@nimrobo/mcporter-remote 0.1.0

package/tests/list-output.test.ts

@@ -0,0 +1,138 @@
+import { describe, expect, it, vi } from 'vitest';
+import { buildToolMetadata } from '../src/cli/generate/tools.js';
+import type { ListSummaryResult } from '../src/cli/list-format.js';
+import {
+  buildAuthCommandHint,
+  buildJsonListEntry,
+  createEmptyStatusCounts,
+  printSingleServerHeader,
+  printToolDetail,
+} from '../src/cli/list-output.js';
+import type { ServerDefinition } from '../src/config.js';
+import type { ServerToolInfo } from '../src/runtime.js';
+
+describe('list output helpers', () => {
+  const definition: ServerDefinition = {
+    name: 'demo',
+    description: 'Demo server',
+    command: { kind: 'http', url: new URL('https://demo.example.com/mcp') },
+    source: { kind: 'local', path: '/tmp/mcporter.json' },
+  };
+
+  it('renders single server headers with tool counts and transport info', () => {
+    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    const summary = printSingleServerHeader(definition, 2, 42, 'HTTP https://demo.example.com/mcp', 'config/demo');
+    expect(summary).toContain('2 tools');
+    expect(summary).toContain('42ms');
+    expect(summary).toContain('HTTP https://demo.example.com/mcp');
+    logSpy.mockRestore();
+  });
+
+  it('prints tool details and indicates optional fields', () => {
+    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    const tool: ServerToolInfo = {
+      name: 'add',
+      description: 'Add numbers',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          a: { type: 'number', description: 'First operand' },
+          b: { type: 'number', description: 'Second operand' },
+          format: { type: 'string', enum: ['json', 'markdown'], description: 'Format' },
+          projectId: { type: 'string', description: 'Project context' },
+          initiativeId: { type: 'string', description: 'Initiative context' },
+          creatorId: { type: 'string', description: 'Creator filter' },
+        },
+        required: ['a', 'b'],
+      },
+      outputSchema: { type: 'number' },
+    };
+    const metadata = buildToolMetadata(tool);
+    const detail = printToolDetail(definition, metadata, true, true);
+    expect(detail.optionalOmitted).toBe(true);
+    expect(detail.examples.length).toBeGreaterThan(0);
+    logSpy.mockRestore();
+  });
+
+  it('prints URL-based examples for ad-hoc HTTP servers', () => {
+    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    const adhocDefinition: ServerDefinition = {
+      name: 'mcp-sentry-dev-mcp',
+      description: 'Ad-hoc Sentry',
+      command: { kind: 'http', url: new URL('https://mcp.sentry.dev/mcp?agent=1') },
+      source: { kind: 'local', path: '<adhoc>' },
+    };
+    const tool: ServerToolInfo = {
+      name: 'use_sentry',
+      description: 'Proxy to Sentry',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          request: { type: 'string', description: 'Instruction' },
+        },
+        required: ['request'],
+      },
+      outputSchema: { type: 'object' },
+    };
+    const metadata = buildToolMetadata(tool);
+    const detail = printToolDetail(adhocDefinition, metadata, false, true);
+    expect(detail.examples[0]).toContain("'https://mcp.sentry.dev/mcp?agent=1.use_sentry(");
+    logSpy.mockRestore();
+  });
+
+  it('builds JSON summaries for successful servers', () => {
+    const summary: ListSummaryResult = {
+      status: 'ok',
+      server: definition,
+      durationMs: 12,
+      tools: [
