@mrrlin-dev/mcp 0.4.101 → 0.4.106

package/dist/bin.cjs

@@ -37428,6 +37428,14 @@ var openApiOperationIds = {
   resolveArtifactKindRoute: "resolveArtifactKindRoute",
   resolveDeliveryForArtifactKind: "resolveDeliveryForArtifactKind",
   recordCapabilityUse: "recordCapabilityUse",
+  appendOperatorTranscriptMessage: "appendOperatorTranscriptMessage",
+  listOperatorTranscriptMessages: "listOperatorTranscriptMessages",
+  createIntentProposal: "createIntentProposal",
+  getIntentProposal: "getIntentProposal",
+  recordIntentClarification: "recordIntentClarification",
+  answerIntentClarification: "answerIntentClarification",
+  confirmIntentProposal: "confirmIntentProposal",
+  getIntentConfirmation: "getIntentConfirmation",
   resolveAccount: "resolveAccount",
   linkAccountIdentity: "linkAccountIdentity",
   getMyAccount: "getMyAccount",
@@ -38109,6 +38117,152 @@ var TASK_NOTES_JOURNAL_SECTIONS = [
 ];
 var JOURNAL_HEADING_RE = new RegExp(`^##[ \\t]+(${TASK_NOTES_JOURNAL_SECTIONS.map((s) => s.heading).join("|")})\\b[ \\t]*(?:[\u2014\u2013-][ \\t]*(\\S.*?))?[ \\t]*$`);
 
+// ../../packages/schemas/dist/intent.js
+var taskImpactSchema = external_exports.enum(["low", "medium", "high"]);
+var autonomyLevelSchema = external_exports.enum(["auto", "human_review"]);
+var autoDeploySchema = external_exports.enum(["off", "dev", "prod"]);
+var mrrlinOperatorTranscriptMessageSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  projectSlug: external_exports.string().min(1),
+  content: external_exports.string().min(1),
+  revision: external_exports.number().int().nonnegative().optional(),
+  createdAt: external_exports.string()
+});
+var mrrlinOperatorTranscriptAppendSchema = external_exports.object({
+  content: external_exports.string().min(1)
+});
+var mrrlinOperatorTranscriptListSchema = external_exports.array(mrrlinOperatorTranscriptMessageSchema);
+var operatorTranscriptMessageResponseSchema = external_exports.object({
+  data: mrrlinOperatorTranscriptMessageSchema
+});
+var operatorTranscriptListResponseSchema = external_exports.object({
+  data: mrrlinOperatorTranscriptListSchema
+});
+var mrrlinIntentProposalStateSchema = external_exports.enum([
+  "pending",
+  "confirmed",
+  "rejected",
+  "blocked",
+  "superseded"
+]);
+var mrrlinIntentProposalSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  projectSlug: external_exports.string().min(1),
+  proposalId: external_exports.string().uuid(),
+  version: external_exports.number().int().min(1),
+  state: mrrlinIntentProposalStateSchema,
+  resolvedIntent: external_exports.record(external_exports.string(), external_exports.unknown()),
+  digest: external_exports.string().min(1),
+  messageIds: external_exports.array(external_exports.string().uuid()).default([]),
+  transcriptRevision: external_exports.string(),
+  transcriptRevisionNumber: external_exports.number().int().nonnegative().optional(),
+  createdAt: external_exports.string(),
+  updatedAt: external_exports.string()
+});
+var mrrlinIntentProposalCreateSchema = external_exports.object({
+  proposalId: external_exports.string().uuid(),
+  version: external_exports.number().int().min(1),
+  resolvedIntent: external_exports.record(external_exports.string(), external_exports.unknown()),
+  digest: external_exports.string().min(1),
+  transcriptRevision: external_exports.string().optional(),
+  expectedTranscriptRevisionNumber: external_exports.number().int().nonnegative(),
+  messageIds: external_exports.array(external_exports.string().uuid())
+}).strict();
+var intentProposalResponseSchema = external_exports.object({
+  data: mrrlinIntentProposalSchema
+});
+var intentProposalMaybeResponseSchema = external_exports.object({
+  data: mrrlinIntentProposalSchema.nullable()
+});
+var mrrlinIntentClarificationStateSchema = external_exports.enum(["open", "answered", "rejected"]);
+var mrrlinIntentClarificationSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  projectSlug: external_exports.string().min(1),
+  proposalId: external_exports.string().uuid(),
+  proposalVersion: external_exports.number().int().min(1),
+  round: external_exports.number().int().min(1).max(3),
+  ordinal: external_exports.number().int().min(1).max(3),
+  question: external_exports.string().min(1),
+  state: mrrlinIntentClarificationStateSchema,
+  answer: external_exports.string().nullable().optional(),
+  actor: external_exports.string().nullable().optional(),
+  answeredAt: external_exports.string().nullable().optional(),
+  createdAt: external_exports.string()
+});
+var mrrlinIntentClarificationRecordSchema = external_exports.object({
+  proposalId: external_exports.string().uuid(),
+  proposalVersion: external_exports.number().int().min(1),
+  round: external_exports.number().int().min(1).max(3),
+  ordinal: external_exports.number().int().min(1).max(3),
+  question: external_exports.string().min(1)
+}).strict();
+var mrrlinIntentClarificationAnswerSchema = external_exports.object({
+  answer: external_exports.string().min(1),
+  actor: external_exports.string().min(1).optional()
+}).strict();
+var intentClarificationResponseSchema = external_exports.object({
+  data: mrrlinIntentClarificationSchema
+});
+var mrrlinIntentConfirmRequestSchema = external_exports.object({
+  proposalId: external_exports.string().uuid(),
+  expectedVersion: external_exports.number().int().min(1),
+  expectedDigest: external_exports.string().min(1),
+  actor: external_exports.string().min(1).optional(),
+  materializeParams: external_exports.object({
+    task: external_exports.object({
+      id: external_exports.string().min(1),
+      title: external_exports.string().min(1).optional(),
+      category: external_exports.string().optional(),
+      subcategory: external_exports.string().optional(),
+      impact: taskImpactSchema.optional(),
+      autonomyLevel: autonomyLevelSchema.optional(),
+      autonomyReason: external_exports.string().optional(),
+      autoDeploy: autoDeploySchema.optional(),
+      domains: external_exports.array(external_exports.string()).optional(),
+      tags: external_exports.array(external_exports.string()).optional(),
+      planId: external_exports.string().optional(),
+      specWikiPageId: external_exports.string().optional(),
+      assignee: external_exports.string().optional(),
+      notes: external_exports.string().optional()
