@modelcontextprotocol/inspector 2.8.0 → 2.9.0

package/clients/web/build/index.js

@@ -20,7 +20,7 @@ import { readFile, writeFile } from "atomically";
 
 // ../../core/storage/store-id.ts
 function validateStoreId(storeId) {
-  return /^[a-zA-Z0-9_-]+$/.test(storeId) && storeId.length > 0;
+  return /^[a-zA-Z0-9_-]+$/.test(storeId) && storeId !== "__proto__";
 }
 
 // ../../core/storage/store-serialize.ts
@@ -146,6 +146,10 @@ var ModernListSkillsResultSchema = ListSkillsResultSchema.extend({
 var GetSkillEnvelopeSchema = z.looseObject({
   skill: SkillEntrySchema
 });
+var ModernGetSkillEnvelopeSchema = GetSkillEnvelopeSchema.extend({
+  ttlMs: z.int().min(0),
+  cacheScope: z.enum(["public", "private"])
+});
 var GetSkillResultSchema = GetSkillEnvelopeSchema.transform(
   (result) => result.skill
 );
@@ -1850,12 +1854,31 @@ function redactJsonValue(value) {
   }
   return value;
 }
+function joinSensitiveContinuations(body) {
+  const out = [];
+  let sensitiveAt = -1;
+  for (const pair of body.split("&")) {
+    const eq = pair.indexOf("=");
+    if (eq === -1) {
+      if (sensitiveAt !== -1 && pair.length > 0) {
+        out[sensitiveAt] += `%26${pair}`;
+      } else {
+        out.push(pair);
+      }
+      continue;
+    }
+    const [key] = new URLSearchParams(pair).keys();
+    sensitiveAt = isSensitiveField(key) && eq < pair.length - 1 ? out.length : -1;
+    out.push(pair);
+  }
+  return out.join("&");
+}
 function redactBody(body, contentType) {
   if (!body) return body;
   const type = (contentType ?? "").toLowerCase();
   if (type.includes("application/x-www-form-urlencoded")) {
     try {
-      const params = new URLSearchParams(body);
+      const params = new URLSearchParams(joinSensitiveContinuations(body));
       let changed = false;
       for (const key of new Set(params.keys())) {
         if (isSensitiveField(key)) {
@@ -2544,1082 +2567,793 @@ function createTransportNode(config, options = {}) {
 // ../../core/auth/requestTimeout.ts
 var OAUTH_TIMEOUT_WIRE_CODE = "oauth_request_timeout";
 
-// ../../core/json/xMcpHeader.ts
-var MCP_PARAM_HEADER_PREFIX = "Mcp-Param-";
+// ../../core/storage/own-entry.ts
+function setOwnEntry(map, key, value) {
+  Object.defineProperty(map, key, {
+    value,
+    enumerable: true,
+    writable: true,
+    configurable: true
+  });
+}
+function getOwnEntry(map, key) {
+  return map !== void 0 && Object.hasOwn(map, key) ? map[key] : void 0;
+}
 
-// ../../core/mcp/import/clientConfig.ts
-function parseJsonObject(raw) {
-  let data;
-  try {
-    data = JSON.parse(raw);
-  } catch (err) {
-    const detail = err instanceof Error ? err.message : String(err);
-    throw new Error(`Invalid JSON: ${detail}`, { cause: err });
+// ../../core/auth/oauth-persist.ts
+import { OAuthTokensSchema } from "@modelcontextprotocol/core";
+var OAUTH_PERSIST_STORE_ID = "oauth";
+function mergeOAuthSections(disk, snapshot, sections) {
+  const merged = {
+    servers: { ...disk?.servers },
+    idpSessions: { ...disk?.idpSessions }
+  };
+  for (const url of sections.servers ?? []) {
+    const value = getOwnEntry(snapshot.servers, url);
+    if (value === void 0) {
+      delete merged.servers[url];
+    } else {
+      setOwnEntry(merged.servers, url, value);
+    }
   }
-  if (!data || typeof data !== "object" || Array.isArray(data)) {
-    throw new Error("Expected a JSON object at the top level");
+  for (const issuer of sections.idpSessions ?? []) {
+    const value = getOwnEntry(snapshot.idpSessions, issuer);
+    if (value === void 0) {
+      delete merged.idpSessions[issuer];
+    } else {
+      setOwnEntry(merged.idpSessions, issuer, value);
+    }
   }
-  return data;
+  return merged;
 }
-function normalizeServerMap(servers) {
-  const out = {};
-  for (const [id, raw] of Object.entries(servers)) {
-    if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
-    const normalized = normalizeServerType(
-      raw
-    );
-    out[id] = normalized;
-  }
-  return out;
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((v) => typeof v === "string");
 }
-function parseMcpServersConfig(raw) {
-  const data = parseJsonObject(raw);
-  const servers = data.mcpServers;
-  if (!servers || typeof servers !== "object" || Array.isArray(servers)) {
-    throw new Error("No 'mcpServers' object found in config file");
+function parseOAuthPersistSections(value) {
+  if (!isRecord2(value)) {
+    return null;
   }
-  return {
-    mcpServers: normalizeServerMap(servers)
-  };
-}
-function parseVsCodeConfig(raw) {
-  const data = parseJsonObject(raw);
-  const servers = data.servers;
-  if (!servers || typeof servers !== "object" || Array.isArray(servers)) {
-    throw new Error("No 'servers' object found in VS Code config file");
+  const sections = {};
+  for (const key of Object.keys(value)) {
+    if (key !== "servers" && key !== "idpSessions") return null;
   }
-  return {
-    mcpServers: normalizeServerMap(servers)
-  };
-}
-
-// ../../core/mcp/import/strategies.ts
-function join4(...segments) {
-  return segments.map(
-    (s, i) => i === 0 ? s.replace(/\/+$/, "") : s.replace(/^\/+|\/+$/g, "")
-  ).filter((s) => s.length > 0).join("/");
-}
-function appData(homeDir) {
-  return join4(homeDir, "AppData", "Roaming");
-}
-function appSupportDir(platform, homeDir, app) {
-  if (platform === "darwin") {
-    return join4(homeDir, "Library", "Application Support", app);
+  if ("servers" in value) {
+    if (!isStringArray(value.servers)) return null;
+    sections.servers = value.servers;
   }
-  if (platform === "win32") {
-    return join4(appData(homeDir), app);
+  if ("idpSessions" in value) {
+    if (!isStringArray(value.idpSessions)) return null;
+    sections.idpSessions = value.idpSessions;
   }
-  return join4(homeDir, ".config", app);
+  return sections;
 }
-var claudeDesktop = {
-  id: "claude-desktop",
-  label: "Claude Desktop",
-  defaultPaths: (platform, homeDir) => [
-    join4(
-      appSupportDir(platform, homeDir, "Claude"),
-      "claude_desktop_config.json"
-    )
-  ],
-  parse: parseMcpServersConfig
-};
-var cursor = {
-  id: "cursor",
-  label: "Cursor",
-  defaultPaths: (_platform, homeDir) => [join4(homeDir, ".cursor", "mcp.json")],
-  parse: parseMcpServersConfig
-};
-var cline = {
-  id: "cline",
-  label: "Cline",
-  defaultPaths: (platform, homeDir) => [
-    // Cline (VS Code extension) global settings live under the editor's
-    // globalStorage; the documented cross-platform fallback is ~/Documents.
-    join4(
-      appSupportDir(platform, homeDir, "Code"),
-      "User",
-      "globalStorage",
-      "saoudrizwan.claude-dev",
-      "settings",
-      "cline_mcp_settings.json"
-    ),
-    join4(homeDir, "Documents", "Cline", "MCP", "cline_mcp_settings.json")
-  ],
-  parse: parseMcpServersConfig
-};
-var vscode = {
-  id: "vscode",
-  label: "VS Code",
-  defaultPaths: (platform, homeDir) => [
-    join4(appSupportDir(platform, homeDir, "Code"), "User", "mcp.json")
-  ],
-  parse: parseVsCodeConfig
-};
-var IMPORT_STRATEGY_LIST = [
-  claudeDesktop,
-  cursor,
-  cline,
-  vscode
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isEntryMap(value) {
+  return isRecord2(value) && Object.values(value).every(isRecord2);
+}
+var VERBATIM_SECRET_KEYS = [
+  "client_secret",
+  "registration_access_token"
 ];
-var IMPORT_STRATEGIES = Object.fromEntries(IMPORT_STRATEGY_LIST.map((s) => [s.id, s]));
-function getImportStrategy(id) {
-  return IMPORT_STRATEGIES[id];
+function isValidClientInformation(value) {
+  if (value === void 0) return true;
+  if (!isRecord2(value)) return false;
+  return VERBATIM_SECRET_KEYS.every(
+    (key) => !Object.hasOwn(value, key) || typeof value[key] === "string"
+  );
 }
-
-// ../../core/mcp/import/resolveSource.ts
-function resolveImportSource(type, platform, homeDir, readFile2) {
-  const strategy = getImportStrategy(type);
-  if (!strategy) return null;
-  const searched = strategy.defaultPaths(platform, homeDir);
-  for (const path6 of searched) {
-    let raw;
-    try {
-      raw = readFile2(path6);
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      return {
-        type,
-        found: true,
-        path: path6,
-        error: `Failed to read ${path6}: ${msg}`,
-        searched
-      };
-    }
-    if (raw === null) continue;
-    try {
-      const config = strategy.parse(raw);
-      return { type, found: true, path: path6, config, searched };
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      return { type, found: true, path: path6, error: msg, searched };
+var PartialTokensSchema = OAuthTokensSchema.partial();
+function isValidTokens(value) {
+  if (value === void 0) return true;
+  return PartialTokensSchema.safeParse(value).success;
+}
+function isValidServerEntry(entry) {
+  if (!isRecord2(entry)) return false;
+  if (!isValidClientInformation(entry.clientInformation)) return false;
+  if (!isValidClientInformation(entry.preregisteredClientInformation))
+    return false;
+  if (entry.byIssuer !== void 0) {
+    if (!isRecord2(entry.byIssuer)) return false;
+    for (const slot of Object.values(entry.byIssuer)) {
+      if (!isRecord2(slot)) return false;
+      if (!isValidClientInformation(slot.clientInformation)) return false;
     }
   }
-  return { type, found: false, searched };
+  return true;
 }
-
-// ../../core/mcp/remote/progressToken.ts
-import { ProgressTokenSchema } from "@modelcontextprotocol/core";
-function progressTokenOf(message) {
-  if ("method" in message && message.method === "notifications/progress" && "params" in message && typeof message.params === "object" && message.params !== null) {
-    const parsed = ProgressTokenSchema.safeParse(
-      message.params.progressToken
-    );
-    if (parsed.success) {
-      return parsed.data;
+function isValidIdpSession(session) {
+  if (!isRecord2(session)) return false;
+  return ["idToken", "refreshToken"].every(
+    (key) => !Object.hasOwn(session, key) || typeof session[key] === "string"
+  );
+}
+function snapshotHasValidSecretPayloads(snapshot) {
+  for (const entry of Object.values(snapshot.servers)) {
+    const record = entry;
+    if (!isValidTokens(record.tokens)) return false;
+    if (isRecord2(record.byIssuer)) {
+      for (const slot of Object.values(record.byIssuer)) {
+        if (isRecord2(slot) && !isValidTokens(slot.tokens)) return false;
+      }
     }
   }
-  return void 0;
+  return Object.values(snapshot.idpSessions).every(isValidIdpSession);
 }
-
-// ../../core/mcp/remote/node/remote-session.ts
-var RemoteSession = class _RemoteSession {
-  sessionId;
-  transport;
-  eventQueue = [];
-  eventConsumer = null;
-  transportDead = false;
-  transportError = null;
-  activeSendCount = 0;
-  /**
-   * Suppress duplicate ambient SSE auth echoes after HTTP command-scoped delivery.
-   * Stale transport `onerror` may arrive after the send completes.
-   */
-  authHttpEchoSuppressUntilMs = 0;
-  static AUTH_HTTP_ECHO_SUPPRESS_MS = 3e4;
-  requestWaits = /* @__PURE__ */ new Map();
-  authProviderHandle = null;
-  appliedProtocolVersion;
-  /** A protocol version is a dated token (`2025-11-25`, `2026-07-28`, …). */
-  static PROTOCOL_VERSION_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
-  constructor(sessionId) {
-    this.sessionId = sessionId;
-  }
-  setAuthProviderHandle(handle) {
-    this.authProviderHandle = handle;
+function snapshotFromPayload(payload) {
+  const servers = payload.servers ?? {};
+  const idpSessions = payload.idpSessions ?? {};
+  if (!isEntryMap(servers) || !isEntryMap(idpSessions)) return null;
+  if (!Object.values(servers).every(isValidServerEntry)) return null;
+  return {
+    servers,
+    idpSessions
+  };
+}
+function parseOAuthPersistBlob(raw) {
+  if (raw === null || raw === void 0) {
+    return null;
   }
-  setAuthState(authState) {
-    if (!this.authProviderHandle) {
-      throw new Error("Session has no OAuth auth provider");
-    }
-    this.authProviderHandle.setAuthState(authState);
+  const parsed = typeof raw === "string" ? raw ? parseStore(raw) : null : raw;
+  if (!isRecord2(parsed)) {
+    return null;
   }
-  setTransport(transport) {
-    this.transport = transport;
+  if (isRecord2(parsed.state) && "version" in parsed) {
+    return snapshotFromPayload(parsed.state);
   }
-  /**
-   * Apply the client's negotiated protocol version to the upstream transport
-   * (#1935). The browser's SDK Client owns the `initialize` handshake, so the
-   * `setProtocolVersion` call it makes lands on the *remote* transport; without
-   * this the backend's real HTTP transport never learns the version and drops
-   * `Mcp-Protocol-Version` from every subsequent request.
-   *
-   * Ignores anything that isn't a plausible version token so a client can't
-   * push arbitrary bytes into an upstream header, and re-applies only on
-   * change (the value rides every `/api/mcp/send`). The value arrives from an
-   * unvalidated JSON body, so the type is checked rather than assumed —
-   * `RegExp.test` would otherwise coerce a `123` or `true` into a "matching"
-   * string and hand the wrong type to the transport.
-   */
-  applyProtocolVersion(version) {
-    if (typeof version !== "string" || version === this.appliedProtocolVersion || !_RemoteSession.PROTOCOL_VERSION_PATTERN.test(version)) {
-      return;
-    }
-    this.appliedProtocolVersion = version;
-    this.transport.setProtocolVersion?.(version);
+  if ("servers" in parsed || "idpSessions" in parsed) {
+    return snapshotFromPayload(parsed);
   }
-  setEventConsumer(consumer) {
-    this.eventConsumer = consumer;
-    while (this.eventQueue.length > 0) {
-      const ev = this.eventQueue.shift();
-      consumer(ev);
+  return null;
+}
+function serializeOAuthPersistBlob(snapshot) {
+  return serializeStore(snapshot);
+}
+function parseOAuthStoreWriteBody(body) {
+  if (!isRecord2(body)) return null;
+  if ("sections" in body) {
+    for (const key of Object.keys(body)) {
+      if (key !== "sections" && key !== "snapshot") return null;
     }
+    const sections = parseOAuthPersistSections(body.sections);
+    if (!sections) return null;
+    const snapshot2 = parseOAuthPersistBlob(
+      "snapshot" in body ? body.snapshot : null
+    );
+    if (!snapshot2 || !snapshotHasValidSecretPayloads(snapshot2)) return null;
+    return { snapshot: snapshot2, sections };
   }
-  clearEventConsumer() {
-    this.eventConsumer = null;
-    return this.transportDead;
+  const snapshot = parseOAuthPersistBlob(body);
+  if (!snapshot || !snapshotHasValidSecretPayloads(snapshot)) return null;
+  return { snapshot };
+}
+
+// ../../core/auth/node/file-lock.ts
+import nodeFs, { statSync, rmdirSync } from "fs";
+import * as fs2 from "fs/promises";
+import * as path2 from "path";
+import properLockfile from "proper-lockfile";
+
+// ../../core/auth/node/secret-store.ts
+var SERVICE_NAME = "mcp-inspector";
+var keyringLoad;
+var KeyringModuleShapeError = class extends Error {
+  constructor(detail, options) {
+    super(`@napi-rs/keyring loaded but ${detail}`, options);
+    this.name = "KeyringModuleShapeError";
   }
-  markTransportDead(error) {
-    this.transportDead = true;
-    this.transportError = error;
-    this.pushEvent({
-      type: "transport_error",
-      data: {
-        error,
-        code: -32e3
-        // MCP error code for connection closed
-      }
-    });
-  }
-  isTransportDead() {
-    return this.transportDead;
-  }
-  getTransportError() {
-    return this.transportError;
-  }
-  hasEventConsumer() {
-    return this.eventConsumer !== null;
-  }
-  beginSend() {
-    this.activeSendCount++;
-  }
-  endSend() {
-    if (this.activeSendCount > 0) {
-      this.activeSendCount--;
+};
+var checkKeyringShape = (mod) => {
+  try {
+    if (typeof mod.AsyncEntry === "function" && typeof mod.findCredentialsAsync === "function") {
+      return { ok: true, mod };
     }
+    return {
+      ok: false,
+      err: new KeyringModuleShapeError(
+        "did not expose AsyncEntry / findCredentialsAsync"
+      )
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      err: new KeyringModuleShapeError(
+        `its exports could not be read: ${err instanceof Error ? err.message : String(err)}`,
+        { cause: err }
+      )
+    };
   }
-  /** Command-scoped auth was returned on HTTP; suppress async onerror echo on SSE. */
-  noteAuthChallengeDeliveredViaHttp() {
-    this.extendAuthHttpEchoSuppression();
+};
+var loadKeyring = () => {
+  keyringLoad ??= import("@napi-rs/keyring").then(
+    checkKeyringShape,
+    (err) => ({ ok: false, err })
+  );
+  return keyringLoad;
+};
+function parseAccount(account) {
+  const idx = account.indexOf(":");
+  if (idx <= 0 || idx === account.length - 1) return null;
+  return {
+    serverId: account.slice(0, idx),
+    field: account.slice(idx + 1)
+  };
+}
+var buildAccount = (serverId, field) => `${serverId}:${field}`;
+var SecretStoreUnavailableError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "SecretStoreUnavailableError";
   }
-  extendAuthHttpEchoSuppression() {
-    this.authHttpEchoSuppressUntilMs = Date.now() + _RemoteSession.AUTH_HTTP_ECHO_SUPPRESS_MS;
+};
+var SecretFileLockHeldError = class extends SecretStoreUnavailableError {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "SecretFileLockHeldError";
   }
-  shouldSuppressAuthEcho() {
-    return Date.now() < this.authHttpEchoSuppressUntilMs;
+};
+var KeychainUnavailableError = class extends SecretStoreUnavailableError {
+  constructor(cause) {
+    const message = cause instanceof Error ? cause.message : String(cause);
+    super(
+      `OS keychain is not available. ${hintFor(cause, message)} Underlying error: ${message}`
+    );
+    this.name = "KeychainUnavailableError";
   }
-  hasActiveSend() {
-    return this.activeSendCount > 0;
+};
+var hintFor = (cause, message) => {
+  if (cause instanceof KeyringModuleShapeError) {
+    return `The @napi-rs/keyring package loaded but does not expose the API this build expects \u2014 most likely a version or packaging mismatch; reinstall the Inspector, and report this if it persists.`;
   }
-  pushAuthChallenge(challenge) {
-    this.pushEvent({ type: "auth_challenge", data: challenge });
+  if (message.includes("Cannot find native binding")) {
+    return `The @napi-rs/keyring platform package for this OS is missing or unavailable \u2014 reinstall the Inspector (for npx, clear the npx cache under your npm cache directory first).`;
   }
-  /**
-   * Streamable HTTP `transport.send()` can return before the JSON-RPC response
-   * arrives. The remote send handler awaits this so `/api/mcp/send` returns
-   * `auth_challenge` or `ok: true` only after the MCP round-trip (or auth error).
