@modelcontextprotocol/inspector 2.9.0 → 2.10.1

package/clients/web/build/index.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { resolve as resolve8 } from "path";
+import { resolve as resolve9 } from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 
 // server/run-web.ts
-import { resolve as resolve7, join as join10, dirname as dirname9 } from "path";
+import { resolve as resolve8, join as join10, dirname as dirname9 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 import { Command } from "commander";
 
@@ -94,6 +94,7 @@ var DEFAULT_TASK_TTL_MS = 6e4;
 var DEFAULT_CONNECTION_TIMEOUT_MS = 3e4;
 var DEFAULT_MAX_FETCH_REQUESTS = 1e3;
 var DEFAULT_PROTOCOL_ERA = "legacy";
+var DEFAULT_ELICIT_CAPABILITY = "both";
 var DEFAULT_MODERN_LOG_LEVEL = "debug";
 var MODERN_LOG_LEVELS = [
   "off",
@@ -285,6 +286,15 @@ var VALID_PROTOCOL_ERAS = /* @__PURE__ */ new Set([
   "auto",
   "modern"
 ]);
+var VALID_ELICIT_CAPABILITIES = /* @__PURE__ */ new Set([
+  "off",
+  "url",
+  "form",
+  "both"
+]);
+function isElicitCapability(value) {
+  return typeof value === "string" && VALID_ELICIT_CAPABILITIES.has(value);
+}
 function isProtocolEra(value) {
   return typeof value === "string" && VALID_PROTOCOL_ERAS.has(value);
 }
@@ -429,7 +439,7 @@ function cleanEndpointOverride(value, field) {
   return value.trim() || void 0;
 }
 function storedFieldsToInspectorSettings(stored) {
-  const hasAny = stored.headers !== void 0 || stored.metadata !== void 0 || stored.connectionTimeout !== void 0 || stored.requestTimeout !== void 0 || stored.taskTtl !== void 0 || stored.autoRefreshOnListChanged !== void 0 || stored.paginatedLists !== void 0 || stored.suppressNotificationStream !== void 0 || stored.advertisedExtensions !== void 0 || stored.maxFetchRequests !== void 0 || stored.skillCatalogMaxSkills !== void 0 || stored.skillCatalogMaxBytes !== void 0 || stored.oauth !== void 0 || stored.roots !== void 0 || stored.protocolEra !== void 0 || stored.modernLogLevel !== void 0 || stored.env !== void 0 || stored.cwd !== void 0;
+  const hasAny = stored.headers !== void 0 || stored.metadata !== void 0 || stored.connectionTimeout !== void 0 || stored.requestTimeout !== void 0 || stored.taskTtl !== void 0 || stored.autoRefreshOnListChanged !== void 0 || stored.paginatedLists !== void 0 || stored.suppressNotificationStream !== void 0 || stored.advertisedExtensions !== void 0 || stored.maxFetchRequests !== void 0 || stored.skillCatalogMaxSkills !== void 0 || stored.skillCatalogMaxBytes !== void 0 || stored.oauth !== void 0 || stored.roots !== void 0 || stored.protocolEra !== void 0 || stored.elicitCapability !== void 0 || stored.modernLogLevel !== void 0 || stored.env !== void 0 || stored.cwd !== void 0;
   if (!hasAny) return void 0;
   const headersPairs = stored.headers ? Object.entries(stored.headers).map(([key, value]) => ({ key, value })) : [];
   const settings = {
@@ -467,6 +477,9 @@ function storedFieldsToInspectorSettings(stored) {
   if (isProtocolEra(stored.protocolEra)) {
     settings.protocolEra = stored.protocolEra;
   }
+  if (isElicitCapability(stored.elicitCapability)) {
+    settings.elicitCapability = stored.elicitCapability;
+  }
   if (isModernLogLevel(stored.modernLogLevel)) {
     settings.modernLogLevel = stored.modernLogLevel;
   }
@@ -542,6 +555,9 @@ function inspectorSettingsToStoredFields(settings) {
   if (settings.protocolEra !== void 0 && settings.protocolEra !== DEFAULT_PROTOCOL_ERA) {
     out.protocolEra = settings.protocolEra;
   }
+  if (settings.elicitCapability !== void 0 && settings.elicitCapability !== DEFAULT_ELICIT_CAPABILITY) {
+    out.elicitCapability = settings.elicitCapability;
+  }
   if (settings.modernLogLevel !== void 0 && settings.modernLogLevel !== DEFAULT_MODERN_LOG_LEVEL) {
     out.modernLogLevel = settings.modernLogLevel;
   }
@@ -596,6 +612,7 @@ var INSPECTOR_FIELD_KEY_MAP = {
   headers: true,
   metadata: true,
   protocolEra: true,
+  elicitCapability: true,
   modernLogLevel: true,
   connectionTimeout: true,
   requestTimeout: true,
@@ -700,6 +717,19 @@ var DEFAULT_SEED_CONFIG = {
   }
 };
 
+// ../../core/storage/own-entry.ts
+function setOwnEntry(map, key, value) {
+  Object.defineProperty(map, key, {
+    value,
+    enumerable: true,
+    writable: true,
+    configurable: true
+  });
+}
+function getOwnEntry(map, key) {
+  return map !== void 0 && Object.hasOwn(map, key) ? map[key] : void 0;
+}
+
 // ../../core/mcp/node/config.ts
 function parseKeyValuePair(value, previous = {}) {
   const parts = value.split("=");
@@ -778,13 +808,14 @@ function loadMcpServersConfig(configPath, writable) {
 }
 function loadServerFromConfig(configPath, serverName, writable) {
   const config = loadMcpServersConfig(configPath, writable);
-  if (!config.mcpServers[serverName]) {
+  const server = getOwnEntry(config.mcpServers, serverName);
+  if (!server) {
     const available = Object.keys(config.mcpServers).join(", ");
     throw new Error(
       `Server '${serverName}' not found in config file. Available servers: ${available}`
     );
   }
-  return config.mcpServers[serverName];
+  return server;
 }
 function buildConfigFromOptions(options) {
