mcp-use 1.34.4 → 1.34.5

package/dist/{chunk-AON7VXVM.js → chunk-35DRMA7E.js}

@@ -6,6 +6,12 @@ import {
   __name
 } from "./chunk-3GQAWCBQ.js";
 
+// src/auth/browser-provider.ts
+import {
+  checkResourceAllowed,
+  resourceUrlFromServerUrl
+} from "@modelcontextprotocol/sdk/shared/auth-utils.js";
+
 // src/auth/kv-store.ts
 var LocalStorageKVStore = class {
   static {
@@ -264,6 +270,43 @@ var BrowserOAuthClientProvider = class {
   invalidateCredentials(scope) {
     return this.session.invalidateCredentials(scope);
   }
+  /**
+   * Validate the protected resource discovered through the OAuth proxy.
+   *
+   * The proxy rewrites protected-resource metadata to the MCP connection URL
+   * so transport-anchored discovery remains valid. Manual authentication is
+   * anchored on the upstream MCP URL instead, so accept that rewrite and
+   * return the original upstream resource that the authorization server
+   * protects.
+   */
+  async validateResourceURL(serverUrl, resource) {
+    if (!resource) return void 0;
+    const requestedResource = resourceUrlFromServerUrl(serverUrl);
+    if (checkResourceAllowed({
+      requestedResource,
+      configuredResource: resource
+    })) {
+      return new URL(resource);
+    }
+    const isConnectionResource = this.connectionUrl && checkResourceAllowed({
+      requestedResource: resourceUrlFromServerUrl(this.connectionUrl),
+      configuredResource: resource
+    });
+    if (isConnectionResource) {
+      const upstreamResource = resourceUrlFromServerUrl(
+        this._lastOriginalResource ?? this.serverUrl
+      );
+      if (checkResourceAllowed({
+        requestedResource,
+        configuredResource: upstreamResource
+      })) {
+        return upstreamResource;
+      }
+    }
+    throw new Error(
+      `Protected resource ${resource} does not match expected ${requestedResource} (or origin)`
+    );
+  }
   /**
    * Resolve this server's OAuth token endpoint (via discovery, cached). Lets
    * consumers persist the endpoint alongside the tokens for server-side

package/dist/{chunk-CI6MW6DM.js → chunk-3BUU264G.js}

@@ -3,17 +3,17 @@ import {
 } from "./chunk-GKPKUKD6.js";
 import {
   CodeModeConnector
-} from "./chunk-WJ2EMDBB.js";
+} from "./chunk-LS73EEWA.js";
 import {
   BaseConnector
-} from "./chunk-7DSZJBE2.js";
+} from "./chunk-JFYUK3XX.js";
 import {
   JSONSchemaToZod
 } from "./chunk-LG5NSHEL.js";
 import {
   Tel,
   getPackageVersion
-} from "./chunk-MKRTKKXV.js";
+} from "./chunk-NDIVAYZ3.js";
 import {
   logger
 } from "./chunk-QWQYAQCK.js";
@@ -2356,7 +2356,7 @@ var MCPClient = class _MCPClient extends BaseMCPClient {
       clientInfo: serverConfig.clientInfo ?? this.config.clientInfo
     };
     if ("command" in merged && "args" in merged) {
-      const { StdioConnector } = await import("./stdio-4SNFIKTV.js");
+      const { StdioConnector } = await import("./stdio-I5TXQ4ET.js");
       const stdioConfig = merged;
       return new StdioConnector({
         command: stdioConfig.command,

package/dist/{chunk-YYUZ7XGB.js → chunk-6P7JMLV2.js}

@@ -3,11 +3,11 @@ import {
   HttpConnector,
   normalizeClientInfo,
   resolveCallbacks
-} from "./chunk-LEWR3GBF.js";
+} from "./chunk-V7Q4HEFC.js";
 import {
   Tel,
   getPackageVersion
-} from "./chunk-2J5OVVW6.js";
+} from "./chunk-VSSL5DL7.js";
 import {
   logger
 } from "./chunk-QWQYAQCK.js";
@@ -105,6 +105,12 @@ var BrowserMCPClient = class _BrowserMCPClient extends BaseMCPClient {
   }
 };
 