+        { name: 'add', description: 'Add numbers', inputSchema: { type: 'object' }, outputSchema: { type: 'number' } },
+      ],
+    };
+    const entry = buildJsonListEntry(summary, 30, { includeSchemas: true });
+    expect(entry.status).toBe('ok');
+    expect(entry.tools?.[0]?.name).toBe('add');
+    expect(entry.tools?.[0]?.inputSchema).toBeDefined();
+  });
+
+  it('includes auth hints for error summaries', () => {
+    const summary: ListSummaryResult = {
+      status: 'error',
+      server: definition,
+      durationMs: 1000,
+      error: new Error('HTTP error 401'),
+    };
+    const entry = buildJsonListEntry(summary, 5, { includeSchemas: false });
+    expect(entry.status).toBe('auth');
+    expect(entry.authCommand).toBe(buildAuthCommandHint(definition));
+  });
+
+  it('exposes source list in JSON only when includeSources is true', () => {
+    const withSources: ServerDefinition = {
+      ...definition,
+      source: { kind: 'local', path: '/project/config/mcporter.json' },
+      sources: [
+        { kind: 'local', path: '/project/config/mcporter.json' },
+        { kind: 'import', path: '/home/.cursor/mcp.json' },
+      ],
+    };
+    const summary: ListSummaryResult = {
+      status: 'ok',
+      server: withSources,
+      durationMs: 10,
+      tools: [],
+    };
+
+    const minimal = buildJsonListEntry(summary, 30, { includeSchemas: false });
+    expect(minimal.sources).toBeUndefined();
+
+    const verbose = buildJsonListEntry(summary, 30, { includeSchemas: false, includeSources: true });
+    expect(verbose.sources).toEqual(withSources.sources);
+    expect(verbose.source).toEqual(withSources.source);
+  });
+
+  it('creates empty status counts with zeroed categories', () => {
+    const counts = createEmptyStatusCounts();
+    expect(counts).toEqual({ ok: 0, auth: 0, offline: 0, http: 0, error: 0 });
+  });
+});

package/tests/live/deepwiki-live.test.ts

@@ -0,0 +1,53 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { describe, expect, it } from 'vitest';
+
+const LIVE_FLAG = process.env.MCP_LIVE_TESTS === '1';
+const ENDPOINTS = [
+  { name: 'streamable-http', url: 'https://mcp.deepwiki.com/mcp' },
+  { name: 'sse', url: 'https://mcp.deepwiki.com/sse' },
+];
+
+const execFileAsync = promisify(execFile);
+
+function skipReason(): string | undefined {
+  if (!LIVE_FLAG) {
+    return 'set MCP_LIVE_TESTS=1 to run live MCP tests';
+  }
+  return undefined;
+}
+
+describe.skipIf(Boolean(skipReason()))('deepwiki live', () => {
+  ENDPOINTS.forEach(({ name, url }) => {
+    it(`lists wiki structure via ${name}`, async () => {
+      const { stdout, stderr } = await execFileAsync('node', [
+        'dist/cli.js',
+        'call',
+        url,
+        'read_wiki_structure',
+        'repoName:facebook/react',
+        '--output',
+        'json',
+      ]);
+      const normalized = stdout.trim() || stderr.trim();
+      // Response comes back as a JS-object literal string; just assert it contains the section list.
+      expect(normalized).toContain('Available pages for facebook/react');
+      expect(normalized).toContain('Overview');
+    }, 30_000);
+
+    it(`prints plain text when default output is used via ${name}`, async () => {
+      const { stdout, stderr } = await execFileAsync('node', [
+        'dist/cli.js',
+        'call',
+        url,
+        'read_wiki_structure',
+        'repoName:facebook/react',
+      ]);
+      const normalized = (stdout || stderr).trim();
+      expect(normalized).toContain('Available pages for facebook/react');
+      // Ensure we rendered the text content, not the JSON envelope.
