mcp-use 1.34.0 → 1.34.1

package/dist/{chunk-3UOADQDZ.js → chunk-2EBW4344.js}

@@ -3,11 +3,11 @@ import {
   HttpConnector,
   normalizeClientInfo,
   resolveCallbacks
-} from "./chunk-BOFDVMBT.js";
+} from "./chunk-YQIRNTLE.js";
 import {
   Tel,
   getPackageVersion
-} from "./chunk-XS2ZMBOG.js";
+} from "./chunk-XIAP7CEH.js";
 import {
   logger
 } from "./chunk-QWQYAQCK.js";
@@ -523,6 +523,41 @@ var BrowserOAuthClientProvider = class {
   getKey(keySuffix) {
     return this.session.getKey(keySuffix);
   }
+  /**
+   * Re-anchor an SDK-derived OAuth discovery URL from the MCP connection
+   * (proxy) origin onto the actual MCP server.
+   *
+   * When MCP traffic is tunneled through a gateway/inspector proxy, the SDK
+   * transport derives `/.well-known/*` URLs from the URL it connected to (the
+   * proxy) whenever no `resource_metadata` hint is available — the SSE
+   * transport's EventSource cannot read `WWW-Authenticate`, and token refresh
+   * runs without a 401 response at hand. The proxy origin serves no OAuth
+   * metadata, so discovery would fail and the server would be misclassified
+   * as "does not support OAuth". Rewriting reproduces what a direct
+   * connection would have requested: the same well-known document, anchored
+   * on the server origin, with the RFC 8414 §3.1 / RFC 9728 §3.1 path
+   * insertion using the server's path instead of the proxy's.
+   */
+  reanchorWellKnownUrl(url) {
+    if (!this.connectionUrl) return url;
+    try {
+      const requested = new URL(url);
+      const connection = new URL(this.connectionUrl);
+      if (requested.origin !== connection.origin) return url;
+      if (!requested.pathname.startsWith("/.well-known/")) return url;
+      const target = new URL(this.serverUrl);
+      const rest = requested.pathname.slice("/.well-known/".length);
+      const [doc, ...suffixParts] = rest.split("/");
+      if (!doc) return url;
+      const suffix = suffixParts.length ? `/${suffixParts.join("/")}` : "";
+      const connectionPath = connection.pathname.replace(/\/+$/, "");
+      const targetPath = target.pathname.replace(/\/+$/, "");
+      const newSuffix = suffix && suffix === connectionPath ? targetPath : suffix;
+      return `${target.origin}/.well-known/${doc}${newSuffix}${requested.search}`;
+    } catch {
+      return url;
+    }
+  }
   /**
    * Returns a `fetch` function, scoped to this provider, that routes OAuth
    * requests (`.well-known` metadata, token, register, authorize) through the
@@ -552,7 +587,8 @@ var BrowserOAuthClientProvider = class {
     const connectionUrl = this.connectionUrl;
     const serverUrl = this.serverUrl;
     return async (input, init) => {
-      const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      const requestedUrl = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      const url = this.reanchorWellKnownUrl(requestedUrl);
       const isOAuthRequest = url.includes("/.well-known/") || url.match(/\/(register|token|authorize)$/);
       if (!isOAuthRequest) {
         return await base(input, init);
@@ -622,7 +658,7 @@ var BrowserOAuthClientProvider = class {
           "[OAuth Proxy] Request failed, falling back to direct fetch:",
           error
         );
-        return await base(input, init);
+        return url !== requestedUrl ? await base(url, init) : await base(input, init);
       }
     };
   }

