@testdriverai/agent 7.11.164-test → 7.11.165-test

package/mcp-server/dist/http-auth.d.ts

@@ -3,8 +3,25 @@
  *
  * OAuth 2.0 Resource Server helpers for the standalone TestDriver MCP server's
  * Streamable HTTP transport. Identity is delegated to Auth0 — this server only
- * *validates* the Bearer JWTs Auth0 issues for the TestDriver API audience and
- * advertises Auth0 as the authorization server via RFC 9728 metadata.
+ * *validates* the Bearer JWTs Auth0 issues for the TestDriver API audience.
+ *
+ * Auth0 cannot be advertised as the authorization server directly. MCP clients
+ * discover it, register through Dynamic Client Registration — which at Auth0
+ * always yields a *third-party* client — and then call `/authorize` with the
+ * RFC 8707 `resource` parameter and no `audience`. Auth0 ignores `resource`,
+ * falls back to its default `/userinfo` audience, and rejects the request:
+ * "The userinfo audience is not allowed for third party clients." Even if it
+ * succeeded, a `/userinfo`-audience token is opaque and would fail the JWT
+ * verification below, which requires `aud === MCP_AUDIENCE`.
+ *
+ * So this server advertises *itself* as the authorization server (RFC 8414) and
+ * proxies exactly one endpoint: `/authorize` redirects to Auth0 with
+ * `audience=<MCP_AUDIENCE>` injected. Token exchange, client registration and
+ * JWKS point straight at Auth0, so no credentials pass through us. The metadata
+ * `issuer` is therefore this server while issued tokens carry Auth0's `iss`;
+ * that is inherent to the proxy pattern and fine because access tokens are
+ * opaque to OAuth clients — only we, the resource server, read `iss`, and we
+ * check it against TRUSTED_ISSUERS.
  *
  * When OAuth is disabled (no `TD_MCP_AUTH=oauth`), everything here is a no-op so
  * local stdio / trusted-network usage is unchanged.
@@ -13,8 +30,33 @@ import type { IncomingMessage } from "http";
 import { type JWTPayload } from "jose";
 /** Whether OAuth enforcement is enabled for the HTTP transport. */
 export declare function isOAuthEnabled(): boolean;
-/** RFC 9728 protected resource metadata document. */
+/**
+ * RFC 9728 protected resource metadata document.
+ *
+ * `authorization_servers` is *this* server, not Auth0: clients must go through
+ * our `/authorize` so the Auth0 API audience gets injected (see the file
+ * header). They then discover the rest from our RFC 8414 document below.
+ */
 export declare function protectedResourceMetadata(req: IncomingMessage, mcpPath: string): Record<string, unknown>;
+/**
+ * RFC 8414 authorization server metadata. Only `authorization_endpoint` is
+ * ours; token exchange, Dynamic Client Registration and JWKS go straight to
+ * Auth0, so no client credentials or codes pass through this server.
+ */
+export declare function authorizationServerMetadata(req: IncomingMessage): Record<string, unknown>;
+/**
+ * Translate an inbound request to our `/authorize` into the upstream Auth0
+ * authorization URL. Every client parameter is forwarded verbatim — including
+ * `state`, `code_challenge` and `redirect_uri`, which stay end-to-end between
+ * the client and Auth0 — with two changes:
+ *
+ *   - `audience` is set to MCP_AUDIENCE. This is the whole point of the hop:
+ *     without it Auth0 defaults to the `/userinfo` audience and refuses the
+ *     third-party (DCR-registered) client outright.
+ *   - `resource` is dropped. Auth0 keys tokens on `audience`, and forwarding a
+ *     resource indicator alongside it only risks the two disagreeing.
+ */
+export declare function authorizeRedirectUrl(requestUrl: URL): string;
 /** Build the `WWW-Authenticate` challenge header value. */
 export declare function wwwAuthenticate(req: IncomingMessage, opts?: {
     error?: string;