+// src/auth/browser-provider.ts
+import {
+  checkResourceAllowed,
+  resourceUrlFromServerUrl
+} from "@modelcontextprotocol/sdk/shared/auth-utils.js";
+
 // src/utils/url-sanitize.ts
 function sanitizeUrl(raw) {
   const abort = /* @__PURE__ */ __name(() => {
@@ -726,6 +732,43 @@ var BrowserOAuthClientProvider = class {
   invalidateCredentials(scope) {
     return this.session.invalidateCredentials(scope);
   }
+  /**
+   * Validate the protected resource discovered through the OAuth proxy.
+   *
+   * The proxy rewrites protected-resource metadata to the MCP connection URL
+   * so transport-anchored discovery remains valid. Manual authentication is
+   * anchored on the upstream MCP URL instead, so accept that rewrite and
+   * return the original upstream resource that the authorization server
+   * protects.
+   */
+  async validateResourceURL(serverUrl, resource) {
+    if (!resource) return void 0;
+    const requestedResource = resourceUrlFromServerUrl(serverUrl);
+    if (checkResourceAllowed({
+      requestedResource,
+      configuredResource: resource
+    })) {
+      return new URL(resource);
+    }
+    const isConnectionResource = this.connectionUrl && checkResourceAllowed({
+      requestedResource: resourceUrlFromServerUrl(this.connectionUrl),
+      configuredResource: resource
+    });
+    if (isConnectionResource) {
+      const upstreamResource = resourceUrlFromServerUrl(
+        this._lastOriginalResource ?? this.serverUrl
+      );
+      if (checkResourceAllowed({
+        requestedResource,
+        configuredResource: upstreamResource
+      })) {
+        return upstreamResource;
+      }
+    }
+    throw new Error(
+      `Protected resource ${resource} does not match expected ${requestedResource} (or origin)`
+    );
+  }
   /**
    * Resolve this server's OAuth token endpoint (via discovery, cached). Lets
    * consumers persist the endpoint alongside the tokens for server-side

package/dist/{chunk-GYSF6PR5.js → chunk-DAFFOVMW.js}

@@ -1,6 +1,6 @@
 import {
   Telemetry
-} from "./chunk-2J5OVVW6.js";
+} from "./chunk-VSSL5DL7.js";
 import {
   logger
 } from "./chunk-QWQYAQCK.js";

package/dist/{chunk-7DSZJBE2.js → chunk-JFYUK3XX.js}

@@ -1,6 +1,6 @@
 import {
   Telemetry
-} from "./chunk-MKRTKKXV.js";
+} from "./chunk-NDIVAYZ3.js";
 import {
   logger
 } from "./chunk-QWQYAQCK.js";

package/dist/{chunk-WJ2EMDBB.js → chunk-LS73EEWA.js}

@@ -1,6 +1,6 @@
 import {
   BaseConnector
-} from "./chunk-7DSZJBE2.js";
+} from "./chunk-JFYUK3XX.js";
 import {
   __name
 } from "./chunk-3GQAWCBQ.js";

package/dist/{chunk-KO5XAWZ3.js → chunk-MD7U5C3K.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-KUEVOU4M.js";
 import {
   Telemetry
-} from "./chunk-MKRTKKXV.js";
+} from "./chunk-NDIVAYZ3.js";
 import {
   generateUUID
 } from "./chunk-MTHLLDCX.js";

package/dist/{chunk-MKRTKKXV.js → chunk-NDIVAYZ3.js}

@@ -13,7 +13,7 @@ import {
 } from "./chunk-3GQAWCBQ.js";
 