   const target = options.target ?? [];
@@ -922,7 +953,6 @@ function resolveServerConfigs(options, mode) {
 }
 
 // server/web-server-config.ts
-import open from "open";
 import pino from "pino";
 
 // ../../core/mcp/remote/constants.ts
@@ -1014,6 +1044,32 @@ function readInspectorVersionSafe(callerUrl) {
   }
 }
 
+// ../../core/node/openUrl.ts
+import open from "open";
+var OPEN_URL_TIMEOUT_MS = 5e3;
+function launched(child) {
+  return new Promise((resolve10, reject) => {
+    child.on("error", reject);
+    child.once("spawn", () => resolve10());
+  });
+}
+async function openUrl(url, timeoutMs = OPEN_URL_TIMEOUT_MS) {
+  const href = typeof url === "string" ? url : url.href;
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(
+      () => reject(new Error(`browser did not open within ${timeoutMs / 1e3}s`)),
+      timeoutMs
+    );
+  });
+  try {
+    const opened = Promise.resolve().then(() => open(href)).then(launched);
+    await Promise.race([opened, timeout]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 // server/sandbox-controller.ts
 import { createServer } from "http";
 import { readFileSync as readFileSync3 } from "fs";
@@ -1151,12 +1207,12 @@ function createSandboxController(options) {
       if (server && sandboxUrl) {
         return { port: boundPort, url: sandboxUrl };
       }
-      return new Promise((resolve9) => {
+      return new Promise((resolve10) => {
         let settled = false;
         const settle = (value) => {
           if (settled) return;
           settled = true;
-          resolve9(value);
+          resolve10(value);
         };
         server = createServer((req, res) => {
           if (req.method !== "GET" || req.url !== "/sandbox" && req.url !== "/sandbox/") {
@@ -1218,11 +1274,11 @@ function createSandboxController(options) {
     },
     async close() {
       if (!server) return;
-      return new Promise((resolve9) => {
+      return new Promise((resolve10) => {
         server.close(() => {
           server = null;
           sandboxUrl = null;
-          resolve9();
+          resolve10();
         });
       });
     },
@@ -1300,12 +1356,12 @@ function createAppOriginController(options) {
       if (server && origin) {
         return { port: boundPort, url: origin };
       }
-      return new Promise((resolve9) => {
+      return new Promise((resolve10) => {
         let settled = false;
         const settle = (value) => {
           if (settled) return;
           settled = true;
-          resolve9(value);
+          resolve10(value);
         };
         server = createServer2((req, res) => {
           const id = req.method === "GET" ? parseDocumentId(req.url) : null;
@@ -1389,11 +1445,11 @@ function createAppOriginController(options) {
       documents.clear();
       retainedChars = 0;
       if (!server) return;
-      return new Promise((resolve9) => {
+      return new Promise((resolve10) => {
         server.close(() => {
           server = null;
           origin = null;
-          resolve9();
+          resolve10();
         });
       });
     },
@@ -1626,7 +1682,7 @@ MCP Inspector Web is up and running at:
   return url;
 }
 function openBrowser(url) {
-  open(url).catch((err) => {
+  openUrl(url).catch((err) => {
     console.warn("Could not open a browser automatically:", err);
   });
 }
@@ -1743,7 +1799,7 @@ function resolveAutoOpen() {
 }
 
 // server/start-vite-dev-server.ts
-import { join as join7, dirname as dirname7, resolve as resolve6 } from "path";
+import { join as join7, dirname as dirname7, resolve as resolve7 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { createServer as createServer3 } from "vite";
 import react from "@vitejs/plugin-react";
@@ -1937,8 +1993,8 @@ async function readChallengeBody(response) {
   let text = "";
   let bytes = 0;
   let timer;
-  const deadline = new Promise((resolve9) => {
-    timer = setTimeout(() => resolve9("timeout"), CHALLENGE_BODY_READ_MS);
+  const deadline = new Promise((resolve10) => {
+    timer = setTimeout(() => resolve10("timeout"), CHALLENGE_BODY_READ_MS);
   });
   try {
     while (bytes < CHALLENGE_BODY_MAX_BYTES) {
@@ -2567,19 +2623,6 @@ function createTransportNode(config, options = {}) {
 // ../../core/auth/requestTimeout.ts
 var OAUTH_TIMEOUT_WIRE_CODE = "oauth_request_timeout";
 
-// ../../core/storage/own-entry.ts
-function setOwnEntry(map, key, value) {
-  Object.defineProperty(map, key, {
-    value,
-    enumerable: true,
-    writable: true,
-    configurable: true
-  });
-}
-function getOwnEntry(map, key) {
-  return map !== void 0 && Object.hasOwn(map, key) ? map[key] : void 0;
-}
-
 // ../../core/auth/oauth-persist.ts
 import { OAuthTokensSchema } from "@modelcontextprotocol/core";
 var OAUTH_PERSIST_STORE_ID = "oauth";
@@ -3191,9 +3234,9 @@ async function openSecretFileLock(filePath) {
 }
 async function withSecretFileLock(filePath, fn) {
   const release = await openSecretFileLock(filePath);
-  if (release === null) return fn();
+  if (release === null) return fn(false);
   try {
-    return await fn();
+    return await fn(true);
   } finally {
     await release();