package/dist/{chunk-U6UCVQKQ.js → chunk-D7SEH5RU.js}

@@ -3,17 +3,17 @@ import {
 } from "./chunk-GKPKUKD6.js";
 import {
   CodeModeConnector
-} from "./chunk-2J3FVMZ5.js";
+} from "./chunk-TAPTQKI4.js";
 import {
   BaseConnector
-} from "./chunk-4KP3757O.js";
+} from "./chunk-YZ22J43K.js";
 import {
   JSONSchemaToZod
 } from "./chunk-LG5NSHEL.js";
 import {
   Tel,
   getPackageVersion
-} from "./chunk-WEMFZYUR.js";
+} from "./chunk-PSOT2YDT.js";
 import {
   logger
 } from "./chunk-QWQYAQCK.js";
@@ -2356,7 +2356,7 @@ var MCPClient = class _MCPClient extends BaseMCPClient {
       clientInfo: serverConfig.clientInfo ?? this.config.clientInfo
     };
     if ("command" in merged && "args" in merged) {
-      const { StdioConnector } = await import("./stdio-QIYDKXTT.js");
+      const { StdioConnector } = await import("./stdio-ECCMBHYL.js");
       const stdioConfig = merged;
       return new StdioConnector({
         command: stdioConfig.command,

package/dist/{chunk-3N6PYMAD.js → chunk-LPVVF6US.js}

@@ -1,6 +1,6 @@
 import {
   CODE_MODE_AGENT_PROMPT
-} from "./chunk-2J3FVMZ5.js";
+} from "./chunk-TAPTQKI4.js";
 import {
   LangChainAdapter
 } from "./chunk-27JERD25.js";
@@ -8,7 +8,7 @@ import {
   Telemetry,
   extractModelInfo,
   getPackageVersion
-} from "./chunk-WEMFZYUR.js";
+} from "./chunk-PSOT2YDT.js";
 import {
   logger
 } from "./chunk-QWQYAQCK.js";

package/dist/{chunk-AOZBHAT7.js → chunk-LZOTKOYW.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-GKPKUKD6.js";
 import {
   BaseConnector
-} from "./chunk-4KP3757O.js";
+} from "./chunk-YZ22J43K.js";
 import {
   logger
 } from "./chunk-QWQYAQCK.js";

package/dist/{chunk-VWJXSLCF.js → chunk-N3DGPXFX.js}

@@ -95,6 +95,41 @@ var BrowserOAuthClientProvider = class {
   getKey(keySuffix) {
     return this.session.getKey(keySuffix);
   }
+  /**
+   * Re-anchor an SDK-derived OAuth discovery URL from the MCP connection
+   * (proxy) origin onto the actual MCP server.
+   *
+   * When MCP traffic is tunneled through a gateway/inspector proxy, the SDK
+   * transport derives `/.well-known/*` URLs from the URL it connected to (the
+   * proxy) whenever no `resource_metadata` hint is available — the SSE
+   * transport's EventSource cannot read `WWW-Authenticate`, and token refresh
+   * runs without a 401 response at hand. The proxy origin serves no OAuth
+   * metadata, so discovery would fail and the server would be misclassified
+   * as "does not support OAuth". Rewriting reproduces what a direct
+   * connection would have requested: the same well-known document, anchored
+   * on the server origin, with the RFC 8414 §3.1 / RFC 9728 §3.1 path
+   * insertion using the server's path instead of the proxy's.
+   */
+  reanchorWellKnownUrl(url) {
+    if (!this.connectionUrl) return url;
+    try {
+      const requested = new URL(url);
+      const connection = new URL(this.connectionUrl);
+      if (requested.origin !== connection.origin) return url;
+      if (!requested.pathname.startsWith("/.well-known/")) return url;
+      const target = new URL(this.serverUrl);
+      const rest = requested.pathname.slice("/.well-known/".length);
+      const [doc, ...suffixParts] = rest.split("/");
+      if (!doc) return url;
+      const suffix = suffixParts.length ? `/${suffixParts.join("/")}` : "";
+      const connectionPath = connection.pathname.replace(/\/+$/, "");
+      const targetPath = target.pathname.replace(/\/+$/, "");
+      const newSuffix = suffix && suffix === connectionPath ? targetPath : suffix;
+      return `${target.origin}/.well-known/${doc}${newSuffix}${requested.search}`;
+    } catch {
+      return url;
+    }
+  }
   /**
    * Returns a `fetch` function, scoped to this provider, that routes OAuth
    * requests (`.well-known` metadata, token, register, authorize) through the
@@ -124,7 +159,8 @@ var BrowserOAuthClientProvider = class {
     const connectionUrl = this.connectionUrl;
     const serverUrl = this.serverUrl;
     return async (input, init) => {
-      const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      const requestedUrl = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      const url = this.reanchorWellKnownUrl(requestedUrl);
       const isOAuthRequest = url.includes("/.well-known/") || url.match(/\/(register|token|authorize)$/);
       if (!isOAuthRequest) {
         return await base(input, init);
@@ -194,7 +230,7 @@ var BrowserOAuthClientProvider = class {
           "[OAuth Proxy] Request failed, falling back to direct fetch:",
           error
         );
-        return await base(input, init);
+        return url !== requestedUrl ? await base(url, init) : await base(input, init);
       }
     };
   }

