = nearest;
+    try {
+      current = fsSync.realpathSync(nearest);
+    } catch {
+    }
+    const mounts = readMountPoints();
+    if (mounts !== null) {
+      return mounts.some(
+        (point) => current === point || current.startsWith(`${point}/`)
+      );
+    }
+    const parent = path4.dirname(current);
+    if (parent === current) return false;
+    return fsSync.statSync(current).dev !== fsSync.statSync("/").dev;
+  } catch {
+    return false;
+  }
+}
+async function buildStore(kind, reason, detail) {
+  if (kind === "keyring") {
+    return {
+      store: new KeyringSecretStore(),
+      info: { kind, reason, durable: true }
+    };
+  }
+  if (kind === "memory") {
+    return {
+      store: new SessionSecretStore(),
+      info: { kind, reason, durable: false, detail }
+    };
+  }
+  const filePath = defaultSecretFilePath();
+  const store = new FileSecretStore({ filePath });
+  await tightenSecretFilePermissions(filePath);
+  return {
+    store,
+    info: await describeFileStore(store, filePath, kind, reason, detail)
+  };
+}
+async function describeFileStore(store, filePath, kind, reason, detail) {
+  const onDisk = await store.readOnDiskEncryption();
+  const unreadable = onDisk.state === "unreadable" ? onDisk.detail : void 0;
+  const plaintext = onDisk.state === "absent" ? !store.encrypted : onDisk.state === "plaintext";
+  const perms = await readSecretFilePermissions(filePath);
+  return {
+    kind,
+    reason,
+    path: filePath,
+    // Omitted entirely when the envelope could not be read, so no consumer
+    // can read a default out of it.
+    ...unreadable === void 0 ? { plaintext } : {},
+    ...unreadable !== void 0 ? { encryptionUnknown: unreadable } : {},
+    ...perms.state === "loose" ? { looseMode: perms.mode } : {},
+    ...perms.state === "unknown" ? { permissionsUnknown: perms.detail } : {},
+    // Only meaningful while the two disagree; omitted otherwise so the
+    // payload does not carry a flag that says nothing.
+    ...unreadable === void 0 && plaintext && store.encrypted ? { pendingEncryption: true } : {},
+    durable: true,
+    detail
+  };
+}
+function chooseFallbackKind(opts) {
+  return opts.container && !opts.mounted ? "memory" : "file";
+}
+function warnAboutSecretStorage(info) {
+  if (info.reason === "fallback") {
+    console.warn(
+      `
+[mcp-inspector] The OS keychain is not available, so secrets will be kept in: ${secretStorageSummary(info)}.` + (info.detail ? `
+[mcp-inspector] Keychain error: ${info.detail}` : "") + `
+[mcp-inspector] Set ${SECRET_STORE_ENV}=keyring|file|memory to choose explicitly.`
+    );
+  }
+  const caveat = secretStorageCaveat(info);
+  if (caveat) console.warn(`[mcp-inspector] ${caveat}`);
+}
+var resolved;
+function resolveSecretStore() {
+  resolved ??= (async () => {
+    const configured = parseSecretStoreEnv(process.env[SECRET_STORE_ENV]);
+    if (configured) {
+      const result2 = await buildStore(configured, "configured");
+      if (configured === "keyring") {
+        await absorbFileSecretsIntoKeyring(result2.store);
+      }
+      warnAboutSecretStorage(result2.info);
+      return result2;
+    }
+    const probe = await probeKeyringAvailable();
+    if (probe.available) {
+      const result2 = await buildStore("keyring", "default");
+      await absorbFileSecretsIntoKeyring(result2.store);
+      return result2;
+    }
+    const kind = chooseFallbackKind({
+      container: isContainer(),
+      mounted: isOnMountPoint(path4.dirname(defaultSecretFilePath()))
+    });
+    const result = await buildStore(kind, "fallback", probe.detail);
+    warnAboutSecretStorage(result.info);
+    return result;
+  })();
+  return resolved;
+}
+async function absorbFileSecretsIntoKeyring(keyring) {
+  const filePath = defaultSecretFilePath();
+  if (!await anythingToMigrate(filePath)) return;
+  const claimed = await withSecretFileLock(filePath, async () => {
+    await recoverOrphanedSnapshots(filePath);
+    if (!fsSync.existsSync(filePath)) return null;
+    const staged = `${filePath}.migrating-${process.pid}-${randomUUID()}`;
+    try {
+      await fs4.rename(filePath, staged);
+    } catch (err) {
+      const code = err.code;
+      if (code !== "ENOENT") {
+        console.warn(
+          `
+[mcp-inspector] Could not claim the secrets file at ${filePath} for migration into the OS keychain (${code ?? "unknown error"}), so it has been left in place. Its secrets are not visible to this session.`
+        );
+      }
+      return null;
+    }
+    const releaseSnapshot = await openSecretFileLock(staged).catch(() => null);
+    return { staged, releaseSnapshot };
+  }).catch((err) => {
+    console.warn(
+      `
+[mcp-inspector] Could not lock the secrets file at ${filePath} to migrate it into the OS keychain (${err.message}), so it has been left in place. Its secrets are not visible to this session; the next run will try again.`
+    );
+    return null;
+  });
+  if (claimed === null) return;
+  try {
+    await handOffStagedSecrets(claimed.staged, filePath, keyring);
+  } finally {
+    await claimed.releaseSnapshot?.();
+  }
+}
+async function handOffStagedSecrets(staged, filePath, keyring) {
+  const file = new FileSecretStore({ filePath: staged });
+  const absorbed = await handOff(file, staged, keyring);
+  if (absorbed) {
+    try {
+      await fs4.rm(staged, { force: true });
+      console.warn(
+        `
+[mcp-inspector] The OS keychain is available again. Secrets kept in ${filePath} while it was not have been moved into the keychain, and the file has been removed.`
+      );
+    } catch (err) {
+      console.warn(
+        `
+[mcp-inspector] Secrets were moved into the OS keychain, but the temporary copy at ${staged} could not be removed (${err instanceof Error ? err.message : String(err)}). Delete it once you have confirmed the keychain has your secrets.`
+      );
+    }
+    return;
+  }
+  try {
+    await fs4.link(staged, filePath);
+    await fs4.rm(staged, { force: true });
+  } catch {
+    console.warn(
+      `
+[mcp-inspector] Could not restore ${staged} to ${filePath}; both files exist and the snapshot holds the secrets that were not migrated. Merge it by hand, or delete it once you have confirmed nothing is missing.`
+    );
+  }
+}
+var isSnapshotName = (name, base) => name.startsWith(`${base}.migrating-`) && !name.endsWith(".lock");
+async function anythingToMigrate(filePath) {
+  const base = path4.basename(filePath);
+  try {
+    return (await fs4.readdir(path4.dirname(filePath))).some(
+      (name) => name === base || isSnapshotName(name, base)
+    );
+  } catch (err) {
+    const code = err.code;
+    return code !== "ENOENT" && code !== "ENOTDIR";
+  }
+}
+async function recoverOrphanedSnapshots(filePath) {
+  const dir = path4.dirname(filePath);
+  const base = path4.basename(filePath);
+  let names;
+  try {
+    names = (await fs4.readdir(dir)).filter((n) => isSnapshotName(n, base));
+  } catch {
+    return;
+  }
+  for (const name of names) {
+    const orphan = path4.join(dir, name);
+    if (await isFileLockHeld(orphan)) continue;
+    try {
+      await fs4.link(orphan, filePath);
+      await fs4.rm(orphan, { force: true });
+      console.warn(
+        `
+[mcp-inspector] Recovered secrets left behind by an interrupted migration (${orphan} \u2192 ${filePath}).`
+      );
+    } catch {
+      console.warn(
+        `
+[mcp-inspector] Found secrets from an interrupted migration at ${orphan}, and a current ${filePath} already exists, so it was left alone. It may hold values the current file does not.`
+      );
     }
-    return [buildConfigFromOptions(options)];
   }
-  return [];
 }
-
-// ../../core/auth/node/secret-store.ts
-var SERVICE_NAME = "mcp-inspector";
-var keyringLoad;
-var KeyringModuleShapeError = class extends Error {
-  constructor(detail, options) {
-    super(`@napi-rs/keyring loaded but ${detail}`, options);
-    this.name = "KeyringModuleShapeError";
+async function handOff(file, filePath, keyring) {
+  let entries;
+  try {
+    entries = await file.readAll();
+  } catch (err) {
+    console.warn(
+      `
+[mcp-inspector] The OS keychain is available again, but the secrets file at ${filePath} could not be read, so its contents were left there: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return false;
   }
-};
-var checkKeyringShape = (mod) => {
+  if (!entries || Object.keys(entries).length === 0) return false;
+  let complete = true;
   try {
-    if (typeof mod.AsyncEntry === "function" && typeof mod.findCredentialsAsync === "function") {
-      return { ok: true, mod };
+    for (const [account, value] of Object.entries(entries)) {
+      const parsed = parseAccount(account);
+      if (!parsed) {
+        complete = false;
+        continue;
+      }
+      const existing = await secretStoreGetStrict(
+        keyring,
+        parsed.serverId,
+        parsed.field
+      );
+      if (existing === null) {
+        await keyring.set(parsed.serverId, parsed.field, value);
+      }
     }
-    return {
-      ok: false,
-      err: new KeyringModuleShapeError(
-        "did not expose AsyncEntry / findCredentialsAsync"
-      )
-    };
   } catch (err) {
-    return {
-      ok: false,
-      err: new KeyringModuleShapeError(
-        `its exports could not be read: ${err instanceof Error ? err.message : String(err)}`,
-        { cause: err }
-      )
-    };
+    console.warn(
+      `
+[mcp-inspector] Could not move the secrets file at ${filePath} into the OS keychain, so it has been left in place: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return false;
   }
-};
-var loadKeyring = () => {
-  keyringLoad ??= import("@napi-rs/keyring").then(
-    checkKeyringShape,
-    (err) => ({ ok: false, err })
-  );
-  return keyringLoad;
-};
-function parseAccount(account) {
-  const idx = account.indexOf(":");
-  if (idx <= 0 || idx === account.length - 1) return null;
-  return {
-    serverId: account.slice(0, idx),
-    field: account.slice(idx + 1)
-  };
-}
-var buildAccount = (serverId, field) => `${serverId}:${field}`;
-var KeychainUnavailableError = class extends Error {
-  constructor(cause) {
-    const message = cause instanceof Error ? cause.message : String(cause);
-    super(
-      `OS keychain is not available. ${hintFor(cause, message)} Underlying error: ${message}`
+  if (!complete) {
+    console.warn(
+      `
+[mcp-inspector] Secrets from ${filePath} have been copied into the OS keychain, but at least one entry could not be read (its key is not in \`serverId:field\` form). The file has been left in place so nothing is lost.`
     );
-    this.name = "KeychainUnavailableError";
+    return false;
   }
-};
-var hintFor = (cause, message) => {
-  if (cause instanceof KeyringModuleShapeError) {
-    return `The @napi-rs/keyring package loaded but does not expose the API this build expects \u2014 most likely a version or packaging mismatch; reinstall the Inspector, and report this if it persists.`;
+  return true;
+}
+var DeferredSecretStore = class {
+  async target() {
+    return (await resolveSecretStore()).store;
   }
-  if (message.includes("Cannot find native binding")) {
-    return `The @napi-rs/keyring platform package for this OS is missing or unavailable \u2014 reinstall the Inspector (for npx, clear the npx cache under your npm cache directory first).`;
+  async isDurable() {
+    return secretStoreIsDurable(await this.target());
+  }
+  /**
+   * Forwarded, and its absence was a real defect rather than an omission:
+   * this is the store production actually uses, so a `secretStoreGetStrict`
+   * call against it fell through to the tolerant `get` and the strictness
+   * existed only in tests that injected a concrete store.
+   */
+  async getStrict(serverId, field) {
+    return secretStoreGetStrict(await this.target(), serverId, field);
+  }
+  async getMany(requests) {
+    return secretStoreGetMany(await this.target(), requests);
   }
-  return `On Linux, install libsecret / gnome-keyring.`;
-};
-var KeyringSecretStore = class {
   async get(serverId, field) {
-    try {
-      const keyring = await loadKeyring();
-      if (!keyring.ok) return null;
-      const entry = new keyring.mod.AsyncEntry(
-        SERVICE_NAME,
-        buildAccount(serverId, field)
-      );
-      const v = await entry.getPassword();
-      return v ?? null;
-    } catch {
-      return null;
-    }
+    return (await this.target()).get(serverId, field);
   }
   async set(serverId, field, value) {
-    try {
-      const keyring = await loadKeyring();
-      if (!keyring.ok) throw new KeychainUnavailableError(keyring.err);
-      const entry = new keyring.mod.AsyncEntry(
-        SERVICE_NAME,
-        buildAccount(serverId, field)
-      );
-      await entry.setPassword(value);
-    } catch (err) {
-      if (err instanceof KeychainUnavailableError) throw err;
-      throw new KeychainUnavailableError(err);
-    }
+    await (await this.target()).set(serverId, field, value);
+  }
+  async setMany(serverId, values) {
+    await secretStoreSetMany(await this.target(), serverId, values);
   }
   async delete(serverId, field) {
-    try {
-      const keyring = await loadKeyring();
-      if (!keyring.ok) return;
-      const entry = new keyring.mod.AsyncEntry(
-        SERVICE_NAME,
-        buildAccount(serverId, field)
-      );
-      await entry.deleteCredential();
-    } catch {
-    }
+    await (await this.target()).delete(serverId, field);
   }
   async deleteAllForServer(serverId) {
-    let creds;
-    try {
-      const keyring = await loadKeyring();
-      if (!keyring.ok) return;
-      creds = await keyring.mod.findCredentialsAsync(SERVICE_NAME);
-    } catch {
-      return;
-    }
-    const prefix = `${serverId}:`;
-    for (const c of creds) {
-      if (!c.account.startsWith(prefix)) continue;
-      const parsed = parseAccount(c.account);
-      if (!parsed || parsed.serverId !== serverId) continue;
-      await this.delete(serverId, parsed.field);
-    }
+    await (await this.target()).deleteAllForServer(serverId);
   }
 };
+function defaultSecretStore() {
+  return new DeferredSecretStore();
+}
 