+    }).strict().optional(),
+    plan: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+  }).strict().optional()
+}).strict();
+var mrrlinIntentConfirmResponseSchema = external_exports.discriminatedUnion("ok", [
+  external_exports.object({
+    ok: external_exports.literal(true),
+    confirmation_id: external_exports.string().uuid(),
+    proposal_id: external_exports.string().uuid(),
+    proposal_version: external_exports.number().int(),
+    digest: external_exports.string(),
+    task_id: external_exports.string().nullable().optional()
+  }),
+  external_exports.object({
+    ok: external_exports.literal(false),
+    code: external_exports.string(),
+    message: external_exports.string(),
+    expected_version: external_exports.number().optional(),
+    current_state: external_exports.string().optional()
+  })
+]);
+var intentConfirmResultResponseSchema = external_exports.object({
+  data: mrrlinIntentConfirmResponseSchema
+});
+var mrrlinIntentConfirmationSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  projectSlug: external_exports.string().min(1),
+  proposalId: external_exports.string().uuid(),
+  proposalVersion: external_exports.number().int().min(1),
+  confirmedBy: external_exports.string().min(1),
+  digest: external_exports.string().min(1),
+  transcriptRevision: external_exports.string(),
+  transcriptRevisionNumber: external_exports.number().int().nonnegative().optional(),
+  createdAt: external_exports.string()
+});
+var intentConfirmationMaybeResponseSchema = external_exports.object({
+  data: mrrlinIntentConfirmationSchema.nullable()
+});
+
 // ../../packages/schemas/dist/appsumo.js
 var APPSUMO_CODE_ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
 var APPSUMO_ALPHABET_SET = new Set(APPSUMO_CODE_ALPHABET);
@@ -41299,6 +41453,84 @@ function createMrrlinClient(config2) {
         method: "DELETE"
       });
     },
+    // ── Server-Authoritative Intent Methods ─────────────────────────────────
+    async appendOperatorTranscriptMessage(projectSlug, content) {
+      const body = await request(`${projectPath(projectSlug)}/intent/transcript`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ content })
+      });
+      return operatorTranscriptMessageResponseSchema.parse(body).data;
+    },
+    async listOperatorTranscriptMessages(projectSlug) {
+      const body = await request(`${projectPath(projectSlug)}/intent/transcript`);
+      return operatorTranscriptListResponseSchema.parse(body).data;
+    },
+    async createIntentProposal(projectSlug, input) {
+      const body = await request(`${projectPath(projectSlug)}/intent/proposals`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(input)
+      });
+      return intentProposalResponseSchema.parse(body).data;
+    },
+    async getIntentProposal(projectSlug, proposalId, version2) {
+      try {
+        const body = await request(`${projectPath(projectSlug)}/intent/proposals/${encodeURIComponent(proposalId)}/${encodeURIComponent(String(version2))}`);
+        return intentProposalMaybeResponseSchema.parse(body).data;
+      } catch (error51) {
+        if (error51 instanceof MrrlinApiError && error51.status === 404)
+          return null;
+        throw error51;
+      }
+    },
+    async recordIntentClarification(projectSlug, input) {
+      const body = await request(`${projectPath(projectSlug)}/intent/clarifications`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(input)
+      });
+      return intentClarificationResponseSchema.parse(body).data;
+    },
+    async answerIntentClarification(projectSlug, id, input) {
+      const body = await request(`${projectPath(projectSlug)}/intent/clarifications/${encodeURIComponent(id)}/answer`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(input)
+      });
+      return intentClarificationResponseSchema.parse(body).data;
+    },
+    async confirmIntentProposal(projectSlug, proposalId, input) {
+      try {
+        const body = await request(`${projectPath(projectSlug)}/intent/proposals/${encodeURIComponent(proposalId)}/confirm`, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify(input)
+        });
+        return intentConfirmResultResponseSchema.parse(body).data;
+      } catch (error51) {
+        if (error51 instanceof MrrlinApiError && (error51.status === 409 || error51.status === 422)) {
+          try {
+            const parsed = JSON.parse(error51.responseBody);
+            const maybeResult = mrrlinIntentConfirmResponseSchema.safeParse(parsed);
+            if (maybeResult.success)
+              return maybeResult.data;
+          } catch {
+          }
+        }
+        throw error51;
+      }
+    },
+    async getIntentConfirmation(projectSlug, proposalId, version2) {
+      try {
+        const body = await request(`${projectPath(projectSlug)}/intent/confirmations/${encodeURIComponent(proposalId)}/${encodeURIComponent(String(version2))}`);
+        return intentConfirmationMaybeResponseSchema.parse(body).data;
+      } catch (error51) {
+        if (error51 instanceof MrrlinApiError && error51.status === 404)
+          return null;
+        throw error51;
+      }
+    },
     async resolveAccount() {
       const body = await request("/auth/account/resolve", {
         method: "POST"
@@ -41404,7 +41636,13 @@ async function resolveIndexPath(input) {
     return import_node_path5.default.resolve(process.env.MRRLIN_WIKI_INDEX_PATH);
   }
   const workspaceRoot = await findWorkspaceRoot();
-  return import_node_path5.default.join(workspaceRoot, "apps", "web", "public", "wiki-index.json");
+  const packageIndexPath = import_node_path5.default.join(workspaceRoot, "packages", "wiki", "wiki-index.json");
+  try {
+    await import_promises3.default.access(packageIndexPath);
+    return packageIndexPath;
+  } catch {
+    return import_node_path5.default.join(workspaceRoot, "apps", "web", "public", "wiki-index.json");
+  }
 }
 async function walkMarkdownFiles(root, dir = root) {
   const entries = await import_promises3.default.readdir(dir, { withFileTypes: true });
@@ -42045,7 +42283,8 @@ function normalizeDomains(value) {
   return normalized.length > 0 ? normalized.sort() : [DEFAULT_DOMAIN];
 }
 function normalizeDomain(value) {
-  return normalizeDomains(value)[0];
+  const domains = normalizeDomains(value);
+  return domains[0] ?? DEFAULT_DOMAIN;