-   */
-  waitForRequestResponse(requestId, timeoutMs = 6e4) {
-    return new Promise((resolve9, reject) => {
-      let timer;
-      const arm = () => {
-        if (timeoutMs <= 0) return;
-        timer = setTimeout(() => {
-          this.requestWaits.delete(requestId);
-          reject(
-            new Error(
-              `MCP request ${String(requestId)} timed out after ${timeoutMs}ms`
-            )
-          );
-        }, timeoutMs);
-      };
-      const clear = () => {
-        if (timer !== void 0) {
-          clearTimeout(timer);
-          timer = void 0;
-        }
-      };
-      arm();
-      this.requestWaits.set(requestId, {
-        resolve: () => {
-          clear();
-          resolve9();
-        },
-        reject: (error) => {
-          clear();
-          reject(error);
-        },
-        // A progress notification for this request re-arms the full window, so
-        // a tool that keeps reporting progress never trips the relay's own
-        // deadline — the same guarantee the SDK client's `resetTimeoutOnProgress`
-        // gives on a direct transport (#2028).
-        resetTimeout: () => {
-          if (timer === void 0) return;
-          clear();
-          arm();
-        }
-      });
-    });
+  return `On Linux, install libsecret / gnome-keyring.`;
+};
+async function probeKeyringAvailable() {
+  const keyring = await loadKeyring();
+  if (!keyring.ok) {
+    const err = keyring.err;
+    return {
+      available: false,
+      detail: err instanceof Error ? err.message : String(err)
+    };
+  }
+  try {
+    const entry = new keyring.mod.AsyncEntry(SERVICE_NAME, PROBE_ACCOUNT);
+    await entry.getPassword();
+    await keyring.mod.findCredentialsAsync(SERVICE_NAME);
+    return { available: true };
+  } catch (err) {
+    return {
+      available: false,
+      detail: err instanceof Error ? err.message : String(err)
+    };
   }
+}
+var PROBE_ACCOUNT = "__inspector:probe";
+var isNoEntryError = (err) => err instanceof Error && /no (matching )?entry/i.test(err.message);
+var KeyringSecretStore = class {
   /**
-   * Re-arm a pending request's wait timeout. Invoked from {@link onMessage} when
-   * a `notifications/progress` carrying this request's `progressToken` arrives.
-   * A no-op when no wait is pending for the id.
+   * The intolerant read. Same lookup as {@link get}, minus the catch — a
+   * keychain that cannot answer must not be reported as an empty one to a
+   * caller that is about to write based on the answer.
    */
-  noteRequestProgress(requestId) {
-    this.requestWaits.get(requestId)?.resetTimeout();
-  }
-  cancelRequestWait(requestId) {
-    const wait = this.requestWaits.get(requestId);
-    if (!wait) {
-      return;
+  async getStrict(serverId, field) {
+    try {
+      const keyring = await loadKeyring();
+      if (!keyring.ok) throw new KeychainUnavailableError(keyring.err);
+      const entry = new keyring.mod.AsyncEntry(
+        SERVICE_NAME,
+        buildAccount(serverId, field)
+      );
+      return await entry.getPassword() ?? null;
+    } catch (err) {
+      if (err instanceof KeychainUnavailableError) throw err;
+      throw new KeychainUnavailableError(err);
     }
-    this.requestWaits.delete(requestId);
-    wait.reject(new Error("MCP request wait cancelled"));
   }
-  rejectActiveRequestWaits(error) {
-    for (const wait of this.requestWaits.values()) {
-      wait.reject(error);
+  async get(serverId, field) {
+    try {
+      const keyring = await loadKeyring();
+      if (!keyring.ok) return null;
+      const entry = new keyring.mod.AsyncEntry(
+        SERVICE_NAME,
+        buildAccount(serverId, field)
+      );
+      const v = await entry.getPassword();
+      return v ?? null;
+    } catch {
+      return null;
     }
-    this.requestWaits.clear();
   }
-  /**
-   * Auth errors from the MCP transport.
-   * - During an active send: command path owns delivery (HTTP); never SSE.
-   * - After HTTP already returned auth_challenge: swallow async onerror echo.
-   * - Otherwise: ambient SSE (idle session).
-   */
-  handleTransportAuthError(error) {
-    if (!(error instanceof AuthChallengeError)) {
-      return false;
-    }
-    this.rejectActiveRequestWaits(error);
-    if (this.hasActiveSend()) {
-      this.extendAuthHttpEchoSuppression();
-      return true;
-    }
-    if (this.shouldSuppressAuthEcho()) {
-      return true;
+  async set(serverId, field, value) {
+    try {
+      const keyring = await loadKeyring();
+      if (!keyring.ok) throw new KeychainUnavailableError(keyring.err);
+      const entry = new keyring.mod.AsyncEntry(
+        SERVICE_NAME,
+        buildAccount(serverId, field)
+      );
+      await entry.setPassword(value);
+    } catch (err) {
+      if (err instanceof KeychainUnavailableError) throw err;
+      throw new KeychainUnavailableError(err);
     }
-    this.pushAuthChallenge(error.authChallenge);
-    return true;
   }
-  settleRequestWait(requestId) {
-    const wait = this.requestWaits.get(requestId);
-    if (!wait) {
-      return;
+  async delete(serverId, field) {
+    try {
+      const keyring = await loadKeyring();
+      if (!keyring.ok) throw new KeychainUnavailableError(keyring.err);
+      const entry = new keyring.mod.AsyncEntry(
+        SERVICE_NAME,
+        buildAccount(serverId, field)
+      );
+      await entry.deleteCredential();
+    } catch (err) {
+      if (isNoEntryError(err)) return;
+      if (err instanceof KeychainUnavailableError) throw err;
+      throw new KeychainUnavailableError(err);
     }
-    this.requestWaits.delete(requestId);
-    wait.resolve();
   }
-  pushEvent(event) {
-    if (this.eventConsumer) {
-      this.eventConsumer(event);
-    } else {
-      this.eventQueue.push(event);
+  async deleteAllForServer(serverId) {
+    let creds;
+    try {
+      const keyring = await loadKeyring();
+      if (!keyring.ok) throw new KeychainUnavailableError(keyring.err);
+      creds = await keyring.mod.findCredentialsAsync(SERVICE_NAME);
+    } catch (err) {
+      if (err instanceof KeychainUnavailableError) throw err;
+      throw new KeychainUnavailableError(err);
     }
-  }
-  onMessage(message) {
-    if ("id" in message && message.id !== null && message.id !== void 0 && ("result" in message || "error" in message)) {
-      this.settleRequestWait(message.id);
+    const prefix = `${serverId}:`;
+    for (const c of creds) {
+      if (!c.account.startsWith(prefix)) continue;
+      const parsed = parseAccount(c.account);
+      if (!parsed || parsed.serverId !== serverId) continue;
+      await this.delete(serverId, parsed.field);
     }
-    const progressToken = progressTokenOf(message);
-    if (progressToken !== void 0) {
-      this.noteRequestProgress(progressToken);
+  }
+};
+async function secretStoreGetStrict(store, serverId, field) {
+  return store.getStrict ? store.getStrict(serverId, field) : store.get(serverId, field);
+}
+async function snapshotSecretFields(store, serverId, fields) {
+  return Promise.all(
+    fields.map(async (field) => ({
+      serverId,
+      field,
+      value: await secretStoreGetStrict(store, serverId, field)
+    }))
+  );
+}
+async function restoreSecretFields(store, snapshot, onRestoreFailure) {
+  for (const { serverId, field, value } of snapshot) {
+    try {
+      if (value === null) await store.delete(serverId, field);
+      else await store.set(serverId, field, value);
+    } catch (error) {
+      onRestoreFailure(error);
     }
-    this.pushEvent({ type: "message", data: message });
   }
-  onFetchRequest(entry) {
-    this.pushEvent({
-      type: "fetch_request",
-      data: {
-        ...entry,
-        timestamp: entry.timestamp instanceof Date ? entry.timestamp.toISOString() : entry.timestamp
+}
+async function secretStoreGetMany(store, requests) {
+  if (store.getMany) return store.getMany(requests);
+  const out = {};
+  await Promise.all(
+    requests.map(async ({ serverId, fields }) => {
+      const entries = await Promise.all(
+        fields.map(
+          async (field) => [field, await store.get(serverId, field)]
+        )
+      );
+      const found = {};
+      for (const [field, value] of entries) {
+        if (value !== null) setOwnEntry(found, field, value);
       }
-    });
+      setOwnEntry(out, serverId, found);
+    })
+  );
+  return out;
+}
+async function secretStoreGetManyStrict(store, requests) {
+  if (store.getManyStrict) return store.getManyStrict(requests);
+  const out = {};
+  await Promise.all(
+    requests.map(async ({ serverId, fields }) => {
+      const entries = await Promise.all(
+        fields.map(
+          async (field) => [
+            field,
+            await secretStoreGetStrict(store, serverId, field)
+          ]
+        )
+      );
+      const found = {};
+      for (const [field, value] of entries) {
+        if (value !== null) setOwnEntry(found, field, value);
+      }
+      setOwnEntry(out, serverId, found);
+    })
+  );
+  return out;
+}
+async function settleStoreMutations(mutations) {
+  const results = await Promise.allSettled(mutations);
+  for (const result of results) {
+    if (result.status === "rejected") throw result.reason;
   }
-  onFetchResponseBody(id, responseBody) {
-    this.pushEvent({
-      type: "fetch_request_body_update",
-      data: { id, responseBody }
-    });
+}
+async function secretStoreSetMany(store, serverId, values) {
+  if (store.setMany) return store.setMany(serverId, values);
+  await settleStoreMutations(
+    Object.entries(values).map(
+      ([field, value]) => store.set(serverId, field, value)
+    )
+  );
+}
+async function secretStoreIsDurable(store) {
+  return store.isDurable ? store.isDurable() : true;
+}
+var InMemorySecretStore = class {
+  map = /* @__PURE__ */ new Map();
+  async get(serverId, field) {
+    return this.map.get(buildAccount(serverId, field)) ?? null;
   }
-  onFetchStreamUpdate(id, stream) {
-    this.pushEvent({
-      type: "fetch_stream_update",
-      data: {
-        id,
-        eventCount: stream.eventCount,
-        ...stream.closedAt && { closedAt: stream.closedAt.toISOString() }
-      }
-    });
+  async set(serverId, field, value) {
+    this.map.set(buildAccount(serverId, field), value);
   }
-  onStderr(entry) {
-    this.pushEvent({
-      type: "stdio_log",
-      data: {
-        timestamp: entry.timestamp.toISOString(),
-        message: entry.message
-      }
-    });
+  async delete(serverId, field) {
+    this.map.delete(buildAccount(serverId, field));
+  }
+  async deleteAllForServer(serverId) {
+    const prefix = `${serverId}:`;
+    for (const key of [...this.map.keys()]) {
+      if (key.startsWith(prefix)) this.map.delete(key);
+    }
+  }
+};
+var SessionSecretStore = class extends InMemorySecretStore {
+  async isDurable() {
+    return false;
   }
 };
 
-// ../../core/mcp/remote/node/tokenAuthProvider.ts
-var REMOTE_OAUTH_STUB_METADATA = {
-  redirect_uris: [],
-  scope: ""
+// ../../core/auth/node/file-lock.ts
+var STALE_MS = 1e4;
+var RETRY = {
+  retries: 20,
+  factor: 2,
+  minTimeout: 20,
+  maxTimeout: 1e3
 };
-function cloneAuthState(state) {
+var RETRY_BUDGET_MS = (() => {
+  let total = 0;
+  let delay = RETRY.minTimeout;
+  for (let i = 0; i < RETRY.retries; i++) {
+    total += Math.min(delay, RETRY.maxTimeout);
+    delay *= RETRY.factor;
+  }
+  return total;
+})();
+var warned = /* @__PURE__ */ new Set();
+function warnOnce(message) {
+  if (warned.has(message)) return;
+  warned.add(message);
+  console.warn(`[mcp-inspector] ${message}`);
+}
+function isStuckOrHeld(err, lockPath) {
+  return isHeldElsewhere(err) || identifySync(lockPath) !== null;
+}
+var isHeldElsewhere = (err) => err.code === "ELOCKED";
+var describeError = (err) => err instanceof Error ? err.message : String(err);
+var lockPathOf = (target) => `${target}.lock`;
+function identifySync(lockPath) {
+  try {
+    const stat2 = statSync(lockPath);
+    return { ino: stat2.ino, birthtimeMs: stat2.birthtimeMs };
+  } catch {
+    return null;
+  }
+}
+function guardedFs(lockPath, owned, onRefused) {
+  const mine = () => {
+    if (owned.id === null) return true;
+    const now = identifySync(lockPath);
+    if (now === null) return false;
+    return now.ino === owned.id.ino && now.birthtimeMs === owned.id.birthtimeMs;
+  };
+  const removeIfMine = () => {
+    if (!mine()) {
+      onRefused();
+      return;
+    }
+    rmdirSync(lockPath);
+  };
   return {
-    ...state.oauthTokens && {
-      oauthTokens: { ...state.oauthTokens }
+    ...nodeFs,
+    // **Identity is captured here, not after `lock()` resolves.** `mkdir` is
+    // the moment the directory becomes ours, and it is synchronous with
+    // respect to this process: recording it in the callback, before yielding,
+    // leaves no window. Capturing after the acquire promise settled — as this
+    // did originally — spans the library's own `utimes`/`stat` probe, and a
+    // waiter replacing our directory inside that span would have us record
+    // *the winner's* identity as our own, after which the guard below would
+    // cheerfully delete their lock.
+    mkdir: (p, cb) => {
+      nodeFs.mkdir(p, (err) => {
+        if (!err) owned.id = identifySync(lockPath);
+        cb(err);
+      });
     },
-    ...state.oauthClient && {
-      oauthClient: { ...state.oauthClient }
+    // Reported as success when refused: the library's bookkeeping should
+    // forget this lock either way. Leaving it registered would hand the
+    // `signal-exit` handler a record pointing at the winner's directory.
+    rmdir: (_p, cb) => {
+      try {
+        removeIfMine();
+        cb(null);
+      } catch (err) {
+        cb(err);
+      }
+    },
+    /* v8 ignore next 3 -- @preserve: only reachable from proper-lockfile's
+       signal-exit handler, i.e. at real process exit, which no in-process
+       test can drive. Its logic is `removeIfMine`, covered via `rmdir`. */
+    rmdirSync: () => {
+      removeIfMine();
     }
   };
 }
-function createRemoteAuthProvider(initialAuthState) {
-  if (!initialAuthState?.oauthTokens && !initialAuthState?.oauthClient) {
-    return void 0;
+function acquire(target, retries, fsShim) {
+  return properLockfile.lock(target, {
+    realpath: false,
+    stale: STALE_MS,
+    retries,
+    // Every directory removal the library performs — on release and from its
+    // exit handler — routes through here. See `guardedFs`.
+    fs: fsShim,
+    // The library's default `onCompromised` *throws* — from a timer, with no
+    // caller on the stack, so it lands as an uncaught exception and takes the
+    // process down. This is also the library's *only* signal for the
+    // stale-takeover race described at the top of this file — someone
+    // declared our lock stale and replaced it — so it is the one place a user
+    // learns the guarantee was lost. Worth saying; not worth killing an
+    // Inspector session over.
+    onCompromised: (err) => warnOnce(
+      `The lock on the secrets file at ${target} was taken over by another process while a write was in progress (${err.message}). If a secret you just saved is missing, save it again.`
+    )
+  });
+}
+async function isFileLockHeld(filePath) {
+  try {
+    return await properLockfile.check(path2.resolve(filePath), {
+      realpath: false,
+      stale: STALE_MS
+    });
+  } catch {
+    return false;
   }
-  let authState = cloneAuthState(initialAuthState);
-  const provider = {
-    get clientMetadata() {
-      return REMOTE_OAUTH_STUB_METADATA;
-    },
-    get redirectUrl() {
-      return "";
-    },
-    async tokens() {
-      return authState.oauthTokens;
-    },
-    async clientInformation() {
-      if (!authState.oauthClient?.client_id) {
-        return void 0;
-      }
-      return {
-        client_id: authState.oauthClient.client_id,
-        ...authState.oauthClient.client_secret && {
-          client_secret: authState.oauthClient.client_secret
-        }
-      };
-    },
-    async saveTokens(tokens) {
-      authState = {
-        ...authState,
-        oauthTokens: {
-          access_token: tokens.access_token,
-          token_type: tokens.token_type,
-          expires_in: tokens.expires_in,
-          refresh_token: tokens.refresh_token,
-          scope: tokens.scope,
-          id_token: tokens.id_token
-        }
-      };
-    },
-    codeVerifier() {
-      return void 0;
-    },
-    async saveCodeVerifier() {
-    },
-    clear() {
-      authState = {};
-    },
-    async redirectToAuthorization() {
-      throw new Error(
-        "OAuth re-authorization must be performed in the Inspector web client (remote server cannot complete OAuth flows)"
+}
+async function openSecretFileLock(filePath) {
+  const target = path2.resolve(filePath);
+  await fs2.mkdir(path2.dirname(target), { recursive: true }).catch(() => {
+  });
+  const owned = { id: null };
+  const fsShim = guardedFs(
+    lockPathOf(target),
+    owned,
+    () => warnOnce(
+      `The lock on the secrets file at ${target} was taken over by another process while a write was in progress, so it was left alone rather than removed. If a secret you just saved is missing, save it again.`
+    )
+  );
+  let release;
+  try {
+    release = await acquire(target, 0, fsShim).catch((err) => {
+      if (!isStuckOrHeld(err, lockPathOf(target))) throw err;
+      return acquire(target, RETRY, fsShim);
+    });
+  } catch (err) {
+    if (isStuckOrHeld(err, lockPathOf(target))) {
+      throw new SecretFileLockHeldError(
+        `Could not save to the secrets file at ${target}: its lock (${lockPathOf(target)}) was still held after the ${Math.round(RETRY_BUDGET_MS / 1e3)} seconds this save waited. Its secrets are intact; the value you just entered was not saved. If no other Inspector is running, remove that lock and try again.`
       );
-    },
-    state() {
-      return "";
     }
-    // This provider implements only the members the remote backend transport
-    // exercises (token get/save, client info, non-interactive redirect); the
-    // interactive-only members the SDK never calls on the server side are stubbed
-    // with narrower shapes (e.g. `codeVerifier()` returns `undefined`, not the
-    // interface's `string | Promise<string>`), so it can't be assigned to the
-    // full `OAuthClientProvider` without the double cast.