package/dist/{chunk-EIYWOJYK.js → chunk-NXLY2JS7.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-KUEVOU4M.js";
 import {
   Telemetry
-} from "./chunk-WEMFZYUR.js";
+} from "./chunk-PSOT2YDT.js";
 import {
   generateUUID
 } from "./chunk-MTHLLDCX.js";

package/dist/{chunk-WEMFZYUR.js → chunk-PSOT2YDT.js}

@@ -13,7 +13,7 @@ import {
 } from "./chunk-3GQAWCBQ.js";
 
 // src/version.ts
-var VERSION = "1.34.0";
+var VERSION = "1.34.1";
 function getPackageVersion() {
   return VERSION;
 }

package/dist/{chunk-2J3FVMZ5.js → chunk-TAPTQKI4.js}

@@ -1,6 +1,6 @@
 import {
   BaseConnector
-} from "./chunk-4KP3757O.js";
+} from "./chunk-YZ22J43K.js";
 import {
   __name
 } from "./chunk-3GQAWCBQ.js";

package/dist/{chunk-7MKAP6XK.js → chunk-VYDFQS24.js}

@@ -1,6 +1,6 @@
 import {
   Telemetry
-} from "./chunk-XS2ZMBOG.js";
+} from "./chunk-XIAP7CEH.js";
 import {
   logger
 } from "./chunk-QWQYAQCK.js";

package/dist/{chunk-XS2ZMBOG.js → chunk-XIAP7CEH.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-3GQAWCBQ.js";
 
 // src/version.ts
-var VERSION = "1.34.0";
+var VERSION = "1.34.1";
 function getPackageVersion() {
   return VERSION;
 }

package/dist/{chunk-BOFDVMBT.js → chunk-YQIRNTLE.js}

@@ -1,11 +1,11 @@
 import {
   BaseConnector,
   ConnectionManager
-} from "./chunk-7MKAP6XK.js";
+} from "./chunk-VYDFQS24.js";
 import {
   Tel,
   getPackageVersion
-} from "./chunk-XS2ZMBOG.js";
+} from "./chunk-XIAP7CEH.js";
 import {
   logger
 } from "./chunk-QWQYAQCK.js";

package/dist/{chunk-4KP3757O.js → chunk-YZ22J43K.js}

@@ -1,6 +1,6 @@
 import {
   Telemetry
-} from "./chunk-WEMFZYUR.js";
+} from "./chunk-PSOT2YDT.js";
 import {
   logger
 } from "./chunk-QWQYAQCK.js";

