@zackbart/connecta 0.7.0 → 0.7.3

package/CHANGELOG.md

@@ -2,6 +2,116 @@
 
 All notable changes to this package are documented here.
 
+## 0.7.3 — 2026-07-27
+
+0.7.3 is the first published package after 0.7.1. It consolidates the
+unpublished 0.7.2 candidate with the hardening and operator work that followed:
+catalog deadlines and authorization recovery, session-safe operator pages,
+terminal probe and QuickJS cleanup, decisive credential-shape drift, stronger
+documentation checks, and a read-only toolkit map. There are no dependency,
+configuration, storage-schema, or breaking TypeScript changes. The authenticated
+`/ui/data` response gains one additive `toolkits` array; existing fields and
+package entrypoints are unchanged.
+
+### Added
+
+- **Connections shows the configured toolkit views** (PR #112). Unrestricted
+  operators can inspect connector membership, tool inclusions/exclusions,
+  currently loaded effective tool counts, and copyable scoped MCP URLs without
+  gaining any mutation or persistence path. Toolkit-restricted identities still
+  cannot enumerate deployment-wide data, the open HTML shell remains data-free,
+  and config-only toolkit descriptions never leave the server.
+
+### Changed
+
+- **Discovery deadlines now govern the catalog work, not only the caller's
+  wait** (issue #98). `list_connectors`, `search_tools`, and `describe_tools`
+  pass `discovery.probeTimeoutMs` into a full downstream `tools/list` walk.
+  Expiry cancels the in-flight page where the transport supports it and prevents
+  another page from starting; existing tool/page bounds remain as backstops,
+  partial catalogs are never published, and the last complete stale catalog
+  remains eligible.
+- **`nextCursor: null` is accepted as end-of-pagination** (issue #99). This
+  narrow compatibility concession treats the common JSON null spelling like an
+  absent cursor while preserving empty string as a real cursor and retaining
+  the SDK's validation for every tool and other result field.
+
+### Fixed
+
+- **Authorization expiry is classified consistently across a catalog walk**
+  (issue #97). A downstream 401 on any `tools/list` page now reports
+  `auth_required` with the pending authorization URL, latches that verdict for
+  the request scope, and never publishes the prefix collected before failure.
+  Network, protocol, and malformed-page failures remain ordinary errors.
+- **Operator pages clear stale identity data when Clerk changes in another tab
+  or outside the page** (issue #92). Connector inventory, masked credential
+  metadata and notices, activity rows, toolkit rows, and capability navigation
+  are discarded together, and the next navigation fetches under the new session
+  rather than repainting cached data.
+- **The three operator routes handle HEAD and small navigation-state edges
+  correctly** (issue #93). `/`, `/credentials`, and `/activity` return their GET
+  headers with no HEAD body; Back/Forward focus stays visible while gated;
+  credential notices clear on page changes; and credential controls use the
+  same Clerk capability predicate as the mutation API.
+- **Stored credential-shape drift is decisive on both status and calls** (issue
+  #90). The fast connector inventory reports the existing `auth_required`
+  replacement state instead of a stale `ok`, while `ctx.credential.get()` and
+  `getAll()` reject the obsolete shape before returning any value. Generic
+  failed health checks remain non-decisive, valid stored supersets remain
+  readable, and replacement/removal remains the recovery path.
+- **Probe teardown cannot be skipped or resurrect a closed request scope**
+  (issue #91). Sibling work settles before shared teardown, cleanup no longer
+  short-circuits on the first rejection, and a closed scope remains terminal.
+  The formerly exported scope-borrowing option remains accepted as deprecated
+  and ignored so the fix does not create a TypeScript compatibility break.
+- **QuickJS host-result cleanup is deterministic under timeout and load**
+  (issue #84). Settled bridge results are bounded, consumed exactly once, and
+  released when execution completes or its deadline wins, preventing late work
+  from retaining unobservable values.
+- **The documentation guard catches the legacy syntax it was meant to prevent**
+  (issue #94). Bare `§N` citations now fail on live source, docs, examples, and
+  README surfaces—including extensionless files—while historical changelog
+  entries remain explicitly exempt. Negative fixtures cover every structural
+  invariant.
+
+## 0.7.1 — 2026-07-27
+
+0.7.1 is a security-and-bounds patch. It closes both redirect paths that could
+let untrusted URL text choose an origin, and it puts hard request and response
+ceilings around discovery. There are no dependency changes and no breaking
+TypeScript changes. There is one intentional runtime hardening to notice:
+`remoteMcp` now rejects downstream redirects by default. A deployment whose MCP
+endpoint legitimately redirects within the same origin can opt into the new
+`redirects: "same-origin"` policy; cross-origin redirects and HTTPS downgrades
+remain impossible.
+
+### Added
+
+- **`remoteMcp` has an explicit downstream redirect policy** (issue #81).
+  `redirects` defaults to `"none"`; `"same-origin"` follows at most five
+  manually validated hops with deliberate 301/302/303/307/308 method and body
+  semantics. Static headers and OAuth credentials never reach a cross-origin
+  target, and policy failures are typed, non-retryable, and sanitized.
+
+### Changed
+
+- **Discovery requests and generated results are bounded** (issue #82).
+  `search_tools` accepts at most 100 results, `describe_tools` accepts at most
+  100 raw addresses, and both reject generated results above 256,000 UTF-8
+  bytes. Compact, JSON-schema, value, and code-mode paths share the same policy,
+  so alternate entry points cannot bypass it.
+
+### Fixed
+
+- **Inbound HTTP-to-HTTPS upgrades preserve the configured public origin**
+  (issue #89). Protocol-relative, backslash, and control-character path forms
+  can no longer turn the upgrade response into an open redirect; ordinary
+  operator and private API paths still retain their path and query.
+- **Downstream MCP redirects are validated before every target request**
+  (issue #81). Redirect loops, excessive chains, scheme downgrades, origin
+  changes, and credential-bearing URL targets now fail closed in both Node and
+  Workers.
+
 ## 0.7.0 — 2026-07-27
 