 // src/version.ts
-var VERSION = "1.34.4";
+var VERSION = "1.34.5";
 function getPackageVersion() {
   return VERSION;
 }

package/dist/{chunk-LEWR3GBF.js → chunk-V7Q4HEFC.js}

@@ -1,11 +1,11 @@
 import {
   BaseConnector,
   ConnectionManager
-} from "./chunk-GYSF6PR5.js";
+} from "./chunk-DAFFOVMW.js";
 import {
   Tel,
   getPackageVersion
-} from "./chunk-2J5OVVW6.js";
+} from "./chunk-VSSL5DL7.js";
 import {
   logger
 } from "./chunk-QWQYAQCK.js";

package/dist/{chunk-2J5OVVW6.js → chunk-VSSL5DL7.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-3GQAWCBQ.js";
 
 // src/version.ts
-var VERSION = "1.34.4";
+var VERSION = "1.34.5";
 function getPackageVersion() {
   return VERSION;
 }

package/dist/{chunk-WGK7GOZV.js → chunk-YH33JHUI.js}

@@ -1,6 +1,6 @@
 import {
   CODE_MODE_AGENT_PROMPT
-} from "./chunk-WJ2EMDBB.js";
+} from "./chunk-LS73EEWA.js";
 import {
   LangChainAdapter
 } from "./chunk-27JERD25.js";
@@ -8,7 +8,7 @@ import {
   Telemetry,
   extractModelInfo,
   getPackageVersion
-} from "./chunk-MKRTKKXV.js";
+} from "./chunk-NDIVAYZ3.js";
 import {
   logger
 } from "./chunk-QWQYAQCK.js";

package/dist/{chunk-XNWBPRVB.js → chunk-ZDC5CD3L.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-GKPKUKD6.js";
 import {
   BaseConnector
-} from "./chunk-7DSZJBE2.js";
+} from "./chunk-JFYUK3XX.js";
 import {
   logger
 } from "./chunk-QWQYAQCK.js";

package/dist/{client-A4Z5ZFV2.js → client-A5GK5WZD.js}

@@ -7,15 +7,15 @@ import {
   createConnectorFromConfig,
   normalizeClientInfo,
   resolveCallbacks
-} from "./chunk-LEWR3GBF.js";
+} from "./chunk-V7Q4HEFC.js";
 import "./chunk-URE3PRDB.js";
 import {
   BaseConnector
-} from "./chunk-GYSF6PR5.js";
+} from "./chunk-DAFFOVMW.js";
 import {
   Tel,
   getPackageVersion
-} from "./chunk-2J5OVVW6.js";
+} from "./chunk-VSSL5DL7.js";
 import {
   logger
 } from "./chunk-QWQYAQCK.js";
@@ -1107,7 +1107,7 @@ var MCPClient = class _MCPClient extends BaseMCPClient {
       clientInfo: serverConfig.clientInfo ?? this.config.clientInfo
     };
     if ("command" in merged && "args" in merged) {
-      const { StdioConnector } = await import("./stdio-ZAOHF4EV.js");
+      const { StdioConnector } = await import("./stdio-OFLQV3DJ.js");
       const stdioConfig = merged;
       return new StdioConnector({
         command: stdioConfig.command,

package/dist/index.cjs

@@ -1170,7 +1170,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = "1.34.4";
+    VERSION = "1.34.5";
     __name(getPackageVersion, "getPackageVersion");
   }
 });
@@ -9688,6 +9688,9 @@ __name(streamEventsToAISDKWithTools, "streamEventsToAISDKWithTools");
 init_telemetry();
 init_version();
 
