pi-mcp-client 0.9.0 → 0.10.0

package/dist/index.js

@@ -6,7 +6,7 @@ import {
   getAgentDir
 } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
-import { Text as Text4 } from "@earendil-works/pi-tui";
+import { Text as Text5 } from "@earendil-works/pi-tui";
 
 // src/prompt-command.ts
 import { BorderedLoader } from "@earendil-works/pi-coding-agent";
@@ -1770,9 +1770,9 @@ var defaultOptions = {
   fields: void 0,
   searchOptions: void 0,
   storeFields: [],
-  logger: (level, message2) => {
+  logger: (level, message3) => {
     if (typeof (console === null || console === void 0 ? void 0 : console[level]) === "function")
-      console[level](message2);
+      console[level](message3);
   },
   autoVacuum: true
 };
@@ -1845,6 +1845,7 @@ import {
   OAuthError,
   RegistrationRejectedError,
   InsecureTokenEndpointError,
+  InsufficientScopeError,
   ProtocolError,
   ProtocolErrorCode,
   ResourceNotFoundError,
@@ -1887,10 +1888,12 @@ var messages = {
   oauth_client_rejected: "The authorization server rejected the OAuth client or its authentication method.",
   oauth_pkce_unsupported: "The authorization server does not support the required S256 PKCE method.",
   oauth_scope_rejected: "The authorization server rejected the requested OAuth scopes.",
+  oauth_scope_required: "The server requires additional OAuth permissions.",
   oauth_grant_rejected: "The OAuth authorization code or refresh token was rejected.",
   oauth_redirect_rejected: "The authorization server rejected the OAuth callback URL.",
   oauth_endpoint_insecure: "The OAuth token endpoint is not secure.",
   oauth_issuer_changed: "The OAuth authorization server changed.",
+  oauth_dpop_unavailable: "The OAuth DPoP signing key is unavailable or DPoP is disabled.",
   callback_unavailable: "The local OAuth callback port is unavailable.",
   busy: "Discovery is still running.",
   operation_failed: "The operation failed."
@@ -1932,11 +1935,13 @@ function diagnostic(code, context) {
     oauth_registration_rejected: `Check whether the service allows public/native client registration and the callback URL shown by /mcp get ${target}. If registration is restricted, configure an approved public client with oauthClientId, run /mcp reload, then retry /mcp login ${target}.`,
     oauth_client_rejected: `Verify oauthClientId, the app's approval, and support for public-client authentication (token endpoint method none). Clients requiring a client secret are not supported. After configuration changes, run /mcp reload and /mcp login ${target}.`,
     oauth_pkce_unsupported: "Use an authorization server or app configuration that supports authorization-code login with S256 PKCE. This client cannot fall back to login without PKCE.",
+    oauth_scope_required: `Run /mcp login ${target} to review the server's requested scopes. If no review appears, check oauthScopes against the service's requirements. No authorization or replay was attempted; retry only after approval.`,
     oauth_scope_rejected: `Check oauthScopes against the service's allowed scopes and app permissions. Run /mcp reload after changes, then /mcp login ${target}.`,
     oauth_grant_rejected: `Run /mcp login ${target} for a fresh authorization code. If it fails again, verify the registered client and exact callback URL shown by /mcp get ${target}.`,
     oauth_redirect_rejected: `Register the exact callback URL shown by /mcp get ${target}, including its host, port, and /callback path. --no-browser uses the same callback URL and does not bypass redirect validation.`,
     oauth_endpoint_insecure: "Use an authorization server with an HTTPS token endpoint. HTTP is only allowed for loopback endpoints; do not disable TLS verification.",
     oauth_issuer_changed: `Verify the server configuration before running /mcp logout ${target} and /mcp login ${target} to trust the new authorization server.`,
+    oauth_dpop_unavailable: `Enable oauthDpop and run /mcp reload, then /mcp login ${target}. If you intentionally disabled DPoP, or the stored key is corrupt or mismatched, run /mcp logout ${target} before signing in again. Bound access or refresh tokens cannot be used without their signing key.`,
     callback_unavailable: `Free the configured callback port, change oauthCallbackPort, or run /mcp login ${target} --no-browser.`,
     busy: "Wait for the current MCP operation to finish, then retry.",
     operation_failed: "Check /mcp for server status and verify the server configuration."
@@ -1988,6 +1993,8 @@ function diagnose(error, context) {
   for (let depth = 0; depth < 4 && current instanceof Error; depth++) {
     if (current instanceof DiagnosticError)
       return diagnostic(current.diagnostic.code, context);
+    if (current instanceof InsufficientScopeError)
+      return diagnostic("oauth_scope_required", context);
     if (current instanceof UnauthorizedError)
       return diagnostic("authentication_required", context);
     if (current instanceof SdkHttpError) {
@@ -2198,6 +2205,7 @@ var OPTION_FIELDS = [
   "oauthClientId",
   "oauthScopes",
   "oauthCallbackPort",
+  "oauthDpop",
   "disabled",
   "includeTools",
   "excludeTools",
@@ -2219,6 +2227,7 @@ function validateOptions(entry, fail) {
     fail("oauthScopes (requires OAuth and 1\u2013100 unique OAuth scope tokens)");
   if (entry.oauthCallbackPort !== void 0 && (!Number.isInteger(entry.oauthCallbackPort) || Number(entry.oauthCallbackPort) < 1 || Number(entry.oauthCallbackPort) > 65535))
     fail("oauthCallbackPort (requires OAuth and a port from 1\u201365535)");
+  if (entry.oauthDpop !== void 0 && typeof entry.oauthDpop !== "boolean") fail("oauthDpop (requires a boolean)");
   if (entry.disabled !== void 0 && typeof entry.disabled !== "boolean") fail("disabled");
   for (const field of ["timeoutMs", "startupTimeoutMs", "toolTimeoutMs"]) {
     if (entry[field] !== void 0 && (!Number.isInteger(entry[field]) || Number(entry[field]) < 100 || Number(entry[field]) > 6e5))
@@ -2273,7 +2282,7 @@ function parseConnections(value, source) {
       fail("transport (provide exactly one of command or url)");
     if (entry.type === "stdio" && !entry.command || entry.type === "http" && !entry.url)
       fail("type (must match command or url)");
-    if (entry.command && (entry.headers || entry.oauthClientId !== void 0 || entry.oauthScopes !== void 0 || entry.oauthCallbackPort !== void 0))
+    if (entry.command && (entry.headers || entry.oauthClientId !== void 0 || entry.oauthScopes !== void 0 || entry.oauthCallbackPort !== void 0 || entry.oauthDpop !== void 0))
       fail("HTTP options on stdio transport");
     if (entry.url && (entry.args || entry.cwd || entry.env))
       fail("stdio options on HTTP transport");
@@ -2444,7 +2453,7 @@ function resolveServer(config, cwd) {
       throw new Error("MCP URLs must use HTTP(S), without credentials or fragments.");
     result.url = url.href;
   }
-  if ((result.oauthClientId !== void 0 || result.oauthScopes !== void 0 || result.oauthCallbackPort !== void 0) && Object.keys(result.headers ?? {}).some(
+  if ((result.oauthClientId !== void 0 || result.oauthScopes !== void 0 || result.oauthCallbackPort !== void 0 || result.oauthDpop !== void 0) && Object.keys(result.headers ?? {}).some(
     (key) => key.toLowerCase() === "authorization"
   ))
     throw new Error("Use OAuth or an Authorization header, not both.");
@@ -2581,7 +2590,7 @@ function searchTools(tools, query, server, limit = DEFAULT_SEARCH_LIMIT) {
 }
 
 // src/config-commands.ts
-var ADD_USAGE = "Usage: /mcp add --scope global|project [--replace] [--transport http|stdio] [--header 'Name: value'] [--env KEY=value] [--oauth-client-id ID] [--oauth-scope SCOPE] [--oauth-callback-port PORT] <server> <url> OR <server> -- <command> [args...]. Put options before the server name.";
+var ADD_USAGE = "Usage: /mcp add --scope global|project [--replace] [--transport http|stdio] [--header 'Name: value'] [--env KEY=value] [--oauth-client-id ID] [--oauth-scope SCOPE] [--oauth-callback-port PORT] [--oauth-dpop] <server> <url> OR <server> -- <command> [args...]. Put options before the server name.";
 var REMOVE_USAGE = "Usage: /mcp remove --scope global|project <server>. Credentials are retained; log out first if you want to remove them.";
 function commandWords(input) {
   const words = [];
@@ -2642,6 +2651,10 @@ function parseConfigCommand(input) {
       replace = true;
       continue;
     }
+    if (flag === "--oauth-dpop" && action === "add") {
+      definition.oauthDpop = true;
+      continue;
+    }
     if (flag === "--oauth")
       throw new ConfigMutationError("Remove --oauth; HTTP authentication is automatic.");
     const value = words[index++];