   }
@@ -3210,10 +3253,10 @@ import * as crypto2 from "crypto";
 import { readFileSync as readFileSync4, statSync as statSync2 } from "fs";
 import * as fs3 from "fs/promises";
 import * as path3 from "path";
-var scrypt2 = (passphrase, salt, keylen, options) => new Promise((resolve9, reject) => {
+var scrypt2 = (passphrase, salt, keylen, options) => new Promise((resolve10, reject) => {
   crypto2.scrypt(passphrase, salt, keylen, options, (err, key) => {
     if (err) reject(err);
-    else resolve9(key);
+    else resolve10(key);
   });
 });
 var FORMAT_VERSION = 1;
@@ -4031,9 +4074,13 @@ async function describeFileStore(store, filePath, kind, reason, detail) {
   };
 }
 function chooseFallbackKind(opts) {
+  if (opts.allowMemory === false) return "file";
   return opts.container && !opts.mounted ? "memory" : "file";
 }
-function warnAboutSecretStorage(info) {
+var memoryFallbackAllowed = true;
+var secretStorageWarningsQuiet = false;
+function warnAboutSecretStorage(info, opts) {
+  if (secretStorageWarningsQuiet && opts?.force !== true) return;
   if (info.reason === "fallback") {
     console.warn(
       `
@@ -4070,7 +4117,8 @@ function resolveSecretStore() {
     }
     const kind = chooseFallbackKind({
       container: isContainer(),
-      mounted: isOnMountPoint(path4.dirname(defaultSecretFilePath()))
+      mounted: isOnMountPoint(path4.dirname(defaultSecretFilePath())),
+      allowMemory: memoryFallbackAllowed
     });
     const result = await buildStore(kind, "fallback", probe.detail);
     warnAboutSecretStorage(result.info);
@@ -4277,8 +4325,15 @@ var DeferredSecretStore = class {
 function defaultSecretStore() {
   return new DeferredSecretStore();
 }
+async function resolveConcreteSecretStore(store) {
+  return store instanceof DeferredSecretStore ? (await resolveSecretStore()).store : store;
+}
+
+// ../../core/auth/node/oauth-namespace-ledger.ts
+import { resolve as resolve6 } from "path";
 
 // ../../core/auth/node/oauth-secrets.ts
+import { randomUUID as randomUUID2 } from "crypto";
 import { OAuthTokensSchema as OAuthTokensSchema2 } from "@modelcontextprotocol/core";
 var PERSIST_TOKENS_ENV = "MCP_INSPECTOR_PERSIST_TOKENS";
 var warnedPolicyValues = /* @__PURE__ */ new Set();
@@ -4294,8 +4349,14 @@ function getPersistTokensPolicy(env = process.env) {
   }
   return "all";
 }
-var oauthSecretServerId = (serverUrl) => `oauth+${encodeURIComponent(serverUrl)}`;
-var oauthIdpSecretServerId = (issuer) => `oauth-idp+${encodeURIComponent(issuer)}`;
+var oauthSecretServerId = (serverUrl, namespace) => namespace === void 0 ? `oauth+${encodeURIComponent(serverUrl)}` : `oauth+${namespace}+${encodeURIComponent(serverUrl)}`;
+var oauthIdpSecretServerId = (issuer, namespace) => namespace === void 0 ? `oauth-idp+${encodeURIComponent(issuer)}` : `oauth-idp+${namespace}+${encodeURIComponent(issuer)}`;
+function isValidSecretsNamespace(value) {
+  return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(value);
+}
+function newSecretsNamespace() {
+  return randomUUID2();
+}
 var issuerTokensField = (issuer) => `tokens:${issuer}`;
 var issuerClientSecretField = (issuer) => `client-secret:${issuer}`;
 var issuerRegistrationTokenField = (issuer) => `registration-token:${issuer}`;
@@ -4552,6 +4613,175 @@ function snapshotHasPlaintextSecrets(snapshot) {
   return false;
 }
 
+// ../../core/auth/node/oauth-namespace-ledger.ts
+var namespaceLedgerPath = (stateFilePath) => `${stateFilePath}.namespaces.json`;
+var KEYRING_LOCATION = "keyring";
+var FILE_LOCATION_PREFIX = "file:";
+async function secretStoreLocation(store) {
+  const concrete = await resolveConcreteSecretStore(store);
+  if (concrete instanceof KeyringSecretStore) return KEYRING_LOCATION;
+  if (concrete instanceof FileSecretStore) {
+    return `${FILE_LOCATION_PREFIX}${resolve6(concrete.filePath)}`;
+  }
+  return "memory";
+}
+function coveredLocations(location, byLocation) {
+  return [...byLocation].filter(
+    ([recorded]) => recorded === location || location === KEYRING_LOCATION && recorded.startsWith(FILE_LOCATION_PREFIX)
+  ).map(([recorded, keys]) => ({ location: recorded, keys }));
+}
+var warnedLedgerFailures = /* @__PURE__ */ new Set();
+function warnLedgerFailure(what, error) {
+  const reason = error instanceof Error ? error.message : String(error);
+  const key = `${what}:${reason}`;
+  if (warnedLedgerFailures.has(key)) return;
+  warnedLedgerFailures.add(key);
+  console.warn(
+    `[mcp-inspector] Could not ${what} the OAuth secrets-namespace ledger (${reason}). OAuth state is unaffected, but secret-store entries left behind if this state file's namespace is ever lost (for example, after a save by an older Inspector) may not be cleaned up automatically.`
+  );
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringsOf(value) {
+  return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+function parseLedger(raw) {
+  const ledger = /* @__PURE__ */ new Map();
+  if (raw === null) return ledger;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return ledger;
+  }
+  const namespaces = isRecord3(parsed) ? parsed.namespaces : void 0;
+  if (!isRecord3(namespaces)) return ledger;
