canvas-parent-mcp 2.1.1 → 2.1.3

package/dist/bundle.js

@@ -4858,7 +4858,7 @@ var require_memoizer = __commonJS({
     var NONE2 = 0;
     var ASSUMED2 = 1;
     var PROVEN2 = 2;
-    function isRecursive2(inst, stack, resolve2) {
+    function isRecursive2(inst, stack, resolve5) {
       const cached2 = recursive2.get(inst);
       if (cached2 !== void 0)
         return cached2 ? PROVEN2 : NONE2;
@@ -4868,7 +4868,7 @@ var require_memoizer = __commonJS({
       let result = NONE2;
       const check2 = (child) => {
         if (result !== PROVEN2 && child?._zod) {
-          const answer = isRecursive2(child, stack, resolve2);
+          const answer = isRecursive2(child, stack, resolve5);
           if (answer > result)
             result = answer;
         }
@@ -4879,7 +4879,7 @@ var require_memoizer = __commonJS({
           const desc = Object.getOwnPropertyDescriptor(sh, key);
           if (spread && !desc.enumerable)
             continue;
-          const child = desc.get ? ASSUMED2 : desc.value?._zod ? isRecursive2(desc.value, stack, resolve2) : NONE2;
+          const child = desc.get ? ASSUMED2 : desc.value?._zod ? isRecursive2(desc.value, stack, resolve5) : NONE2;
           if (child > answer)
             answer = child;
         }
@@ -4943,7 +4943,7 @@ var require_memoizer = __commonJS({
           break;
         // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
         case "lazy": {
-          const inner = def._cachedInner ?? (resolve2 ? inst._zod.innerType : void 0);
+          const inner = def._cachedInner ?? (resolve5 ? inst._zod.innerType : void 0);
           merge2(inner ? isRecursive2(inner, stack, false) : ASSUMED2);
           break;
         }
@@ -25548,7 +25548,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes3, createHash } = __require("crypto");
+    var { randomBytes: randomBytes4, createHash } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -26086,7 +26086,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes3(16).toString("base64");
+      const key = randomBytes4(16).toString("base64");
       const request = isSecure ? https.request : http.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -26980,9 +26980,23 @@ var require_websocket_server = __commonJS({
 });
 
 // src/index.ts
-import { dirname as dirname3, join as join4 } from "path";
+import { dirname as dirname4, join as join6 } from "path";
 import { fileURLToPath } from "url";
 
+// node_modules/@chrischall/mcp-utils/dist/cancel/index.js
+import { AsyncLocalStorage } from "node:async_hooks";
+var storage = new AsyncLocalStorage();
+function withCallSignal(signal, fn, request) {
+  return signal ? storage.run({ signal, ...request ? { request } : {} }, fn) : fn();
+}
+
+// node_modules/@chrischall/mcp-utils/dist/caller/index.js
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+var storage2 = new AsyncLocalStorage2();
+function withCallerCapabilities(capabilities, fn) {
+  return capabilities ? storage2.run(capabilities, fn) : fn();
+}
+
 // node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
 var __create2 = Object.create;
 var __defProp2 = Object.defineProperty;
@@ -31385,14 +31399,14 @@ function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
 }
 function sleep(ms, signal) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve5, reject) => {
     if (signal?.aborted) {
       reject(signal.reason instanceof SdkError ? signal.reason : new SdkError(SdkErrorCode.RequestTimeout, String(signal.reason)));
       return;
     }
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve2();
+      resolve5();
     }, ms);
     const onAbort = () => {
       clearTimeout(timer);
@@ -32186,7 +32200,7 @@ var Protocol = class {
     const flowStartedAt = Date.now();
     let onAbort;
     let cleanupMessageId;
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve5, reject) => {
       const earlyReject = (error62) => {
         reject(error62);
       };
@@ -32254,7 +32268,7 @@ var Protocol = class {
         }
         if (decoded.kind === "invalid") return reject(decoded.error);
         if (decoded.kind === "input_required") {
-          if (options?.allowInputRequired === true) return resolve2(manualInputRequiredValue(decoded));
+          if (options?.allowInputRequired === true) return resolve5(manualInputRequiredValue(decoded));
           const flow = {
             codec: codec2,
             request,
@@ -32266,11 +32280,11 @@ var Protocol = class {
               params
             }, resultSchema, legOptions)
           };
-          return resolve2(this._resolveNonCompleteResult(decoded, flow));
+          return resolve5(this._resolveNonCompleteResult(decoded, flow));
         }
         const result = decoded.result;
         validateStandardSchema(resultSchema, result).then((parseResult) => {
-          if (parseResult.success) resolve2(parseResult.data);
+          if (parseResult.success) resolve5(parseResult.data);
           else reject(new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${request.method}: ${parseResult.error}`));
         }, reject);
       });
@@ -35182,7 +35196,7 @@ var require_compile2 = /* @__PURE__ */ __commonJSMin(((exports) => {
     ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
     const schOrFunc = root.refs[ref];
     if (schOrFunc) return schOrFunc;
-    let _sch = resolve2.call(this, root, ref);
+    let _sch = resolve5.call(this, root, ref);
     if (_sch === void 0) {
       const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
       const { schemaId } = this.opts;
@@ -35208,7 +35222,7 @@ var require_compile2 = /* @__PURE__ */ __commonJSMin(((exports) => {
   function sameSchemaEnv(s1, s2) {
     return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
   }
-  function resolve2(root, ref) {
+  function resolve5(root, ref) {
     let sch;
     while (typeof (sch = this.refs[ref]) == "string") ref = sch;
     return sch || this.schemas[ref] || resolveSchema.call(this, root, ref);
@@ -35658,47 +35672,47 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
     else if (typeof uri === "object") uri = parse3(serialize(uri, options), options);
     return uri;
   }
-  function resolve2(baseURI, relativeURI, options) {
+  function resolve5(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
     const resolved2 = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
     schemelessOptions.skipEscape = true;
     return serialize(resolved2, schemelessOptions);
   }
-  function resolveComponent(base, relative, options, skipNormalization) {
+  function resolveComponent(base, relative2, options, skipNormalization) {
     const target = {};
     if (!skipNormalization) {
       base = parse3(serialize(base, options), options);
-      relative = parse3(serialize(relative, options), options);
+      relative2 = parse3(serialize(relative2, options), options);
     }
     options = options || {};
-    if (!options.tolerant && relative.scheme) {
-      target.scheme = relative.scheme;
-      target.userinfo = relative.userinfo;
-      target.host = relative.host;
-      target.port = relative.port;
-      target.path = removeDotSegments(relative.path || "");
-      target.query = relative.query;
+    if (!options.tolerant && relative2.scheme) {
+      target.scheme = relative2.scheme;
+      target.userinfo = relative2.userinfo;
+      target.host = relative2.host;
+      target.port = relative2.port;
+      target.path = removeDotSegments(relative2.path || "");
+      target.query = relative2.query;
     } else {
-      if (relative.userinfo !== void 0 || relative.host !== void 0 || relative.port !== void 0) {
-        target.userinfo = relative.userinfo;
-        target.host = relative.host;
-        target.port = relative.port;
-        target.path = removeDotSegments(relative.path || "");
-        target.query = relative.query;
+      if (relative2.userinfo !== void 0 || relative2.host !== void 0 || relative2.port !== void 0) {
+        target.userinfo = relative2.userinfo;
+        target.host = relative2.host;
+        target.port = relative2.port;
+        target.path = removeDotSegments(relative2.path || "");
+        target.query = relative2.query;
       } else {
-        if (!relative.path) {
+        if (!relative2.path) {
           target.path = base.path;
-          if (relative.query !== void 0) target.query = relative.query;
+          if (relative2.query !== void 0) target.query = relative2.query;
           else target.query = base.query;
         } else {
-          if (relative.path[0] === "/") target.path = removeDotSegments(relative.path);
+          if (relative2.path[0] === "/") target.path = removeDotSegments(relative2.path);
           else {
-            if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) target.path = "/" + relative.path;
-            else if (!base.path) target.path = relative.path;
-            else target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative.path;
+            if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) target.path = "/" + relative2.path;
+            else if (!base.path) target.path = relative2.path;
+            else target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative2.path;
             target.path = removeDotSegments(target.path);
           }
-          target.query = relative.query;
+          target.query = relative2.query;
         }
         target.userinfo = base.userinfo;
         target.host = base.host;
@@ -35706,7 +35720,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
       }
       target.scheme = base.scheme;
     }
-    target.fragment = relative.fragment;
+    target.fragment = relative2.fragment;
     return target;
   }
   function equal(uriA, uriB, options) {
@@ -35832,7 +35846,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
   const fastUri = {
     SCHEMES,
     normalize,
-    resolve: resolve2,
+    resolve: resolve5,
     resolveComponent,
     equal,
     serialize,
@@ -41205,7 +41219,7 @@ var StdioServerTransport = class {
   }
   send(message) {
     if (this._closed) return Promise.reject(/* @__PURE__ */ new Error("StdioServerTransport is closed"));
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve5, reject) => {
       const json2 = serializeMessage(message);
       let settled = false;
       const onError = (error62) => {
@@ -41220,14 +41234,14 @@ var StdioServerTransport = class {
         settled = true;
         this._stdout.off("error", onError);
         this._stdout.off("drain", onDrain);
-        resolve2();
+        resolve5();
       };
       this._stdout.once("error", onError);
       if (this._stdout.write(json2)) {
         if (settled) return;
         settled = true;
         this._stdout.off("error", onError);
-        resolve2();
+        resolve5();
       } else if (!settled) this._stdout.once("drain", onDrain);
     });
   }
@@ -41281,14 +41295,14 @@ var StdioConnectionChannel = class {
   */
   async whenRequestsAnswered(timeoutMs) {
     if (this._closed || this._pendingRequests.size === 0) return true;
-    return await new Promise((resolve2) => {
+    return await new Promise((resolve5) => {
       const waiter = () => {
         clearTimeout(timer);
-        resolve2(true);
+        resolve5(true);
       };
       const timer = setTimeout(() => {
         this._drainWaiters = this._drainWaiters.filter((pending) => pending !== waiter);
-        resolve2(false);
+        resolve5(false);
       }, timeoutMs);
       this._drainWaiters.push(waiter);
     });
@@ -41662,13 +41676,28 @@ var API_KEY_RE = new RegExp([
   "whsec_[A-Za-z0-9]{16,}\\b"
   // webhook signing secret (Stripe-style)
 ].map((p) => `\\b${p}`).join("|"), "g");
-var QUERY_SECRET_RE = /([?&](?:access_token|refresh_token|client_secret|api_?key|signature|token|key|sig)=)[^&#\s"'<>`]+/gi;
+var QUERY_SECRET_RE = /([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig)=)[^&#\s"'<>`]+/gi;
+var OAUTH_CODE_RE = /([?&]code=)(?=[^&#\s"'<>`]{16,})[^&#\s"'<>`]+/gi;
+var FORM_PASSWORD_RE = /((?:^|[\s,;:"'(\[{])(?:password|passwd)=)[^&#\s"'<>`]+/gim;
+var HEADER_SECRET_RE = /(\b(?:x[-_][a-z0-9_-]*?(?:api[-_]?key|token|secret|auth)[a-z0-9_-]*|api[-_]?key)\s*:\s*)[^\s,;"'<>`]+/gi;
 var AWS_SIGV4_RE = /([?&]X-Amz-(?:Signature|Security-Token|Credential)=)[^&#\s"'<>`]+/gi;
-var JSON_SECRET_KEYS = "access_token|refresh_token|client_secret|api_?key|password|passwd|secret|token";
-var JSON_SECRET_DQ_RE = new RegExp(`("(?:${JSON_SECRET_KEYS})"\\s*:\\s*")[^"]*(")`, "gi");
-var JSON_SECRET_SQ_RE = new RegExp(`('(?:${JSON_SECRET_KEYS})'\\s*:\\s*')[^']*(')`, "gi");
+var JSON_SECRET_KEYS = [
+  "(?:access|refresh|id|auth|session|bearer|csrf|xsrf)[_-]?token",
+  "client[_-]?secret",
+  "api[_-]?secret",
+  "(?:x[_-])?api[_-]?key",
+  "private[_-]?key",
+  "x[_-][a-z0-9_-]*?(?:api[_-]?key|token|secret|auth)[a-z0-9_-]*",
+  "(?:proxy-)?authorization",
+  "password",
+  "passwd",
+  "secret",
+  "token"
+].join("|");
+var JSON_SECRET_DQ_RE = new RegExp(`("(?:${JSON_SECRET_KEYS})"\\s*:\\s*")(?:[^"\\\\]|\\\\.)*(")`, "gi");
+var JSON_SECRET_SQ_RE = new RegExp(`('(?:${JSON_SECRET_KEYS})'\\s*:\\s*')(?:[^'\\\\]|\\\\.)*(')`, "gi");
 function redactSecrets(text) {
-  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JWT_RE, "[REDACTED]");
+  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(HEADER_SECRET_RE, "$1[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(OAUTH_CODE_RE, "$1[REDACTED]").replace(FORM_PASSWORD_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JWT_RE, "[REDACTED]");
 }
 function truncateErrorMessage(text, max = DEFAULT_ERROR_MESSAGE_MAX) {
   const str = text === null || text === void 0 ? "" : String(text);
@@ -46709,7 +46738,7 @@ var recursive = /* @__PURE__ */ new WeakMap();
 var NONE = 0;
 var ASSUMED = 1;
 var PROVEN = 2;
-function isRecursive(inst, stack, resolve2) {
+function isRecursive(inst, stack, resolve5) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -46719,7 +46748,7 @@ function isRecursive(inst, stack, resolve2) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve2);
+      const answer = isRecursive(child, stack, resolve5);
       if (answer > result)
         result = answer;
     }
@@ -46730,7 +46759,7 @@ function isRecursive(inst, stack, resolve2) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve2) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve5) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -46794,7 +46823,7 @@ function isRecursive(inst, stack, resolve2) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve2 ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve5 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -61447,17 +61476,73 @@ Hint: ${err.hint}`);
   }
   throw err;
 }
+function mcpRequestFrom(args) {
+  const ctx = args.at(-1);
+  if (typeof ctx !== "object" || ctx === null)
+    return void 0;
+  const req = ctx.mcpReq;
+  if (typeof req !== "object" || req === null)
+    return void 0;
+  return typeof req.notify === "function" ? req : void 0;
+}
+function callSignalFrom(args) {
+  const ctx = args.at(-1);
+  if (typeof ctx !== "object" || ctx === null)
+    return void 0;
+  const req = ctx.mcpReq;
+  if (typeof req !== "object" || req === null)
+    return void 0;
+  const signal = req.signal;
+  return signal instanceof AbortSignal ? signal : void 0;
+}
+function declaredCapabilitiesFrom(server) {
+  const inner = server.server;
+  if (typeof inner !== "object" || inner === null)
+    return void 0;
+  const read = inner.getClientCapabilities;
+  if (typeof read !== "function")
+    return void 0;
+  try {
+    const declared = read.call(inner);
+    return typeof declared === "object" && declared !== null ? declared : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function surfaceToolHints(server) {
   const register2 = server.registerTool.bind(server);
-  server.registerTool = (name, config2, cb) => register2(name, config2, (...args) => {
-    let result;
-    try {
-      result = cb(...args);
-    } catch (err) {
-      return hintResultOrRethrow(err);
-    }
-    return result instanceof Promise ? result.catch(hintResultOrRethrow) : result;
-  });
+  server.registerTool = (name, config2, cb) => register2(name, config2, (...args) => (
+    // THE CALLER'S CANCELLATION, made ambient for the whole handler
+    // (`cancel/index.ts`). The SDK delivers it and the fleet ignored it:
+    // measured against @modelcontextprotocol/server 2.0.0, a cancelled
+    // call aborts `ctx.mcpReq.signal` with the caller's reason and the
+    // handler runs to completion regardless — so the HTTP request stays
+    // in flight, the child keeps burning metered CPU, and the upstream
+    // keeps being hit for somebody who has gone. claude.ai sent 101
+    // cancellations in the week to 2026-09-20.
+    //
+    // Here because this is the one wrapper every tool already passes
+    // through: threading the signal by hand would mean editing several
+    // hundred handlers and missing exactly the ones nobody edits.
+    withCallSignal(callSignalFrom(args), () => (
+      // WHAT THE CALLER CAN DO, made ambient for the same reason and in
+      // the same place (`caller/index.ts`). Only the 2025-era half needs
+      // the wrapper — a 2026-07-28 request answers for itself off its own
+      // envelope — but a guarded tool that cannot tell whether the caller
+      // can be shown a prompt returns one the SDK then refuses to deliver,
+      // and that refusal reaches the caller as an unexplained protocol
+      // error it had no chance to catch.
+      withCallerCapabilities(declaredCapabilitiesFrom(server), () => {
+        let result;
+        try {
+          result = cb(...args);
+        } catch (err) {
+          return hintResultOrRethrow(err);
+        }
+        return result instanceof Promise ? result.catch(hintResultOrRethrow) : result;
+      })
+    ), mcpRequestFrom(args))
+  ));
 }
 async function createMcpServer(opts) {
   const server = new McpServer({ name: opts.name, version: opts.version }, { supportedProtocolVersions: [...SERVER_PROTOCOL_VERSIONS] });
@@ -61472,13 +61557,47 @@ async function createMcpServer(opts) {
   }
   return server;
 }
+var DEFAULT_SHUTDOWN_TIMEOUT_MS = 5e3;
+var DEFAULT_REPEAT_SIGNAL_GRACE_MS = 500;
 function withGracefulShutdown(target, opts = {}) {
   const shouldExit = opts.exit ?? true;
+  if (opts.timeoutMs !== void 0 && !(Number.isFinite(opts.timeoutMs) && opts.timeoutMs > 0)) {
+    throw new RangeError("withGracefulShutdown: timeoutMs must be a finite number greater than 0.");
+  }
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_SHUTDOWN_TIMEOUT_MS;
+  if (opts.repeatSignalGraceMs !== void 0 && !(Number.isFinite(opts.repeatSignalGraceMs) && opts.repeatSignalGraceMs >= 0)) {
+    throw new RangeError("withGracefulShutdown: repeatSignalGraceMs must be a finite number >= 0.");
+  }
+  const repeatGraceMs = opts.repeatSignalGraceMs ?? DEFAULT_REPEAT_SIGNAL_GRACE_MS;
   let shuttingDown = false;
+  let firstSignalAt = 0;
+  let exited = false;
+  const exitOnce = () => {
+    if (exited)
+      return;
+    exited = true;
+    process.exit(0);
+  };
   const handler = (signal) => {
-    if (shuttingDown)
+    if (shuttingDown) {
+      if (Date.now() - firstSignalAt < repeatGraceMs)
+        return;
+      if (shouldExit) {
+        console.error(`[mcp-utils] second ${signal} during shutdown \u2014 exiting now`);
+        exitOnce();
+      }
       return;
+    }
     shuttingDown = true;
+    firstSignalAt = Date.now();
+    let timer;
+    if (shouldExit) {
+      timer = setTimeout(() => {
+        console.error(`[mcp-utils] graceful shutdown on ${signal} did not finish in ${timeoutMs}ms \u2014 exiting`);
+        exitOnce();
+      }, timeoutMs);
+      timer.unref?.();
+    }
     void (async () => {
       try {
         if (opts.onSignal)
@@ -61487,8 +61606,10 @@ function withGracefulShutdown(target, opts = {}) {
       } catch (err) {
         console.error(`[mcp-utils] error during graceful shutdown on ${signal}: ${err instanceof Error ? err.message : String(err)}`);
       } finally {
+        if (timer !== void 0)
+          clearTimeout(timer);
         if (shouldExit)
-          process.exit(0);
+          exitOnce();
       }
     })();
   };
@@ -61518,6 +61639,8 @@ function runMcp(opts) {
 }
 