+      expect(normalized).not.toContain('"type"');
+      expect(normalized.startsWith('{')).toBe(false);
+    }, 30_000);
+  });
+});

package/tests/oauth-callback.test.ts

@@ -0,0 +1,108 @@
+import { randomUUID } from 'node:crypto';
+import http from 'node:http';
+import os from 'node:os';
+import path from 'node:path';
+import { afterEach, describe, expect, it } from 'vitest';
+import type { ServerDefinition } from '../src/config.js';
+import { createOAuthSession } from '../src/oauth.js';
+
+const makeDefinition = (overrides: Partial<ServerDefinition> = {}): ServerDefinition => ({
+  name: overrides.name ?? 'svc',
+  description: 'test',
+  command: { kind: 'http', url: new URL('https://example.com/mcp') },
+  tokenCacheDir: overrides.tokenCacheDir ?? path.join(os.tmpdir(), 'mcporter-oauth-test', randomUUID()),
+  auth: 'oauth',
+  ...overrides,
+});
+
+const logger = { info: () => {}, warn: () => {}, error: () => {} };
+type StatefulProvider = { redirectUrl: string | URL; state: () => Promise<string> };
+
+const requestStatus = (target: URL): Promise<number> =>
+  new Promise((resolve, reject) => {
+    const req = http.request(
+      {
+        hostname: target.hostname,
+        port: target.port,
+        path: `${target.pathname}${target.search}`,
+        family: 4,
+        method: 'GET',
+      },
+      (res) => {
+        const status = res.statusCode ?? 0;
+        res.resume();
+        resolve(status);
+      }
+    );
+    req.on('error', reject);
+    req.end();
+  });
+
+let cleanup: (() => Promise<void>) | null = null;
+afterEach(async () => {
+  if (cleanup) {
+    await cleanup();
+    cleanup = null;
+  }
+});
+
+describe('oauth callback handling', () => {
+  it('rejects callbacks when state does not match', async () => {
+    const session = await createOAuthSession(makeDefinition(), logger);
+    cleanup = () => session.close();
+    const provider = session.provider as StatefulProvider;
+    const redirect = new URL(String(provider.redirectUrl));
+    redirect.hostname = '127.0.0.1';
+
+    // Persist expected state then send a mismatched one.
+    await provider.state();
+    const wait = session.waitForAuthorizationCode();
+    wait.catch(() => {});
+    const badUrl = new URL(redirect);
+    badUrl.searchParams.set('code', 'abc');
+    badUrl.searchParams.set('state', 'wrong-state');
+
+    const status = await requestStatus(badUrl);
+    expect(status).toBeGreaterThanOrEqual(400);
+
+    await expect(wait).rejects.toThrow(/state/i);
+    await wait.catch(() => {});
+  });
+
+  it('honors custom callback paths in oauthRedirectUrl', async () => {
+    const session = await createOAuthSession(
+      makeDefinition({ oauthRedirectUrl: 'http://127.0.0.1:0/custom-cb' }),
+      logger
+    );
+    cleanup = () => session.close();
+    const provider = session.provider as StatefulProvider;
+    const redirect = new URL(String(provider.redirectUrl));
+    const state = await provider.state();
+
+    const wait = session.waitForAuthorizationCode();
+    const okUrl = new URL(redirect);
+    okUrl.searchParams.set('code', 'xyz');
+    okUrl.searchParams.set('state', state);
+
+    const status = await requestStatus(okUrl);
+    expect(status).toBe(200);
+    await expect(wait).resolves.toBe('xyz');
+  });
+
+  it('accepts callbacks that omit state (compat servers)', async () => {
+    const session = await createOAuthSession(makeDefinition(), logger);
+    cleanup = () => session.close();
+    const provider = session.provider as StatefulProvider;
+    const redirect = new URL(String(provider.redirectUrl));
+    redirect.hostname = '127.0.0.1';
+
+    await provider.state();
+    const wait = session.waitForAuthorizationCode();