-  };
-  return {
-    provider,
-    setAuthState(next) {
-      authState = cloneAuthState(next);
-    },
-    getAuthState() {
-      return cloneAuthState(authState);
+    warnOnce(
+      `Could not take a lock on the secrets file at ${target} (${describeError(err)}), so writes to it are not protected against another process writing at the same moment.`
+    );
+    return null;
+  }
+  return async () => {
+    try {
+      await release();
+    } catch (err) {
+      if (err.code === "ERELEASED") return;
+      warnOnce(
+        // **Conditional, not an instruction.** Two blanket versions of this
+        // have now been wrong in opposite directions: "it expires on its own"
+        // (false whenever the same `rmdir` that blocked us also blocks stale
+        // takeover — `ENOTEMPTY`, `EACCES`, `EPERM`, `EROFS`), and "remove it
+        // by hand" (false whenever the failure was transient, since the path
+        // may by then hold a *different, live* Inspector's lock, and deleting
+        // that destroys the exclusion of a process that did nothing wrong).
+        //
+        // `proper-lockfile` forwards whatever the filesystem returned, and
+        // nothing here can tell a permanent refusal from a passing one. So
+        // this reports what happened and states the two conditions the
+        // operator can check for themselves, rather than asserting an outcome
+        // this code does not know.
+        `Could not release the lock on the secrets file at ${target} (${describeError(err)}). It may clear on its own \u2014 stale takeover reclaims a lock through the same directory removal, so it will not if whatever blocked this persists. If saves keep failing against this file and no other Inspector is running, remove ${lockPathOf(target)} by hand.`
+      );
     }
   };
 }
-
-// ../../core/auth/node/secret-store.ts
-var SERVICE_NAME = "mcp-inspector";
-var keyringLoad;
-var KeyringModuleShapeError = class extends Error {
-  constructor(detail, options) {
-    super(`@napi-rs/keyring loaded but ${detail}`, options);
-    this.name = "KeyringModuleShapeError";
-  }
-};
-var checkKeyringShape = (mod) => {
+async function withSecretFileLock(filePath, fn) {
+  const release = await openSecretFileLock(filePath);
+  if (release === null) return fn();
   try {
-    if (typeof mod.AsyncEntry === "function" && typeof mod.findCredentialsAsync === "function") {
-      return { ok: true, mod };
-    }
-    return {
-      ok: false,
-      err: new KeyringModuleShapeError(
-        "did not expose AsyncEntry / findCredentialsAsync"
-      )
-    };
-  } catch (err) {
-    return {
-      ok: false,
-      err: new KeyringModuleShapeError(
-        `its exports could not be read: ${err instanceof Error ? err.message : String(err)}`,
-        { cause: err }
-      )
-    };
+    return await fn();
+  } finally {
+    await release();
   }
-};
-var loadKeyring = () => {
-  keyringLoad ??= import("@napi-rs/keyring").then(
-    checkKeyringShape,
-    (err) => ({ ok: false, err })
-  );
-  return keyringLoad;
-};
-function parseAccount(account) {
-  const idx = account.indexOf(":");
-  if (idx <= 0 || idx === account.length - 1) return null;
-  return {
-    serverId: account.slice(0, idx),
-    field: account.slice(idx + 1)
-  };
 }
-var buildAccount = (serverId, field) => `${serverId}:${field}`;
-var SecretStoreUnavailableError = class extends Error {
-  constructor(message, options) {
-    super(message, options);
-    this.name = "SecretStoreUnavailableError";
-  }
-};
-var KeychainUnavailableError = class extends SecretStoreUnavailableError {
-  constructor(cause) {
-    const message = cause instanceof Error ? cause.message : String(cause);
-    super(
-      `OS keychain is not available. ${hintFor(cause, message)} Underlying error: ${message}`
-    );
-    this.name = "KeychainUnavailableError";
+
+// ../../core/auth/node/secret-store-selection.ts
+import { randomUUID } from "crypto";
+import * as fsSync from "fs";
+import * as fs4 from "fs/promises";
+import * as path4 from "path";
+
+// ../../core/auth/node/file-secret-store.ts
+import * as crypto2 from "crypto";
+import { readFileSync as readFileSync4, statSync as statSync2 } from "fs";
+import * as fs3 from "fs/promises";
+import * as path3 from "path";
+var scrypt2 = (passphrase, salt, keylen, options) => new Promise((resolve9, reject) => {
+  crypto2.scrypt(passphrase, salt, keylen, options, (err, key) => {
+    if (err) reject(err);
+    else resolve9(key);
+  });
+});
+var FORMAT_VERSION = 1;
+var CIPHER = "aes-256-gcm";
+var KEY_BYTES = 32;
+var IV_BYTES = 12;
+var GCM_TAG_BYTES = 16;
+var SCRYPT_N = 16384;
+var SCRYPT_R = 8;
+var SCRYPT_P = 1;
+var SECRET_KEY_ENV = "MCP_INSPECTOR_SECRET_KEY";
+var SECRET_KEY_FILE_ENV = "MCP_INSPECTOR_SECRET_KEY_FILE";
+function isSameFile(a, b) {
+  if (path3.resolve(a) === path3.resolve(b)) return true;
+  try {
+    const sa = statSync2(a);
+    const sb = statSync2(b);
+    return sa.dev === sb.dev && sa.ino === sb.ino;
+  } catch {
+    return false;
   }
-};
-var hintFor = (cause, message) => {
-  if (cause instanceof KeyringModuleShapeError) {
-    return `The @napi-rs/keyring package loaded but does not expose the API this build expects \u2014 most likely a version or packaging mismatch; reinstall the Inspector, and report this if it persists.`;
+}
+function resolveSecretPassphrase(env = process.env, secretFilePath) {
+  const direct = env[SECRET_KEY_ENV];
+  const hasDirect = direct !== void 0 && direct.trim() !== "";
+  const rawKeyFile = env[SECRET_KEY_FILE_ENV];
+  const wantsKeyFile = rawKeyFile !== void 0;
+  const keyFile = rawKeyFile?.trim();
+  if (hasDirect && wantsKeyFile) {
+    return {
+      problem: `both ${SECRET_KEY_ENV} and ${SECRET_KEY_FILE_ENV} are set; set only one`
+    };
   }
-  if (message.includes("Cannot find native binding")) {
-    return `The @napi-rs/keyring platform package for this OS is missing or unavailable \u2014 reinstall the Inspector (for npx, clear the npx cache under your npm cache directory first).`;
+  if (hasDirect) return { passphrase: direct };
+  if (!wantsKeyFile) return {};
+  if (!keyFile) {
+    return { problem: `${SECRET_KEY_FILE_ENV} is set but empty` };
   }
-  return `On Linux, install libsecret / gnome-keyring.`;
-};
-async function probeKeyringAvailable() {
-  const keyring = await loadKeyring();
-  if (!keyring.ok) {
-    const err = keyring.err;
+  const resolved2 = path3.resolve(keyFile);
+  if (secretFilePath !== void 0 && isSameFile(resolved2, secretFilePath)) {
     return {
-      available: false,
-      detail: err instanceof Error ? err.message : String(err)
+      problem: `${SECRET_KEY_FILE_ENV} (${resolved2}) is the secrets file itself; point it at a separate key file`
     };
   }
+  let contents;
   try {
-    const entry = new keyring.mod.AsyncEntry(SERVICE_NAME, PROBE_ACCOUNT);
-    await entry.getPassword();
-    return { available: true };
+    contents = readFileSync4(resolved2, "utf-8");
   } catch (err) {
     return {
-      available: false,
-      detail: err instanceof Error ? err.message : String(err)
+      // `String(err)` rather than `.message`: `readFileSync` only ever throws
+      // an `Error`, so an `instanceof` guard would be a branch no test can take.
+      problem: `${SECRET_KEY_FILE_ENV} (${resolved2}) could not be read: ${String(err)}`
     };
   }
+  const passphrase = contents.replace(/[\r\n]+$/, "");
+  if (passphrase.trim() === "") {
+    return { problem: `${SECRET_KEY_FILE_ENV} (${resolved2}) is empty` };
+  }
+  return { passphrase };
 }
-var PROBE_ACCOUNT = "__inspector:probe";
-var KeyringSecretStore = class {
-  /**
-   * The intolerant read. Same lookup as {@link get}, minus the catch — a
-   * keychain that cannot answer must not be reported as an empty one to a
-   * caller that is about to write based on the answer.
-   */
-  async getStrict(serverId, field) {
-    try {
-      const keyring = await loadKeyring();
-      if (!keyring.ok) throw new KeychainUnavailableError(keyring.err);
-      const entry = new keyring.mod.AsyncEntry(
-        SERVICE_NAME,
-        buildAccount(serverId, field)
-      );
-      return await entry.getPassword() ?? null;
-    } catch (err) {
-      if (err instanceof KeychainUnavailableError) throw err;
-      throw new KeychainUnavailableError(err);
-    }
-  }
-  async get(serverId, field) {
-    try {
-      const keyring = await loadKeyring();
-      if (!keyring.ok) return null;
-      const entry = new keyring.mod.AsyncEntry(
-        SERVICE_NAME,
-        buildAccount(serverId, field)
-      );
-      const v = await entry.getPassword();
-      return v ?? null;
-    } catch {
-      return null;
-    }
+var buildAccount2 = (serverId, field) => `${serverId}:${field}`;
+function assertSecretString(field, value) {
+  if (typeof value !== "string") {
+    throw new TypeError(
+      `Refusing to store a non-string secret value (${typeof value}) for "${field}": the secrets file holds only strings, and writing this would make the whole file unreadable.`
+    );
   }
-  async set(serverId, field, value) {
-    try {
-      const keyring = await loadKeyring();
-      if (!keyring.ok) throw new KeychainUnavailableError(keyring.err);
-      const entry = new keyring.mod.AsyncEntry(
-        SERVICE_NAME,
-        buildAccount(serverId, field)
-      );
-      await entry.setPassword(value);
-    } catch (err) {
-      if (err instanceof KeychainUnavailableError) throw err;
-      throw new KeychainUnavailableError(err);
-    }
+}
+function asSecretMap(value, filePath) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new SecretStoreUnavailableError(
+      `The secrets file at ${filePath} does not hold a secret map (found ${Array.isArray(value) ? "an array" : typeof value}). Refusing to write, which would replace it. Move the file aside to start over.`
+    );
   }
-  async delete(serverId, field) {
-    try {
-      const keyring = await loadKeyring();
-      if (!keyring.ok) return;
-      const entry = new keyring.mod.AsyncEntry(
-        SERVICE_NAME,
-        buildAccount(serverId, field)
+  for (const [key, entry] of Object.entries(value)) {
+    if (typeof entry !== "string") {
+      throw new SecretStoreUnavailableError(
+        `The secrets file at ${filePath} holds a non-string value for "${key}". Refusing to write, which would replace it. Move the file aside to start over.`
       );
-      await entry.deleteCredential();
-    } catch {
     }
   }
-  async deleteAllForServer(serverId) {
-    let creds;
-    try {
-      const keyring = await loadKeyring();
-      if (!keyring.ok) return;
-      creds = await keyring.mod.findCredentialsAsync(SERVICE_NAME);
-    } catch {
-      return;
-    }
-    const prefix = `${serverId}:`;
-    for (const c of creds) {
-      if (!c.account.startsWith(prefix)) continue;
-      const parsed = parseAccount(c.account);
-      if (!parsed || parsed.serverId !== serverId) continue;
-      await this.delete(serverId, parsed.field);
-    }
+  return { ...value };
+}
+var SecretFileKeyMismatchError = class extends SecretStoreUnavailableError {
+  constructor(filePath, hasKey) {
+    super(
+      hasKey ? `The secrets file at ${filePath} could not be decrypted with the current ${SECRET_KEY_ENV} (or ${SECRET_KEY_FILE_ENV}). Refusing to write, which would overwrite the existing secrets. Restore the original passphrase, or delete the file to start over.` : `The secrets file at ${filePath} is encrypted but ${SECRET_KEY_ENV} is not set (nor ${SECRET_KEY_FILE_ENV}). Refusing to write, which would overwrite the existing secrets. Set the passphrase this file was written with, or delete the file to start over.`
+    );
+    this.name = "SecretFileKeyMismatchError";
   }
 };
-async function secretStoreGetStrict(store, serverId, field) {
-  return store.getStrict ? store.getStrict(serverId, field) : store.get(serverId, field);
-}
-async function secretStoreGetMany(store, requests) {
-  if (store.getMany) return store.getMany(requests);
-  const out = {};
-  await Promise.all(
-    requests.map(async ({ serverId, fields }) => {
-      const entries = await Promise.all(
-        fields.map(
-          async (field) => [field, await store.get(serverId, field)]
-        )
-      );
-      const found = {};
-      for (const [field, value] of entries) {
-        if (value !== null) found[field] = value;
-      }
-      out[serverId] = found;
-    })
-  );
-  return out;
+var encodeParts = (iv, tag, body) => `${iv.toString("base64")}.${tag.toString("base64")}.${body.toString("base64")}`;
+function decodeParts(payload) {
+  const parts = payload.split(".");
+  if (parts.length !== 3) return null;
+  const [iv, tag, body] = parts;
+  return {
+    iv: Buffer.from(iv, "base64"),
+    tag: Buffer.from(tag, "base64"),
+    body: Buffer.from(body, "base64")
+  };
 }
-async function secretStoreSetMany(store, serverId, values) {
-  if (store.setMany) return store.setMany(serverId, values);
-  await Promise.all(
-    Object.entries(values).map(
-      ([field, value]) => store.set(serverId, field, value)
-    )
+var MAX_WRITE_ATTEMPTS = 5;
+var fileQueues = /* @__PURE__ */ new Map();
+function sameMap(a, b) {
+  const ak = Object.keys(a);
+  if (ak.length !== Object.keys(b).length) return false;
+  return ak.every(
+    (k) => Object.prototype.hasOwnProperty.call(b, k) && a[k] === b[k]
   );
 }
-async function secretStoreIsDurable(store) {
-  return store.isDurable ? store.isDurable() : true;
-}
-var InMemorySecretStore = class {
-  map = /* @__PURE__ */ new Map();
-  async get(serverId, field) {
-    return this.map.get(buildAccount(serverId, field)) ?? null;
+var isPositiveInt = (v) => typeof v === "number" && Number.isInteger(v) && v > 0;
+function encryptedEnvelopeProblem(parsed) {
+  if (!parsed.kdf || typeof parsed.data !== "string") {
+    return "encrypted envelope is missing its kdf or data";
   }
-  async set(serverId, field, value) {
-    this.map.set(buildAccount(serverId, field), value);
+  const parts = decodeParts(parsed.data);
+  if (!parts) return "encrypted payload is not iv.tag.ciphertext";
+  if (parts.iv.length !== IV_BYTES) {
+    return `initialization vector is ${parts.iv.length} bytes, expected ${IV_BYTES}`;
   }
-  async delete(serverId, field) {
-    this.map.delete(buildAccount(serverId, field));
+  if (parts.tag.length !== GCM_TAG_BYTES) {
+    return `authentication tag is ${parts.tag.length} bytes, expected ${GCM_TAG_BYTES}`;
   }
-  async deleteAllForServer(serverId) {
-    const prefix = `${serverId}:`;
-    for (const key of [...this.map.keys()]) {
-      if (key.startsWith(prefix)) this.map.delete(key);
-    }
+  if (parts.body.length === 0) return "ciphertext is empty";
+  const { algorithm, salt, N, r, p } = parsed.kdf;
+  if (algorithm !== "scrypt") return `unsupported kdf "${String(algorithm)}"`;
+  if (typeof salt !== "string" || Buffer.from(salt, "base64").length === 0) {
+    return "kdf salt is missing or not base64";
   }
-};
-var SessionSecretStore = class extends InMemorySecretStore {
-  async isDurable() {
-    return false;
+  if (!isPositiveInt(N) || N < 2 || (N & N - 1) !== 0) {
+    return `kdf N is ${String(N)}, which is not a power of two above 1`;
   }
-};
-
-// ../../core/auth/node/secret-store-selection.ts
-import { randomUUID } from "crypto";
-import * as fsSync from "fs";
-import * as fs4 from "fs/promises";
-import * as path4 from "path";
-
-// ../../core/auth/node/file-secret-store.ts
-import * as crypto2 from "crypto";
-import { readFileSync as readFileSync4, statSync as statSync2 } from "fs";
-import * as fs3 from "fs/promises";
-import * as path3 from "path";
-
-// ../../core/auth/node/file-lock.ts
-import nodeFs, { statSync, rmdirSync } from "fs";
-import * as fs2 from "fs/promises";
-import * as path2 from "path";
-import properLockfile from "proper-lockfile";
-var STALE_MS = 1e4;
-var RETRY = {
-  retries: 20,
-  factor: 2,
-  minTimeout: 20,
-  maxTimeout: 1e3
-};
-var RETRY_BUDGET_MS = (() => {
-  let total = 0;
-  let delay = RETRY.minTimeout;
-  for (let i = 0; i < RETRY.retries; i++) {
-    total += Math.min(delay, RETRY.maxTimeout);
-    delay *= RETRY.factor;
+  if (!isPositiveInt(r) || !isPositiveInt(p)) {
+    return `kdf r/p are ${String(r)}/${String(p)}, which are not positive integers`;
   }
-  return total;
-})();
-var warned = /* @__PURE__ */ new Set();
-function warnOnce(message) {
-  if (warned.has(message)) return;
-  warned.add(message);
-  console.warn(`[mcp-inspector] ${message}`);
-}
-function isStuckOrHeld(err, lockPath) {
-  return isHeldElsewhere(err) || identifySync(lockPath) !== null;
-}
-var isHeldElsewhere = (err) => err.code === "ELOCKED";
-var describeError = (err) => err instanceof Error ? err.message : String(err);
-var lockPathOf = (target) => `${target}.lock`;
-function identifySync(lockPath) {
-  try {
-    const stat2 = statSync(lockPath);
-    return { ino: stat2.ino, birthtimeMs: stat2.birthtimeMs };
-  } catch {
-    return null;
+  if (N > SCRYPT_N || r > SCRYPT_R || p > SCRYPT_P) {
+    return `kdf cost parameters (N=${N}, r=${r}, p=${p}) exceed the supported maximum (N=${SCRYPT_N}, r=${SCRYPT_R}, p=${SCRYPT_P})`;
   }
-}
-function guardedFs(lockPath, owned, onRefused) {
-  const mine = () => {
-    if (owned.id === null) return true;
-    const now = identifySync(lockPath);
-    if (now === null) return false;
-    return now.ino === owned.id.ino && now.birthtimeMs === owned.id.birthtimeMs;
-  };
-  const removeIfMine = () => {
-    if (!mine()) {
-      onRefused();
-      return;
-    }
-    rmdirSync(lockPath);
-  };
-  return {
-    ...nodeFs,
-    // **Identity is captured here, not after `lock()` resolves.** `mkdir` is
-    // the moment the directory becomes ours, and it is synchronous with
-    // respect to this process: recording it in the callback, before yielding,
-    // leaves no window. Capturing after the acquire promise settled — as this
-    // did originally — spans the library's own `utimes`/`stat` probe, and a
-    // waiter replacing our directory inside that span would have us record
-    // *the winner's* identity as our own, after which the guard below would
-    // cheerfully delete their lock.