+  for (const [namespace, locations] of Object.entries(namespaces)) {
+    if (!isValidSecretsNamespace(namespace) || !isRecord3(locations)) continue;
+    const byLocation = /* @__PURE__ */ new Map();
+    for (const [location, keys] of Object.entries(locations)) {
+      if (!isRecord3(keys)) continue;
+      byLocation.set(location, {
+        servers: new Set(stringsOf(keys.servers)),
+        idpSessions: new Set(stringsOf(keys.idpSessions))
+      });
+    }
+    if (byLocation.size > 0) ledger.set(namespace, byLocation);
+  }
+  return ledger;
+}
+function serializeLedger(ledger) {
+  const namespaces = Object.fromEntries(
+    [...ledger].map(([namespace, byLocation]) => [
+      namespace,
+      Object.fromEntries(
+        [...byLocation].map(([location, keys]) => [
+          location,
+          { servers: [...keys.servers], idpSessions: [...keys.idpSessions] }
+        ])
+      )
+    ])
+  );
+  return serializeStore({ namespaces });
+}
+async function writeLedger(stateFilePath, ledger) {
+  const path6 = namespaceLedgerPath(stateFilePath);
+  if (ledger.size === 0) await deleteStoreFile(path6);
+  else await writeStoreFile(path6, serializeLedger(ledger));
+}
+async function recordNamespaceKeys(stateFilePath, secretStore, namespace, servers, idpSessions) {
+  try {
+    const ledger = parseLedger(
+      await readStoreFile(namespaceLedgerPath(stateFilePath))
+    );
+    const location = await secretStoreLocation(secretStore);
+    let byLocation = ledger.get(namespace);
+    if (!byLocation) {
+      byLocation = /* @__PURE__ */ new Map();
+      ledger.set(namespace, byLocation);
+    }
+    let keys = byLocation.get(location);
+    let changed = false;
+    if (!keys) {
+      keys = { servers: /* @__PURE__ */ new Set(), idpSessions: /* @__PURE__ */ new Set() };
+      byLocation.set(location, keys);
+      changed = true;
+    }
+    for (const url of servers) {
+      if (keys.servers.has(url)) continue;
+      keys.servers.add(url);
+      changed = true;
+    }
+    for (const issuer of idpSessions) {
+      if (keys.idpSessions.has(issuer)) continue;
+      keys.idpSessions.add(issuer);
+      changed = true;
+    }
+    if (changed) await writeLedger(stateFilePath, ledger);
+  } catch (error) {
+    warnLedgerFailure("update", error);
+  }
+}
+async function purgeSupersededNamespaces(stateFilePath, secretStore, current) {
+  let ledger;
+  let location;
+  try {
+    ledger = parseLedger(
+      await readStoreFile(namespaceLedgerPath(stateFilePath))
+    );
+    location = await secretStoreLocation(secretStore);
+  } catch (error) {
+    warnLedgerFailure("read", error);
+    return;
+  }
+  let changed = false;
+  for (const [namespace, byLocation] of ledger) {
+    if (namespace === current) continue;
+    for (const { location: recorded, keys } of coveredLocations(
+      location,
+      byLocation
+    )) {
+      const purges = [
+        ...[...keys.servers].map(
+          (url) => () => oauthSecretServerId(url, namespace)
+        ),
+        ...[...keys.idpSessions].map(
+          (issuer) => () => oauthIdpSecretServerId(issuer, namespace)
+        )
+      ];
+      let purged = true;
+      for (const idOf of purges) {
+        try {
+          await secretStore.deleteAllForServer(idOf());
+        } catch (error) {
+          purged = false;
+          warnLedgerFailure("purge an orphaned namespace recorded in", error);
+        }
+      }
+      if (!purged || recorded !== location) continue;
+      byLocation.delete(recorded);
+      if (recorded.startsWith(FILE_LOCATION_PREFIX)) {
+        const keyring = byLocation.get(KEYRING_LOCATION) ?? {
+          servers: /* @__PURE__ */ new Set(),
+          idpSessions: /* @__PURE__ */ new Set()
+        };
+        for (const url of keys.servers) keyring.servers.add(url);
+        for (const issuer of keys.idpSessions) keyring.idpSessions.add(issuer);
+        byLocation.set(KEYRING_LOCATION, keyring);
+      }
+      changed = true;
+    }
+    if (byLocation.size === 0) ledger.delete(namespace);
+  }
+  if (!changed) return;
+  try {
+    await writeLedger(stateFilePath, ledger);
+  } catch (error) {
+    warnLedgerFailure("update", error);
+  }
+}
+
 // ../../core/auth/node/oauth-persist-file.ts
 var warnedStoreFailures = /* @__PURE__ */ new Set();
 function warnStoreWriteFailure(error) {
@@ -4601,9 +4831,9 @@ function rethrowLockError(filePath, error, action = "save") {
 async function withOAuthStateLock(filePath, action, body) {
   let entered = false;
   try {
-    return await withSecretFileLock(filePath, async () => {
+    return await withSecretFileLock(filePath, async (locked) => {
       entered = true;
-      return body();
+      return body(locked);
     });
   } catch (error) {
     if (!entered) rethrowLockError(filePath, error, action);
@@ -4618,13 +4848,97 @@ var OAuthStateFileUnrecognizedError = class extends Error {
     this.name = "OAuthStateFileUnrecognizedError";
   }
 };
-async function readDiskForMutation(filePath, action) {
+var SECRETS_NAMESPACE_KEY = "secretsNamespace";
+function parseSecretsNamespace(raw) {