+
+    const okUrl = new URL(redirect);
+    okUrl.searchParams.set('code', 'nostate');
+    const status = await requestStatus(okUrl);
+    expect(status).toBe(200);
+    await expect(wait).resolves.toBe('nostate');
+  });
+});

package/tests/oauth-open-external.test.ts

@@ -0,0 +1,29 @@
+import { EventEmitter } from 'node:events';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { __oauthInternals } from '../src/oauth.js';
+
+describe('openExternal', () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('swallows xdg-open error events on linux', () => {
+    const child = new EventEmitter() as EventEmitter & { unref: () => void };
+    child.unref = vi.fn();
+    const launch = vi.fn(() => child as unknown as ReturnType<typeof import('node:child_process').spawn>);
+
+    expect(() =>
+      __oauthInternals.openExternal(
+        'https://example.com/auth',
+        'linux',
+        launch as unknown as typeof import('node:child_process').spawn
+      )
+    ).not.toThrow();
+    expect(launch).toHaveBeenCalledWith('xdg-open', ['https://example.com/auth'], {
+      stdio: 'ignore',
+      detached: true,
+    });
+    expect(() => child.emit('error', Object.assign(new Error('ENOENT'), { code: 'ENOENT' }))).not.toThrow();
+    expect(child.unref).toHaveBeenCalled();
+  });
+});

package/tests/oauth-persistence.test.ts

@@ -0,0 +1,146 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import type { ServerDefinition } from '../src/config.js';
+import { readJsonFile } from '../src/fs-json.js';
+import { buildOAuthPersistence, clearOAuthCaches } from '../src/oauth-persistence.js';
+import { loadVaultEntry, vaultKeyForDefinition } from '../src/oauth-vault.js';
+
+const mkDef = (name: string, tokenCacheDir?: string): ServerDefinition => ({
+  name,
+  description: `${name} server`,
+  command: { kind: 'http', url: new URL('https://example.com/mcp') },
+  auth: 'oauth',
+  tokenCacheDir,
+});
+
+describe('oauth persistence', () => {
+  const tempRoots: string[] = [];
+  let homedirSpy!: ReturnType<typeof vi.spyOn>;
+  let hasSpy = false;
+
+  afterEach(async () => {
+    if (hasSpy) {
+      homedirSpy.mockRestore();
+      hasSpy = false;
+    }
+    await Promise.all(tempRoots.splice(0).map((dir) => fs.rm(dir, { recursive: true, force: true })));
+  });
+
+  it('prefers explicit tokenCacheDir before vault when reading tokens', async () => {
+    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'mcporter-oauth-'));
+    tempRoots.push(tmp);
+    homedirSpy = vi.spyOn(os, 'homedir').mockReturnValue(tmp);
+    hasSpy = true;
+
+    const cacheDir = path.join(tmp, 'cache');
+    await fs.mkdir(cacheDir, { recursive: true });
+    await fs.writeFile(
+      path.join(cacheDir, 'tokens.json'),
+      JSON.stringify({ access_token: 'from-cache', token_type: 'Bearer' })
+    );
+
+    // Vault also contains a token, but cache dir should win.
+    const vaultPath = path.join(tmp, '.mcporter', 'credentials.json');
+    await fs.mkdir(path.dirname(vaultPath), { recursive: true });
+    const definition = mkDef('service', cacheDir);
+    const key = vaultKeyForDefinition(definition);
+    await fs.writeFile(
+      vaultPath,
+      JSON.stringify({
+        version: 1,
+        entries: {
+          [key]: {
+            updatedAt: new Date().toISOString(),
+            tokens: { access_token: 'from-vault', token_type: 'Bearer' },
+            serverName: 'service',
+          },
+        },
+      })
+    );
+
+    const persistence = await buildOAuthPersistence(definition);
+
+    expect(await persistence.readTokens()).toEqual({ access_token: 'from-cache', token_type: 'Bearer' });
+    // Saving should propagate to both stores.