+// src/auth/browser-provider.ts
+var import_auth_utils = require("@modelcontextprotocol/sdk/shared/auth-utils.js");
+
 // src/utils/url-sanitize.ts
 function sanitizeUrl(raw) {
   const abort = /* @__PURE__ */ __name(() => {
@@ -10305,6 +10308,43 @@ var BrowserOAuthClientProvider = class {
   invalidateCredentials(scope) {
     return this.session.invalidateCredentials(scope);
   }
+  /**
+   * Validate the protected resource discovered through the OAuth proxy.
+   *
+   * The proxy rewrites protected-resource metadata to the MCP connection URL
+   * so transport-anchored discovery remains valid. Manual authentication is
+   * anchored on the upstream MCP URL instead, so accept that rewrite and
+   * return the original upstream resource that the authorization server
+   * protects.
+   */
+  async validateResourceURL(serverUrl, resource) {
+    if (!resource) return void 0;
+    const requestedResource = (0, import_auth_utils.resourceUrlFromServerUrl)(serverUrl);
+    if ((0, import_auth_utils.checkResourceAllowed)({
+      requestedResource,
+      configuredResource: resource
+    })) {
+      return new URL(resource);
+    }
+    const isConnectionResource = this.connectionUrl && (0, import_auth_utils.checkResourceAllowed)({
+      requestedResource: (0, import_auth_utils.resourceUrlFromServerUrl)(this.connectionUrl),
+      configuredResource: resource
+    });
+    if (isConnectionResource) {
+      const upstreamResource = (0, import_auth_utils.resourceUrlFromServerUrl)(
+        this._lastOriginalResource ?? this.serverUrl
+      );
+      if ((0, import_auth_utils.checkResourceAllowed)({
+        requestedResource,
+        configuredResource: upstreamResource
+      })) {
+        return upstreamResource;
+      }
+    }
+    throw new Error(
+      `Protected resource ${resource} does not match expected ${requestedResource} (or origin)`
+    );
+  }
   /**
    * Resolve this server's OAuth token endpoint (via discovery, cached). Lets
    * consumers persist the endpoint alongside the tokens for server-side
@@ -12945,6 +12985,7 @@ function useMcp(options) {
         addLog("info", "Triggering fresh OAuth authorization...");
         const parsedUrl = new URL(url);
         const baseUrl = parsedUrl.origin + parsedUrl.pathname.replace(/\/+$/, "");
+        let authFlowError = null;
         try {
           await (0, import_auth4.auth)(freshAuthProvider, {
             serverUrl: baseUrl,
@@ -12952,13 +12993,21 @@ function useMcp(options) {
           });
           addLog("info", "OAuth flow completed (tokens obtained)");
         } catch (err) {
+          authFlowError = err instanceof Error ? err : new Error(String(err));
           addLog(
             "info",
             "OAuth flow initiated (popup/redirect):",
-            err instanceof Error ? err.message : "Redirecting..."
+            authFlowError.message
           );
         }
         const newAuthUrl = freshAuthProvider.getLastAttemptedAuthUrl?.();
+        if (authFlowError && !capturedPopup && !newAuthUrl) {
+          failConnection(
+            `Authentication failed: ${authFlowError.message}`,
+            authFlowError
+          );
+          return;
+        }
         if (newAuthUrl) {
           setAuthUrl(newAuthUrl);
           addLog("info", "Updated auth URL for fallback:", newAuthUrl);