 // node_modules/@chrischall/mcp-utils/dist/config/index.js
+import { homedir } from "node:os";
+import { isAbsolute, join, resolve } from "node:path";
 var PLACEHOLDER_RE = /^\$\{[^}]*\}$/;
 function readEnvVar(key, opts = {}) {
   const env = opts.env ?? process.env;
@@ -61544,6 +61667,15 @@ function parseBoolEnv(key, opts = {}) {
     return false;
   return fallback;
 }
+function expandPath(p) {
+  let expanded = p;
+  if (p === "~") {
+    expanded = homedir();
+  } else if (p.startsWith("~/")) {
+    expanded = join(homedir(), p.slice(2));
+  }
+  return isAbsolute(expanded) ? expanded : resolve(expanded);
+}
 async function loadDotenvSafely(opts = {}) {
   try {
     const mod = await import(
@@ -61561,6 +61693,41 @@ async function loadDotenvSafely(opts = {}) {
   }
 }
 
+// node_modules/@chrischall/mcp-utils/dist/fs/confine.js
+import { existsSync, realpathSync } from "node:fs";
+import { dirname, isAbsolute as isAbsolute2, relative, resolve as resolve2, sep } from "node:path";
+function isInside(root, target) {
+  const rel = relative(root, target);
+  return rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute2(rel);
+}
+function realPathAllowingMissing(p) {
+  const abs = resolve2(p);
+  let existing = abs;
+  const tail = [];
+  while (!existsSync(existing)) {
+    const parent = dirname(existing);
+    if (parent === existing)
+      break;
+    tail.unshift(existing.slice(parent.length).replace(/^[/\\]+/, ""));
+    existing = parent;
+  }
+  let real;
+  try {
+    real = realpathSync(existing);
+  } catch {
+    real = existing;
+  }
+  return tail.length > 0 ? resolve2(real, ...tail) : real;
+}
+function assertPathWithinRoots(path, roots) {
+  const target = realPathAllowingMissing(expandPath(path));
+  for (const root of roots) {
+    if (isInside(realPathAllowingMissing(expandPath(root)), target))
+      return target;
+  }
+  throw new Error(`Path is outside the allowed directories: ${path}`);
+}
+
 // node_modules/@chrischall/mcp-utils/dist/http/index.js
 function buildQueryString(params) {
   const parts = [];
@@ -61695,6 +61862,33 @@ var pageSchema = {
 };
 
 // node_modules/@chrischall/mcp-utils/dist/auth/index.js
+var OAuth2RefreshError = class extends McpToolError {
+  status;
+  constructor(status, message, opts) {
+    super(message, opts);
+    this.name = "OAuth2RefreshError";
+    this.status = status;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var OAuth2RotationPersistError = class extends McpToolError {
+  persistenceFailure = true;
+  result;
+  constructor(result, cause) {
+    super(`OAuth2 refresh token rotated, but saving it failed: ${truncateErrorMessage(messageOf2(cause), 200)}`, {
+      hint: "The new refresh token is still held in memory; fix the storage problem before the process restarts.",
+      cause
+    });
+    this.name = "OAuth2RotationPersistError";
+    this.result = result;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+function isRetryable(err) {
+  if (!(err instanceof OAuth2RefreshError))
+    return true;
+  return err.status >= 500 || err.status === 429 || err.status === 408;
+}
 var sleep2 = (ms) => ms > 0 ? new Promise((r) => setTimeout(r, ms)) : Promise.resolve();
 function createOAuth2Refresher(opts) {
   const doFetch = opts.fetchImpl ?? fetch;
@@ -61702,10 +61896,13 @@ function createOAuth2Refresher(opts) {
   const maxRetries = opts.retry?.count ?? 0;
   const retryDelayMs = opts.retry?.delayMs ?? 0;
   let inFlight = null;
+  let currentRefreshToken = opts.refreshToken;
+  const spent = /* @__PURE__ */ new Set();
+  let rotatedTo;
   async function exchangeOnce() {
     const body = new URLSearchParams({
       grant_type: grantType,
-      refresh_token: opts.refreshToken,
+      refresh_token: currentRefreshToken,
       ...opts.params
     }).toString();
     const res = await doFetch(opts.endpoint, {
@@ -61718,7 +61915,7 @@ function createOAuth2Refresher(opts) {
     });
     if (!res.ok) {
       const errText = await res.text().catch(() => "");
-      throw createHelpfulError(`OAuth2 token refresh failed: ${res.status} ${res.statusText}: ${truncateErrorMessage(errText, 200)}`, { hint: "The refresh token may be expired or revoked \u2014 re-authenticate." });
+      throw new OAuth2RefreshError(res.status, `OAuth2 token refresh failed: ${res.status} ${res.statusText}: ${truncateErrorMessage(errText, 200)}`, { hint: "The refresh token may be expired or revoked \u2014 re-authenticate." });
     }
     const data = await res.json().catch(() => null);
     const accessToken = data?.access_token;
@@ -61730,6 +61927,11 @@ function createOAuth2Refresher(opts) {
     const result = { accessToken };
     if (typeof data?.refresh_token === "string" && data.refresh_token.length > 0) {
       result.refreshToken = data.refresh_token;
+      if (data.refresh_token !== currentRefreshToken) {
+        spent.add(currentRefreshToken);
+        currentRefreshToken = data.refresh_token;
+        rotatedTo = data.refresh_token;
+      }
     }
     if (typeof data?.expires_in === "number") {
       result.expiresIn = data.expires_in;
@@ -61744,16 +61946,32 @@ function createOAuth2Refresher(opts) {
         return await exchangeOnce();
       } catch (e) {
         lastErr = e;
+        if (!isRetryable(e))
+          break;
         if (attempt < maxRetries)
           await sleep2(retryDelayMs);
       }
     }
     throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
   }
-  return function refresh() {
+  return function refresh(refreshToken) {
     if (inFlight)
       return inFlight;
-    const p = exchangeWithRetry().finally(() => {
+    if (typeof refreshToken === "string" && refreshToken.length > 0 && !spent.has(refreshToken)) {
+      currentRefreshToken = refreshToken;
+    }
+    const p = (async () => {
+      rotatedTo = void 0;
+      const result = await exchangeWithRetry();
+      if (rotatedTo !== void 0 && opts.onRotate) {
+        try {
+          await opts.onRotate(rotatedTo);
+        } catch (err) {
+          throw new OAuth2RotationPersistError(result, err);
+        }
+      }
+      return result;
+    })().finally(() => {
       if (inFlight === p)
         inFlight = null;
     });
@@ -61761,6 +61979,9 @@ function createOAuth2Refresher(opts) {
     return p;
   };
 }
+function messageOf2(err) {
+  return err instanceof Error ? err.message : String(err);
+}
 
