@pi-archimedes/mcp 2.5.1 → 2.6.2

package/README.md

@@ -1,39 +1,42 @@
 # @pi-archimedes/mcp
 
-Full-featured MCP client adapter with a pi-native TUI — feature parity with pi-mcp-adapter.
+**Bring the tools you already use.**
 
-Connect any MCP server (stdio or HTTP/SSE), call its tools through a single `mcp` proxy tool or per-server direct tools, manage servers and OAuth flows interactively, and browse cached tool metadata offline — all without leaving the terminal.
-
-## What you get
-
-- **`mcp` gateway tool** — search, describe, and call tools across all configured servers; also handles `status`, per-server tool listing, and eager `connect` without opening every server upfront
-- **Per-server direct tools** — each server's tools registered as `{server}_{tool}` for token-efficient calls; a per-server `directTools` array narrows the set to named tools only
-- **`/mcp` command family** — status, tools, prompts, reconnect, enable/disable, logout, auth, management panel, and setup panel — everything in one command namespace
-- **OAuth 2.1 + PKCE** — browser auth flow for protected servers (Atlassian, Notion, GitHub, …), OS credential-store persistence, SDK-driven token refresh
-- **Lifecycle management** — `keep-alive`, `lazy`, `lazy-keep-alive`, or `eager` per server, with configurable idle timeout
-- **Metadata cache** — `~/.pi/agent/mcp-cache.json` (7-day validity) lets search/describe work offline and persists each server's last connection outcome so `needs-auth`/errors survive restarts
-- **Compact two-line tool rendering** — `mcp <target>` header (cyan + orange) plus a key-arg summary; full args and output hidden until expanded with `ctrl+o`
-- **Layered config** — six config files, lowest → highest precedence; safe single-field write-back that never touches credentials or unrelated servers
+Your MCP servers — stdio or HTTP/SSE — can talk to Pi without leaving the terminal. One `mcp` tool reaches every server (or per-server direct tools for token-efficient calls), `/mcp` is a single command namespace for management and auth, and the setup wizard imports server definitions from Cursor, Claude Code, Claude Desktop, and VS Code. Start with `/mcp setup`; manage with `/mcp`.
 
 ## Install
 
+Standalone:
+
 ```bash
 pi install npm:@pi-archimedes/mcp
 ```
 
-Or install the full meta package:
+Or the full suite instead:
 
 ```bash
 pi install npm:pi-archimedes
 ```
 
+New to Pi? Pi itself is a one-time global install and needs Node.js ≥ 22.19.0 — `npm install -g --ignore-scripts @earendil-works/pi-coding-agent`; Pi's [quickstart](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/quickstart.md) covers authentication and [provider docs](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md) list the supported providers. After installing Pi, choose one installation command above, then `cd` into your project and run `pi`, and in the session use `/login` + `/model` — the [setup section](https://github.com/danielcherubini/pi-archimedes#setup) covers the first run. `/reload` picks up both new extensions and new server configs.
+
+## What you get
+
+- **`mcp` gateway tool** — search, describe, and call tools across all configured servers; also `status`, per-server tool listing, and eager `connect`, without opening every server upfront.
+- **Per-server direct tools** — each server's tools registered as `{server}_{tool}` for direct, token-efficient calls; a per-server `directTools` array narrows the set to named tools.
+- **`/mcp` command family** — status, tools, prompts, reconnect, enable/disable, logout, auth, management panel, setup panel — one namespace.
+- **OAuth 2.1 + PKCE** — interactive browser auth for protected servers, with OS credential-store persistence and SDK-driven refresh.
+- **Lifecycle management** — `keep-alive`, `lazy` (default), `lazy-keep-alive`, or `eager` per server, with an idle timeout.
+- **Metadata cache** — `~/.pi/agent/mcp-cache.json` (7-day validity) lets search/describe work offline and persists each server's last connection outcome, so `needs-auth`/errors survive restarts.
+- **Compact two-line tool rendering** — an `mcp <target>` header with a key-argument summary; full args and output expand with `ctrl+o`.
+- **Layered config** — six config files, lowest → highest precedence, with a safe single-field write-back that never touches credentials or unrelated servers.
+
 ## Quick start
 