 0.7.0 is the surface settlement: one release that finishes moving connecta's

package/README.md

@@ -95,7 +95,8 @@ rather than a redaction pass: the event type has nowhere to put a payload, which
 is what keeps an operations log from becoming something worth stealing.
 
 **Operator pages that cannot administer the deployment.** Connections at `GET /`
-shows connector health, tool counts, and downstream authorization links;
+shows connector health, tool counts, downstream authorization links, and a
+read-only map of the toolkit views declared in deployment config;
 `/credentials` rotates stored secrets; and `/activity` shows the optional
 payload-free ledger. They share one data-free shell with no build step and use
 authenticated private APIs for deployment data. They cannot add a connector,

package/dist/connectors/remote-mcp.d.ts

@@ -1,4 +1,5 @@
-import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
+import type { FetchLike, Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
+import { ConnectorCallError } from "../errors.js";
 import type { Connector, ConnectorContext, Logger } from "../types.js";
 export type RemoteMcpAuth = {
     type: "headers";
@@ -6,6 +7,7 @@ export type RemoteMcpAuth = {
 } | {
     type: "oauth";
 };
+export type RemoteMcpRedirectPolicy = "none" | "same-origin";
 export interface RemoteMcpOptions {
     url: string;
     /** Human-readable display name; the connector id remains the address prefix. */
@@ -25,6 +27,14 @@ export interface RemoteMcpOptions {
      */
     usageGuide?: string;
     auth?: RemoteMcpAuth;
+    /**
+     * Downstream HTTP redirect policy. Defaults to `"none"`: every redirect is
+     * rejected. `"same-origin"` follows at most five redirects while preserving
+     * standard 301/302/303/307/308 method semantics. Cross-origin redirects and
+     * HTTPS downgrades are always refused, so credentials never cross the
+     * configured request's origin.
+     */
+    redirects?: RemoteMcpRedirectPolicy;
     /**
      * Refuse to connect to a non-`https://` `url` at construction (default
      * false). Loopback hosts (`localhost`, `127.0.0.1`, `[::1]`) are always
@@ -45,6 +55,19 @@ export interface RemoteMcpOptions {
      */
     _transportFactory?: (ctx: ConnectorContext) => Transport;
 }
+export declare const MAX_REMOTE_REDIRECT_HOPS = 5;
+export declare class RemoteMcpRedirectError extends ConnectorCallError {
+    constructor(connectorId: string, reason: string);
+}
+/**
+ * Wrap fetch with explicit, bounded redirect handling.
+ *
+ * The starting URL of each fetch call is trusted by its caller (the configured
+ * MCP endpoint, or an OAuth URL discovered by the pinned SDK). Only Location
+ * values are policy-controlled here. No rejected target is ever fetched, so
+ * arbitrary static header names receive the same protection as Authorization.
+ */
+export declare function redirectSafeFetch(connectorId: string, policy?: RemoteMcpRedirectPolicy, baseFetch?: FetchLike): FetchLike;
 /**
  * Proxy a downstream remote MCP server. SDK clients and transports are scoped
  * to one inbound request: reused by calls within a batch/execute_code run, but