 // ../../core/mcp/node/server-secrets.ts
 async function rehydrateMcpConfigFromKeychain(config, secretStore) {
-  const out = { mcpServers: {} };
-  await Promise.all(
-    Object.entries(config.mcpServers).map(async ([id, stored]) => {
-      const fields = expectedSecretFields(stored);
-      const secrets = {};
-      await Promise.all(
-        fields.map(async (field) => {
-          const value = await secretStore.get(id, field);
-          if (value !== null) {
-            secrets[field] = value;
-          }
-        })
-      );
-      out.mcpServers[id] = mergeSecretsIntoStored(stored, secrets);
-    })
+  const entries = Object.entries(config.mcpServers);
+  const secrets = await secretStoreGetMany(
+    secretStore,
+    entries.map(([serverId, stored]) => ({
+      serverId,
+      fields: expectedSecretFields(stored)
+    }))
   );
+  const out = { mcpServers: {} };
+  for (const [id, stored] of entries) {
+    out.mcpServers[id] = mergeSecretsIntoStored(stored, secrets[id] ?? {});
+  }
   return out;
 }
 
@@ -817,7 +2161,7 @@ function headersToServerSettings(headers) {
   return {
     headers: Object.entries(headers).map(([key, value]) => ({ key, value })),
     env: [],
-    metadata: [],
+    metadata: {},
     connectionTimeout: 0,
     requestTimeout: 0,
     taskTtl: DEFAULT_TASK_TTL_MS,
@@ -846,7 +2190,7 @@ async function loadServerEntries(serverOptions) {
   const source = resolveServerSource(serverOptions);
   if (source) {
     let config = readServerListFile(source.path, source.writable);
-    const secretStore = serverOptions.secretStore ?? new KeyringSecretStore();
+    const secretStore = serverOptions.secretStore ?? defaultSecretStore();
     config = await rehydrateMcpConfigFromKeychain(config, secretStore);
     const entries = mcpConfigToServerEntries(config);
     const result = {};
@@ -1282,6 +2626,17 @@ function parseWwwAuthenticateBearer(header) {
     errorDescription: params.error_description
   };
 }
+function challengeResourceMetadataUrl(challenge) {
+  const value = challenge.resourceMetadataUrl?.trim();
+  if (!value) {
+    return void 0;
+  }
+  try {
+    return new URL(value);
+  } catch {
+    return void 0;
+  }
+}
 function parseScopeString(scope) {
   if (!scope?.trim()) {
     return [];
@@ -1331,6 +2686,7 @@ function parseAuthChallengeFromResponse(response, context) {
   return {
     reason: reasonFromHttpResponse(status, bearer),
     ...requiredScopes.length > 0 ? { requiredScopes } : {},
+    ...bearer.resourceMetadata ? { resourceMetadataUrl: bearer.resourceMetadata } : {},
     ...bearer.errorDescription ? { message: bearer.errorDescription } : {},
     ...context ? { context } : {},
     raw: {
@@ -1371,6 +2727,7 @@ function parseAuthChallengeFromError(err, context) {
   return {
     reason: reasonFromHttpResponse(status, bearer),
     ...requiredScopes.length > 0 ? { requiredScopes } : {},
+    ...bearer.resourceMetadata ? { resourceMetadataUrl: bearer.resourceMetadata } : {},
     ...context ? { context } : {},
     raw: {
       httpStatus: status,
@@ -1417,8 +2774,26 @@ function createAuthChallengeInterceptFetch(baseFetch) {
     );
   };
 }
+function createAuthChallengeObserverFetch(baseFetch, onChallenge) {
+  return async (input, init) => {
+    const response = await baseFetch(input, init);
+    if (response.status === 401 || response.status === 403) {
+      const challenge = parseAuthChallengeFromResponse(response);
+      if (challenge) {
+        onChallenge(challenge);
+      }
+    }
+    return response;
+  };
+}
 
-// ../../core/mcp/node/transport.ts
+// ../../core/mcp/node/proxyFetch.ts
+function asUndiciInit(init) {
+  return init;
+}
+function asBodyInit(body) {
+  return body;
+}
 var PROXY_ENV_VARS = [
   "HTTPS_PROXY",
   "https_proxy",
@@ -1432,27 +2807,95 @@ function readProxyEnv() {
   }
   return void 0;
 }
-function withProxyDispatcher(baseFetch) {
-  if (readProxyEnv() === void 0) return baseFetch;
-  let dispatcherPromise;
-  const getDispatcher = () => {
-    dispatcherPromise ??= import("./undici-KNXAVD2F.js").then(
-      ({ EnvHttpProxyAgent }) => new EnvHttpProxyAgent(),
-      (cause) => {
-        throw new Error(
-          "HTTPS_PROXY / HTTP_PROXY is set but the `undici` package is not available. Install it (it ships with the CLI client) or unset the proxy env var.",
-          { cause }
-        );
-      }
+var NULL_BODY_STATUSES = /* @__PURE__ */ new Set([
+  101,
+  103,
+  204,
+  205,
+  304
+]);
+function toGlobalResponse(res) {
+  const headers = new Headers();
+  for (const [key, value] of res.headers) headers.append(key, value);
+  const out = new Response(
+    NULL_BODY_STATUSES.has(res.status) ? null : asBodyInit(res.body),
+    {
+      status: res.status,
+      statusText: res.statusText,
+      headers
+    }
+  );
+  for (const [key, value] of [
+    ["url", res.url],
+    ["redirected", res.redirected],
+    ["type", res.type]
+  ]) {
+    Object.defineProperty(out, key, {
+      value,
+      configurable: true,
+      enumerable: false
+    });
+  }
+  return out;
+}
+var loadedProxiedFetch;
+async function loadProxiedFetch() {
+  let undici;
+  try {
+    undici = await import("undici");
+  } catch (cause) {
+    throw new Error(
+      "HTTPS_PROXY / HTTP_PROXY is set but the `undici` package could not be loaded, so requests cannot be routed through the proxy. This is a packaging fault rather than something to fix by installing undici; please report it, or unset the proxy env var to fall back to a direct connection.",
+      { cause }
+    );
+  }
+  const dispatcher = new undici.EnvHttpProxyAgent();
+  return async (input, init) => {
+    const [target, requestInit] = toUndiciRequest(input, init);
+    return toGlobalResponse(
+      await undici.fetch(target, { ...asUndiciInit(requestInit), dispatcher })
     );
-    return dispatcherPromise;
   };
-  const proxiedFetch = async (input, init) => {
-    const dispatcher = await getDispatcher();
-    return baseFetch(input, { ...init, dispatcher });
+}
+function toUndiciRequest(input, init) {
+  if (input instanceof Request) {
+    return [
+      input.url,
+      {
+        method: input.method,
+        headers: input.headers,
+        // A stream body needs `duplex: "half"`; the field is undici's, not in
+        // the DOM `RequestInit`, so it rides along as an extra property.
+        ...input.body ? { body: input.body, duplex: "half" } : {},
+        signal: input.signal,
+        // Everything else the Request carries. Dropping these would silently
+        // change fetch semantics under a proxy — most visibly `redirect`, where
+        // a `new Request(url, { redirect: "manual" })` would start following
+        // redirects instead of surfacing them.
+        redirect: input.redirect,
+        cache: input.cache,
+        credentials: input.credentials,
+        integrity: input.integrity,
+        keepalive: input.keepalive,
+        mode: input.mode,
+        referrer: input.referrer,
+        referrerPolicy: input.referrerPolicy,
+        // An explicit `init` still wins, per the fetch contract.
+        ...init
+      }
+    ];
+  }
+  return [input instanceof URL ? input.href : input, init ?? {}];
+}
+function createProxyFetch() {
+  if (readProxyEnv() === void 0) return void 0;
+  return async (input, init) => {
+    loadedProxiedFetch ??= loadProxiedFetch();
+    return (await loadedProxiedFetch)(input, init);
   };
-  return proxiedFetch;
 }
+
+// ../../core/mcp/node/transport.ts
 function headersFromSettings(settings) {
   if (!settings || settings.headers.length === 0) return void 0;
   const out = {};
@@ -1472,10 +2915,12 @@ function createTransportNode(config, options = {}) {
     onFetchResponseBody,
     authProvider,
     settings,
-    interceptAuthChallenges = false
+    interceptAuthChallenges = false,
+    onAuthChallengeObserved
   } = options;
-  const baseFetch = withProxyDispatcher(optionsFetchFn ?? globalThis.fetch);
-  const fetchWithOptionalAuthIntercept = interceptAuthChallenges ? createAuthChallengeInterceptFetch(baseFetch) : baseFetch;
+  const baseFetch = optionsFetchFn ?? createProxyFetch() ?? globalThis.fetch;
+  const withChallengeObserver = (inner) => onAuthChallengeObserved ? createAuthChallengeObserverFetch(inner, onAuthChallengeObserved) : inner;
+  const fetchWithOptionalAuthIntercept = interceptAuthChallenges ? createAuthChallengeInterceptFetch(withChallengeObserver(baseFetch)) : withChallengeObserver(baseFetch);
   if (serverType === "stdio") {
     const stdioConfig = config;
     const transport = new StdioClientTransport({
@@ -1500,7 +2945,8 @@ function createTransportNode(config, options = {}) {
   } else if (serverType === "sse") {
     const sseConfig = config;
     const url = new URL(sseConfig.url);
-    const sseFetch = sseConfig.eventSourceInit?.fetch || fetchWithOptionalAuthIntercept;
+    const configuredSseFetch = sseConfig.eventSourceInit?.fetch;
+    const sseFetch = configuredSseFetch ? withChallengeObserver(configuredSseFetch) : fetchWithOptionalAuthIntercept;
     const trackedFetch = onFetchRequest ? createFetchTracker(sseFetch, {
       trackRequest: onFetchRequest,
       updateResponseBody: onFetchResponseBody
@@ -1699,7 +3145,8 @@ async function migrateClientPlaintextSecret(filePath, config, secretStore) {
   const value = secrets[SECRET_FIELD_IDP_CLIENT_SECRET];
   if (!value) return config;
   try {
-    const existing = await secretStore.get(
+    const existing = await secretStoreGetStrict(
+      secretStore,
       CLIENT_KEYCHAIN_ID,
       SECRET_FIELD_IDP_CLIENT_SECRET
     );
@@ -1710,10 +3157,11 @@ async function migrateClientPlaintextSecret(filePath, config, secretStore) {
         value
       );
     }
+    if (!await secretStoreIsDurable(secretStore)) return config;
     await writeStoreFile(filePath, serializeStore(stripped));
     return stripped;
   } catch (err) {
-    if (err instanceof KeychainUnavailableError) {
+    if (err instanceof SecretStoreUnavailableError) {
       return config;
     }
     throw err;
@@ -1770,7 +3218,7 @@ function getActiveCimdClientMetadataUrl(config) {
 // ../../core/client/runner.ts
 async function loadRunnerClientConfig(options) {
   const customPath = options?.clientConfigPath?.trim() || process.env.MCP_CLIENT_CONFIG_PATH?.trim() || void 0;
-  const secretStore = options?.secretStore ?? new KeyringSecretStore();
+  const secretStore = options?.secretStore ?? defaultSecretStore();
   return loadClientConfig({ filePath: customPath, secretStore });
 }
 function isOAuthCapableServerConfig(config) {
@@ -1782,7 +3230,7 @@ function buildRunnerClientAuthOptions(clientConfig, savedSettings, cliOverrides)
   const activeCimdUrl = getActiveCimdClientMetadataUrl(clientConfig);
   const serverAuthorizationParams = savedSettings ? oauthAuthorizationParamsFromSettings(savedSettings) : void 0;
   const serverEndpointOverrides = savedSettings ? oauthEndpointOverridesFromSettings(savedSettings) : void 0;
-  const oauthFromServer = savedSettings && (savedSettings.oauthClientId || savedSettings.oauthClientSecret || savedSettings.oauthScopes || serverAuthorizationParams || serverEndpointOverrides || savedSettings.enterpriseManaged) ? {
+  const oauthFromServer = savedSettings && (savedSettings.oauthClientId || savedSettings.oauthClientSecret || savedSettings.oauthScopes || serverAuthorizationParams || serverEndpointOverrides || savedSettings.enterpriseManaged || savedSettings.oauthRequestRefreshToken === false) ? {
     ...savedSettings.oauthClientId && {
       clientId: savedSettings.oauthClientId
     },
@@ -1798,6 +3246,11 @@ function buildRunnerClientAuthOptions(clientConfig, savedSettings, cliOverrides)
     ...serverEndpointOverrides,
     ...savedSettings.enterpriseManaged && {
       enterpriseManaged: true
+    },
+    // #2068: only the explicit opt-out is forwarded; omitting the key
+    // leaves the provider's default (declare `refresh_token`) in place.
+    ...savedSettings.oauthRequestRefreshToken === false && {
+      requestRefreshToken: false
     }
   } : void 0;
   const clientMetadataUrl = cliOverrides?.clientMetadataUrl?.trim() || activeCimdUrl;
@@ -1908,7 +3361,7 @@ function formatRunnerOAuthRedirectUrl(config) {
 // src/App.tsx
 import {
   useState as useState23,
-  useMemo as useMemo3,
+  useMemo as useMemo4,
   useEffect as useEffect20,
   useCallback as useCallback11,
   useRef as useRef13
@@ -1917,6 +3370,10 @@ import { Box as Box27, Text as Text24, useInput as useInput21, useApp } from "in
 