package/mcp-server/dist/http-auth.js

@@ -3,8 +3,25 @@
  *
  * OAuth 2.0 Resource Server helpers for the standalone TestDriver MCP server's
  * Streamable HTTP transport. Identity is delegated to Auth0 — this server only
- * *validates* the Bearer JWTs Auth0 issues for the TestDriver API audience and
- * advertises Auth0 as the authorization server via RFC 9728 metadata.
+ * *validates* the Bearer JWTs Auth0 issues for the TestDriver API audience.
+ *
+ * Auth0 cannot be advertised as the authorization server directly. MCP clients
+ * discover it, register through Dynamic Client Registration — which at Auth0
+ * always yields a *third-party* client — and then call `/authorize` with the
+ * RFC 8707 `resource` parameter and no `audience`. Auth0 ignores `resource`,
+ * falls back to its default `/userinfo` audience, and rejects the request:
+ * "The userinfo audience is not allowed for third party clients." Even if it
+ * succeeded, a `/userinfo`-audience token is opaque and would fail the JWT
+ * verification below, which requires `aud === MCP_AUDIENCE`.
+ *
+ * So this server advertises *itself* as the authorization server (RFC 8414) and
+ * proxies exactly one endpoint: `/authorize` redirects to Auth0 with
+ * `audience=<MCP_AUDIENCE>` injected. Token exchange, client registration and
+ * JWKS point straight at Auth0, so no credentials pass through us. The metadata
+ * `issuer` is therefore this server while issued tokens carry Auth0's `iss`;
+ * that is inherent to the proxy pattern and fine because access tokens are
+ * opaque to OAuth clients — only we, the resource server, read `iss`, and we
+ * check it against TRUSTED_ISSUERS.
  *
  * When OAuth is disabled (no `TD_MCP_AUTH=oauth`), everything here is a no-op so
  * local stdio / trusted-network usage is unchanged.
@@ -14,7 +31,12 @@ import { createRemoteJWKSet, jwtVerify } from "jose";
 export function isOAuthEnabled() {
     return (process.env.TD_MCP_AUTH || "").toLowerCase() === "oauth";
 }
-/** Canonical resource identifier (RFC 8707) = the Auth0 API audience. */
+/**
+ * The Auth0 API audience every access token must be minted for. This is what we
+ * inject into the proxied `/authorize` and what `authenticate()` asserts as
+ * `aud`. Note this is NOT the RFC 8707 resource identifier (that is the MCP
+ * endpoint URL, see `resourceUrl()`); Auth0 keys tokens on `audience` alone.
+ */
 const MCP_AUDIENCE = process.env.TD_AUTH0_AUDIENCE || "https://api.testdriver.ai";
 /** Auth0 issuer(s) trusted to mint tokens. Comma-separated env override. */
 const TRUSTED_ISSUERS = (process.env.TD_MCP_TRUSTED_ISSUERS ||
@@ -26,6 +48,16 @@ const TRUSTED_ISSUERS = (process.env.TD_MCP_TRUSTED_ISSUERS ||
     .split(",")
     .map((s) => s.trim())
     .filter(Boolean);
+/**
+ * The Auth0 tenant we actually send users to. TRUSTED_ISSUERS may list several
+ * tenants we *accept* tokens from (staging alongside production); the first is
+ * the one we hand off to. Kept without a trailing slash for URL building —
+ * TRUSTED_ISSUERS entries keep theirs, because `iss` matching is exact.
+ */
+const AUTH0_ORIGIN = (TRUSTED_ISSUERS[0] || "https://replayable.us.auth0.com/")
+    .replace(/\/$/, "");
+/** Scopes advertised in both metadata documents. */
+const SCOPES_SUPPORTED = ["openid", "profile", "email", "offline_access"];
 // One remote JWKS per issuer; jose caches keys and handles rotation.
 const jwksByIssuer = new Map();
 function jwksForIssuer(issuer) {
@@ -45,6 +77,18 @@ function requestScheme(req) {
     const socket = req.socket;
     return socket && socket.encrypted ? "https" : "http";
 }
+/**
+ * The public origin clients reach us on — the authorization server identifier
+ * we advertise, so it must match the host the metadata was fetched from.
+ * `TD_MCP_PUBLIC_URL` overrides it when the proxy hop rewrites the host.