@@ -2680,7 +2693,7 @@ function parseConfigCommand(input) {
     if (transport === "http") fail();
     definition.command = words[++index];
     definition.args = words.slice(index + 1);
-    if (!definition.command || definition.oauthClientId || definition.oauthScopes || definition.oauthCallbackPort || definition.headers) fail();
+    if (!definition.command || definition.oauthClientId || definition.oauthScopes || definition.oauthCallbackPort || definition.oauthDpop || definition.headers) fail();
   } else {
     if (transport === "stdio" || index + 1 !== words.length || definition.env) fail();
     definition.url = words[index];
@@ -2702,7 +2715,7 @@ function configCommandCompletions(input, servers) {
   const args = /^--scope\s+(global|project)\s+([^\s]*)$/u.exec(rest);
   if (!args) return [];
   const [, scope, partial] = args;
-  const values = action === "import" ? [] : action === "remove" ? servers.sort() : ["--replace", "--transport", "--header", "--env", "--oauth-client-id", "--oauth-scope", "--oauth-callback-port"];
+  const values = action === "import" ? [] : action === "remove" ? servers.sort() : ["--replace", "--transport", "--header", "--env", "--oauth-client-id", "--oauth-scope", "--oauth-callback-port", "--oauth-dpop"];
   return values.filter((value) => value.startsWith(partial)).map((value) => ({
     value: `${action} --scope ${scope} ${value}`,
     label: value
@@ -2714,13 +2727,13 @@ function identifier(value) {
   return typeof value === "string" && !!value && value.length <= 512 && line(value) === value;
 }
 function preparePrompt(server, identity, value) {
-  const invalid3 = () => failure("protocol_error", { server, operation: "search" });
-  if (!object(value) || !identifier(value.name) || value.description !== void 0 && typeof value.description !== "string" || value.title !== void 0 && typeof value.title !== "string" || value.arguments !== void 0 && !Array.isArray(value.arguments)) throw invalid3();
+  const invalid4 = () => failure("protocol_error", { server, operation: "search" });
+  if (!object(value) || !identifier(value.name) || value.description !== void 0 && typeof value.description !== "string" || value.title !== void 0 && typeof value.title !== "string" || value.arguments !== void 0 && !Array.isArray(value.arguments)) throw invalid4();
   const args = value.arguments ?? [];
-  if (args.length > 100) throw invalid3();
+  if (args.length > 100) throw invalid4();
   const seen = /* @__PURE__ */ new Set();
   const arguments_ = args.map((argument) => {
-    if (!object(argument) || !identifier(argument.name) || seen.has(argument.name) || argument.description !== void 0 && typeof argument.description !== "string" || argument.required !== void 0 && typeof argument.required !== "boolean") throw invalid3();
+    if (!object(argument) || !identifier(argument.name) || seen.has(argument.name) || argument.description !== void 0 && typeof argument.description !== "string" || argument.required !== void 0 && typeof argument.required !== "boolean") throw invalid4();
     seen.add(argument.name);
     return { name: argument.name, description: plain(argument.description ?? "").slice(0, 8e3), required: argument.required === true };
   });
@@ -2742,14 +2755,14 @@ function promptCommand(prompt) {
 }
 var promptText = (value) => plain(value).replace(/\r\n?/g, "\n");
 function preparePromptSnapshot(result, server) {
-  const invalid3 = () => failure("protocol_error", { server, operation: "prompt" });
-  if (!object(result) || !Array.isArray(result.messages) || !result.messages.length) throw invalid3();
+  const invalid4 = () => failure("protocol_error", { server, operation: "prompt" });
+  if (!object(result) || !Array.isArray(result.messages) || !result.messages.length) throw invalid4();
   if (Buffer.byteLength(JSON.stringify(result)) > 50 * 1024) throw failure("prompt_too_large", { server, operation: "prompt" });
   let usable = true;
   const previews = [];
-  const messages2 = result.messages.map((message2, index) => {
-    if (!["user", "assistant"].includes(message2.role) || !object(message2.content)) throw invalid3();
-    const content = message2.content;
+  const messages2 = result.messages.map((message3, index) => {
+    if (!["user", "assistant"].includes(message3.role) || !object(message3.content)) throw invalid4();
+    const content = message3.content;
     let block;
     let preview2;
     if (content.type === "text" && typeof content.text === "string") {
@@ -2769,9 +2782,9 @@ ${promptText(content.resource.text)}`;
       block = { type: line(String(content.type)), unsupported: true, bytes: Buffer.byteLength(JSON.stringify(content)) };
       preview2 = `Unsupported ${line(String(content.type))} content \xB7 ${Buffer.byteLength(JSON.stringify(content))} bytes`;
     }
-    previews.push(`Message ${index + 1} \xB7 ${message2.role} (server supplied)
+    previews.push(`Message ${index + 1} \xB7 ${message3.role} (server supplied)
 ${preview2}`);
-    return { role: message2.role, content: block };
+    return { role: message3.role, content: block };
   });
   const description = typeof result.description === "string" ? promptText(result.description) : void 0;
   const body = JSON.stringify({ server, ...description === void 0 ? {} : { description }, messages: messages2 }, null, 2);
@@ -3192,10 +3205,10 @@ var TomlError = class extends Error {
   line;
   column;
   codeblock;
-  constructor(message2, options) {
+  constructor(message3, options) {
     const [line2, column] = getLineColFromPtr(options.toml, options.ptr);
     const codeblock = makeCodeBlock(options.toml, line2, column);
-    super(`Invalid TOML document: ${message2}
+    super(`Invalid TOML document: ${message3}
 
 ${codeblock}`, options);
     this.line = line2;
@@ -3591,8 +3604,8 @@ function parseArray(ctx, integersAsBigInt) {
 }
 
 // node_modules/smol-toml/dist/parse.js
-function peekTable(key, table, meta, type) {
-  let t = table;
+function peekTable(key, table2, meta, type) {
+  let t = table2;
   let m = meta;
   let k;
   let hasOwn = false;
@@ -4128,7 +4141,7 @@ import {
 // src/oauth-page.ts
 function oauthCallbackHtml(status) {
   const heading = status === "received" ? "Authorization response received" : status === "denied" ? "Authorization not granted" : "Invalid OAuth callback";
-  const message2 = status === "received" ? "Return to Pi to finish signing in. You can close this tab." : "Return to Pi and try signing in again. You can close this tab.";
+  const message3 = status === "received" ? "Return to Pi to finish signing in. You can close this tab." : "Return to Pi and try signing in again. You can close this tab.";
   return `<!doctype html>
 <html lang="en">
 <head>
@@ -4191,28 +4204,509 @@ function oauthCallbackHtml(status) {
     <div class="logo"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 800 800" aria-hidden="true"><path fill="#fff" fill-rule="evenodd" d="M165.29 165.29 H517.36 V400 H400 V517.36 H282.65 V634.72 H165.29 Z M282.65 282.65 V400 H400 V282.65 Z"/><path fill="#fff" d="M517.36 400 H634.72 V634.72 H517.36 Z"/></svg></div>
     <p class="brand">Pi MCP Client</p>
     <h1>${heading}</h1>
-    <p>${message2}</p>
+    <p>${message3}</p>
   </main>
 </body>
 </html>`;
 }
 
+// src/oauth-fetch.ts
+import { OAuthErrorCode } from "@modelcontextprotocol/client";
+var codes = new Set(Object.values(OAuthErrorCode));
+async function privateOAuthFetch(input, init) {
+  const tokenRequest = init?.body instanceof URLSearchParams && init.body.has("grant_type");
+  if (!tokenRequest) return fetch(input, init);
+  try {
+    const response = await fetch(input, init);
+    const reader = response.body?.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+      while (reader) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        size += value.byteLength;
+        if (size > 65536) throw new Error("Token response too large");
+        chunks.push(value);
+      }
+    } finally {
+      await reader?.cancel();
+    }
+    const text = new TextDecoder().decode(Buffer.concat(chunks));
+    let body;
+    try {
+      body = JSON.parse(text);
+    } catch {
+      body = void 0;
+    }
+    if (!response.ok || body && typeof body === "object" && "error" in body) {
+      const code = body && typeof body === "object" && "error" in body ? body.error : void 0;
+      const payload = response.ok && body && typeof body === "object" ? { ...body } : {};
+      return Response.json({
+        ...payload,
+        error: typeof code === "string" && codes.has(code) ? code : "server_error",
+        error_description: void 0,
+        error_uri: void 0
+      }, {
+        status: response.status,
+        headers: response.headers