 // ../../core/mcp/inspectorClient.ts
 import { Client } from "@modelcontextprotocol/client";
+import {
+  ProgressTokenSchema,
+  RequestMetaSchema
+} from "@modelcontextprotocol/core";
 
 // ../../core/json/xMcpHeader.ts
 var X_MCP_HEADER_KEY = "x-mcp-header";
@@ -1954,8 +3411,8 @@ var OBJECT_VALUED_SUBSCHEMA_KEYWORDS = /* @__PURE__ */ new Set([
   "$defs",
   "definitions"
 ]);
-function pathName(path3) {
-  return path3.length === 0 ? "<root>" : path3.join(".");
+function pathName(path6) {
+  return path6.length === 0 ? "<root>" : path6.join(".");
 }
 function isRecord(node) {
   return node !== null && typeof node === "object";
@@ -1963,23 +3420,23 @@ function isRecord(node) {
 function scanXMcpHeaderDeclarations(inputSchema) {
   const declarations = [];
   const seenLower = /* @__PURE__ */ new Map();
-  const visit = (node, path3, reachable) => {
+  const visit = (node, path6, reachable) => {
     if (!isRecord(node)) return void 0;
     const schema = node;
     if (X_MCP_HEADER_KEY in schema) {
-      if (!reachable || path3.length === 0) {
-        return `${pathName(path3)}: x-mcp-header is only permitted on properties statically reachable via a chain of 'properties' keys (not under items, additionalProperties, oneOf/anyOf/allOf/not, if/then/else, or $ref)`;
+      if (!reachable || path6.length === 0) {
+        return `${pathName(path6)}: x-mcp-header is only permitted on properties statically reachable via a chain of 'properties' keys (not under items, additionalProperties, oneOf/anyOf/allOf/not, if/then/else, or $ref)`;
       }
       const raw = schema[X_MCP_HEADER_KEY];
       if (typeof raw !== "string" || raw.length === 0) {
-        return `${pathName(path3)}: x-mcp-header MUST be a non-empty string`;
+        return `${pathName(path6)}: x-mcp-header MUST be a non-empty string`;
       }
       if (!RFC9110_TOKEN.test(raw)) {
-        return `${pathName(path3)}: x-mcp-header '${raw}' is not a valid RFC 9110 token (no spaces, control characters or HTTP delimiters)`;
+        return `${pathName(path6)}: x-mcp-header '${raw}' is not a valid RFC 9110 token (no spaces, control characters or HTTP delimiters)`;
       }
       const type = typeof schema.type === "string" ? schema.type : void 0;
       if (type === void 0 || !PERMITTED_X_MCP_HEADER_TYPES.has(type)) {
-        return `${pathName(path3)}: x-mcp-header is only permitted on primitive-typed properties (string, integer, boolean); got ${type ?? "<none>"}`;
+        return `${pathName(path6)}: x-mcp-header is only permitted on primitive-typed properties (string, integer, boolean); got ${type ?? "<none>"}`;
       }
       const lower = raw.toLowerCase();
       const prior = seenLower.get(lower);
@@ -1987,12 +3444,12 @@ function scanXMcpHeaderDeclarations(inputSchema) {
         return `x-mcp-header '${raw}' is not case-insensitively unique (also declared as '${prior}')`;
       }
       seenLower.set(lower, raw);
-      declarations.push({ path: path3, headerName: raw, type });
+      declarations.push({ path: path6, headerName: raw, type });
     }
     const properties = schema.properties;
     if (isRecord(properties)) {
       for (const [key, child] of Object.entries(properties)) {
-        const fault2 = visit(child, [...path3, key], reachable);
+        const fault2 = visit(child, [...path6, key], reachable);
         if (fault2 !== void 0) return fault2;
       }
     }
@@ -2001,7 +3458,7 @@ function scanXMcpHeaderDeclarations(inputSchema) {
       if (sub === void 0) continue;
       const branches = Array.isArray(sub) ? sub : isRecord(sub) && OBJECT_VALUED_SUBSCHEMA_KEYWORDS.has(k) ? Object.values(sub) : [sub];
       for (const branch of branches) {
-        const fault2 = visit(branch, [...path3, `<${k}>`], false);
+        const fault2 = visit(branch, [...path6, `<${k}>`], false);
         if (fault2 !== void 0) return fault2;
       }
     }
@@ -2046,9 +3503,9 @@ function utf8ToBase64(s) {
 function encodeMcpParamValue(value) {
   return needsBase64(value) ? `${BASE64_SENTINEL_PREFIX}${utf8ToBase64(value)}${BASE64_SENTINEL_SUFFIX}` : value;
 }
-function valueAtPath(root, path3) {
+function valueAtPath(root, path6) {
   let node = root;
-  for (const key of path3) {
+  for (const key of path6) {
     if (node === null || typeof node !== "object") return void 0;
     node = node[key];
   }
@@ -2269,12 +3726,84 @@ function buildClientExtensions(input) {
       map[ext.key] = ext.advertisement ? structuredClone(ext.advertisement) : {};
     }
   }
+  const uiAdvertisement = map[UI_EXTENSION_KEY];
+  if (input.appElicitation && uiAdvertisement) {
+    map[UI_EXTENSION_KEY] = { ...uiAdvertisement, elicitation: {} };
+  }
   if (input.enterpriseManaged) {
     map[EMA_EXTENSION_KEY] = {};
   }
   return map;
 }
 
+// ../../core/mcp/appElicitation.ts
+import { ElicitResultSchema } from "@modelcontextprotocol/core";
+function uiExtension(capabilities) {
+  const ext = capabilities?.extensions?.[UI_EXTENSION_KEY];
+  return typeof ext === "object" && ext !== null ? ext : void 0;
+}
+function getUiClientCapability(capabilities) {
+  return uiExtension(capabilities);
+}
+function getUiServerCapability(capabilities) {
+  return uiExtension(capabilities);
+}
+function supportsAppElicitation(clientCapabilities, serverCapabilities) {
+  const clientUi = getUiClientCapability(clientCapabilities);
+  const serverUi = getUiServerCapability(serverCapabilities);
+  return Boolean(
+    clientCapabilities?.elicitation?.form && clientUi?.mimeTypes?.includes(MCP_APP_MIME_TYPE) && clientUi.elicitation && serverUi?.elicitation
+  );
+}
+var ELICITATION_UI_URI_ERROR = "Elicitation UI resourceUri must be an absolute ui:// URI";
+function validateElicitationUiResourceUri(resourceUri) {
+  let parsed;
+  try {
+    parsed = new URL(resourceUri);
+  } catch {
+    throw new Error(ELICITATION_UI_URI_ERROR);
+  }
+  if (parsed.protocol !== "ui:" || !/^ui:\/\//i.test(resourceUri) || parsed.host.length === 0) {
+    throw new Error(ELICITATION_UI_URI_ERROR);
+  }
+}
+function getElicitationUiResourceUri(params) {
+  const ui = params._meta?.ui;
+  if (typeof ui !== "object" || ui === null) return void 0;
+  const resourceUri = ui.resourceUri;
+  if (resourceUri === void 0) return void 0;
+  if (typeof resourceUri !== "string") {
+    throw new Error("Elicitation UI resourceUri must be a string");
+  }
+  validateElicitationUiResourceUri(resourceUri);
+  return resourceUri;
+}
+function isFormElicitation(params) {
+  const mode = params.mode;
+  return mode === void 0 || mode === "form";
+}
+var ELICIT_RESULT_ERROR = "App returned an invalid elicitation result";
+function validateAppElicitResult(provider, params, result) {
+  const parsed = ElicitResultSchema.safeParse(result);
+  if (!parsed.success) {
+    return `${ELICIT_RESULT_ERROR}: ${parsed.error.issues[0]?.message ?? "does not match ElicitResult"}`;
+  }
+  if (parsed.data.action !== "accept") return void 0;
+  const content = parsed.data.content;
+  if (typeof content !== "object" || content === null || Array.isArray(content)) {
+    return "App accepted the elicitation without a content object";
+  }
+  const schema = params.requestedSchema;
+  if (typeof schema !== "object" || schema === null) return void 0;
+  try {
+    const validate = provider.getValidator(schema);
+    const validation = validate(content);
+    return validation.valid ? void 0 : `App content does not match the requested schema: ${validation.errorMessage}`;
+  } catch {
+    return void 0;
+  }
+}
+
 // ../../core/mcp/inspectorClient.ts
 import {
   EmptyResultSchema,
@@ -2365,10 +3894,10 @@ function labelForRawItem(value) {
 function describeIssues(error) {
   const [issue] = error.issues;
   if (!issue) return "did not match the expected shape";
-  const path3 = issue.path.join(".");
+  const path6 = issue.path.join(".");
   const detail = expectedDetail(issue);
   const message = detail ? `${issue.message} (${detail})` : issue.message;
-  return path3.length > 0 ? `${path3}: ${message}` : message;
+  return path6.length > 0 ? `${path6}: ${message}` : message;
 }
 function expectedDetail(issue) {
   if (!("expected" in issue) || typeof issue.expected !== "string") {
@@ -2726,7 +4255,7 @@ var SamplingCreateMessage = class {
   resolvePromise;
   rejectPromise;
   onRemove;
-  constructor(request, resolve4, reject, onRemove, origin = "server-request") {
+  constructor(request, resolve7, reject, onRemove, origin = "server-request") {
     this.onRemove = onRemove;
     this.id = `sampling-${crypto.randomUUID()}`;
     this.timestamp = /* @__PURE__ */ new Date();
@@ -2734,7 +4263,7 @@ var SamplingCreateMessage = class {
     const relatedTask = request.params?._meta?.[RELATED_TASK_META_KEY];
     this.taskId = relatedTask?.taskId;
     this.origin = origin;
-    this.resolvePromise = resolve4;
+    this.resolvePromise = resolve7;
     this.rejectPromise = reject;
   }
   /**
@@ -2826,7 +4355,7 @@ var ElicitationCreateMessage = class {
    */
   rejectCallback;
   onRemove;
-  constructor(request, resolve4, onRemove, reject, origin = "server-request") {
+  constructor(request, resolve7, onRemove, reject, origin = "server-request") {
     this.onRemove = onRemove;
     this.id = `elicitation-${crypto.randomUUID()}`;
     this.timestamp = /* @__PURE__ */ new Date();
@@ -2834,7 +4363,7 @@ var ElicitationCreateMessage = class {
     const relatedTask = request.params?._meta?.[RELATED_TASK_META_KEY2];
     this.taskId = relatedTask?.taskId;
     this.origin = origin;
-    this.resolvePromise = resolve4;
+    this.resolvePromise = resolve7;
     this.rejectCallback = reject;
   }
   /**
@@ -3022,7 +4551,7 @@ function isAuthorizationServerMetadataRequest(input) {
   } catch {
     pathname = raw;
   }
-  return AS_METADATA_WELL_KNOWN_PATHS.some((path3) => pathname.includes(path3));
+  return AS_METADATA_WELL_KNOWN_PATHS.some((path6) => pathname.includes(path6));
 }
 function isJsonDocumentResponse(contentType) {
   if (!contentType) return false;
@@ -3127,6 +4656,47 @@ function applyAuthorizationParams(authorizationUrl, params) {
   return merged;
 }
 
+// ../../core/auth/scopes.ts
+import {
+  computeScopeUnion as sdkComputeScopeUnion,
+  isStrictScopeSuperset as sdkIsStrictScopeSuperset
+} from "@modelcontextprotocol/client";
+var computeScopeUnion = sdkComputeScopeUnion;
+var isStrictScopeSuperset = sdkIsStrictScopeSuperset;
+var OFFLINE_ACCESS_SCOPE = "offline_access";
+function scopeForDeclinedRefreshGrant(effectiveScope, configuredScope, requiredScopes) {
+  if (!effectiveScope) return effectiveScope;
+  const configured = configuredScope?.trim().split(/\s+/) ?? [];
+  const required = requiredScopes ?? [];
+  if (configured.includes(OFFLINE_ACCESS_SCOPE) || required.includes(OFFLINE_ACCESS_SCOPE)) {
+    const tokens = effectiveScope.trim().split(/\s+/).filter((token) => token !== "");
+    if (!tokens.includes(OFFLINE_ACCESS_SCOPE)) {
+      tokens.push(OFFLINE_ACCESS_SCOPE);
+    }
+    return tokens.join(" ");
+  }
+  const kept = effectiveScope.trim().split(/\s+/).filter((token) => token !== "" && token !== OFFLINE_ACCESS_SCOPE);
+  if (kept.length > 0) return kept.join(" ");
+  const fallback = configuredScope?.trim();
+  if (fallback) return fallback;
+  return void 0;
+}
+function resolvePersistedScopeAfterGrant(grantedScope, requestedScope) {
+  const granted = grantedScope?.trim();
+  if (granted) {
+    return granted;
+  }
+  const requested = requestedScope?.trim();
+  return requested || void 0;
+}
+function resolveEffectiveGrantedScope(storedScope, tokenScope) {
+  const granted = tokenScope?.trim();
+  if (granted) {
+    return granted;
+  }
+  return computeScopeUnion(storedScope, tokenScope);
+}
+
 // ../../core/auth/providers.ts
 var MutableRedirectUrlProvider = class {
   redirectUrl = "";
@@ -3164,6 +4734,10 @@ var BaseOAuthClientProvider = class {
   clientMetadataUrl;
   /** Custom authorization-request parameters (#2018). Authorize URL only. */
   authorizationParams;
+  /** Declare the `refresh_token` grant in {@link clientMetadata} (#2068). */
+  requestRefreshToken;
+  /** Server-configured scope, for the #2068 `offline_access` distinction. */
+  configuredScope;
   constructor(serverUrl, oauthConfig) {
     this.serverUrl = serverUrl;
     this.storage = oauthConfig.storage;
@@ -3171,6 +4745,8 @@ var BaseOAuthClientProvider = class {
     this.navigation = oauthConfig.navigation;
     this.clientMetadataUrl = oauthConfig.clientMetadataUrl;
     this.authorizationParams = oauthConfig.authorizationParams;
+    this.requestRefreshToken = oauthConfig.requestRefreshToken ?? true;
+    this.configuredScope = oauthConfig.configuredScope;
   }
   /**
    * Load persisted scope into {@link cachedScope} before SDK `auth()` (which
@@ -3202,6 +4778,12 @@ var BaseOAuthClientProvider = class {
     this.suppressAuthorizationNavigation = suppress;
   }
   get scope() {
+    if (!this.requestRefreshToken) {
+      return scopeForDeclinedRefreshGrant(
+        this.cachedScope,
+        this.configuredScope
+      );
+    }
     return this.cachedScope;
   }
   get redirectUrl() {
@@ -3214,7 +4796,12 @@ var BaseOAuthClientProvider = class {
     const metadata = {
       redirect_uris: this.redirect_uris,
       token_endpoint_auth_method: "none",
-      grant_types: ["authorization_code", "refresh_token"],
+      // #2068: `refresh_token` is declared by default, and dropped when the
+      // server's "Request refresh token" setting is off — which stops the SDK
+      // *adding* `offline_access` (and so the `prompt=consent` it forces). It
+      // does not remove an `offline_access` that reaches the scope another way.
+      // See `OAuthProviderConfig.requestRefreshToken`.
+      grant_types: this.requestRefreshToken ? ["authorization_code", "refresh_token"] : ["authorization_code"],
       response_types: ["code"],
       client_name: "MCP Inspector",
       client_uri: "https://github.com/modelcontextprotocol/inspector",
@@ -3471,6 +5058,10 @@ function isJwtExpired(token, skewMs = 6e4, nowMs = Date.now()) {
   if (exp === void 0) return false;
   return nowMs >= exp - skewMs;
 }
+function isJwtFormat(token) {
+  const parts = token.split(".");
+  return parts.length === 3 && parts[0].length > 0 && parts[1].length > 0 && parts[2] !== void 0;
+}
 