package/dist/index.js

@@ -5,7 +5,7 @@ import {
 } from "./chunk-OWF2HVMR.js";
 import {
   StdioConnector
-} from "./chunk-XNWBPRVB.js";
+} from "./chunk-ZDC5CD3L.js";
 import {
   clearRpcLogs,
   getAllRpcLogs,
@@ -32,7 +32,7 @@ import {
   reject,
   resolveCallbacks,
   validate
-} from "./chunk-CI6MW6DM.js";
+} from "./chunk-3BUU264G.js";
 import "./chunk-GKPKUKD6.js";
 import "./chunk-GXNAXUDI.js";
 import {
@@ -50,12 +50,12 @@ import {
   getSupportedProviders,
   isValidLLMString,
   parseLLMString
-} from "./chunk-WGK7GOZV.js";
+} from "./chunk-YH33JHUI.js";
 import "./chunk-N27VLLMA.js";
-import "./chunk-WJ2EMDBB.js";
+import "./chunk-LS73EEWA.js";
 import {
   BaseConnector
-} from "./chunk-7DSZJBE2.js";
+} from "./chunk-JFYUK3XX.js";
 import {
   BaseAdapter
 } from "./chunk-27JERD25.js";
@@ -67,7 +67,7 @@ import {
   onMcpAuthorization,
   probeAuthParams,
   runAuthPopup
-} from "./chunk-AON7VXVM.js";
+} from "./chunk-35DRMA7E.js";
 import {
   sanitizeUrl
 } from "./chunk-QZVO7T36.js";
@@ -98,7 +98,7 @@ import {
   createServerRunEventData,
   getPackageVersion,
   setTelemetrySource
-} from "./chunk-MKRTKKXV.js";
+} from "./chunk-NDIVAYZ3.js";
 import {
   telFetch
 } from "./chunk-BXZHMYMM.js";
@@ -1884,6 +1884,7 @@ function useMcp(options) {
         addLog("info", "Triggering fresh OAuth authorization...");
         const parsedUrl = new URL(url);
         const baseUrl = parsedUrl.origin + parsedUrl.pathname.replace(/\/+$/, "");
+        let authFlowError = null;
         try {
           await auth(freshAuthProvider, {
             serverUrl: baseUrl,
@@ -1891,13 +1892,21 @@ function useMcp(options) {
           });
           addLog("info", "OAuth flow completed (tokens obtained)");
         } catch (err) {
+          authFlowError = err instanceof Error ? err : new Error(String(err));
           addLog(
             "info",
             "OAuth flow initiated (popup/redirect):",
-            err instanceof Error ? err.message : "Redirecting..."
+            authFlowError.message
           );
         }
         const newAuthUrl = freshAuthProvider.getLastAttemptedAuthUrl?.();
+        if (authFlowError && !capturedPopup && !newAuthUrl) {
+          failConnection(
+            `Authentication failed: ${authFlowError.message}`,
+            authFlowError
+          );
+          return;
+        }
         if (newAuthUrl) {
           setAuthUrl(newAuthUrl);
           addLog("info", "Updated auth URL for fallback:", newAuthUrl);

package/dist/src/agents/index.cjs

@@ -583,7 +583,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = "1.34.4";
+    VERSION = "1.34.5";
     __name(getPackageVersion, "getPackageVersion");
   }
 });

package/dist/src/agents/index.js

@@ -3,13 +3,13 @@ import {
   MCPAgent,
   PROMPTS,
   RemoteAgent
-} from "../../chunk-WGK7GOZV.js";
+} from "../../chunk-YH33JHUI.js";
 import "../../chunk-N27VLLMA.js";
-import "../../chunk-WJ2EMDBB.js";
-import "../../chunk-7DSZJBE2.js";
+import "../../chunk-LS73EEWA.js";
+import "../../chunk-JFYUK3XX.js";
 import "../../chunk-27JERD25.js";
 import "../../chunk-LG5NSHEL.js";
-import "../../chunk-MKRTKKXV.js";
+import "../../chunk-NDIVAYZ3.js";
 import "../../chunk-BXZHMYMM.js";
 import "../../chunk-MTHLLDCX.js";
 import "../../chunk-QWQYAQCK.js";

package/dist/src/auth/browser-provider.d.ts

@@ -100,6 +100,16 @@ export declare class BrowserOAuthClientProvider implements OAuthClientProvider {
     codeVerifier(): Promise<string>;
     saveCodeVerifier(codeVerifier: string): Promise<void>;
     invalidateCredentials(scope: "all" | "client" | "tokens" | "verifier"): Promise<void>;
+    /**
+     * Validate the protected resource discovered through the OAuth proxy.
+     *
+     * The proxy rewrites protected-resource metadata to the MCP connection URL
+     * so transport-anchored discovery remains valid. Manual authentication is
+     * anchored on the upstream MCP URL instead, so accept that rewrite and
+     * return the original upstream resource that the authorization server
+     * protects.
+     */
+    validateResourceURL(serverUrl: string | URL, resource?: string): Promise<URL | undefined>;
     /**
      * Resolve this server's OAuth token endpoint (via discovery, cached). Lets
      * consumers persist the endpoint alongside the tokens for server-side