+    await persistence.saveTokens({ access_token: 'new-token', token_type: 'Bearer' });
+    const cacheTokens = (await readJsonFile(path.join(cacheDir, 'tokens.json'))) as
+      | { access_token: string }
+      | undefined;
+    expect(cacheTokens?.access_token).toBe('new-token');
+    const entry = await loadVaultEntry(definition);
+    expect(entry?.tokens?.access_token).toBe('new-token');
+  });
+
+  it('migrates legacy per-server cache into the vault', async () => {
+    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'mcporter-oauth-'));
+    tempRoots.push(tmp);
+    homedirSpy = vi.spyOn(os, 'homedir').mockReturnValue(tmp);
+    hasSpy = true;
+
+    const legacyDir = path.join(tmp, '.mcporter', 'legacy-service');
+    await fs.mkdir(legacyDir, { recursive: true });
+    await fs.writeFile(
+      path.join(legacyDir, 'tokens.json'),
+      JSON.stringify({ access_token: 'legacy-token', token_type: 'Bearer' })
+    );
+
+    const logger = { info: vi.fn(), warn: vi.fn(), error: vi.fn() } as const;
+    const definition = mkDef('legacy-service');
+    const persistence = await buildOAuthPersistence(definition, logger);
+
+    expect(await persistence.readTokens()).toEqual({ access_token: 'legacy-token', token_type: 'Bearer' });
+    const entry = await loadVaultEntry(definition);
+    expect(entry?.tokens?.access_token).toBe('legacy-token');
+    expect(logger.info).toHaveBeenCalledWith("Migrated legacy OAuth cache for 'legacy-service' into vault.");
+  });
+
+  it('clears vault, legacy, tokenCacheDir, and provider-specific caches', async () => {
+    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'mcporter-oauth-'));
+    tempRoots.push(tmp);
+    homedirSpy = vi.spyOn(os, 'homedir').mockReturnValue(tmp);
+    hasSpy = true;
+
+    const cacheDir = path.join(tmp, 'cache');
+    await fs.mkdir(cacheDir, { recursive: true });
+    await fs.writeFile(
+      path.join(cacheDir, 'tokens.json'),
+      JSON.stringify({ access_token: 'cached', token_type: 'Bearer' })
+    );
+
+    const legacyDir = path.join(tmp, '.mcporter', 'gmail');
+    await fs.mkdir(legacyDir, { recursive: true });
+    await fs.writeFile(
+      path.join(legacyDir, 'tokens.json'),
+      JSON.stringify({ access_token: 'legacy', token_type: 'Bearer' })
+    );
+
+    const gmailLegacyFile = path.join(tmp, '.gmail-mcp', 'credentials.json');
+    await fs.mkdir(path.dirname(gmailLegacyFile), { recursive: true });
+    await fs.writeFile(gmailLegacyFile, '{}');
+
+    const vaultPath = path.join(tmp, '.mcporter', 'credentials.json');
+    await fs.mkdir(path.dirname(vaultPath), { recursive: true });
+    const logger = { info: vi.fn(), warn: vi.fn(), error: vi.fn() } as const;
+    const definition = mkDef('gmail', cacheDir);
+    const key = vaultKeyForDefinition(definition);
+    await fs.writeFile(
+      vaultPath,
+      JSON.stringify({
+        version: 1,
+        entries: {
+          [key]: { serverName: 'gmail', updatedAt: new Date().toISOString(), tokens: { access_token: 'vault' } },
+        },
+      })
+    );
+
+    await clearOAuthCaches(definition, logger, 'all');
+
+    await expect(fs.access(path.join(cacheDir, 'tokens.json'))).rejects.toThrow();
+    await expect(fs.access(path.join(legacyDir, 'tokens.json'))).rejects.toThrow();
+    await expect(fs.access(gmailLegacyFile)).rejects.toThrow();
+    const entry = await loadVaultEntry(definition);
+    expect(entry).toBeUndefined();
+  });
+});

package/tests/oauth-session.test.ts

@@ -0,0 +1,216 @@
+import fs from 'node:fs/promises';
+import http from 'node:http';
+import os from 'node:os';
+import path from 'node:path';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import type { ServerDefinition } from '../src/config.js';
+import { __oauthInternals, createOAuthSession } from '../src/oauth.js';