+      });
+    }
+    if (!body || typeof body !== "object") throw new Error("Invalid token response");
+    return new Response(text, { status: response.status, headers: response.headers });
+  } catch {
+    throw failure("oauth_failed", { operation: "auth" });
+  }
+}
+
+// src/dpop.ts
+import { DpopSession, generateDpopKeyPair } from "@modelcontextprotocol/client";
+
+// node_modules/jose/dist/webapi/lib/buffer_utils.js
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+var strictDecoder = new TextDecoder("utf-8", { fatal: true });
+var MAX_INT32 = 2 ** 32;
+var NON_ASCII = /[^\x00-\x7f]/;
+function encode(string) {
+  if (typeof string == "string" && string.length >= 128) {
+    if (NON_ASCII.test(string))
+      throw new TypeError("non-ASCII string encountered in encode()");
+    return encoder.encode(string);
+  }
+  const bytes = new Uint8Array(string.length);
+  for (let i = 0; i < string.length; i++) {
+    const code = string.charCodeAt(i);
+    if (code > 127)
+      throw new TypeError("non-ASCII string encountered in encode()");
+    bytes[i] = code;
+  }
+  return bytes;
+}
+function encodeBase64(input, url = false) {
+  if (Uint8Array.prototype.toBase64)
+    return input.toBase64({ alphabet: url ? "base64url" : "base64", omitPadding: url });
+  const CHUNK_SIZE = 32768, arr = [];
+  for (let i = 0; i < input.length; i += CHUNK_SIZE)
+    arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+  const encoded = btoa(arr.join(""));
+  return url ? encoded.replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_") : encoded;
+}
+function decodeBase64(encoded, url = false) {
+  if (Uint8Array.fromBase64)
+    return Uint8Array.fromBase64(encoded, { alphabet: url ? "base64url" : "base64" });
+  if (url) {
+    if (encoded.includes("+") || encoded.includes("/"))
+      throw new TypeError("Invalid base64url");
+    encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
+  }
+  const binary = atob(encoded), bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++)
+    bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+async function digest(algorithm, data) {
+  const subtleDigest = `SHA-${algorithm.slice(-3)}`;
+  return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));
+}
+
+// node_modules/jose/dist/webapi/util/errors.js
+var JOSEError = class extends Error {
+  static code = "ERR_JOSE_GENERIC";
+  code = "ERR_JOSE_GENERIC";
+  constructor(message3, options) {
+    super(message3, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);
+  }
+};
+var JOSENotSupported = class extends JOSEError {
+  static code = "ERR_JOSE_NOT_SUPPORTED";
+  code = "ERR_JOSE_NOT_SUPPORTED";
+};
+var JWKInvalid = class extends JOSEError {
+  static code = "ERR_JWK_INVALID";
+  code = "ERR_JWK_INVALID";
+};
+
+// node_modules/jose/dist/webapi/util/base64url.js
+var invalid2 = "The input to be decoded is not correctly encoded.";
+function decode(input) {
+  try {
+    return decodeBase64(typeof input == "string" ? input : decoder.decode(input), true);
+  } catch (cause) {
+    throw new TypeError(invalid2, { cause });
+  }
+}
+function encode2(input) {
+  return encodeBase64(typeof input == "string" ? encoder.encode(input) : input, true);
+}
+
+// node_modules/jose/dist/webapi/lib/validate.js
+function isObject(input) {
+  if (typeof input != "object" || input === null || Object.prototype.toString.call(input) !== "[object Object]")
+    return false;
+  const prototype = Object.getPrototypeOf(input);
+  return prototype === null || Object.getPrototypeOf(prototype) === null;
+}
+
+// node_modules/jose/dist/webapi/lib/key.js
+var isCryptoKey = (key) => {
+  if (key?.[Symbol.toStringTag] === "CryptoKey")
+    return true;
+  try {
+    return key instanceof CryptoKey;
+  } catch {
+    return false;
+  }
+};
+var isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
+var isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
+function message(msg, actual, ...types) {
+  if (types.length > 2) {
+    const last2 = types.pop();
+    msg += `one of type ${types.join(", ")}, or ${last2}.`;
+  } else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;
+  return actual == null ? msg += ` Received ${actual}` : typeof actual == "function" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == "object" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;
+}
+var invalidKeyInput = (actual, ...types) => message("Key must be ", actual, ...types);
+function snapshotJwk(jwk) {
+  return { __proto__: null, ...jwk };
+}
+function normalizeJwk(jwk) {
+  const normalized = snapshotJwk(jwk);
+  if (normalized.ext !== void 0 && typeof normalized.ext != "boolean")
+    throw new TypeError('"ext" (Extractable) Parameter must be a boolean');
+  if (normalized.key_ops !== void 0) {
+    const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;
+    if (!keyOps || keyOps.some((operation) => typeof operation != "string") || new Set(keyOps).size !== keyOps.length)
+      throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');
+    normalized.key_ops = keyOps;
+  }
+  return normalized;
+}
+function validateExtractableOption(extractable) {
+  if (extractable !== void 0 && typeof extractable != "boolean")
+    throw new TypeError('"extractable" option must be a boolean');
+  return extractable;
+}
+async function jwkToKey(entry, jwk, extractable) {
+  if (!entry.kty.includes(jwk.kty))
+    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+  const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = { ...jwk, ext: extractable ?? jwk.ext };
+  return keyData.kty !== "AKP" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey("jwk", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
+}
+
+// node_modules/jose/dist/webapi/lib/key_descriptor.js
+function table(entries) {
+  const out = { __proto__: null };
+  for (const alg in entries)
+    out[alg] = { ...entries[alg], alg };
+  return out;
+}
+
+// node_modules/jose/dist/webapi/lib/jwe_algorithms.js
+var wrap = [
+  ["encrypt", "wrapKey"],
+  ["decrypt", "unwrapKey"]
+];
+var derive = [[], ["deriveBits"]];
+var none = [[], []];
+function rsaes(bits) {
+  return {
+    kty: ["RSA"],
+    mode: "key-encryption",
+    subtle: { name: "RSA-OAEP", hash: `SHA-${bits}` },
+    usages: wrap,
+    ops: ["wrapKey", "unwrapKey"]
+  };
+}
+function ecdh(mode) {
+  return {
+    kty: ["EC", "OKP"],
+    mode,
+    subtle: { name: "ECDH" },
+    resolve: ({ kty, crv, asymmetricKeyType }) => {
+      if (crv === "X25519" || asymmetricKeyType === "x25519")
+        return { name: "X25519" };
+      if (kty === "OKP")
+        throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+      return { name: "ECDH", namedCurve: crv };
+    },
+    usages: derive,
+    ops: [void 0, "deriveBits"]
+  };
+}
+function aeskw(bits, gcm = false) {
+  return {
+    kty: ["oct"],
+    mode: "key-wrapping",
+    secret: true,
+    subtle: { name: gcm ? "AES-GCM" : "AES-KW", length: bits },
+    usages: none,
+    ops: gcm ? ["encrypt", "decrypt"] : ["wrapKey", "unwrapKey"]
+  };
+}
+function pbes2() {
+  return {
+    kty: ["oct"],
+    mode: "key-wrapping",
+    secret: true,
+    subtle: { name: "PBKDF2" },
+    usages: none,
+    ops: ["deriveBits", "deriveBits"]
+  };
+}
+var JWE = table({
+  dir: {
+    kty: ["oct"],
+    mode: "direct-encryption",
+    secret: true,
+    subtle: { name: "AES-GCM" },
+    usages: none,
+    ops: ["encrypt", "decrypt"]
+  },
+  "RSA-OAEP": rsaes(1),
+  "RSA-OAEP-256": rsaes(256),
+  "RSA-OAEP-384": rsaes(384),
+  "RSA-OAEP-512": rsaes(512),
+  "ECDH-ES": ecdh("direct-key-agreement"),
+  "ECDH-ES+A128KW": ecdh("key-agreement-with-key-wrapping"),
+  "ECDH-ES+A192KW": ecdh("key-agreement-with-key-wrapping"),
+  "ECDH-ES+A256KW": ecdh("key-agreement-with-key-wrapping"),
+  A128KW: aeskw(128),
+  A192KW: aeskw(192),
+  A256KW: aeskw(256),
+  A128GCMKW: aeskw(128, true),
+  A192GCMKW: aeskw(192, true),
+  A256GCMKW: aeskw(256, true),
+  "PBES2-HS256+A128KW": pbes2(),
+  "PBES2-HS384+A192KW": pbes2(),
+  "PBES2-HS512+A256KW": pbes2()
+});
+var contentOps = ["encrypt", "decrypt"];
+function contentEncryption(bits, cbc = false) {
+  return {
+    kty: ["oct"],
+    secret: true,
+    subtle: { name: cbc ? "AES-CBC" : "AES-GCM", length: bits },
+    usages: none,
+    ops: contentOps,
+    cekBits: bits,
+    ivBits: cbc ? 128 : 96,
+    cbc
+  };
+}
+var ENC = table({
+  A128GCM: contentEncryption(128),
+  A192GCM: contentEncryption(192),
+  A256GCM: contentEncryption(256),
+  "A128CBC-HS256": contentEncryption(256, true),
+  "A192CBC-HS384": contentEncryption(384, true),
+  "A256CBC-HS512": contentEncryption(512, true)
+});
+
+// node_modules/jose/dist/webapi/lib/jws_algorithms.js