 }
 function normalizeImpact(value) {
   if (typeof value !== "string") return null;
@@ -42075,8 +42314,9 @@ var PERSONAS_BY_DOMAIN = {
 function resolveProducerPersona(domain2) {
   const domains = normalizeDomains(domain2);
   for (const d of domains) {
-    if (d !== "code" && PERSONAS_BY_DOMAIN[d]) {
-      return PERSONAS_BY_DOMAIN[d];
+    const persona = PERSONAS_BY_DOMAIN[d];
+    if (d !== "code" && persona) {
+      return persona;
     }
   }
   return null;
@@ -44107,6 +44347,11 @@ var import_promises4 = require("node:timers/promises");
 var MODEL_ID_REGEX = /^[a-zA-Z0-9][a-zA-Z0-9._-]{1,63}$/;
 var CONVERSATION_ID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 var activeProcesses = /* @__PURE__ */ new Set();
+function signalStartedChild(child, signal) {
+  if (child.pid === void 0 || child.pid <= 0)
+    return;
+  child.kill(signal);
+}
 var globalCleanupInstalled = false;
 function installGlobalCleanupOnce() {
   if (globalCleanupInstalled)
@@ -44115,7 +44360,7 @@ function installGlobalCleanupOnce() {
   process.once("exit", () => {
     for (const child of activeProcesses) {
       try {
-        child.kill("SIGKILL");
+        signalStartedChild(child, "SIGKILL");
       } catch {
       }
     }
@@ -44123,14 +44368,14 @@ function installGlobalCleanupOnce() {
   const sigHandler = async () => {
     for (const child of activeProcesses) {
       try {
-        child.kill("SIGTERM");
+        signalStartedChild(child, "SIGTERM");
       } catch {
       }
     }
     await (0, import_promises4.setTimeout)(1e3);
     for (const child of activeProcesses) {
       try {
-        child.kill("SIGKILL");
+        signalStartedChild(child, "SIGKILL");
       } catch {
       }
     }
@@ -44261,11 +44506,11 @@ var AgyProcess = class _AgyProcess {
     return () => this.exitHandlers.delete(handler);
   }
   async dispose() {
-    if (this.exited || this.child.killed) {
+    if (this.exited || this.child.killed || this.child.pid === void 0 || this.child.pid <= 0) {
       activeProcesses.delete(this.child);
       return;
     }
-    this.child.kill("SIGTERM");
+    signalStartedChild(this.child, "SIGTERM");
     try {
       await Promise.race([
         (0, import_node_events2.once)(this.child, "exit"),
@@ -44275,7 +44520,7 @@ var AgyProcess = class _AgyProcess {
     }
     if (!this.exited) {
       try {
-        this.child.kill("SIGKILL");
+        signalStartedChild(this.child, "SIGKILL");
       } catch {
       }
     }
@@ -45057,7 +45302,7 @@ function extractOneShotResult2(stdout) {
   } catch {
     return { ok: false, error: "agy exec produced no parseable JSON output" };
   }
-  if (parsed.status !== "SUCCESS" || typeof parsed.response !== "string") {
+  if (!parsed || parsed.status !== "SUCCESS" || typeof parsed.response !== "string") {
     return { ok: false, error: `agy exec failed or returned invalid response format: ${JSON.stringify(parsed)}` };
   }
   return {
@@ -45248,19 +45493,22 @@ async function resolveSpecDomains(client, projectSlug, page) {
     const taskId = await resolveGatedTaskId(client, projectSlug, page);
     if (taskId !== null) {
       const task = await client.getTask(projectSlug, taskId);
-      return normalizeDomainArray(task?.domains ?? task?.domain);
+      const taskRecord = task;
+      return normalizeDomainArray(taskRecord?.domains ?? taskRecord?.domain);
     }
     const plans = await client.listPlans(projectSlug);
     const plan = plans.find((p) => p.specWikiPageId === page.id);
     if (plan) {
-      const rawPlanDomains = plan?.domains ?? plan?.domain;
+      const planRecord = plan;
+      const rawPlanDomains = planRecord?.domains ?? planRecord?.domain;
       const substantivePlanDomains = (Array.isArray(rawPlanDomains) ? rawPlanDomains : rawPlanDomains != null ? [rawPlanDomains] : []).map(String).map((d) => d.trim().toLowerCase()).filter(Boolean);
       if (substantivePlanDomains.length > 0) {
         return normalizeDomainArray(substantivePlanDomains);
       }
     }
     const project = await client.getProject(projectSlug);
-    return normalizeDomainArray(project?.defaultDomains ?? project?.defaultDomain);
+    const projectRecord = project;
+    return normalizeDomainArray(projectRecord?.defaultDomains ?? projectRecord?.defaultDomain);
   } catch {
     return ["code"];
   }
@@ -45676,14 +45924,16 @@ function buildSpecGateDeps(args) {
           const plan = plans.find((p) => p.specWikiPageId === specPageId);
           if (plan) {
             const project2 = await client.getProject(projectSlug);
-            const rawPlanDomains = plan?.domains ?? plan?.domain;
+            const planRecord = plan;
+            const projectRecord = project2;
+            const rawPlanDomains = planRecord.domains ?? planRecord.domain;
             const substantivePlanDomains = (Array.isArray(rawPlanDomains) ? rawPlanDomains : rawPlanDomains != null ? [rawPlanDomains] : []).map(String).map((d) => d.trim().toLowerCase()).filter(Boolean);
-            const planDomains = substantivePlanDomains.length > 0 ? substantivePlanDomains : project2?.defaultDomains ?? (project2?.defaultDomain ? [project2.defaultDomain] : void 0);
+            const planDomains = substantivePlanDomains.length > 0 ? substantivePlanDomains : projectRecord?.defaultDomains ?? (projectRecord?.defaultDomain ? [projectRecord.defaultDomain] : void 0);
             return {
               taskId: null,
               planId: plan.id,
               seed: null,
-              title: plan.title ?? plan.name ?? null,
+              title: planRecord.title ?? plan.name ?? null,
               domains: planDomains,
               notes: null
             };
@@ -46062,7 +46312,8 @@ async function buildDeliverableGateDeps(args) {
   let criteria = [];
   if (taskId) {
     const task = await client.getTask(projectSlug, taskId);
-    domain2 = normalizeDomain(task?.domains ?? task?.domain);
+    const taskRecord = task;
+    domain2 = normalizeDomain(taskRecord?.domains ?? taskRecord?.domain);
     impact = task?.impact;
     taskTitle = task?.title ?? "";
     if (task?.specWikiPageId) {
@@ -46746,7 +46997,7 @@ async function deliverToWiki(client, projectSlug, payload) {
   return client.updateWikiPage(projectSlug, payload.pageId, payload.patch);
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