 // node_modules/@fetchproxy/protocol/dist/crypto.js
 var subtle = globalThis.crypto.subtle;
@@ -61959,6 +62180,7 @@ var KNOWN_CAPABILITIES = /* @__PURE__ */ new Set([
   "capture_redirect",
   "read_indexed_db",
   "read_dom",
+  "read_dom_list",
   "download",
   "graphql",
   "write_cookies"
@@ -62459,6 +62681,79 @@ function assertDomSelectorsArray(value, label) {
     }
   }
 }
+function assertDomListSelectorsArray(value, label) {
+  if (!Array.isArray(value)) {
+    throw new ProtocolError3(`${label}: expected array, got ${typeof value}`);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (let i = 0; i < value.length; i++) {
+    const entry = value[i];
+    assertObject(entry, `${label}[${i}]`);
+    if (entry.name === void 0) {
+      throw new ProtocolError3(`${label}[${i}].name: missing`);
+    }
+    if (entry.itemSelector === void 0) {
+      throw new ProtocolError3(`${label}[${i}].itemSelector: missing`);
+    }
+    if (entry.fields === void 0) {
+      throw new ProtocolError3(`${label}[${i}].fields: missing`);
+    }
+    if (typeof entry.name !== "string" || !SCOPE_KEY_RE.test(entry.name)) {
+      throw new ProtocolError3(`${label}[${i}].name: invalid ${JSON.stringify(entry.name)}`);
+    }
+    if (typeof entry.itemSelector !== "string" || !DOM_SELECTOR_RE.test(entry.itemSelector)) {
+      throw new ProtocolError3(`${label}[${i}].itemSelector: invalid ${JSON.stringify(entry.itemSelector)}`);
+    }
+    if (!Array.isArray(entry.fields) || entry.fields.length === 0) {
+      throw new ProtocolError3(`${label}[${i}].fields: expected non-empty array`);
+    }
+    const fieldNames = /* @__PURE__ */ new Set();
+    for (let j = 0; j < entry.fields.length; j++) {
+      const field = entry.fields[j];
+      const fieldLabel = `${label}[${i}].fields[${j}]`;
+      assertObject(field, fieldLabel);
+      if (field.name === void 0) {
+        throw new ProtocolError3(`${fieldLabel}.name: missing`);
+      }
+      if (typeof field.name !== "string" || !SCOPE_KEY_RE.test(field.name)) {
+        throw new ProtocolError3(`${fieldLabel}.name: invalid ${JSON.stringify(field.name)}`);
+      }
+      if (field.selector !== void 0) {
+        if (typeof field.selector !== "string" || !DOM_SELECTOR_RE.test(field.selector)) {
+          throw new ProtocolError3(`${fieldLabel}.selector: invalid ${JSON.stringify(field.selector)}`);
+        }
+      }
+      if (field.attribute !== void 0) {
+        if (typeof field.attribute !== "string" || !DOM_ATTRIBUTE_RE.test(field.attribute)) {
+          throw new ProtocolError3(`${fieldLabel}.attribute: invalid ${JSON.stringify(field.attribute)}`);
+        }
+      }
+      if (fieldNames.has(field.name)) {
+        throw new ProtocolError3(`${label}[${i}].fields: duplicate name ${JSON.stringify(field.name)}`);
+      }
+      fieldNames.add(field.name);
+      for (const k of Object.keys(field)) {
+        if (k !== "name" && k !== "selector" && k !== "attribute") {
+          throw new ProtocolError3(`${fieldLabel}: unexpected field ${JSON.stringify(k)}`);
+        }
+      }
+    }
+    if (entry.maxItems !== void 0) {
+      if (typeof entry.maxItems !== "number" || !Number.isInteger(entry.maxItems) || entry.maxItems < 1 || entry.maxItems > 1e3) {
+        throw new ProtocolError3(`${label}[${i}].maxItems: invalid ${JSON.stringify(entry.maxItems)}`);
+      }
+    }
+    if (seen.has(entry.name)) {
+      throw new ProtocolError3(`${label}: duplicate name ${JSON.stringify(entry.name)}`);
+    }
+    seen.add(entry.name);
+    for (const k of Object.keys(entry)) {
+      if (k !== "name" && k !== "itemSelector" && k !== "fields" && k !== "maxItems") {
+        throw new ProtocolError3(`${label}[${i}]: unexpected field ${JSON.stringify(k)}`);
+      }
+    }
+  }
+}
 function assertGraphqlOpsArray(value, label) {
   if (!Array.isArray(value)) {
     throw new ProtocolError3(`${label}: expected array, got ${typeof value}`);
@@ -62505,6 +62800,8 @@ function validateFrame(raw) {
     return validateHelloRejected(raw);
   if (t === "extension-disconnected")
     return { type: "extension-disconnected" };
+  if (t === "peer-gone")
+    return validatePeerGone(raw);
   throw new ProtocolError3(`unknown frame type: ${String(t)}`);
 }
 function validateHello(raw) {
@@ -62575,16 +62872,11 @@ function validateHello(raw) {
     if (raw.domSelectors !== void 0) {
       assertDomSelectorsArray(raw.domSelectors, "hello.domSelectors");
     }
-    if (raw.accepts !== void 0) {
-      if (!Array.isArray(raw.accepts)) {
-        throw new ProtocolError3("hello.accepts: expected array");
-      }
-      for (const a of raw.accepts) {
-        if (typeof a !== "string") {
-          throw new ProtocolError3(`hello.accepts: entry must be string, got ${typeof a}`);
-        }
-      }
+    if (raw.domListSelectors !== void 0) {
+      assertDomListSelectorsArray(raw.domListSelectors, "hello.domListSelectors");
     }
+    if (raw.accepts !== void 0)
+      assertAcceptsList(raw.accepts);
     if (raw.graphqlOps !== void 0) {
       assertGraphqlOpsArray(raw.graphqlOps, "hello.graphqlOps");
     }
@@ -62606,6 +62898,8 @@ function validateHello(raw) {
     assertBase64(raw.identityX25519Pub, "hello.identityX25519Pub");
     assertBase64(raw.identityEd25519Pub, "hello.identityEd25519Pub");
     assertBase64(raw.sessionNonce, "hello.sessionNonce");
+    if (raw.accepts !== void 0)
+      assertAcceptsList(raw.accepts);
     return raw;
   }
   throw new ProtocolError3(`hello.role: must be 'server' or 'extension', got ${String(role)}`);
@@ -62661,6 +62955,27 @@ function validatePairPending(raw) {
   }
   return { type: "pair-pending", mcpId: raw.mcpId, pairCode: raw.pairCode };
 }
+function assertAcceptsList(accepts) {
+  if (!Array.isArray(accepts)) {
+    throw new ProtocolError3("hello.accepts: expected array");
+  }
+  for (const a of accepts) {
+    if (typeof a !== "string") {
+      throw new ProtocolError3(`hello.accepts: entry must be string, got ${typeof a}`);
+    }
+  }
+}
+function validatePeerGone(raw) {
+  assertString(raw.mcpId, "peer-gone.mcpId");
+  if (!isValidMcpId(raw.mcpId))
+    throw new ProtocolError3("peer-gone.mcpId: invalid format");
+  for (const k of Object.keys(raw)) {
+    if (k !== "type" && k !== "mcpId") {
+      throw new ProtocolError3(`peer-gone: unexpected field ${JSON.stringify(k)}`);
+    }
+  }
+  return { type: "peer-gone", mcpId: raw.mcpId };
+}
 function validateHelloRejected(raw) {
   assertString(raw.mcpId, "hello-rejected.mcpId");
   if (!isValidMcpId(raw.mcpId))
@@ -62910,6 +63225,24 @@ function validateInnerRequest(raw) {
     }
     return raw;
   }
+  if (raw.op === "read_dom_list") {
+    assertObject(raw.init, "inner.init");
+    if (raw.init.origin === void 0)
+      throw new ProtocolError3("inner.init.origin: missing");
+    if (raw.init.name === void 0)
+      throw new ProtocolError3("inner.init.name: missing");
+    assertHttpsOriginOnly(raw.init.origin, "inner.init.origin");
+    assertString(raw.init.name, "inner.init.name");
+    if (raw.init.name.length === 0) {
+      throw new ProtocolError3("inner.init.name: must be non-empty");
+    }
+    for (const k of Object.keys(raw.init)) {
+      if (k !== "origin" && k !== "name") {
+        throw new ProtocolError3(`inner.init: unexpected field ${JSON.stringify(k)} on read_dom_list`);
+      }
+    }
+    return raw;
+  }
   if (raw.op === "graphql_query") {
     assertObject(raw.init, "inner.init");
     if (raw.init.name === void 0)
@@ -62957,7 +63290,7 @@ function validateInnerRequest(raw) {
     }
     return raw;
   }
-  throw new ProtocolError3(`inner.op: must be one of "fetch", "read_cookies", "read_local_storage", "read_session_storage", "capture_request_header", "capture_redirect", "read_indexed_db", "read_dom", "download", "graphql_query", "write_cookies"; got ${JSON.stringify(raw.op)}`);
+  throw new ProtocolError3(`inner.op: must be one of "fetch", "read_cookies", "read_local_storage", "read_session_storage", "capture_request_header", "capture_redirect", "read_indexed_db", "read_dom", "read_dom_list", "download", "graphql_query", "write_cookies"; got ${JSON.stringify(raw.op)}`);
 }
 function assertNonEmptyKeyArray(value, label) {
   if (!Array.isArray(value)) {
@@ -63065,6 +63398,18 @@ function validateInnerResponse(raw) {
       assertStringMap(raw.values, "inner.values");
       return raw;
     }
+    if (op === "read_dom_list") {
+      if (raw.rows === void 0) {
+        throw new ProtocolError3("inner.rows: missing on read_dom_list response");
+      }
+      if (!Array.isArray(raw.rows)) {
+        throw new ProtocolError3("inner.rows: expected array, got " + typeof raw.rows);
+      }
+      for (const [i, row] of raw.rows.entries()) {
+        assertStringMap(row, `inner.rows[${i}]`);
+      }
+      return raw;
+    }
     if (op === "graphql_query") {
       if (raw.data === void 0) {
         throw new ProtocolError3("inner.data: missing on graphql_query response");
@@ -63166,12 +63511,6 @@ async function sealInnerFrame(sessionKey, mcpId, seq, inner, direction) {
     ciphertext: toB64(ct)
   };
 }
-async function openEncryptedFrame(sessionKey, frame, direction) {
-  const result = await openEncryptedFrameDetailed(sessionKey, frame, direction);
-  if (result.stage === "ok")
-    return result.inner;
-  throw result.error instanceof Error ? result.error : new Error(String(result.error));
-}
 async function openEncryptedFrameDetailed(sessionKey, frame, direction) {
   let pt;
   try {
@@ -63202,7 +63541,7 @@ var DEFAULT_BIND_TIMEOUT_MS = 5e3;
 async function electRole(opts) {
   const server = createServer();
   const bindTimeoutMs = opts.bindTimeoutMs ?? DEFAULT_BIND_TIMEOUT_MS;
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve5, reject) => {
     let timer;
     const clearBindTimer = () => {
       if (timer) {
@@ -63218,7 +63557,7 @@ async function electRole(opts) {
           server.close();
         } catch {
         }
-        resolve2({ role: "peer" });
+        resolve5({ role: "peer" });
       } else {
         reject(e);
       }
@@ -63226,7 +63565,7 @@ async function electRole(opts) {
     const onListening = () => {
       clearBindTimer();
       server.removeListener("error", onError);
-      resolve2({ role: "host", server });
+      resolve5({ role: "host", server });
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -63323,6 +63662,18 @@ async function buildServerHello(opts) {
       ...d.attribute !== void 0 ? { attribute: d.attribute } : {}
     }));
   }
+  if (opts.domListSelectors && opts.domListSelectors.length > 0) {
+    hello.domListSelectors = opts.domListSelectors.map((d) => ({
+      name: d.name,
+      itemSelector: d.itemSelector,
+      fields: d.fields.map((f) => ({
+        name: f.name,
+        ...f.selector !== void 0 ? { selector: f.selector } : {},
+        ...f.attribute !== void 0 ? { attribute: f.attribute } : {}
+      })),
+      ...d.maxItems !== void 0 ? { maxItems: d.maxItems } : {}
+    }));
+  }
   if (opts.graphqlOps && opts.graphqlOps.length > 0) {
     hello.graphqlOps = opts.graphqlOps.map((d) => ({
       name: d.name,
@@ -63491,14 +63842,15 @@ async function awaitSessionReady(ready, opts) {
 }
 
 // node_modules/@fetchproxy/server/dist/extension-trust.js
-import { readFile as readFile2, writeFile as writeFile2, rename as rename2, unlink as unlink2, mkdir as mkdir2, chmod as chmod2 } from "node:fs/promises";
-import { isAbsolute as isAbsolute2, join as join2 } from "node:path";
+import { readFile as readFile2, writeFile as writeFile2, rename as rename2, unlink as unlink2, mkdir as mkdir2, chmod as chmod2, rm as rm2 } from "node:fs/promises";
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { isAbsolute as isAbsolute4, join as join3 } from "node:path";
 
 // node_modules/@fetchproxy/server/dist/identity.js
-import { readFile, readdir, writeFile, mkdir, chmod, rename, rm, unlink } from "node:fs/promises";
+import { readFile, readdir, writeFile, mkdir, chmod, rename, rm, unlink, link, lstat } from "node:fs/promises";
 import { randomBytes } from "node:crypto";
-import { isAbsolute, join } from "node:path";
-import { homedir } from "node:os";
+import { isAbsolute as isAbsolute3, join as join2 } from "node:path";
+import { homedir as homedir2 } from "node:os";
 var SAFE_PLAIN = /^[A-Za-z0-9._-]+$/;
 var SAFE_SCOPED = /^@[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
 function envIdentityDir() {
@@ -63506,12 +63858,12 @@ function envIdentityDir() {
   if (raw === void 0)
     return void 0;
   const dir = raw.trim();
-  if (dir === "" || !isAbsolute(dir))
+  if (dir === "" || !isAbsolute3(dir))
     return void 0;
   return dir;
 }
 function defaultIdentityDir() {
-  return envIdentityDir() ?? join(homedir(), ".fetchproxy", "identity");
+  return envIdentityDir() ?? join2(homedir2(), ".fetchproxy", "identity");
 }
 function safeIdentityFileBase(serverName) {
   if (!serverName || serverName === ".." || serverName.includes("..") || !SAFE_PLAIN.test(serverName) && !SAFE_SCOPED.test(serverName)) {
@@ -63520,7 +63872,7 @@ function safeIdentityFileBase(serverName) {
   return serverName.replace(/\//g, "_");
 }
 function identityFilePath(dir, serverName) {
-  return join(dir, `${safeIdentityFileBase(serverName)}.json`);
+  return join2(dir, `${safeIdentityFileBase(serverName)}.json`);
 }
 async function generateIdentity() {
   const x = await generateX25519();
@@ -63563,7 +63915,7 @@ async function openIdentityDir(dir) {
   }
 }
 var STAGING_BYTES = 6;
-async function sweepStagingFiles(dir, serverName) {
+async function sweepStagingFiles(dir, serverName, opts = {}) {
   const base = safeIdentityFileBase(serverName).replace(/[.]/g, "\\.");
   const staging = new RegExp(`^${base}\\.json\\.[0-9a-f]{${STAGING_BYTES * 2}}\\.tmp$`);
   let names;
@@ -63572,35 +63924,80 @@ async function sweepStagingFiles(dir, serverName) {
   } catch {
     return;
   }
-  await Promise.all(names.filter((name) => staging.test(name)).map((name) => unlink(join(dir, name)).catch(() => void 0)));
+  const cutoff = opts.olderThanMs === void 0 ? null : Date.now() - opts.olderThanMs;
+  await Promise.all(names.filter((name) => staging.test(name)).map(async (name) => {
+    const path = join2(dir, name);
+    if (cutoff !== null) {
+      const st = await lstat(path).catch(() => null);
+      if (st === null || st.mtimeMs > cutoff)
+        return;
+    }
+    await unlink(path).catch(() => void 0);
+  }));
 }
-async function writeIdentityFile(dir, serverName, id) {
+async function loadOrCreateIdentity(serverName, dir = defaultIdentityDir()) {
   const path = identityFilePath(dir, serverName);
   await openIdentityDir(dir);
-  await sweepStagingFiles(dir, serverName);
-  const tmp = `${path}.${randomBytes(STAGING_BYTES).toString("hex")}.tmp`;
   try {
-    await writeFile(tmp, serializeIdentity(id), { mode: 384, flag: "wx" });
-    await chmod(tmp, 384);
-    await rename(tmp, path);
+    return parseIdentity(await readFile(path, "utf8"));
   } catch (e) {
-    await rm(tmp, { force: true });
-    throw e;
+    if (e.code !== "ENOENT" && !(e instanceof SyntaxError))
+      throw e;
+  }
+  let unreadable = null;
+  for (let attempt = 0; attempt < 5; attempt++) {
+    const id = await generateIdentity();
+    if (await publishIdentityIfAbsent(dir, serverName, id))
+      return id;
+    try {
+      return parseIdentity(await readFile(path, "utf8"));
+    } catch (e) {
+      if (e.code === "ENOENT") {
+        continue;
+      }
+      if (!(e instanceof SyntaxError))
+        throw e;
+      unreadable = e;
+      await new Promise((r) => setTimeout(r, 20 * (attempt + 1)));
+    }
   }
-  return path;
+  if (unreadable !== null)
+    throw unreadable;
+  throw new Error(`fetchproxy: could not create an identity for ${JSON.stringify(serverName)} in ${dir}`);
 }
-async function loadOrCreateIdentity(serverName, dir = defaultIdentityDir()) {
+var NO_HARD_LINKS = /* @__PURE__ */ new Set(["EPERM", "ENOTSUP", "EOPNOTSUPP", "ENOSYS"]);
+async function publishIdentityIfAbsent(dir, serverName, id) {
   const path = identityFilePath(dir, serverName);
-  await openIdentityDir(dir);
+  await sweepStagingFiles(dir, serverName, { olderThanMs: 6e4 });
+  const tmp = `${path}.${randomBytes(STAGING_BYTES).toString("hex")}.tmp`;
   try {
-    return parseIdentity(await readFile(path, "utf8"));
+    await writeFile(tmp, serializeIdentity(id), { mode: 384, flag: "wx" });
+    await chmod(tmp, 384);
+    try {
+      await link(tmp, path);
+    } catch (e) {
+      const code = e.code;
+      if (code === void 0 || !NO_HARD_LINKS.has(code))
+        throw e;
+      try {
+        await writeFile(path, serializeIdentity(id), { mode: 384, flag: "wx" });
+      } catch (writeErr) {
+        if (writeErr.code !== "EEXIST") {
+          await rm(path, { force: true }).catch(() => void 0);
+        }
+        throw writeErr;
+      }
+      await chmod(path, 384);
+    }
+    return true;
   } catch (e) {
-    if (e.code !== "ENOENT")
-      throw e;
+    const code = e.code;
+    if (code === "EEXIST" || code === "ENOENT")
+      return false;
+    throw e;
+  } finally {
+    await rm(tmp, { force: true });
   }
-  const id = await generateIdentity();
-  await writeIdentityFile(dir, serverName, id);
-  return id;
 }
 