 // ../../core/auth/ema/storage.ts
 function normalizeIdpIssuer(issuer) {
@@ -3703,13 +5294,12 @@ import {
 
 // ../../core/auth/discovery.ts
 import { discoverAuthorizationServerMetadata as discoverAuthorizationServerMetadata2 } from "@modelcontextprotocol/client";
-function getAuthorizationServerUrl(serverUrl, resourceMetadata) {
-  const first = resourceMetadata?.authorization_servers?.[0];
-  if (first) {
-    return parseHttpUrl(first, "protected resource authorization_servers[0]");
-  }
+function serverUrlAsAuthorizationServer(serverUrl) {
   try {
-    return new URL("/", serverUrl);
+    const url = new URL(serverUrl);
+    url.search = "";
+    url.hash = "";
+    return url;
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
     throw new Error(`Invalid MCP server URL: "${serverUrl}" (${detail})`, {
@@ -3717,6 +5307,43 @@ function getAuthorizationServerUrl(serverUrl, resourceMetadata) {
     });
   }
 }
+function getAuthorizationServerUrl(serverUrl, resourceMetadata) {
+  const first = resourceMetadata?.authorization_servers?.[0];
+  if (first) {
+    return parseHttpUrl(first, "protected resource authorization_servers[0]");
+  }
+  return serverUrlAsAuthorizationServer(serverUrl);
+}
+function getAuthorizationServerUrlCandidates(serverUrl, resourceMetadata) {
+  const primary = getAuthorizationServerUrl(serverUrl, resourceMetadata);
+  const namedByMetadata = Boolean(resourceMetadata?.authorization_servers?.[0]);
+  if (namedByMetadata || primary.pathname === "/") return [primary];
+  return [primary, new URL("/", primary)];
+}
+async function discoverAuthorizationServerMetadataFromCandidates(candidates, discover) {
+  let firstError;
+  let sawError = false;
+  for (const candidate of candidates) {
+    try {
+      const metadata = await discover(candidate);
+      if (metadata) return { authorizationServerUrl: candidate, metadata };
+    } catch (err) {
+      if (!sawError) {
+        firstError = err;
+        sawError = true;
+      }
+    }
+  }
+  if (sawError) throw firstError;
+  return void 0;
+}
+async function discoverAuthorizationServerMetadataForServer(serverUrl, resourceMetadata, fetchFn) {
+  const found = await discoverAuthorizationServerMetadataFromCandidates(
+    getAuthorizationServerUrlCandidates(serverUrl, resourceMetadata),
+    (candidate) => discoverAuthorizationServerMetadata2(candidate, { fetchFn })
+  );
+  return found?.metadata;
+}
 
 // ../../core/auth/ema/resourceContext.ts
 function resolveEmaScopes(resourceMetadata, configuredScope) {
@@ -3899,7 +5526,7 @@ async function mintEmaResourceTokens(config, resourceContext) {
     scope: ctx.scope,
     fetchFn: config.fetchFn
   });
-  return redeemIdJagForAccessToken({
+  const tokens = await redeemIdJagForAccessToken({
     resourceAsUrl: ctx.resourceAsUrl,
     idJag,
     resourceClientId: config.resourceClientId,
@@ -3908,6 +5535,19 @@ async function mintEmaResourceTokens(config, resourceContext) {
     scope: ctx.scope,
     fetchFn: config.fetchFn
   });
+  return { tokens, requestedScope: ctx.scope };
+}
+async function saveMintedTokens(config, { tokens, requestedScope }) {
+  await config.storage.saveTokens(config.serverUrl, tokens, {
+    enterpriseManaged: true
+  });
+  const scopeToPersist = resolvePersistedScopeAfterGrant(
+    tokens.scope,
+    requestedScope
+  );
+  if (scopeToPersist) {
+    await config.storage.saveScope(config.serverUrl, scopeToPersist);
+  }
 }
 async function trySilentEmaAuth(config) {
   const idToken = await getValidIdToken({
@@ -3919,10 +5559,7 @@ async function trySilentEmaAuth(config) {
     return { status: "no_idp_session" };
   }
   try {
-    const tokens = await mintEmaResourceTokens(config);
-    await config.storage.saveTokens(config.serverUrl, tokens, {
-      enterpriseManaged: true
-    });
+    await saveMintedTokens(config, await mintEmaResourceTokens(config));
     return { status: "success" };
   } catch (err) {
     return { status: "mint_failed", error: wrapEmaMintError(err) };
@@ -3953,16 +5590,14 @@ async function completeEmaIdpAuthorizationAndMint(config, authorizationCode, iss
       cause: err
     });
   }
-  let tokens;
+  let minted;
   try {
-    tokens = await mintEmaResourceTokens(config);
+    minted = await mintEmaResourceTokens(config);
   } catch (err) {
     throw wrapEmaMintError(err);
   }
-  await config.storage.saveTokens(config.serverUrl, tokens, {
-    enterpriseManaged: true
-  });
-  return tokens;
+  await saveMintedTokens(config, minted);
+  return minted;
 }
 async function refreshEmaResourceTokens(config) {
   const idToken = await getValidIdToken({
@@ -3973,11 +5608,9 @@ async function refreshEmaResourceTokens(config) {
   if (!idToken) {
     return void 0;
   }
-  const tokens = await mintEmaResourceTokens(config);
-  await config.storage.saveTokens(config.serverUrl, tokens, {
-    enterpriseManaged: true
-  });
-  return tokens;
+  const minted = await mintEmaResourceTokens(config);
+  await saveMintedTokens(config, minted);
+  return minted.tokens;
 }
 
 // ../../core/auth/ema/idpSession.ts
@@ -3996,6 +5629,12 @@ function isAccessTokenUsable(tokens) {
   if (!tokens?.access_token) return false;
   return !isJwtExpired(tokens.access_token);
 }
+function isAccessTokenProvablyUnexpired(tokens) {
+  if (!tokens?.access_token) return false;
+  if (!isJwtFormat(tokens.access_token)) return false;
+  if (jwtExpiresAtMs(tokens.access_token) === void 0) return false;
+  return !isJwtExpired(tokens.access_token);
+}
 function resolveClient(preregistered, dynamic, dynamicRegistrationKind) {
   if (preregistered?.client_id) {
     return {
@@ -4083,10 +5722,7 @@ function protocolFromOAuthConfig(config) {
 }
 
 // ../../core/auth/cimd.ts
-import {
-  discoverAuthorizationServerMetadata as discoverAuthorizationServerMetadata4,
-  discoverOAuthProtectedResourceMetadata as discoverOAuthProtectedResourceMetadata2
-} from "@modelcontextprotocol/client";
+import { discoverOAuthProtectedResourceMetadata as discoverOAuthProtectedResourceMetadata2 } from "@modelcontextprotocol/client";
 async function ensureCimdClientRegistration(params) {
   const clientMetadataUrl = params.provider.clientMetadataUrl?.trim();
   if (!clientMetadataUrl) return;
@@ -4095,18 +5731,23 @@ async function ensureCimdClientRegistration(params) {
   let resourceMetadata;
   try {
     resourceMetadata = await discoverOAuthProtectedResourceMetadata2(
-      params.serverUrl
+      params.serverUrl,
+      { resourceMetadataUrl: params.resourceMetadataUrl },
+      // The same fetch the AS-metadata leg below uses. On web that is
+      // `createRemoteFetch`, which proxies through the backend to sidestep
+      // CORS — on the global `fetch` this leg would fail in the browser, be
+      // swallowed by the catch, and leave CIMD probing the wrong
+      // authorization server (Copilot).
+      params.fetchFn
     );
   } catch {
     resourceMetadata = void 0;
   }
-  const authServerUrl = getAuthorizationServerUrl(
+  const metadata = await discoverAuthorizationServerMetadataForServer(
     params.serverUrl,
-    resourceMetadata
+    resourceMetadata,
+    params.fetchFn
   );
-  const metadata = await discoverAuthorizationServerMetadata4(authServerUrl, {
-    ...params.fetchFn && { fetchFn: params.fetchFn }
-  });
   if (!metadata?.client_id_metadata_document_supported) return;
   const clientInformation = {
     client_id: clientMetadataUrl
@@ -4175,29 +5816,6 @@ var EmaTransportOAuthProvider = class {
   }
 };
 