package/dist/{client-O5HMGXF3.js → client-AGYZM4PU.js}

@@ -7,15 +7,15 @@ import {
   createConnectorFromConfig,
   normalizeClientInfo,
   resolveCallbacks
-} from "./chunk-BOFDVMBT.js";
+} from "./chunk-YQIRNTLE.js";
 import "./chunk-URE3PRDB.js";
 import {
   BaseConnector
-} from "./chunk-7MKAP6XK.js";
+} from "./chunk-VYDFQS24.js";
 import {
   Tel,
   getPackageVersion
-} from "./chunk-XS2ZMBOG.js";
+} from "./chunk-XIAP7CEH.js";
 import {
   logger
 } from "./chunk-QWQYAQCK.js";
@@ -1107,7 +1107,7 @@ var MCPClient = class _MCPClient extends BaseMCPClient {
       clientInfo: serverConfig.clientInfo ?? this.config.clientInfo
     };
     if ("command" in merged && "args" in merged) {
-      const { StdioConnector } = await import("./stdio-NRH7PMXI.js");
+      const { StdioConnector } = await import("./stdio-VYJBFXTQ.js");
       const stdioConfig = merged;
       return new StdioConnector({
         command: stdioConfig.command,

package/dist/index.cjs

@@ -1170,7 +1170,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = "1.34.0";
+    VERSION = "1.34.1";
     __name(getPackageVersion, "getPackageVersion");
   }
 });
@@ -10102,6 +10102,41 @@ var BrowserOAuthClientProvider = class {
   getKey(keySuffix) {
     return this.session.getKey(keySuffix);
   }
+  /**
+   * Re-anchor an SDK-derived OAuth discovery URL from the MCP connection
+   * (proxy) origin onto the actual MCP server.
+   *
+   * When MCP traffic is tunneled through a gateway/inspector proxy, the SDK
+   * transport derives `/.well-known/*` URLs from the URL it connected to (the
+   * proxy) whenever no `resource_metadata` hint is available — the SSE
+   * transport's EventSource cannot read `WWW-Authenticate`, and token refresh
+   * runs without a 401 response at hand. The proxy origin serves no OAuth
+   * metadata, so discovery would fail and the server would be misclassified
+   * as "does not support OAuth". Rewriting reproduces what a direct
+   * connection would have requested: the same well-known document, anchored
+   * on the server origin, with the RFC 8414 §3.1 / RFC 9728 §3.1 path
+   * insertion using the server's path instead of the proxy's.
+   */
+  reanchorWellKnownUrl(url) {
+    if (!this.connectionUrl) return url;
+    try {
+      const requested = new URL(url);
+      const connection = new URL(this.connectionUrl);
+      if (requested.origin !== connection.origin) return url;
+      if (!requested.pathname.startsWith("/.well-known/")) return url;
+      const target = new URL(this.serverUrl);
+      const rest = requested.pathname.slice("/.well-known/".length);
+      const [doc, ...suffixParts] = rest.split("/");
+      if (!doc) return url;
+      const suffix = suffixParts.length ? `/${suffixParts.join("/")}` : "";
+      const connectionPath = connection.pathname.replace(/\/+$/, "");
+      const targetPath = target.pathname.replace(/\/+$/, "");
+      const newSuffix = suffix && suffix === connectionPath ? targetPath : suffix;
+      return `${target.origin}/.well-known/${doc}${newSuffix}${requested.search}`;
+    } catch {
+      return url;
+    }
+  }
   /**
    * Returns a `fetch` function, scoped to this provider, that routes OAuth
    * requests (`.well-known` metadata, token, register, authorize) through the
@@ -10131,7 +10166,8 @@ var BrowserOAuthClientProvider = class {
     const connectionUrl = this.connectionUrl;
     const serverUrl = this.serverUrl;
     return async (input, init) => {
-      const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      const requestedUrl = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      const url = this.reanchorWellKnownUrl(requestedUrl);
       const isOAuthRequest = url.includes("/.well-known/") || url.match(/\/(register|token|authorize)$/);
       if (!isOAuthRequest) {
         return await base(input, init);
@@ -10201,7 +10237,7 @@ var BrowserOAuthClientProvider = class {
           "[OAuth Proxy] Request failed, falling back to direct fetch:",
           error
         );
-        return await base(input, init);
+        return url !== requestedUrl ? await base(url, init) : await base(input, init);
       }
     };
   }