-1. Create or edit a config file — the project-shared one is usually the right place:
+1. **`/mcp setup`** — the recommended path. It scaffolds `.mcp.json`, adds curated presets (context7, chrome-devtools, deepwiki, fetch), and imports server definitions from Cursor, Claude Code, Claude Desktop, and VS Code — with a preview of which names will be added before anything is written.
+2. Or edit a config file by hand. The project-shared `<project>/.mcp.json` is usually the right place. **Merge deliberately — do not `cat > .mcp.json`**, which silently destroys settings for other servers:
 
-   ```bash
-   # in your project root
-   cat > .mcp.json <<'EOF'
+   ```json
    {
      "mcpServers": {
        "context7": {
@@ -42,14 +45,10 @@ pi install npm:pi-archimedes
        }
      }
    }
-   EOF
    ```
 
-   Or use `/mcp setup` to scaffold it interactively (see below).
-
-2. `/reload` to pick up the new config.
-
-3. The `mcp` tool and direct tools (`context7_*`) are now available. Check with `/mcp status`.
+3. `/reload` to pick up the new config.
+4. The `mcp` tool and direct tools (`context7_*`) are now available; check with `/mcp status`.
 
 ## `/mcp` command reference
 
@@ -95,7 +94,7 @@ Onboarding for a new project. All writes target the project-shared `.mcp.json`.
 
 - **Scaffold** — writes `{ "mcpServers": {} }` only when the file is absent
 - **Add a known server** — curated preset list (context7, chrome-devtools, deepwiki, fetch); existing entries are never overwritten
-- **Import from another tool** — discovers MCP configs from Cursor, Claude Code, Claude Desktop, and VSCode; shows a preview of which server names will be added before writing; names already in `.mcp.json` are kept untouched
+- **Import from another tool** — discovers MCP configs from Cursor, Claude Code, Claude Desktop, and VS Code. The six candidate files, in scan order, are `~/.cursor/mcp.json` and `<project>/.cursor/mcp.json` (`mcpServers` key), `~/.claude/mcp.json` and `~/.claude.json` (`mcpServers`), `~/.claude/claude_desktop_config.json` (`mcpServers`), and `<project>/.vscode/mcp.json` (its key is `servers`, not `mcpServers`); shows a preview of which server names will be added before writing; names already in `.mcp.json` are kept untouched
 
 ## OAuth
 
@@ -107,9 +106,19 @@ Three paths reach the same auth entry point:
 
 Token details:
 
-- Tokens persist in the OS credential store (macOS Keychain / Windows Credential Manager / Linux libsecret) — no plaintext fallback
-- Token refresh is SDK-driven; a pre-registered public client (`clientId` without `clientSecret`) is never auto-refreshed — re-run `/mcp auth <server>` when its token expires
-- The `auth` field on http/sse servers accepts `{ "token": "…" }` (static bearer), `"oauth"` (defaults), or a full `McpOAuthConfig` object
+- Tokens persist in the OS credential store (macOS Keychain / Windows Credential Manager / Linux Secret Service). Storage is **fail-closed**: if the keyring is unavailable, auth operations throw a clear error — there is never a plaintext fallback.
+- Token refresh is SDK-driven; a pre-registered public client (`clientId` without `clientSecret`) is never auto-refreshed — re-run `/mcp auth <server>` when its token expires.
+- The `auth` field on http/sse servers accepts `{ "token": "…" }` (static bearer), `"oauth"`, or a full `McpOAuthConfig` object. `auth: "oauth"` (or a config object with at least one field below) is what enables OAuth with the default grant settings; a valid object can override them. **Omitting `auth` does not automatically enable OAuth** — there is no implicit OAuth default, but static authentication can still be supplied through `bearerTokenEnv` or `headers`:
+
+| `McpOAuthConfig` field | Meaning |
+|------------------------|---------|
+| `grantType` | `"authorization_code"` (default) or `"client_credentials"` |
+| `clientId` | client identifier |
+| `clientSecret` | string, literal only — no `!command` resolution |
+| `scope` | space-separated scopes |
+| `redirectUri` | pre-registered clients only |
+| `clientName` | human name, shown in consent screens |
+| `authorizationServerUrl` | reserved — parsed but not yet used |
 