-// ../../core/auth/scopes.ts
-import {
-  computeScopeUnion as sdkComputeScopeUnion,
-  isStrictScopeSuperset as sdkIsStrictScopeSuperset
-} from "@modelcontextprotocol/client";
-var computeScopeUnion = sdkComputeScopeUnion;
-var isStrictScopeSuperset = sdkIsStrictScopeSuperset;
-function resolvePersistedScopeAfterGrant(grantedScope, requestedScope) {
-  const granted = grantedScope?.trim();
-  if (granted) {
-    return granted;
-  }
-  const requested = requestedScope?.trim();
-  return requested || void 0;
-}
-function resolveEffectiveGrantedScope(storedScope, tokenScope) {
-  const granted = tokenScope?.trim();
-  if (granted) {
-    return granted;
-  }
-  return computeScopeUnion(storedScope, tokenScope);
-}
-
 // ../../core/auth/oauthUx.ts
 function isStandardOAuthStepUp(challenge, options) {
   return challenge.reason === "insufficient_scope" && !options?.enterpriseManaged;
@@ -4285,6 +5903,11 @@ var OAuthManager = class {
   oauthFlowState = null;
   /** SEP-2350 union scope pending until interactive step-up completes. */
   pendingAuthorizationScope;
+  /**
+   * The RFC 9728 metadata URL from the last 401/403 the transport observed.
+   * See {@link noteObservedAuthChallenge}.
+   */
+  observedResourceMetadataUrl;
   authChallengeMutex = Promise.resolve();
   constructor(params) {
     this.params = params;
@@ -4352,7 +5975,14 @@ var OAuthManager = class {
       // the provider (not in OAuth storage like `scope`) — they are pure config
       // read from mcp.json, and nothing in the flow needs to persist or union
       // them.
-      authorizationParams: this.oauthConfig.authorizationParams
+      authorizationParams: this.oauthConfig.authorizationParams,
+      // #2068: per-server opt-out of the `refresh_token` grant. Like
+      // `authorizationParams` this is pure config off mcp.json, so it lives on
+      // the provider rather than in OAuth storage.
+      requestRefreshToken: this.oauthConfig.requestRefreshToken,
+      // #2068: lets the provider tell an `offline_access` the user asked for
+      // from one inherited from a previous grant's persisted scope.
+      configuredScope: this.oauthConfig.scope
     });
     provider.setEventTarget(this.params.getEventTarget());
     await provider.prepareForAuth();
@@ -4431,6 +6061,19 @@ var OAuthManager = class {
     await this.recordAuthorizationCodeFlowState(authorizationUrl);
     return authorizationUrl;
   }
+  /**
+   * Record a challenge the transport saw but did not raise as one.
+   *
+   * The legacy first-authorization path connects with no `authProvider` and no
+   * challenge interception, so the client calls {@link authenticate} off a
+   * headerless SDK `UnauthorizedError` — this is what carries the advertised
+   * RFC 9728 metadata URL across that gap (#2071). Latest-wins: every
+   * challenge comes from the same server, so the most recent one is what that
+   * server currently says, including when it says nothing.
+   */
+  noteObservedAuthChallenge(challenge) {
+    this.observedResourceMetadataUrl = challengeResourceMetadataUrl(challenge);
+  }
   async authenticate() {
     if (this.isEnterpriseManaged()) {
       return this.authenticateEnterpriseManaged();
@@ -4438,15 +6081,19 @@ var OAuthManager = class {
     const provider = await this.createOAuthProvider();
     const serverUrl = this.getServerUrl();
     provider.clearCapturedAuthUrl();
+    const resourceMetadataUrl = this.observedResourceMetadataUrl;
     await ensureCimdClientRegistration({
       serverUrl,
       provider,
-      fetchFn: this.params.effectiveAuthFetch
+      fetchFn: this.params.effectiveAuthFetch,
+      resourceMetadataUrl
     });
+    const requestedScope = provider.scope;
     const result = await mcpAuth(provider, {
       serverUrl,
-      scope: provider.scope,
-      fetchFn: this.params.effectiveAuthFetch
+      scope: requestedScope,
+      fetchFn: this.params.effectiveAuthFetch,
+      resourceMetadataUrl
     });
     if (result === "AUTHORIZED") {
       throw new Error(
@@ -4457,6 +6104,7 @@ var OAuthManager = class {
     if (!capturedUrl) {
       throw new Error("Failed to capture authorization URL");
     }
+    this.recordAuthorizationRequestScope(capturedUrl, requestedScope);
     const stateParam = capturedUrl.searchParams.get("state");
     if (stateParam && this.params.onBeforeOAuthRedirect) {
       const parsedState = parseOAuthState(stateParam);
@@ -4473,28 +6121,42 @@ var OAuthManager = class {
     };
     return capturedUrl;
   }
+  /**
+   * Remember what an interactive authorization asked for, so the callback can
+   * apply RFC 6749 §5.1 — a token response that omits `scope` granted exactly
+   * the requested scope (#2117). Without it, an ordinary grant whose AS echoes
+   * no scope leaves the previous stored scope standing as though it were what
+   * the current token carries.
+   *
+   * The authorize URL is the authority, not the scope handed to `auth()`: the
+   * SDK augments the request with `offline_access` when the AS advertises it
+   * and the client asks for a refresh token, so the input can be a strict
+   * subset of what was actually requested. The fallback covers an authorize
+   * URL that carries no `scope` parameter at all.
+   *
+   * This composes with the #2068 refresh-token opt-out rather than defeating
+   * it. The SDK's augmentation is gated on `clientMetadata.grant_types`
+   * including `refresh_token`, which the provider drops when the opt-out is
+   * on — so with the grant declined the URL carries the *filtered* scope, and
+   * that is what gets persisted. #2068 recorded the same value here behind a
+   * `requestRefreshToken === false` gate; reading the URL makes the gate
+   * unnecessary, so one wire case now has one persistence behavior instead of
+   * two selected by a checkbox (#2117).
+   */
+  recordAuthorizationRequestScope(authorizationUrl, requestedScope) {
+    this.pendingAuthorizationScope = authorizationUrl.searchParams.get("scope")?.trim() || requestedScope;
+  }
   async completeOAuthFlow(authorizationCode, iss) {
     try {
       if (this.isEnterpriseManaged()) {
         const emaConfig = await this.getEmaFlowConfig();
         const scopeForMint = this.pendingAuthorizationScope ?? emaConfig.scope;
         const config = scopeForMint ? { ...emaConfig, scope: scopeForMint } : emaConfig;
-        const tokens2 = await completeEmaIdpAuthorizationAndMint(
+        const { tokens: tokens2 } = await completeEmaIdpAuthorizationAndMint(
           config,
           authorizationCode,
           iss
         );
-        const requestedScope2 = this.pendingAuthorizationScope;
-        const scopeToPersist2 = resolvePersistedScopeAfterGrant(
-          tokens2.scope,
-          requestedScope2
-        );
-        if (scopeToPersist2) {
-          await this.requireStorage().saveScope(
-            this.getServerUrl(),
-            scopeToPersist2
-          );
-        }
         this.pendingAuthorizationScope = void 0;
         const completedAt2 = Date.now();
         this.oauthFlowState = {
@@ -4624,9 +6286,12 @@ var OAuthManager = class {
    * satisfied without an authorization-server round-trip.
    *
    * Returns `true` for `insufficient_scope` when stored + token scope cover the
-   * SEP-2350 union. For `token_expired`, returns `true` when a usable access
-   * token is already in storage. `invalid_token` and `unauthorized` always
-   * return `false` — the resource server explicitly rejected the credential.
+   * SEP-2350 union. For `token_expired`, returns `true` only when storage holds
+   * a *provably* unexpired token — a JWT whose `exp` is still in the future. An
+   * opaque token carries no local expiry evidence, so the resource server's
+   * verdict stands and re-authorization proceeds. `invalid_token` and
+   * `unauthorized` always return `false` — the resource server explicitly
+   * rejected the credential.
    */
   async checkAuthChallengeSatisfied(challenge) {
     const storage = this.oauthConfig.storage;
@@ -4639,7 +6304,7 @@ var OAuthManager = class {
       return false;
     }
     if (challenge.reason !== "insufficient_scope") {
-      return challenge.reason === "token_expired" && isAccessTokenUsable(tokens);
+      return challenge.reason === "token_expired" && isAccessTokenProvablyUnexpired(tokens);
     }
     const enriched = await this.enrichChallengeWithAuthorizationScopes(
       challenge,
@@ -4674,8 +6339,8 @@ var OAuthManager = class {
     }
     const prior = this.authChallengeMutex;
     let release;
-    const gate = new Promise((resolve4) => {
-      release = resolve4;
+    const gate = new Promise((resolve7) => {
+      release = resolve7;
     });
     this.authChallengeMutex = gate;
     await prior;
@@ -4799,12 +6464,27 @@ var OAuthManager = class {
       tokens?.scope
     );
     provider.clearCapturedAuthUrl();
+    const resourceMetadataUrl = challengeResourceMetadataUrl(enriched);
     await ensureCimdClientRegistration({
       serverUrl,
       provider,
-      fetchFn: this.params.effectiveAuthFetch
+      fetchFn: this.params.effectiveAuthFetch,
+      resourceMetadataUrl
     });
-    const scopeForAuth = enriched.reason === "insufficient_scope" ? enriched.authorizationScopes?.join(" ") : this.oauthConfig.scope?.trim() || (enriched.requiredScopes?.length ? enriched.requiredScopes.join(" ") : void 0);
+    const requestedScopeForAuth = enriched.reason === "insufficient_scope" ? enriched.authorizationScopes?.join(" ") : this.oauthConfig.scope?.trim() || (enriched.requiredScopes?.length ? enriched.requiredScopes.join(" ") : void 0);
+    const scopeForAuth = this.oauthConfig.requestRefreshToken === false ? scopeForDeclinedRefreshGrant(
+      requestedScopeForAuth,
+      this.oauthConfig.scope,
+      // The RAW challenge scopes, not `enriched.requiredScopes`:
+      // `enrichChallengeWithScopes` narrows that to the *missing* subset,
+      // so a challenge requiring `offline_access tools:write` against a
+      // stored scope that already has `offline_access` arrives here as
+      // just `["tools:write"]`. Passing the narrowed list would read the
+      // server's explicit requirement as inherited and strip it — then
+      // re-authorization earns the same challenge forever, which is the
+      // loop this argument exists to prevent.
+      challenge.requiredScopes
+    ) : requestedScopeForAuth;
     provider.setSuppressAuthorizationNavigation(true);
     let result;
     try {
@@ -4812,6 +6492,7 @@ var OAuthManager = class {
         serverUrl,
         scope: scopeForAuth,
         fetchFn: this.params.effectiveAuthFetch,
+        resourceMetadataUrl,
         ...enriched.reason === "insufficient_scope" && {
           forceReauthorization: isStrictScopeSuperset(
             scopeForAuth,
@@ -4859,9 +6540,7 @@ var OAuthManager = class {
         error: new Error("Failed to capture authorization URL")
       };
     }
-    if (enriched.reason === "insufficient_scope" && scopeForAuth) {
-      this.pendingAuthorizationScope = scopeForAuth;
-    }
+    this.recordAuthorizationRequestScope(capturedUrl, scopeForAuth);
     const clientInfo = await provider.clientInformation();
     await this.recordAuthorizationCodeFlowState(
       capturedUrl,
@@ -4918,6 +6597,7 @@ var OAuthManager = class {
         serverUrl,
         scope: scopeForAuth,
         fetchFn: this.params.effectiveAuthFetch,
+        resourceMetadataUrl: challengeResourceMetadataUrl(enriched),
         forceReauthorization: true
       });
     } finally {
@@ -4998,40 +6678,38 @@ function legacySessionId(json) {
 async function* parseSSE(reader) {
   const decoder = new TextDecoder();
   let buffer = "";
+  let currentEvent = "message";
+  let currentData = [];
+  const consume = (line) => {
+    if (line.startsWith("event:")) {
+      currentEvent = line.slice(6).trim();
+    } else if (line.startsWith("data:")) {
+      currentData.push(line.slice(5).trimStart());
+    } else if (line === "") {
+      const complete = currentData.length > 0 ? { event: currentEvent, data: currentData.join("\n") } : null;
+      currentEvent = "message";
+      currentData = [];
+      return complete;
+    }
+    return null;
+  };
   while (true) {
     const { done, value } = await reader.read();
     if (done) break;
     buffer += decoder.decode(value, { stream: true });
     const lines = buffer.split("\n");
     buffer = lines.pop() ?? "";
-    let currentEvent = "message";
-    let currentData = [];
     for (const line of lines) {
-      if (line.startsWith("event:")) {
-        currentEvent = line.slice(6).trim();
-      } else if (line.startsWith("data:")) {
-        currentData.push(line.slice(5).trimStart());
-      } else if (line === "") {
-        if (currentData.length > 0) {
-          yield { event: currentEvent, data: currentData.join("\n") };
-        }
-        currentEvent = "message";
-        currentData = [];
-      }
+      const complete = consume(line);
+      if (complete) yield complete;
     }
   }
-  if (buffer.trim()) {
-    const lines = buffer.split("\n");
-    let currentEvent = "message";
-    const currentData = [];
-    for (const line of lines) {
-      if (line.startsWith("event:")) currentEvent = line.slice(6).trim();
-      else if (line.startsWith("data:"))
-        currentData.push(line.slice(5).trimStart());
-    }
-    if (currentData.length > 0) {
-      yield { event: currentEvent, data: currentData.join("\n") };
-    }
+  if (buffer) {
+    const complete = consume(buffer);
+    if (complete) yield complete;
+  }
+  if (currentData.length > 0) {
+    yield { event: currentEvent, data: currentData.join("\n") };
   }
 }
 var RemoteClientTransport = class {
@@ -5366,7 +7044,7 @@ var RemoteClientTransport = class {
     this.sseResponseWaits.clear();
   }
   waitForSseResponse(requestId) {
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve7, reject) => {
       const timer = setTimeout(() => {
         this.sseResponseWaits.delete(requestId);
         reject(
@@ -5378,7 +7056,7 @@ var RemoteClientTransport = class {
       this.sseResponseWaits.set(requestId, {
         resolve: () => {
           clearTimeout(timer);
-          resolve4();
+          resolve7();
         },
         reject: (error) => {
           clearTimeout(timer);
@@ -5510,6 +7188,29 @@ function notificationMethodFromSchema(schema) {
   }
   return void 0;
 }
+function describeJsonType2(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "array";
+  return typeof value;
+}
+function isProgressToken(value) {
+  return ProgressTokenSchema.safeParse(value).success;
+}
+function dropInvalidReservedMeta(meta, logger) {
+  const result = RequestMetaSchema.safeParse(meta);
+  if (result.success) return meta;
+  const cleaned = { ...meta };
+  for (const issue of result.error.issues) {
+    const key = issue.path[0];
+    if (typeof key !== "string" || !(key in cleaned)) continue;
+    logger.warn(
+      { key, received: describeJsonType2(cleaned[key]) },
+      "Dropping reserved `_meta` member \u2014 it does not match the protocol schema."
+    );
+    delete cleaned[key];
+  }
+  return cleaned;
+}
 var MODERN_RECONNECT_BASE_MS = 500;
 var MODERN_RECONNECT_MAX_MS = 15e3;
 var MODERN_RECONNECT_MAX_ATTEMPTS = 8;
@@ -5699,6 +7400,37 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
   // Per-extension advertise overrides (#1738); undefined key falls back to the
   // registry default in ADVERTISABLE_EXTENSIONS.
   advertisedExtensions;
+  /**
+   * Host-supplied renderer for app-rendered form elicitations (#1854), or
+   * undefined on a client that cannot host MCP Apps. Its presence is what
+   * advertises the nested MCP Apps `elicitation` capability, so this is the one
+   * fact both the advertisement and the routing gate read.
+   */
+  appElicitationRenderer;
+  /**
+   * Monotonic counter behind the request-scoped id handed to the renderer. The
+   * association MUST be per request (a map keyed by this id owns the resource
+   * URI, renderer instance and promise on the host side) so two concurrent
+   * elicitations cannot resolve through each other's bridges.
+   */
+  appElicitationSeq = 0;
+  /**
+   * Per-instance prefix for {@link appElicitationSeq}.
+   *
+   * A counter alone is not enough: a host may hold ONE renderer across
+   * replacement clients (the web client rebuilds its `InspectorClient` on a
+   * settings change), and every fresh instance would otherwise mint
+   * `app-elicitation-1` for its first request. Settling that id would then
+   * resolve — or discard — whichever connection's request the host happened to
+   * be keying.
+   */
+  appElicitationPrefix = `app-elicitation-${globalThis.crypto?.randomUUID?.() ?? Math.random().toString(36).slice(2)}`;
+  /**
+   * Abort controllers for app-rendered elicitations still awaiting an answer.
+   * Aborted alongside the native pending queue on disconnect, so a rendered app
+   * cannot outlive the connection that asked for it.
+   */
+  activeAppElicitations = /* @__PURE__ */ new Set();
   receiverTaskTtlMs;
   receiverTaskRecords = /* @__PURE__ */ new Map();
   // OAuth support (config owned by oauthManager; client delegates and uses !!oauthManager for "is OAuth configured")
@@ -5746,6 +7478,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
     this.elicit = options.elicit ?? true;
     this.receiverTasks = options.receiverTasks ?? false;
     this.advertisedExtensions = options.advertisedExtensions;
+    this.appElicitationRenderer = options.appElicitation;
     this.receiverTaskTtlMs = options.receiverTaskTtlMs ?? 6e4;
     this.progress = options.progress ?? true;
     this.resetTimeoutOnProgress = options.resetTimeoutOnProgress ?? true;
@@ -5850,7 +7583,13 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
     }
     const advertisedExtensions = buildClientExtensions({
       enterpriseManaged: options.oauth?.enterpriseManaged ?? false,
-      advertised: this.advertisedExtensions
+      advertised: this.advertisedExtensions,
+      // Read off the built `capabilities.elicitation.form` rather than
+      // re-deriving from `options.elicit`: the nested MCP Apps `elicitation`
+      // setting must never be advertised without the core form capability it
+      // extends, and two derivations of the same fact can drift. Disabling form
+      // elicitation therefore drops both, as the contract requires. (#1854)
+      appElicitation: this.appElicitationRenderer !== void 0 && capabilities.elicitation?.form !== void 0
     });
     if (Object.keys(advertisedExtensions).length > 0) {
       capabilities.extensions = {
@@ -5974,7 +7713,23 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       ...logMeta ?? {},
       ...callMetadata ?? {}
     };
-    return Object.keys(merged).length > 0 ? merged : void 0;
+    const sanitized = dropInvalidReservedMeta(merged, this.logger);
+    return Object.keys(sanitized).length > 0 ? sanitized : void 0;
+  }
+  /**
+   * The `progressToken` a caller stamped on its request metadata, when it is
+   * one the SDK will accept.
+   *
+   * This governs only **callback correlation** — whether the client wires up an
+   * `onprogress` for the request. Keeping an invalid value off the **wire** is
+   * a separate concern handled in {@link mergeMeta}, which deletes the member
+   * from the outgoing `_meta` so a conforming server is never sent something
+   * `ProgressTokenSchema` rejects. The two use the same {@link isProgressToken}
+   * predicate, so they cannot disagree about what counts as valid.
+   */
+  progressTokenOf(metadata) {
+    const token = metadata?.progressToken;
+    return isProgressToken(token) ? token : void 0;
   }
   getRequestOptions(progressToken, signal) {
     const opts = {
@@ -6085,8 +7840,8 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
     };
     let resolvePayload;
     let rejectPayload;
-    const payloadPromise = new Promise((resolve4, reject) => {
-      resolvePayload = resolve4;
+    const payloadPromise = new Promise((resolve7, reject) => {
+      resolvePayload = resolve7;
       rejectPayload = reject;
     });
     void payloadPromise.catch(() => {
@@ -6095,7 +7850,8 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       task,
       payloadPromise,
       resolvePayload,
-      rejectPayload
+      rejectPayload,
+      abort: new AbortController()
     };
     record.cleanupTimeoutId = setTimeout(() => {
       record.cleanupTimeoutId = void 0;
@@ -6166,6 +7922,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
     };
     record.task = updatedTask;
     record.rejectPayload(new Error("Task cancelled"));
+    record.abort.abort();
     if (record.cleanupTimeoutId != null) {
       clearTimeout(record.cleanupTimeoutId);
       record.cleanupTimeoutId = void 0;
@@ -6265,7 +8022,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       }
     }
     if (this.elicitationCapabilityAdvertised && this.client) {
-      const elicitHandler = (request) => {
+      const elicitHandler = (request, ctx) => {
         const paramsTask = request.params?.task;
         if (this.tasksCapabilityAdvertised && paramsTask != null) {
           const record = this.createReceiverTask({
@@ -6273,40 +8030,68 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
             initialStatus: "input_required",
             statusMessage: "Awaiting user input"
           });
+          const completeTask = (result) => {
+            if (_InspectorClient.isTerminalTaskStatus(record.task.status))
+              return;
+            record.resolvePayload(result);
+            const updated = {
+              ...record.task,
+              status: "completed",
+              lastUpdatedAt: (/* @__PURE__ */ new Date()).toISOString()
+            };
+            record.task = updated;
+            this.upsertReceiverTask(updated);
+          };
+          const failTask = (error) => {
+            if (_InspectorClient.isTerminalTaskStatus(record.task.status))
+              return;
+            record.rejectPayload(error);
+            const updated = {
+              ...record.task,
+              status: "failed",
+              lastUpdatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+              statusMessage: error.message
+            };
+            record.task = updated;
+            this.upsertReceiverTask(updated);
+          };
           void (async () => {
+            let appResult;
+            try {
+              appResult = await this.tryAppElicitation(
+                request,
+                record.abort.signal
+              );
+            } catch (error) {
+              failTask(
+                error instanceof Error ? error : new Error(String(error))
+              );
+              return;
+            }
+            if (appResult) {
+              completeTask(appResult);
+              return;
+            }
             const elicitationRequest = new ElicitationCreateMessage(
               request,
-              (result) => {
-                record.resolvePayload(result);
-                const now = (/* @__PURE__ */ new Date()).toISOString();
-                const updated = {
-                  ...record.task,
-                  status: "completed",
-                  lastUpdatedAt: now
-                };
-                record.task = updated;
-                this.upsertReceiverTask(updated);
-              },
+              completeTask,
               (id) => this.removePendingElicitation(id),
-              (error) => {
-                record.rejectPayload(error);
-                const now = (/* @__PURE__ */ new Date()).toISOString();
-                const updated = {
-                  ...record.task,
-                  status: "failed",
-                  lastUpdatedAt: now,
-                  statusMessage: error.message
-                };
-                record.task = updated;
-                this.upsertReceiverTask(updated);
-              }
+              failTask
             );
             this.addPendingElicitation(elicitationRequest);
+            this.wirePendingAbort(
+              record.abort.signal,
+              () => this.removePendingElicitation(elicitationRequest.id)
+            );
           })();
           const taskResult = { task: record.task };
           return Promise.resolve(taskResult);
         }
-        return this.enqueuePendingElicitation(request, "server-request");
+        return this.enqueuePendingElicitation(
+          request,
+          "server-request",
+          ctx?.mcpReq?.signal
+        );
       };
       this.client.setRequestHandler("elicitation/create", elicitHandler);
       if (this.tasksCapabilityAdvertised) {
@@ -6396,6 +8181,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       if (record.cleanupTimeoutId != null) {
         clearTimeout(record.cleanupTimeoutId);
       }
+      record.abort.abort();
     }
     this.receiverTaskRecords.clear();
   }
@@ -6502,6 +8288,10 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       elicitation.cancel();
     }
     this.pendingElicitations = [];
+    for (const controller of this.activeAppElicitations) {
+      controller.abort();
+    }
+    this.activeAppElicitations.clear();
   }
   /**
    * {@link clearPendingPeerRequests} plus the change events, for every route
@@ -6522,7 +8312,11 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
    * `dropCachedTransport` also fires `onclose`) announce it once.
    */
   clearAndAnnouncePendingPeerRequests() {
-    if (this.pendingSamples.length === 0 && this.pendingElicitations.length === 0) {
+    if (this.pendingSamples.length === 0 && this.pendingElicitations.length === 0 && // App-rendered elicitations (#1854) are not in either array — they live in
+    // the host's renderer — so an emptiness check that ignores them lets a
+    // mid-session close (the `onclose` route, which reaches teardown only
+    // through here) leave a modal open for a connection that is gone.
+    this.activeAppElicitations.size === 0) {
       return;
     }
     this.clearPendingPeerRequests();
@@ -6565,6 +8359,10 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
         ...this.serverSettings && { settings: this.serverSettings }
       };
       if (this.isHttpOAuthConfig() && oauthManager) {
+        const manager = oauthManager;
+        transportOptions.onAuthChallengeObserved = (challenge) => {
+          manager.noteObservedAuthChallenge(challenge);
+        };
         if (oauthManager.isEnterpriseManaged()) {
           await oauthManager.trySilentEnterpriseManagedAuth();
           const provider = await oauthManager.createOAuthProviderForTransport();
@@ -7041,14 +8839,14 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       params
     };
     const timeoutMs = this.requestTimeout ?? 3e4;
-    const raw = await new Promise((resolve4, reject) => {
+    const raw = await new Promise((resolve7, reject) => {
       const timer = setTimeout(() => {
         this.pendingRawWireRequests.delete(id);
         reject(
           new Error(`Raw request "${method}" timed out after ${timeoutMs} ms`)
         );
       }, timeoutMs);
-      this.pendingRawWireRequests.set(id, { resolve: resolve4, reject, timer });
+      this.pendingRawWireRequests.set(id, { resolve: resolve7, reject, timer });
       transport.send(message).catch((err) => {
         const pending = this.pendingRawWireRequests.get(id);
         if (pending) {
@@ -7269,7 +9067,9 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
    * corresponding `ElicitResult` (echoed to the server on retry); only a
    * genuine failure or a `signal` abort rejects.
    */
-  enqueuePendingElicitation(request, origin, signal) {
+  async enqueuePendingElicitation(request, origin, signal) {
+    const appResult = await this.tryAppElicitation(request, signal);
+    if (appResult) return appResult;
     return new Promise((resolvePromise, rejectPromise) => {
       const elicitation = new ElicitationCreateMessage(
         request,
@@ -7285,6 +9085,79 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       });
     });
   }
+  /**
+   * Attempt to resolve an `elicitation/create` request by rendering the MCP App
+   * the server attached to it (#1854), returning the app's standard
+   * `ElicitResult`.
+   *
+   * Returns `null` for "not app-rendered — use the native UI", which covers
+   * every negotiation gate and every failure mode the contract lists: either
+   * peer did not negotiate the capability, the metadata is absent or unusable,
+   * the mode is not `form`, the renderer failed (resource read, sandbox/bridge
+   * init, missing app capability, timeout), or the app returned something that
+   * is not a valid result for this request. An explicit `decline` or `cancel`
+   * is a *completed* elicitation and is returned, not fallen back on.
+   *
+   * The one case that does not fall back is an abort of the originating
+   * request: the caller is cancelling the whole elicitation, so re-opening it
+   * in the native queue would resurrect work the user just abandoned.
+   */
+  async tryAppElicitation(request, signal) {
+    const renderer = this.appElicitationRenderer;
+    if (!renderer) return null;
+    if (!supportsAppElicitation(this.clientCapabilities, this.capabilities)) {
+      return null;
+    }
+    if (!isFormElicitation(request.params)) return null;
+    let resourceUri;
+    try {
+      resourceUri = getElicitationUiResourceUri(request.params);
+    } catch (error) {
+      this.logger.warn(
+        { error },
+        "Elicitation carried unusable _meta.ui.resourceUri; using the native elicitation UI"
+      );
+      return null;
+    }
+    if (!resourceUri) return null;
+    if (signal?.aborted) throw createPendingAbortError();
+    const controller = new AbortController();
+    const forwardAbort = () => controller.abort(signal?.reason);
+    signal?.addEventListener("abort", forwardAbort, { once: true });
+    this.activeAppElicitations.add(controller);
+    try {
+      const result = await renderer({
+        requestId: `${this.appElicitationPrefix}-${++this.appElicitationSeq}`,
+        resourceUri,
+        params: request.params,
+        signal: controller.signal
+      });
+      this.outputValidator ??= new AjvJsonSchemaValidator();
+      const invalid = validateAppElicitResult(
+        this.outputValidator,
+        request.params,
+        result
+      );
+      if (invalid) {
+        this.logger.warn(
+          { resourceUri, reason: invalid },
+          "App-rendered elicitation returned an invalid result; using the native elicitation UI"
+        );
+        return null;
+      }
+      return result;
+    } catch (error) {
+      if (controller.signal.aborted) throw createPendingAbortError();
+      this.logger.warn(
+        { error, resourceUri },
+        "App-rendered elicitation failed; using the native elicitation UI"
+      );
+      return null;
+    } finally {
+      this.activeAppElicitations.delete(controller);
+      signal?.removeEventListener("abort", forwardAbort);
+    }
+  }
   /**
    * Reject a still-pending request when `signal` aborts (e.g. the user cancels
    * the tool call while its MRTR round is awaiting an answer). No-op when
@@ -7587,7 +9460,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       () => this.client.request(
         { method: "tools/list", params },
         ListToolsResultSchema,
-        this.getRequestOptions(metadata?.progressToken)
+        this.getRequestOptions(this.progressTokenOf(metadata))
       )
     );
     const tools = [...response.tools || []];
@@ -7808,7 +9681,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
           ) : this.client.request(
             { method, params },
             pageSchema,
-            this.getRequestOptions(metadata?.progressToken)
+            this.getRequestOptions(this.progressTokenOf(metadata))
           ),
           { method }
         );
@@ -7937,7 +9810,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
           ) : this.client.request(
             { method: "tools/list", params },
             pageSchema,
-            this.getRequestOptions(metadata?.progressToken)
+            this.getRequestOptions(this.progressTokenOf(metadata))
           ),
           { method: "tools/list" }
         );
@@ -8157,7 +10030,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       callParams.task = { ttl: taskOptions.ttl };
     }
     const requestOptions = this.getRequestOptions(
-      metadata?.progressToken,
+      this.progressTokenOf(metadata),
       signal
     );
     this.applyMirroredParamHeaders(tool, convertedArgs, requestOptions);
@@ -8243,14 +10116,14 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
    * `completeIfPending`).
    */
   awaitUrlElicitation(params) {
-    return new Promise((resolve4) => {
+    return new Promise((resolve7) => {
       const request = {
         method: "elicitation/create",
         params
       };
       const message = new ElicitationCreateMessage(
         request,
-        (result) => resolve4(result.action),
+        (result) => resolve7(result.action),
         (id) => this.removePendingElicitation(id)
       );
       this.addPendingElicitation(message);
@@ -8409,7 +10282,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
           inputSignal
         );
         await new Promise(
-          (resolve4) => setTimeout(resolve4, this.taskPollInterval(task))
+          (resolve7) => setTimeout(resolve7, this.taskPollInterval(task))
         );
         detailed = await this.rawWireRequest(
           "tasks/get",
@@ -8487,7 +10360,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
             inputSignal
           );
           await new Promise(
-            (resolve4) => setTimeout(resolve4, this.taskPollInterval(task2))
+            (resolve7) => setTimeout(resolve7, this.taskPollInterval(task2))
           );
           detailed = await this.rawWireRequest(
             "tasks/get",
@@ -8518,7 +10391,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
     try {
       while (!_InspectorClient.isTerminalTaskStatus(task.status)) {
         await new Promise(
-          (resolve4) => setTimeout(resolve4, this.taskPollInterval(task))
+          (resolve7) => setTimeout(resolve7, this.taskPollInterval(task))
         );
         task = await client.request(
           { method: "tasks/get", params: { taskId: task.taskId } },
@@ -8581,7 +10454,9 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       let finalResult;
       let taskId;
       let error;
-      const requestOptions = this.getRequestOptions(metadata?.progressToken);
+      const requestOptions = this.getRequestOptions(
+        this.progressTokenOf(metadata)
+      );
       this.applyMirroredParamHeaders(tool, convertedArgs, requestOptions);
       if (this.progress) {
         const innerOnProgress = requestOptions.onprogress;
@@ -8748,7 +10623,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       () => this.client.request(
         { method: "resources/list", params },
         ListResourcesResultSchema,
-        this.getRequestOptions(metadata?.progressToken)
+        this.getRequestOptions(this.progressTokenOf(metadata))
       )
     );
     return {
@@ -8801,7 +10676,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
         "resources/read",
         params,
         ReadResourceResultSchema,
-        this.getRequestOptions(metadata?.progressToken)
+        this.getRequestOptions(this.progressTokenOf(metadata))
       ),
       { method: "resources/read" }
     );
@@ -8878,7 +10753,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       () => this.client.request(
         { method: "resources/templates/list", params },
         ListResourceTemplatesResultSchema,
-        this.getRequestOptions(metadata?.progressToken)
+        this.getRequestOptions(this.progressTokenOf(metadata))
       ),
       { method: "resources/templates/list" }
     );
@@ -8931,7 +10806,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       () => this.client.request(
         { method: "prompts/list", params },
         ListPromptsResultSchema,
-        this.getRequestOptions(metadata?.progressToken)
+        this.getRequestOptions(this.progressTokenOf(metadata))
       )
     );
     return {
@@ -8987,7 +10862,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
         "prompts/get",
         params,
         GetPromptResultSchema,
-        this.getRequestOptions(metadata?.progressToken)
+        this.getRequestOptions(this.progressTokenOf(metadata))
       ),
       { method: "prompts/get", toolName: name }
     );
@@ -9033,7 +10908,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       const response = await this.invokeMcpClient(
         () => this.client.complete(
           params,
-          this.getRequestOptions(metadata?.progressToken)
+          this.getRequestOptions(this.progressTokenOf(metadata))
         ),
         {
           method: "completion/complete",
@@ -11022,19 +12897,19 @@ function classifyAuthorizationServerMismatch(err) {
 }
 