 function isZ4Schema(s) {
   const schema = s;
   return !!schema._zod;
@@ -46809,7 +47060,7 @@ function getLiteralValue(schema) {
   return void 0;
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
 var LATEST_PROTOCOL_VERSION = "2025-11-25";
 var SUPPORTED_PROTOCOL_VERSIONS = [LATEST_PROTOCOL_VERSION, "2025-06-18", "2025-03-26", "2024-11-05", "2024-10-07"];
 var RELATED_TASK_META_KEY = "io.modelcontextprotocol/related-task";
@@ -48329,7 +48580,7 @@ var UrlElicitationRequiredError = class extends McpError {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
 function isTerminal(status) {
   return status === "completed" || status === "failed" || status === "cancelled";
 }
@@ -48340,7 +48591,7 @@ var ignoreOverride = Symbol("Let zodToJsonSchema decide on which parser to use")
 // ../../node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@4.4.3/node_modules/zod-to-json-schema/dist/esm/parsers/string.js
 var ALPHA_NUMERIC = new Set("ABCDEFGHIJKLMNOPQRSTUVXYZabcdefghijklmnopqrstuvxyz0123456789");
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
 function getMethodLiteral(schema) {
   const shape = getObjectShape(schema);
   const methodSchema = shape?.method;
@@ -48361,7 +48612,7 @@ function parseWithCompat(schema, data) {
   return result.data;
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
 var DEFAULT_REQUEST_TIMEOUT_MSEC = 6e4;
 var Protocol = class {
   constructor(_options) {
@@ -48402,6 +48653,9 @@ var Protocol = class {
       this.setRequestHandler(GetTaskPayloadRequestSchema, async (request, extra) => {
         const handleTaskResult = async () => {
           const taskId = request.params.taskId;
+          if (!await this._taskStore.getTask(taskId, extra.sessionId)) {
+            throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
+          }
           if (this._taskMessageQueue) {
             let queuedMessage;
             while (queuedMessage = await this._taskMessageQueue.dequeue(taskId, extra.sessionId)) {
@@ -48432,12 +48686,12 @@ var Protocol = class {
             throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
           }
           if (!isTerminal(task.status)) {
-            await this._waitForTaskUpdate(taskId, extra.signal);
+            await this._waitForTaskUpdate(taskId, extra.signal, extra.sessionId);
             return await handleTaskResult();
           }
           if (isTerminal(task.status)) {
             const result = await this._taskStore.getTaskResult(taskId, extra.sessionId);
-            this._clearTaskQueue(taskId);
+            this._clearTaskQueue(taskId, extra.sessionId);
             return {
               ...result,
               _meta: {
@@ -48474,7 +48728,7 @@ var Protocol = class {
             throw new McpError(ErrorCode.InvalidParams, `Cannot cancel task in terminal status: ${task.status}`);
           }
           await this._taskStore.updateTaskStatus(request.params.taskId, "cancelled", "Client cancelled task execution.", extra.sessionId);
-          this._clearTaskQueue(request.params.taskId);
+          this._clearTaskQueue(request.params.taskId, extra.sessionId);
           const cancelledTask = await this._taskStore.getTask(request.params.taskId, extra.sessionId);
           if (!cancelledTask) {
             throw new McpError(ErrorCode.InvalidParams, `Task not found after cancellation: ${request.params.taskId}`);
@@ -48602,6 +48856,19 @@ var Protocol = class {
     const handler = this._requestHandlers.get(request.method) ?? this.fallbackRequestHandler;
     const capturedTransport = this._transport;
     const relatedTaskId = request.params?._meta?.[RELATED_TASK_META_KEY]?.taskId;
+    const sessionId = capturedTransport?.sessionId;
+    const store = this._taskStore;
+    let relatedTaskFound = true;
+    let relatedTaskLookup;
+    if (relatedTaskId && store && this._taskMessageQueue && sessionId !== void 0) {
+      relatedTaskFound = false;
+      relatedTaskLookup = (async () => {
+        if (!await store.getTask(relatedTaskId, sessionId)) {
+          throw new McpError(ErrorCode.InvalidParams, `Task not found: ${relatedTaskId}`);
+        }
+        relatedTaskFound = true;
+      })();
+    }
     if (handler === void 0) {
       const errorResponse = {
         jsonrpc: "2.0",
@@ -48611,7 +48878,10 @@ var Protocol = class {
           message: "Method not found"
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && relatedTaskLookup) {
+        const queuedError = { type: "error", message: errorResponse, timestamp: Date.now() };
+        relatedTaskLookup.then(() => this._enqueueTaskMessage(relatedTaskId, queuedError, sessionId), () => capturedTransport?.send(errorResponse)).catch((error51) => this._onerror(new Error(`Failed to send an error response: ${error51}`)));
+      } else if (relatedTaskId && this._taskMessageQueue) {
         this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -48662,7 +48932,10 @@ var Protocol = class {
       closeSSEStream: extra?.closeSSEStream,
       closeStandaloneSSEStream: extra?.closeStandaloneSSEStream
     };
-    Promise.resolve().then(() => {
+    (relatedTaskLookup ?? Promise.resolve()).then(() => {
+      if (relatedTaskLookup && abortController.signal.aborted) {
+        throw new McpError(ErrorCode.ConnectionClosed, "Request was cancelled");
+      }
       if (taskCreationParams) {
         this.assertTaskHandlerCapability(request.method);
       }
@@ -48697,7 +48970,7 @@ var Protocol = class {
           ...error51["data"] !== void 0 && { data: error51["data"] }
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && this._taskMessageQueue && relatedTaskFound) {
         await this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -49177,7 +49450,7 @@ var Protocol = class {
       throw new Error("Cannot enqueue task message: taskStore and taskMessageQueue are not configured");
     }
     const maxQueueSize = this._options?.maxTaskQueueSize;
-    await this._taskMessageQueue.enqueue(taskId, message, sessionId, maxQueueSize);
+    await this._taskMessageQueue.enqueue(taskId, message, sessionId ?? this._transport?.sessionId, maxQueueSize);
   }
   /**
    * Clears the message queue for a task and rejects any pending request resolvers.
@@ -49206,12 +49479,13 @@ var Protocol = class {
    * Uses polling to check for updates at the task's configured poll interval.