+ */
+function publicOrigin(req) {
+    if (process.env.TD_MCP_PUBLIC_URL) {
+        return process.env.TD_MCP_PUBLIC_URL.replace(/\/$/, "");
+    }
+    const host = req.headers["x-forwarded-host"] || req.headers.host;
+    return `${requestScheme(req)}://${host}`;
+}
 /** The public URL clients use to reach this server's MCP endpoint. */
 function resourceUrl(req, mcpPath) {
     if (process.env.TD_MCP_RESOURCE) {
@@ -53,16 +97,72 @@ function resourceUrl(req, mcpPath) {
     const host = req.headers["x-forwarded-host"] || req.headers.host;
     return `${requestScheme(req)}://${host}${mcpPath}`;
 }
-/** RFC 9728 protected resource metadata document. */
+/**
+ * RFC 9728 protected resource metadata document.
+ *
+ * `authorization_servers` is *this* server, not Auth0: clients must go through
+ * our `/authorize` so the Auth0 API audience gets injected (see the file
+ * header). They then discover the rest from our RFC 8414 document below.
+ */
 export function protectedResourceMetadata(req, mcpPath) {
     return {
         resource: resourceUrl(req, mcpPath),
-        authorization_servers: TRUSTED_ISSUERS.map((iss) => iss.replace(/\/$/, "")),
+        authorization_servers: [publicOrigin(req)],
         bearer_methods_supported: ["header"],
-        scopes_supported: ["openid", "profile", "email"],
+        scopes_supported: SCOPES_SUPPORTED,
         resource_documentation: "https://docs.testdriver.ai",
     };
 }
+/**
+ * RFC 8414 authorization server metadata. Only `authorization_endpoint` is
+ * ours; token exchange, Dynamic Client Registration and JWKS go straight to
+ * Auth0, so no client credentials or codes pass through this server.
+ */
+export function authorizationServerMetadata(req) {
+    const base = publicOrigin(req);
+    return {
+        issuer: base,
+        authorization_endpoint: `${base}/authorize`,
+        token_endpoint: `${AUTH0_ORIGIN}/oauth/token`,
+        registration_endpoint: `${AUTH0_ORIGIN}/oidc/register`,
+        revocation_endpoint: `${AUTH0_ORIGIN}/oauth/revoke`,
+        jwks_uri: `${AUTH0_ORIGIN}/.well-known/jwks.json`,
+        response_types_supported: ["code"],
+        response_modes_supported: ["query"],
+        grant_types_supported: ["authorization_code", "refresh_token"],
+        // OAuth 2.1 / MCP clients are public clients using PKCE.
+        code_challenge_methods_supported: ["S256"],
+        token_endpoint_auth_methods_supported: [
+            "none",
+            "client_secret_post",
+            "client_secret_basic",
+        ],
+        scopes_supported: SCOPES_SUPPORTED,
+    };
+}
+/**
+ * Translate an inbound request to our `/authorize` into the upstream Auth0
+ * authorization URL. Every client parameter is forwarded verbatim — including
+ * `state`, `code_challenge` and `redirect_uri`, which stay end-to-end between
+ * the client and Auth0 — with two changes:
+ *
+ *   - `audience` is set to MCP_AUDIENCE. This is the whole point of the hop:
+ *     without it Auth0 defaults to the `/userinfo` audience and refuses the
+ *     third-party (DCR-registered) client outright.
+ *   - `resource` is dropped. Auth0 keys tokens on `audience`, and forwarding a
+ *     resource indicator alongside it only risks the two disagreeing.
+ */
+export function authorizeRedirectUrl(requestUrl) {
+    const target = new URL(`${AUTH0_ORIGIN}/authorize`);
+    for (const [key, value] of requestUrl.searchParams) {
+        if (key === "audience" || key === "resource") {
+            continue;
+        }
+        target.searchParams.append(key, value);
+    }
+    target.searchParams.set("audience", MCP_AUDIENCE);
+    return target.toString();
+}
 /** Build the `WWW-Authenticate` challenge header value. */
 export function wwwAuthenticate(req, opts) {
     const host = req.headers["x-forwarded-host"] || req.headers.host;