 // ../../core/node/version.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname3, join as join2, parse } from "path";
+import { readFileSync as readFileSync3 } from "fs";
+import { dirname as dirname5, join as join3, parse } from "path";
 import { fileURLToPath } from "url";
 var ROOT_PACKAGE_NAME = "@modelcontextprotocol/inspector";
 function readInspectorVersion(callerUrl) {
-  const startDir = dirname3(fileURLToPath(callerUrl));
+  const startDir = dirname5(fileURLToPath(callerUrl));
   const { root } = parse(startDir);
   let dir = startDir;
   for (; ; ) {
     let manifest;
     try {
       manifest = JSON.parse(
-        readFileSync2(join2(dir, "package.json"), "utf-8")
+        readFileSync3(join3(dir, "package.json"), "utf-8")
       );
     } catch {
     }
@@ -11042,7 +12917,7 @@ function readInspectorVersion(callerUrl) {
       return manifest.version;
     }
     if (dir === root) break;
-    dir = dirname3(dir);
+    dir = dirname5(dir);
   }
   throw new Error(
     `Could not locate the ${ROOT_PACKAGE_NAME} root package.json above ${startDir}`
@@ -11550,11 +13425,11 @@ var OAuthCallbackServer = class {
     const {
       port = 0,
       hostname = DEFAULT_HOSTNAME,
-      path: path3 = DEFAULT_CALLBACK_PATH,
+      path: path6 = DEFAULT_CALLBACK_PATH,
       onCallback,
       onError
     } = options;
-    if (!path3.startsWith("/")) {
+    if (!path6.startsWith("/")) {
       return Promise.reject(
         new Error("Callback path must start with '/' (absolute path)")
       );
@@ -11562,8 +13437,8 @@ var OAuthCallbackServer = class {
     this.onCallback = onCallback;
     this.onError = onError;
     this.handled = false;
-    this.callbackPath = path3;
-    return new Promise((resolve4, reject) => {
+    this.callbackPath = path6;
+    return new Promise((resolve7, reject) => {
       this.server = createServer((req, res) => this.handleRequest(req, res));
       this.server.on("error", reject);
       this.server.listen(port, hostname, () => {
@@ -11573,9 +13448,9 @@ var OAuthCallbackServer = class {
           return;
         }
         this.port = a.port;
-        resolve4({
+        resolve7({
           port: this.port,
-          redirectUrl: buildRedirectUrl(hostname, this.port, path3)
+          redirectUrl: buildRedirectUrl(hostname, this.port, path6)
         });
       });
     });
@@ -11585,8 +13460,8 @@ var OAuthCallbackServer = class {
    */
   async stop() {
     if (!this.server) return;
-    await new Promise((resolve4) => {
-      this.server.close(() => resolve4());
+    await new Promise((resolve7) => {
+      this.server.close(() => resolve7());
     });
     this.server = null;
   }
@@ -11660,8 +13535,8 @@ var OAuthCallbackServer = class {
 function createOAuthCallbackServer() {
   return new OAuthCallbackServer();
 }
-function buildRedirectUrl(host, port, path3) {
-  return `http://${formatHostForUrl(host)}:${port}${path3}`;
+function buildRedirectUrl(host, port, path6) {
+  return `http://${formatHostForUrl(host)}:${port}${path6}`;
 }
 