package/dist/src/auth/browser-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser-provider.d.ts","sourceRoot":"","sources":["../../../src/auth/browser-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EACV,sBAAsB,EACtB,mBAAmB,EACnB,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAkBlD,UAAU,mBAAmB;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,CACd,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,IAAI,KAC7B,IAAI,CAAC;CACX;AAED;;GAEG;AACH,qBAAa,0BAA2B,YAAW,mBAAmB;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IACnD,OAAO,CAAC,OAAO,CAAoB;IAGnC,OAAO,CAAC,eAAe,CAAC,CAAU;IAClC,OAAO,CAAC,eAAe,CAAC,CAAU;IAClC,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,kBAAkB,CAAU;IACpC,OAAO,CAAC,qBAAqB,CAAuB;IACpD,QAAQ,CAAC,aAAa,EAClB,CAAC,CACC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,IAAI,KAC7B,IAAI,CAAC,GACV,SAAS,CAAC;gBAEF,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB;IAkBhE,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAED,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,KAAK,IAAI,MAAM,GAAG,SAAS,CAE9B;IAED,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAIjC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IA2B5B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,OAAO,KAAK,GAAG,SAAS;IAsJjE,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,MAAM,IAAI,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAI1C,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC,iBAAiB,IAAI,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IAShE,qBAAqB,CACzB,iBAAiB,EAAE,sBAAsB,GACxC,OAAO,CAAC,IAAI,CAAC;IAOhB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAI/B,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrD,qBAAqB,CACnB,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAC9C,OAAO,CAAC,IAAI,CAAC;IAIhB;;;;OAIG;IACH,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI1C,2EAA2E;IAC3E,WAAW,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIrC;;;;OAIG;IACH,oBAAoB,IAAI,OAAO,CAAC;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,IAAI,CAAC;IAIT;;;;;OAKG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBrE;;;OAGG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAuDnE;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;IAyBnC;;OAEG;IACH,uBAAuB,IAAI,MAAM,GAAG,IAAI;IAMxC,YAAY,IAAI,MAAM;CAqCvB"}
+{"version":3,"file":"browser-provider.d.ts","sourceRoot":"","sources":["../../../src/auth/browser-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAKpF,OAAO,KAAK,EACV,sBAAsB,EACtB,mBAAmB,EACnB,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAkBlD,UAAU,mBAAmB;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,CACd,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,IAAI,KAC7B,IAAI,CAAC;CACX;AAED;;GAEG;AACH,qBAAa,0BAA2B,YAAW,mBAAmB;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IACnD,OAAO,CAAC,OAAO,CAAoB;IAGnC,OAAO,CAAC,eAAe,CAAC,CAAU;IAClC,OAAO,CAAC,eAAe,CAAC,CAAU;IAClC,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,kBAAkB,CAAU;IACpC,OAAO,CAAC,qBAAqB,CAAuB;IACpD,QAAQ,CAAC,aAAa,EAClB,CAAC,CACC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,IAAI,KAC7B,IAAI,CAAC,GACV,SAAS,CAAC;gBAEF,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB;IAkBhE,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAED,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,KAAK,IAAI,MAAM,GAAG,SAAS,CAE9B;IAED,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAIjC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IA2B5B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,OAAO,KAAK,GAAG,SAAS;IAsJjE,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,MAAM,IAAI,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAI1C,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC,iBAAiB,IAAI,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IAShE,qBAAqB,CACzB,iBAAiB,EAAE,sBAAsB,GACxC,OAAO,CAAC,IAAI,CAAC;IAOhB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAI/B,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrD,qBAAqB,CACnB,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAC9C,OAAO,CAAC,IAAI,CAAC;IAIhB;;;;;;;;OAQG;IACG,mBAAmB,CACvB,SAAS,EAAE,MAAM,GAAG,GAAG,EACvB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;IA0C3B;;;;OAIG;IACH,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI1C,2EAA2E;IAC3E,WAAW,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIrC;;;;OAIG;IACH,oBAAoB,IAAI,OAAO,CAAC;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,IAAI,CAAC;IAIT;;;;;OAKG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBrE;;;OAGG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAuDnE;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;IAyBnC;;OAEG;IACH,uBAAuB,IAAI,MAAM,GAAG,IAAI;IAMxC,YAAY,IAAI,MAAM;CAqCvB"}

package/dist/src/auth/index.cjs

@@ -30,6 +30,9 @@ __export(auth_exports, {
 });
 module.exports = __toCommonJS(auth_exports);
 