 ## Config files & write-back
 
@@ -120,11 +129,11 @@ Six layers load in order, lowest → highest precedence (per-server field-level
 | 1 | `~/.config/mcp/mcp.json` | Global (standard MCP location) |
 | 2 | `~/.agents/mcp.json` | Cross-agent (home) |
 | 3 | `~/.agents/mcp/mcp.json` | Cross-agent (home, alternate) |
-| 4 | `~/.pi/agent/mcp.json` | Pi agent directory |
+| 4 | `<agentDir>/mcp.json` (agent directory is `$PI_CODING_AGENT_DIR`, defaulting to `~/.pi/agent`) | Pi agent directory |
 | 5 | `<project>/.mcp.json` | Project-shared (committable) |
 | 6 | `<project>/.pi/mcp.json` | Pi override — highest precedence |
 
-Files accept `//` comments and trailing commas. When a higher-precedence layer changes a server's `url`, inherited `auth`/`headers`/`bearerTokenEnv` from lower layers are dropped — credentials are never sent to an endpoint you didn't explicitly configure them for.
+The `mcp.json` files (including layer 4's `<agentDir>/mcp.json`) accept `//` comments and trailing commas (**JSONC**). That does not apply to Archimedes settings — `~/.pi/agent/settings.json` is **strict JSON**, parsed without comment support. When a higher-precedence layer changes a server's `url`, inherited `auth`/`headers`/`bearerTokenEnv` from lower layers are dropped — credentials are never sent to an endpoint you didn't explicitly configure them for.
 
 Write-back targets:
 
@@ -135,7 +144,7 @@ Changes take effect on the next `/reload`.
 
 ## Settings
 
-Settings are stored in `~/.pi/agent/settings.json` under the `archimedes.mcp` namespace.
+`~/.pi/agent/settings.json`, under `archimedes.mcp` (strict JSON):
 
 | Setting | Type | Default | Description |
 |---------|------|---------|-------------|
@@ -165,6 +174,6 @@ Per-server overrides (in the `mcp.json` server definition):
 
 ## Integration
 
-When installed via `pi-archimedes` (the meta package), the MCP adapter is automatically registered. Tool rendering uses Core's chrome and color palette. Standalone installation works independently — the full feature set is available without the meta package.
+In the [suite](https://github.com/danielcherubini/pi-archimedes), the MCP adapter is registered with the rest — tool rendering uses core's chrome and colour palette, and a blocking OAuth loader triggers the notify extension's prompts. Standalone, the full feature set works independently. On/off in the suite is managed by `/plugins` (`archimedes.mcp.enabled`, default on).
 
-← Back to [pi-archimedes](../../README.md)
+← [Back to pi-archimedes](https://github.com/danielcherubini/pi-archimedes)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-archimedes/mcp",
-  "version": "2.5.1",
+  "version": "2.6.2",
   "type": "module",
   "keywords": [
     "pi-package"
@@ -17,7 +17,7 @@
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@napi-rs/keyring": "^1.3.0",
     "open": "^10.2.0",
-    "@pi-archimedes/core": "2.5.1"
+    "@pi-archimedes/core": "2.6.2"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": ">=0.1.0",
@@ -25,8 +25,8 @@
     "typebox": ">=1.1.0"
   },
   "devDependencies": {
-    "@earendil-works/pi-coding-agent": "^0.84.4",
-    "@earendil-works/pi-tui": "^0.84.4",
+    "@earendil-works/pi-coding-agent": "^0.85.1",
+    "@earendil-works/pi-tui": "^0.85.1",
     "@types/node": "^22.0.0",
     "typebox": "^1.1.38",
     "typescript": "^6.0.3"