package/dist/connectors/remote-mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-mcp.d.ts","sourceRoot":"","sources":["../../src/connectors/remote-mcp.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAK/E,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAEhB,MAAM,EAEP,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtB,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,SAAS,CAAC;CAC1D;AAuKD;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,SAAS,CA2fvE"}
+{"version":3,"file":"remote-mcp.d.ts","sourceRoot":"","sources":["../../src/connectors/remote-mcp.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,SAAS,EACT,SAAS,EACV,MAAM,+CAA+C,CAAC;AAKvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAEhB,MAAM,EAEP,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtB,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,aAAa,CAAC;AAE7D,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,uBAAuB,CAAC;IACpC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,SAAS,CAAC;CAC1D;AA8JD,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAW1C,qBAAa,sBAAuB,SAAQ,kBAAkB;gBAChD,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAOhD;AAaD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,uBAAgC,EACxC,SAAS,GAAE,SAAiB,GAC3B,SAAS,CA2EX;AAiBD;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,SAAS,CA6hBvE"}

package/dist/connectors/remote-mcp.js

@@ -1,7 +1,9 @@
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { ListToolsResultSchema } from "@modelcontextprotocol/sdk/types.js";
 import { CfWorkerJsonSchemaValidator } from "@modelcontextprotocol/sdk/validation/cfworker";
+import { z } from "zod";
 import { KvOAuthProvider } from "../auth/downstream-oauth.js";
 import { ConnectorCallError } from "../errors.js";
 import { CONNECTA_VERSION } from "../version.js";
@@ -47,23 +49,28 @@ const MAX_TOOLS = 100_000;
  * is a definite loop, two consecutive pages that add no new tools are a server
  * going nowhere, and MAX_TOOLS caps what any of it can accumulate. This exists
  * only so the loop is finite even if a downstream somehow satisfies all three
- * forever, because the caller's probe deadline abandons the *caller*, not the
- * loop. Set high enough that no honest server reaches it.
+ * forever on a path with no discovery deadline. Set high enough that no honest
+ * server reaches it.
  */
 const MAX_TOOL_PAGES = 10_000;
+/**
+ * Compatibility concession for hand-rolled servers that serialize
+ * end-of-pagination as `null`. Only the cursor is widened; every tool and every
+ * other result field still passes through the SDK's pinned schema.
+ */
+const CompatibleListToolsResultSchema = ListToolsResultSchema.extend({
+    nextCursor: z.string().nullable().optional(),
+});
 /**
  * Re-prime an SDK client's tool-metadata cache from the *full* walked catalog.
  *
- * `Client.listTools()` ends by calling its private `cacheToolMetadata`, which
- * **clears** the output-schema validators and the task-support sets before
- * repopulating them from the page it just received. Call it once per page —
- * which walking the chain necessarily does — and the request-scoped client is
- * left holding metadata for the *last* page alone. `callTool` then finds no
- * validator for every earlier-page tool and silently skips both the "declared
- * an outputSchema but returned no structuredContent" check and the
- * structured-content validation, and finds no task requirement so a
- * required-task tool is dispatched as a plain `tools/call`. Enforcement would
- * depend on which page a tool happened to land on, which is not enforcement.
+ * The SDK's `Client.listTools()` caches one page at a time and **clears** the
+ * output-schema validators and task-support sets before each replacement.
+ * This walk uses `Client.request()` so it can make the narrow null-cursor
+ * compatibility concession above, then primes the metadata exactly once from
+ * the complete chain. Otherwise `callTool` would find no validator or task
+ * requirement for earlier-page tools and enforcement would depend on where a
+ * tool happened to land, which is not enforcement.
  *
  * So hand the whole aggregated list back deliberately, once, at the end. The
  * SDK types the method `private`, hence the cast; the SDK version is pinned
@@ -78,9 +85,9 @@ function primeToolMetadata(client, tools) {
     prime.call(client, tools);
 }
 /**
- * True for a result-parse failure caused by the page's `nextCursor` itself —
- * in practice `nextCursor: null`, a very common JSON idiom for "no more pages"
- * that the MCP schema does not accept (the chain ends on an *absent* cursor).
+ * True for a result-parse failure caused by the page's `nextCursor` itself.
+ * `null` is accepted deliberately; other non-string values remain a named