 // ../../core/auth/node/runner-interactive-oauth.ts
@@ -11679,8 +13554,8 @@ async function runRunnerInteractiveOAuth(options) {
   const server = createServer2();
   let flowResolve;
   let flowReject;
-  const flowDone = new Promise((resolve4, reject) => {
-    flowResolve = resolve4;
+  const flowDone = new Promise((resolve7, reject) => {
+    flowResolve = resolve7;
     flowReject = reject;
   });
   let timeoutId;
@@ -11760,16 +13635,16 @@ async function runRunnerInteractiveOAuth(options) {
 }
 
 // src/logger.ts
-import path2 from "path";
+import path5 from "path";
 import pino from "pino";
 var tuiLoggerInstance;
 function getTuiLogger() {
   if (!tuiLoggerInstance) {
-    const logDir = process.env.MCP_INSPECTOR_LOG_DIR ?? path2.join(
+    const logDir = process.env.MCP_INSPECTOR_LOG_DIR ?? path5.join(
       process.env.HOME || process.env.USERPROFILE || ".",
       ".mcp-inspector"
     );
-    const logPath = path2.join(logDir, "auth.log");
+    const logPath = path5.join(logDir, "auth.log");
     tuiLoggerInstance = pino(
       {
         name: "mcp-inspector-tui",
@@ -13168,9 +15043,283 @@ function PromptsTab({
 }
 