+  if (raw === null) return void 0;
+  try {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null) return void 0;
+    const value = parsed[SECRETS_NAMESPACE_KEY];
+    return isValidSecretsNamespace(value) ? value : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function serializeOAuthFileBlob(snapshot, namespace) {
+  if (namespace === void 0) return serializeOAuthPersistBlob(snapshot);
+  return serializeStore({ [SECRETS_NAMESPACE_KEY]: namespace, ...snapshot });
+}
+function warnNamespaceCleanupFailure(error) {
+  const reason = error instanceof Error ? error.message : String(error);
+  const key = `namespace-cleanup:${reason}`;
+  if (warnedStoreFailures.has(key)) return;
+  warnedStoreFailures.add(key);
+  console.warn(
+    `[mcp-inspector] Could not remove legacy un-namespaced secret-store entries after scoping them to this state file (${reason}). This file uses the scoped copies, but another pre-namespace state file could still read the stale leftovers until it adopts or re-authorizes \u2014 and they will not be cleaned up automatically.`
+  );
+}
+async function adoptSecretsNamespace(filePath, secretStore, locked) {
   const raw = await readStoreFile(filePath);
-  const parsed = parseOAuthPersistBlob(raw);
-  if (raw !== null && parsed === null) {
-    throw new OAuthStateFileUnrecognizedError(filePath, action);
+  const existing = parseSecretsNamespace(raw);
+  if (existing !== void 0) {
+    if (locked) {
+      await purgeSupersededNamespaces(filePath, secretStore, existing);
+    }
+    return existing;
+  }
+  const snapshot = parseOAuthPersistBlob(raw);
+  if (raw !== null && snapshot === null) {
+    throw new OAuthStateFileUnrecognizedError(filePath, "save");
+  }
+  if (locked) {
+    await purgeSupersededNamespaces(filePath, secretStore, void 0);
+  }
+  const namespace = newSecretsNamespace();
+  if (snapshot === null) return namespace;
+  const moves = [
+    ...Object.entries(snapshot.servers).map(([url, state]) => ({
+      legacyId: oauthSecretServerId(url),
+      scopedId: oauthSecretServerId(url, namespace),
+      fields: serverSecretFields(state)
+    })),
+    ...Object.keys(snapshot.idpSessions).map((issuer) => ({
+      legacyId: oauthIdpSecretServerId(issuer),
+      scopedId: oauthIdpSecretServerId(issuer, namespace),
+      fields: [IDP_SESSION_FIELD]
+    }))
+  ];
+  if (moves.length === 0) return namespace;
+  if (!locked) {
+    throw new SecretStoreUnavailableError(
+      `Could not save OAuth state: ${filePath} predates per-state-file secret namespaces, and migrating its secret-store entries needs the file lock, which is unavailable here (see the lock warning above). Migrating without it could lose credentials if two processes migrate at once. Nothing was changed; make the lock directory writable and retry \u2014 or, if you cannot, clear this file's stored OAuth state and re-authorize (clearing does not migrate, and the fresh state file mints its namespace without the lock).`
+    );
   }
-  return parsed;
+  await recordNamespaceKeys(
+    filePath,
+    secretStore,
+    namespace,
+    Object.keys(snapshot.servers),
+    Object.keys(snapshot.idpSessions)
+  );
+  const touched = [];
+  try {
+    for (const { legacyId, scopedId, fields } of moves) {
+      for (const field of fields) {
+        const value = await secretStoreGetStrict(secretStore, legacyId, field);
+        if (value === null) continue;
+        touched.push({ serverId: scopedId, field, value: null });
+        await secretStore.set(scopedId, field, value);
+      }
+    }
+    await writeStoreFile(filePath, serializeOAuthFileBlob(snapshot, namespace));
+  } catch (error) {
+    await restoreSecretFields(secretStore, touched, warnRestoreFailure);
+    throw error;
+  }
+  for (const { legacyId } of moves) {
+    try {
+      await secretStore.deleteAllForServer(legacyId);
+    } catch (error) {
+      warnNamespaceCleanupFailure(error);
+    }
+  }
+  return namespace;
 }
 async function persistEntrySecrets(store, serverId, candidates, secrets, prior, allowDegrade) {
   const priorValue = new Map(prior.map(({ field, value }) => [field, value]));
@@ -4672,7 +4986,8 @@ function preserveNonDurableSecrets(diskSecrets, secrets) {
 async function writeOAuthSections(filePath, snapshot, sections, secretStore = defaultSecretStore()) {
   const policy = getPersistTokensPolicy();
   const durable = await secretStoreIsDurable(secretStore);
-  await withOAuthStateLock(filePath, "save", async () => {
+  await withOAuthStateLock(filePath, "save", async (locked) => {
+    let namespace = await adoptSecretsNamespace(filePath, secretStore, locked);
     const restoreBaseline = /* @__PURE__ */ new Map();
     const ourWrites = /* @__PURE__ */ new Map();
     const priorKey = (p) => `${p.serverId}\0${p.field}`;
@@ -4731,7 +5046,27 @@ async function writeOAuthSections(filePath, snapshot, sections, secretStore = de
       const attemptWrites = /* @__PURE__ */ new Map();
       let written;
       try {
-        const disk = await readDiskForMutation(filePath, "save");
+        const rawDisk = await readStoreFile(filePath);
+        const disk = parseOAuthPersistBlob(rawDisk);