+ * downstream nonconformance instead of surfacing as a raw validation dump.
  * Duck-typed rather than `instanceof ZodError`: the SDK may parse with its own
  * zod instance, and cross-instance `instanceof` is a coin flip.
  */
@@ -136,6 +143,91 @@ function isLoopbackHost(hostname) {
         hostname === "[::1]" ||
         hostname === "::1");
 }
+export const MAX_REMOTE_REDIRECT_HOPS = 5;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+const BODY_HEADERS = [
+    "content-encoding",
+    "content-language",
+    "content-length",
+    "content-location",
+    "content-type",
+    "transfer-encoding",
+];
+export class RemoteMcpRedirectError extends ConnectorCallError {
+    constructor(connectorId, reason) {
+        super("connector_call_failed", `Connector "${connectorId}" redirect policy rejected the downstream response: ${reason}.`);
+        this.name = "RemoteMcpRedirectError";
+    }
+}
+function redirectedInit(init, status) {
+    const method = (init.method ?? "GET").toUpperCase();
+    const becomesGet = (status === 303 && method !== "GET" && method !== "HEAD") ||
+        ((status === 301 || status === 302) && method === "POST");
+    if (!becomesGet)
+        return init;
+    const headers = new Headers(init.headers);
+    for (const name of BODY_HEADERS)
+        headers.delete(name);
+    return { ...init, method: "GET", body: undefined, headers };
+}
+/**
+ * Wrap fetch with explicit, bounded redirect handling.
+ *
+ * The starting URL of each fetch call is trusted by its caller (the configured
+ * MCP endpoint, or an OAuth URL discovered by the pinned SDK). Only Location
+ * values are policy-controlled here. No rejected target is ever fetched, so
+ * arbitrary static header names receive the same protection as Authorization.
+ */
+export function redirectSafeFetch(connectorId, policy = "none", baseFetch = fetch) {
+    return async (input, initialInit = {}) => {
+        let current = new URL(input);
+        let init = initialInit;
+        const seen = new Set([current.href]);
+        let hops = 0;
+        while (true) {
+            const response = await baseFetch(current, {
+                ...init,
+                redirect: "manual",
+            });
+            if (!REDIRECT_STATUSES.has(response.status))
+                return response;
+            const location = response.headers.get("location");
+            await response.body?.cancel().catch(() => { });
+            if (!location) {
+                throw new RemoteMcpRedirectError(connectorId, `HTTP ${response.status} carried no Location header`);
+            }
+            if (policy === "none") {
+                throw new RemoteMcpRedirectError(connectorId, `HTTP ${response.status} redirects are disabled`);
+            }
+            if (hops >= MAX_REMOTE_REDIRECT_HOPS) {
+                throw new RemoteMcpRedirectError(connectorId, `the redirect chain exceeded ${MAX_REMOTE_REDIRECT_HOPS} hops`);
+            }
+            let next;
+            try {
+                next = new URL(location, current);
+            }
+            catch {
+                throw new RemoteMcpRedirectError(connectorId, `HTTP ${response.status} carried an invalid Location header`);
+            }
+            if (current.protocol === "https:" && next.protocol !== "https:") {
+                throw new RemoteMcpRedirectError(connectorId, "an HTTPS-to-HTTP downgrade is not allowed");
+            }
+            if (next.origin !== current.origin) {
+                throw new RemoteMcpRedirectError(connectorId, "a cross-origin redirect is not allowed");
+            }
+            if (next.username || next.password) {
+                throw new RemoteMcpRedirectError(connectorId, "a redirect target containing URL credentials is not allowed");
+            }
+            if (seen.has(next.href)) {
+                throw new RemoteMcpRedirectError(connectorId, "the redirect chain loops");
+            }
+            seen.add(next.href);
+            hops++;
+            init = redirectedInit(init, response.status);
+            current = next;
+        }
+    };
+}
 /**
  * Proxy a downstream remote MCP server. SDK clients and transports are scoped
  * to one inbound request: reused by calls within a batch/execute_code run, but
@@ -151,6 +243,9 @@ export function remoteMcp(id, opts) {
     // transport, response bodies, AbortSignals, or connection promise reachable
     // from the isolate singleton. Those are request-bound in Cloudflare Workers.
     const states = new WeakMap();
+    // Closing is terminal even after `states.delete`: a late or future lookup
+    // must not recreate an ownerless connection under the ended scope.
+    const closedScopes = new WeakSet();