+
+type StatefulProvider = {
+  redirectUrl: string | URL;
+  state: () => Promise<string>;
+  redirectToAuthorization: (authorizationUrl: URL) => Promise<void>;
+};
+
+const requestStatus = (target: URL): Promise<number> =>
+  new Promise((resolve, reject) => {
+    const req = http.request(
+      {
+        hostname: target.hostname,
+        port: target.port,
+        path: `${target.pathname}${target.search}`,
+        family: 4,
+        method: 'GET',
+      },
+      (res) => {
+        const status = res.statusCode ?? 0;
+        res.resume();
+        resolve(status);
+      }
+    );
+    req.on('error', reject);
+    req.end();
+  });
+
+describe('FileOAuthClientProvider session lifecycle', () => {
+  const tempDirs: string[] = [];
+
+  afterEach(async () => {
+    vi.restoreAllMocks();
+    await Promise.all(tempDirs.splice(0).map((dir) => fs.rm(dir, { recursive: true, force: true })));
+  });
+
+  it('rejects pending authorization waits when the session closes early', async () => {
+    const tokenCacheDir = await fs.mkdtemp(path.join(os.tmpdir(), 'mcporter-oauth-test-'));
+    tempDirs.push(tokenCacheDir);
+    const definition: ServerDefinition = {
+      name: 'test-oauth',
+      description: 'Test OAuth server',
+      command: { kind: 'http', url: new URL('https://example.com/mcp') },
+      auth: 'oauth',
+      tokenCacheDir,
+    };
+    const logger = {
+      info: vi.fn(),
+      warn: vi.fn(),
+      error: vi.fn(),
+    };
+
+    const session = await createOAuthSession(definition, logger);
+    const waitPromise = session.waitForAuthorizationCode();
+    await session.close();
+    await expect(waitPromise).rejects.toThrow(/closed before receiving authorization code/i);
+  });
+
+  it('uses oauthScope when explicitly configured', async () => {
+    const tokenCacheDir = await fs.mkdtemp(path.join(os.tmpdir(), 'mcporter-oauth-test-'));
+    tempDirs.push(tokenCacheDir);
+    const definition: ServerDefinition = {
+      name: 'test-oauth-scope',
+      description: 'Test OAuth server',
+      command: { kind: 'http', url: new URL('https://example.com/mcp') },
+      auth: 'oauth',
+      tokenCacheDir,
+      oauthScope: 'openid email profile',
+    };
+    const logger = {
+      info: vi.fn(),
+      warn: vi.fn(),
+      error: vi.fn(),
+    };
+
+    const session = await createOAuthSession(definition, logger);
+    expect((session.provider as { clientMetadata: { scope?: string } }).clientMetadata.scope).toBe(
+      'openid email profile'
+    );
+    await session.close();
+  });
+
+  it('clears stale client registrations when redirect URI changes with dynamic ports', async () => {
+    const tokenCacheDir = await fs.mkdtemp(path.join(os.tmpdir(), 'mcporter-oauth-test-'));
+    tempDirs.push(tokenCacheDir);
+    await fs.writeFile(
+      path.join(tokenCacheDir, 'client.json'),
+      JSON.stringify({ redirect_uris: ['http://127.0.0.1:9999/callback'] }, null, 2),
+      'utf8'
+    );
+    const definition: ServerDefinition = {
+      name: 'test-oauth-stale-client',
+      description: 'Test OAuth server',
+      command: { kind: 'http', url: new URL('https://example.com/mcp') },
+      auth: 'oauth',
+      tokenCacheDir,
+    };
+    const logger = {
+      info: vi.fn(),
+      warn: vi.fn(),
+      error: vi.fn(),
+    };
+
+    const session = await createOAuthSession(definition, logger);
+    await session.close();
+
+    await expect(fs.readFile(path.join(tokenCacheDir, 'client.json'), 'utf8')).rejects.toMatchObject({
+      code: 'ENOENT',
+    });
+    expect(logger.info).toHaveBeenCalledWith(expect.stringContaining('clearing stale client registration'));
+  });
+
+  it('closes the callback server when stale-client reads throw', async () => {
+    const tokenCacheDir = await fs.mkdtemp(path.join(os.tmpdir(), 'mcporter-oauth-test-'));