-    mkdir: (p, cb) => {
-      nodeFs.mkdir(p, (err) => {
-        if (!err) owned.id = identifySync(lockPath);
-        cb(err);
-      });
-    },
-    // Reported as success when refused: the library's bookkeeping should
-    // forget this lock either way. Leaving it registered would hand the
-    // `signal-exit` handler a record pointing at the winner's directory.
-    rmdir: (_p, cb) => {
-      try {
-        removeIfMine();
-        cb(null);
-      } catch (err) {
-        cb(err);
-      }
-    },
-    /* v8 ignore next 3 -- @preserve: only reachable from proper-lockfile's
-       signal-exit handler, i.e. at real process exit, which no in-process
-       test can drive. Its logic is `removeIfMine`, covered via `rmdir`. */
-    rmdirSync: () => {
-      removeIfMine();
-    }
-  };
-}
-function acquire(target, retries, fsShim) {
-  return properLockfile.lock(target, {
-    realpath: false,
-    stale: STALE_MS,
-    retries,
-    // Every directory removal the library performs — on release and from its
-    // exit handler — routes through here. See `guardedFs`.
-    fs: fsShim,
-    // The library's default `onCompromised` *throws* — from a timer, with no
-    // caller on the stack, so it lands as an uncaught exception and takes the
-    // process down. This is also the library's *only* signal for the
-    // stale-takeover race described at the top of this file — someone
-    // declared our lock stale and replaced it — so it is the one place a user
-    // learns the guarantee was lost. Worth saying; not worth killing an
-    // Inspector session over.
-    onCompromised: (err) => warnOnce(
-      `The lock on the secrets file at ${target} was taken over by another process while a write was in progress (${err.message}). If a secret you just saved is missing, save it again.`
-    )
-  });
-}
-async function isFileLockHeld(filePath) {
-  try {
-    return await properLockfile.check(path2.resolve(filePath), {
-      realpath: false,
-      stale: STALE_MS
-    });
-  } catch {
-    return false;
-  }
-}
-async function openSecretFileLock(filePath) {
-  const target = path2.resolve(filePath);
-  await fs2.mkdir(path2.dirname(target), { recursive: true }).catch(() => {
-  });
-  const owned = { id: null };
-  const fsShim = guardedFs(
-    lockPathOf(target),
-    owned,
-    () => warnOnce(
-      `The lock on the secrets file at ${target} was taken over by another process while a write was in progress, so it was left alone rather than removed. If a secret you just saved is missing, save it again.`
-    )
-  );
-  let release;
-  try {
-    release = await acquire(target, 0, fsShim).catch((err) => {
-      if (!isStuckOrHeld(err, lockPathOf(target))) throw err;
-      return acquire(target, RETRY, fsShim);
-    });
-  } catch (err) {
-    if (isStuckOrHeld(err, lockPathOf(target))) {
-      throw new SecretStoreUnavailableError(
-        `Could not save to the secrets file at ${target}: its lock (${lockPathOf(target)}) was still held after the ${Math.round(RETRY_BUDGET_MS / 1e3)} seconds this save waited. Its secrets are intact; the value you just entered was not saved. If no other Inspector is running, remove that lock and try again.`
-      );
-    }
-    warnOnce(
-      `Could not take a lock on the secrets file at ${target} (${describeError(err)}), so writes to it are not protected against another process writing at the same moment.`
-    );
-    return null;
-  }
-  return async () => {
-    try {
-      await release();
-    } catch (err) {
-      if (err.code === "ERELEASED") return;
-      warnOnce(
-        // **Conditional, not an instruction.** Two blanket versions of this
-        // have now been wrong in opposite directions: "it expires on its own"
-        // (false whenever the same `rmdir` that blocked us also blocks stale
-        // takeover — `ENOTEMPTY`, `EACCES`, `EPERM`, `EROFS`), and "remove it
-        // by hand" (false whenever the failure was transient, since the path
-        // may by then hold a *different, live* Inspector's lock, and deleting
-        // that destroys the exclusion of a process that did nothing wrong).
-        //
-        // `proper-lockfile` forwards whatever the filesystem returned, and
-        // nothing here can tell a permanent refusal from a passing one. So
-        // this reports what happened and states the two conditions the
-        // operator can check for themselves, rather than asserting an outcome
-        // this code does not know.
-        `Could not release the lock on the secrets file at ${target} (${describeError(err)}). It may clear on its own \u2014 stale takeover reclaims a lock through the same directory removal, so it will not if whatever blocked this persists. If saves keep failing against this file and no other Inspector is running, remove ${lockPathOf(target)} by hand.`
-      );
-    }
-  };
-}
-async function withSecretFileLock(filePath, fn) {
-  const release = await openSecretFileLock(filePath);
-  if (release === null) return fn();
-  try {
-    return await fn();
-  } finally {
-    await release();
-  }
-}
-
-// ../../core/auth/node/file-secret-store.ts
-var scrypt2 = (passphrase, salt, keylen, options) => new Promise((resolve9, reject) => {
-  crypto2.scrypt(passphrase, salt, keylen, options, (err, key) => {
-    if (err) reject(err);
-    else resolve9(key);
-  });
-});
-var FORMAT_VERSION = 1;
-var CIPHER = "aes-256-gcm";
-var KEY_BYTES = 32;
-var IV_BYTES = 12;
-var GCM_TAG_BYTES = 16;
-var SCRYPT_N = 16384;
-var SCRYPT_R = 8;
-var SCRYPT_P = 1;
-var SECRET_KEY_ENV = "MCP_INSPECTOR_SECRET_KEY";
-var SECRET_KEY_FILE_ENV = "MCP_INSPECTOR_SECRET_KEY_FILE";
-function isSameFile(a, b) {
-  if (path3.resolve(a) === path3.resolve(b)) return true;
-  try {
-    const sa = statSync2(a);
-    const sb = statSync2(b);
-    return sa.dev === sb.dev && sa.ino === sb.ino;
-  } catch {
-    return false;
-  }
-}
-function resolveSecretPassphrase(env = process.env, secretFilePath) {
-  const direct = env[SECRET_KEY_ENV];
-  const hasDirect = direct !== void 0 && direct.trim() !== "";
-  const rawKeyFile = env[SECRET_KEY_FILE_ENV];
-  const wantsKeyFile = rawKeyFile !== void 0;
-  const keyFile = rawKeyFile?.trim();
-  if (hasDirect && wantsKeyFile) {
-    return {
-      problem: `both ${SECRET_KEY_ENV} and ${SECRET_KEY_FILE_ENV} are set; set only one`
-    };
-  }
-  if (hasDirect) return { passphrase: direct };
-  if (!wantsKeyFile) return {};
-  if (!keyFile) {
-    return { problem: `${SECRET_KEY_FILE_ENV} is set but empty` };
-  }
-  const resolved2 = path3.resolve(keyFile);
-  if (secretFilePath !== void 0 && isSameFile(resolved2, secretFilePath)) {
-    return {
-      problem: `${SECRET_KEY_FILE_ENV} (${resolved2}) is the secrets file itself; point it at a separate key file`
-    };
-  }
-  let contents;
-  try {
-    contents = readFileSync4(resolved2, "utf-8");
-  } catch (err) {
-    return {
-      // `String(err)` rather than `.message`: `readFileSync` only ever throws
-      // an `Error`, so an `instanceof` guard would be a branch no test can take.
-      problem: `${SECRET_KEY_FILE_ENV} (${resolved2}) could not be read: ${String(err)}`
-    };
-  }
-  const passphrase = contents.replace(/[\r\n]+$/, "");
-  if (passphrase.trim() === "") {
-    return { problem: `${SECRET_KEY_FILE_ENV} (${resolved2}) is empty` };
-  }
-  return { passphrase };
-}
-var buildAccount2 = (serverId, field) => `${serverId}:${field}`;
-function asSecretMap(value, filePath) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    throw new SecretStoreUnavailableError(
-      `The secrets file at ${filePath} does not hold a secret map (found ${Array.isArray(value) ? "an array" : typeof value}). Refusing to write, which would replace it. Move the file aside to start over.`
-    );
-  }
-  for (const [key, entry] of Object.entries(value)) {
-    if (typeof entry !== "string") {
-      throw new SecretStoreUnavailableError(
-        `The secrets file at ${filePath} holds a non-string value for "${key}". Refusing to write, which would replace it. Move the file aside to start over.`
-      );
-    }
-  }
-  return { ...value };
-}
-var SecretFileKeyMismatchError = class extends SecretStoreUnavailableError {
-  constructor(filePath, hasKey) {
-    super(
-      hasKey ? `The secrets file at ${filePath} could not be decrypted with the current ${SECRET_KEY_ENV} (or ${SECRET_KEY_FILE_ENV}). Refusing to write, which would overwrite the existing secrets. Restore the original passphrase, or delete the file to start over.` : `The secrets file at ${filePath} is encrypted but ${SECRET_KEY_ENV} is not set (nor ${SECRET_KEY_FILE_ENV}). Refusing to write, which would overwrite the existing secrets. Set the passphrase this file was written with, or delete the file to start over.`
-    );
-    this.name = "SecretFileKeyMismatchError";
-  }
-};
-var encodeParts = (iv, tag, body) => `${iv.toString("base64")}.${tag.toString("base64")}.${body.toString("base64")}`;
-function decodeParts(payload) {
-  const parts = payload.split(".");
-  if (parts.length !== 3) return null;
-  const [iv, tag, body] = parts;
-  return {
-    iv: Buffer.from(iv, "base64"),
-    tag: Buffer.from(tag, "base64"),
-    body: Buffer.from(body, "base64")
-  };
-}
-var MAX_WRITE_ATTEMPTS = 5;
-var fileQueues = /* @__PURE__ */ new Map();
-function sameMap(a, b) {
-  const ak = Object.keys(a);
-  if (ak.length !== Object.keys(b).length) return false;
-  return ak.every(
-    (k) => Object.prototype.hasOwnProperty.call(b, k) && a[k] === b[k]
-  );
-}
-var isPositiveInt = (v) => typeof v === "number" && Number.isInteger(v) && v > 0;
-function encryptedEnvelopeProblem(parsed) {
-  if (!parsed.kdf || typeof parsed.data !== "string") {
-    return "encrypted envelope is missing its kdf or data";
-  }
-  const parts = decodeParts(parsed.data);
-  if (!parts) return "encrypted payload is not iv.tag.ciphertext";
-  if (parts.iv.length !== IV_BYTES) {
-    return `initialization vector is ${parts.iv.length} bytes, expected ${IV_BYTES}`;
-  }
-  if (parts.tag.length !== GCM_TAG_BYTES) {
-    return `authentication tag is ${parts.tag.length} bytes, expected ${GCM_TAG_BYTES}`;
-  }
-  if (parts.body.length === 0) return "ciphertext is empty";
-  const { algorithm, salt, N, r, p } = parsed.kdf;
-  if (algorithm !== "scrypt") return `unsupported kdf "${String(algorithm)}"`;
-  if (typeof salt !== "string" || Buffer.from(salt, "base64").length === 0) {
-    return "kdf salt is missing or not base64";
-  }
-  if (!isPositiveInt(N) || N < 2 || (N & N - 1) !== 0) {
-    return `kdf N is ${String(N)}, which is not a power of two above 1`;
-  }
-  if (!isPositiveInt(r) || !isPositiveInt(p)) {
-    return `kdf r/p are ${String(r)}/${String(p)}, which are not positive integers`;
-  }
-  if (N > SCRYPT_N || r > SCRYPT_R || p > SCRYPT_P) {
-    return `kdf cost parameters (N=${N}, r=${r}, p=${p}) exceed the supported maximum (N=${SCRYPT_N}, r=${SCRYPT_R}, p=${SCRYPT_P})`;
-  }
-  return null;
+  return null;
 }
 var FileSecretStore = class {
   filePath;
@@ -3806,7 +3540,9 @@ var FileSecretStore = class {
     let plain;
     try {
       const key = await this.deriveKey(parsed.kdf);
-      const decipher = crypto2.createDecipheriv(CIPHER, key, parts.iv);
+      const decipher = crypto2.createDecipheriv(CIPHER, key, parts.iv, {
+        authTagLength: GCM_TAG_BYTES
+      });
       decipher.setAuthTag(parts.tag);
       plain = Buffer.concat([
         decipher.update(parts.body),
@@ -3840,7 +3576,9 @@ var FileSecretStore = class {
       };
       const key = await this.deriveKey(kdf);
       const iv = crypto2.randomBytes(IV_BYTES);
-      const cipher = crypto2.createCipheriv(CIPHER, key, iv);
+      const cipher = crypto2.createCipheriv(CIPHER, key, iv, {
+        authTagLength: GCM_TAG_BYTES
+      });
       const body = Buffer.concat([
         cipher.update(JSON.stringify(map), "utf-8"),
         cipher.final()
@@ -4005,27 +3743,54 @@ var FileSecretStore = class {
       const found = {};
       for (const field of fields) {
         const value = map?.[buildAccount2(serverId, field)];
-        if (value !== void 0) found[field] = value;
+        if (value !== void 0) setOwnEntry(found, field, value);
       }
-      out[serverId] = found;
+      setOwnEntry(out, serverId, found);
     }
     return out;
   }
   /**
-   * The intolerant read — same lookup as {@link get}, minus the catch.
-   *
-   * Without this, `secretStoreGetStrict` fell back to `get` for the file
-   * store and turned every read failure into `null`. Both plaintext
-   * migrations *write* on `null` and then strip the disk copy, so a
-   * transient read error that cleared before the write let an older
-   * on-disk value replace a newer stored one — the same inversion the
-   * strict seam was introduced to prevent, still open on the store the
-   * seam was introduced for.
+   * Bulk twin of {@link getStrict}: the same single-pass read as
+   * {@link getMany}, but an unreadable store throws (with the typed advice
+   * {@link getStrict} attaches) instead of yielding no fields — required by
+   * OAuth read hydration, whose result later drives store deletions.
    */
-  async getStrict(serverId, field) {
+  async getManyStrict(requests) {
+    let map;
     try {
-      const map = await this.serialize(() => this.readMap());
-      return map?.[buildAccount2(serverId, field)] ?? null;
+      map = await this.serialize(() => this.readMap());
+    } catch (err) {
+      if (err instanceof SecretStoreUnavailableError) throw err;
+      throw new SecretStoreUnavailableError(
+        `Could not read the secrets file at ${this.filePath}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    const out = {};
+    for (const { serverId, fields } of requests) {
+      const found = {};
+      for (const field of fields) {
+        const value = map?.[buildAccount2(serverId, field)];
+        if (value !== void 0) setOwnEntry(found, field, value);
+      }
+      setOwnEntry(out, serverId, found);
+    }
+    return out;
+  }
+  /**
+   * The intolerant read — same lookup as {@link get}, minus the catch.
+   *
+   * Without this, `secretStoreGetStrict` fell back to `get` for the file
+   * store and turned every read failure into `null`. Both plaintext
+   * migrations *write* on `null` and then strip the disk copy, so a
+   * transient read error that cleared before the write let an older
+   * on-disk value replace a newer stored one — the same inversion the
+   * strict seam was introduced to prevent, still open on the store the
+   * seam was introduced for.
+   */
+  async getStrict(serverId, field) {
+    try {
+      const map = await this.serialize(() => this.readMap());
+      return map?.[buildAccount2(serverId, field)] ?? null;
     } catch (err) {
       if (err instanceof SecretStoreUnavailableError) throw err;
       throw new SecretStoreUnavailableError(
@@ -4051,6 +3816,9 @@ var FileSecretStore = class {
    */
   async setMany(serverId, values) {
     if (Object.keys(values).length === 0) return;
+    for (const [field, value] of Object.entries(values)) {
+      assertSecretString(field, value);
+    }
     await this.serialize(
       () => this.mutate((map) => {
         const next = { ...map };
@@ -4062,6 +3830,7 @@ var FileSecretStore = class {
     );
   }
   async set(serverId, field, value) {
+    assertSecretString(field, value);
     await this.serialize(
       () => this.mutate((map) => ({
         ...map,
@@ -4077,9 +3846,11 @@ var FileSecretStore = class {
     await this.deleteWhere((key) => key.startsWith(prefix));
   }
   /**
-   * Shared delete body. Silent on every failure, matching the keyring store:
-   * every reason a delete can fail collapses to "the entry isn't there
-   * anymore", and `set` is the operation that reports a broken store.
+   * Shared delete body. Same confirmed-delete contract as the keyring
+   * store: a deletion that cannot be confirmed (unreadable file, failed
+   * decrypt, failed write) must escape, because reporting success would
+   * let a caller commit state that assumes the entry is gone — once the
+   * file becomes readable again, a later read would resurrect it.