package/src/auth-flow.ts

@@ -57,6 +57,15 @@ export type AuthStatus =
 export interface AuthenticateOptions {
   /** Called once when the SDK builds the authorization URL (e.g. to open a browser). */
   onAuthorizationUrl?: (url: URL) => void | Promise<void>;
+  /**
+   * Called after the authorization URL is opened, giving the caller a chance
+   * to prompt the user to paste the full callback URL (for remote/headless
+   * environments where the browser cannot reach the local callback server).
+   * Should resolve with the pasted text, or undefined/empty to cancel.
+   * When provided, it races with the local callback server; whichever wins
+   * first completes the flow.
+   */
+  onAuthorizationInput?: (url: URL, signal: AbortSignal) => Promise<string | undefined>;
   /** Cancels the callback wait; the flow rethrows the abort error. */
   signal?: AbortSignal;
 }
@@ -132,6 +141,52 @@ function describeError(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
 }
 
+/**
+ * Parse an authorization code from a pasted raw code or full callback URL.
+ * Returns `{ code, iss? }` on success, throws a descriptive error otherwise.
+ */
+function parseCallbackInput(input: string, expectedState?: string): { code: string; iss?: string } {
+  const trimmed = input.trim();
+  if (!trimmed) throw new Error("Authorization code or redirect URL is required");
+
+  // Try to parse as a URL (full callback redirect)
+  let params: URLSearchParams | undefined;
+  try {
+    params = new URL(trimmed).searchParams;
+  } catch {
+    // Not a URL — try treating it as a query string
+    if (trimmed.includes("code=")) {
+      try {
+        params = new URLSearchParams(trimmed.includes("?") ? trimmed.slice(trimmed.indexOf("?") + 1) : trimmed);
+      } catch {
+        // ignore
+      }
+    }
+  }
+
+  if (params) {
+    const error = params.get("error");
+    if (error) {
+      const description = params.get("error_description");
+      throw new Error(description ? `${error}: ${description}` : error);
+    }
+    const state = params.get("state");
+    if (expectedState && state && state !== expectedState) {
+      throw new Error("OAuth state mismatch — potential CSRF attack");
+    }
+    const code = params.get("code");
+    if (code) {
+      const iss = params.get("iss") ?? undefined;
+      return { code, ...(iss !== undefined ? { iss } : {}) };
+    }
+  }
+
+  // Treat as a raw authorization code
+  if (/^[A-Za-z0-9._~+/=:-]+$/.test(trimmed)) return { code: trimmed };
+
+  throw new Error("Could not find an authorization code in the provided input");
+}
+
 /**
  * Build the host callbacks for the provider. exactOptionalPropertyTypes:
  * `OAuthCallbacks.onAuthorizationUrl` is an optional property whose type
@@ -226,16 +281,44 @@ export async function authenticate(
     // redirectToAuthorization → onAuthorizationUrl (opens the browser).
     await auth(provider, { serverUrl });
 
-    const resPromise = waitForCallback(state, options.signal);
+    const callbackPromise = waitForCallback(state, options.signal);
     // Eager no-op rejection sink: `waitForCallback` can reject before we
     // reach the await (already-aborted signal), and an unhandled rejection
     // during that window would crash the process. The awaited promise below
     // still observes the same rejection.
-    resPromise.catch(() => undefined);
-    const { code } = await resPromise;
+    callbackPromise.catch(() => undefined);
+
+    let result: { code: string; iss?: string };
+    if (options.onAuthorizationInput) {
+      // Race the local callback server against manual user input (for remote
+      // or headless environments where the browser redirect can't reach us).
+      const inputController = new AbortController();
+      const authorizationUrl = new URL(
+        `http://localhost:${boundPort}/callback?state=${encodeURIComponent(state)}`,
+      );
+      try {
+        const winner = await Promise.race([
+          callbackPromise.then((r) => ({ source: "callback" as const, result: r })),
+          options
+            .onAuthorizationInput(authorizationUrl, inputController.signal)
+            .then((pasted) => ({ source: "manual" as const, pasted })),
+        ]);
+        if (winner.source === "callback") {
+          result = winner.result;
+        } else {
+          // Manual input won — parse the pasted text
+          if (!winner.pasted?.trim()) throw new Error("OAuth authentication cancelled");
+          result = parseCallbackInput(winner.pasted, state);
+        }
+      } finally {
+        inputController.abort();
+      }
+    } else {
+      result = await callbackPromise;
+    }
 