 // src/components/ToolsTab.tsx
-import { useState as useState14, useEffect as useEffect13, useRef as useRef7 } from "react";
+import { useState as useState14, useEffect as useEffect13, useMemo as useMemo2, useRef as useRef7 } from "react";
 import { Box as Box8, Text as Text7, useInput as useInput5 } from "ink";
+
+// ../../core/json/schemaLint.ts
+var BOOLEAN_VALUED_KEYWORDS = /* @__PURE__ */ new Set([
+  "additionalProperties",
+  "unevaluatedProperties",
+  "additionalItems",
+  "unevaluatedItems"
+]);
+var SUBSCHEMA_KEYWORDS = [
+  "items",
+  "contains",
+  "not",
+  "propertyNames",
+  "if",
+  "then",
+  "else",
+  "additionalProperties",
+  "unevaluatedProperties",
+  "additionalItems",
+  "unevaluatedItems",
+  // 2019-09/2020-12: the schema the *decoded* string content must satisfy.
+  // A real schema position, so a bare `true` or a remote `$ref` under it is a
+  // real finding.
+  "contentSchema"
+];
+var SUBSCHEMA_ARRAY_KEYWORDS = [
+  "allOf",
+  "anyOf",
+  "oneOf",
+  "prefixItems"
+];
+var SUBSCHEMA_MAP_KEYWORDS = [
+  "properties",
+  "patternProperties",
+  "dependentSchemas",
+  "dependencies",
+  "$defs",
+  "definitions"
+];
+var CONSTRAINING_KEYWORDS = /* @__PURE__ */ new Set([
+  // Assertions
+  "type",
+  "enum",
+  "const",
+  "multipleOf",
+  "maximum",
+  "exclusiveMaximum",
+  "minimum",
+  "exclusiveMinimum",
+  "maxLength",
+  "minLength",
+  "pattern",
+  "format",
+  "contentMediaType",
+  "contentEncoding",
+  "contentSchema",
+  "maxItems",
+  "minItems",
+  "uniqueItems",
+  "maxContains",
+  "minContains",
+  "maxProperties",
+  "minProperties",
+  "required",
+  "dependentRequired",
+  // Applicators
+  "allOf",
+  "anyOf",
+  "oneOf",
+  "not",
+  // `if` / `then` / `else` are deliberately absent — they only constrain as a
+  // PAIR. `if` alone has no assertion effect, and `then` / `else` are ignored
+  // without it, so `{"if": {"const": 1}}` accepts every value. The pairing is
+  // checked separately in `constrainsInstance`.
+  "items",
+  "prefixItems",
+  "contains",
+  "additionalItems",
+  "unevaluatedItems",
+  "properties",
+  "patternProperties",
+  "additionalProperties",
+  "unevaluatedProperties",
+  "propertyNames",
+  "dependentSchemas",
+  "dependencies",
+  // References
+  "$ref",
+  "$dynamicRef",
+  "$recursiveRef"
+]);
+var JSON_SCHEMA_TYPES = /* @__PURE__ */ new Set([
+  "null",
+  "boolean",
+  "object",
+  "array",
+  "number",
+  "string",
+  "integer"
+]);
+function constrainsInstance(node) {
+  if (Object.keys(node).some((key) => CONSTRAINING_KEYWORDS.has(key))) {
+    return true;
+  }
+  return "if" in node && ("then" in node || "else" in node);
+}
+function isPortableTypeUnion(type) {
+  if (type.length === 0) return false;
+  if (!type.every((t) => typeof t === "string" && JSON_SCHEMA_TYPES.has(t))) {
+    return false;
+  }
+  return new Set(type).size === type.length;
+}
+var MAX_DEPTH = 64;
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function childPath(parent, key) {
+  if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key)) {
+    return parent === "" ? key : `${parent}.${key}`;
+  }
+  return `${parent}[${JSON.stringify(key)}]`;
+}
+function indexPath(parent, index) {
+  return `${parent}[${index}]`;
+}
+function describeSchemaPath(schema, path6) {
+  return path6 === "" ? schema : `${schema}.${path6}`;
+}
+function declaresAnyId(node, depth = 0) {
+  if (depth > MAX_DEPTH || !isRecord3(node)) return false;
+  if (typeof node.$id === "string" && node.$id !== "") return true;
+  let found = false;
+  forEachSubschema(node, "", (child) => {
+    if (!found) found = declaresAnyId(child, depth + 1);
+  });
+  return found;
+}
+function add(ctx, rule, severity, path6, issue, suggestion) {
+  ctx.findings.push({
+    rule,
+    severity,
+    schema: ctx.schema,
+    path: path6,
+    issue,
+    suggestion
+  });
+}
+function forEachSubschema(node, path6, visit) {
+  for (const key of SUBSCHEMA_MAP_KEYWORDS) {
+    const map = node[key];
+    if (!isRecord3(map)) continue;
+    for (const [name, sub] of Object.entries(map)) {
+      visit(sub, childPath(childPath(path6, key), name), key);
+    }
+  }
+  for (const key of SUBSCHEMA_ARRAY_KEYWORDS) {
+    const arr = node[key];
+    if (!Array.isArray(arr)) continue;
+    arr.forEach((sub, i) => {
+      visit(sub, indexPath(childPath(path6, key), i), key);
+    });
+  }
+  for (const key of SUBSCHEMA_KEYWORDS) {
+    if (!(key in node)) continue;
+    const value = node[key];
+    if (key === "items" && Array.isArray(value)) {
+      value.forEach((sub, i) => {
+        visit(sub, indexPath(childPath(path6, key), i), key);
+      });
+      continue;
+    }
+    visit(value, childPath(path6, key), key);
+  }
+}
+function booleanTrueSuggestion(keyword) {
+  if (keyword === "not") {
+    return "Use `{}`, the object form of the always-true schema \u2014 under `not` that is an exact replacement. (Declaring a concrete type here would instead let every value of another type through.)";
+  }
+  return 'Declare what the value actually is \u2014 e.g. `{"type": "object", "additionalProperties": true}` for a free-form object. That is a deliberate change of contract, not an equivalent rewrite: `true` accepts any JSON value at all.';
+}
+function walk(node, path6, keyword, depth, ctx) {
+  if (depth > MAX_DEPTH) return;
+  if (typeof node === "boolean") {
+    if (keyword !== void 0 && BOOLEAN_VALUED_KEYWORDS.has(keyword)) return;
+    add(
+      ctx,
+      "boolean-schema",
+      "error",
+      path6,
+      `Bare \`${String(node)}\` used where a schema object is expected.`,
+      node ? booleanTrueSuggestion(keyword) : (
+        // `false` in a property position means the property is FORBIDDEN.
+        // Deleting the entry is not the same thing: with `additionalProperties`
+        // absent (default `true`) the property becomes allowed with any value,
+        // so the suggestion has to preserve the always-false constraint.
+        'Use the object form of the always-false schema \u2014 `{"not": {}}`. (Deleting the entry is a different contract: under the default `additionalProperties` the property would then be allowed with any value, not forbidden.)'
+      )
+    );
+    return;
+  }
+  if (!isRecord3(node)) return;
+  lintNode(node, path6, keyword, ctx);
+  forEachSubschema(node, path6, (child, childPathValue, childKeyword) => {
+    walk(child, childPathValue, childKeyword, depth + 1, ctx);
+  });
+}
+function lintNode(node, path6, keyword, ctx) {
+  const type = node.type;
+  if (Array.isArray(type) && isPortableTypeUnion(type)) {
+    add(
+      ctx,
+      "type-union",
+      "warning",
+      path6,
+      `\`type\` is an array (${JSON.stringify(type)}). The array form is legal JSON Schema, but several MCP clients read \`type\` as a single string and either reject the tool or drop the constraint.`,
+      `Split it into \`anyOf\` branches, each with a single \`type\` \u2014 \`{"anyOf": [${type.map((t) => `{"type": "${t}"}`).join(
+        ", "
+      )}]}\`. (Making the property optional instead is a different contract: absent is not the same as \`null\`.)`
+    );
+  }
+  const ref = node.$ref;
+  if (typeof ref === "string" && ref !== "" && !ref.startsWith("#") && !ctx.hasEmbeddedIds) {
+    add(
+      ctx,
+      "remote-ref",
+      "warning",
+      path6,
+      `\`$ref\` points outside this document (\`${ref}\`). Clients do not fetch remote schemas, so the constraint is dropped or the tool is rejected.`,
+      "Inline the referenced schema, or move it into `$defs` and reference it as `#/$defs/<name>`."
+    );
+  }
+  const constrains = constrainsInstance(node);
+  if (!constrains && keyword !== "not") {
+    add(
+      ctx,
+      "untyped-schema",
+      "warning",
+      path6,
+      "Schema carries no validation keyword at all, so it accepts any value \u2014 the object-literal spelling of a bare `true`.",
+      // "changes", not "narrows": in an ordinary property position it does
+      // narrow, but under a conditional (`if`) a typed replacement redirects
+      // which branch applies rather than tightening anything.
+      'Declare what the value actually is \u2014 e.g. `{"type": "object", "additionalProperties": true}` for a free-form object. That is a deliberate change of contract, which is the point: as written it constrains nothing.'
+    );
+  }
+}
+function lintSchema(schema, kind, findings) {
+  walk(schema, "", void 0, 0, {
+    schema: kind,
+    findings,
+    hasEmbeddedIds: declaresAnyId(schema)
+  });
+}
+function lintToolSchemas(tool) {
+  const findings = [];
+  if (tool.inputSchema !== void 0) {
+    lintSchema(tool.inputSchema, "inputSchema", findings);
+  }
+  if (tool.outputSchema !== void 0) {
+    lintSchema(tool.outputSchema, "outputSchema", findings);
+  }
+  return findings;
+}
+
+// src/components/ToolsTab.tsx
 import { Fragment as Fragment5, jsx as jsx8, jsxs as jsxs7 } from "react/jsx-runtime";
+var SEVERITY_MARKER = {
+  error: { glyph: "!", color: "red" },
+  warning: { glyph: "?", color: "yellow" }
+};
+function schemaMarker(findings) {
+  if (!findings || findings.length === 0) return void 0;
+  return findings.some((f) => f.severity === "error") ? SEVERITY_MARKER.error : SEVERITY_MARKER.warning;
+}
 function ToolsTab({
   tools,
   isConnected,
@@ -13188,6 +15337,10 @@ function ToolsTab({
     { resetWhen: tools }
   );
   const [error] = useState14(null);
+  const findingsByTool = useMemo2(
+    () => tools.map((tool) => lintToolSchemas(tool)),
+    [tools]
+  );
   const scrollViewRef = useRef7(null);
   const listWidth = Math.floor(width * 0.4);
   const detailWidth = width - listWidth;
@@ -13231,6 +15384,7 @@ function ToolsTab({
     scrollViewRef.current?.scrollTo(0);
   }, [selectedIndex]);
   const selectedTool = tools[selectedIndex] || null;
+  const selectedFindings = findingsByTool[selectedIndex] ?? [];
   return /* @__PURE__ */ jsxs7(Box8, { flexDirection: "row", width, height, children: [
     /* @__PURE__ */ jsxs7(
       Box8,
@@ -13267,9 +15421,14 @@ function ToolsTab({
               children: tools.slice(firstVisible, firstVisible + visibleCount).map((tool, i) => {
                 const index = firstVisible + i;
                 const isSelected = index === selectedIndex;
+                const marker = schemaMarker(findingsByTool[index]);
                 return /* @__PURE__ */ jsx8(Box8, { paddingY: 0, flexShrink: 0, children: /* @__PURE__ */ jsxs7(Text7, { children: [
                   isSelected ? "\u25B6 " : "  ",
-                  tool.name || `Tool ${index + 1}`
+                  tool.name || `Tool ${index + 1}`,
+                  marker && /* @__PURE__ */ jsxs7(Text7, { color: marker.color, children: [
+                    " ",
+                    marker.glyph
+                  ] })
                 ] }) }, tool.name || index);
               })
             }
@@ -13317,6 +15476,38 @@ function ToolsTab({
               },
               `desc-${idx}`
             )) }),
+            selectedFindings.length > 0 && /* @__PURE__ */ jsxs7(Fragment5, { children: [
+              /* @__PURE__ */ jsx8(Box8, { marginTop: 1, flexShrink: 0, children: /* @__PURE__ */ jsxs7(Text7, { bold: true, color: "yellow", children: [
+                "Schema Portability (",
+                selectedFindings.length,
+                "):"
+              ] }) }),
+              selectedFindings.map((finding, idx) => {
+                const marker = SEVERITY_MARKER[finding.severity];
+                return /* @__PURE__ */ jsxs7(
+                  Box8,
+                  {
+                    flexDirection: "column",
+                    paddingLeft: 2,
+                    marginTop: 1,
+                    flexShrink: 0,
+                    children: [
+                      /* @__PURE__ */ jsxs7(Text7, { color: marker.color, children: [
+                        marker.glyph,
+                        " ",
+                        describeSchemaPath(finding.schema, finding.path)
+                      ] }),
+                      /* @__PURE__ */ jsx8(Text7, { dimColor: true, children: finding.issue }),
+                      /* @__PURE__ */ jsxs7(Text7, { dimColor: true, children: [
+                        "Fix: ",
+                        finding.suggestion
+                      ] })
+                    ]
+                  },
+                  `finding-${finding.schema}-${finding.path}-${finding.rule}-${idx}`
+                );
+              })
+            ] }),
             selectedTool.inputSchema && /* @__PURE__ */ jsxs7(Fragment5, { children: [
               /* @__PURE__ */ jsx8(Box8, { marginTop: 1, flexShrink: 0, children: /* @__PURE__ */ jsx8(Text7, { bold: true, children: "Input Schema:" }) }),
               JSON.stringify(selectedTool.inputSchema, null, 2).split("\n").map((line, idx) => /* @__PURE__ */ jsx8(
@@ -13907,7 +16098,7 @@ import { Box as Box23, Text as Text20, useInput as useInput17 } from "ink";
 
 // node_modules/ink-form/lib/Form.js
 import { Box as Box22, useFocusManager, useInput as useInput16 } from "ink";
-import { useEffect as useEffect19, useMemo as useMemo2, useState as useState18 } from "react";
+import { useEffect as useEffect19, useMemo as useMemo3, useState as useState18 } from "react";
 import * as React23 from "react";
 
 // node_modules/ink-form/lib/FormHeader.js
@@ -15325,7 +17516,7 @@ var Form = (props) => {
   const [currentTab, setCurrentTab] = useState18(0);
   const [value, setValue] = useState18(props.value ?? {});
   const [editingField, setEditingField] = useState18();
-  const canSubmitForm = useMemo2(() => canSubmit(props.form, value), [value, props.form]);
+  const canSubmitForm = useMemo3(() => canSubmit(props.form, value), [value, props.form]);
   const focusManager = useFocusManager();
   useEffect19(() => {
     focusManager.enableFocus();
@@ -16461,11 +18652,13 @@ function App({
         const { config: serverConfig, settings: savedSettings } = mcpServers[serverName];
         const environment = {
           transport: createTransportNode,
-          logger: getTuiLogger()
+          logger: getTuiLogger(),
+          // Bottom of the fetch stack, so InspectorClient's wrappers compose
+          // over it and OAuth requests are proxied too (#2067). Undefined when
+          // no proxy env var is set.
+          fetch: createProxyFetch()
         };
-        const defaultMetadata = savedSettings?.metadata ? Object.fromEntries(
-          savedSettings.metadata.filter((m) => m.key.trim() !== "").map((m) => [m.key, m.value])
-        ) : void 0;
+        const defaultMetadata = savedSettings?.metadata;
         const clientAuthOptions = buildRunnerClientAuthOptions(
           clientConfig,
           savedSettings,
@@ -16614,7 +18807,7 @@ function App({
       setActiveTab("info");
     }
   }, [activeTab, selectedServerConfig]);
-  const selectedInspectorClient = useMemo3(
+  const selectedInspectorClient = useMemo4(
     () => selectedServer ? inspectorClients[selectedServer] : null,
     [selectedServer, inspectorClients]
   );
@@ -16627,15 +18820,15 @@ function App({
     disconnect: disconnectInspector,
     lastError: inspectorLastError
   } = useInspectorClient(selectedInspectorClient);
-  const selectedMessageLogState = useMemo3(
+  const selectedMessageLogState = useMemo4(
     () => selectedServer && messageLogStates[selectedServer] ? messageLogStates[selectedServer] : null,
     [selectedServer, messageLogStates]
   );
-  const selectedFetchRequestLogState = useMemo3(
+  const selectedFetchRequestLogState = useMemo4(
     () => selectedServer && fetchRequestLogStates[selectedServer] ? fetchRequestLogStates[selectedServer] : null,
     [selectedServer, fetchRequestLogStates]
   );
-  const selectedStderrLogState = useMemo3(
+  const selectedStderrLogState = useMemo4(
     () => selectedServer && stderrLogStates[selectedServer] ? stderrLogStates[selectedServer] : null,
     [selectedServer, stderrLogStates]
   );
@@ -16648,7 +18841,7 @@ function App({
   const { stderrLogs: inspectorStderrLogs } = useStderrLog(
     selectedStderrLogState
   );
-  const selectedManagedToolsState = useMemo3(
+  const selectedManagedToolsState = useMemo4(
     () => selectedServer && managedToolsStates[selectedServer] ? managedToolsStates[selectedServer] : null,
     [selectedServer, managedToolsStates]
   );
@@ -16656,15 +18849,15 @@ function App({
     selectedInspectorClient,
     selectedManagedToolsState
   );
-  const selectedManagedResourcesState = useMemo3(
+  const selectedManagedResourcesState = useMemo4(
     () => selectedServer && managedResourcesStates[selectedServer] ? managedResourcesStates[selectedServer] : null,
     [selectedServer, managedResourcesStates]
   );
-  const selectedManagedResourceTemplatesState = useMemo3(
+  const selectedManagedResourceTemplatesState = useMemo4(
     () => selectedServer && managedResourceTemplatesStates[selectedServer] ? managedResourceTemplatesStates[selectedServer] : null,
     [selectedServer, managedResourceTemplatesStates]
   );
-  const selectedManagedPromptsState = useMemo3(
+  const selectedManagedPromptsState = useMemo4(
     () => selectedServer && managedPromptsStates[selectedServer] ? managedPromptsStates[selectedServer] : null,
     [selectedServer, managedPromptsStates]
   );
@@ -16975,7 +19168,7 @@ function App({
     }
     setOauthRevision((n) => n + 1);
   }, [selectedInspectorClient, inspectorStatus, disconnectInspector]);
-  const currentServerState = useMemo3(() => {
+  const currentServerState = useMemo4(() => {
     if (!selectedServer) return null;
     return {
       status: inspectorStatus,
@@ -17937,7 +20130,7 @@ async function runTui(args) {
 
 // index.ts
 var __filename = fileURLToPath2(import.meta.url);
-var isMain = process.argv[1] !== void 0 && resolve3(process.argv[1]) === resolve3(__filename);
+var isMain = process.argv[1] !== void 0 && resolve6(process.argv[1]) === resolve6(__filename);
 if (isMain) {
   runTui(process.argv).catch((err) => {
     console.error("Error:", err instanceof Error ? err.message : err);
@@ -17954,3 +20147,16 @@ if (isMain) {
 export {
   runTui
 };
+/* v8 ignore next 2 -- @preserve: the non-Error arm is unreachable via
+   proper-lockfile, which rejects only with Errors. */
+/* v8 ignore next -- @preserve: node validates the cost parameters
+   synchronously (an out-of-grammar `N` throws from the call itself,
+   which the corrupt-KDF test exercises), so this asynchronous channel
+   is left for allocation failure — not provokable deterministically. */
+/* v8 ignore next -- @preserve: unreachable, `encryptedEnvelopeProblem`
+   above returns a reason for anything `decodeParts` would reject. Kept as
+   the type narrowing `parts` needs. */
+/* v8 ignore next -- @preserve: the walk can only run out of ancestors if
+   the filesystem root itself does not exist, which would mean the process
+   has no cwd to have resolved against. Kept as the loop's termination
+   guard rather than trusting that invariant. */