package/dist/index.js

@@ -5,7 +5,7 @@ import {
 } from "./chunk-OWF2HVMR.js";
 import {
   StdioConnector
-} from "./chunk-AOZBHAT7.js";
+} from "./chunk-LZOTKOYW.js";
 import {
   clearRpcLogs,
   getAllRpcLogs,
@@ -32,7 +32,7 @@ import {
   reject,
   resolveCallbacks,
   validate
-} from "./chunk-U6UCVQKQ.js";
+} from "./chunk-D7SEH5RU.js";
 import "./chunk-GKPKUKD6.js";
 import "./chunk-GXNAXUDI.js";
 import {
@@ -50,12 +50,12 @@ import {
   getSupportedProviders,
   isValidLLMString,
   parseLLMString
-} from "./chunk-3N6PYMAD.js";
+} from "./chunk-LPVVF6US.js";
 import "./chunk-N27VLLMA.js";
-import "./chunk-2J3FVMZ5.js";
+import "./chunk-TAPTQKI4.js";
 import {
   BaseConnector
-} from "./chunk-4KP3757O.js";
+} from "./chunk-YZ22J43K.js";
 import {
   BaseAdapter
 } from "./chunk-27JERD25.js";
@@ -67,7 +67,7 @@ import {
   onMcpAuthorization,
   probeAuthParams,
   runAuthPopup
-} from "./chunk-VWJXSLCF.js";
+} from "./chunk-N3DGPXFX.js";
 import {
   sanitizeUrl
 } from "./chunk-HDFPTC56.js";
@@ -98,7 +98,7 @@ import {
   createServerRunEventData,
   getPackageVersion,
   setTelemetrySource
-} from "./chunk-WEMFZYUR.js";
+} from "./chunk-PSOT2YDT.js";
 import {
   telFetch
 } from "./chunk-BXZHMYMM.js";

package/dist/src/agents/index.cjs

@@ -583,7 +583,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = "1.34.0";
+    VERSION = "1.34.1";
     __name(getPackageVersion, "getPackageVersion");
   }
 });

package/dist/src/agents/index.js

@@ -3,13 +3,13 @@ import {
   MCPAgent,
   PROMPTS,
   RemoteAgent
-} from "../../chunk-3N6PYMAD.js";
+} from "../../chunk-LPVVF6US.js";
 import "../../chunk-N27VLLMA.js";
-import "../../chunk-2J3FVMZ5.js";
-import "../../chunk-4KP3757O.js";
+import "../../chunk-TAPTQKI4.js";
+import "../../chunk-YZ22J43K.js";
 import "../../chunk-27JERD25.js";
 import "../../chunk-LG5NSHEL.js";
-import "../../chunk-WEMFZYUR.js";
+import "../../chunk-PSOT2YDT.js";
 import "../../chunk-BXZHMYMM.js";
 import "../../chunk-MTHLLDCX.js";
 import "../../chunk-QWQYAQCK.js";

package/dist/src/auth/browser-provider.d.ts

@@ -54,6 +54,22 @@ export declare class BrowserOAuthClientProvider implements OAuthClientProvider {
     get callbackUrl(): string;
     get scope(): string | undefined;
     getKey(keySuffix: string): string;
+    /**
+     * Re-anchor an SDK-derived OAuth discovery URL from the MCP connection
+     * (proxy) origin onto the actual MCP server.
+     *
+     * When MCP traffic is tunneled through a gateway/inspector proxy, the SDK
+     * transport derives `/.well-known/*` URLs from the URL it connected to (the
+     * proxy) whenever no `resource_metadata` hint is available — the SSE
+     * transport's EventSource cannot read `WWW-Authenticate`, and token refresh
+     * runs without a 401 response at hand. The proxy origin serves no OAuth
+     * metadata, so discovery would fail and the server would be misclassified
+     * as "does not support OAuth". Rewriting reproduces what a direct
+     * connection would have requested: the same well-known document, anchored
+     * on the server origin, with the RFC 8414 §3.1 / RFC 9728 §3.1 path
+     * insertion using the server's path instead of the proxy's.
+     */
+    private reanchorWellKnownUrl;
     /**
      * Returns a `fetch` function, scoped to this provider, that routes OAuth
      * requests (`.well-known` metadata, token, register, authorize) through the