     // SDK: exchange the code for tokens (persists via provider.saveTokens).
-    await auth(provider, { serverUrl, authorizationCode: code });
+    await auth(provider, { serverUrl, authorizationCode: result.code });
     return { status: "authenticated" };
   } catch (error) {
     if (options.signal?.aborted) throw error;

package/src/auth-run.test.ts

@@ -8,17 +8,8 @@ import { openAuthUrl, reconnectAfterAuth, runAuthWithLoader } from "./auth-run.j
 import { loadMetadataCache, setCachePathForTest } from "./metadata-cache.js";
 import type { ServerClient } from "./server-client.js";
 
-// The real BorderedLoader needs a live TUI; a stub with the same surface
-// (constructor message + onAbort) is enough to drive the auth runner.
 vi.mock("@earendil-works/pi-coding-agent", () => ({
-  BorderedLoader: class {
-    message: string;
-    onAbort?: () => void;
-    constructor(_tui: unknown, _theme: unknown, message: string) {
-      this.message = message;
-    }
-    dispose() {}
-  },
+  getAgentDir: () => `${process.env.TMPDIR ?? "/tmp"}/pi-archimedes-mock-agent`,
 }));
 vi.mock("open", () => ({ default: vi.fn().mockResolvedValue({}) }));
 
@@ -38,7 +29,7 @@ afterEach(() => {
 });
 
 const AUTH_URL = "https://as.example/authorize?state=xyz";
-const LABEL = "Authenticating srv… (esc to cancel)";
+const LABEL = "Authenticating srv…";
 
 // ── fakes ────────────────────────────────────────────────────────────────────
 
@@ -68,7 +59,6 @@ function makeFakeClient(opts: FakeClientOpts = {}) {
     close: vi.fn().mockResolvedValue(undefined),
     connect: vi.fn().mockImplementation(async () => {
       if (opts.reconnectError) {
-        // Mirror the real client: a thrown connect settles into "error".
         client.status = "error";
         client.error = opts.reconnectError;
         throw new Error(opts.reconnectError);
@@ -96,8 +86,6 @@ function makeFakeClient(opts: FakeClientOpts = {}) {
           return Promise.reject(new Error(opts.error ?? "boom"));
         default:
           if (opts.invokeAuthUrl) {
-            // Resolve only after the URL hook settles, so `open()` and the
-            // notification are guaranteed to have run before success.
             return Promise.resolve(options?.onAuthorizationUrl?.(new URL(AUTH_URL))).then(
               () => undefined,
             );
@@ -109,114 +97,60 @@ function makeFakeClient(opts: FakeClientOpts = {}) {
   return client;
 }
 
-interface FakeLoader {
-  message: string;
-  onAbort?: () => void;
-}
-
-interface CtxState {
-  notify: ReturnType<typeof vi.fn>;
-  custom: ReturnType<typeof vi.fn>;
-  lastLoader: () => FakeLoader | null;
-}
-
-/** Fake ExtensionContext: custom() runs the factory synchronously and
- *  resolves when done() is first called; the loader is captured. */
-function makeCtx(): { ctx: ExtensionContext; state: CtxState } {
-  const state: Omit<CtxState, "lastLoader"> = { notify: vi.fn(), custom: vi.fn() };
-  let lastLoader: FakeLoader | null = null;
-  state.custom.mockImplementation(
-    (factory: (
-      tui: unknown,
-      theme: unknown,
-      keybindings: unknown,
-      done: (result: unknown) => void,
-    ) => unknown) => {
-      let resolve!: (result: unknown) => void;
-      const pending = new Promise<unknown>((r) => (resolve = r));
-      let settled = false;
-      const done = (result: unknown) => {
-        if (!settled) {
-          settled = true;
-          resolve(result);
-        }
-      };
-      lastLoader = factory({}, {}, {}, done) as FakeLoader | null;
-      return pending;
-    },
-  );
+function makeCtx() {
+  const notify = vi.fn();
+  const setStatus = vi.fn();
+  const confirm = vi.fn().mockResolvedValue(false);
+  const input = vi.fn().mockResolvedValue(undefined);
   const ctx = {
     hasUI: true,
-    ui: { notify: state.notify, custom: state.custom },
+    ui: { notify, setStatus, confirm, input },
   } as unknown as ExtensionContext;
-  return { ctx, state: { ...state, lastLoader: () => lastLoader } };
+  return { ctx, notify, setStatus, confirm, input };
 }
 