package/mcp-server/dist/server.mjs

@@ -23,7 +23,7 @@ import { z } from "zod";
 import * as core from "./core/actions.js";
 import { NoActiveSessionError } from "./core/actions.js";
 import { resolveE2bTemplateId, resolveOs } from "./env-utils.js";
-import { authenticate, isOAuthEnabled, protectedResourceMetadata, wwwAuthenticate } from "./http-auth.js";
+import { authenticate, authorizationServerMetadata, authorizeRedirectUrl, isOAuthEnabled, protectedResourceMetadata, wwwAuthenticate } from "./http-auth.js";
 import { SessionStartInputSchema } from "./provision-types.js";
 // =============================================================================
 // Sentry
@@ -1739,9 +1739,11 @@ async function startHttpServer() {
                 res.end(JSON.stringify({ status: "ok", server: "testdriver", version, sessions: connections.size }));
                 return;
             }
-            // RFC 9728 protected-resource metadata so OAuth clients discover Auth0.
-            // Only advertised when OAuth is enforced. Some clients append the resource
-            // path to the well-known URL, so match both.
+            // RFC 9728 protected-resource metadata, pointing OAuth clients at this
+            // server as the authorization server (see http-auth.ts for why we sit in
+            // front of Auth0 rather than advertising it directly). Only advertised
+            // when OAuth is enforced. Some clients append the resource path to the
+            // well-known URL, so match both.
             if (isOAuthEnabled() &&
                 req.method === "GET" &&
                 (url.pathname === "/.well-known/oauth-protected-resource" ||
@@ -1750,6 +1752,27 @@ async function startHttpServer() {
                 res.end(JSON.stringify(protectedResourceMetadata(req, mcpPath)));
                 return;
             }
+            // RFC 8414 authorization-server metadata. Clients look for it at the
+            // OAuth path and, per OpenID Discovery, sometimes the OIDC one; both
+            // describe the same hop, so serve both.
+            if (isOAuthEnabled() &&
+                req.method === "GET" &&
+                (url.pathname === "/.well-known/oauth-authorization-server" ||
+                    url.pathname === `/.well-known/oauth-authorization-server${mcpPath}` ||
+                    url.pathname === "/.well-known/openid-configuration")) {
+                res.writeHead(200, { "content-type": "application/json" });
+                res.end(JSON.stringify(authorizationServerMetadata(req)));
+                return;
+            }
+            // The one proxied endpoint: redirect to Auth0 with the API audience
+            // injected. `state`, PKCE and `redirect_uri` pass through untouched, so
+            // the callback goes straight from Auth0 back to the client and the code
+            // is exchanged at Auth0's token endpoint without touching this server.
+            if (isOAuthEnabled() && req.method === "GET" && url.pathname === "/authorize") {
+                res.writeHead(302, { location: authorizeRedirectUrl(url), "cache-control": "no-store" });
+                res.end();
+                return;
+            }
             if (url.pathname !== mcpPath) {
                 res.writeHead(404, { "content-type": "application/json" });
                 res.end(JSON.stringify({ error: "Not found", hint: `MCP endpoint is ${mcpPath}` }));