    * @param taskId The task ID to wait for
    * @param signal Abort signal to cancel the wait
+   * @param sessionId Session of the request that waits, passed to the task store
    * @returns Promise that resolves when an update occurs or rejects if aborted
    */
-  async _waitForTaskUpdate(taskId, signal) {
+  async _waitForTaskUpdate(taskId, signal, sessionId) {
     let interval = this._options?.defaultTaskPollInterval ?? 1e3;
     try {
-      const task = await this._taskStore?.getTask(taskId);
+      const task = await this._taskStore?.getTask(taskId, sessionId);
       if (task?.pollInterval) {
         interval = task.pollInterval;
       }
@@ -49315,7 +49589,7 @@ function mergeCapabilities(base, additional) {
   return result;
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
 var import_ajv = __toESM(require_ajv(), 1);
 var import_ajv_formats = __toESM(require_dist(), 1);
 function createDefaultAjvInstance() {
@@ -49383,7 +49657,7 @@ var AjvJsonSchemaValidator = class {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/client.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/client.js
 var ExperimentalClientTasks = class {
   constructor(_client) {
     this._client = _client;
@@ -49537,7 +49811,7 @@ var ExperimentalClientTasks = class {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
 function assertToolsCallTaskCapability(requests, method, entityName) {
   if (!requests) {
     throw new Error(`${entityName} does not support task creation (required for ${method})`);
@@ -49572,7 +49846,7 @@ function assertClientRequestTaskCapability(requests, method, entityName) {
   }
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/client/index.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/client/index.js
 function applyElicitationDefaults(schema, data) {
   if (!schema || data === null || typeof data !== "object")
     return;
@@ -50083,7 +50357,7 @@ var Client = class extends Protocol {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
 var import_content_type = __toESM(require_content_type(), 1);
 function mediaTypeEssence(header) {
   if (!header) {
@@ -50100,7 +50374,7 @@ function mediaTypeEssence(header) {
   }
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/transport.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/transport.js
 function normalizeHeaders(headers) {
   if (!headers)
     return {};
@@ -50126,6 +50400,68 @@ function createFetchWithInit(baseFetch = fetch, baseInit) {
     return baseFetch(url2, mergedInit);
   };
 }
+var MAX_REDIRECTS = 5;
+var REDIRECT_STATUSES = [301, 302, 303, 307, 308];
+function isWithinOrigin(from, to) {
+  if (from.protocol === to.protocol && from.hostname === to.hostname && from.port === to.port) {
+    return true;
+  }
+  return from.hostname === to.hostname && from.protocol === "http:" && from.port === "" && to.protocol === "https:" && to.port === "";
+}
+function redirectTarget(response, requestUrl) {
+  const location = REDIRECT_STATUSES.includes(response.status) ? response.headers.get("location") : null;
+  try {
+    return location ? new URL(location, requestUrl) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function followWithinOrigin(baseFetch, url2, init, response, followed = 0) {
+  const target = redirectTarget(response, url2);
+  const keepsMethod = response.status === 307 || response.status === 308 || (init?.method ?? "GET").toUpperCase() === "GET";
+  if (!target || followed === MAX_REDIRECTS || !keepsMethod) {
+    return void 0;
+  }
+  const from = new URL(url2);
+  const addsUserinfo = (target.username || target.password) && (target.username !== from.username || target.password !== from.password);
+  if (addsUserinfo || !isWithinOrigin(from, target)) {
+    return void 0;
+  }
+  return Promise.resolve(response.body?.cancel()).then(() => baseFetch(target, { ...init, redirect: "manual" })).then((next) => followWithinOrigin(baseFetch, target, init, next, followed + 1) ?? next);
+}
+var followingFetches = /* @__PURE__ */ new WeakSet();
+function fetchLeavingRedirects(baseFetch) {
+  const following = (url2, init) => (baseFetch ?? fetch)(url2, init);
+  followingFetches.add(following);
+  return following;
+}
+function fetchWithinOrigin(baseFetch = fetch) {
+  if (followingFetches.has(baseFetch)) {
+    return baseFetch;
+  }
+  return (url2, init) => {
+    if (init?.redirect === "error" || init?.redirect === "manual") {
+      return baseFetch(url2, init);
+    }
+    return Promise.resolve(baseFetch(url2, { ...init, redirect: "manual" })).then((response) => followWithinOrigin(baseFetch, url2, init, response) ?? response);
+  };
+}
+function unfollowedRedirect(response, requestUrl) {
+  if (response.type === "opaqueredirect") {
+    return "Redirect not followed: this runtime does not expose the redirect target";
+  }
+  const from = response.url || requestUrl;
+  const target = redirectTarget(response, from);
+  if (!target) {
+    return void 0;
+  }
+  target.username = target.password = target.search = target.hash = "";
+  if (target.protocol === "http:" && new URL(from).protocol === "https:") {
+    target.protocol = "https:";
+    return `Redirect to plain http not followed; try ${target.href} instead`;
+  }
+  return `Redirect to ${target.href} not followed`;
+}
 
 // ../../node_modules/.pnpm/pkce-challenge@5.0.1/node_modules/pkce-challenge/dist/index.node.js
 var crypto3;
@@ -50170,7 +50506,7 @@ async function pkceChallenge(length) {
   };
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
 var SafeUrlSchema = url().superRefine((val, ctx) => {
   if (!URL.canParse(val)) {
     ctx.addIssue({
@@ -50272,7 +50608,12 @@ var OAuthTokensSchema = object({
   token_type: string2(),
   expires_in: coerce_exports.number().optional(),
   scope: string2().optional(),
-  refresh_token: string2().optional()
+  refresh_token: string2().optional(),
+  /**
+   * Not part of the wire format: the authorization server this value was obtained from, added by
+   * the client's `auth()` before it is stored and compared when it is read back.
+   */
+  issuer: string2().optional().catch(void 0)
 }).strip();
 var OAuthErrorResponseSchema = object({
   error: string2(),
@@ -50302,7 +50643,12 @@ var OAuthClientInformationSchema = object({
   client_id: string2(),
   client_secret: string2().optional(),
   client_id_issued_at: number2().optional(),
-  client_secret_expires_at: number2().optional()
+  client_secret_expires_at: number2().optional(),
+  /**
+   * Not part of the wire format: the authorization server this value was obtained from, added by
+   * the client's `auth()` before it is stored and compared when it is read back.
+   */
+  issuer: string2().optional().catch(void 0)
 }).strip();
 var OAuthClientInformationFullSchema = OAuthClientMetadataSchema.merge(OAuthClientInformationSchema);
 var OAuthClientRegistrationErrorSchema = object({
@@ -50314,7 +50660,7 @@ var OAuthTokenRevocationRequestSchema = object({
   token_type_hint: string2().optional()
 }).strip();
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth-utils.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth-utils.js
 function resourceUrlFromServerUrl(url2) {
   const resourceURL = typeof url2 === "string" ? new URL(url2) : new URL(url2.href);
   resourceURL.hash = "";
@@ -50334,7 +50680,7 @@ function checkResourceAllowed({ requestedResource, configuredResource }) {
   return requestedPath.startsWith(configuredPath);