    */
   async deleteWhere(match) {
     try {
@@ -4092,7 +3863,12 @@ var FileSecretStore = class {
           return next;
         })
       );
-    } catch {
+    } catch (err) {
+      if (err instanceof SecretStoreUnavailableError) throw err;
+      throw new SecretStoreUnavailableError(
+        `Could not delete from the secrets file: ${err instanceof Error ? err.message : String(err)}`,
+        { cause: err }
+      );
     }
   }
 };
@@ -4353,150 +4129,1432 @@ async function handOffStagedSecrets(staged, filePath, keyring) {
 [mcp-inspector] Secrets were moved into the OS keychain, but the temporary copy at ${staged} could not be removed (${err instanceof Error ? err.message : String(err)}). Delete it once you have confirmed the keychain has your secrets.`
       );
     }
-    return;
+    return;
+  }
+  try {
+    await fs4.link(staged, filePath);
+    await fs4.rm(staged, { force: true });
+  } catch {
+    console.warn(
+      `
+[mcp-inspector] Could not restore ${staged} to ${filePath}; both files exist and the snapshot holds the secrets that were not migrated. Merge it by hand, or delete it once you have confirmed nothing is missing.`
+    );
+  }
+}
+var isSnapshotName = (name, base) => name.startsWith(`${base}.migrating-`) && !name.endsWith(".lock");
+async function anythingToMigrate(filePath) {
+  const base = path4.basename(filePath);
+  try {
+    return (await fs4.readdir(path4.dirname(filePath))).some(
+      (name) => name === base || isSnapshotName(name, base)
+    );
+  } catch (err) {
+    const code = err.code;
+    return code !== "ENOENT" && code !== "ENOTDIR";
+  }
+}
+async function recoverOrphanedSnapshots(filePath) {
+  const dir = path4.dirname(filePath);
+  const base = path4.basename(filePath);
+  let names;
+  try {
+    names = (await fs4.readdir(dir)).filter((n) => isSnapshotName(n, base));
+  } catch {
+    return;
+  }
+  for (const name of names) {
+    const orphan = path4.join(dir, name);
+    if (await isFileLockHeld(orphan)) continue;
+    try {
+      await fs4.link(orphan, filePath);
+      await fs4.rm(orphan, { force: true });
+      console.warn(
+        `
+[mcp-inspector] Recovered secrets left behind by an interrupted migration (${orphan} \u2192 ${filePath}).`
+      );
+    } catch {
+      console.warn(
+        `
+[mcp-inspector] Found secrets from an interrupted migration at ${orphan}, and a current ${filePath} already exists, so it was left alone. It may hold values the current file does not.`
+      );
+    }
+  }
+}
+async function handOff(file, filePath, keyring) {
+  let entries;
+  try {
+    entries = await file.readAll();
+  } catch (err) {
+    console.warn(
+      `
+[mcp-inspector] The OS keychain is available again, but the secrets file at ${filePath} could not be read, so its contents were left there: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return false;
+  }
+  if (!entries || Object.keys(entries).length === 0) return false;
+  let complete = true;
+  try {
+    for (const [account, value] of Object.entries(entries)) {
+      const parsed = parseAccount(account);
+      if (!parsed) {
+        complete = false;
+        continue;
+      }
+      const existing = await secretStoreGetStrict(
+        keyring,
+        parsed.serverId,
+        parsed.field
+      );
+      if (existing === null) {
+        await keyring.set(parsed.serverId, parsed.field, value);
+      }
+    }
+  } catch (err) {
+    console.warn(
+      `
+[mcp-inspector] Could not move the secrets file at ${filePath} into the OS keychain, so it has been left in place: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return false;
+  }
+  if (!complete) {
+    console.warn(
+      `
+[mcp-inspector] Secrets from ${filePath} have been copied into the OS keychain, but at least one entry could not be read (its key is not in \`serverId:field\` form). The file has been left in place so nothing is lost.`
+    );
+    return false;
+  }
+  return true;
+}
+async function getSecretStorageInfo() {
+  const { store, info } = await resolveSecretStore();
+  if (info.kind !== "file" || !(store instanceof FileSecretStore)) return info;
+  return describeFileStore(
+    store,
+    store.filePath,
+    "file",
+    info.reason,
+    info.detail
+  );
+}
+var DeferredSecretStore = class {
+  async target() {
+    return (await resolveSecretStore()).store;
+  }
+  async isDurable() {
+    return secretStoreIsDurable(await this.target());
+  }
+  /**
+   * Forwarded, and its absence was a real defect rather than an omission:
+   * this is the store production actually uses, so a `secretStoreGetStrict`
+   * call against it fell through to the tolerant `get` and the strictness
+   * existed only in tests that injected a concrete store.
+   */
+  async getStrict(serverId, field) {
+    return secretStoreGetStrict(await this.target(), serverId, field);
+  }
+  async getMany(requests) {
+    return secretStoreGetMany(await this.target(), requests);
+  }
+  async getManyStrict(requests) {
+    return secretStoreGetManyStrict(await this.target(), requests);
+  }
+  async get(serverId, field) {
+    return (await this.target()).get(serverId, field);
+  }
+  async set(serverId, field, value) {
+    await (await this.target()).set(serverId, field, value);
+  }
+  async setMany(serverId, values) {
+    await secretStoreSetMany(await this.target(), serverId, values);
+  }
+  async delete(serverId, field) {
+    await (await this.target()).delete(serverId, field);
+  }
+  async deleteAllForServer(serverId) {
+    await (await this.target()).deleteAllForServer(serverId);
+  }
+};
+function defaultSecretStore() {
+  return new DeferredSecretStore();
+}
+
+// ../../core/auth/node/oauth-secrets.ts
+import { OAuthTokensSchema as OAuthTokensSchema2 } from "@modelcontextprotocol/core";
+var PERSIST_TOKENS_ENV = "MCP_INSPECTOR_PERSIST_TOKENS";
+var warnedPolicyValues = /* @__PURE__ */ new Set();
+function getPersistTokensPolicy(env = process.env) {
+  const raw = env[PERSIST_TOKENS_ENV];
+  if (raw === void 0 || raw === "") return "all";
+  if (raw === "all" || raw === "access" || raw === "none") return raw;
+  if (!warnedPolicyValues.has(raw)) {
+    warnedPolicyValues.add(raw);
+    console.warn(
+      `[mcp-inspector] Ignoring invalid ${PERSIST_TOKENS_ENV}=${JSON.stringify(raw)} (expected "all", "access", or "none"); persisting all tokens.`
+    );
+  }
+  return "all";
+}
+var oauthSecretServerId = (serverUrl) => `oauth+${encodeURIComponent(serverUrl)}`;
+var oauthIdpSecretServerId = (issuer) => `oauth-idp+${encodeURIComponent(issuer)}`;
+var issuerTokensField = (issuer) => `tokens:${issuer}`;
+var issuerClientSecretField = (issuer) => `client-secret:${issuer}`;
+var issuerRegistrationTokenField = (issuer) => `registration-token:${issuer}`;
+var LEGACY_TOKENS_FIELD = "tokens";
+var LEGACY_CLIENT_SECRET_FIELD = "client-secret";
+var LEGACY_REGISTRATION_TOKEN_FIELD = "registration-token";
+var PREREG_CLIENT_SECRET_FIELD = "prereg-client-secret";
+var PREREG_REGISTRATION_TOKEN_FIELD = "prereg-registration-token";
+var IDP_SESSION_FIELD = "idp-session";
+function applyTokensPolicy(tokens, policy) {
+  if (policy === "none") return void 0;
+  if (policy === "access" && tokens.refresh_token !== void 0) {
+    const { refresh_token: _stripped, ...rest } = tokens;
+    return rest;
+  }
+  return tokens;
+}
+var StorableTokensSchema = OAuthTokensSchema2.partial();
+function hasSecretBearingTokenField(tokens) {
+  return tokens.access_token !== void 0 || tokens.refresh_token !== void 0 || tokens.id_token !== void 0;
+}
+function splitTokens(tokens, policy) {
+  const kept = applyTokensPolicy(tokens, policy);
+  if (!kept) return {};
+  if (!StorableTokensSchema.safeParse(kept).success) {
+    return { plaintext: kept };
+  }
+  if (!hasSecretBearingTokenField(kept)) {
+    return {};
+  }
+  return { secret: JSON.stringify(kept) };
+}
+function splitClientInformation(info, fields, secrets) {
+  const { client_secret, registration_access_token, ...publicInfo } = info;
+  if (client_secret === void 0 && registration_access_token === void 0) {
+    return info;
+  }
+  if (client_secret !== void 0) {
+    secrets[fields.clientSecret] = client_secret;
+  }
+  if (registration_access_token !== void 0) {
+    secrets[fields.registrationToken] = registration_access_token;
+  }
+  return publicInfo;
+}
+function joinClientInformation(info, fields, secrets) {
+  const clientSecret = secrets[fields.clientSecret];
+  const registrationToken = secrets[fields.registrationToken];
+  if (clientSecret === void 0 && registrationToken === void 0) {
+    return info;
+  }
+  return {
+    ...info,
+    ...clientSecret !== void 0 && { client_secret: clientSecret },
+    ...registrationToken !== void 0 && {
+      registration_access_token: registrationToken
+    }
+  };
+}
+var issuerClientInfoFields = (issuer) => ({
+  clientSecret: issuerClientSecretField(issuer),
+  registrationToken: issuerRegistrationTokenField(issuer)
+});
+var LEGACY_CLIENT_INFO_FIELDS = {
+  clientSecret: LEGACY_CLIENT_SECRET_FIELD,
+  registrationToken: LEGACY_REGISTRATION_TOKEN_FIELD
+};
+var PREREG_CLIENT_INFO_FIELDS = {
+  clientSecret: PREREG_CLIENT_SECRET_FIELD,
+  registrationToken: PREREG_REGISTRATION_TOKEN_FIELD
+};
+function splitServerOAuthState(state, policy) {
+  const secrets = {};
+  const residue = { ...state };
+  if (state.byIssuer) {
+    const byIssuer = {};
+    for (const [issuer, slot] of Object.entries(state.byIssuer)) {
+      const slotResidue = { ...slot };
+      if (slot.tokens) {
+        delete slotResidue.tokens;
+        const tokenSplit = splitTokens(slot.tokens, policy);
+        if (tokenSplit.secret !== void 0) {
+          secrets[issuerTokensField(issuer)] = tokenSplit.secret;
+        }
+        if (tokenSplit.plaintext) slotResidue.tokens = tokenSplit.plaintext;
+      }
+      if (slot.clientInformation) {
+        slotResidue.clientInformation = splitClientInformation(
+          slot.clientInformation,
+          issuerClientInfoFields(issuer),
+          secrets
+        );
+      }
+      setOwnEntry(byIssuer, issuer, slotResidue);
+    }
+    residue.byIssuer = byIssuer;
+  }
+  if (state.tokens) {
+    delete residue.tokens;
+    const tokenSplit = splitTokens(state.tokens, policy);
+    if (tokenSplit.secret !== void 0) {
+      secrets[LEGACY_TOKENS_FIELD] = tokenSplit.secret;
+    }
+    if (tokenSplit.plaintext) residue.tokens = tokenSplit.plaintext;
+  }
+  if (state.clientInformation) {
+    residue.clientInformation = splitClientInformation(
+      state.clientInformation,
+      LEGACY_CLIENT_INFO_FIELDS,
+      secrets
+    );
+  }
+  if (state.preregisteredClientInformation) {
+    residue.preregisteredClientInformation = splitClientInformation(
+      state.preregisteredClientInformation,
+      PREREG_CLIENT_INFO_FIELDS,
+      secrets
+    );
+  }
+  return { residue, secrets };
+}
+function parseStoredTokens(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (StorableTokensSchema.safeParse(parsed).success && hasSecretBearingTokenField(parsed)) {
+      return parsed;
+    }
+  } catch {
+  }
+  return void 0;
+}
+function parseStoredIdpSession(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed === "object" && parsed !== null) {
+      const { idToken, refreshToken } = parsed;
+      const usable = {
+        ...typeof idToken === "string" && { idToken },
+        ...typeof refreshToken === "string" && { refreshToken }
+      };
+      if (Object.keys(usable).length > 0) return usable;
+    }
+  } catch {
+  }
+  return void 0;
+}
+function isUsableStoredSecret(field, raw) {
+  if (field === LEGACY_TOKENS_FIELD || field.startsWith("tokens:")) {
+    return parseStoredTokens(raw) !== void 0;
+  }
+  if (field === IDP_SESSION_FIELD) {
+    return parseStoredIdpSession(raw) !== void 0;
+  }
+  return true;
+}
+function joinServerOAuthState(residue, secrets) {
+  const joined = { ...residue };
+  if (residue.byIssuer) {
+    const byIssuer = {};
+    for (const [issuer, slot] of Object.entries(residue.byIssuer)) {
+      const joinedSlot = { ...slot };
+      const tokensRaw = secrets[issuerTokensField(issuer)];
+      if (tokensRaw !== void 0) {
+        const tokens = parseStoredTokens(tokensRaw);
+        if (tokens) joinedSlot.tokens = tokens;
+      }
+      if (joinedSlot.clientInformation) {
+        joinedSlot.clientInformation = joinClientInformation(
+          joinedSlot.clientInformation,
+          issuerClientInfoFields(issuer),
+          secrets
+        );
+      }
+      setOwnEntry(byIssuer, issuer, joinedSlot);
+    }
+    joined.byIssuer = byIssuer;
+  }
+  const legacyTokensRaw = secrets[LEGACY_TOKENS_FIELD];
+  if (legacyTokensRaw !== void 0) {
+    const tokens = parseStoredTokens(legacyTokensRaw);
+    if (tokens) joined.tokens = tokens;
+  }
+  if (joined.clientInformation) {
+    joined.clientInformation = joinClientInformation(
+      joined.clientInformation,
+      LEGACY_CLIENT_INFO_FIELDS,
+      secrets
+    );
+  }
+  if (joined.preregisteredClientInformation) {
+    joined.preregisteredClientInformation = joinClientInformation(
+      joined.preregisteredClientInformation,
+      PREREG_CLIENT_INFO_FIELDS,
+      secrets
+    );
+  }
+  return joined;
+}
+function splitIdpSession(session, policy) {
+  const { idToken, refreshToken, ...residue } = session;
+  const secrets = {};
+  if (policy !== "none" && (idToken !== void 0 || refreshToken !== void 0)) {
+    const kept = {
+      ...typeof idToken === "string" && { idToken },
+      ...policy === "all" && typeof refreshToken === "string" && { refreshToken }
+    };
+    if (Object.keys(kept).length > 0) {
+      secrets[IDP_SESSION_FIELD] = JSON.stringify(kept);
+    }
+  }
+  return { residue, secrets };
+}
+function joinIdpSession(residue, secrets) {
+  const raw = secrets[IDP_SESSION_FIELD];
+  if (raw === void 0) return { ...residue };
+  const stored = parseStoredIdpSession(raw);
+  return stored ? { ...residue, ...stored } : { ...residue };
+}
+function serverSecretFields(state) {
+  const fields = /* @__PURE__ */ new Set([
+    LEGACY_TOKENS_FIELD,
+    LEGACY_CLIENT_SECRET_FIELD,
+    LEGACY_REGISTRATION_TOKEN_FIELD,
+    PREREG_CLIENT_SECRET_FIELD,
+    PREREG_REGISTRATION_TOKEN_FIELD
+  ]);
+  for (const issuer of Object.keys(state?.byIssuer ?? {})) {
+    fields.add(issuerTokensField(issuer));
+    fields.add(issuerClientSecretField(issuer));
+    fields.add(issuerRegistrationTokenField(issuer));
+  }
+  return [...fields];
+}
+function clientInfoHasPlaintext(info) {
+  return info !== void 0 && (info.client_secret !== void 0 || info.registration_access_token !== void 0);
+}
+function snapshotHasPlaintextSecrets(snapshot) {
+  for (const state of Object.values(snapshot.servers)) {
+    if (state.tokens) return true;
+    if (clientInfoHasPlaintext(state.clientInformation)) return true;
+    if (clientInfoHasPlaintext(state.preregisteredClientInformation)) {
+      return true;
+    }
+    for (const slot of Object.values(state.byIssuer ?? {})) {
+      if (slot.tokens) return true;
+      if (clientInfoHasPlaintext(slot.clientInformation)) return true;
+    }
+  }
+  for (const session of Object.values(snapshot.idpSessions)) {
+    if (session.idToken !== void 0 || session.refreshToken !== void 0) {
+      return true;
+    }
+  }
+  return false;
+}
+
+// ../../core/auth/node/oauth-persist-file.ts
+var warnedStoreFailures = /* @__PURE__ */ new Set();
+function warnStoreWriteFailure(error) {
+  const reason = error instanceof Error ? error.message : String(error);
+  if (warnedStoreFailures.has(reason)) return;
+  warnedStoreFailures.add(reason);
+  console.warn(
+    `[mcp-inspector] Could not write OAuth tokens to the secret store (${reason}). Tokens will be kept in memory for this session only and will NOT be persisted; expect to re-authorize after a restart.`
+  );
+}
+function warnRestoreFailure(error) {
+  const reason = error instanceof Error ? error.message : String(error);
+  const key = `restore:${reason}`;
+  if (warnedStoreFailures.has(key)) return;
+  warnedStoreFailures.add(key);
+  console.warn(
+    `[mcp-inspector] Could not restore secret-store entries after a failed OAuth state write (${reason}). The secret store may be inconsistent with oauth.json; if a server's stored credentials stop working, re-authorize it.`
+  );
+}
+function warnUnconfirmedFile(error) {
+  const reason = error instanceof Error ? error.message : String(error);
+  const key = `unconfirmed:${reason}`;
+  if (warnedStoreFailures.has(key)) return;
+  warnedStoreFailures.add(key);
+  console.warn(
+    `[mcp-inspector] Could not re-read oauth.json after a failed OAuth state save (${reason}). The file may still contain the interrupted save while the secret store was restored to the previous values; if a server's stored credentials stop working, re-authorize it.`
+  );
+}
+function warnMigrationFailure(error) {
+  const reason = error instanceof Error ? error.message : String(error);
+  const key = `migration:${reason}`;
+  if (warnedStoreFailures.has(key)) return;
+  warnedStoreFailures.add(key);
+  console.warn(
+    `[mcp-inspector] Could not migrate plaintext OAuth secrets into the secret store (${reason}). The plaintext copy in oauth.json was kept and keeps working; migration will be retried on the next read.`
+  );
+}
+function rethrowLockError(filePath, error, action = "save") {
+  if (error instanceof SecretFileLockHeldError) {
+    throw new SecretFileLockHeldError(
+      `Could not ${action} OAuth state: the state file at ${filePath} is locked by another Inspector process and did not become available.`,
+      { cause: error }
+    );
+  }
+  throw error;
+}
+async function withOAuthStateLock(filePath, action, body) {
+  let entered = false;
+  try {
+    return await withSecretFileLock(filePath, async () => {
+      entered = true;
+      return body();
+    });
+  } catch (error) {
+    if (!entered) rethrowLockError(filePath, error, action);
+    throw error;
+  }
+}
+var OAuthStateFileUnrecognizedError = class extends Error {
+  constructor(filePath, action) {
+    super(