+        if (rawDisk !== null && disk === null) {
+          throw new OAuthStateFileUnrecognizedError(filePath, "save");
+        }
+        const diskNamespace = parseSecretsNamespace(rawDisk);
+        if (diskNamespace !== void 0 && diskNamespace !== namespace) {
+          let restoreFailure;
+          await restoreSecretFields(
+            secretStore,
+            [...restoreBaseline.values()],
+            (error) => {
+              restoreFailure ??= error;
+            }
+          );
+          if (restoreFailure !== void 0) throw restoreFailure;
+          restoreBaseline.clear();
+          ourWrites.clear();
+          unconfirmed = null;
+          namespace = diskNamespace;
+        }
         const effective = sections ? {
           servers: sections.servers && [...new Set(sections.servers)],
           idpSessions: sections.idpSessions && [
@@ -4752,8 +5087,15 @@ async function writeOAuthSections(filePath, snapshot, sections, secretStore = de
           ]
         };
         const merged = mergeOAuthSections(disk, snapshot, effective);
+        await recordNamespaceKeys(
+          filePath,
+          secretStore,
+          namespace,
+          Object.keys(merged.servers),
+          Object.keys(merged.idpSessions)
+        );
         for (const url of effective.servers ?? []) {
-          const serverId = oauthSecretServerId(url);
+          const serverId = oauthSecretServerId(url, namespace);
           const next = getOwnEntry(snapshot.servers, url);
           const candidates = [
             .../* @__PURE__ */ new Set([
@@ -4828,7 +5170,7 @@ async function writeOAuthSections(filePath, snapshot, sections, secretStore = de
           }
         }
         for (const issuer of effective.idpSessions ?? []) {
-          const serverId = oauthIdpSecretServerId(issuer);
+          const serverId = oauthIdpSecretServerId(issuer, namespace);
           const next = getOwnEntry(snapshot.idpSessions, issuer);
           const entryPrior = await snapshotSecretFields(secretStore, serverId, [
             IDP_SESSION_FIELD
@@ -4889,7 +5231,7 @@ async function writeOAuthSections(filePath, snapshot, sections, secretStore = de
             value: secrets[IDP_SESSION_FIELD] ?? null
           });
         }
-        written = serializeOAuthPersistBlob(merged);
+        written = serializeOAuthFileBlob(merged, namespace);
         await writeStoreFile(filePath, written);
         unconfirmed = { written, writes: attemptWrites };
       } catch (error) {
@@ -4913,36 +5255,42 @@ async function writeOAuthSections(filePath, snapshot, sections, secretStore = de
     );
   });
 }
-function secretRequestsFor(snapshot) {
+function secretRequestsFor(snapshot, namespace) {
   const requests = [];
   for (const [url, state] of Object.entries(snapshot.servers)) {
     requests.push({
-      serverId: oauthSecretServerId(url),
+      serverId: oauthSecretServerId(url, namespace),
       fields: serverSecretFields(state)
     });
   }
   for (const issuer of Object.keys(snapshot.idpSessions)) {
     requests.push({
-      serverId: oauthIdpSecretServerId(issuer),
+      serverId: oauthIdpSecretServerId(issuer, namespace),
       fields: [IDP_SESSION_FIELD]
     });
   }
   return requests;
 }
-async function joinSnapshot(snapshot, secretStore) {
-  const requests = secretRequestsFor(snapshot);
+async function joinSnapshot(snapshot, secretStore, namespace) {
+  const requests = secretRequestsFor(snapshot, namespace);
   const values = requests.length > 0 ? await secretStoreGetManyStrict(secretStore, requests) : {};
   return {
     servers: Object.fromEntries(
       Object.entries(snapshot.servers).map(([url, state]) => [
         url,
-        joinServerOAuthState(state, values[oauthSecretServerId(url)] ?? {})
+        joinServerOAuthState(
+          state,
+          values[oauthSecretServerId(url, namespace)] ?? {}
+        )
       ])
     ),
     idpSessions: Object.fromEntries(
       Object.entries(snapshot.idpSessions).map(([issuer, session]) => [
         issuer,
-        joinIdpSession(session, values[oauthIdpSecretServerId(issuer)] ?? {})
+        joinIdpSession(
+          session,
+          values[oauthIdpSecretServerId(issuer, namespace)] ?? {}
+        )
       ])
     )
   };
@@ -4951,6 +5299,16 @@ async function migratePlaintextSecrets(filePath, secretStore) {
   const raw = await readStoreFile(filePath);
   const fresh = parseOAuthPersistBlob(raw);
   if (!fresh || !snapshotHasPlaintextSecrets(fresh)) return;
+  const namespace = parseSecretsNamespace(raw);
+  if (namespace !== void 0) {
+    await recordNamespaceKeys(
+      filePath,
+      secretStore,
+      namespace,
+      Object.keys(fresh.servers),
+      Object.keys(fresh.idpSessions)
+    );
+  }
   const migrateEntrySecrets = async (serverId, secrets) => {
     const absent = {};
     for (const [field, value] of Object.entries(secrets)) {
@@ -4967,44 +5325,57 @@ async function migratePlaintextSecrets(filePath, secretStore) {
   for (const [url, state] of Object.entries(fresh.servers)) {
     const split = splitServerOAuthState(state, "all");