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/auth/errors.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/auth/errors.js
 var OAuthError = class extends Error {
   constructor(message, errorUri) {
     super(message);
@@ -50429,7 +50775,7 @@ var OAUTH_ERRORS = {
   [InvalidTargetError.errorCode]: InvalidTargetError
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/client/auth.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/client/auth.js
 var UnauthorizedError = class extends Error {
   constructor(message) {
     super(message ?? "Unauthorized");
@@ -50500,10 +50846,31 @@ async function parseErrorResponse(input) {
     const errorClass = OAUTH_ERRORS[error51] || ServerError;
     return new errorClass(error_description || "", error_uri);
   } catch (error51) {
-    const errorMessage = `${statusCode ? `HTTP ${statusCode}: ` : ""}Invalid OAuth error response: ${error51}. Raw body: ${body}`;
+    const redirect = input instanceof Response ? unfollowedRedirect(input, input.url) : void 0;
+    const errorMessage = `${statusCode ? `HTTP ${statusCode}: ` : ""}${redirect ?? `Invalid OAuth error response: ${error51}. Raw body: ${body}`}`;
     return new ServerError(errorMessage);
   }
 }
+function issuersMatch(a, b) {
+  let [x, y] = [a, b];
+  try {
+    [x, y] = [new URL(a).href, new URL(b).href];
+  } catch {
+  }
+  return x === y || x.endsWith("/") && x.slice(0, -1) === y || y.endsWith("/") && y.slice(0, -1) === x;
+}
+function discardIfIssuerMismatch(stored, issuer) {
+  if (!stored)
+    return void 0;
+  if (typeof stored.issuer !== "string")
+    return stored.issuer == null ? stored : { ...stored, issuer: void 0 };
+  return issuersMatch(stored.issuer, issuer) ? stored : void 0;
+}
+var TokenResponseSchema = OAuthTokensSchema.omit({ issuer: true });
+var RegistrationResponseSchema = OAuthClientInformationFullSchema.omit({ issuer: true });
+function boundElsewhereError(stored, issuer) {
+  return new Error(`OAuth client information is bound to authorization server ${stored.issuer} and is not presented to ${issuer}. Clear the stored client information, or correct \`expectedIssuer\`, if the authorization server has moved.`);
+}
 async function auth(provider, options) {
   try {
     return await authInternal(provider, options);
@@ -50557,9 +50924,24 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
       authorizationServerMetadata: metadata
     });
   }
-  const resource = await selectResourceURL(serverUrl, provider, resourceMetadata);
+  const issuer = String(authorizationServerUrl);
+  const selectedResource = await selectResourceURL(serverUrl, provider, resourceMetadata);
+  const resource = selectedResource && resourceMetadata && !provider.validateResourceURL ? resourceMetadata.resource : selectedResource;
   const resolvedScope = scope || resourceMetadata?.scopes_supported?.join(" ") || provider.clientMetadata.scope;
-  let clientInformation = await Promise.resolve(provider.clientInformation());
+  const storedClientInformation = await Promise.resolve(provider.clientInformation());
+  let clientInformation = discardIfIssuerMismatch(storedClientInformation, issuer);
+  const canRegisterAgain = provider.saveClientInformation !== void 0 && !!provider.redirectUrl;
+  if (storedClientInformation && !clientInformation && !canRegisterAgain) {
+    throw boundElsewhereError(storedClientInformation, issuer);
+  }
+  const unstampedClientInformation = clientInformation?.issuer == null ? clientInformation : void 0;
+  const bindClientInformation = async () => {
+    try {
+      if (unstampedClientInformation)
+        await provider.saveClientInformation?.({ ...unstampedClientInformation, issuer });
+    } catch {
+    }
+  };
   if (!clientInformation) {
     if (authorizationCode !== void 0) {
       throw new Error("Existing OAuth client information is required when exchanging an authorization code");
@@ -50571,9 +50953,7 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
     }
     const shouldUseUrlBasedClientId = supportsUrlBasedClientId && clientMetadataUrl;
     if (shouldUseUrlBasedClientId) {
-      clientInformation = {
-        client_id: clientMetadataUrl
-      };
+      clientInformation = { client_id: clientMetadataUrl, issuer };
       await provider.saveClientInformation?.(clientInformation);
     } else {
       if (!provider.saveClientInformation) {
@@ -50585,8 +50965,8 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
         scope: resolvedScope,
         fetchFn
       });
-      await provider.saveClientInformation(fullInformation);
-      clientInformation = fullInformation;
+      clientInformation = { ...fullInformation, issuer };
+      await provider.saveClientInformation(clientInformation);
     }
   }
   const nonInteractiveFlow = !provider.redirectUrl;
@@ -50597,10 +50977,14 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
       authorizationCode,
       fetchFn
     });
-    await provider.saveTokens(tokens3);
+    await bindClientInformation();
+    await provider.saveTokens({ ...tokens3, issuer });
     return "AUTHORIZED";
   }
-  const tokens2 = await provider.tokens();
+  const tokens2 = discardIfIssuerMismatch(await provider.tokens(), issuer);
+  if (tokens2?.refresh_token && tokens2.issuer == null) {
+    console.warn("[mcp-sdk] stored OAuth tokens have no 'issuer' property (saved by an earlier version, or by a provider that does not keep it) and are used as-is; make sure your OAuthClientProvider stores what saveTokens() and saveClientInformation() receive unchanged.");
+  }
   if (tokens2?.refresh_token) {
     try {
       const newTokens = await refreshAuthorization(authorizationServerUrl, {
@@ -50611,7 +50995,8 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
         addClientAuthentication: provider.addClientAuthentication,
         fetchFn
       });
-      await provider.saveTokens(newTokens);
+      await bindClientInformation();
+      await provider.saveTokens({ ...newTokens, issuer });
       return "AUTHORIZED";
     } catch (error51) {
       if (!(error51 instanceof OAuthError) || error51 instanceof ServerError) {
@@ -50710,7 +51095,7 @@ async function discoverOAuthProtectedResourceMetadata(serverUrl, opts, fetchFn =
 }
 async function fetchWithCorsRetry(url2, headers, fetchFn = fetch) {
   try {
-    return await fetchFn(url2, { headers });
+    return await fetchWithinOrigin(fetchFn)(url2, { headers });
   } catch (error51) {
     if (error51 instanceof TypeError) {
       if (headers) {
@@ -50735,7 +51120,7 @@ async function tryMetadataDiscovery(url2, protocolVersion, fetchFn = fetch) {
   return await fetchWithCorsRetry(url2, headers, fetchFn);
 }
 function shouldAttemptFallback(response, pathname) {
-  return !response || response.status >= 400 && response.status < 500 && pathname !== "/";
+  return !response || !response.ok && response.status < 500 && pathname !== "/";
 }
 async function discoverMetadataWithFallback(serverUrl, wellKnownType, fetchFn, opts) {
   const issuer = new URL(serverUrl);
@@ -50801,7 +51186,7 @@ async function discoverAuthorizationServerMetadata(authorizationServerUrl, { fet
     }
     if (!response.ok) {
       await response.body?.cancel();
-      if (response.status >= 400 && response.status < 500) {
+      if (response.status < 500) {
         continue;
       }
       throw new Error(`HTTP ${response.status} trying to load ${type === "oauth" ? "OAuth" : "OpenID provider"} metadata from ${endpointUrl}`);