+      `Refusing to ${action} OAuth state: ${filePath} exists but is not a recognized OAuth state file (it may be corrupt, truncated, or written by something else). Its entries are the only index of credentials in the OS keychain / secret store, so overwriting it would strand them. Restore the file from a backup or fix its JSON; deleting it starts fresh but abandons any credentials it indexed.`
+    );
+    this.name = "OAuthStateFileUnrecognizedError";
+  }
+};
+async function readDiskForMutation(filePath, action) {
+  const raw = await readStoreFile(filePath);
+  const parsed = parseOAuthPersistBlob(raw);
+  if (raw !== null && parsed === null) {
+    throw new OAuthStateFileUnrecognizedError(filePath, action);
+  }
+  return parsed;
+}
+async function persistEntrySecrets(store, serverId, candidates, secrets, prior, allowDegrade) {
+  const priorValue = new Map(prior.map(({ field, value }) => [field, value]));
+  const changed = {};
+  for (const [field, value] of Object.entries(secrets)) {
+    if (priorValue.get(field) !== value) changed[field] = value;
+  }
+  try {
+    if (Object.keys(changed).length > 0) {
+      await secretStoreSetMany(store, serverId, changed);
+    }
+  } catch (error) {
+    if (!allowDegrade) throw error;
+    warnStoreWriteFailure(error);
+    const touched = prior.filter(({ field }) => changed[field] !== void 0);
+    let restoreFailure;
+    await restoreSecretFields(store, touched, (err) => {
+      restoreFailure = err;
+    });
+    if (restoreFailure !== void 0) throw restoreFailure;
+    return false;
+  }
+  await settleStoreMutations(
+    candidates.filter(
+      (field) => secrets[field] === void 0 && priorValue.get(field) !== null
+    ).map((field) => store.delete(serverId, field))
+  );
+  return true;
+}
+function revertEntryToDisk(merged, disk, key) {
+  const diskEntry = getOwnEntry(disk, key);
+  if (diskEntry === void 0) {
+    if (Object.hasOwn(merged, key)) delete merged[key];
+  } else {
+    setOwnEntry(merged, key, diskEntry);
+  }
+}
+function preserveNonDurableSecrets(diskSecrets, secrets) {
+  const keep = {};
+  for (const [field, value] of Object.entries(secrets)) {
+    if (diskSecrets[field] === value) keep[field] = value;
+  }
+  return keep;
+}
+async function writeOAuthSections(filePath, snapshot, sections, secretStore = defaultSecretStore()) {
+  const policy = getPersistTokensPolicy();
+  const durable = await secretStoreIsDurable(secretStore);
+  await withOAuthStateLock(filePath, "save", async () => {
+    const restoreBaseline = /* @__PURE__ */ new Map();
+    const ourWrites = /* @__PURE__ */ new Map();
+    const priorKey = (p) => `${p.serverId}\0${p.field}`;
+    const foldPriors = (priors) => {
+      for (const prior of priors) {
+        const key = priorKey(prior);
+        if (restoreBaseline.has(key) && ourWrites.get(key) !== void 0 && prior.value === ourWrites.get(key)) {
+          continue;
+        }
+        restoreBaseline.set(key, prior);
+      }
+    };
+    const restoreToBaseline = () => restoreSecretFields(
+      secretStore,
+      [...restoreBaseline.values()],
+      warnRestoreFailure
+    );
+    let unconfirmed = null;
+    const reconcileFailure = async () => {
+      if (unconfirmed !== null) {
+        const committed = unconfirmed;
+        let observed = null;
+        let readable = true;
+        try {
+          observed = await readStoreFile(filePath);
+        } catch (error) {
+          readable = false;
+          warnUnconfirmedFile(error);
+        }
+        if (readable && observed === committed.written) {
+          const target = new Map(
+            [...restoreBaseline].map(([key, { serverId, field, value }]) => [
+              key,
+              { serverId, field, value }
+            ])
+          );
+          for (const [key, write] of committed.writes) target.set(key, write);
+          try {
+            await settleStoreMutations(
+              [...target.values()].map(
+                ({ serverId, field, value }) => value === null ? secretStore.delete(serverId, field) : secretStore.set(serverId, field, value)
+              )
+            );
+            return true;
+          } catch (error) {
+            warnRestoreFailure(error);
+            return false;
+          }
+        }
+      }
+      await restoreToBaseline();
+      return false;
+    };
+    for (let attempt = 0; attempt < MAX_WRITE_ATTEMPTS; attempt++) {
+      const priorSecrets = [];
+      const attemptWrites = /* @__PURE__ */ new Map();
+      let written;
+      try {
+        const disk = await readDiskForMutation(filePath, "save");
+        const effective = sections ? {
+          servers: sections.servers && [...new Set(sections.servers)],
+          idpSessions: sections.idpSessions && [
+            ...new Set(sections.idpSessions)
+          ]
+        } : {
+          servers: [
+            .../* @__PURE__ */ new Set([
+              ...Object.keys(disk?.servers ?? {}),
+              ...Object.keys(snapshot.servers)
+            ])
+          ],
+          idpSessions: [
+            .../* @__PURE__ */ new Set([
+              ...Object.keys(disk?.idpSessions ?? {}),
+              ...Object.keys(snapshot.idpSessions)
+            ])
+          ]
+        };
+        const merged = mergeOAuthSections(disk, snapshot, effective);
+        for (const url of effective.servers ?? []) {
+          const serverId = oauthSecretServerId(url);
+          const next = getOwnEntry(snapshot.servers, url);
+          const candidates = [
+            .../* @__PURE__ */ new Set([
+              ...serverSecretFields(getOwnEntry(disk?.servers, url)),
+              ...serverSecretFields(next)
+            ])
+          ];
+          const entryPrior = await snapshotSecretFields(
+            secretStore,
+            serverId,
+            candidates
+          );
+          priorSecrets.push(...entryPrior);
+          if (next === void 0) {
+            for (const field of candidates) {
+              ourWrites.set(priorKey({ serverId, field }), null);
+            }
+            await secretStore.deleteAllForServer(serverId);
+            for (const field of candidates) {
+              attemptWrites.set(priorKey({ serverId, field }), {
+                serverId,
+                field,
+                value: null
+              });
+            }
+            continue;
+          }
+          const { residue, secrets } = splitServerOAuthState(next, policy);
+          for (const field of candidates) {
+            ourWrites.set(
+              priorKey({ serverId, field }),
+              secrets[field] ?? null
+            );
+          }
+          setOwnEntry(merged.servers, url, residue);
+          if (!durable) {
+            const diskEntry = getOwnEntry(disk?.servers, url);
+            const keep = preserveNonDurableSecrets(
+              diskEntry ? splitServerOAuthState(diskEntry, policy).secrets : {},
+              secrets
+            );
+            if (Object.keys(keep).length > 0) {
+              setOwnEntry(
+                merged.servers,
+                url,
+                joinServerOAuthState(residue, keep)
+              );
+            }
+          }
+          const persisted = await persistEntrySecrets(
+            secretStore,
+            serverId,
+            candidates,
+            secrets,
+            entryPrior,
+            // Degrading is only sound when the disk entry is the pre-call
+            // state this attempt's priors pair with; on a retry it may be an
+            // earlier attempt's committed residue, so escalate into the
+            // reconciling exit instead.
+            attempt === 0
+          );
+          if (!persisted) {
+            revertEntryToDisk(merged.servers, disk?.servers, url);
+            continue;
+          }
+          for (const field of candidates) {
+            attemptWrites.set(priorKey({ serverId, field }), {
+              serverId,
+              field,
+              value: secrets[field] ?? null
+            });
+          }
+        }
+        for (const issuer of effective.idpSessions ?? []) {
+          const serverId = oauthIdpSecretServerId(issuer);
+          const next = getOwnEntry(snapshot.idpSessions, issuer);
+          const entryPrior = await snapshotSecretFields(secretStore, serverId, [
+            IDP_SESSION_FIELD
+          ]);
+          priorSecrets.push(...entryPrior);
+          if (next === void 0) {
+            ourWrites.set(
+              priorKey({ serverId, field: IDP_SESSION_FIELD }),
+              null
+            );
+            await secretStore.deleteAllForServer(serverId);
+            attemptWrites.set(
+              priorKey({ serverId, field: IDP_SESSION_FIELD }),
+              {
+                serverId,
+                field: IDP_SESSION_FIELD,
+                value: null
+              }
+            );
+            continue;
+          }
+          const { residue, secrets } = splitIdpSession(next, policy);
+          ourWrites.set(
+            priorKey({ serverId, field: IDP_SESSION_FIELD }),
+            secrets[IDP_SESSION_FIELD] ?? null
+          );
+          setOwnEntry(merged.idpSessions, issuer, residue);
+          if (!durable) {
+            const diskSession = getOwnEntry(disk?.idpSessions, issuer);
+            const keep = preserveNonDurableSecrets(
+              diskSession ? splitIdpSession(diskSession, policy).secrets : {},
+              secrets
+            );
+            if (Object.keys(keep).length > 0) {
+              setOwnEntry(
+                merged.idpSessions,
+                issuer,
+                joinIdpSession(residue, keep)
+              );
+            }
+          }
+          const persisted = await persistEntrySecrets(
+            secretStore,
+            serverId,
+            [IDP_SESSION_FIELD],
+            secrets,
+            entryPrior,
+            // Same as the server loop: degrade on the first attempt only.
+            attempt === 0
+          );
+          if (!persisted) {
+            revertEntryToDisk(merged.idpSessions, disk?.idpSessions, issuer);
+            continue;
+          }
+          attemptWrites.set(priorKey({ serverId, field: IDP_SESSION_FIELD }), {
+            serverId,
+            field: IDP_SESSION_FIELD,
+            value: secrets[IDP_SESSION_FIELD] ?? null
+          });
+        }
+        written = serializeOAuthPersistBlob(merged);
+        await writeStoreFile(filePath, written);
+        unconfirmed = { written, writes: attemptWrites };
+      } catch (error) {
+        foldPriors(priorSecrets);
+        if (await reconcileFailure()) return;
+        throw error;
+      }
+      foldPriors(priorSecrets);
+      let observed;
+      try {
+        observed = await readStoreFile(filePath);
+      } catch {
+        continue;
+      }
+      if (observed === written) return;
+      unconfirmed = null;
+    }
+    if (await reconcileFailure()) return;
+    throw new SecretStoreUnavailableError(
+      `Could not save OAuth state: another process kept overwriting ${filePath} (gave up after ${MAX_WRITE_ATTEMPTS} attempts). Re-run the action to retry.`
+    );
+  });
+}
+function secretRequestsFor(snapshot) {
+  const requests = [];
+  for (const [url, state] of Object.entries(snapshot.servers)) {
+    requests.push({
+      serverId: oauthSecretServerId(url),
+      fields: serverSecretFields(state)
+    });
+  }
+  for (const issuer of Object.keys(snapshot.idpSessions)) {
+    requests.push({
+      serverId: oauthIdpSecretServerId(issuer),
+      fields: [IDP_SESSION_FIELD]
+    });
+  }
+  return requests;
+}
+async function joinSnapshot(snapshot, secretStore) {
+  const requests = secretRequestsFor(snapshot);
+  const values = requests.length > 0 ? await secretStoreGetManyStrict(secretStore, requests) : {};
+  return {
+    servers: Object.fromEntries(
+      Object.entries(snapshot.servers).map(([url, state]) => [
+        url,
+        joinServerOAuthState(state, values[oauthSecretServerId(url)] ?? {})
+      ])
+    ),
+    idpSessions: Object.fromEntries(
+      Object.entries(snapshot.idpSessions).map(([issuer, session]) => [
+        issuer,
+        joinIdpSession(session, values[oauthIdpSecretServerId(issuer)] ?? {})
+      ])
+    )
+  };
+}
+async function migratePlaintextSecrets(filePath, secretStore) {
+  const raw = await readStoreFile(filePath);
+  const fresh = parseOAuthPersistBlob(raw);
+  if (!fresh || !snapshotHasPlaintextSecrets(fresh)) return;
+  const migrateEntrySecrets = async (serverId, secrets) => {
+    const absent = {};
+    for (const [field, value] of Object.entries(secrets)) {
+      const existing = await secretStoreGetStrict(secretStore, serverId, field);
+      if (existing === null || !isUsableStoredSecret(field, existing)) {
+        absent[field] = value;
+      }
+    }
+    if (Object.keys(absent).length > 0) {
+      await secretStoreSetMany(secretStore, serverId, absent);
+    }
+  };
+  const residue = { servers: {}, idpSessions: {} };
+  for (const [url, state] of Object.entries(fresh.servers)) {
+    const split = splitServerOAuthState(state, "all");
+    setOwnEntry(residue.servers, url, split.residue);
+    await migrateEntrySecrets(oauthSecretServerId(url), split.secrets);
+  }
+  for (const [issuer, session] of Object.entries(fresh.idpSessions)) {
+    const split = splitIdpSession(session, "all");
+    setOwnEntry(residue.idpSessions, issuer, split.residue);
+    await migrateEntrySecrets(oauthIdpSecretServerId(issuer), split.secrets);
+  }
+  const stripped = serializeOAuthPersistBlob(residue);
+  if (stripped !== raw) {
+    await writeStoreFile(filePath, stripped);
+  }
+}
+async function readOAuthStore(filePath, secretStore = defaultSecretStore()) {
+  return withOAuthStateLock(filePath, "read", async () => {
+    let snapshot = parseOAuthPersistBlob(await readStoreFile(filePath));
+    if (snapshot === null) return null;
+    if (snapshotHasPlaintextSecrets(snapshot) && await secretStoreIsDurable(secretStore)) {
+      try {
+        await migratePlaintextSecrets(filePath, secretStore);
+        snapshot = parseOAuthPersistBlob(await readStoreFile(filePath)) ?? snapshot;
+      } catch (error) {
+        warnMigrationFailure(error);
+      }
+    }
+    return joinSnapshot(snapshot, secretStore);
+  });
+}
+async function removeOAuthStore(filePath, secretStore = defaultSecretStore()) {
+  await withOAuthStateLock(filePath, "remove", async () => {
+    const snapshot = await readDiskForMutation(filePath, "remove");
+    if (snapshot) {
+      const targets = [
+        ...Object.entries(snapshot.servers).map(([url, state]) => ({
+          id: oauthSecretServerId(url),
+          fields: serverSecretFields(state)
+        })),
+        ...Object.keys(snapshot.idpSessions).map((issuer) => ({
+          id: oauthIdpSecretServerId(issuer),
+          fields: [IDP_SESSION_FIELD]
+        }))
+      ];
+      const priorSecrets = [];
+      try {
+        for (const { id, fields } of targets) {
+          priorSecrets.push(
+            ...await snapshotSecretFields(secretStore, id, fields)
+          );
+          await secretStore.deleteAllForServer(id);
+        }
+        await deleteStoreFile(filePath);
+      } catch (error) {
+        await restoreSecretFields(
+          secretStore,
+          priorSecrets,
+          warnRestoreFailure
+        );
+        throw error;
+      }
+    } else {
+      await deleteStoreFile(filePath);
+    }
+  });
+}
+
+// ../../core/json/xMcpHeader.ts
+var MCP_PARAM_HEADER_PREFIX = "Mcp-Param-";
+
+// ../../core/mcp/import/clientConfig.ts
+function parseJsonObject(raw) {
+  let data;
+  try {
+    data = JSON.parse(raw);
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    throw new Error(`Invalid JSON: ${detail}`, { cause: err });
+  }
+  if (!data || typeof data !== "object" || Array.isArray(data)) {
+    throw new Error("Expected a JSON object at the top level");
+  }
+  return data;
+}
+function normalizeServerMap(servers) {
+  const out = {};
+  for (const [id, raw] of Object.entries(servers)) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
+    const normalized = normalizeServerType(
+      raw
+    );
+    out[id] = normalized;
+  }
+  return out;
+}
+function parseMcpServersConfig(raw) {
+  const data = parseJsonObject(raw);
+  const servers = data.mcpServers;
+  if (!servers || typeof servers !== "object" || Array.isArray(servers)) {
+    throw new Error("No 'mcpServers' object found in config file");
+  }
+  return {
+    mcpServers: normalizeServerMap(servers)
+  };
+}
+function parseVsCodeConfig(raw) {
+  const data = parseJsonObject(raw);
+  const servers = data.servers;
+  if (!servers || typeof servers !== "object" || Array.isArray(servers)) {
+    throw new Error("No 'servers' object found in VS Code config file");
+  }
+  return {
+    mcpServers: normalizeServerMap(servers)
+  };
+}
+
+// ../../core/mcp/import/strategies.ts
+function join5(...segments) {
+  return segments.map(
+    (s, i) => i === 0 ? s.replace(/\/+$/, "") : s.replace(/^\/+|\/+$/g, "")
+  ).filter((s) => s.length > 0).join("/");
+}
+function appData(homeDir) {
+  return join5(homeDir, "AppData", "Roaming");
+}
+function appSupportDir(platform, homeDir, app) {
+  if (platform === "darwin") {
+    return join5(homeDir, "Library", "Application Support", app);
+  }
+  if (platform === "win32") {
+    return join5(appData(homeDir), app);
+  }
+  return join5(homeDir, ".config", app);
+}
+var claudeDesktop = {
+  id: "claude-desktop",
+  label: "Claude Desktop",
+  defaultPaths: (platform, homeDir) => [
+    join5(
+      appSupportDir(platform, homeDir, "Claude"),
+      "claude_desktop_config.json"
+    )
+  ],
+  parse: parseMcpServersConfig
+};
+var cursor = {
+  id: "cursor",
+  label: "Cursor",
+  defaultPaths: (_platform, homeDir) => [join5(homeDir, ".cursor", "mcp.json")],
+  parse: parseMcpServersConfig
+};
+var cline = {
+  id: "cline",
+  label: "Cline",
+  defaultPaths: (platform, homeDir) => [
+    // Cline (VS Code extension) global settings live under the editor's
+    // globalStorage; the documented cross-platform fallback is ~/Documents.