     const isOauth = opts.auth?.type === "oauth";
     const logger = opts.logger ?? console;
     // Check the destination scheme once at construction: buildTransport (and the
@@ -171,25 +266,32 @@ export function remoteMcp(id, opts) {
     const authRequiredError = (cause) => new ConnectorCallError("auth_required", `Connector "${id}" requires authorization — call authorize_connector({ connector: "${id}" }) and open the returned URL.`, { cause });
     const scopeEndedError = () => new Error(`Connector "${id}" scope ended during connection.`);
     /**
-     * One `tools/list` request. The only thing wrapped here is the diagnosis of a
-     * `nextCursor` the MCP result schema refuses — overwhelmingly `null`, which
-     * plenty of servers use to mean "no more pages" but the spec spells as an
-     * *absent* cursor. The SDK surfaces that as a raw validation dump about a
-     * field the operator never sees; say which server broke which rule instead.
-     * Accepting `null` as end-of-chain outright is issue #99.
+     * One `tools/list` request. The SDK schema is retained wholesale except for
+     * accepting `null` as the common, unambiguous end-of-chain spelling. Other
+     * cursor shapes still get a useful connector-level diagnosis.
      */
-    const listPage = async (client, cursor) => {
+    const listPage = async (client, cursor, ctx) => {
         try {
-            return await client.listTools(cursor === undefined ? undefined : { cursor });
+            return await client.request({
+                method: "tools/list",
+                ...(cursor === undefined ? {} : { params: { cursor } }),
+            }, CompatibleListToolsResultSchema, ctx.timeoutMs || ctx.signal
+                ? {
+                    ...(ctx.timeoutMs ? { timeout: ctx.timeoutMs } : {}),
+                    ...(ctx.signal ? { signal: ctx.signal } : {}),
+                }
+                : undefined);
         }
         catch (err) {
             if (!isCursorShapeError(err))
                 throw err;
-            throw new Error(`Connector "${id}" returned a tools/list page whose nextCursor is neither a string nor absent (a null cursor is the usual culprit) — MCP ends pagination on an absent nextCursor, so this catalog cannot be walked.`, { cause: err });
+            throw new Error(`Connector "${id}" returned a tools/list page whose nextCursor is neither a string, null, nor absent — this catalog cannot be walked.`, { cause: err });
         }
     };
     const stateFor = (ctx) => {
         const scope = ctx.requestScope ?? ctx;
+        if (closedScopes.has(scope))
+            throw scopeEndedError();
         let state = states.get(scope);
         if (!state) {
             state = {
@@ -209,25 +311,22 @@ export function remoteMcp(id, opts) {
         state.provider ??= new KvOAuthProvider(id, ctx.storage, `${ctx.baseUrl}/oauth/callback/${id}`);
         return state.provider;
     };
-    // NOTE: StreamableHTTPClientTransport speaks over fetch, which transparently
-    // follows 3xx redirects. A malicious or compromised downstream MCP could
-    // redirect to an internal address (e.g. http://169.254.169.254/…) and fetch
-    // would re-issue the request — potentially carrying static auth headers. The
-    // scheme check above only guards the first hop; a fully robust guard (manual
-    // redirect handling + per-hop re-validation + stripping auth headers cross-
-    // origin) lives in the SDK transport and is deferred to a future non-patch
-    // release rather than reimplemented here.
     const buildTransport = (ctx, state) => {
         if (opts._transportFactory)
             return opts._transportFactory(ctx);
         const url = new URL(opts.url);
+        const guardedFetch = redirectSafeFetch(id, opts.redirects);
         if (opts.auth?.type === "oauth") {
             return new StreamableHTTPClientTransport(url, {
                 authProvider: getProvider(ctx, state),
+                fetch: guardedFetch,
             });
         }
         const headers = opts.auth?.type === "headers" ? opts.auth.headers : undefined;
-        return new StreamableHTTPClientTransport(url, headers ? { requestInit: { headers } } : undefined);
+        return new StreamableHTTPClientTransport(url, {
+            ...(headers ? { requestInit: { headers } } : {}),
+            fetch: guardedFetch,
+        });
     };
     const reset = (state) => {
         state.client = null;
@@ -238,6 +337,12 @@ export function remoteMcp(id, opts) {
         // `closed` is deliberately not cleared — see ConnectionState.
     };
     const ensureConnected = async (ctx, state) => {
+        // A 401 after connect is a verdict for the whole request scope, not merely