@@ -50834,6 +51219,9 @@ async function discoverOAuthServerInfo(serverUrl, opts) {
     resourceMetadata
   };
 }
+function resourceIndicatorToString(resource) {
+  return typeof resource === "string" ? resource : resource.href;
+}
 async function startAuthorization(authorizationServerUrl, { metadata, clientInformation, redirectUrl, scope, state, resource }) {
   let authorizationUrl;
   if (metadata) {
@@ -50865,7 +51253,7 @@ async function startAuthorization(authorizationServerUrl, { metadata, clientInfo
     authorizationUrl.searchParams.append("prompt", "consent");
   }
   if (resource) {
-    authorizationUrl.searchParams.set("resource", resource.href);
+    authorizationUrl.searchParams.set("resource", resourceIndicatorToString(resource));
   }
   return { authorizationUrl, codeVerifier };
 }
@@ -50884,7 +51272,7 @@ async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequ
     Accept: "application/json"
   });
   if (resource) {
-    tokenRequestParams.set("resource", resource.href);
+    tokenRequestParams.set("resource", resourceIndicatorToString(resource));
   }
   if (addClientAuthentication) {
     await addClientAuthentication(headers, tokenRequestParams, tokenUrl, metadata);
@@ -50893,7 +51281,7 @@ async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequ
     const authMethod = selectClientAuthMethod(clientInformation, supportedMethods);
     applyClientAuthentication(authMethod, clientInformation, headers, tokenRequestParams);
   }
-  const response = await (fetchFn ?? fetch)(tokenUrl, {
+  const response = await fetchWithinOrigin(fetchFn ?? fetch)(tokenUrl, {
     method: "POST",
     headers,
     body: tokenRequestParams
@@ -50901,7 +51289,7 @@ async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequ
   if (!response.ok) {
     throw await parseErrorResponse(response);
   }
-  return OAuthTokensSchema.parse(await response.json());
+  return TokenResponseSchema.parse(await response.json());
 }
 async function refreshAuthorization(authorizationServerUrl, { metadata, clientInformation, refreshToken, resource, addClientAuthentication, fetchFn }) {
   const tokenRequestParams = new URLSearchParams({
@@ -50919,6 +51307,15 @@ async function refreshAuthorization(authorizationServerUrl, { metadata, clientIn
   return { refresh_token: refreshToken, ...tokens2 };
 }
 async function fetchToken(provider, authorizationServerUrl, { metadata, resource, authorizationCode, fetchFn } = {}) {
+  const readClientInformation = async () => {
+    const storedClientInformation = await provider.clientInformation();
+    const checked = discardIfIssuerMismatch(storedClientInformation, String(authorizationServerUrl));
+    if (storedClientInformation && !checked) {
+      throw boundElsewhereError(storedClientInformation, String(authorizationServerUrl));
+    }
+    return checked;
+  };
+  let clientInformation = await readClientInformation();
   const scope = provider.clientMetadata.scope;
   let tokenRequestParams;
   if (provider.prepareTokenRequest) {
@@ -50934,11 +51331,11 @@ async function fetchToken(provider, authorizationServerUrl, { metadata, resource
     const codeVerifier = await provider.codeVerifier();
     tokenRequestParams = prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, provider.redirectUrl);
   }
-  const clientInformation = await provider.clientInformation();
+  clientInformation ?? (clientInformation = await readClientInformation());
   return executeTokenRequest(authorizationServerUrl, {
     metadata,
     tokenRequestParams,
-    clientInformation: clientInformation ?? void 0,
+    clientInformation,
     addClientAuthentication: provider.addClientAuthentication,
     resource,
     fetchFn
@@ -50954,7 +51351,7 @@ async function registerClient(authorizationServerUrl, { metadata, clientMetadata
   } else {
     registrationUrl = new URL("/register", authorizationServerUrl);
   }
-  const response = await (fetchFn ?? fetch)(registrationUrl, {
+  const response = await fetchWithinOrigin(fetchFn ?? fetch)(registrationUrl, {
     method: "POST",
     headers: {
       "Content-Type": "application/json"
@@ -50967,7 +51364,7 @@ async function registerClient(authorizationServerUrl, { metadata, clientMetadata
   if (!response.ok) {
     throw await parseErrorResponse(response);
   }
-  return OAuthClientInformationFullSchema.parse(await response.json());
+  return RegistrationResponseSchema.parse(await response.json());
 }
 
 // ../../node_modules/.pnpm/eventsource-parser@3.1.1/node_modules/eventsource-parser/dist/index.js
@@ -51171,7 +51568,7 @@ var EventSourceParserStream = class extends TransformStream {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/client/streamableHttp.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/client/streamableHttp.js
 var DEFAULT_STREAMABLE_HTTP_RECONNECTION_OPTIONS = {
   initialReconnectionDelay: 1e3,
   maxReconnectionDelay: 3e4,
@@ -51194,9 +51591,19 @@ var StreamableHTTPClientTransport = class {
     this._authProvider = opts?.authProvider;
     this._fetch = opts?.fetch;
     this._fetchWithInit = createFetchWithInit(opts?.fetch, opts?.requestInit);
+    this._followRedirects = opts?.redirectPolicy === "follow";
+    if (this._followRedirects) {
+      this._fetch = fetchLeavingRedirects(this._fetch);
+      this._fetchWithInit = fetchLeavingRedirects(this._fetchWithInit);
+    }
     this._sessionId = opts?.sessionId;
     this._reconnectionOptions = opts?.reconnectionOptions ?? DEFAULT_STREAMABLE_HTTP_RECONNECTION_OPTIONS;
   }
+  /** Error text for a redirect `response` that was not followed, or `undefined` for any other response. */
+  _unfollowedRedirect(response, url2) {
+    const text = unfollowedRedirect(response, url2);
+    return text && !this._followRedirects ? `${text} (redirectPolicy: 'same-origin')` : text;
+  }
   async _authThenStart() {
     if (!this._authProvider) {
       throw new UnauthorizedError("No auth provider");
@@ -51246,11 +51653,13 @@ var StreamableHTTPClientTransport = class {
       if (resumptionToken) {
         headers.set("last-event-id", resumptionToken);
       }
-      const response = await (this._fetch ?? fetch)(this._url, {
-        method: "GET",
-        headers,
-        signal: this._abortController?.signal
-      });
+      const fetchFn = this._fetch ?? fetch;
+      const init = { method: "GET", headers, signal: this._abortController?.signal };
+      let response = await fetchFn(this._url, this._followRedirects ? init : { ...init, redirect: "manual" });
+      const followed = this._followRedirects ? void 0 : followWithinOrigin(fetchFn, this._url, init, response);
+      if (followed) {
+        response = await followed;
+      }
       if (!response.ok) {
         await response.body?.cancel();
         if (response.status === 401 && this._authProvider) {
@@ -51259,7 +51668,7 @@ var StreamableHTTPClientTransport = class {
         if (response.status === 405) {
           return;
         }
-        throw new StreamableHTTPError(response.status, `Failed to open SSE stream: ${response.statusText}`);
+        throw new StreamableHTTPError(response.status, `Failed to open SSE stream: ${this._unfollowedRedirect(response, this._url) ?? response.statusText}`);
       }
       this._handleSseStream(response.body, options, true);
     } catch (error51) {
@@ -51422,7 +51831,7 @@ var StreamableHTTPClientTransport = class {
         body: JSON.stringify(message),
         signal: this._abortController?.signal