package/mcp-server/src/http-auth.test.ts

@@ -0,0 +1,180 @@
+/**
+ * Unit tests for http-auth.ts
+ *
+ * Focus: the OAuth hop this server puts in front of Auth0. Auth0 rejects a
+ * DCR-registered (third-party) client that reaches `/authorize` without an
+ * `audience` — "The userinfo audience is not allowed for third party clients"
+ * — and ignores the RFC 8707 `resource` parameter MCP clients send instead.
+ * These tests pin the three things that together avoid that:
+ *
+ *   1. we advertise ourselves, not Auth0, as the authorization server,
+ *   2. our RFC 8414 document routes only `/authorize` through us,
+ *   3. that redirect injects the API audience and preserves state/PKCE.
+ */
+
+import type { IncomingMessage } from "http";
+import { describe, it, expect, afterEach } from "vitest";
+import {
+  authorizationServerMetadata,
+  authorizeRedirectUrl,
+  protectedResourceMetadata,
+} from "./http-auth.js";
+
+const AUTH0 = "https://replayable.us.auth0.com";
+const AUDIENCE = "https://api.testdriver.ai";
+
+/** Minimal IncomingMessage stand-in: only headers and socket are read. */
+function fakeReq(
+  headers: Record<string, string> = {},
+  encrypted = false,
+): IncomingMessage {
+  return {
+    headers: { host: "mcp.example.com", ...headers },
+    socket: { encrypted },
+  } as unknown as IncomingMessage;
+}
+
+/** The authorize request Claude sends today, which Auth0 refused. */
+function clientAuthorizeUrl(
+  extra: Record<string, string> = {},
+): URL {
+  const url = new URL("https://mcp.example.com/authorize");
+  const params: Record<string, string> = {
+    response_type: "code",
+    client_id: "dcr-generated-client",
+    redirect_uri: "https://claude.ai/api/mcp/auth_callback",
+    scope: "openid profile email offline_access",
+    state: "opaque-state",
+    code_challenge: "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
+    code_challenge_method: "S256",
+    resource: "https://mcp.example.com/mcp",
+    ...extra,
+  };
+  for (const [k, v] of Object.entries(params)) {
+    url.searchParams.set(k, v);
+  }
+  return url;
+}
+
+afterEach(() => {
+  delete process.env.TD_MCP_PUBLIC_URL;
+  delete process.env.TD_MCP_RESOURCE;
+});
+
+// ---------------------------------------------------------------------------
+// protectedResourceMetadata (RFC 9728)
+// ---------------------------------------------------------------------------
+
+describe("protectedResourceMetadata", () => {
+  it("advertises this server as the authorization server, not Auth0", () => {
+    const doc = protectedResourceMetadata(fakeReq(), "/mcp");
+    // Pointing straight at Auth0 is what produced the userinfo-audience error.
+    expect(doc.authorization_servers).toEqual(["http://mcp.example.com"]);
+    expect(JSON.stringify(doc.authorization_servers)).not.toContain("auth0");
+  });
+
+  it("keeps the MCP endpoint as the RFC 8707 resource identifier", () => {
+    const doc = protectedResourceMetadata(fakeReq(), "/mcp");
+    expect(doc.resource).toBe("http://mcp.example.com/mcp");
+  });
+
+  it("honours a TLS-terminating proxy's forwarded scheme and host", () => {
+    const doc = protectedResourceMetadata(
+      fakeReq({
+        "x-forwarded-proto": "https",
+        "x-forwarded-host": "td-test-mcp-server.fly.dev",
+      }),
+      "/mcp",
+    );
+    expect(doc.authorization_servers).toEqual([
+      "https://td-test-mcp-server.fly.dev",
+    ]);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// authorizationServerMetadata (RFC 8414)
+// ---------------------------------------------------------------------------
+
+describe("authorizationServerMetadata", () => {
+  it("names itself as issuer so discovery validation matches the fetch URL", () => {
+    const doc = authorizationServerMetadata(
+      fakeReq({ "x-forwarded-proto": "https" }),
+    );
+    expect(doc.issuer).toBe("https://mcp.example.com");
+    expect(doc.authorization_endpoint).toBe("https://mcp.example.com/authorize");
+  });
+
+  it("sends token exchange, registration and JWKS straight to Auth0", () => {
+    const doc = authorizationServerMetadata(fakeReq());
+    // No credentials or codes should route through this server.
+    expect(doc.token_endpoint).toBe(`${AUTH0}/oauth/token`);
+    expect(doc.registration_endpoint).toBe(`${AUTH0}/oidc/register`);
+    expect(doc.jwks_uri).toBe(`${AUTH0}/.well-known/jwks.json`);
+  });
+
+  it("advertises PKCE, as OAuth 2.1 public clients require", () => {
+    const doc = authorizationServerMetadata(fakeReq());
+    expect(doc.code_challenge_methods_supported).toEqual(["S256"]);
+    expect(doc.token_endpoint_auth_methods_supported).toContain("none");
+  });
+
+  it("lets TD_MCP_PUBLIC_URL override a host the proxy hop rewrote", () => {
+    process.env.TD_MCP_PUBLIC_URL = "https://mcp.testdriver.ai/";
+    const doc = authorizationServerMetadata(fakeReq());
+    expect(doc.issuer).toBe("https://mcp.testdriver.ai");
+    expect(doc.authorization_endpoint).toBe(
+      "https://mcp.testdriver.ai/authorize",
+    );
+  });
+});
+
+// ---------------------------------------------------------------------------
+// authorizeRedirectUrl — the fix itself
+// ---------------------------------------------------------------------------
+
+describe("authorizeRedirectUrl", () => {
+  it("injects the API audience Auth0 needs from third-party clients", () => {
+    const target = new URL(authorizeRedirectUrl(clientAuthorizeUrl()));
+    expect(target.origin + target.pathname).toBe(`${AUTH0}/authorize`);
+    expect(target.searchParams.get("audience")).toBe(AUDIENCE);
+  });
+
+  it("passes state, PKCE and redirect_uri through untouched", () => {
+    const source = clientAuthorizeUrl();
+    const target = new URL(authorizeRedirectUrl(source));
+    for (const key of [
+      "response_type",
+      "client_id",
+      "redirect_uri",
+      "scope",
+      "state",
+      "code_challenge",
+      "code_challenge_method",
+    ]) {
+      expect(target.searchParams.get(key)).toBe(source.searchParams.get(key));
+    }
+  });
+
+  it("drops the resource indicator Auth0 ignores", () => {
+    const target = new URL(authorizeRedirectUrl(clientAuthorizeUrl()));
+    expect(target.searchParams.has("resource")).toBe(false);
+  });
+
+  it("replaces a client-supplied audience rather than duplicating it", () => {
+    const target = new URL(
+      authorizeRedirectUrl(
+        clientAuthorizeUrl({ audience: "https://wrong.example.com" }),
+      ),
+    );
+    expect(target.searchParams.getAll("audience")).toEqual([AUDIENCE]);
+  });
+
+  it("forwards repeated parameters without collapsing them", () => {
+    const source = clientAuthorizeUrl();
+    source.searchParams.append("prompt", "consent");
+    source.searchParams.append("prompt", "login");
+    const target = new URL(authorizeRedirectUrl(source));
+    expect(target.searchParams.getAll("prompt")).toEqual(["consent", "login"]);
+  });
+});