package/dist/src/auth/browser-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser-provider.d.ts","sourceRoot":"","sources":["../../../src/auth/browser-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EACV,sBAAsB,EACtB,mBAAmB,EACnB,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAkBlD,UAAU,mBAAmB;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,CACd,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,IAAI,KAC7B,IAAI,CAAC;CACX;AAED;;GAEG;AACH,qBAAa,0BAA2B,YAAW,mBAAmB;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IACnD,OAAO,CAAC,OAAO,CAAoB;IAGnC,OAAO,CAAC,eAAe,CAAC,CAAU;IAClC,OAAO,CAAC,eAAe,CAAC,CAAU;IAClC,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,kBAAkB,CAAU;IACpC,OAAO,CAAC,qBAAqB,CAAuB;IACpD,QAAQ,CAAC,aAAa,EAClB,CAAC,CACC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,IAAI,KAC7B,IAAI,CAAC,GACV,SAAS,CAAC;gBAEF,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB;IAkBhE,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAED,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,KAAK,IAAI,MAAM,GAAG,SAAS,CAE9B;IAED,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAIjC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,OAAO,KAAK,GAAG,SAAS;IA6IjE,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,MAAM,IAAI,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAI1C,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC,iBAAiB,IAAI,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IAShE,qBAAqB,CACzB,iBAAiB,EAAE,sBAAsB,GACxC,OAAO,CAAC,IAAI,CAAC;IAOhB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAI/B,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrD,qBAAqB,CACnB,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAC9C,OAAO,CAAC,IAAI,CAAC;IAIhB;;;;OAIG;IACH,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI1C;;;;OAIG;IACH,oBAAoB,IAAI,OAAO,CAAC;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,IAAI,CAAC;IAIT;;;;;OAKG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBrE;;;OAGG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAuDnE;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;IAyBnC;;OAEG;IACH,uBAAuB,IAAI,MAAM,GAAG,IAAI;IAMxC,YAAY,IAAI,MAAM;CAqCvB"}
+{"version":3,"file":"browser-provider.d.ts","sourceRoot":"","sources":["../../../src/auth/browser-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EACV,sBAAsB,EACtB,mBAAmB,EACnB,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAkBlD,UAAU,mBAAmB;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,CACd,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,IAAI,KAC7B,IAAI,CAAC;CACX;AAED;;GAEG;AACH,qBAAa,0BAA2B,YAAW,mBAAmB;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IACnD,OAAO,CAAC,OAAO,CAAoB;IAGnC,OAAO,CAAC,eAAe,CAAC,CAAU;IAClC,OAAO,CAAC,eAAe,CAAC,CAAU;IAClC,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,kBAAkB,CAAU;IACpC,OAAO,CAAC,qBAAqB,CAAuB;IACpD,QAAQ,CAAC,aAAa,EAClB,CAAC,CACC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,IAAI,KAC7B,IAAI,CAAC,GACV,SAAS,CAAC;gBAEF,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB;IAkBhE,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAED,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,KAAK,IAAI,MAAM,GAAG,SAAS,CAE9B;IAED,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAIjC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IA2B5B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,OAAO,KAAK,GAAG,SAAS;IAsJjE,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,MAAM,IAAI,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAI1C,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC,iBAAiB,IAAI,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IAShE,qBAAqB,CACzB,iBAAiB,EAAE,sBAAsB,GACxC,OAAO,CAAC,IAAI,CAAC;IAOhB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAI/B,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrD,qBAAqB,CACnB,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAC9C,OAAO,CAAC,IAAI,CAAC;IAIhB;;;;OAIG;IACH,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI1C;;;;OAIG;IACH,oBAAoB,IAAI,OAAO,CAAC;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,IAAI,CAAC;IAIT;;;;;OAKG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBrE;;;OAGG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAuDnE;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;IAyBnC;;OAEG;IACH,uBAAuB,IAAI,MAAM,GAAG,IAAI;IAMxC,YAAY,IAAI,MAAM;CAqCvB"}