+var sig = [["verify"], ["sign"]];
+function hmac(bits) {
+  const subtle = { name: "HMAC", hash: `SHA-${bits}` };
+  return { kty: ["oct"], secret: true, subtle, signing: subtle, usages: sig };
+}
+function rsa(bits, saltLength) {
+  const subtle = { name: saltLength ? "RSA-PSS" : "RSASSA-PKCS1-v1_5", hash: `SHA-${bits}` };
+  return {
+    kty: ["RSA"],
+    subtle,
+    signing: saltLength ? { ...subtle, saltLength } : subtle,
+    usages: sig,
+    minRsaBits: 2048
+  };
+}
+function ecdsa(crv, bits) {
+  return {
+    kty: ["EC"],
+    crv,
+    subtle: { name: "ECDSA", namedCurve: crv },
+    signing: { name: "ECDSA", hash: `SHA-${bits}` },
+    usages: sig
+  };
+}
+function eddsa() {
+  const subtle = { name: "Ed25519" };
+  return {
+    kty: ["OKP"],
+    crv: "Ed25519",
+    subtle,
+    signing: subtle,
+    usages: sig
+  };
+}
+function mldsa(bits) {
+  const subtle = { name: `ML-DSA-${bits}` };
+  return {
+    kty: ["AKP"],
+    subtle,
+    signing: subtle,
+    usages: sig
+  };
+}
+var JWS = table({
+  HS256: hmac(256),
+  HS384: hmac(384),
+  HS512: hmac(512),
+  RS256: rsa(256),
+  RS384: rsa(384),
+  RS512: rsa(512),
+  PS256: rsa(256, 32),
+  PS384: rsa(384, 48),
+  PS512: rsa(512, 64),
+  ES256: ecdsa("P-256", 256),
+  ES384: ecdsa("P-384", 384),
+  ES512: ecdsa("P-521", 512),
+  EdDSA: eddsa(),
+  Ed25519: eddsa(),
+  "ML-DSA-44": mldsa(44),
+  "ML-DSA-65": mldsa(65),
+  "ML-DSA-87": mldsa(87)
+});
+
+// node_modules/jose/dist/webapi/lib/key_algorithm.js
+function unsupportedAlg(source = 'JWK "alg" (Algorithm) Parameter') {
+  throw new JOSENotSupported(`Invalid or unsupported ${source} value`);
+}
+function keyAlgorithm(alg, source) {
+  return (typeof alg == "string" ? JWS[alg] ?? JWE[alg] : void 0) ?? unsupportedAlg(source);
+}
+
+// node_modules/jose/dist/webapi/key/export.js
+async function exportJWK(key) {
+  if (isKeyObject(key))
+    if (key.type === "secret")
+      key = key.export();
+    else
+      return key.export({ format: "jwk" });
+  if (key instanceof Uint8Array)
+    return {
+      kty: "oct",
+      k: encode2(key)
+    };
+  if (!isCryptoKey(key))
+    throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "Uint8Array"));
+  if (!key.extractable)
+    throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");
+  const jwk = await crypto.subtle.exportKey("jwk", key);
+  delete jwk.ext, delete jwk.key_ops, delete jwk.use, jwk.kty !== "AKP" && delete jwk.alg;
+  for (const parameter of Object.keys(jwk))
+    jwk[parameter] === void 0 && delete jwk[parameter];
+  return jwk;
+}
+
+// node_modules/jose/dist/webapi/jwk/thumbprint.js
+var check = (value, description) => {
+  if (typeof value != "string" || !value)
+    throw new JWKInvalid(`${description} missing or invalid`);
+};
+async function calculateJwkThumbprint(key, digestAlgorithm) {
+  let jwk;
+  if (isObject(key)) {
+    if (jwk = snapshotJwk(key), typeof jwk.kty != "string")
+      throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
+  } else if (isKeyLike(key))
+    jwk = snapshotJwk(await exportJWK(key));
+  else
+    throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
+  if (digestAlgorithm ??= "sha256", digestAlgorithm !== "sha256" && digestAlgorithm !== "sha384" && digestAlgorithm !== "sha512")
+    throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');
+  let components;
+  switch (jwk.kty) {
+    case "AKP":
+      check(jwk.alg, '"alg" (Algorithm) Parameter'), check(jwk.pub, '"pub" (Public key) Parameter'), components = { alg: jwk.alg, kty: jwk.kty, pub: jwk.pub };
+      break;
+    case "EC":
+      check(jwk.crv, '"crv" (Curve) Parameter'), check(jwk.x, '"x" (X Coordinate) Parameter'), check(jwk.y, '"y" (Y Coordinate) Parameter'), components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y };
+      break;
+    case "OKP":
+      check(jwk.crv, '"crv" (Subtype of Key Pair) Parameter'), check(jwk.x, '"x" (Public Key) Parameter'), components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x };
+      break;
+    case "RSA":
+      check(jwk.e, '"e" (Exponent) Parameter'), check(jwk.n, '"n" (Modulus) Parameter'), components = { e: jwk.e, kty: jwk.kty, n: jwk.n };
+      break;
+    case "oct":
+      if (typeof jwk.k != "string")
+        throw new JWKInvalid('"k" (Key Value) Parameter missing or invalid');
+      components = { k: jwk.k, kty: jwk.kty };
+      break;
+    default:
+      throw new JOSENotSupported('"kty" (Key Type) Parameter missing or unsupported');
+  }
+  const data = encode(JSON.stringify(components));
+  return encode2(await digest(digestAlgorithm, data));
+}
+
+// node_modules/jose/dist/webapi/key/import.js
+async function importJWK(jwk, alg, options) {
+  if (!isObject(jwk))
+    throw new TypeError("JWK must be an object");
+  const normalized = normalizeJwk(jwk), extractable = validateExtractableOption(options?.extractable), { alg: jwkAlg } = normalized;
+  if (alg ??= jwkAlg, normalized.kty !== "oct" && !alg)
+    throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+  switch (normalized.kty) {
+    case "oct":
+      if (typeof normalized.k != "string")
+        throw new TypeError('missing "k" (Key Value) Parameter value');
+      return decode(normalized.k);
+    case "AKP": {
+      if (typeof jwkAlg != "string" || !jwkAlg)
+        throw new TypeError('missing "alg" (Algorithm) Parameter value');
+      if (alg !== jwkAlg)
+        throw new TypeError("JWK alg and alg option value mismatch");
+      return jwkToKey(keyAlgorithm(alg), normalized, extractable);
+    }
+    case "RSA":
+    case "EC":
+    case "OKP":
+      return jwkToKey(keyAlgorithm(alg), normalized, extractable);
+    default:
+      throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
+  }
+}
+
+// src/dpop.ts
+async function createDpopKey(issuer, clientId) {
+  const pair = await generateDpopKeyPair({ alg: "ES256", extractable: true });
+  return { issuer, clientId, privateJwk: await exportJWK(pair.privateKey) };
+}
+async function restoreDpopSession(stored) {
+  const jwk = stored.privateJwk;
+  if (!jwk || jwk.kty !== "EC" || jwk.crv !== "P-256" || ![jwk.x, jwk.y, jwk.d].every((value) => typeof value === "string" && /^[A-Za-z0-9_-]{43}$/u.test(value)))
+    throw new Error("Invalid DPoP key");
+  const publicJwk = { kty: "EC", crv: "P-256", x: jwk.x, y: jwk.y };
+  const privateKey = await importJWK({ ...publicJwk, d: jwk.d }, "ES256", { extractable: false });
+  const publicKey = await importJWK(publicJwk, "ES256");
+  if (privateKey instanceof Uint8Array || publicKey instanceof Uint8Array) throw new Error("Invalid DPoP key");
+  return DpopSession.create({ keyPair: {
+    privateKey,
+    publicKey,
+    publicJwk,
+    thumbprint: await calculateJwkThumbprint(publicJwk),
+    alg: "ES256"
+  } });
+}
+
 // src/auth.ts
 function callbackUrl(options = {}) {
   return `http://127.0.0.1:${options.oauthCallbackPort ?? 19847}/callback`;
 }
 function parseCallback(value, redirect, state) {
-  const invalid3 = () => failure("oauth_failed", { operation: "auth" });
-  if (value.length > 16384 || /[\u0000-\u0020\u007f]/u.test(value)) throw invalid3();
+  const invalid4 = () => failure("oauth_failed", { operation: "auth" });
+  if (value.length > 16384 || /[\u0000-\u0020\u007f]/u.test(value)) throw invalid4();
   let target;
   try {
     target = new URL(value);
   } catch {
-    throw invalid3();
+    throw invalid4();
   }
   const expected = new URL(redirect);
   const params = target.searchParams;
-  if (target.origin !== expected.origin || target.pathname !== expected.pathname || target.username || target.password || target.hash || [...params.keys()].some((key) => params.getAll(key).length !== 1) || params.get("state") !== state || params.has("code") === params.has("error") || !(params.get("code") || params.get("error"))) throw invalid3();
+  if (target.origin !== expected.origin || target.pathname !== expected.pathname || target.username || target.password || target.hash || [...params.keys()].some((key) => params.getAll(key).length !== 1) || params.get("state") !== state || params.has("code") === params.has("error") || !(params.get("code") || params.get("error"))) throw invalid4();
   return params;
 }
 function credentialKey({ server, url, clientId }) {
@@ -4256,6 +4750,7 @@ var OAuthProvider = class {
   constructor(identity, store, redirect, options = {}) {
     this.store = store;
     this.redirect = redirect;
+    this.options = options;
     const { server, url, clientId } = identity;
     this.clientId = clientId;
     this.redirectUrl = callbackUrl(options);
@@ -4279,6 +4774,9 @@ var OAuthProvider = class {
   key;
   verifier;
   discovery;
+  requestedScope;
+  dpopSession;