 // ── runAuthWithLoader ────────────────────────────────────────────────────────
 
 describe("runAuthWithLoader", () => {
-  it("opens the URL, notifies, reconnects, and returns the reconnected status", async () => {
+  it("notifies the URL first, opens the browser, reconnects, returns reconnected", async () => {
     const client = makeFakeClient({ outcome: "success", invokeAuthUrl: true, toolCount: 3 });
-    const { ctx, state } = makeCtx();
+    const { ctx, notify, setStatus } = makeCtx();
     const outcome = await runAuthWithLoader(ctx, client as unknown as ServerClient, {
       loaderLabel: LABEL,
     });
 
     expect(outcome).toEqual({ kind: "reconnected", status: "connected", tools: 3 });
-    // Loader shown with the caller-supplied label
-    expect(state.custom).toHaveBeenCalledTimes(1);
-    expect(state.lastLoader()!.message).toBe(LABEL);
-    // authenticate called once with an (unaborted) abort signal + URL hook
-    expect(client.authenticate).toHaveBeenCalledTimes(1);
-    const opts = client.authenticate.mock.calls[0]![0] as {
-      signal: AbortSignal;
-      onAuthorizationUrl: (u: URL) => Promise<void>;
-    };
-    expect(opts.signal.aborted).toBe(false);
-    // Browser opened for the auth URL, user notified of it
-    expect(open).toHaveBeenCalledWith(AUTH_URL);
-    expect(state.notify).toHaveBeenCalledWith(
-      `Opening browser… if it didn't open, visit: ${AUTH_URL}`,
+    // Status set during, cleared after
+    expect(setStatus).toHaveBeenCalledWith("mcp-auth-srv", LABEL);
+    expect(setStatus).toHaveBeenLastCalledWith("mcp-auth-srv", undefined);
+    // Notification fired with URL (before open)
+    expect(notify).toHaveBeenCalledWith(
+      expect.stringContaining(AUTH_URL),
       "info",
     );
+    // Browser opened
+    expect(open).toHaveBeenCalledWith(AUTH_URL);
     // Reconnect to pick up the freshly stored token
     expect(client.close).toHaveBeenCalledTimes(1);
     expect(client.connect).toHaveBeenCalledTimes(1);
   });
 
-  it("reports cancelled (no reconnect) when the loader is esc-closed", async () => {
-    const client = makeFakeClient({ outcome: "wait" });
-    const { ctx, state } = makeCtx();
-    const running = runAuthWithLoader(ctx, client as unknown as ServerClient, {
-      loaderLabel: LABEL,
-    });
-    await vi.waitFor(() => expect(client.authenticate).toHaveBeenCalledTimes(1));
-    const opts = client.authenticate.mock.calls[0]![0] as { signal: AbortSignal };
-    expect(opts.signal.aborted).toBe(false);
-
-    // Simulate Esc in the loader
-    state.lastLoader()!.onAbort!();
-    const outcome = await running;
-
-    expect(outcome).toEqual({ kind: "cancelled" });
-    expect(opts.signal.aborted).toBe(true);
-    expect(client.close).not.toHaveBeenCalled();
-    expect(client.connect).not.toHaveBeenCalled();
+  it("clears setStatus even when the flow fails", async () => {
+    const client = makeFakeClient({ outcome: "throw", error: "boom" });
+    const { ctx, setStatus } = makeCtx();
+    await runAuthWithLoader(ctx, client as unknown as ServerClient, { loaderLabel: LABEL });
+    expect(setStatus).toHaveBeenLastCalledWith("mcp-auth-srv", undefined);
   });
 