package/dist/src/auth/index.cjs

@@ -444,6 +444,41 @@ var BrowserOAuthClientProvider = class {
   getKey(keySuffix) {
     return this.session.getKey(keySuffix);
   }
+  /**
+   * Re-anchor an SDK-derived OAuth discovery URL from the MCP connection
+   * (proxy) origin onto the actual MCP server.
+   *
+   * When MCP traffic is tunneled through a gateway/inspector proxy, the SDK
+   * transport derives `/.well-known/*` URLs from the URL it connected to (the
+   * proxy) whenever no `resource_metadata` hint is available — the SSE
+   * transport's EventSource cannot read `WWW-Authenticate`, and token refresh
+   * runs without a 401 response at hand. The proxy origin serves no OAuth
+   * metadata, so discovery would fail and the server would be misclassified
+   * as "does not support OAuth". Rewriting reproduces what a direct
+   * connection would have requested: the same well-known document, anchored
+   * on the server origin, with the RFC 8414 §3.1 / RFC 9728 §3.1 path
+   * insertion using the server's path instead of the proxy's.
+   */
+  reanchorWellKnownUrl(url) {
+    if (!this.connectionUrl) return url;
+    try {
+      const requested = new URL(url);
+      const connection = new URL(this.connectionUrl);
+      if (requested.origin !== connection.origin) return url;
+      if (!requested.pathname.startsWith("/.well-known/")) return url;
+      const target = new URL(this.serverUrl);
+      const rest = requested.pathname.slice("/.well-known/".length);
+      const [doc, ...suffixParts] = rest.split("/");
+      if (!doc) return url;
+      const suffix = suffixParts.length ? `/${suffixParts.join("/")}` : "";
+      const connectionPath = connection.pathname.replace(/\/+$/, "");
+      const targetPath = target.pathname.replace(/\/+$/, "");
+      const newSuffix = suffix && suffix === connectionPath ? targetPath : suffix;
+      return `${target.origin}/.well-known/${doc}${newSuffix}${requested.search}`;
+    } catch {
+      return url;
+    }
+  }
   /**
    * Returns a `fetch` function, scoped to this provider, that routes OAuth
    * requests (`.well-known` metadata, token, register, authorize) through the
@@ -473,7 +508,8 @@ var BrowserOAuthClientProvider = class {
     const connectionUrl = this.connectionUrl;
     const serverUrl = this.serverUrl;
     return async (input, init) => {
-      const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      const requestedUrl = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      const url = this.reanchorWellKnownUrl(requestedUrl);
       const isOAuthRequest = url.includes("/.well-known/") || url.match(/\/(register|token|authorize)$/);
       if (!isOAuthRequest) {
         return await base(input, init);
@@ -543,7 +579,7 @@ var BrowserOAuthClientProvider = class {
           "[OAuth Proxy] Request failed, falling back to direct fetch:",
           error
         );
-        return await base(input, init);
+        return url !== requestedUrl ? await base(url, init) : await base(input, init);
       }
     };
   }

package/dist/src/auth/index.js

@@ -5,7 +5,7 @@ import {
   onMcpAuthorization,
   probeAuthParams,
   runAuthPopup
-} from "../../chunk-VWJXSLCF.js";
+} from "../../chunk-N3DGPXFX.js";
 import "../../chunk-HDFPTC56.js";
 import "../../chunk-3GQAWCBQ.js";
 export {

package/dist/src/browser-agent.cjs

@@ -1170,7 +1170,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = "1.34.0";
+    VERSION = "1.34.1";
     __name(getPackageVersion, "getPackageVersion");
   }
 });