       };
-      const response = await (this._fetch ?? fetch)(this._url, init);
+      const response = await fetchWithinOrigin(this._fetch ?? fetch)(this._url, init);
       const sessionId = response.headers.get("mcp-session-id");
       if (sessionId) {
         this._sessionId = sessionId;
@@ -51474,7 +51883,7 @@ var StreamableHTTPClientTransport = class {
             return this.send(message);
           }
         }
-        throw new StreamableHTTPError(response.status, `Error POSTing to endpoint: ${text}`);
+        throw new StreamableHTTPError(response.status, `Error POSTing to endpoint: ${this._unfollowedRedirect(response, this._url) ?? text}`);
       }
       this._hasCompletedAuthFlow = false;
       this._lastUpscopingHeader = void 0;
@@ -51536,10 +51945,10 @@ var StreamableHTTPClientTransport = class {
         headers,
         signal: this._abortController?.signal
       };
-      const response = await (this._fetch ?? fetch)(this._url, init);
+      const response = await fetchWithinOrigin(this._fetch ?? fetch)(this._url, init);
       await response.body?.cancel();
       if (!response.ok && response.status !== 405) {
-        throw new StreamableHTTPError(response.status, `Failed to terminate session: ${response.statusText}`);
+        throw new StreamableHTTPError(response.status, `Failed to terminate session: ${this._unfollowedRedirect(response, this._url) ?? response.statusText}`);
       }
       this._sessionId = void 0;
     } catch (error51) {
@@ -51568,12 +51977,12 @@ var StreamableHTTPClientTransport = class {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/client/stdio.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/client/stdio.js
 var import_cross_spawn = __toESM(require_cross_spawn(), 1);
 var import_node_process = __toESM(require("node:process"), 1);
 var import_node_stream = require("node:stream");
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
 var STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
 var ReadBuffer = class {
   constructor(options) {
@@ -51610,7 +52019,7 @@ function serializeMessage(message) {
   return JSON.stringify(message) + "\n";
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/client/stdio.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/client/stdio.js
 var DEFAULT_INHERITED_ENV_VARS = import_node_process.default.platform === "win32" ? [
   "APPDATA",
   "HOMEDRIVE",
@@ -53082,7 +53491,8 @@ async function handleConsensusBlocked(result, ctx, input, resolvedTaskId) {
             ...groupId ? { groupId } : {}
           });
         } catch (err) {
-          const isConflict = err?.status === 409 || err?.statusCode === 409 || err?.code === "23505" || String(err?.message ?? "").includes("already exists") || String(err?.message ?? "").includes("duplicate key");
+          const errObj = err;
+          const isConflict = errObj?.status === 409 || errObj?.statusCode === 409 || errObj?.code === "23505" || String(errObj?.message ?? "").includes("already exists") || String(errObj?.message ?? "").includes("duplicate key");
           if (!isConflict) {
             throw err;
           }
@@ -53106,7 +53516,8 @@ async function handleConsensusBlocked(result, ctx, input, resolvedTaskId) {
             ...groupId ? { groupId } : {}
           });
         } catch (err) {
-          const isConflict = err?.status === 409 || err?.statusCode === 409 || err?.code === "23505" || String(err?.message ?? "").includes("already exists") || String(err?.message ?? "").includes("duplicate key");
+          const errObj = err;
+          const isConflict = errObj?.status === 409 || errObj?.statusCode === 409 || errObj?.code === "23505" || String(errObj?.message ?? "").includes("already exists") || String(errObj?.message ?? "").includes("duplicate key");
           if (!isConflict) {
             throw err;
           }
@@ -59134,7 +59545,7 @@ Do NOT derail the current task - if the operator has an in-flight question, answ
 }
 
 // src/_generated/version.ts
-var PKG_VERSION = "0.4.101";
+var PKG_VERSION = "0.4.106";
 
 // src/director-closure.ts
 var CLOSURE_SNAPSHOT_TIMEOUT_MS = 2e3;
@@ -61085,7 +61496,7 @@ async function uploadPendingDays(stateDir, client, bridgeHealth, gateCtx) {
         ...gateCalls.length > 0 ? { gateCalls } : {}
       };
       const gateResult = await gate(batch, [], gateCtx);
-      const gateMarker = gateResult.gated ? "gated" : "projection-only";
+      const _gateMarker = gateResult.gated ? "gated" : "projection-only";
       if (cur.projectSlug === "_unattributed") {
         await client.postOperatorTelemetry(gateResult.artifact);
       } else {
@@ -63709,7 +64120,7 @@ ${renderTaskStateSection(taskState)}`;
     }
   }
   const removeWtFn = deps.removeRunWorktree ?? removeRunWorktree;
-  const pushFn = deps.pushRunBranch ?? pushRunBranch;
+  const _pushFn = deps.pushRunBranch ?? pushRunBranch;
   try {
     const startParams = {
       cwd: turnCwd,
@@ -63970,10 +64381,10 @@ Continue executing task ${task.id}. Make the next concrete increment of progress
       if (!expectedRepoFullName) {
         throw new Error(`push aborted: project ${projectSlug} has no bound GitHub repository`);
       }
-      const pushFn2 = deps.pushRunBranch ?? pushRunBranch;
+      const pushFn = deps.pushRunBranch ?? pushRunBranch;
       const locksDir = deps.locksDir ?? "/tmp/mrrlin-locks";
       await withCheckoutLock(locksDir, projectSlug, async () => {
-        await pushFn2({
+        await pushFn({
           worktreePath,
           locksDir,
           slug: projectSlug,
@@ -72675,7 +73086,7 @@ async function startDirectorBridge() {
     await tokenRefresher.start();
     process.stderr.write("[mrrlin-mcp director-bridge] agent credential active; operator token auto-refresh enabled.\n");
   } else {
-    let apiToken = envToken ?? readOperatorToken() ?? void 0;
+    const apiToken = envToken ?? readOperatorToken() ?? void 0;
     if (envToken) {
       try {
         persistOperatorToken(envToken);
@@ -73639,7 +74050,7 @@ function renderContextPrefix(context) {
   return parts.join("\n\n");
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
 var ExperimentalServerTasks = class {
   constructor(_server) {
     this._server = _server;
@@ -73852,7 +74263,7 @@ var ExperimentalServerTasks = class {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
 var Server = class extends Protocol {
   /**
    * Initializes this server with the given name and version information.
@@ -74223,7 +74634,7 @@ var Server = class extends Protocol {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 var import_node_process2 = __toESM(require("node:process"), 1);
 var StdioServerTransport = class {
   constructor(_stdin = import_node_process2.default.stdin, _stdout = import_node_process2.default.stdout, options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrrlin-dev/mcp",
-  "version": "0.4.101",
+  "version": "0.4.106",
   "type": "module",
   "bin": {
     "mrrlin-mcp": "dist/bin.cjs"
@@ -16,11 +16,11 @@
   "dependencies": {
     "@clack/prompts": "^0.8.2",
     "@iarna/toml": "^2.2.5",
-    "@modelcontextprotocol/sdk": "^1.6.0",
+    "@modelcontextprotocol/sdk": "^1.32.0",
     "@mrrlin-dev/external-agents": "latest",
     "@playwright/mcp": "0.0.76",
     "dotenv": "^16.4.5",
-    "hono": "^4.7.2",
+    "hono": "^4.13.11",
     "playwright-core": "1.61.0-alpha-1781023400000",
     "proper-lockfile": "^4.1.2",
     "qrcode": "^1.5.3",