+    join5(
+      appSupportDir(platform, homeDir, "Code"),
+      "User",
+      "globalStorage",
+      "saoudrizwan.claude-dev",
+      "settings",
+      "cline_mcp_settings.json"
+    ),
+    join5(homeDir, "Documents", "Cline", "MCP", "cline_mcp_settings.json")
+  ],
+  parse: parseMcpServersConfig
+};
+var vscode = {
+  id: "vscode",
+  label: "VS Code",
+  defaultPaths: (platform, homeDir) => [
+    join5(appSupportDir(platform, homeDir, "Code"), "User", "mcp.json")
+  ],
+  parse: parseVsCodeConfig
+};
+var IMPORT_STRATEGY_LIST = [
+  claudeDesktop,
+  cursor,
+  cline,
+  vscode
+];
+var IMPORT_STRATEGIES = Object.fromEntries(IMPORT_STRATEGY_LIST.map((s) => [s.id, s]));
+function getImportStrategy(id) {
+  return IMPORT_STRATEGIES[id];
+}
+
+// ../../core/mcp/import/resolveSource.ts
+function resolveImportSource(type, platform, homeDir, readFile2) {
+  const strategy = getImportStrategy(type);
+  if (!strategy) return null;
+  const searched = strategy.defaultPaths(platform, homeDir);
+  for (const path6 of searched) {
+    let raw;
+    try {
+      raw = readFile2(path6);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      return {
+        type,
+        found: true,
+        path: path6,
+        error: `Failed to read ${path6}: ${msg}`,
+        searched
+      };
+    }
+    if (raw === null) continue;
+    try {
+      const config = strategy.parse(raw);
+      return { type, found: true, path: path6, config, searched };
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      return { type, found: true, path: path6, error: msg, searched };
+    }
+  }
+  return { type, found: false, searched };
+}
+
+// ../../core/mcp/remote/progressToken.ts
+import { ProgressTokenSchema } from "@modelcontextprotocol/core";
+function progressTokenOf(message) {
+  if ("method" in message && message.method === "notifications/progress" && "params" in message && typeof message.params === "object" && message.params !== null) {
+    const parsed = ProgressTokenSchema.safeParse(
+      message.params.progressToken
+    );
+    if (parsed.success) {
+      return parsed.data;
+    }
+  }
+  return void 0;
+}
+function waitForProgressToken(waits, token) {
+  const exact = waits.get(token);
+  if (exact !== void 0 || typeof token === "number") {
+    return exact;
+  }
+  const numeric = Number(token);
+  return Number.isSafeInteger(numeric) ? waits.get(numeric) : void 0;
+}
+
+// ../../core/mcp/remote/node/remote-session.ts
+var RemoteSession = class _RemoteSession {
+  sessionId;
+  transport;
+  eventQueue = [];
+  eventConsumer = null;
+  transportDead = false;
+  transportError = null;
+  activeSendCount = 0;
+  /**
+   * Suppress duplicate ambient SSE auth echoes after HTTP command-scoped delivery.
+   * Stale transport `onerror` may arrive after the send completes.
+   */
+  authHttpEchoSuppressUntilMs = 0;
+  static AUTH_HTTP_ECHO_SUPPRESS_MS = 3e4;
+  requestWaits = /* @__PURE__ */ new Map();
+  authProviderHandle = null;
+  appliedProtocolVersion;
+  /** A protocol version is a dated token (`2025-11-25`, `2026-07-28`, …). */
+  static PROTOCOL_VERSION_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
+  constructor(sessionId) {
+    this.sessionId = sessionId;
+  }
+  setAuthProviderHandle(handle) {
+    this.authProviderHandle = handle;
+  }
+  setAuthState(authState) {
+    if (!this.authProviderHandle) {
+      throw new Error("Session has no OAuth auth provider");
+    }
+    this.authProviderHandle.setAuthState(authState);
+  }
+  setTransport(transport) {
+    this.transport = transport;
+  }
+  /**
+   * Apply the client's negotiated protocol version to the upstream transport
+   * (#1935). The browser's SDK Client owns the `initialize` handshake, so the
+   * `setProtocolVersion` call it makes lands on the *remote* transport; without
+   * this the backend's real HTTP transport never learns the version and drops
+   * `Mcp-Protocol-Version` from every subsequent request.
+   *
+   * Ignores anything that isn't a plausible version token so a client can't
+   * push arbitrary bytes into an upstream header, and re-applies only on
+   * change (the value rides every `/api/mcp/send`). The value arrives from an
+   * unvalidated JSON body, so the type is checked rather than assumed —
+   * `RegExp.test` would otherwise coerce a `123` or `true` into a "matching"
+   * string and hand the wrong type to the transport.
+   */
+  applyProtocolVersion(version) {
+    if (typeof version !== "string" || version === this.appliedProtocolVersion || !_RemoteSession.PROTOCOL_VERSION_PATTERN.test(version)) {
+      return;
+    }
+    this.appliedProtocolVersion = version;
+    this.transport.setProtocolVersion?.(version);
+  }
+  setEventConsumer(consumer) {
+    this.eventConsumer = consumer;
+    while (this.eventQueue.length > 0) {
+      const ev = this.eventQueue.shift();
+      consumer(ev);
+    }
+  }
+  clearEventConsumer() {
+    this.eventConsumer = null;
+    return this.transportDead;
+  }
+  markTransportDead(error) {
+    this.transportDead = true;
+    this.transportError = error;
+    this.pushEvent({
+      type: "transport_error",
+      data: {
+        error,
+        code: -32e3
+        // MCP error code for connection closed
+      }
+    });
+  }
+  isTransportDead() {
+    return this.transportDead;
+  }
+  getTransportError() {
+    return this.transportError;
+  }
+  hasEventConsumer() {
+    return this.eventConsumer !== null;
+  }
+  beginSend() {
+    this.activeSendCount++;
+  }
+  endSend() {
+    if (this.activeSendCount > 0) {
+      this.activeSendCount--;
+    }
   }
-  try {
-    await fs4.link(staged, filePath);
-    await fs4.rm(staged, { force: true });
-  } catch {
-    console.warn(
-      `
-[mcp-inspector] Could not restore ${staged} to ${filePath}; both files exist and the snapshot holds the secrets that were not migrated. Merge it by hand, or delete it once you have confirmed nothing is missing.`
-    );
+  /** Command-scoped auth was returned on HTTP; suppress async onerror echo on SSE. */
+  noteAuthChallengeDeliveredViaHttp() {
+    this.extendAuthHttpEchoSuppression();
   }
-}
-var isSnapshotName = (name, base) => name.startsWith(`${base}.migrating-`) && !name.endsWith(".lock");
-async function anythingToMigrate(filePath) {
-  const base = path4.basename(filePath);
-  try {
-    return (await fs4.readdir(path4.dirname(filePath))).some(
-      (name) => name === base || isSnapshotName(name, base)
-    );
-  } catch (err) {
-    const code = err.code;
-    return code !== "ENOENT" && code !== "ENOTDIR";
+  extendAuthHttpEchoSuppression() {
+    this.authHttpEchoSuppressUntilMs = Date.now() + _RemoteSession.AUTH_HTTP_ECHO_SUPPRESS_MS;
   }
-}
-async function recoverOrphanedSnapshots(filePath) {
-  const dir = path4.dirname(filePath);
-  const base = path4.basename(filePath);
-  let names;
-  try {
-    names = (await fs4.readdir(dir)).filter((n) => isSnapshotName(n, base));
-  } catch {
-    return;
+  shouldSuppressAuthEcho() {
+    return Date.now() < this.authHttpEchoSuppressUntilMs;
   }
-  for (const name of names) {
-    const orphan = path4.join(dir, name);
-    if (await isFileLockHeld(orphan)) continue;
-    try {
-      await fs4.link(orphan, filePath);
-      await fs4.rm(orphan, { force: true });
-      console.warn(
-        `
-[mcp-inspector] Recovered secrets left behind by an interrupted migration (${orphan} \u2192 ${filePath}).`
-      );
-    } catch {
-      console.warn(
-        `
-[mcp-inspector] Found secrets from an interrupted migration at ${orphan}, and a current ${filePath} already exists, so it was left alone. It may hold values the current file does not.`
-      );
-    }
+  hasActiveSend() {
+    return this.activeSendCount > 0;
   }
-}
-async function handOff(file, filePath, keyring) {
-  let entries;
-  try {
-    entries = await file.readAll();
-  } catch (err) {
-    console.warn(
-      `
-[mcp-inspector] The OS keychain is available again, but the secrets file at ${filePath} could not be read, so its contents were left there: ${err instanceof Error ? err.message : String(err)}`
-    );
-    return false;
+  pushAuthChallenge(challenge) {
+    this.pushEvent({ type: "auth_challenge", data: challenge });
   }
-  if (!entries || Object.keys(entries).length === 0) return false;
-  let complete = true;
-  try {
-    for (const [account, value] of Object.entries(entries)) {
-      const parsed = parseAccount(account);
-      if (!parsed) {
-        complete = false;
-        continue;
-      }
-      const existing = await secretStoreGetStrict(
-        keyring,
-        parsed.serverId,
-        parsed.field
-      );
-      if (existing === null) {
-        await keyring.set(parsed.serverId, parsed.field, value);
-      }
-    }
-  } catch (err) {
-    console.warn(
-      `
-[mcp-inspector] Could not move the secrets file at ${filePath} into the OS keychain, so it has been left in place: ${err instanceof Error ? err.message : String(err)}`
-    );
-    return false;
+  /**
+   * Streamable HTTP `transport.send()` can return before the JSON-RPC response
+   * arrives. The remote send handler awaits this so `/api/mcp/send` returns
+   * `auth_challenge` or `ok: true` only after the MCP round-trip (or auth error).
+   */
+  waitForRequestResponse(requestId, timeoutMs = 6e4) {
+    return new Promise((resolve9, reject) => {
+      let timer;
+      const arm = () => {
+        if (timeoutMs <= 0) return;
+        timer = setTimeout(() => {
+          this.requestWaits.delete(requestId);
+          reject(
+            new Error(
+              `MCP request ${String(requestId)} timed out after ${timeoutMs}ms`
+            )
+          );
+        }, timeoutMs);
+      };
+      const clear = () => {
+        if (timer !== void 0) {
+          clearTimeout(timer);
+          timer = void 0;
+        }
+      };
+      arm();
+      this.requestWaits.set(requestId, {
+        resolve: () => {
+          clear();
+          resolve9();
+        },
+        reject: (error) => {
+          clear();
+          reject(error);
+        },
+        // A progress notification for this request re-arms the full window, so
+        // a tool that keeps reporting progress never trips the relay's own
+        // deadline — the same guarantee the SDK client's `resetTimeoutOnProgress`
+        // gives on a direct transport (#2028).
+        resetTimeout: () => {
+          if (timer === void 0) return;
+          clear();
+          arm();
+        }
+      });
+    });
   }
-  if (!complete) {
-    console.warn(
-      `
-[mcp-inspector] Secrets from ${filePath} have been copied into the OS keychain, but at least one entry could not be read (its key is not in \`serverId:field\` form). The file has been left in place so nothing is lost.`
-    );
-    return false;
+  /**
+   * Re-arm a pending request's wait timeout. Invoked from {@link onMessage} when
+   * a `notifications/progress` carrying this request's `progressToken` arrives.
+   * A no-op when no wait is pending for the id. A numeric string token (`"4"`)
+   * matches the numeric request id, as it does in the SDK (#2458).
+   */
+  noteRequestProgress(progressToken) {
+    waitForProgressToken(this.requestWaits, progressToken)?.resetTimeout();
   }
-  return true;
-}
-async function getSecretStorageInfo() {
-  const { store, info } = await resolveSecretStore();
-  if (info.kind !== "file" || !(store instanceof FileSecretStore)) return info;
-  return describeFileStore(
-    store,
-    store.filePath,
-    "file",
-    info.reason,
-    info.detail
-  );
-}
-var DeferredSecretStore = class {
-  async target() {
-    return (await resolveSecretStore()).store;
+  cancelRequestWait(requestId) {
+    const wait = this.requestWaits.get(requestId);
+    if (!wait) {
+      return;
+    }
+    this.requestWaits.delete(requestId);
+    wait.reject(new Error("MCP request wait cancelled"));
   }
-  async isDurable() {
-    return secretStoreIsDurable(await this.target());
+  rejectActiveRequestWaits(error) {
+    for (const wait of this.requestWaits.values()) {
+      wait.reject(error);
+    }
+    this.requestWaits.clear();
   }
   /**
-   * Forwarded, and its absence was a real defect rather than an omission:
-   * this is the store production actually uses, so a `secretStoreGetStrict`
-   * call against it fell through to the tolerant `get` and the strictness
-   * existed only in tests that injected a concrete store.
+   * Auth errors from the MCP transport.
+   * - During an active send: command path owns delivery (HTTP); never SSE.
+   * - After HTTP already returned auth_challenge: swallow async onerror echo.
+   * - Otherwise: ambient SSE (idle session).
    */
-  async getStrict(serverId, field) {
-    return secretStoreGetStrict(await this.target(), serverId, field);
+  handleTransportAuthError(error) {
+    if (!(error instanceof AuthChallengeError)) {
+      return false;
+    }
+    this.rejectActiveRequestWaits(error);
+    if (this.hasActiveSend()) {
+      this.extendAuthHttpEchoSuppression();
+      return true;
+    }
+    if (this.shouldSuppressAuthEcho()) {
+      return true;
+    }
+    this.pushAuthChallenge(error.authChallenge);
+    return true;
   }
-  async getMany(requests) {
-    return secretStoreGetMany(await this.target(), requests);
+  settleRequestWait(requestId) {
+    const wait = this.requestWaits.get(requestId);
+    if (!wait) {
+      return;
+    }
+    this.requestWaits.delete(requestId);
+    wait.resolve();
   }
-  async get(serverId, field) {
-    return (await this.target()).get(serverId, field);
+  pushEvent(event) {
+    if (this.eventConsumer) {
+      this.eventConsumer(event);
+    } else {
+      this.eventQueue.push(event);
+    }
   }
-  async set(serverId, field, value) {
-    await (await this.target()).set(serverId, field, value);
+  onMessage(message) {
+    if ("id" in message && message.id !== null && message.id !== void 0 && ("result" in message || "error" in message)) {
+      this.settleRequestWait(message.id);
+    }
+    const progressToken = progressTokenOf(message);
+    if (progressToken !== void 0) {
+      this.noteRequestProgress(progressToken);
+    }
+    this.pushEvent({ type: "message", data: message });
   }
-  async setMany(serverId, values) {
-    await secretStoreSetMany(await this.target(), serverId, values);
+  onFetchRequest(entry) {
+    this.pushEvent({
+      type: "fetch_request",
+      data: {
+        ...entry,
+        timestamp: entry.timestamp instanceof Date ? entry.timestamp.toISOString() : entry.timestamp
+      }
+    });
   }
-  async delete(serverId, field) {
-    await (await this.target()).delete(serverId, field);
+  onFetchResponseBody(id, responseBody) {
+    this.pushEvent({
+      type: "fetch_request_body_update",
+      data: { id, responseBody }
+    });
+  }
+  onFetchStreamUpdate(id, stream) {
+    this.pushEvent({
+      type: "fetch_stream_update",
+      data: {
+        id,
+        eventCount: stream.eventCount,
+        ...stream.closedAt && { closedAt: stream.closedAt.toISOString() }
+      }
+    });
   }
-  async deleteAllForServer(serverId) {
-    await (await this.target()).deleteAllForServer(serverId);
+  onStderr(entry) {
+    this.pushEvent({
+      type: "stdio_log",
+      data: {
+        timestamp: entry.timestamp.toISOString(),
+        message: entry.message
+      }
+    });
   }
 };
-function defaultSecretStore() {
-  return new DeferredSecretStore();
+
+// ../../core/mcp/remote/node/tokenAuthProvider.ts
+var REMOTE_OAUTH_STUB_METADATA = {
+  redirect_uris: [],
+  scope: ""
+};
+function cloneAuthState(state) {
+  return {
+    ...state.oauthTokens && {
+      oauthTokens: { ...state.oauthTokens }
+    },
+    ...state.oauthClient && {
+      oauthClient: { ...state.oauthClient }
+    }
+  };
+}
+function createRemoteAuthProvider(initialAuthState) {
+  if (!initialAuthState?.oauthTokens && !initialAuthState?.oauthClient) {
+    return void 0;
+  }
+  let authState = cloneAuthState(initialAuthState);
+  const provider = {
+    get clientMetadata() {
+      return REMOTE_OAUTH_STUB_METADATA;
+    },
+    get redirectUrl() {
+      return "";
+    },
+    async tokens() {
+      return authState.oauthTokens;
+    },
+    async clientInformation() {
+      if (!authState.oauthClient?.client_id) {
+        return void 0;
+      }
+      return {
+        client_id: authState.oauthClient.client_id,
+        ...authState.oauthClient.client_secret && {
+          client_secret: authState.oauthClient.client_secret
+        }
+      };
+    },
+    async saveTokens(tokens) {
+      authState = {
+        ...authState,
+        oauthTokens: {
+          access_token: tokens.access_token,
+          token_type: tokens.token_type,
+          expires_in: tokens.expires_in,
+          refresh_token: tokens.refresh_token,
+          scope: tokens.scope,
+          id_token: tokens.id_token
+        }
+      };
+    },
+    codeVerifier() {
+      return void 0;
+    },
+    async saveCodeVerifier() {
+    },
+    clear() {
+      authState = {};
+    },
+    async redirectToAuthorization() {
+      throw new Error(
+        "OAuth re-authorization must be performed in the Inspector web client (remote server cannot complete OAuth flows)"
+      );
+    },
+    state() {
+      return "";
+    }
+    // This provider implements only the members the remote backend transport
+    // exercises (token get/save, client info, non-interactive redirect); the
+    // interactive-only members the SDK never calls on the server side are stubbed
+    // with narrower shapes (e.g. `codeVerifier()` returns `undefined`, not the
+    // interface's `string | Promise<string>`), so it can't be assigned to the
+    // full `OAuthClientProvider` without the double cast.