     setOwnEntry(residue.servers, url, split.residue);
-    await migrateEntrySecrets(oauthSecretServerId(url), split.secrets);
+    await migrateEntrySecrets(
+      oauthSecretServerId(url, namespace),
+      split.secrets
+    );
   }
   for (const [issuer, session] of Object.entries(fresh.idpSessions)) {
     const split = splitIdpSession(session, "all");
     setOwnEntry(residue.idpSessions, issuer, split.residue);
-    await migrateEntrySecrets(oauthIdpSecretServerId(issuer), split.secrets);
+    await migrateEntrySecrets(
+      oauthIdpSecretServerId(issuer, namespace),
+      split.secrets
+    );
   }
-  const stripped = serializeOAuthPersistBlob(residue);
+  const stripped = serializeOAuthFileBlob(residue, namespace);
   if (stripped !== raw) {
     await writeStoreFile(filePath, stripped);
   }
 }
 async function readOAuthStore(filePath, secretStore = defaultSecretStore()) {
   return withOAuthStateLock(filePath, "read", async () => {
-    let snapshot = parseOAuthPersistBlob(await readStoreFile(filePath));
+    let raw = await readStoreFile(filePath);
+    let snapshot = parseOAuthPersistBlob(raw);
     if (snapshot === null) return null;
     if (snapshotHasPlaintextSecrets(snapshot) && await secretStoreIsDurable(secretStore)) {
       try {
         await migratePlaintextSecrets(filePath, secretStore);
-        snapshot = parseOAuthPersistBlob(await readStoreFile(filePath)) ?? snapshot;
+        raw = await readStoreFile(filePath);
+        snapshot = parseOAuthPersistBlob(raw) ?? snapshot;
       } catch (error) {
         warnMigrationFailure(error);
       }
     }
-    return joinSnapshot(snapshot, secretStore);
+    return joinSnapshot(snapshot, secretStore, parseSecretsNamespace(raw));
   });
 }
 async function removeOAuthStore(filePath, secretStore = defaultSecretStore()) {
-  await withOAuthStateLock(filePath, "remove", async () => {
-    const snapshot = await readDiskForMutation(filePath, "remove");
+  await withOAuthStateLock(filePath, "remove", async (locked) => {
+    const rawBlob = await readStoreFile(filePath);
+    const snapshot = parseOAuthPersistBlob(rawBlob);
+    if (rawBlob !== null && snapshot === null) {
+      throw new OAuthStateFileUnrecognizedError(filePath, "remove");
+    }
     if (snapshot) {
+      const namespace = parseSecretsNamespace(rawBlob);
       const targets = [
         ...Object.entries(snapshot.servers).map(([url, state]) => ({
-          id: oauthSecretServerId(url),
+          id: oauthSecretServerId(url, namespace),
           fields: serverSecretFields(state)
         })),
         ...Object.keys(snapshot.idpSessions).map((issuer) => ({
-          id: oauthIdpSecretServerId(issuer),
+          id: oauthIdpSecretServerId(issuer, namespace),
           fields: [IDP_SESSION_FIELD]
         }))
       ];
@@ -5028,6 +5399,9 @@ async function removeOAuthStore(filePath, secretStore = defaultSecretStore()) {
     } else {
       await deleteStoreFile(filePath);
     }
+    if (locked) {
+      await purgeSupersededNamespaces(filePath, secretStore, void 0);
+    }
   });
 }
 
@@ -5323,7 +5697,7 @@ var RemoteSession = class _RemoteSession {
    * `auth_challenge` or `ok: true` only after the MCP round-trip (or auth error).
    */
   waitForRequestResponse(requestId, timeoutMs = 6e4) {
-    return new Promise((resolve9, reject) => {
+    return new Promise((resolve10, reject) => {
       let timer;
       const arm = () => {
         if (timeoutMs <= 0) return;
@@ -5346,7 +5720,7 @@ var RemoteSession = class _RemoteSession {
       this.requestWaits.set(requestId, {
         resolve: () => {
           clear();
-          resolve9();
+          resolve10();
         },
         reject: (error) => {
           clear();
@@ -5869,13 +6243,13 @@ function closeAbortedStream(stream) {
 }
 async function primeAndHoldSseStream(stream, cleanup) {
   let done = false;
-  const aborted = new Promise((resolve9) => {
+  const aborted = new Promise((resolve10) => {
     stream.onAbort(() => {
       if (done) return;
       done = true;
       cleanup();
       closeAbortedStream(stream);
-      resolve9();
+      resolve10();
     });
   });
   await stream.write(SSE_PRIMING_COMMENT);
@@ -6364,7 +6738,7 @@ function createRemoteApp(options) {
         });
       });
       if (session.isTransportDead()) {
-        await new Promise((resolve9) => setTimeout(resolve9, 0));
+        await new Promise((resolve10) => setTimeout(resolve10, 0));
         session.clearEventConsumer();
         sessions.delete(sessionId);
         return;
@@ -7664,6 +8038,40 @@ function injectAuthToken(html, token) {
   return script + html;
 }
 
+// server/health.ts
+var HEALTH_PATH = "/healthz";
+var HEALTH_BODY = Object.freeze({
+  status: "ok"
+});
+var HEALTH_HEADERS = Object.freeze({
+  "Content-Type": "application/json; charset=utf-8",
+  "Cache-Control": "no-store"
+});
+var HEALTH_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
+function isHealthRequest(method, url) {
+  if (!method || !HEALTH_METHODS.has(method.toUpperCase())) return false;
+  const path6 = (url ?? "").split(/[?#]/, 1)[0];
+  return path6 === HEALTH_PATH;
+}
+function healthBodyFor(method) {