package/mcp-server/src/http-auth.ts

@@ -3,8 +3,25 @@
  *
  * OAuth 2.0 Resource Server helpers for the standalone TestDriver MCP server's
  * Streamable HTTP transport. Identity is delegated to Auth0 — this server only
- * *validates* the Bearer JWTs Auth0 issues for the TestDriver API audience and
- * advertises Auth0 as the authorization server via RFC 9728 metadata.
+ * *validates* the Bearer JWTs Auth0 issues for the TestDriver API audience.
+ *
+ * Auth0 cannot be advertised as the authorization server directly. MCP clients
+ * discover it, register through Dynamic Client Registration — which at Auth0
+ * always yields a *third-party* client — and then call `/authorize` with the
+ * RFC 8707 `resource` parameter and no `audience`. Auth0 ignores `resource`,
+ * falls back to its default `/userinfo` audience, and rejects the request:
+ * "The userinfo audience is not allowed for third party clients." Even if it
+ * succeeded, a `/userinfo`-audience token is opaque and would fail the JWT
+ * verification below, which requires `aud === MCP_AUDIENCE`.
+ *
+ * So this server advertises *itself* as the authorization server (RFC 8414) and
+ * proxies exactly one endpoint: `/authorize` redirects to Auth0 with
+ * `audience=<MCP_AUDIENCE>` injected. Token exchange, client registration and
+ * JWKS point straight at Auth0, so no credentials pass through us. The metadata
+ * `issuer` is therefore this server while issued tokens carry Auth0's `iss`;
+ * that is inherent to the proxy pattern and fine because access tokens are
+ * opaque to OAuth clients — only we, the resource server, read `iss`, and we
+ * check it against TRUSTED_ISSUERS.
  *
  * When OAuth is disabled (no `TD_MCP_AUTH=oauth`), everything here is a no-op so
  * local stdio / trusted-network usage is unchanged.
@@ -18,7 +35,12 @@ export function isOAuthEnabled(): boolean {
   return (process.env.TD_MCP_AUTH || "").toLowerCase() === "oauth";
 }
 
-/** Canonical resource identifier (RFC 8707) = the Auth0 API audience. */
+/**
+ * The Auth0 API audience every access token must be minted for. This is what we
+ * inject into the proxied `/authorize` and what `authenticate()` asserts as
+ * `aud`. Note this is NOT the RFC 8707 resource identifier (that is the MCP
+ * endpoint URL, see `resourceUrl()`); Auth0 keys tokens on `audience` alone.
+ */
 const MCP_AUDIENCE =
   process.env.TD_AUTH0_AUDIENCE || "https://api.testdriver.ai";
 
@@ -35,6 +57,18 @@ const TRUSTED_ISSUERS = (
   .map((s) => s.trim())
   .filter(Boolean);
 