 // node_modules/@fetchproxy/server/dist/extension-trust.js
@@ -63610,7 +64007,7 @@ function envTrustDir(env = process.env) {
   if (raw === void 0)
     return void 0;
   const dir = raw.trim();
-  if (dir !== "" && isAbsolute2(dir))
+  if (dir !== "" && isAbsolute4(dir))
     return dir;
   console.warn(`[fetchproxy] ignoring ${TRUST_DIR_ENV}=${JSON.stringify(raw)}: it is not an absolute path. The extension pin will be written beside the identity instead, which is not where you pointed it \u2014 if that directory is read-only, no pin is ever kept.`);
   return void 0;
@@ -63658,13 +64055,13 @@ function decideExtensionTrust(args) {
   };
 }
 function extensionTrustPath(serverName, dir = defaultTrustDir()) {
-  return join2(dir, `${safeIdentityFileBase(serverName)}.extension-trust.json`);
+  return join3(dir, `${safeIdentityFileBase(serverName)}.extension-trust.json`);
 }
 function extensionTrustPathHint(serverName) {
   try {
     return extensionTrustPath(serverName);
   } catch {
-    return join2(defaultTrustDir(), "<server-name>.extension-trust.json");
+    return join3(defaultTrustDir(), "<server-name>.extension-trust.json");
   }
 }
 function isPin(x) {
@@ -63701,10 +64098,15 @@ async function readExtensionPin(serverName, dir = defaultTrustDir()) {
 async function writeExtensionPin(serverName, pin, dir = defaultTrustDir()) {
   const path = extensionTrustPath(serverName, dir);
   await mkdir2(dir, { recursive: true, mode: 448 });
-  const tmp = `${path}.tmp`;
-  await writeFile2(tmp, JSON.stringify(pin, null, 2), { mode: 384 });
-  await chmod2(tmp, 384);
-  await rename2(tmp, path);
+  const tmp = `${path}.${randomBytes2(6).toString("hex")}.tmp`;
+  try {
+    await writeFile2(tmp, JSON.stringify(pin, null, 2), { mode: 384, flag: "wx" });
+    await chmod2(tmp, 384);
+    await rename2(tmp, path);
+  } catch (e) {
+    await rm2(tmp, { force: true });
+    throw e;
+  }
 }
 
 // node_modules/@fetchproxy/server/dist/host.js
@@ -63741,6 +64143,7 @@ function originVerdict(origin, allowLocal) {
 var HANDSHAKE_TIMEOUT_MS = 15e3;
 var MAX_PAYLOAD_BYTES = MAX_FRAME_BYTES;
 var enc4 = new TextEncoder();
+var OWN_DECRYPT_FAILURES_BEFORE_REHANDSHAKE = 3;
 async function startHost(opts) {
   const allowLocalOrigins = envAllowsLocalOrigins();
   if (allowLocalOrigins) {
@@ -63784,6 +64187,7 @@ async function startHost(opts) {
     localStoragePointers: opts.ownLocalStoragePointers,
     sessionStoragePointers: opts.ownSessionStoragePointers,
     domSelectors: opts.ownDomSelectors,
+    domListSelectors: opts.ownDomListSelectors,
     graphqlOps: opts.ownGraphqlOps
   };
   const generateSessionKeypair = opts.generateSessionKeypair ?? generateX25519;
@@ -63810,8 +64214,8 @@ async function startHost(opts) {
   let rejectOwnSession;
   let ownSessionReady;
   function resetSessionPromise() {
-    ownSessionReady = new Promise((resolve2, reject) => {
-      resolveOwnSession = resolve2;
+    ownSessionReady = new Promise((resolve5, reject) => {
+      resolveOwnSession = resolve5;
       rejectOwnSession = reject;
     });
     ownSessionReady.catch(() => {
@@ -63854,6 +64258,31 @@ async function startHost(opts) {
       return null;
     }
   };
+  let ownDecryptFailures = 0;
+  const rehandshakeOwnSession = async (ws) => {
+    const hello = extensionHello;
+    if (extensionWs !== ws || !hello)
+      return;
+    console.warn(`[fetchproxy] ${opts.ownServerName}: ${OWN_DECRYPT_FAILURES_BEFORE_REHANDSHAKE} frames in a row from the extension failed authentication under this MCP's session key \u2014 re-handshaking this MCP's session (the extension stays connected).`);
+    ownSession = dropOwnSessionAndEphemeral();
+    resetSessionPromise();
+    const mintedKeypair = await generateSessionKeypair();
+    const mintedHello = await buildServerHello({
+      ...ownHelloBase,
+      sessionPub: mintedKeypair.publicKey,
+      answersExtNonce: fromB64(hello.sessionNonce)
+    });
+    if (extensionWs !== ws || extensionHello !== hello || ownSession !== null) {
+      mintedKeypair.privateKey.fill(0);
+      return;
+    }
+    installOwnEphemeral({
+      nonce: fromB64(mintedHello.sessionNonce),
+      pub: mintedKeypair.publicKey,
+      priv: mintedKeypair.privateKey
+    });
+    ws.send(JSON.stringify(mintedHello));
+  };
   wss.on("connection", (ws) => {
     let identified = null;
     let peerMcpId = null;
@@ -64044,6 +64473,7 @@ async function startHost(opts) {
             if (extensionWs !== ws)
               return;
             ownSession = new SessionState(key);
+            ownDecryptFailures = 0;
             ownPendingPairCode = null;
             resolveOwnSession(ownSession);
           } else {
@@ -64065,15 +64495,42 @@ async function startHost(opts) {
               }
               if (claim2 !== "ok")
                 return;
-              let inner;
+              let result;
               try {
-                inner = await openEncryptedFrame(session.sessionKey, frame, "e2s");
+                result = await openEncryptedFrameDetailed(session.sessionKey, frame, "e2s");
               } catch (e) {
                 session.releaseInboundSeq(frame.seq);
                 throw e;
               }
+              if (result.stage === "decrypt-failed") {
+                session.releaseInboundSeq(frame.seq);
+                console.warn(`[fetchproxy] ${opts.ownServerName}: dropped an inbound frame (seq ${frame.seq}) that failed authentication \u2014 most likely a straggler from a previous session.`);
+                if (session === ownSession) {
+                  ownDecryptFailures += 1;
+                  if (ownDecryptFailures >= OWN_DECRYPT_FAILURES_BEFORE_REHANDSHAKE) {
+                    ownDecryptFailures = 0;
+                    void rehandshakeOwnSession(ws).catch((e) => console.error(`[fetchproxy] ${opts.ownServerName}: re-handshake failed:`, e));
+                  }
+                }
+                return;
+              }
+              if (session === ownSession)
+                ownDecryptFailures = 0;
               session.commitInboundSeq(frame.seq);
-              ownInnerListeners.forEach((cb) => cb(inner));
+              if (result.stage === "ok") {
+                ownInnerListeners.forEach((cb) => cb(result.inner));
+              } else {
+                console.error("[fetchproxy] host: received a frame that decrypted OK but failed validation:", result.error);
+                const recoveredId = result.recoveredId;
+                if (recoveredId !== void 0) {
+                  ownInnerListeners.forEach((cb) => cb({
+                    type: "response",
+                    id: recoveredId,
+                    ok: false,
+                    error: `malformed response failed protocol validation: ${String(result.error)}`
+                  }));
+                }
+              }
             } else {
               const slot = peers.get(frame.mcpId);
               if (slot)
@@ -64132,6 +64589,7 @@ async function startHost(opts) {
           rejectOwnSession(new Error("extension disconnected before ready"));
         }
         ownSession = dropOwnSessionAndEphemeral();
+        ownDecryptFailures = 0;
         ownPendingPairCode = null;
         resetSessionPromise();
         disconnectListeners.forEach((cb) => cb());
@@ -64146,13 +64604,20 @@ async function startHost(opts) {
         }
       }
       if (identified === "peer" && peerMcpId) {
-        if (peers.get(peerMcpId)?.ws === ws)
+        if (peers.get(peerMcpId)?.ws === ws) {
           peers.delete(peerMcpId);
+          if (extensionWs && extensionHello?.accepts?.includes("peer-gone")) {
+            try {
+              extensionWs.send(JSON.stringify({ type: "peer-gone", mcpId: peerMcpId }));
+            } catch {
+            }
+          }
+        }
       }
     });
   });
   return {
-    close: () => new Promise((resolve2) => {
+    close: () => new Promise((resolve5) => {
       for (const client of wss.clients) {
         try {
           client.terminate();
@@ -64160,7 +64625,7 @@ async function startHost(opts) {
         }
       }
       wss.close(() => {
-        opts.httpServer.close(() => resolve2());
+        opts.httpServer.close(() => resolve5());
       });
     }),
     sendOwnInner: async (inner) => {
@@ -64190,26 +64655,42 @@ async function startHost(opts) {
 }
 
 // node_modules/@fetchproxy/server/dist/peer.js
+var PEER_DIAL_TIMEOUT_MS = 5e3;
 var enc5 = new TextEncoder();
+function notSentError() {
+  return new Error("fetchproxy: request not sent \u2014 the connection to the bridge host closed before it went out, so nothing reached the browser. It is safe to retry.");
+}
 async function startPeer(opts) {
   const ws = new import_websocket.default(`ws://${opts.host}:${opts.port}`, {
     maxPayload: opts.maxPayloadBytes ?? MAX_PAYLOAD_BYTES
   });
-  await new Promise((resolve2, reject) => {
+  const dialTimeoutMs = opts.dialTimeoutMs ?? PEER_DIAL_TIMEOUT_MS;
+  await new Promise((resolve5, reject) => {
+    let timer;
     const onOpen = () => {
       cleanup();
-      resolve2();
+      resolve5();
     };
     const onError = (e) => {
       cleanup();
       reject(e);
     };
     const cleanup = () => {
+      if (timer !== void 0)
+        clearTimeout(timer);
       ws.off("open", onOpen);
       ws.off("error", onError);
     };
     ws.once("open", onOpen);
     ws.once("error", onError);
+    if (dialTimeoutMs > 0) {
+      timer = setTimeout(() => {
+        cleanup();
+        ws.on("error", () => void 0);
+        ws.terminate();
+        reject(new Error(`fetchproxy: the process holding ${opts.host}:${opts.port} did not answer the WebSocket upgrade within ${dialTimeoutMs}ms \u2014 it may be wedged or not a fetchproxy host. Restart the MCP that owns the port (or free it) and retry.`));
+      }, dialTimeoutMs);
+    }
   });
   ws.on("error", (e) => {
     console.warn(`[fetchproxy] peer: socket error: ${String(e)}`);
@@ -64228,6 +64709,7 @@ async function startPeer(opts) {
     captureHeaders: opts.captureHeaders,
     indexedDbScopes: opts.indexedDbScopes,
     domSelectors: opts.domSelectors,
+    domListSelectors: opts.domListSelectors,
     localStoragePointers: opts.localStoragePointers,
     sessionStoragePointers: opts.sessionStoragePointers,
     graphqlOps: opts.graphqlOps,
@@ -64251,6 +64733,7 @@ async function startPeer(opts) {
   const renegotiateListeners = [];
   const pendingPairListeners = [];
   const closeListeners = [];
+  const extensionDisconnectListeners = [];
   let session = null;
   let sessionEphemeral = null;
   function dropSessionEphemeral() {
@@ -64270,10 +64753,24 @@ async function startPeer(opts) {
   let warnedUnverifiablePairCode = false;
   let resolveFirstReady;
   let rejectFirstReady;
-  const sessionPromise = new Promise((resolve2, reject) => {
-    resolveFirstReady = resolve2;
-    rejectFirstReady = reject;
-  });
+  let sessionPromise;
+  let sessionPromiseSettled = false;
+  function resetSessionPromise() {
+    sessionPromiseSettled = false;
+    sessionPromise = new Promise((resolve5, reject) => {
+      resolveFirstReady = (st) => {
+        sessionPromiseSettled = true;
+        resolve5(st);
+      };
+      rejectFirstReady = (e) => {
+        sessionPromiseSettled = true;
+        reject(e);
+      };
+    });
+    sessionPromise.catch(() => {
+    });
+  }
+  resetSessionPromise();
   let extensionHello = null;
   let extensionGone = false;
   let cachedPin = void 0;
@@ -64370,6 +64867,12 @@ async function startPeer(opts) {
         extensionGone = true;
         dropSessionEphemeral();
         pendingPairCode = null;
+        if (session !== null) {
+          session = null;
+          if (sessionPromiseSettled)
+            resetSessionPromise();
+        }
+        extensionDisconnectListeners.forEach((cb) => cb());
         return;
       }
       if (frame.type === "ready" && frame.mcpId === opts.mcpId) {
@@ -64486,19 +64989,30 @@ async function startPeer(opts) {
     }
     closeListeners.forEach((cb) => cb());
   });
-  sessionPromise.catch(() => {
-  });
   const handle = {
     ws,
-    session: sessionPromise,
+    // A getter: `extension-disconnected` replaces the promise (B-BUG-5).
+    get session() {
+      return sessionPromise;
+    },
     sendInner: async (inner) => {
-      await awaitSessionReady(sessionPromise, {
-        mcpId: opts.mcpId,
-        pendingPairCode: () => pendingPairCode
-      });
+      try {
+        await awaitSessionReady(sessionPromise, {
+          mcpId: opts.mcpId,
+          pendingPairCode: () => pendingPairCode
+        });
+      } catch (e) {
+        if (ws.readyState !== import_websocket.default.OPEN)
+          throw notSentError();
+        throw e;
+      }
       const s = session;
+      if (s === null)
+        throw new Error("peer: extension disconnected");
       const plaintext = encodeOutboundInnerFrame(opts.mcpId, inner);
       const sealed = await sealInnerFrame(s.sessionKey, opts.mcpId, s.nextOutboundSeq(), plaintext, "s2e");
+      if (ws.readyState !== import_websocket.default.OPEN)
+        throw notSentError();
       ws.send(JSON.stringify(sealed));
     },
     onInner: (cb) => {
@@ -64516,6 +65030,9 @@ async function startPeer(opts) {
     onClose: (cb) => {
       closeListeners.push(cb);
     },
+    onExtensionDisconnect: (cb) => {
+      extensionDisconnectListeners.push(cb);
+    },
     close: () => ws.close()
   };
   return handle;
@@ -64523,15 +65040,15 @@ async function startPeer(opts) {
 