+  return method.toUpperCase() === "HEAD" ? null : JSON.stringify(HEALTH_BODY);
+}
+function healthResponse(method = "GET") {
+  return new Response(healthBodyFor(method), {
+    status: 200,
+    headers: { ...HEALTH_HEADERS }
+  });
+}
+function handleNodeHealthRequest(req, res) {
+  const { method } = req;
+  if (method === void 0 || !isHealthRequest(method, req.url)) return false;
+  res.writeHead(200, { ...HEALTH_HEADERS });
+  const body = healthBodyFor(method);
+  if (body === null) res.end();
+  else res.end(body);
+  return true;
+}
+
 // server/vite-hono-plugin.ts
 function honoMiddlewarePlugin(config) {
   let resolvedAuthToken = "";
@@ -7765,6 +8173,9 @@ function honoMiddlewarePlugin(config) {
       const honoMiddleware = async (req, res, next) => {
         try {
           const pathname = req.url || "";
+          if (handleNodeHealthRequest(req, res)) {
+            return;
+          }
           if (!pathname.startsWith("/api")) {
             return next();
           }
@@ -7784,10 +8195,10 @@ function honoMiddlewarePlugin(config) {
           if (req.method !== "GET" && req.method !== "HEAD") {
             const chunks = [];
             req.on("data", (chunk) => chunks.push(chunk));
-            await new Promise((resolve9) => {
-              req.once("end", () => resolve9());
-              req.once("error", () => resolve9());
-              req.once("close", () => resolve9());
+            await new Promise((resolve10) => {
+              req.once("end", () => resolve10());
+              req.once("error", () => resolve10());
+              req.once("close", () => resolve10());
             });
             if (chunks.length > 0) {
               init.body = Buffer.concat(chunks);
@@ -7829,10 +8240,10 @@ function honoMiddlewarePlugin(config) {
                 while (true) {
                   const { done, value } = await reader.read();
                   if (done || clientGone || res.destroyed) break;
-                  await new Promise((resolve9, reject) => {
+                  await new Promise((resolve10, reject) => {
                     res.write(
                       Buffer.from(value),
-                      (err) => err ? reject(err) : resolve9()
+                      (err) => err ? reject(err) : resolve10()
                     );
                   });
                 }
@@ -8129,7 +8540,7 @@ function vitestSharedPaths(clientDir) {
 // server/start-vite-dev-server.ts
 var __dirname2 = dirname7(fileURLToPath4(import.meta.url));
 async function startViteDevServer(config) {
-  const root = resolve6(join7(__dirname2, ".."));
+  const root = resolve7(join7(__dirname2, ".."));
   clearViteDepsCache(root);
   const { repoRoot, sharedAliases, sharedDedupe, nodeModulesAliases } = vitestSharedPaths(root);
   const inlineConfig = {
@@ -8222,6 +8633,7 @@ async function startHonoServer(config) {
     secretStorageResolver: getSecretStorageInfo
   });
   const app = new Hono2();
+  app.get(HEALTH_PATH, (c) => healthResponse(c.req.method));
   app.use("/api/*", async (c) => {
     return apiApp.fetch(c.req.raw);
   });
@@ -8289,8 +8701,8 @@ async function startHonoServer(config) {
       if ("closeAllConnections" in httpServer) {
         httpServer.closeAllConnections();
       }
-      await new Promise((resolve9, reject) => {
-        httpServer.close((err) => err ? reject(err) : resolve9());
+      await new Promise((resolve10, reject) => {
+        httpServer.close((err) => err ? reject(err) : resolve10());
       });
     }
   };
@@ -8333,7 +8745,7 @@ function ensureWebBuild(webRoot, distRoot, deps = {}) {
 var __dirname4 = dirname9(fileURLToPath6(import.meta.url));
 function ensureStdioCwd(config) {
   if ((config.type === "stdio" || config.type === void 0) && config.command && !config.cwd) {
-    return { ...config, cwd: resolve7(process.cwd()) };
+    return { ...config, cwd: resolve8(process.cwd()) };
   }
   return config;
 }
@@ -8396,7 +8808,7 @@ async function runWeb(argv) {
         "Note: --server has no effect on the web UI yet; it lists every server in the catalog."
       );
     }
-    mcpConfigPath = resolve7(process.cwd(), catalogPath);
+    mcpConfigPath = resolve8(process.cwd(), catalogPath);
     writable = true;
   } else if (hasConfig) {
     if (opts.server) {
@@ -8404,7 +8816,7 @@ async function runWeb(argv) {
         "Note: --server has no effect on the web UI yet; it lists every server in the file."
       );
     }
-    const resolvedConfigPath = resolve7(process.cwd(), opts.config);
+    const resolvedConfigPath = resolve8(process.cwd(), opts.config);
     try {
       resolveServerConfigs({ configPath: resolvedConfigPath }, "multi");
     } catch (err) {
@@ -8512,7 +8924,7 @@ async function runWeb(argv) {
 
 // src/index.ts
 var __filename2 = fileURLToPath7(import.meta.url);
-var isMain = process.argv[1] !== void 0 && resolve8(process.argv[1]) === resolve8(__filename2);
+var isMain = process.argv[1] !== void 0 && resolve9(process.argv[1]) === resolve9(__filename2);
 if (isMain) {
   runWeb(process.argv).then((code) => process.exit(code ?? 0)).catch((e) => {
     console.error(e);