+  resolvedDpopSession;
   expectedState = randomUUID2();
   clientId;
   assertCurrent() {
@@ -4296,7 +4794,13 @@ var OAuthProvider = class {
   }
   clientInformation(ctx) {
     this.assertCurrent();
+    return this.lookupClientInformation(ctx);
+  }
+  lookupClientInformation(ctx) {
     if (!ctx) return void 0;
+    const grantIssuer = this.data.grantIssuer ?? this.data.tokens?.issuer;
+    if (grantIssuer && grantIssuer !== ctx.issuer || this.data.dpopKey && this.data.dpopKey.issuer !== ctx.issuer)
+      throw failure("oauth_issuer_changed", { operation: "auth", oauth: true });
     const stored = Object.hasOwn(this.data.clients, ctx.issuer) ? this.data.clients[ctx.issuer] : void 0;
     if (!this.clientId) {
       const registration = this.data.registrations?.[ctx.issuer];
@@ -4313,8 +4817,12 @@ var OAuthProvider = class {
     if (this.clientId && (info.client_id !== this.clientId || info.client_secret))
       throw new Error("Cannot replace the configured public OAuth client.");
     const previous = this.data.clients[ctx.issuer];
-    if (!this.clientId && previous && previous.client_id !== info.client_id && this.data.tokens?.issuer === ctx.issuer)
-      delete this.data.tokens;
+    if (!this.clientId && previous && previous.client_id !== info.client_id) {
+      if (this.data.tokens?.issuer === ctx.issuer) delete this.data.tokens;
+      delete this.data.dpopKey;
+      this.dpopSession = void 0;
+      this.resolvedDpopSession = void 0;
+    }
     this.data.clients = { ...this.data.clients, [ctx.issuer]: info };
     if (!this.clientId) this.data.registrations = {
       ...this.data.registrations,
@@ -4328,14 +4836,58 @@ var OAuthProvider = class {
     return !ctx || tokens2?.issuer === ctx.issuer ? tokens2 : void 0;
   }
   saveTokens(tokens2) {
+    if (tokens2.token_type?.toLowerCase() === "dpop" && (!this.options.oauthDpop || !this.data.dpopKey || this.data.dpopKey.issuer !== tokens2.issuer))
+      throw failure("oauth_dpop_unavailable", { operation: "auth" });
     if (this.clientId) {
       if (!tokens2.issuer) throw new Error("OAuth tokens have no issuer.");
       const info = this.clientInformation({ issuer: tokens2.issuer });
       this.data.clients = { ...this.data.clients, [tokens2.issuer]: info };
     }
-    this.data.tokens = tokens2;
+    const scope = tokens2.scope ?? this.requestedScope ?? (tokens2.issuer === this.data.tokens?.issuer ? this.data.tokens?.scope : void 0);
+    this.data.dpopRefreshBound = !!tokens2.refresh_token && (!!this.dpopSession || !!this.data.dpopRefreshBound && tokens2.refresh_token === this.data.tokens?.refresh_token);
+    this.data.grantIssuer = tokens2.issuer ?? this.data.grantIssuer;
+    this.data.tokens = { ...tokens2, ...scope !== void 0 ? { scope } : {} };
     this.save();
   }
+  async dpop() {
+    const bound = this.data.tokens?.token_type?.toLowerCase() === "dpop" || !!this.data.tokens?.refresh_token && !!this.data.dpopRefreshBound;
+    if (!this.options.oauthDpop && !bound) return void 0;
+    this.assertCurrent();
+    if (!this.options.oauthDpop) {
+      if (bound) throw failure("oauth_dpop_unavailable", { operation: "auth" });
+      return void 0;
+    }
+    const issuer = this.discovery?.authorizationServerMetadata?.issuer ?? this.discovery?.authorizationServerUrl ?? this.data.tokens?.issuer;
+    const client = issuer ? this.lookupClientInformation({ issuer }) : void 0;
+    if (!issuer || !client) {
+      if (bound) throw failure("oauth_dpop_unavailable", { operation: "auth" });
+      return void 0;
+    }
+    if (!this.data.dpopKey && !this.redirect) {
+      if (bound) throw failure("oauth_dpop_unavailable", { operation: "auth" });
+      return void 0;
+    }
+    if (this.data.dpopKey && (this.data.dpopKey.issuer !== issuer || this.data.dpopKey.clientId !== client.client_id))
+      throw failure("oauth_dpop_unavailable", { operation: "auth" });
+    if (this.resolvedDpopSession) return this.resolvedDpopSession;
+    this.dpopSession ??= (async () => {
+      if (!this.data.dpopKey) {
+        const key = await createDpopKey(issuer, client.client_id);
+        this.assertCurrent();
+        this.data.dpopKey = key;
+        this.save();
+      }
+      try {
+        return await restoreDpopSession(this.data.dpopKey);
+      } catch {
+        throw failure("oauth_dpop_unavailable", { operation: "auth" });
+      }
+    })();
+    const session = await this.dpopSession;
+    this.assertCurrent();
+    this.resolvedDpopSession = session;
+    return session;
+  }
   saveCodeVerifier(value) {
     this.verifier = value;
   }
@@ -4354,12 +4906,17 @@ var OAuthProvider = class {
       throw failure("authentication_required", { operation: "connect", oauth: true });
     if (url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))
       throw new Error("Refusing an insecure authorization URL.");
+    await this.dpop();
+    this.requestedScope = url.searchParams.get("scope") ?? void 0;
     await this.redirect(url);
   }
   invalidateCredentials(scope) {
     if (scope === "all" || scope === "client") {
       this.data.clients = {};
       delete this.data.registrations;
+      delete this.data.dpopKey;
+      this.dpopSession = void 0;
+      this.resolvedDpopSession = void 0;
     }
     if (scope === "all" || scope === "tokens") delete this.data.tokens;
     if (scope === "all" || scope === "verifier") this.verifier = void 0;
@@ -4401,6 +4958,14 @@ async function connectionAuthProvider(server, config, storeFactory = credentialS
         throw error;
       }
     },
+    dpop: async () => {
+      try {
+        return await (await get()).dpop();
+      } catch (error) {
+        if (!initialized && error instanceof DiagnosticError && error.diagnostic.code === "credential_store_unavailable") return void 0;
+        throw error;
+      }
+    },
     saveTokens: async (tokens2) => (await get()).saveTokens(tokens2),
     saveCodeVerifier: async (value) => (await get()).saveCodeVerifier(value),
     codeVerifier: async () => (await get()).codeVerifier(),
@@ -4481,9 +5046,36 @@ async function authenticate(identity, open2, signal, store, options = {}) {
   const callback = new Promise((resolve3) => {
     resolveCallback = resolve3;
   });
+  const backing = store ?? await credentialStore(identity);
+  const original = backing.read();
+  const epoch = credentialEpochs.get(credentialKey(identity)) ?? 0;
+  let staged = original;
+  const guard = () => {
+    deadline.throwIfAborted();
+    if ((credentialEpochs.get(credentialKey(identity)) ?? 0) !== epoch || backing.read() !== original)
+      throw failure("authentication_required", { operation: "auth" });
+  };
+  const pending = {
+    read: () => {
+      guard();
+      return staged;
+    },
+    write: (value) => {
+      guard();
+      staged = value;
+    },
+    remove: () => {
+      guard();
+      staged = null;
+    }
+  };
+  const commit = () => {
+    guard();
+    if (staged !== null) backing.write(staged);
+  };
   const provider = new OAuthProvider(
     identity,
-    store ?? await credentialStore(identity),
+    pending,
     async (target) => {
       deadline.throwIfAborted();
       if (!options.handoff) return open2(target.href);
@@ -4513,7 +5105,7 @@ async function authenticate(identity, open2, signal, store, options = {}) {
     res.end(oauthCallbackHtml(params.has("error") ? "denied" : "received"));
     resolveCallback(params);
   });
-  const fetchFn = (input, init) => fetch(input, {
+  const fetchFn = (input, init) => privateOAuthFetch(input, {
     ...init,
     signal: AbortSignal.any([deadline, ...init?.signal ? [init.signal] : []])
   });
@@ -4530,7 +5122,10 @@ async function authenticate(identity, open2, signal, store, options = {}) {
       forceReauthorization: true,
       scope: options.oauthScopes?.join(" ")
     });
-    if (result === "AUTHORIZED") return;
+    if (result === "AUTHORIZED") {
+      commit();
+      return;
+    }
     const params = await waitFor(callback, deadline);
     if (params.has("error") || !params.get("code"))
       throw new Error("OAuth authorization was not granted.");
@@ -4541,6 +5136,7 @@ async function authenticate(identity, open2, signal, store, options = {}) {
     });
     try {
       await transport.finishAuth(params);
+      commit();
     } finally {
       await transport.close();
     }
@@ -4571,9 +5167,9 @@ function serverMatrix(servers, loaded, width = 80, theme) {
     const fitted = truncateToWidth2(text, width, "\u2026");
     return theme ? fitted : plain(fitted);
   };
-  const wrap = (text) => wrapTextWithAnsi(text, width).map(fit);
+  const wrap2 = (text) => wrapTextWithAnsi(text, width).map(fit);