+    tempDirs.push(tokenCacheDir);
+    await fs.writeFile(path.join(tokenCacheDir, 'client.json'), '{not-valid-json', 'utf8');
+    const definition: ServerDefinition = {
+      name: 'test-oauth-read-failure',
+      description: 'Test OAuth server',
+      command: { kind: 'http', url: new URL('https://example.com/mcp') },
+      auth: 'oauth',
+      tokenCacheDir,
+    };
+    const logger = {
+      info: vi.fn(),
+      warn: vi.fn(),
+      error: vi.fn(),
+    };
+
+    const originalCreateServer = http.createServer.bind(http);
+    const createdServers: http.Server[] = [];
+    const createServerSpy = vi.spyOn(http, 'createServer').mockImplementation((...args) => {
+      const server = originalCreateServer(...args);
+      createdServers.push(server);
+      return server;
+    });
+
+    try {
+      await expect(createOAuthSession(definition, logger)).rejects.toThrow(SyntaxError);
+      await new Promise((resolve) => setTimeout(resolve, 0));
+      expect(createdServers).toHaveLength(1);
+      expect(createdServers[0]?.listening).toBe(false);
+    } finally {
+      createServerSpy.mockRestore();
+    }
+  });
+
+  it('resolves waiters created before redirectToAuthorization', async () => {
+    const tokenCacheDir = await fs.mkdtemp(path.join(os.tmpdir(), 'mcporter-oauth-test-'));
+    tempDirs.push(tokenCacheDir);
+    const definition: ServerDefinition = {
+      name: 'test-oauth-wait-before-redirect',
+      description: 'Test OAuth server',
+      command: { kind: 'http', url: new URL('https://example.com/mcp') },
+      auth: 'oauth',
+      tokenCacheDir,
+    };
+    const logger = {
+      info: vi.fn(),
+      warn: vi.fn(),
+      error: vi.fn(),
+    };
+
+    const session = await createOAuthSession(definition, logger);
+    const provider = session.provider as StatefulProvider;
+    vi.spyOn(__oauthInternals, 'openExternal').mockImplementation(() => {});
+    const waitPromise = session.waitForAuthorizationCode();
+    await provider.redirectToAuthorization(new URL('https://example.com/auth'));
+
+    const callback = new URL(String(provider.redirectUrl));
+    callback.hostname = '127.0.0.1';
+    callback.searchParams.set('code', 'prewait-code');
+    const status = await requestStatus(callback);
+    expect(status).toBe(200);
+    await expect(waitPromise).resolves.toBe('prewait-code');
+    await session.close();
+  });
+
+  it('does not replace the pending authorization deferred on repeated redirect calls', async () => {
+    const tokenCacheDir = await fs.mkdtemp(path.join(os.tmpdir(), 'mcporter-oauth-test-'));
+    tempDirs.push(tokenCacheDir);
+    const definition: ServerDefinition = {
+      name: 'test-oauth-repeat-redirect',
+      description: 'Test OAuth server',
+      command: { kind: 'http', url: new URL('https://example.com/mcp') },
+      auth: 'oauth',
+      tokenCacheDir,
+    };
+    const logger = {
+      info: vi.fn(),
+      warn: vi.fn(),
+      error: vi.fn(),
+    };
+
+    const session = await createOAuthSession(definition, logger);
+    const provider = session.provider as StatefulProvider;
+    vi.spyOn(__oauthInternals, 'openExternal').mockImplementation(() => {});
+    const waitPromise = session.waitForAuthorizationCode();
+    await provider.redirectToAuthorization(new URL('https://example.com/auth-one'));
+    await provider.redirectToAuthorization(new URL('https://example.com/auth-two'));
+
+    const callback = new URL(String(provider.redirectUrl));
+    callback.hostname = '127.0.0.1';
+    callback.searchParams.set('code', 'stable-deferred-code');
+    const status = await requestStatus(callback);
+    expect(status).toBe(200);
+    await expect(waitPromise).resolves.toBe('stable-deferred-code');
+    await session.close();
+  });
+});