+/**
+ * The Auth0 tenant we actually send users to. TRUSTED_ISSUERS may list several
+ * tenants we *accept* tokens from (staging alongside production); the first is
+ * the one we hand off to. Kept without a trailing slash for URL building —
+ * TRUSTED_ISSUERS entries keep theirs, because `iss` matching is exact.
+ */
+const AUTH0_ORIGIN = (TRUSTED_ISSUERS[0] || "https://replayable.us.auth0.com/")
+  .replace(/\/$/, "");
+
+/** Scopes advertised in both metadata documents. */
+const SCOPES_SUPPORTED = ["openid", "profile", "email", "offline_access"];
+
 // One remote JWKS per issuer; jose caches keys and handles rotation.
 const jwksByIssuer = new Map<
   string,
@@ -62,6 +96,19 @@ function requestScheme(req: IncomingMessage): string {
   return socket && socket.encrypted ? "https" : "http";
 }
 
+/**
+ * The public origin clients reach us on — the authorization server identifier
+ * we advertise, so it must match the host the metadata was fetched from.
+ * `TD_MCP_PUBLIC_URL` overrides it when the proxy hop rewrites the host.
+ */
+function publicOrigin(req: IncomingMessage): string {
+  if (process.env.TD_MCP_PUBLIC_URL) {
+    return process.env.TD_MCP_PUBLIC_URL.replace(/\/$/, "");
+  }
+  const host = req.headers["x-forwarded-host"] || req.headers.host;
+  return `${requestScheme(req)}://${host}`;
+}
+
 /** The public URL clients use to reach this server's MCP endpoint. */
 function resourceUrl(req: IncomingMessage, mcpPath: string): string {
   if (process.env.TD_MCP_RESOURCE) {
@@ -71,20 +118,80 @@ function resourceUrl(req: IncomingMessage, mcpPath: string): string {
   return `${requestScheme(req)}://${host}${mcpPath}`;
 }
 
-/** RFC 9728 protected resource metadata document. */
+/**
+ * RFC 9728 protected resource metadata document.
+ *
+ * `authorization_servers` is *this* server, not Auth0: clients must go through
+ * our `/authorize` so the Auth0 API audience gets injected (see the file
+ * header). They then discover the rest from our RFC 8414 document below.
+ */
 export function protectedResourceMetadata(
   req: IncomingMessage,
   mcpPath: string,
 ): Record<string, unknown> {
   return {
     resource: resourceUrl(req, mcpPath),
-    authorization_servers: TRUSTED_ISSUERS.map((iss) => iss.replace(/\/$/, "")),
+    authorization_servers: [publicOrigin(req)],
     bearer_methods_supported: ["header"],
-    scopes_supported: ["openid", "profile", "email"],
+    scopes_supported: SCOPES_SUPPORTED,
     resource_documentation: "https://docs.testdriver.ai",
   };
 }
 
+/**
+ * RFC 8414 authorization server metadata. Only `authorization_endpoint` is
+ * ours; token exchange, Dynamic Client Registration and JWKS go straight to
+ * Auth0, so no client credentials or codes pass through this server.
+ */
+export function authorizationServerMetadata(
+  req: IncomingMessage,
+): Record<string, unknown> {
+  const base = publicOrigin(req);
+  return {
+    issuer: base,
+    authorization_endpoint: `${base}/authorize`,
+    token_endpoint: `${AUTH0_ORIGIN}/oauth/token`,
+    registration_endpoint: `${AUTH0_ORIGIN}/oidc/register`,
+    revocation_endpoint: `${AUTH0_ORIGIN}/oauth/revoke`,
+    jwks_uri: `${AUTH0_ORIGIN}/.well-known/jwks.json`,
+    response_types_supported: ["code"],
+    response_modes_supported: ["query"],
+    grant_types_supported: ["authorization_code", "refresh_token"],
+    // OAuth 2.1 / MCP clients are public clients using PKCE.
+    code_challenge_methods_supported: ["S256"],
+    token_endpoint_auth_methods_supported: [
+      "none",
+      "client_secret_post",
+      "client_secret_basic",
+    ],
+    scopes_supported: SCOPES_SUPPORTED,
+  };
+}
+
+/**
+ * Translate an inbound request to our `/authorize` into the upstream Auth0
+ * authorization URL. Every client parameter is forwarded verbatim — including
+ * `state`, `code_challenge` and `redirect_uri`, which stay end-to-end between
+ * the client and Auth0 — with two changes:
+ *
+ *   - `audience` is set to MCP_AUDIENCE. This is the whole point of the hop:
+ *     without it Auth0 defaults to the `/userinfo` audience and refuses the
+ *     third-party (DCR-registered) client outright.
+ *   - `resource` is dropped. Auth0 keys tokens on `audience`, and forwarding a
+ *     resource indicator alongside it only risks the two disagreeing.
+ */
+export function authorizeRedirectUrl(requestUrl: URL): string {
+  const target = new URL(`${AUTH0_ORIGIN}/authorize`);
+  for (const [key, value] of requestUrl.searchParams) {
+    if (key === "audience" || key === "resource") {
+      continue;
+    }
+    target.searchParams.append(key, value);
+  }
+  target.searchParams.set("audience", MCP_AUDIENCE);
+  return target.toString();
+}
+
 /** Build the `WWW-Authenticate` challenge header value. */
 export function wwwAuthenticate(
   req: IncomingMessage,