+  };
+  return {
+    provider,
+    setAuthState(next) {
+      authState = cloneAuthState(next);
+    },
+    getAuthState() {
+      return cloneAuthState(authState);
+    }
+  };
 }
 
 // ../../core/client/config-parse.ts
@@ -4651,6 +5709,23 @@ function mergeSecretsIntoClientConfig(config, secrets) {
 }
 
 // ../../core/client/node-persistence.ts
+async function withClientConfigLock(filePath, action, body) {
+  let entered = false;
+  try {
+    return await withSecretFileLock(filePath, async () => {
+      entered = true;
+      return body();
+    });
+  } catch (error) {
+    if (!entered && error instanceof SecretFileLockHeldError) {
+      throw new SecretFileLockHeldError(
+        `Could not ${action} the client configuration: the file at ${filePath} is locked by another Inspector process and did not become available.`,
+        { cause: error }
+      );
+    }
+    throw error;
+  }
+}
 async function readIdpSecretFromKeychain(secretStore) {
   const secret = await secretStore.get(
     CLIENT_KEYCHAIN_ID,
@@ -4660,29 +5735,39 @@ async function readIdpSecretFromKeychain(secretStore) {
   return { [SECRET_FIELD_IDP_CLIENT_SECRET]: secret };
 }
 async function migrateClientPlaintextSecret(filePath, config, secretStore) {
-  const { stripped, secrets } = extractSecretsFromClientConfig(config);
-  const value = secrets[SECRET_FIELD_IDP_CLIENT_SECRET];
-  if (!value) return config;
   try {
-    const existing = await secretStoreGetStrict(
-      secretStore,
-      CLIENT_KEYCHAIN_ID,
-      SECRET_FIELD_IDP_CLIENT_SECRET
-    );
-    if (existing === null) {
-      await secretStore.set(
-        CLIENT_KEYCHAIN_ID,
-        SECRET_FIELD_IDP_CLIENT_SECRET,
-        value
-      );
-    }
-    if (!await secretStoreIsDurable(secretStore)) return config;
-    await writeStoreFile(filePath, serializeStore(stripped));
-    return stripped;
+    return await withClientConfigLock(filePath, "migrate", async () => {
+      const raw = await readStoreFile(filePath);
+      if (raw === null) return {};
+      const fresh = parseClientConfig(parseStore(raw));
+      const { stripped, secrets } = extractSecretsFromClientConfig(fresh);
+      const value = secrets[SECRET_FIELD_IDP_CLIENT_SECRET];
+      if (!value) return fresh;
+      try {
+        const existing = await secretStoreGetStrict(
+          secretStore,
+          CLIENT_KEYCHAIN_ID,
+          SECRET_FIELD_IDP_CLIENT_SECRET
+        );
+        if (existing === null) {
+          await secretStore.set(
+            CLIENT_KEYCHAIN_ID,
+            SECRET_FIELD_IDP_CLIENT_SECRET,
+            value
+          );
+        }
+        if (!await secretStoreIsDurable(secretStore)) return fresh;
+        await writeStoreFile(filePath, serializeStore(stripped));
+        return stripped;
+      } catch (err) {
+        if (err instanceof SecretStoreUnavailableError) {
+          return fresh;
+        }
+        throw err;
+      }
+    });
   } catch (err) {
-    if (err instanceof SecretStoreUnavailableError) {
-      return config;
-    }
+    if (err instanceof SecretFileLockHeldError) return config;
     throw err;
   }
 }
@@ -4702,30 +5787,44 @@ async function writeClientConfigStore(filePath, body, secretStore) {
   const validated = parseClientConfig(body);
   const { stripped, secrets } = extractSecretsFromClientConfig(validated);
   const idpSecret = secrets[SECRET_FIELD_IDP_CLIENT_SECRET];
-  if (idpSecret) {
-    await secretStore.set(
-      CLIENT_KEYCHAIN_ID,
-      SECRET_FIELD_IDP_CLIENT_SECRET,
-      idpSecret
-    );
-  } else {
-    await secretStore.delete(
-      CLIENT_KEYCHAIN_ID,
+  await withClientConfigLock(filePath, "save", async () => {
+    const prior = await snapshotSecretFields(secretStore, CLIENT_KEYCHAIN_ID, [
       SECRET_FIELD_IDP_CLIENT_SECRET
-    );
-  }
-  const durable = await secretStoreIsDurable(secretStore);
-  await writeStoreFile(
-    filePath,
-    serializeStore(
-      durable ? stripped : await preserveLegacyPlaintext(
+    ]);
+    try {
+      if (idpSecret) {
+        await secretStore.set(
+          CLIENT_KEYCHAIN_ID,
+          SECRET_FIELD_IDP_CLIENT_SECRET,
+          idpSecret
+        );
+      } else {
+        await secretStore.delete(
+          CLIENT_KEYCHAIN_ID,
+          SECRET_FIELD_IDP_CLIENT_SECRET
+        );
+      }
+      const durable = await secretStoreIsDurable(secretStore);
+      await writeStoreFile(
         filePath,
-        validated,
-        stripped,
-        idpSecret
-      )
-    )
-  );
+        serializeStore(
+          durable ? stripped : await preserveLegacyPlaintext(
+            filePath,
+            validated,
+            stripped,
+            idpSecret
+          )
+        )
+      );
+    } catch (error) {
+      await restoreSecretFields(secretStore, prior, (restoreError) => {
+        console.warn(
+          `[mcp-inspector] Could not restore the IdP client secret after a failed client.json write: ${restoreError instanceof Error ? restoreError.message : String(restoreError)}`
+        );
+      });
+      throw error;
+    }
+  });
 }
 async function preserveLegacyPlaintext(filePath, validated, stripped, idpSecret) {
   if (!idpSecret) return stripped;
@@ -4740,8 +5839,25 @@ async function preserveLegacyPlaintext(filePath, validated, stripped, idpSecret)
   }
 }
 async function deleteClientConfigStore(filePath, secretStore) {
-  await deleteStoreFile(filePath);
-  await secretStore.delete(CLIENT_KEYCHAIN_ID, SECRET_FIELD_IDP_CLIENT_SECRET);
+  await withClientConfigLock(filePath, "remove", async () => {
+    const prior = await snapshotSecretFields(secretStore, CLIENT_KEYCHAIN_ID, [
+      SECRET_FIELD_IDP_CLIENT_SECRET
+    ]);
+    try {
+      await secretStore.delete(
+        CLIENT_KEYCHAIN_ID,
+        SECRET_FIELD_IDP_CLIENT_SECRET
+      );
+      await deleteStoreFile(filePath);
+    } catch (error) {
+      await restoreSecretFields(secretStore, prior, (restoreError) => {
+        console.warn(
+          `[mcp-inspector] Could not restore the IdP client secret after a failed client.json delete: ${restoreError instanceof Error ? restoreError.message : String(restoreError)}`
+        );
+      });
+      throw error;
+    }
+  });
 }
 
 // ../../core/mcp/remote/node/server.ts
@@ -4768,6 +5884,7 @@ async function primeAndHoldSseStream(stream, cleanup) {
 var MAX_APP_DOCUMENT_CHARS = 8 * 1024 * 1024;
 var MAX_APP_DOCUMENT_BODY_BYTES = 24 * 1024 * 1024;
 var MAX_APP_CSP_CHARS = 8 * 1024;
+var MAX_STORAGE_BODY_BYTES = 4 * 1024 * 1024;
 function isHeaderSafeValue(value) {
   return !/[^\t\x20-\x7e]/.test(value);
 }
@@ -5400,6 +6517,10 @@ function createRemoteApp(options) {
         const config = await readClientConfigStore(filePath, secretStore);
         return c.json(config);
       }
+      if (storeId === OAUTH_PERSIST_STORE_ID) {
+        const snapshot = await readOAuthStore(filePath, secretStore);
+        return c.json(snapshot ?? {});
+      }
       const raw = await readStoreFile(filePath);
       if (raw === null) {
         return c.json({}, 200);
@@ -5407,40 +6528,74 @@ function createRemoteApp(options) {
       const store = parseStore(raw);
       return c.json(store);
     } catch (error) {
+      const keychainResp = keychainErrorResponse(c, error);
+      if (keychainResp) return keychainResp;
       const msg = error instanceof Error ? error.message : String(error);
       return c.json({ error: `Failed to read store: ${msg}` }, 500);
     }
   });
-  app.post("/api/storage/:storeId", async (c) => {
-    const storeId = c.req.param("storeId");
-    if (!storeId || !validateStoreId(storeId)) {
-      return c.json({ error: "Invalid storeId" }, 400);
-    }
-    let body;
-    try {
-      body = await c.req.json();
-    } catch {
-      return c.json({ error: "Invalid JSON body" }, 400);
-    }
-    const filePath = getStoreFilePath(storageDir, storeId);
-    try {
-      if (storeId === "client") {
-        await writeClientConfigStore(filePath, body, secretStore);
-        return c.json({ ok: true });
+  app.post(
+    "/api/storage/:storeId",
+    // Before the parse, not after: see MAX_STORAGE_BODY_BYTES.
+    bodyLimit({
+      maxSize: MAX_STORAGE_BODY_BYTES,
+      onError: (c) => c.json({ error: "Storage payload too large" }, 413)
+    }),
+    async (c) => {
+      const storeId = c.req.param("storeId");
+      if (!storeId || !validateStoreId(storeId)) {
+        return c.json({ error: "Invalid storeId" }, 400);
       }
-      const jsonData = serializeStore(body);
-      await writeStoreFile(filePath, jsonData);
-      return c.json({ ok: true });
-    } catch (error) {
-      if (error instanceof ZodError2) {
-        return c.json({ error: formatClientConfigLoadError(error) }, 400);
+      let body;
+      try {
+        body = await c.req.json();
+      } catch {
+        return c.json({ error: "Invalid JSON body" }, 400);
+      }
+      const filePath = getStoreFilePath(storageDir, storeId);
+      try {
+        if (storeId === "client") {
+          await writeClientConfigStore(filePath, body, secretStore);
+          return c.json({ ok: true });
+        }
+        if (c.req.query("sections") !== void 0) {
+          return c.json(
+            {
+              error: "The sections descriptor moved from the ?sections query parameter to the request body"
+            },
+            400
+          );
+        }
+        if (storeId === OAUTH_PERSIST_STORE_ID) {
+          const write = parseOAuthStoreWriteBody(body);
+          if (!write) {
+            return c.json(
+              { error: "OAuth store writes require an OAuth state body" },
+              400
+            );
+          }
+          await writeOAuthSections(
+            filePath,
+            write.snapshot,
+            write.sections,
+            secretStore
+          );
+          return c.json({ ok: true });
+        }
+        const jsonData = serializeStore(body);
+        await writeStoreFile(filePath, jsonData);
+        return c.json({ ok: true });
+      } catch (error) {
+        if (error instanceof ZodError2) {
+          return c.json({ error: formatClientConfigLoadError(error) }, 400);
+        }
+        const keychainResp = keychainErrorResponse(c, error);
+        if (keychainResp) return keychainResp;
+        const msg = error instanceof Error ? error.message : String(error);
+        return c.json({ error: `Failed to write store: ${msg}` }, 500);
       }
-      const keychainResp = storeId === "client" ? keychainErrorResponse(c, error) : void 0;
-      if (keychainResp) return keychainResp;
-      const msg = error instanceof Error ? error.message : String(error);
-      return c.json({ error: `Failed to write store: ${msg}` }, 500);
     }
-  });
+  );
   app.delete("/api/storage/:storeId", async (c) => {
     const storeId = c.req.param("storeId");
     if (!storeId || !validateStoreId(storeId)) {
@@ -5452,9 +6607,15 @@ function createRemoteApp(options) {
         await deleteClientConfigStore(filePath, secretStore);
         return c.json({ ok: true });
       }
+      if (storeId === OAUTH_PERSIST_STORE_ID) {
+        await removeOAuthStore(filePath, secretStore);
+        return c.json({ ok: true });
+      }
       await deleteStoreFile(filePath);
       return c.json({ ok: true });
     } catch (error) {
+      const keychainResp = keychainErrorResponse(c, error);
+      if (keychainResp) return keychainResp;
       const msg = error instanceof Error ? error.message : String(error);
       return c.json({ error: `Failed to delete store: ${msg}` }, 500);
     }
@@ -5525,6 +6686,13 @@ function createRemoteApp(options) {
     const out = {};
     for (const [id, val] of Object.entries(raw)) {
       if (!val || typeof val !== "object") continue;
+      if (id === "__proto__") {
+        logWarn(
+          { route: "/api/servers", id },
+          "Dropping mcp.json entry with reserved id `__proto__` \u2014 rename the server to use it."
+        );
+        continue;
+      }
       const valObj = val;
       if ("settings" in valObj) {
         logWarn(
@@ -5952,7 +7120,7 @@ function createRemoteApp(options) {
     return false;
   };
   let warnedSessionPreserved = false;
-  const migratePlaintextSecrets = async (config) => {
+  const migratePlaintextSecrets2 = async (config) => {
     let changed = false;
     const next = { mcpServers: {} };
     const durable = await secretStoreIsDurable(secretStore);
@@ -6023,7 +7191,22 @@ function createRemoteApp(options) {
     return out;
   };
   const deleteKeychainFields = async (id, fields) => {
-    await Promise.all(fields.map((field) => secretStore.delete(id, field)));
+    await settleStoreMutations(
+      fields.map((field) => secretStore.delete(id, field))
+    );
+  };
+  const warnSecretRestoreFailure = (error) => {
+    const msg = error instanceof Error ? error.message : String(error);
+    if (fileLogger) {
+      fileLogger.warn(
+        { err: msg },
+        "Could not restore keychain entries after a failed catalog mutation; keychain and mcp.json may disagree until the next successful save."
+      );
+    } else {
+      console.warn(
+        `[mcp-inspector] Could not restore keychain entries after a failed catalog mutation: ${msg}`
+      );
+    }
   };
   const entryForDisk = async (built, stripped, previous) => {
     if (await secretStoreIsDurable(secretStore)) return stripped;
@@ -6079,7 +7262,7 @@ function createRemoteApp(options) {
           mcpServers: normalizeMcpServers(parsedInside?.mcpServers)
         };
         if (!hasPlaintextSecrets(inside)) return inside;
-        const { migrated, changed } = await migratePlaintextSecrets(inside);
+        const { migrated, changed } = await migratePlaintextSecrets2(inside);
         if (changed) {
           await writeMcpAndTrackMtime(serializeStore(migrated));
         }
@@ -6121,7 +7304,7 @@ function createRemoteApp(options) {
     if (typeof body.id !== "string" || !validateStoreId(body.id)) {
       return c.json(
         {
-          error: "Invalid id: must be non-empty and contain only alphanumeric, hyphen, or underscore"
+          error: "Invalid id: must be non-empty, contain only alphanumeric, hyphen, or underscore, and not be `__proto__`"
         },
         400
       );
@@ -6139,15 +7322,29 @@ function createRemoteApp(options) {
     try {
       return await withWriteLock(async () => {
         const current = await readMcpConfig();
-        if (id in current.mcpServers) {
+        if (Object.hasOwn(current.mcpServers, id)) {
           return c.json({ error: `Server '${id}' already exists` }, 409);
         }
         const built = buildStoredEntry(id, body.config, postSettings);
         const { stripped, secrets } = extractSecretsFromStored(built);
         await secretStore.deleteAllForServer(id);
-        await writeKeychainEntriesFor(id, secrets);
-        current.mcpServers[id] = await entryForDisk(built, stripped);
-        await writeMcpAndTrackMtime(serializeStore(current));
+        const prior = await snapshotSecretFields(
+          secretStore,
+          id,
+          Object.keys(secrets)
+        );
+        try {
+          await writeKeychainEntriesFor(id, secrets);
+          current.mcpServers[id] = await entryForDisk(built, stripped);
+          await writeMcpAndTrackMtime(serializeStore(current));
+        } catch (error) {
+          await restoreSecretFields(
+            secretStore,
+            prior,
+            warnSecretRestoreFailure
+          );
+          throw error;
+        }
         return c.json({ ok: true });
       });
     } catch (error) {
@@ -6237,10 +7434,10 @@ function createRemoteApp(options) {
     try {
       return await withWriteLock(async () => {
         const current = await readMcpConfig();
-        if (!(originalId in current.mcpServers)) {
+        if (!Object.hasOwn(current.mcpServers, originalId)) {
           return c.json({ error: `Server '${originalId}' not found` }, 404);
         }
-        if (newId !== originalId && newId in current.mcpServers) {
+        if (newId !== originalId && Object.hasOwn(current.mcpServers, newId)) {
           return c.json({ error: `Server '${newId}' already exists` }, 409);
         }
         const existing = current.mcpServers[originalId];
@@ -6297,27 +7494,80 @@ function createRemoteApp(options) {
         }
         if (newId !== originalId) {
           const previousFields = expectedSecretFields(existing);
-          const keychainSecrets = await readKeychainEntriesFor(
+          const originalPrior = await snapshotSecretFields(
+            secretStore,
             originalId,
             previousFields
           );
+          const keychainSecrets = {};
+          for (const { field, value } of originalPrior) {
+            if (value !== null) setOwnEntry(keychainSecrets, field, value);
+          }
           const secretsToWrite = mergeRenameKeychainSecrets(
             stripped,
             keychainSecrets,
             secrets
           );
-          await writeKeychainEntriesFor(newId, secretsToWrite);
-          await writeMcpAndTrackMtime(serializeStore(next));
-          await secretStore.deleteAllForServer(originalId);
+          await secretStore.deleteAllForServer(newId);
+          const prior = [
+            ...await snapshotSecretFields(
+              secretStore,
+              newId,
+              Object.keys(secretsToWrite)
+            ),
+            ...originalPrior
+          ];
+          let diskCommitted = false;
+          try {
+            await writeKeychainEntriesFor(newId, secretsToWrite);
+            await writeMcpAndTrackMtime(serializeStore(next));
+            diskCommitted = true;
+            await secretStore.deleteAllForServer(originalId);
+          } catch (error) {
+            if (diskCommitted) {
+              try {
+                await writeMcpAndTrackMtime(serializeStore(current));
+              } catch (diskError) {
+                warnSecretRestoreFailure(diskError);
+              }
+            }
+            await restoreSecretFields(
+              secretStore,
+              prior,
+              warnSecretRestoreFailure
+            );
+            throw error;
+          }
         } else {
           const previousFields = new Set(expectedSecretFields(existing));
           const stillExpected = new Set(expectedSecretFields(built));
           const obsolete = [...previousFields].filter(
             (field) => field === SECRET_FIELD_OAUTH_CLIENT_SECRET ? settingsIntent.kind !== "preserve" && !(field in secrets) : !stillExpected.has(field)
           );
-          await writeKeychainEntriesFor(newId, secrets);
-          await writeMcpAndTrackMtime(serializeStore(next));
-          await deleteKeychainFields(newId, obsolete);
+          const prior = await snapshotSecretFields(secretStore, newId, [
+            .../* @__PURE__ */ new Set([...Object.keys(secrets), ...obsolete])
+          ]);
+          let diskCommitted = false;
+          try {
+            await writeKeychainEntriesFor(newId, secrets);
+            await writeMcpAndTrackMtime(serializeStore(next));
+            diskCommitted = true;
+            await deleteKeychainFields(newId, obsolete);
+          } catch (error) {
+            if (diskCommitted) {
+              try {
+                await writeMcpAndTrackMtime(serializeStore(current));
+              } catch (diskError) {
+                warnSecretRestoreFailure(diskError);
+              }
+            }
+            await restoreSecretFields(
+              secretStore,
+              prior,
+              warnSecretRestoreFailure
+            );
+            throw error;
+          }
         }
         return c.json({ ok: true });
       });
@@ -6338,13 +7588,28 @@ function createRemoteApp(options) {
     try {
       return await withWriteLock(async () => {
         const current = await readMcpConfig();
-        if (!(id in current.mcpServers)) {
+        if (!Object.hasOwn(current.mcpServers, id)) {
           await secretStore.deleteAllForServer(id);
           return c.json({ ok: true });
         }
+        const stored = current.mcpServers[id];
         delete current.mcpServers[id];
-        await writeMcpAndTrackMtime(serializeStore(current));
-        await secretStore.deleteAllForServer(id);
+        const prior = await snapshotSecretFields(
+          secretStore,
+          id,
+          expectedSecretFields(stored)
+        );
+        try {
+          await secretStore.deleteAllForServer(id);
+          await writeMcpAndTrackMtime(serializeStore(current));
+        } catch (error) {
+          await restoreSecretFields(
+            secretStore,
+            prior,
+            warnSecretRestoreFailure
+          );
+          throw error;
+        }
         return c.json({ ok: true });
       });
     } catch (error) {