 // node_modules/@fetchproxy/server/dist/error-kind.js
 function classifyFetchError(error62) {
+  if (/^(in-page )?fetch threw:/.test(error62)) {
+    return "tab_fetch_failed";
+  }
   if (/Could not establish connection/i.test(error62) || /Receiving end does not exist/i.test(error62)) {
     return "content_script_unreachable";
   }
   if (/^tab fetch failed:/.test(error62)) {
     return "tab_fetch_failed";
   }
-  if (/^(in-page )?fetch threw:/.test(error62)) {
-    return "tab_fetch_failed";
-  }
   if (/^no tab matching /.test(error62)) {
     return "no_tab";
   }
@@ -64723,6 +65240,17 @@ var FetchproxyTimeoutError = class extends FetchproxyProtocolError {
    * the message says which number that was and where it came from.
    */
   requestedTimeoutMs;
+  /**
+   * B-BUG-1: whether re-sending this request is safe. A timeout only means
+   * the reply did not arrive in time — the extension may already have run the
+   * request in the tab — so this is `false` for a non-idempotent `fetch`
+   * (anything but GET/HEAD/OPTIONS) the caller did not mark `retryOnTimeout`,
+   * for `download` and `writeCookies`, and for `graphqlQuery` unless the
+   * caller marked it `retryOnTimeout` (a declared operation may be a
+   * mutation). `retryOnceOnTimeout` honours it. Defaults to `true` (the read
+   * verbs).
+   */
+  retrySafe;
   constructor(args) {
     const graceMs = args.graceMs ?? VERB_DEADLINE_GRACE_MS;
     const callerChose = args.requestedTimeoutMs !== void 0 && args.timeoutMs === args.requestedTimeoutMs + graceMs;
@@ -64735,6 +65263,7 @@ var FetchproxyTimeoutError = class extends FetchproxyProtocolError {
     this.elapsedMs = args.elapsedMs ?? args.timeoutMs;
     this.retryAttempted = args.retryAttempted ?? false;
     this.requestedTimeoutMs = args.requestedTimeoutMs ?? null;
+    this.retrySafe = args.retrySafe ?? true;
   }
 };
 var SUBDOMAIN_LABEL_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/i;
@@ -64774,6 +65303,32 @@ function assertUrlInDomains(field, url4, domains) {
   throw new Error(`FetchproxyServer: ${field} host "${host}" is outside declared domains [${declared}] \u2014 must be one of them or a subdomain`);
 }
 var DEFAULT_JSON_OK_STATUSES = [200, 201, 202, 204];
+function parseJsonBody(response) {
+  if (response.status === 204 || response.body.trim() === "")
+    return null;
+  return JSON.parse(response.body);
+}
+var TIMEOUT_RETRY_SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function isRetrySafeOnTimeout(method, retryOnTimeout) {
+  if (retryOnTimeout !== void 0)
+    return retryOnTimeout;
+  return TIMEOUT_RETRY_SAFE_METHODS.has(method.toUpperCase());
+}
+function isResendableRequest(inner) {
+  switch (inner.op) {
+    case "fetch":
+      return isRetrySafeOnTimeout(inner.init.method);
+    case "write_cookies":
+    case "download":
+    // A declared GraphQL operation may be a mutation; the server holds only
+    // its name, so it cannot tell. `graphqlQuery({ retryOnTimeout: true })`
+    // passes `resendable` explicitly for a known query.
+    case "graphql_query":
+      return false;
+    default:
+      return true;
+  }
+}
 var FetchproxyServer = class {
   /**
    * Bridge role. `null` until the first verb call (or an explicit
@@ -64822,12 +65377,22 @@ var FetchproxyServer = class {
   pendingRedirect = /* @__PURE__ */ new Map();
   // 0.4.0+: read_indexed_db awaiters resolve a JSON-typed values map.
   pendingIdb = /* @__PURE__ */ new Map();
+  // 3.1.0+: read_dom_list awaiters resolve an array of field-value rows —
+  // a different shape from `pendingStorage`'s single map, so its own map.
+  pendingDomList = /* @__PURE__ */ new Map();
   // download awaiters resolve the saved-file metadata (path + size + mime).
   pendingDownload = /* @__PURE__ */ new Map();
   // 1.x+: graphql_query awaiters resolve the GraphQL `data` object. Its
   // shape is operation-specific, so the awaiter resolves `unknown` and the
   // caller narrows.
   pendingGraphql = /* @__PURE__ */ new Map();
+  /**
+   * B-BUG-6: the frames of in-flight requests that are safe to send again
+   * if the host that relayed them exits before replying (see
+   * `recoverFromHostLoss`). Keyed by request id; an entry outlives its
+   * request only until the next prune or response.
+   */
+  resendable = /* @__PURE__ */ new Map();
   mcpId = null;
   identity = null;
   // 0.5.3+: in-flight role-election / handle-start promise. Set the
@@ -64873,7 +65438,7 @@ var FetchproxyServer = class {
       }
       for (const c of opts.capabilities) {
         if (!KNOWN_CAPABILITIES.has(c)) {
-          throw new Error(`FetchproxyServer: unknown capability ${JSON.stringify(c)} \u2014 known values: ["fetch", "read_cookies"]`);
+          throw new Error(`FetchproxyServer: unknown capability ${JSON.stringify(c)} \u2014 known values: ${JSON.stringify([...KNOWN_CAPABILITIES])}`);
         }
       }
       capabilities = [...opts.capabilities];
@@ -64920,6 +65485,16 @@ var FetchproxyServer = class {
         selector: d.selector,
         ...d.attribute !== void 0 ? { attribute: d.attribute } : {}
       })),
+      domListSelectors: (opts.domListSelectors ?? []).map((d) => ({
+        name: d.name,
+        itemSelector: d.itemSelector,
+        fields: d.fields.map((f) => ({
+          name: f.name,
+          ...f.selector !== void 0 ? { selector: f.selector } : {},
+          ...f.attribute !== void 0 ? { attribute: f.attribute } : {}
+        })),
+        ...d.maxItems !== void 0 ? { maxItems: d.maxItems } : {}
+      })),
       graphqlOps: (opts.graphqlOps ?? []).map((d) => ({
         name: d.name,
         operationName: d.operationName
@@ -65049,6 +65624,7 @@ var FetchproxyServer = class {
         ownLocalStoragePointers: this.opts.localStoragePointers,
         ownSessionStoragePointers: this.opts.sessionStoragePointers,
         ownDomSelectors: this.opts.domSelectors,
+        ownDomListSelectors: this.opts.domListSelectors,
         ownGraphqlOps: this.opts.graphqlOps,
         onPairCode: this.opts.onPairCode,
         extensionTrust: this.extensionTrust()
@@ -65080,6 +65656,7 @@ var FetchproxyServer = class {
         localStoragePointers: this.opts.localStoragePointers,
         sessionStoragePointers: this.opts.sessionStoragePointers,
         domSelectors: this.opts.domSelectors,
+        domListSelectors: this.opts.domListSelectors,
         graphqlOps: this.opts.graphqlOps,
         extensionTrust: this.extensionTrust(),
         requireExtensionIdentity: this.opts.requireExtensionIdentity
@@ -65089,6 +65666,10 @@ var FetchproxyServer = class {
         this.stopKeepalive();
         this.rejectAllPending();
       });
+      this.peerHandle.onExtensionDisconnect(() => {
+        this.stopKeepalive();
+        this.rejectAllPending();
+      });
       this.peerHandle.onPendingPair((code) => {
         this.rejectAllPending(this.pairingErrorMessage(code));
       });
@@ -65100,9 +65681,9 @@ var FetchproxyServer = class {
         if (this.closing || this.peerHandle === null)
           return;
         this.stopKeepalive();
-        this.rejectAllPending();
         this.peerHandle = null;
         this.role = null;
+        void this.recoverFromHostLoss();
       });
     }
   }
@@ -65123,7 +65704,7 @@ var FetchproxyServer = class {
    * only when the bridge itself failed (no signed-in tab, extension
    * offline, etc.).
    */
-  async fetch(init) {
+  async fetch(init, fetchOpts = {}) {
     await this.ensureConnected();
     const pendingCode = this.currentPendingPairCode();
     if (pendingCode !== null) {
@@ -65135,16 +65716,17 @@ var FetchproxyServer = class {
         retryAttempted: false
       };
     }
-    const first = await this._fetchOnceWithTimeout(init);
+    const first = await this._fetchOnceWithTimeout(init, fetchOpts);
     const reviveMs = this.opts.bridgeReviveDelayMs;
     const isColdStartSymptom = !first.ok && (first.kind === "content_script_unreachable" || first.kind === "timeout");
     if (isColdStartSymptom) {
       this.lastEvictionDetectedAt = Date.now();
     }
-    if (isColdStartSymptom && reviveMs !== void 0 && reviveMs > 0) {
+    const retryable = isColdStartSymptom && (first.kind === "content_script_unreachable" || isRetrySafeOnTimeout(init.method, fetchOpts.retryOnTimeout));
+    if (retryable && reviveMs !== void 0 && reviveMs > 0) {
       this.lazyReviveAttempts += 1;
       await new Promise((r) => setTimeout(r, reviveMs));
-      const second = await this._fetchOnceWithTimeout(init);
+      const second = await this._fetchOnceWithTimeout(init, fetchOpts);
       if (second.ok) {
         this.lazyReviveSuccesses += 1;
         this.recordSuccess();
@@ -65293,13 +65875,16 @@ var FetchproxyServer = class {
    * one of the op maps — request ids are unique) so it doesn't leak until the
    * server closes, then rethrow.
    */
-  async sendInnerFrame(inner) {
+  async sendInnerFrame(inner, opts = {}) {
     try {
       if (this.hostHandle) {
         await this.hostHandle.sendOwnInner(inner);
       } else if (this.peerHandle) {
         await this.peerHandle.sendInner(inner);
       }
+      if (inner.type === "request" && (opts.resendable ?? isResendableRequest(inner))) {
+        this.noteResendable(inner);
+      }
     } catch (err) {
       if ("id" in inner && typeof inner.id === "number") {
         const { id } = inner;
@@ -65311,6 +65896,7 @@ var FetchproxyServer = class {
         this.pendingRedirect.delete(id);
         this.pendingDownload.delete(id);
         this.pendingIdb.delete(id);
+        this.pendingDomList.delete(id);
         this.pendingGraphql.delete(id);
       }
       throw err;
@@ -65321,13 +65907,25 @@ var FetchproxyServer = class {
    * On timeout returns the `{ok:false, kind:'timeout'}` envelope —
    * the throwing surface is the convenience methods.
    */
-  async _fetchOnceWithTimeout(init) {
+  async _fetchOnceWithTimeout(init, fetchOpts = {}) {
     const id = this.nextRequestId++;
     const inner = { type: "request", id, op: "fetch", init };
-    const pending = this.guardPending(new Promise((resolve2) => {
-      this.pending.set(id, resolve2);
+    const pending = this.guardPending(new Promise((resolve5) => {
+      this.pending.set(id, resolve5);
     }));
-    await this.sendInnerFrame(inner);
+    try {
+      await this.sendInnerFrame(inner, {
+        resendable: isRetrySafeOnTimeout(init.method, fetchOpts.retryOnTimeout)
+      });
+    } catch (err) {
+      return {
+        ok: false,
+        error: err instanceof Error ? err.message : String(err),
+        kind: "session_not_ready",
+        retryAttempted: false,
+        cause: err
+      };
+    }
     const timeoutMs = this.opts.fetchTimeoutMs;
     if (timeoutMs === void 0 || timeoutMs <= 0)
       return pending;
@@ -65336,12 +65934,12 @@ var FetchproxyServer = class {
     try {
       return await Promise.race([
         pending,
-        new Promise((resolve2) => {
+        new Promise((resolve5) => {
           timer = setTimeout(() => {
             this.pending.delete(id);
             const elapsedMs = Date.now() - start;
             const error62 = `fetchproxy: ${init.url} did not respond within ${timeoutMs}ms`;
-            resolve2({
+            resolve5({
               ok: false,
               error: error62,
               kind: "timeout",
@@ -65401,7 +65999,7 @@ var FetchproxyServer = class {
     });
     return pending;
   }
-  async _withVerbTimeout(pending, pendingMap, id, url4, requestedTimeoutMs) {
+  async _withVerbTimeout(pending, pendingMap, id, url4, requestedTimeoutMs, retrySafe = true) {
     const transportMs = this.opts.fetchTimeoutMs;
     if (transportMs === void 0 || transportMs <= 0)
       return pending;
@@ -65422,6 +66020,7 @@ var FetchproxyServer = class {
               port: this.opts.port,
               elapsedMs: Date.now() - start,
               retryAttempted: false,
+              retrySafe,
               graceMs,
               ...requestedTimeoutMs !== void 0 ? { requestedTimeoutMs } : {}
             }));
@@ -65439,7 +66038,7 @@ var FetchproxyServer = class {
    * logic re-implemented inline) `captureRequestHeader()` agree on what
    * to throw.
    */
-  _typedErrorFor(result, url4, op, retryAttempted) {
+  _typedErrorFor(result, url4, op, retryAttempted, retrySafe = true) {
     if (result.kind === "timeout") {
       return new FetchproxyTimeoutError({
         url: url4,
@@ -65447,7 +66046,8 @@ var FetchproxyServer = class {
         role: this.role,
         port: this.opts.port,
         elapsedMs: result.elapsedMs,
-        retryAttempted
+        retryAttempted,
+        retrySafe
       });
     }
     if (result.kind === "content_script_unreachable") {
@@ -65483,9 +66083,9 @@ var FetchproxyServer = class {
     if (opts.subdomain !== void 0)
       assertSubdomainLabel(opts.subdomain);
     const baseDomain = this.resolveBaseDomain(opts.domain);
-    const isAbsolute3 = path.startsWith("http://") || path.startsWith("https://");
+    const isAbsolute6 = path.startsWith("http://") || path.startsWith("https://");
     let host;
-    if (isAbsolute3) {
+    if (isAbsolute6) {
       try {
         host = new URL(path).host;
       } catch {
@@ -65494,7 +66094,7 @@ var FetchproxyServer = class {
     } else {
       host = opts.subdomain ? `${opts.subdomain}.${baseDomain}` : baseDomain;
     }
-    const url4 = isAbsolute3 ? path : `https://${host}${path}`;
+    const url4 = isAbsolute6 ? path : `https://${host}${path}`;
     assertUrlInDomains("request url", url4, this.opts.domains);
     let tabUrl = `https://${host}/`;
     if (opts.viaTab !== void 0) {
@@ -65521,9 +66121,12 @@ var FetchproxyServer = class {
       // every version before this option existed.
       ...opts.credentials === "omit" ? { credentials: "omit" } : {}
     };
-    const result = await this.fetch(init);
+    const result = await this.fetch(init, opts.retryOnTimeout !== void 0 ? { retryOnTimeout: opts.retryOnTimeout } : {});
     if (!result.ok) {
-      throw this._typedErrorFor(result, init.url, "fetch", result.retryAttempted ?? false);
+      if (result.kind === "session_not_ready" && result.cause instanceof Error) {
+        throw result.cause;
+      }
+      throw this._typedErrorFor(result, init.url, "fetch", result.retryAttempted ?? false, isRetrySafeOnTimeout(method, opts.retryOnTimeout));
     }
     const response = {
       status: result.status,
@@ -65563,17 +66166,21 @@ var FetchproxyServer = class {
    * GET a path and parse the response body as JSON. Throws
    * `FetchproxyHttpError` if the status is outside the default 2xx
    * happy-path set (`[200, 201, 202, 204]`); pass a custom
-   * `expectStatus` to override.
+   * `expectStatus` to override. A 204 or an empty/whitespace body
+   * resolves to `null` (the declared `T` does not say so, to keep
+   * existing call sites compiling — include `| null` in `T` if the
+   * endpoint can answer empty).
    */
   async getJson(path, opts = {}) {
     const response = await this.get(path, this.applyJsonDefaults(opts));
-    return JSON.parse(response.body);
+    return parseJsonBody(response);
   }
   /**
    * POST a JSON body and parse the response body as JSON. The body is
    * `JSON.stringify`'d; `Content-Type: application/json` is set unless
    * the caller already provided one. Defaults `expectStatus` to the 2xx
-   * happy-path set.
+   * happy-path set. A 204 or an empty/whitespace body resolves to `null`
+   * rather than throwing after the write already happened (see `getJson`).
    */
   async postJson(path, body, opts = {}) {
     const headers = { ...opts.headers ?? {} };
@@ -65585,7 +66192,7 @@ var FetchproxyServer = class {
       headers,
       body: body === void 0 ? void 0 : JSON.stringify(body)
     });
-    return JSON.parse(response.body);
+    return parseJsonBody(response);
   }
   /**
    * GET a path and return the response body as a string. Throws
@@ -65606,7 +66213,8 @@ var FetchproxyServer = class {
    *  - adds `Content-Type: application/json` only for a non-GET request
    *    that carries a `body` (and only if the caller didn't set one);
    *  - `JSON.stringify`s the body (GET / no-body sends nothing);
-   *  - treats a `204` or an empty body as `data: null` (no parse);
+   *  - treats a `204`, an empty body, or a whitespace-only body as
+   *    `data: null` (no parse), the same rule as getJson/postJson;
    *  - otherwise `JSON.parse`s the body.
    *
    * Scope is serialization + header defaults + 204-handling +
@@ -65620,6 +66228,11 @@ var FetchproxyServer = class {
    * Bridge-level failures (no signed-in tab, SW down, timeout) still
    * throw the typed errors via `request()`, exactly like the verb
    * helpers — only successful round-trips (any HTTP status) return.
+   *
+   * `retryOnTimeout` is `RequestOpts.retryOnTimeout`: a timed-out POST is
+   * NOT re-sent unless the caller says it is safe to repeat. A read-only POST
+   * (a search, a GraphQL query) should pass `true` to keep the cold-start
+   * timeout retry (#90).
    */
   async requestJson(method, path, opts = {}) {
     const isGet = method.toUpperCase() === "GET";
@@ -65633,7 +66246,8 @@ var FetchproxyServer = class {
       headers,
       body: sendBody ? JSON.stringify(opts.body) : void 0,
       ...opts.subdomain !== void 0 ? { subdomain: opts.subdomain } : {},
-      ...opts.domain !== void 0 ? { domain: opts.domain } : {}
+      ...opts.domain !== void 0 ? { domain: opts.domain } : {},
+      ...opts.retryOnTimeout !== void 0 ? { retryOnTimeout: opts.retryOnTimeout } : {}
     });
     const result = {
       ok: true,
@@ -65641,12 +66255,9 @@ var FetchproxyServer = class {
       url: response.url,
       body: response.body
     };
-    if (response.status === 204 || response.body === "") {
-      return { data: null, result };
-    }
     let data;
     try {
-      data = JSON.parse(response.body);
+      data = parseJsonBody(response);
     } catch (e) {
       throw new Error(`fetchproxy ${method} ${path} \u2014 response was not JSON: ${e instanceof Error ? e.message : String(e)}`);
     }
@@ -65703,18 +66314,19 @@ var FetchproxyServer = class {
     };
   }
   /**
-   * Snapshot the user's non-HttpOnly cookies for the chosen domain.
+   * Read the user's cookies for the chosen domain.
    *
    * Requires `'read_cookies'` in `FetchproxyServerOpts.capabilities`.
    * Throws a developer-facing `Error` at the call site if the MCP did
    * not declare the capability — this is a programming mistake, not a
    * runtime condition.
    *
-   * The returned string is the raw `document.cookie` value (semicolon-
-   * separated `k=v` pairs). HttpOnly cookies are NOT visible to page JS
-   * and are therefore not included; the underlying threat model assumes
-   * the cookies that matter for the auth bootstrap (session tokens, csrf
-   * cookies that the page itself reads) are non-HttpOnly.
+   * The returned string is semicolon-separated `k=v` pairs. With `keys`
+   * (each in the declared `cookieKeys`), the extension reads each name via
+   * `chrome.cookies.get`, which INCLUDES HttpOnly cookies — the login
+   * session cookie among them; that is what cookie-session MCPs use it
+   * for. Without `keys` (legacy), it is the tab's `document.cookie`, which
+   * omits HttpOnly cookies. See docs/SECURITY.md §T-cookie-exfil.
    *
    * Throws `FetchproxyProtocolError` if the bridge could not deliver
    * the request (no signed-in tab, extension offline, etc.).
@@ -65747,8 +66359,8 @@ var FetchproxyServer = class {
       const tabUrl = `https://${host}/`;
       inner = { type: "request", id, op: "read_cookies", init: { tabUrl } };
     }
-    const pending = this.guardPending(new Promise((resolve2) => {
-      this.pendingReadCookies.set(id, resolve2);
+    const pending = this.guardPending(new Promise((resolve5) => {
+      this.pendingReadCookies.set(id, resolve5);
     }));
     await this.sendInnerFrame(inner);
     const result = await this._withVerbTimeout(pending, this.pendingReadCookies, id, `https://${host}`);
@@ -65806,11 +66418,19 @@ var FetchproxyServer = class {
         ...cookiePath !== void 0 ? { path: cookiePath } : {}
       }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingWriteCookies.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve5, reject) => {
+      this.pendingWriteCookies.set(id, { resolve: resolve5, reject });
     }));
     await this.sendInnerFrame(inner);
-    return this._withVerbTimeout(pending, this.pendingWriteCookies, id, `https://${host}`);
+    return this._withVerbTimeout(
+      pending,
+      this.pendingWriteCookies,
+      id,
+      `https://${host}`,
+      void 0,
+      // A write: never re-sent after an ambiguous timeout.
+      false
+    );
   }
   /**
    * 0.3.0+: read declared localStorage keys from the user's signed-in
@@ -65869,8 +66489,8 @@ var FetchproxyServer = class {
         ...opts.pointers ? { pointers: { ...opts.pointers } } : {}
       }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingStorage.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve5, reject) => {
+      this.pendingStorage.set(id, { resolve: resolve5, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingStorage, id, `https://${host}`);
@@ -65913,53 +66533,7 @@ var FetchproxyServer = class {
       throw new Error("FetchproxyServer.captureRequestHeader: pass both host AND headerName, or neither (which defaults to the single declared entry)");
     }
     const callOpts = { ...resolved2, ...opts?.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {} };
-    try {
-      const result = await this._captureRequestHeaderOnce(callOpts);
-      this.recordSuccess();
-      return result;
-    } catch (err) {
-      const swDown = err instanceof FetchproxyProtocolError && classifyFetchError(err.message) === "content_script_unreachable";