+// src/auth/browser-provider.ts
+var import_auth_utils = require("@modelcontextprotocol/sdk/shared/auth-utils.js");
+
 // src/utils/url-sanitize.ts
 function sanitizeUrl(raw) {
   const abort = /* @__PURE__ */ __name(() => {
@@ -647,6 +650,43 @@ var BrowserOAuthClientProvider = class {
   invalidateCredentials(scope) {
     return this.session.invalidateCredentials(scope);
   }
+  /**
+   * Validate the protected resource discovered through the OAuth proxy.
+   *
+   * The proxy rewrites protected-resource metadata to the MCP connection URL
+   * so transport-anchored discovery remains valid. Manual authentication is
+   * anchored on the upstream MCP URL instead, so accept that rewrite and
+   * return the original upstream resource that the authorization server
+   * protects.
+   */
+  async validateResourceURL(serverUrl, resource) {
+    if (!resource) return void 0;
+    const requestedResource = (0, import_auth_utils.resourceUrlFromServerUrl)(serverUrl);
+    if ((0, import_auth_utils.checkResourceAllowed)({
+      requestedResource,
+      configuredResource: resource
+    })) {
+      return new URL(resource);
+    }
+    const isConnectionResource = this.connectionUrl && (0, import_auth_utils.checkResourceAllowed)({
+      requestedResource: (0, import_auth_utils.resourceUrlFromServerUrl)(this.connectionUrl),
+      configuredResource: resource
+    });
+    if (isConnectionResource) {
+      const upstreamResource = (0, import_auth_utils.resourceUrlFromServerUrl)(
+        this._lastOriginalResource ?? this.serverUrl
+      );
+      if ((0, import_auth_utils.checkResourceAllowed)({
+        requestedResource,
+        configuredResource: upstreamResource
+      })) {
+        return upstreamResource;
+      }
+    }
+    throw new Error(
+      `Protected resource ${resource} does not match expected ${requestedResource} (or origin)`
+    );
+  }
   /**
    * Resolve this server's OAuth token endpoint (via discovery, cached). Lets
    * consumers persist the endpoint alongside the tokens for server-side

package/dist/src/auth/index.js

@@ -5,7 +5,7 @@ import {
   onMcpAuthorization,
   probeAuthParams,
   runAuthPopup
-} from "../../chunk-AON7VXVM.js";
+} from "../../chunk-35DRMA7E.js";
 import "../../chunk-QZVO7T36.js";
 import "../../chunk-3GQAWCBQ.js";
 export {

package/dist/src/browser-agent.cjs

@@ -1170,7 +1170,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = "1.34.4";
+    VERSION = "1.34.5";
     __name(getPackageVersion, "getPackageVersion");
   }
 });

package/dist/src/browser-agent.js

@@ -7,7 +7,7 @@ import {
   Telemetry,
   extractModelInfo,
   getPackageVersion
-} from "../chunk-2J5OVVW6.js";
+} from "../chunk-VSSL5DL7.js";
 import {
   logger
 } from "../chunk-QWQYAQCK.js";
@@ -1671,7 +1671,7 @@ var MCPAgent = class {
         logger.debug(
           `Creating MCPClient with ${Object.keys(this.mcpServersConfig).length} server(s)...`
         );
-        const { MCPClient } = await import("../client-A4Z5ZFV2.js");
+        const { MCPClient } = await import("../client-A5GK5WZD.js");
         this.client = new MCPClient({ mcpServers: this.mcpServersConfig });
         logger.debug("\u2705 MCPClient created successfully");
       }