+        // for the one call that observed it. Do not let the still-cached client make
+        // a later status or call in the same scope report healthy.
+        if (state.authRequired) {
+            throw authRequiredError(new UnauthorizedError("Downstream authorization is no longer valid."));
+        }
         // Cross-isolate force re-auth: another isolate bumped the KV generation and
         // wiped credentials. This request's cached client still speaks the old
         // token — drop it so the next connect runs against current state.
@@ -371,61 +476,74 @@ export function remoteMcp(id, opts) {
             /** Consecutive pages that advertised a successor but added nothing. */
             let barren = 0;
             let complete = false;
-            for (let page = 0; page < MAX_TOOL_PAGES; page++) {
-                // The scope can end between pages (probe timeout, teardown). Stop
-                // rather than keep paging into a transport that is being closed.
-                if (state.closed)
-                    throw scopeEndedError();
-                // Page one sends no params at all, so a non-paginated server sees
-                // exactly the request it saw before pagination existed.
-                const res = await listPage(client, cursor);
-                let added = 0;
-                for (const t of res.tools) {
-                    // First page wins. An unstable cursor can serve the same tool on two
-                    // pages — a failure mode that did not exist while only page one was
-                    // read — and a duplicate would inflate `toolCount`, double the tool's
-                    // `search_tools` row, and churn the registry's catalog-changed
-                    // comparison into a persistence write on every refresh.
-                    if (names.has(t.name))
-                        continue;
-                    names.add(t.name);
-                    listed.push(t);
-                    added++;
-                }
-                // Pagination ends when `nextCursor` is ABSENT — not when it is falsy.
-                // An empty string is a legal cursor and means "keep going"; `if
-                // (!next)` here would silently truncate that server's catalog.
-                const next = res.nextCursor;
-                if (typeof next !== "string") {
-                    complete = true;
-                    break;
-                }
-                // A page that adds nothing and still claims a successor made no
-                // progress. Allow exactly one: the widespread idiom is to advertise a
-                // cursor whenever a page came back full and then serve one empty page
-                // to terminate, and that server is conformant. Two in a row is a
-                // downstream going nowhere, and this kills a "fresh cursor forever, no
-                // tools" adversary in a couple of round trips instead of thousands.
-                if (added === 0 && ++barren > 1) {
-                    throw new Error(`Connector "${id}" returned two consecutive tools/list pages that added no tools and still advertised another — the catalog is not advancing.`);
-                }
-                if (added > 0)
-                    barren = 0;
-                // A cursor handed back a second time is not a slow server, it is a
-                // loop. Fail now rather than walking it until a ceiling notices.
-                if (spent.has(next)) {
-                    throw new Error(`Connector "${id}" handed back a tools/list cursor it had already issued — the pagination chain loops.`);
+            try {
+                for (let page = 0; page < MAX_TOOL_PAGES; page++) {
+                    // The scope can end between pages (probe timeout, teardown). Stop
+                    // rather than keep paging into a transport that is being closed.
+                    if (state.closed)
+                        throw scopeEndedError();
+                    // A discovery deadline uses the same signal for the whole chain.
+                    // Check it before issuing each page as well as passing it to the
+                    // in-flight SDK request, so expiry never starts one more round trip.
+                    if (ctx.signal?.aborted) {
+                        throw ctx.signal.reason instanceof Error
+                            ? ctx.signal.reason
+                            : new Error(`Connector "${id}" catalog deadline expired.`);
+                    }
+                    // Page one sends no params at all, so a non-paginated server sees
+                    // exactly the request it saw before pagination existed.
+                    const res = await listPage(client, cursor, ctx);