-      if (!swDown) {
-        this.recordFailure(`capture_request_header: ${err.message ?? String(err)}`);
-        throw err;
-      }
-      this.lastEvictionDetectedAt = Date.now();
-      const reviveMs = this.opts.bridgeReviveDelayMs ?? 0;
-      if (reviveMs > 0) {
-        this.lazyReviveAttempts += 1;
-        await new Promise((r) => setTimeout(r, reviveMs));
-        try {
-          const result = await this._captureRequestHeaderOnce(callOpts);
-          this.lazyReviveSuccesses += 1;
-          this.recordSuccess();
-          return result;
-        } catch (retryErr) {
-          const stillDown = retryErr instanceof FetchproxyProtocolError && classifyFetchError(retryErr.message) === "content_script_unreachable";
-          if (!stillDown) {
-            this.recordFailure(`capture_request_header: ${retryErr.message ?? String(retryErr)}`);
-            throw retryErr;
-          }
-          this.recordFailure(`capture_request_header bridge-down: ${retryErr.message}`);
-          throw new FetchproxyBridgeDownError({
-            originalError: retryErr.message,
-            retryAttempted: true,
-            op: "capture_request_header",
-            url: `https://${resolved2.host}${resolved2.path ?? "/*"}`,
-            role: this.role,
-            port: this.opts.port
-          });
-        }
-      }
-      this.recordFailure(`capture_request_header bridge-down: ${err.message}`);
-      throw new FetchproxyBridgeDownError({
-        originalError: err.message,
-        retryAttempted: false,
-        op: "capture_request_header",
-        url: `https://${resolved2.host}${resolved2.path ?? "/*"}`,
-        role: this.role,
-        port: this.opts.port
-      });
-    }
+    return this.withLazyRevive("capture_request_header", `https://${resolved2.host}${resolved2.path ?? "/*"}`, () => this._captureRequestHeaderOnce(callOpts));
   }
   async _captureRequestHeaderOnce(opts) {
     const id = this.nextRequestId++;
@@ -65974,8 +66548,8 @@ var FetchproxyServer = class {
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
       }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingCapture.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve5, reject) => {
+      this.pendingCapture.set(id, { resolve: resolve5, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(
@@ -66008,53 +66582,7 @@ var FetchproxyServer = class {
     }
     await this.ensureConnected();
     this.throwIfPendingPair();
-    try {
-      const result = await this._captureRedirectOnce(opts);
-      this.recordSuccess();
-      return result;
-    } catch (err) {
-      const swDown = err instanceof FetchproxyProtocolError && classifyFetchError(err.message) === "content_script_unreachable";
-      if (!swDown) {
-        this.recordFailure(`capture_redirect: ${err.message ?? String(err)}`);
-        throw err;
-      }
-      this.lastEvictionDetectedAt = Date.now();
-      const reviveMs = this.opts.bridgeReviveDelayMs ?? 0;
-      if (reviveMs > 0) {
-        this.lazyReviveAttempts += 1;
-        await new Promise((r) => setTimeout(r, reviveMs));
-        try {
-          const result = await this._captureRedirectOnce(opts);
-          this.lazyReviveSuccesses += 1;
-          this.recordSuccess();
-          return result;
-        } catch (retryErr) {
-          const stillDown = retryErr instanceof FetchproxyProtocolError && classifyFetchError(retryErr.message) === "content_script_unreachable";
-          if (!stillDown) {
-            this.recordFailure(`capture_redirect: ${retryErr.message ?? String(retryErr)}`);
-            throw retryErr;
-          }
-          this.recordFailure(`capture_redirect bridge-down: ${retryErr.message}`);
-          throw new FetchproxyBridgeDownError({
-            originalError: retryErr.message,
-            retryAttempted: true,
-            op: "capture_redirect",
-            url: `https://${opts.host}${opts.path ?? "/*"}`,
-            role: this.role,
-            port: this.opts.port
-          });
-        }
-      }
-      this.recordFailure(`capture_redirect bridge-down: ${err.message}`);
-      throw new FetchproxyBridgeDownError({
-        originalError: err.message,
-        retryAttempted: false,
-        op: "capture_redirect",
-        url: `https://${opts.host}${opts.path ?? "/*"}`,
-        role: this.role,
-        port: this.opts.port
-      });
-    }
+    return this.withLazyRevive("capture_redirect", `https://${opts.host}${opts.path ?? "/*"}`, () => this._captureRedirectOnce(opts));
   }
   async _captureRedirectOnce(opts) {
     const id = this.nextRequestId++;
@@ -66068,8 +66596,8 @@ var FetchproxyServer = class {
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
       }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingRedirect.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve5, reject) => {
+      this.pendingRedirect.set(id, { resolve: resolve5, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(
@@ -66099,52 +66627,57 @@ var FetchproxyServer = class {
     assertUrlInDomains("download url", opts.url, this.opts.domains);
     await this.ensureConnected();
     this.throwIfPendingPair();
+    return this.withLazyRevive("download", opts.url, () => this._downloadOnce(opts));
+  }
+  /**
+   * B-QUAL-1: the lazy-revive policy for the throwing verbs
+   * (`capture_request_header`, `capture_redirect`, `download`), in one place.
+   * Runs `once`; on the SW-eviction symptom (`content_script_unreachable` —
+   * the request provably never reached a tab, so re-sending is safe) stamps
+   * the eviction counter, waits `bridgeReviveDelayMs` and retries once, then
+   * surfaces a `FetchproxyBridgeDownError`. Every other error is recorded and
+   * rethrown untouched. `fetch()` keeps its own envelope-shaped variant.
+   */
+  async withLazyRevive(op, url4, once) {
+    const isSwDown = (e) => e instanceof FetchproxyProtocolError && classifyFetchError(e.message) === "content_script_unreachable";
+    const bridgeDown = (e, retryAttempted) => {
+      this.recordFailure(`${op} bridge-down: ${e.message}`);
+      return new FetchproxyBridgeDownError({
+        originalError: e.message,
+        retryAttempted,
+        op,
+        url: url4,
+        role: this.role,
+        port: this.opts.port
+      });
+    };
     try {
-      const result = await this._downloadOnce(opts);
+      const result = await once();
       this.recordSuccess();
       return result;
     } catch (err) {
-      const swDown = err instanceof FetchproxyProtocolError && classifyFetchError(err.message) === "content_script_unreachable";
-      if (!swDown) {
-        this.recordFailure(`download: ${err.message ?? String(err)}`);
+      if (!isSwDown(err)) {
+        this.recordFailure(`${op}: ${err.message ?? String(err)}`);
         throw err;
       }
       this.lastEvictionDetectedAt = Date.now();
       const reviveMs = this.opts.bridgeReviveDelayMs ?? 0;
-      if (reviveMs > 0) {
-        this.lazyReviveAttempts += 1;
-        await new Promise((r) => setTimeout(r, reviveMs));
-        try {
-          const result = await this._downloadOnce(opts);
-          this.lazyReviveSuccesses += 1;
-          this.recordSuccess();
-          return result;
-        } catch (retryErr) {
-          const stillDown = retryErr instanceof FetchproxyProtocolError && classifyFetchError(retryErr.message) === "content_script_unreachable";
-          if (!stillDown) {
-            this.recordFailure(`download: ${retryErr.message ?? String(retryErr)}`);
-            throw retryErr;
-          }
-          this.recordFailure(`download bridge-down: ${retryErr.message}`);
-          throw new FetchproxyBridgeDownError({
-            originalError: retryErr.message,
-            retryAttempted: true,
-            op: "download",
-            url: opts.url,
-            role: this.role,
-            port: this.opts.port
-          });
+      if (reviveMs <= 0)
+        throw bridgeDown(err, false);
+      this.lazyReviveAttempts += 1;
+      await new Promise((r) => setTimeout(r, reviveMs));
+      try {
+        const result = await once();
+        this.lazyReviveSuccesses += 1;
+        this.recordSuccess();
+        return result;
+      } catch (retryErr) {
+        if (!isSwDown(retryErr)) {
+          this.recordFailure(`${op}: ${retryErr.message ?? String(retryErr)}`);
+          throw retryErr;
         }
+        throw bridgeDown(retryErr, true);
       }
-      this.recordFailure(`download bridge-down: ${err.message}`);
-      throw new FetchproxyBridgeDownError({
-        originalError: err.message,
-        retryAttempted: false,
-        op: "download",
-        url: opts.url,
-        role: this.role,
-        port: this.opts.port
-      });
     }
   }
   async _downloadOnce(opts) {
@@ -66159,8 +66692,8 @@ var FetchproxyServer = class {
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
       }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingDownload.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve5, reject) => {
+      this.pendingDownload.set(id, { resolve: resolve5, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(
@@ -66173,7 +66706,9 @@ var FetchproxyServer = class {
       // CAP and need the identical explanation; missing it then was the point
       // of #279 — "both verbs" was counted off the two call sites in view
       // rather than off the type. Three is still the number.
-      opts.timeoutMs
+      opts.timeoutMs,
+      // A second download saves a duplicate "file (1)".
+      false
     );
   }
   /**
@@ -66218,8 +66753,8 @@ var FetchproxyServer = class {
         keys: [...opts.keys]
       }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingIdb.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve5, reject) => {
+      this.pendingIdb.set(id, { resolve: resolve5, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingIdb, id, origin);
@@ -66258,12 +66793,58 @@ var FetchproxyServer = class {
       op: "read_dom",
       init: { origin, names: [...opts.names] }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingStorage.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve5, reject) => {
+      this.pendingStorage.set(id, { resolve: resolve5, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingStorage, id, origin);
   }
+  /**
+   * 3.1.0+: read a declared REPEATED DOM structure from the user's
+   * signed-in tab. Requires `'read_dom_list'` in capabilities AND `name` to
+   * match a declared `domListSelectors` entry. The extension resolves the
+   * entry's `itemSelector` via `document.querySelectorAll` in the matched
+   * tab's DOM (isolated world), then resolves each declared field against
+   * every matched item in turn — no page-JS execution, same as `readDom`.
+   *
+   * Returns one row per matched item, in document order, truncated to the
+   * entry's declared `maxItems` when set. A field absent on a given item is
+   * omitted from that item's row (the row itself is still returned). Throws
+   * `FetchproxyProtocolError` on bridge failures and a plain `Error` on
+   * developer mistakes (undeclared capability, undeclared name).
+   *
+   * Reads only what is CURRENTLY rendered — a virtualized or lazily-loaded
+   * list returns only its visible rows. A caller that needs more scrolls
+   * the list (out of band) and calls again.
+   */
+  async readDomList(opts) {
+    if (!this.opts.capabilities.includes("read_dom_list")) {
+      throw new Error('FetchproxyServer.readDomList(): MCP did not declare "read_dom_list" in capabilities');
+    }
+    await this.ensureConnected();
+    this.throwIfPendingPair();
+    if (typeof opts.name !== "string" || opts.name.length === 0) {
+      throw new Error("FetchproxyServer.readDomList: opts.name must be a non-empty string");
+    }
+    this.assertScopeSubset([opts.name], this.opts.domListSelectors.map((d) => d.name), "domListSelectors");
+    if (opts.subdomain !== void 0)
+      assertSubdomainLabel(opts.subdomain);
+    const baseDomain = this.resolveBaseDomain(opts.domain);
+    const host = opts.subdomain ? `${opts.subdomain}.${baseDomain}` : baseDomain;
+    const origin = `https://${host}`;
+    const id = this.nextRequestId++;
+    const inner = {
+      type: "request",
+      id,
+      op: "read_dom_list",
+      init: { origin, name: opts.name }
+    };
+    const pending = this.guardPending(new Promise((resolve5, reject) => {
+      this.pendingDomList.set(id, { resolve: resolve5, reject });
+    }));
+    await this.sendInnerFrame(inner);
+    return this._withVerbTimeout(pending, this.pendingDomList, id, origin);
+  }
   /**
    * 1.x+: run a declared GraphQL operation through the page's own Apollo
    * client (`window.__APOLLO_CLIENT__`) in the signed-in tab's MAIN world.
@@ -66304,11 +66885,12 @@ var FetchproxyServer = class {
         ...opts.tabUrl !== void 0 ? { tabUrl: opts.tabUrl } : {}
       }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingGraphql.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve5, reject) => {
+      this.pendingGraphql.set(id, { resolve: resolve5, reject });
     }));
-    await this.sendInnerFrame(inner);
-    return this._withVerbTimeout(pending, this.pendingGraphql, id, opts.name);
+    const retrySafe = opts.retryOnTimeout === true;
+    await this.sendInnerFrame(inner, { resendable: retrySafe });
+    return this._withVerbTimeout(pending, this.pendingGraphql, id, opts.name, void 0, retrySafe);
   }
   assertScopeSubset(requested, declared, label) {
     const undeclared = undeclaredKeys(requested, declared);
@@ -66345,6 +66927,7 @@ var FetchproxyServer = class {
   onInner(inner) {
     if (inner.type !== "response")
       return;
+    this.resendable.delete(inner.id);
     this.lastExtensionMessageAt = Date.now();
     const fetchCb = this.pending.get(inner.id);
     if (fetchCb) {
@@ -66433,6 +67016,20 @@ var FetchproxyServer = class {
       }
       return;
     }
+    const domListCb = this.pendingDomList.get(inner.id);
+    if (domListCb) {
+      this.pendingDomList.delete(inner.id);
+      if (inner.ok) {
+        if (inner.op === "read_dom_list" && inner.rows) {
+          domListCb.resolve(inner.rows.map((row) => ({ ...row })));
+        } else {
+          domListCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on read_dom_list awaiter`));
+        }
+      } else {
+        domListCb.reject(protocolErrorFrom(inner.error));
+      }
+      return;
+    }
     const downloadCb = this.pendingDownload.get(inner.id);
     if (downloadCb) {
       this.pendingDownload.delete(inner.id);
@@ -66492,42 +67089,133 @@ var FetchproxyServer = class {
       }
     }
   }
-  rejectAllPending(reason = "extension disconnected") {
+  rejectAllPending(reason = "extension disconnected", keep = /* @__PURE__ */ new Set()) {
+    for (const id of this.allPendingIds()) {
+      if (!keep.has(id))
+        this.rejectPendingId(id, reason);
+    }
+    if (keep.size === 0)
+      this.resendable.clear();
+  }
+  /** Every request id with a live awaiter, across all op maps. */
+  allPendingIds() {
+    const ids = [];
+    for (const map2 of this.pendingMaps())
+      for (const id of map2.keys())
+        ids.push(id);
+    return ids;
+  }
+  pendingMaps() {
+    return [
+      this.pending,
+      this.pendingReadCookies,
+      this.pendingStorage,
+      this.pendingWriteCookies,
+      this.pendingCapture,
+      this.pendingRedirect,
+      this.pendingIdb,
+      this.pendingDomList,
+      this.pendingDownload,
+      this.pendingGraphql
+    ];
+  }
+  isPendingId(id) {
+    return this.pendingMaps().some((m) => m.has(id));
+  }
+  /** Fail the one awaiter registered under `id`, in its own map's shape. */
+  rejectPendingId(id, reason) {
     const err = new FetchproxyProtocolError(reason);
-    for (const cb of this.pending.values()) {
-      cb({
+    this.resendable.delete(id);
+    const fetchCb = this.pending.get(id);
+    if (fetchCb) {
+      this.pending.delete(id);
+      fetchCb({
         ok: false,
         error: err.message,
         kind: classifyFetchError(err.message),
         retryAttempted: false
       });
+      return;
+    }
+    const cookieCb = this.pendingReadCookies.get(id);
+    if (cookieCb) {
+      this.pendingReadCookies.delete(id);
+      cookieCb({ ok: false, error: err.message });
+      return;
+    }
+    for (const map2 of [
+      this.pendingStorage,
+      this.pendingWriteCookies,
+      this.pendingCapture,
+      this.pendingRedirect,
+      this.pendingIdb,
+      this.pendingDomList,
+      this.pendingDownload,
+      this.pendingGraphql
+    ]) {
+      const entry = map2.get(id);
+      if (entry) {
+        map2.delete(id);
+        entry.reject(err);
+        return;
+      }
+    }
+  }
+  noteResendable(inner) {
+    this.resendable.set(inner.id, inner);
+    if (this.resendable.size > 256) {
+      for (const id of [...this.resendable.keys()]) {
+        if (!this.isPendingId(id))
+          this.resendable.delete(id);
+      }
     }
-    this.pending.clear();
-    for (const cb of this.pendingReadCookies.values()) {
-      cb({ ok: false, error: err.message });
-    }
-    this.pendingReadCookies.clear();
-    for (const { reject } of this.pendingStorage.values())
-      reject(err);
-    this.pendingStorage.clear();
-    for (const { reject } of this.pendingWriteCookies.values())
-      reject(err);
-    this.pendingWriteCookies.clear();
-    for (const { reject } of this.pendingCapture.values())
-      reject(err);
-    this.pendingCapture.clear();
-    for (const { reject } of this.pendingRedirect.values())
-      reject(err);
-    this.pendingRedirect.clear();
-    for (const { reject } of this.pendingIdb.values())
-      reject(err);
-    this.pendingIdb.clear();
-    for (const { reject } of this.pendingDownload.values())
-      reject(err);
-    this.pendingDownload.clear();
-    for (const { reject } of this.pendingGraphql.values())
-      reject(err);
-    this.pendingGraphql.clear();
+  }
+  /**
+   * B-BUG-6: the host this peer relayed through has gone — most often a
+   * short-lived process (a bootstrap lift, an `fpx` call) that won the
+   * election and then closed. Fail only the in-flight requests that may
+   * already have run (a non-idempotent fetch, a cookie write, a download);
+   * re-elect and send the rest again. The replies to the originals died with
+   * the old host, and each re-sent request keeps its awaiter and its
+   * original deadline.
+   */
+  async recoverFromHostLoss() {
+    const toResend = /* @__PURE__ */ new Map();
+    for (const [id, inner] of this.resendable) {
+      if (this.isPendingId(id))
+        toResend.set(id, inner);
+    }
+    this.resendable.clear();
+    this.rejectAllPending("fetchproxy: the MCP process holding the bridge port exited while this request was in flight. It was not re-sent because it may already have run in the browser \u2014 check before retrying.", new Set(toResend.keys()));
+    if (toResend.size === 0)
+      return;
+    const lost = (id, e) => this.rejectPendingId(id, `fetchproxy: the bridge host exited and reconnecting failed: ${e instanceof Error ? e.message : String(e)}`);
+    try {
+      await this.ensureConnected();
+    } catch (e) {
+      for (const id of toResend.keys())
+        lost(id, e);
+      return;
+    }
+    for (const [id, inner] of toResend) {
+      if (!this.isPendingId(id))
+        continue;
+      try {
+        await this.resendInnerFrame(inner);
+      } catch (e) {
+        lost(id, e);
+      }
+    }
+  }
+  /** Send an already-registered request again, keeping its awaiter on failure. */
+  async resendInnerFrame(inner) {
+    if (this.hostHandle)
+      await this.hostHandle.sendOwnInner(inner);
+    else if (this.peerHandle)
+      await this.peerHandle.sendInner(inner);
+    else
+      throw new Error("no bridge handle after re-election");
+    this.noteResendable(inner);
   }
   /**
    * 0.5.2+: read the current pair-pending pair code from whichever handle
@@ -66630,6 +67318,12 @@ async function runOneLift(opts) {
   if (envVal !== void 0 && envVal !== "" && envVal !== "0" && envVal !== "false") {
     throw new BootstrapDisabledError(opts.serverName, envVar);
   }
+  for (const bucket of ["cookies", "localStorage", "sessionStorage"]) {
+    const glob = opts.declare[bucket].find((k) => k.endsWith("*"));
+    if (glob !== void 0) {
+      throw new Error(`fetchproxy bootstrap: declare.${bucket} contains ${JSON.stringify(glob)}, a glob. A lift reads each key by its exact name, so a glob can never match \u2014 list the concrete key names instead.`);
+    }
+  }
   const factory = opts._serverFactory ?? defaultFactory;
   const indexedDb = opts.declare.indexedDb ?? [];
   const localStoragePointers = opts.declare.localStoragePointers ?? [];
@@ -66887,7 +67581,7 @@ function loadAccount(env = process.env) {
 // package.json
 var package_default = {
   name: "canvas-parent-mcp",
-  version: "2.1.1",
+  version: "2.1.3",
   mcpName: "io.github.chrischall/canvas-parent-mcp",
   description: "Canvas LMS (Instructure) MCP server \u2014 student/observer read access with optional file download",
   author: "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -66934,12 +67628,12 @@ var package_default = {
     typecheck: "tsc -p tsconfig.json --noEmit"
   },
   dependencies: {
-    "@chrischall/mcp-utils": "^1.0.0",
-    "@fetchproxy/bootstrap": "^3.0.1",
-    "@fetchproxy/server": "^3.0.1",
+    "@chrischall/mcp-utils": "^2.4.0",
+    "@fetchproxy/bootstrap": "^3.2.0",
+    "@fetchproxy/server": "^3.2.0",
     "@modelcontextprotocol/server": "^2.0.0",
     dotenv: "^18.0.0",
-    zod: "^4.6.2"
+    zod: "^4.6.5"
   },
   devDependencies: {
     "@modelcontextprotocol/client": "^2.0.0",
@@ -67196,10 +67890,10 @@ function registerCredentialHealthcheckTool(args) {
 import { writeFile as writeFile3, stat } from "fs/promises";
 