package/mcp-server/src/server.ts

@@ -29,7 +29,7 @@ import { z } from "zod";
 import * as core from "./core/actions.js";
 import { NoActiveSessionError, type ActionResult } from "./core/actions.js";
 import { resolveE2bTemplateId, resolveOs } from "./env-utils.js";
-import { authenticate, isOAuthEnabled, protectedResourceMetadata, wwwAuthenticate } from "./http-auth.js";
+import { authenticate, authorizationServerMetadata, authorizeRedirectUrl, isOAuthEnabled, protectedResourceMetadata, wwwAuthenticate } from "./http-auth.js";
 import { SessionStartInputSchema, type SessionStartInput } from "./provision-types.js";
 import { type SessionState } from "./session.js";
 
@@ -2117,9 +2117,11 @@ async function startHttpServer() {
         return;
       }
 
-      // RFC 9728 protected-resource metadata so OAuth clients discover Auth0.
-      // Only advertised when OAuth is enforced. Some clients append the resource
-      // path to the well-known URL, so match both.
+      // RFC 9728 protected-resource metadata, pointing OAuth clients at this
+      // server as the authorization server (see http-auth.ts for why we sit in
+      // front of Auth0 rather than advertising it directly). Only advertised
+      // when OAuth is enforced. Some clients append the resource path to the
+      // well-known URL, so match both.
       if (
         isOAuthEnabled() &&
         req.method === "GET" &&
@@ -2131,6 +2133,31 @@ async function startHttpServer() {
         return;
       }
 
+      // RFC 8414 authorization-server metadata. Clients look for it at the
+      // OAuth path and, per OpenID Discovery, sometimes the OIDC one; both
+      // describe the same hop, so serve both.
+      if (
+        isOAuthEnabled() &&
+        req.method === "GET" &&
+        (url.pathname === "/.well-known/oauth-authorization-server" ||
+          url.pathname === `/.well-known/oauth-authorization-server${mcpPath}` ||
+          url.pathname === "/.well-known/openid-configuration")
+      ) {
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(JSON.stringify(authorizationServerMetadata(req)));
+        return;
+      }
+
+      // The one proxied endpoint: redirect to Auth0 with the API audience
+      // injected. `state`, PKCE and `redirect_uri` pass through untouched, so
+      // the callback goes straight from Auth0 back to the client and the code
+      // is exchanged at Auth0's token endpoint without touching this server.
+      if (isOAuthEnabled() && req.method === "GET" && url.pathname === "/authorize") {
+        res.writeHead(302, { location: authorizeRedirectUrl(url), "cache-control": "no-store" });
+        res.end();
+        return;
+      }
+
       if (url.pathname !== mcpPath) {
         res.writeHead(404, { "content-type": "application/json" });
         res.end(JSON.stringify({ error: "Not found", hint: `MCP endpoint is ${mcpPath}` }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@testdriverai/agent",
-  "version": "7.11.164-test",
+  "version": "7.11.165-test",
   "description": "Next generation autonomous AI agent for end-to-end testing of web & desktop",
   "main": "sdk.js",
   "types": "sdk.d.ts",