+                    let added = 0;
+                    for (const t of res.tools) {
+                        // First page wins. An unstable cursor can serve the same tool on
+                        // two pages — a duplicate would inflate `toolCount`, double the
+                        // `search_tools` row, and churn catalog persistence.
+                        if (names.has(t.name))
+                            continue;
+                        names.add(t.name);
+                        listed.push(t);
+                        added++;
+                    }
+                    // Pagination ends when `nextCursor` is absent or null — never merely
+                    // falsy. Empty string is present and means "keep going".
+                    const next = res.nextCursor;
+                    if (next === undefined || next === null) {
+                        complete = true;
+                        break;
+                    }
+                    // A page that adds nothing and still claims a successor made no
+                    // progress. Allow exactly one: the widespread idiom is to advertise
+                    // a cursor whenever a page came back full and then serve one empty
+                    // page to terminate. Two in a row is a downstream going nowhere.
+                    if (added === 0 && ++barren > 1) {
+                        throw new Error(`Connector "${id}" returned two consecutive tools/list pages that added no tools and still advertised another — the catalog is not advancing.`);
+                    }
+                    if (added > 0)
+                        barren = 0;
+                    // A cursor handed back a second time is a loop, not a slow server.
+                    if (spent.has(next)) {
+                        throw new Error(`Connector "${id}" handed back a tools/list cursor it had already issued — the pagination chain loops.`);
+                    }
+                    // Checked here rather than on arrival: this bounds what a *walk* may
+                    // accumulate; a one-page server was always free to send its page.
+                    if (listed.length > MAX_TOOLS) {
+                        throw new Error(`Connector "${id}" advertised further tools/list pages past ${listed.length} tools, over the ${MAX_TOOLS}-tool ceiling one catalog refresh will collect.`);
+                    }
+                    // Opaque by contract: handed straight back, never parsed, rewritten,
+                    // or persisted.
+                    spent.add(next);
+                    cursor = next;
                 }
-                // Checked here rather than on arrival: this bounds what a *walk* may
-                // accumulate, and a server that answers in one page was always free to
-                // send whatever it sends.
-                if (listed.length > MAX_TOOLS) {
-                    throw new Error(`Connector "${id}" advertised further tools/list pages past ${listed.length} tools, over the ${MAX_TOOLS}-tool ceiling one catalog refresh will collect.`);
+            }
+            catch (err) {
+                // A grant can be revoked after connect and after any earlier page.
+                // Classify that exactly like connect-time and call-time authorization
+                // failures, and latch it for the rest of this request scope.
+                if (err instanceof UnauthorizedError) {
+                    state.authRequired = true;
+                    throw authRequiredError(err);
                 }
-                // Opaque by contract: handed straight back, never parsed, rewritten,
-                // or persisted.
-                spent.add(next);
-                cursor = next;
+                throw err;
             }
             // Fail the refresh outright. Returning what we have would publish a
             // partial catalog that looks complete; throwing lets the registry keep
@@ -469,11 +587,13 @@ export function remoteMcp(id, opts) {
         },
         async closeScope(ctx) {
             const scope = ctx.requestScope ?? ctx;
+            // Tombstone before any lookup or await. This also makes close-before-use
+            // terminal rather than allowing the scope to spring into existence later.
+            closedScopes.add(scope);
             const state = states.get(scope);
             if (!state)
                 return;
-            // Delete before awaiting: a duplicate teardown is a no-op, and no later
-            // lookup can reuse the state while its client is closing.
+            // Delete before awaiting: a duplicate teardown is a no-op.
             states.delete(scope);
             state.closed = true;
             const client = state.client;