 // node_modules/@chrischall/mcp-utils/dist/session/index.js
-import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync, renameSync, unlinkSync } from "node:fs";
-import { dirname, join as join3, resolve } from "node:path";
-import { homedir as homedir2 } from "node:os";
-import { randomBytes as randomBytes2, createHmac } from "node:crypto";
+import { existsSync as existsSync2, readFileSync, writeFileSync, mkdirSync, chmodSync, renameSync, unlinkSync } from "node:fs";
+import { dirname as dirname2, join as join4, resolve as resolve3 } from "node:path";
+import { homedir as homedir3 } from "node:os";
+import { randomBytes as randomBytes3, createHmac } from "node:crypto";
 function bindingDigest(secret, salt) {
   return createHmac("sha256", salt).update(secret).digest("hex").slice(0, 32);
 }
@@ -67220,7 +67914,7 @@ function createFileStatePersistence(opts) {
   const secret = opts.boundTo;
   return {
     load() {
-      if (!existsSync(filePath))
+      if (!existsSync2(filePath))
         return null;
       try {
         const raw = JSON.parse(readFileSync(filePath, "utf8"));
@@ -67250,16 +67944,16 @@ function createFileStatePersistence(opts) {
       }
     },
     save(state) {
-      const dir = dirname(filePath);
-      const tmp = `${filePath}.tmp-${randomBytes2(6).toString("hex")}`;
-      const dirExisted = existsSync(dir);
+      const dir = dirname2(filePath);
+      const tmp = `${filePath}.tmp-${randomBytes3(6).toString("hex")}`;
+      const dirExisted = existsSync2(dir);
       try {
         mkdirSync(dir, { recursive: true, mode: 448 });
         if (!dirExisted)
           chmodSync(dir, 448);
         let boundTo;
         if (secret !== void 0) {
-          const salt = randomBytes2(16).toString("hex");
+          const salt = randomBytes3(16).toString("hex");
           boundTo = { salt, digest: bindingDigest(secret, salt) };
         }
         const envelope = { v: 1, ...boundTo !== void 0 ? { boundTo } : {}, state };
@@ -67269,7 +67963,7 @@ function createFileStatePersistence(opts) {
         chmodSync(filePath, 384);
       } catch (err) {
         try {
-          if (existsSync(tmp))
+          if (existsSync2(tmp))
             unlinkSync(tmp);
         } catch {
         }
@@ -67278,7 +67972,7 @@ function createFileStatePersistence(opts) {
     },
     clear() {
       try {
-        if (existsSync(filePath))
+        if (existsSync2(filePath))
           unlinkSync(filePath);
       } catch {
       }
@@ -67286,11 +67980,11 @@ function createFileStatePersistence(opts) {
   };
 }
 function homeOf(env) {
-  return readEnvVar("HOME", { env }) ?? homedir2();
+  return readEnvVar("HOME", { env }) ?? homedir3();
 }
 function resolveStateDir(opts = {}) {
   const env = opts.env;
-  return join3(readEnvVar("MCP_DATA_DIR", { env }) ?? homeOf(env), opts.subdir ?? "");
+  return join4(readEnvVar("MCP_DATA_DIR", { env }) ?? homeOf(env), opts.subdir ?? "");
 }
 function resolveStateFile(opts) {
   const override = opts.envVar !== void 0 ? readEnvVar(opts.envVar, { env: opts.env }) : void 0;
@@ -67298,13 +67992,13 @@ function resolveStateFile(opts) {
     if (override === "~")
       return homeOf(opts.env);
     if (override.startsWith("~/"))
-      return join3(homeOf(opts.env), override.slice(2));
-    return resolve(override);
+      return join4(homeOf(opts.env), override.slice(2));
+    return resolve3(override);
   }
   const dirOpts = { env: opts.env };
   if (opts.subdir !== void 0)
     dirOpts.subdir = opts.subdir;
-  return join3(resolveStateDir(dirOpts), opts.fileName);
+  return join4(resolveStateDir(dirOpts), opts.fileName);
 }
 var TOKEN_REFRESH_SKEW_MS = 5 * 60 * 1e3;
 function isPersistedCookieSession(raw) {
@@ -67594,7 +68288,8 @@ function reportCacheWriteFailure(err) {
 }
 
