nexrall-code 0.5.189 → 0.5.190

package/dist/index.js

@@ -68020,6 +68020,15 @@ function parseResourceMetadataUrl(wwwAuthenticate) {
   const m2 = /resource_metadata\s*=\s*"([^"]+)"/i.exec(wwwAuthenticate || "");
   return m2 ? m2[1] : null;
 }
+function protectedResourceCandidates(serverUrl) {
+  const u = new URL(serverUrl);
+  const base = u.origin;
+  const p = u.pathname.replace(/\/$/, "");
+  return [
+    ...p ? [`${base}/.well-known/oauth-protected-resource${p}`] : [],
+    `${base}/.well-known/oauth-protected-resource`
+  ];
+}
 function authServerCandidates(authServer) {
   const u = new URL(authServer);
   const base = u.origin;
@@ -68076,8 +68085,15 @@ async function discover(serverUrl, wwwAuthenticate, f3 = defaultFetch()) {
   let authServer = null;
   let resource = serverUrl;
   let scope;
-  const prmUrl = parseResourceMetadataUrl(wwwAuthenticate) ?? `${origin}/.well-known/oauth-protected-resource`;
-  const prm = await fetchJsonSafe(f3, prmUrl);
+  const prmCandidates = [parseResourceMetadataUrl(wwwAuthenticate), ...protectedResourceCandidates(serverUrl)].filter(
+    (u) => Boolean(u)
+  );
+  let prm = null;
+  for (const url2 of new Set(prmCandidates)) {
+    prm = await fetchJsonSafe(f3, url2);
+    if (prm)
+      break;
+  }
   if (prm) {
     const servers = prm.authorization_servers;
     if (Array.isArray(servers) && servers.length)
@@ -68110,7 +68126,7 @@ async function discover(serverUrl, wwwAuthenticate, f3 = defaultFetch()) {
 async function registerClient(meta, redirectUri, f3) {
   if (!meta.registration_endpoint) {
     throw new Error(
-      "Authorization server does not support dynamic client registration; a client_id must be configured manually."
+      'Authorization server does not support dynamic client registration; a client_id must be configured manually \u2014 create an OAuth client for this server, then re-run `nex mcp login <server> --client-id <id> [--client-secret <secret>]` (or set "clientId" / "clientSecret" in its mcp.json entry).'
     );
   }
   const resp = await f3(meta.registration_endpoint, {
@@ -68268,25 +68284,32 @@ function openInBrowser(url2) {
   }
 }
 async function probeAuthChallenge(serverUrl, f3 = defaultFetch()) {
-  try {
-    const resp = await f3(serverUrl, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream" },
-      body: JSON.stringify({
-        jsonrpc: "2.0",
-        id: 1,
-        method: "initialize",
-        params: {
-          protocolVersion: import_code_core5.MCP_PROTOCOL_VERSION,
-          capabilities: {},
-          clientInfo: { name: "nexrall-code", version: "1.0" }
-        }
-      })
-    });
-    return resp.headers?.get("www-authenticate") ?? "";
-  } catch {
-    return "";
+  const steps = [
+    {
+      method: "initialize",
+      params: {
+        protocolVersion: import_code_core5.MCP_PROTOCOL_VERSION,
+        capabilities: {},
+        clientInfo: { name: "nexrall-code", version: "1.0" }
+      }
+    },
+    { method: "tools/list", params: {} }
+  ];
+  for (const { method, params } of steps) {
+    try {
+      const resp = await f3(serverUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream" },
+        body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params })
+      });
+      const challenge = resp.headers?.get("www-authenticate") ?? "";
+      if (challenge)
+        return challenge;
+    } catch {
+      return "";
+    }
   }
+  return "";
 }
 async function authorizeServer(o) {
   const f3 = o.fetchImpl ?? defaultFetch();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexrall-code",
-  "version": "0.5.189",
+  "version": "0.5.190",
   "description": "Nexrall Code — AI coding assistant for your terminal (headless agent for scripts, CI and automation)",
   "keywords": [
     "ai",