   const rows = [];
-  if (!servers.length) return wrap(fg("muted", "No MCP servers configured.")).join("\n");
+  if (!servers.length) return wrap2(fg("muted", "No MCP servers configured.")).join("\n");
   const toolsWidth = Math.max(5, ...servers.map((server) => String(server.catalogSize ?? "\u2014").length));
   const loadedWidth = Math.max(6, ...servers.map((server) => String(loaded.get(server.name) ?? 0).length));
   const fixedWidth = 18 + toolsWidth + loadedWidth;
@@ -4597,17 +5193,17 @@ function serverMatrix(servers, loaded, width = 80, theme) {
     const name = fg(server.state === "disabled" ? "dim" : "text", bold(compact ? line(server.name) : padName(server.name)));
     const glyph = fg(state.color, state.glyph);
     if (compact) {
-      rows.push(...wrap(`${glyph} ${name}`));
-      rows.push(...wrap(`  ${fg(state.color, state.label)} \xB7 ${fg("muted", `${tools} tools \xB7 ${count} loaded`)}`));
+      rows.push(...wrap2(`${glyph} ${name}`));
+      rows.push(...wrap2(`  ${fg(state.color, state.label)} \xB7 ${fg("muted", `${tools} tools \xB7 ${count} loaded`)}`));
     } else {
       rows.push(`${glyph} ${name}  ${fg(state.color, state.label.padEnd(10))}  ` + fg(server.catalogSize === void 0 ? "dim" : "text", tools.padStart(toolsWidth)) + "  " + fg(count ? "accent" : "dim", String(count).padStart(loadedWidth)));
     }
   }
-  rows.push("", ...wrap(fg("dim", "Connections open on demand. \u2014 = catalog not fetched.")));
+  rows.push("", ...wrap2(fg("dim", "Connections open on demand. \u2014 = catalog not fetched.")));
   const errors = servers.filter((server) => server.state === "failed" && server.error);
   if (errors.length) rows.push("");
   for (const server of errors) {
-    rows.push(...wrap(fg("error", `\u2718\uFE0E ${line(server.name)}: [${line(server.error.code)}]`) + fg("muted", ` ${line(server.error.message)}`)));
+    rows.push(...wrap2(fg("error", `\u2718\uFE0E ${line(server.name)}: [${line(server.error.code)}]`) + fg("muted", ` ${line(server.error.message)}`)));
   }
   return rows.map(fit).join("\n");
 }
@@ -4694,7 +5290,8 @@ function inspectServer(name, config, status, authentication) {
     `OAuth: ${usesOAuth(config) ? "automatic" : "not used"}`,
     ...usesOAuth(config) ? [
       `Requested scopes: ${config.oauthScopes?.map(line).join(", ") ?? "SDK/server defaults"}`,
-      `OAuth callback: http://127.0.0.1:${config.oauthCallbackPort ?? 19847}/callback`
+      `OAuth callback: http://127.0.0.1:${config.oauthCallbackPort ?? 19847}/callback`,
+      `DPoP: ${config.oauthDpop ? "enabled (ES256; token binding depends on the service)" : "disabled"}`
     ] : [],
     ...authentication ? [`Authentication: ${authentication}`] : [],
     `Timeout: ${config.timeoutMs ? `${config.timeoutMs} ms` : "default"}`,
@@ -4713,6 +5310,111 @@ function inspectServer(name, config, status, authentication) {
   ].join("\n");
 }
 
+// src/authorization.ts
+import { computeScopeUnion } from "@modelcontextprotocol/client";
+function parseScopes(value) {
+  if (!value || value.length > 25699) return void 0;
+  const scopes = [...new Set(value.split(" "))];
+  if (scopes.length > 100 || scopes.some((scope) => scope.length > 256 || !/^[\x21\x23-\x5b\x5d-\x7e]+$/u.test(scope))) return void 0;
+  return scopes;
+}
+function authorizationOptions(identity, store, options, required) {
+  const granted = new OAuthProvider(identity, store).tokens()?.scope;
+  const scope = computeScopeUnion(options.oauthScopes?.join(" "), granted, required.join(" "));
+  const scopes = parseScopes(scope);
+  if (!scopes) throw failure("oauth_scope_rejected", { operation: "auth" });
+  return { options: { ...options, oauthScopes: scopes }, grantedScopesKnown: granted !== void 0 };
+}
+function loginSummary(options, reviewed) {
+  const scopes = options.oauthScopes;
+  const names = scopes?.join(", ");
+  const summary = scopes && (reviewed || names.length > 80) ? `${scopes.length} ${reviewed ? "reviewed " : "configured "}scopes` : names ?? "SDK/server defaults";
+  return `Requested scopes: ${summary}
+Callback: http://127.0.0.1:${options.oauthCallbackPort ?? 19847}/callback`;
+}
+
+// src/authorization-review.ts
+import { Text as Text3, truncateToWidth as truncateToWidth3 } from "@earendil-works/pi-tui";
+async function reviewAuthorization(ctx, server, requested, combined, grantedScopesKnown, signal) {
+  const warning = grantedScopesKnown ? "" : "Previously granted scopes are unknown and may not be retained. Configure oauthScopes with the permissions you need, or continue with the listed scopes.\n\n";
+  const text = `${warning}Server-requested scopes (untrusted data):
+${requested.join("\n")}
+
+Login scopes (configured + known grants + requested):
+${combined.join("\n")}
+
+Approval opens sign-in. The rejected operation is never replayed.`;
+  if (signal.aborted) return false;
+  if (ctx.mode !== "tui") {
+    const lines = new Text3(text, 0, 0).render(70);
+    let page = 0;
+    const pages = Math.ceil(lines.length / 8);
+    while (!signal.aborted) {
+      const choice = await chooseOption(
+        ctx,
+        `Permissions for ${server} \xB7 ${page + 1}/${pages}
+${lines.slice(page * 8, page * 8 + 8).join("\n")}`,
+        ["Cancel", ...page + 1 < pages ? ["Next page"] : ["Approve sign-in"], ...page ? ["Previous page"] : []],
+        signal
+      );
+      if (choice === "Next page") page++;
+      else if (choice === "Previous page") page--;
+      else return choice === "Approve sign-in" && !signal.aborted;
+    }
+    return false;
+  }
+  return ctx.ui.custom((tui, theme, keys, done) => {
+    let settled = false;
+    const finish = (approved) => {
+      if (settled) return;
+      settled = true;
+      signal.removeEventListener("abort", abort);
+      done(approved);
+    };
+    const abort = () => finish(false);
+    signal.addEventListener("abort", abort, { once: true });
+    const component = authorizationReview(server, text, () => tui.terminal.rows, theme, keys, finish, () => tui.requestRender());
+    return { ...component, dispose: () => signal.removeEventListener("abort", abort) };
+  });
+}
+function authorizationReview(server, text, rows, theme, keys, done, render) {
+  let offset = 0, size = 1, width = 0, height = 0;
+  let lines = [], last2 = false;
+  return {
+    render(columns) {
+      if (columns < 24 || rows() < 14) {
+        last2 = false;
+        return [truncateToWidth3("Enlarge terminal; Esc cancels", columns)];
+      }
+      const available = Math.max(1, rows() - 8);
+      if (columns !== width || available !== height) {
+        width = columns;
+        height = available;
+        offset = 0;
+        lines = new Text3(text, 0, 0).render(Math.max(1, columns));
+      }
+      size = Math.max(1, available - 4);
+      last2 = offset + size >= lines.length;
+      return [
+        truncateToWidth3(theme.fg("accent", `Permissions: ${server}`), columns),
+        ...lines.slice(offset, offset + size),
+        truncateToWidth3(`${offset + 1}\u2013${Math.min(offset + size, lines.length)}/${lines.length}`, columns),
+        truncateToWidth3(last2 ? "a: approve \xB7 Esc: cancel" : "Enter/\u2193: next", columns),
+        truncateToWidth3("\u2191: previous \xB7 Esc cancel", columns)
+      ];
+    },
+    handleInput(data) {
+      if (keys.matches(data, "tui.select.cancel")) done(false);
+      else if (data === "a" && last2) done(true);
+      else if (keys.matches(data, "tui.select.up")) offset = Math.max(0, offset - size);
+      else if (!last2 && (keys.matches(data, "tui.select.confirm") || keys.matches(data, "tui.select.down"))) offset += size;
+      render();
+    },
+    invalidate() {
+    }
+  };
+}
+
 // src/runtime.ts
 import { mkdir as mkdir2, readFile as readFile2, rename as rename2, rm as rm2, stat as stat2, writeFile as writeFile2 } from "node:fs/promises";
 import { join as join2 } from "node:path";
@@ -4724,13 +5426,15 @@ import {
   SdkError as SdkError2,
   SdkErrorCode,
   StreamableHTTPClientTransport,
+  extractWWWAuthenticateParams,
+  computeScopeUnion as computeScopeUnion2,
   UriTemplate as UriTemplate2
 } from "@modelcontextprotocol/client";
 
 // package.json
 var package_default = {
   name: "pi-mcp-client",
-  version: "0.9.0",
+  version: "0.10.0",
   description: "MCP tools for Pi, discovered on demand and called natively through the official SDK.",
   type: "module",
   license: "MIT",
@@ -4769,8 +5473,9 @@ var package_default = {
     prepack: "bun run build"
   },
   dependencies: {
-    "@modelcontextprotocol/client": "2.0.0",
+    "@modelcontextprotocol/client": "2.1.0",
     "@napi-rs/keyring": "^1.3.0",
+    jose: "^6.1.3",
     minisearch: "^7.2.0",