-  it("treats a flow rejection of exactly 'OAuth cancelled' as cancelled", async () => {
-    // Externally aborted flow rejects "OAuth cancelled" without the loader
-    // ever settling via onAbort.
+  it("treats 'OAuth cancelled' rejection as cancelled (no reconnect)", async () => {
     const client = makeFakeClient({ outcome: "throw", error: "OAuth cancelled" });
-    const { ctx, state: s } = makeCtx();
-    const running = runAuthWithLoader(ctx, client as unknown as ServerClient, {
+    const { ctx } = makeCtx();
+    const outcome = await runAuthWithLoader(ctx, client as unknown as ServerClient, {
       loaderLabel: LABEL,
     });
-    // Esc is NOT pressed — only the flow rejection decides.
-    const outcome = await running;
     expect(outcome).toEqual({ kind: "cancelled" });
     expect(client.close).not.toHaveBeenCalled();
-    expect(s.notify).not.toHaveBeenCalled();
+    expect(client.connect).not.toHaveBeenCalled();
   });
 
   it("surfaces other flow failures as flow-error without reconnecting", async () => {
@@ -227,10 +161,9 @@ describe("runAuthWithLoader", () => {
     });
     expect(outcome).toEqual({ kind: "flow-error", error: "token endpoint refused" });
     expect(client.close).not.toHaveBeenCalled();
-    expect(client.connect).not.toHaveBeenCalled();
   });
 
-  it("reports a failed reconnect as reconnect-failed with the error message", async () => {
+  it("reports a failed reconnect as reconnect-failed", async () => {
     const client = makeFakeClient({ reconnectError: "connection refused" });
     const { ctx } = makeCtx();
     const outcome = await runAuthWithLoader(ctx, client as unknown as ServerClient, {
@@ -248,6 +181,16 @@ describe("runAuthWithLoader", () => {
     });
     expect(outcome).toEqual({ kind: "reconnected", status: "needs-auth", tools: 0 });
   });
+
+  it("passes onAuthorizationInput to authenticate", async () => {
+    const client = makeFakeClient({ outcome: "success" });
+    const { ctx } = makeCtx();
+    await runAuthWithLoader(ctx, client as unknown as ServerClient, { loaderLabel: LABEL });
+    const opts = client.authenticate.mock.calls[0]![0] as {
+      onAuthorizationInput?: unknown;
+    };
+    expect(typeof opts.onAuthorizationInput).toBe("function");
+  });
 });
 
 // ── reconnectAfterAuth ───────────────────────────────────────────────────────
@@ -271,10 +214,7 @@ describe("reconnectAfterAuth", () => {
 
   it("records 'connected' in the ADR 0004 ledger after a successful reconnect", async () => {
     const client = makeFakeClient({ statusAfterReconnect: "connected", toolCount: 2 });
-    const outcome = await reconnectAfterAuth(client as unknown as ServerClient);
-    expect(outcome).toEqual({ kind: "reconnected", status: "connected", tools: 2 });
-    // The persisted outcome ledger (ADR 0004) must reflect the settled
-    // connection — a stale "needs-auth" here would stick across sessions.
+    await reconnectAfterAuth(client as unknown as ServerClient);
     const rec = loadMetadataCache().serverStatuses?.["srv"];
     expect(rec?.status).toBe("connected");
     expect(rec?.at).toBeTypeOf("number");
@@ -283,10 +223,7 @@ describe("reconnectAfterAuth", () => {
 
   it("records 'error' with the failure message when the post-auth reconnect fails", async () => {
     const client = makeFakeClient({ reconnectError: "connection refused" });
-    const outcome = await reconnectAfterAuth(client as unknown as ServerClient);
-    expect(outcome).toEqual({ kind: "reconnect-failed", error: "connection refused" });
-    // The fake settles into "error" like the real client does for a thrown
-    // connect — recordClientOutcome maps that to a recorded failure.
+    await reconnectAfterAuth(client as unknown as ServerClient);
     const rec = loadMetadataCache().serverStatuses?.["srv"];
     expect(rec?.status).toBe("error");
     expect(rec?.error).toBe("connection refused");