package/dist/src/browser-agent.js

@@ -7,7 +7,7 @@ import {
   Telemetry,
   extractModelInfo,
   getPackageVersion
-} from "../chunk-XS2ZMBOG.js";
+} from "../chunk-XIAP7CEH.js";
 import {
   logger
 } from "../chunk-QWQYAQCK.js";
@@ -1671,7 +1671,7 @@ var MCPAgent = class {
         logger.debug(
           `Creating MCPClient with ${Object.keys(this.mcpServersConfig).length} server(s)...`
         );
-        const { MCPClient } = await import("../client-O5HMGXF3.js");
+        const { MCPClient } = await import("../client-AGYZM4PU.js");
         this.client = new MCPClient({ mcpServers: this.mcpServersConfig });
         logger.debug("\u2705 MCPClient created successfully");
       }

package/dist/src/browser.cjs

@@ -783,7 +783,7 @@ var ClientRemoveServerEvent = class extends BaseTelemetryEvent {
 };
 
 // src/version.ts
-var VERSION = "1.34.0";
+var VERSION = "1.34.1";
 function getPackageVersion() {
   return VERSION;
 }
@@ -3512,6 +3512,41 @@ var BrowserOAuthClientProvider = class {
   getKey(keySuffix) {
     return this.session.getKey(keySuffix);
   }
+  /**
+   * Re-anchor an SDK-derived OAuth discovery URL from the MCP connection
+   * (proxy) origin onto the actual MCP server.
+   *
+   * When MCP traffic is tunneled through a gateway/inspector proxy, the SDK
+   * transport derives `/.well-known/*` URLs from the URL it connected to (the
+   * proxy) whenever no `resource_metadata` hint is available — the SSE
+   * transport's EventSource cannot read `WWW-Authenticate`, and token refresh
+   * runs without a 401 response at hand. The proxy origin serves no OAuth
+   * metadata, so discovery would fail and the server would be misclassified
+   * as "does not support OAuth". Rewriting reproduces what a direct
+   * connection would have requested: the same well-known document, anchored
+   * on the server origin, with the RFC 8414 §3.1 / RFC 9728 §3.1 path
+   * insertion using the server's path instead of the proxy's.
+   */
+  reanchorWellKnownUrl(url) {
+    if (!this.connectionUrl) return url;
+    try {
+      const requested = new URL(url);
+      const connection = new URL(this.connectionUrl);
+      if (requested.origin !== connection.origin) return url;
+      if (!requested.pathname.startsWith("/.well-known/")) return url;
+      const target = new URL(this.serverUrl);
+      const rest = requested.pathname.slice("/.well-known/".length);
+      const [doc, ...suffixParts] = rest.split("/");
+      if (!doc) return url;
+      const suffix = suffixParts.length ? `/${suffixParts.join("/")}` : "";
+      const connectionPath = connection.pathname.replace(/\/+$/, "");
+      const targetPath = target.pathname.replace(/\/+$/, "");
+      const newSuffix = suffix && suffix === connectionPath ? targetPath : suffix;
+      return `${target.origin}/.well-known/${doc}${newSuffix}${requested.search}`;
+    } catch {
+      return url;
+    }
+  }
   /**
    * Returns a `fetch` function, scoped to this provider, that routes OAuth
    * requests (`.well-known` metadata, token, register, authorize) through the
@@ -3541,7 +3576,8 @@ var BrowserOAuthClientProvider = class {
     const connectionUrl = this.connectionUrl;
     const serverUrl = this.serverUrl;
     return async (input, init) => {
-      const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      const requestedUrl = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      const url = this.reanchorWellKnownUrl(requestedUrl);
       const isOAuthRequest = url.includes("/.well-known/") || url.match(/\/(register|token|authorize)$/);
       if (!isOAuthRequest) {
         return await base(input, init);
@@ -3611,7 +3647,7 @@ var BrowserOAuthClientProvider = class {
           "[OAuth Proxy] Request failed, falling back to direct fetch:",
           error
         );
-        return await base(input, init);
+        return url !== requestedUrl ? await base(url, init) : await base(input, init);
       }
     };
   }