     "smol-toml": "^1.8.0"
   },
@@ -4778,7 +5483,7 @@ var package_default = {
     "@earendil-works/pi-ai": "^0.85.1",
     "@earendil-works/pi-coding-agent": "^0.85.1",
     "@earendil-works/pi-tui": "^0.85.1",
-    "@modelcontextprotocol/server": "2.0.0",
+    "@modelcontextprotocol/server": "2.1.0",
     "@types/bun": "^1.3.0",
     "@types/node": "^24.0.0",
     esbuild: "^0.25.0",
@@ -4901,21 +5606,21 @@ var MAX_CHOICES = 100;
 var MAX_TEXT = 8192;
 var MAX_CONTENT = 64 * 1024;
 var MAX_REQUIRED = 3;
-var invalid2 = (message2) => new ProtocolError2(ProtocolErrorCode2.InvalidParams, message2);
+var invalid3 = (message3) => new ProtocolError2(ProtocolErrorCode2.InvalidParams, message3);
 var short = (value, limit) => typeof value === "string" ? line(value).slice(0, limit) : "";
 var number = (value) => typeof value === "number" && Number.isFinite(value) ? value : void 0;
-function message(value) {
+function message2(value) {
   const text = plain(value).split("\n").map((row) => row.trimEnd()).slice(0, 20).join("\n").trim();
   return text.slice(0, 2e3) || "(No message supplied.)";
 }
 function choices(values) {
   if (!values.length || values.length > MAX_CHOICES || new Set(values.map((choice) => choice.value)).size !== values.length)
-    throw invalid2("Elicitation choices are empty, duplicated, or too many.");
+    throw invalid3("Elicitation choices are empty, duplicated, or too many.");
   return values.map(({ value, label: label2 }) => ({ value, label: short(label2, 120) || short(value, 120) || JSON.stringify(value) }));
 }
 function formFields(schema) {
   const entries = Object.entries(schema.properties ?? {});
-  if (entries.length > MAX_FIELDS) throw invalid2("Elicitation forms are limited to 50 fields.");
+  if (entries.length > MAX_FIELDS) throw invalid3("Elicitation forms are limited to 50 fields.");
   const required = new Set(Array.isArray(schema.required) ? schema.required : []);
   return entries.map(([name, value]) => {
     const property = value;
@@ -5071,7 +5776,7 @@ async function elicitForm(ui, server, params, signal) {
   for (const field of fields)
     if (field.default !== void 0 && !problem(field, field.default)) values.set(field.name, field.default);
   const title = `${server} requests information
-${message(params.message)}
+${message2(params.message)}
 
 Review the values below. Only what you submit is sent to ${server}. Never enter passwords, API keys, or payment details here.`;
   while (!signal.aborted) {
@@ -5112,13 +5817,13 @@ async function elicitUrl(ui, server, params, signal) {
   const target = safeUrl(params.url);
   if (!target) {
     ui.notify(`${server} asked to open an unsupported URL, so the request was refused. Only HTTPS pages, or HTTP pages on this computer, without embedded credentials can be opened.`, "warning");
-    throw invalid2("Unsupported elicitation URL.");
+    throw invalid3("Unsupported elicitation URL.");
   }
   let failed = false;
   while (!signal.aborted) {
     const choice = await ui.select(
       `${server} asks you to open a web page
-${message(params.message)}
+${message2(params.message)}
 
 Site: ${target.host}
 URL: ${target.href}
@@ -5156,7 +5861,7 @@ function requiredElicitations(error) {
   if (!Array.isArray(list) || !list.length || list.length > MAX_REQUIRED) return;
   const valid = list.every((item) => typeof item === "object" && item !== null && item.mode === "url" && typeof item.message === "string" && typeof item.url === "string" && typeof item.elicitationId === "string" && item.elicitationId.length > 0 && item.elicitationId.length <= 256);
   if (!valid || new Set(list.map((item) => item.elicitationId)).size !== list.length) return;
-  return list.map(({ mode, message: message2, url, elicitationId }) => ({ mode, message: message2, url, elicitationId }));
+  return list.map(({ mode, message: message3, url, elicitationId }) => ({ mode, message: message3, url, elicitationId }));
 }
 
 // src/runtime.ts
@@ -5252,6 +5957,8 @@ var createSdkConnector = (storeFactory = credentialStore) => async (name, config
   }) : new StreamableHTTPClientTransport(new URL(config.url), {
     requestInit: { headers: config.headers },
     authProvider: await connectionAuthProvider(name, config, storeFactory),
+    // Approval and resubmission belong to the user, not transport retries.
+    onInsufficientScope: "throw",
     // Bound HTTP responses (including OAuth), but not established SSE streams.
     // Accommodate startup/tool overrides; the SDK enforces each request's tighter deadline.
     fetch: async (input, init) => {
@@ -5262,7 +5969,7 @@ var createSdkConnector = (storeFactory = credentialStore) => async (name, config
       );
       timer.unref();
       try {
-        const response = await fetch(input, {
+        const response = await privateOAuthFetch(input, {
           ...init,
           signal: AbortSignal.any([
             signal,
@@ -5270,6 +5977,10 @@ var createSdkConnector = (storeFactory = credentialStore) => async (name, config
             ...init?.signal ? [init.signal] : []
           ])
         });
+        if (response.status === 403 && usesOAuth(config)) {
+          const challenge = extractWWWAuthenticateParams(response);
+          if (challenge.error === "insufficient_scope") handlers?.scopeChallenge?.(challenge.scope);
+        }
         if (response.headers.get("content-type")?.split(";")[0].trim() === "text/event-stream")
           clearTimeout(timer);
         return response;
@@ -5308,8 +6019,21 @@ var McpRuntime = class {
     this.options = options;
   }
   states = /* @__PURE__ */ new Map();
+  scopeChallenges = /* @__PURE__ */ new Map();
   lifetime = new AbortController();
   closing;
+  /** Challenges are session-local, expire, and never survive configuration changes. */
+  authorizationChallenge(name) {
+    const challenge = this.scopeChallenges.get(name);
+    if (!challenge || challenge.expires < Date.now() || challenge.identity !== this.identity(name)) {
+      this.scopeChallenges.delete(name);
+      return void 0;
+    }
+    return challenge;
+  }
+  clearAuthorizationChallenge(name, approved) {
+    if (this.scopeChallenges.get(name) === approved) this.scopeChallenges.delete(name);
+  }
   onResourceUpdated;
   subscriptionGeneration = 0;
   subscriptionCleanup = Promise.resolve();
@@ -5374,6 +6098,14 @@ var McpRuntime = class {
         ),
         this.lifetime.signal,
         {
+          scopeChallenge: (scope) => {
+            if (this.closing || this.lifetime.signal.aborted || state.connectionToken !== token) return;
+            const scopes = parseScopes(scope);
+            const previous = this.authorizationChallenge(name);
+            const union = scopes && parseScopes(computeScopeUnion2(previous?.scopes.join(" "), scopes.join(" ")));
+            if (union) this.scopeChallenges.set(name, { scopes: union, identity, expires: Date.now() + 6e5 });
+            else this.scopeChallenges.delete(name);
+          },
           toolsChanged: () => {
             if (this.closing || this.lifetime.signal.aborted || state.connectionToken !== token)
               return;
@@ -5950,6 +6682,7 @@ var McpRuntime = class {
         throw failure("busy", { server: name, operation: "auth" });
     }
     await Promise.all(names.map(async (name) => {
+      this.scopeChallenges.delete(name);
       const state = this.states.get(name);
       if (!state) return;
       state.connectionToken = void 0;
@@ -6005,6 +6738,7 @@ var McpRuntime = class {
     return this.closing ??= this.shutdown();
   }
   async shutdown() {
+    this.scopeChallenges.clear();
     await this.clearResourceSubscriptions();
     await Promise.all(
       [...this.states.values()].map(
@@ -6250,7 +6984,7 @@ Full MCP result: ${path}`;
 
 // src/render.ts
 import { keyText } from "@earendil-works/pi-coding-agent";
-import { Text as Text3, truncateToWidth as truncateToWidth3 } from "@earendil-works/pi-tui";
+import { Text as Text4, truncateToWidth as truncateToWidth4 } from "@earendil-works/pi-tui";
 
 // src/format.ts
 import {
@@ -6361,10 +7095,10 @@ function renderCall(title, args, theme, expanded) {
       if (width <= 0) return [];
       const text = theme.fg("toolTitle", theme.bold(line(title))) + (preview ? theme.fg("dim", ` ${preview}`) : "");
       if (expanded)
-        return new Text3(text, 0, 0).render(width).map((row) => truncateToWidth3(row, width));
+        return new Text4(text, 0, 0).render(width).map((row) => truncateToWidth4(row, width));
       const key = keyText("app.tools.expand");
       return [
-        truncateToWidth3(
+        truncateToWidth4(
           text + (key ? theme.fg("muted", ` (${key} to expand)`) : ""),