 // src/client.ts
-import { dirname as dirname2 } from "path";
+import { dirname as dirname3, isAbsolute as isAbsolute5, join as join5, resolve as resolve4 } from "path";
+import { homedir as homedir4 } from "os";
 
 // src/session-login.ts
 var USER_AGENT = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36";
@@ -67692,6 +68387,8 @@ var CanvasClient = class {
    * what keeps the path alive once the browser cookie lapses.
    */
   refreshSession;
+  /** Explicit download root; when unset, resolved per call (see {@link downloadRoot}). */
+  outputDir;
   auth;
   /** Lazily-built shared refresh_token exchanger (oauth mode only). */
   oauthRefresh = null;
@@ -67707,6 +68404,7 @@ var CanvasClient = class {
    */
   constructor(account, opts = {}) {
     this.account = account;
+    this.outputDir = opts.outputDir;
     this.sessionLoginFn = opts.sessionLogin ?? sessionLogin;
     this.refreshSession = opts.refreshSession ?? null;
     this.auth = new CookieSessionManager({
@@ -67729,7 +68427,7 @@ var CanvasClient = class {
     const res = await this.doRawRequest(path, opts);
     const text = await res.text();
     if (opts.responseType === "text") return text;
-    return parseJsonBody(text) ?? null;
+    return parseJsonBody2(text) ?? null;
   }
   async requestPaginated(path, opts = {}) {
     const perPage = opts.perPage ?? DEFAULT_PER_PAGE;
@@ -67739,7 +68437,7 @@ var CanvasClient = class {
     for (let page = 0; page < maxPages; page++) {
       const res = await this.doRawRequest(url4, opts);
       const text = await res.text();
-      const parsed = parseJsonBody(text) ?? [];
+      const parsed = parseJsonBody2(text) ?? [];
       for (const item of parsed) out.push(item);
       const linkHeader = res.headers.get("link");
       const next = linkHeader ? parseLinkHeader(linkHeader).next : void 0;
@@ -67748,33 +68446,84 @@ var CanvasClient = class {
     }
     return out;
   }
+  /**
+   * Download a Canvas file to disk.
+   *
+   * Both inputs arrive from tool arguments, which a prompt injection in
+   * classmate/teacher-authored Canvas content can steer, so both are pinned
+   * BEFORE any credential is attached:
+   *  - `path` must resolve to the configured Canvas origin (https, same host —
+   *    the `https://canvas@evil/` userinfo trick parses to a foreign host and is
+   *    refused) and name a `/files/<id>` resource. Only the initial request is
+   *    pinned: Canvas legitimately redirects to its file store, and fetch
+   *    strips Authorization/Cookie on a cross-origin redirect.
+   *  - `destinationPath` must lie inside the download root (see
+   *    {@link downloadRoot}), checked through symlinks; a relative path is
+   *    resolved against that root.
+   */
   async download(path, destinationPath, opts = {}) {
+    const url4 = this.pinDownloadUrl(path);
+    const dest = this.confineDestination(destinationPath);
     let destStat = null;
     try {
-      destStat = await stat(destinationPath);
+      destStat = await stat(dest);
     } catch {
     }
     if (destStat?.isDirectory()) throw new InvalidPathError(destinationPath);
     if (destStat && !opts.overwrite) throw new FileExistsError(destinationPath);
-    const parent = dirname2(destinationPath);
+    const parent = dirname3(dest);
     try {
       await stat(parent);
     } catch {
       throw new ParentDirectoryMissingError(parent);
     }
-    const url4 = /^https?:\/\//i.test(path) ? path : `${this.account.baseUrl}${path}`;
     const res = await this.authedFetch(url4, {});
     if (res.status === 401) throw new TokenExpiredError(this.account.mode);
     if (res.status === 404) throw new Error(`Canvas download 404 for ${path}`);
     if (!res.ok) throw new Error(`Canvas download ${res.status} for ${path}`);
     const buf = new Uint8Array(await res.arrayBuffer());
-    await writeFile3(destinationPath, buf);
+    await writeFile3(dest, buf);
     return {
-      path: destinationPath,
+      path: dest,
       bytes: buf.byteLength,
       contentType: res.headers.get("content-type") ?? "application/octet-stream"
     };
   }
+  /**
+   * The directory downloads are confined to: the constructor's `outputDir`,
+   * else `CANVAS_OUTPUT_DIR`, else `~/Downloads`. Read per call so an env
+   * change needs no client rebuild.
+   */
+  downloadRoot() {
+    return expandPath(this.outputDir ?? readEnvVar("CANVAS_OUTPUT_DIR") ?? join5(homedir4(), "Downloads"));
+  }
+  confineDestination(destinationPath) {
+    const root = this.downloadRoot();
+    const candidate = destinationPath.startsWith("~") || isAbsolute5(destinationPath) ? expandPath(destinationPath) : resolve4(root, destinationPath);
+    try {
+      assertPathWithinRoots(candidate, [root]);
+    } catch {
+      throw new DownloadDestinationRejectedError(destinationPath, root);
+    }
+    return candidate;
+  }
+  pinDownloadUrl(path) {
+    const raw = /^[a-z][a-z0-9+.-]*:/i.test(path) ? path : `${this.account.baseUrl}${path}`;
+    let parsed;
+    try {
+      parsed = new URL(raw);
+    } catch {
+      throw new DownloadUrlRejectedError(path, "not a valid URL");
+    }
+    const origin = new URL(this.account.baseUrl).origin;
+    if (parsed.protocol !== "https:" || parsed.origin !== origin || parsed.username || parsed.password) {
+      throw new DownloadUrlRejectedError(path, `must be an https URL on ${origin}`);
+    }
+    if (!/\/files\/[^/]+/.test(parsed.pathname)) {
+      throw new DownloadUrlRejectedError(path, "must name a Canvas file (a /files/<id> path)");
+    }
+    return parsed.href;
+  }
   async doRawRequest(path, opts) {
     const url4 = /^https?:\/\//i.test(path) ? path : `${this.account.baseUrl}${path}`;
     const accept = opts.responseType === "text" ? "text/html, text/plain, */*" : "application/json+canvas-string-ids, application/json";
@@ -67880,15 +68629,15 @@ var CanvasClient = class {
     };
   }
 };
-function parseJsonBody(text) {
+function parseJsonBody2(text) {
   if (!text) return null;
   const stripped = text.replace(/^while\(1\);/, "");
   return JSON.parse(stripped);
 }
 function injectPerPage(pathOrUrl, perPage) {
   if (/[?&]per_page=/.test(pathOrUrl)) return pathOrUrl;
-  const sep = pathOrUrl.includes("?") ? "&" : "?";
-  return `${pathOrUrl}${sep}per_page=${perPage}`;
+  const sep2 = pathOrUrl.includes("?") ? "&" : "?";
+  return `${pathOrUrl}${sep2}per_page=${perPage}`;
 }
 var TokenExpiredError = class extends Error {
   constructor(mode, detail) {
@@ -67909,6 +68658,26 @@ var CanvasUnreachableError = class extends Error {
   }
   status;
 };
+var DownloadUrlRejectedError = class extends Error {
+  constructor(url4, reason) {
+    super(`DownloadUrlRejected: ${reason}; use the \`url\` from canvas_list_course_files. Got: ${url4}`);
+    this.url = url4;
+    this.name = "DownloadUrlRejectedError";
+  }
+  url;
+};
+var DownloadDestinationRejectedError = class extends Error {
+  constructor(path, root) {
+    super(
+      `DownloadDestinationRejected: destinationPath must be inside ${root} (set CANVAS_OUTPUT_DIR to change it). Got: ${path}`
+    );
+    this.path = path;
+    this.root = root;
+    this.name = "DownloadDestinationRejectedError";
+  }
+  path;
+  root;
+};
 var InvalidPathError = class extends Error {
   constructor(path) {
     super(`InvalidPath: destinationPath must be a filename, not a directory: ${path}`);
@@ -68315,8 +69084,8 @@ var listArgs4 = external_exports.object({
   contentTypes: external_exports.array(external_exports.string()).optional()
 });
 var downloadArgs = external_exports.object({
-  url: external_exports.string().describe("The url field returned by canvas_list_course_files (absolute https URL)."),
-  destinationPath: external_exports.string().describe("Absolute path where the file should be written."),
+  url: external_exports.string().describe("The url field returned by canvas_list_course_files (an https /files/ URL on the configured Canvas host; anything else is refused)."),
+  destinationPath: external_exports.string().describe("Where to write the file. Must be inside the download directory (CANVAS_OUTPUT_DIR, default ~/Downloads); a relative path is resolved against it."),
   overwrite: external_exports.boolean().optional()
 });
 function registerFileTools(server, client) {
@@ -68334,8 +69103,8 @@ function registerFileTools(server, client) {
     return textContent(data);
   });
   server.registerTool("canvas_download_file", {
-    description: "Download a Canvas file to disk. `url` is the absolute URL from canvas_list_course_files; `destinationPath` is required.",
-    annotations: { destructiveHint: true },
+    description: "Download a Canvas file to disk. `url` is the absolute URL from canvas_list_course_files (only file URLs on the configured Canvas host are accepted); `destinationPath` is required and must be inside the download directory (CANVAS_OUTPUT_DIR, default ~/Downloads).",
+    annotations: { destructiveHint: true, openWorldHint: true },
     inputSchema: downloadArgs
   }, async (rawArgs) => {
     const args = downloadArgs.parse(rawArgs);
@@ -68347,8 +69116,8 @@ function registerFileTools(server, client) {
 }
 
 // src/index.ts
-var __dirname = dirname3(fileURLToPath(import.meta.url));
-await loadDotenvSafely({ path: join4(__dirname, "..", ".env"), override: false });
+var __dirname = dirname4(fileURLToPath(import.meta.url));
+await loadDotenvSafely({ path: join6(__dirname, "..", ".env"), override: false });
 var resolved = null;
 var configError = null;
 try {
@@ -68358,7 +69127,7 @@ try {
 }
 await runMcp({
   name: "canvas",
-  version: "2.1.1",
+  version: "2.1.3",
   // x-release-please-version
   tools: [
     // Outside the `if (resolved)` on purpose: an unconfigured server must