           width
         )
@@ -6399,30 +7133,30 @@ function renderResult(result, options, theme, isError) {
       const lines = rows.flatMap((row) => {
         const status = states[row.state] ?? states.failed;
         const value = theme.fg(status.color, status.glyph) + " " + theme.fg(status === states.failed ? "error" : "accent", line(row.label)) + (row.inlineDescription ? theme.fg("dim", ` ${line(row.inlineDescription)}`) : "") + (row.inlineAction ? theme.bold(theme.fg("dim", ` ${line(row.inlineAction)}`)) : "");
-        const rendered = options.expanded && (!details?.searchNotes || row.state === "failed") ? new Text3(value, 0, 0).render(width).map((x) => truncateToWidth3(x, width)) : [truncateToWidth3(value, width)];
+        const rendered = options.expanded && (!details?.searchNotes || row.state === "failed") ? new Text4(value, 0, 0).render(width).map((x) => truncateToWidth4(x, width)) : [truncateToWidth4(value, width)];
         if (options.expanded && row.description)
-          rendered.push(truncateToWidth3(
+          rendered.push(truncateToWidth4(
             theme.fg("dim", `  ${line(row.description)}`),
             width
           ));
         return rendered;
       });
       for (const note of details?.searchNotes ?? [])
-        lines.push(...(options.expanded ? new Text3(theme.fg("warning", plain(note)), 0, 0).render(width) : [theme.fg("warning", line(note))]).map((row) => truncateToWidth3(row, width)));
+        lines.push(...(options.expanded ? new Text4(theme.fg("warning", plain(note)), 0, 0).render(width) : [theme.fg("warning", line(note))]).map((row) => truncateToWidth4(row, width)));
       if (options.expanded && !options.isPartial && text && !details?.searchNotes && !bodyInRow)
         lines.push(
-          ...new Text3(
+          ...new Text4(
             formattedOutput ??= (() => {
               const output = validation ? formatValidation(body, theme) : formatOutput(body, details?.displayBlocks, theme);
               return isError || details?.failed ? theme.fg("error", output) : output;
             })(),
             0,
             0
-          ).render(width).map((x) => truncateToWidth3(x, width))
+          ).render(width).map((x) => truncateToWidth4(x, width))
         );
       if (!options.expanded && details?.fullOutputPath)
         lines.push(
-          truncateToWidth3(
+          truncateToWidth4(
             theme.fg("dim", `Full result: ${details.fullOutputPath}`),
             width
           )
@@ -6492,14 +7226,14 @@ var CommandUsageError = class extends Error {
 };
 function errorResult(error, context) {
   const value = error instanceof ToolContractError ? diagnostic("tool_changed", context) : diagnose(error, context);
-  const message2 = formatDiagnostic(value) + (context.operation === "call" && !value.code.startsWith("elicitation_") ? " The call was not replayed. The server may already have performed the operation; verify before retrying." : "");
-  return textResult(message2, {
+  const message3 = formatDiagnostic(value) + (context.operation === "call" && !value.code.startsWith("elicitation_") ? " The call was not replayed. The server may already have performed the operation; verify before retrying." : "");
+  return textResult(message3, {
     mcpClient: 1,
     failed: true,
     diagnostics: [value],
     rows: [
       {
-        label: value.code === "cancelled" ? "Cancelled" : message2,
+        label: value.code === "cancelled" ? "Cancelled" : message3,
         state: value.code === "cancelled" ? "cancelled" : "failed"
       }
     ]
@@ -6521,12 +7255,12 @@ function mcpClient(pi, options = {}) {
     STATUS_ENTRY,
     (entry, _options, theme) => statusPanel(entry.data ?? { servers: [], loaded: [] }, theme)
   );
-  pi.registerMessageRenderer("mcp-prompt", (message2, { expanded, outputPad }, theme) => {
-    const details = object(message2.details) ? message2.details : {};
+  pi.registerMessageRenderer("mcp-prompt", (message3, { expanded, outputPad }, theme) => {
+    const details = object(message3.details) ? message3.details : {};
     const count = Number(details.count ?? 0);
     const label2 = `${line(String(details.server ?? "MCP"))} \xB7 ${line(String(details.name ?? "prompt"))} \xB7 ${count} ${count === 1 ? "message" : "messages"}`;
-    return new Text4(theme.fg("toolTitle", "mcp prompt") + "\n" + theme.fg("success", "\u2714\uFE0E ") + theme.fg("accent", label2) + (expanded && typeof message2.content === "string" ? `
-${message2.content}` : ""), outputPad, 0);
+    return new Text5(theme.fg("toolTitle", "mcp prompt") + "\n" + theme.fg("success", "\u2714\uFE0E ") + theme.fg("accent", label2) + (expanded && typeof message3.content === "string" ? `
+${message3.content}` : ""), outputPad, 0);
   });
   const exposure = new Exposure(pi, registerNative);
   const launchBrowser = async (target) => {
@@ -6537,7 +7271,7 @@ ${message2.content}` : ""), outputPad, 0);
   const elicitationUi = (ctx) => ({
     select: (title, choices2, signal) => chooseOption(ctx, title, choices2, signal),
     editor: (title, value) => ctx.ui.editor(title, value),
-    notify: (message2, type) => ctx.ui.notify(message2, type),
+    notify: (message3, type) => ctx.ui.notify(message3, type),
     open: launchBrowser
   });
   const current = () => {
@@ -6564,12 +7298,12 @@ Text output is limited to 2000 lines or 50 KiB; larger results are saved to a pr
       renderResult: (result, options2, theme, context) => renderResult(result, options2, theme, context.isError),
       async execute(_id, args, signal, onUpdate, ctx) {
         const label2 = `${tool.server}.${tool.name}`;
-        const emit = (message2) => onUpdate?.(
-          textResult(message2, {
+        const emit = (message3) => onUpdate?.(
+          textResult(message3, {
             mcpClient: 1,
             rows: [
               {
-                label: `${label2} \xB7 ${line(message2).slice(0, 160)}`,
+                label: `${label2} \xB7 ${line(message3).slice(0, 160)}`,
                 state: "running"
               }
             ]
@@ -6684,6 +7418,7 @@ Text output is limited to 2000 lines or 50 KiB; larger results are saved to a pr
         return false;
       }
     });
+    loginController?.abort();
     promptController?.abort();
     if (mutation?.action !== "import") importController?.abort();
     const old = runtime;
@@ -6697,6 +7432,7 @@ Text output is limited to 2000 lines or 50 KiB; larger results are saved to a pr
   }
   pi.on("session_start", async (_event, ctx) => {
     const generation = ++sessionGeneration;
+    loginController?.abort();
     promptController?.abort();
     importController?.abort();
     trustController?.abort();
@@ -6914,7 +7650,7 @@ Variables: ${(candidate.variables ?? []).join(", ") || "none"}. Supply known val
               state: "failed"
             };
           }));
-          messages2.push(...discovery.unavailable.map((message2) => `Not searched: ${message2}`), ...discovery.warnings);
+          messages2.push(...discovery.unavailable.map((message3) => `Not searched: ${message3}`), ...discovery.warnings);
           messages2.push("No tools activated or resource or prompt content read. Activate selected tools or read selected resources using their exact next-call arguments. Prompt commands are for the user to run, not the assistant.");
         } else {
           const resolved = resolveTools(discovery.tools, identifiers);
@@ -7037,8 +7773,8 @@ ${snapshot.body}`,
         if (action === "subscriptions") {
           if (server) throw new CommandUsageError("Use /mcp subscriptions without arguments.");
           const watches = current().resourceSubscriptions();
-          const message2 = watches.length ? watches.map((watch) => `${watch.changed ? "\u21BB" : "\u2714\uFE0E"} ${watch.server} \xB7 ${line(watch.uri).slice(0, 160)}${watch.changed ? " \xB7 changed" : ""}`).join("\n") : "No active resource subscriptions.";
-          if (ctx.hasUI) ctx.ui.notify(message2, "info");
+          const message3 = watches.length ? watches.map((watch) => `${watch.changed ? "\u21BB" : "\u2714\uFE0E"} ${watch.server} \xB7 ${line(watch.uri).slice(0, 160)}${watch.changed ? " \xB7 changed" : ""}`).join("\n") : "No active resource subscriptions.";
+          if (ctx.hasUI) ctx.ui.notify(message3, "info");
           return;
         }
         if (action === "subscribe" || action === "unsubscribe") {
@@ -7057,8 +7793,8 @@ ${snapshot.body}`,
           server = mutation.server;
           await reloadConfiguration(ctx, mutation);
           const remaining = Object.hasOwn(config, server);
-          const message2 = mutation.action === "add" ? `\u2714\uFE0E ${server}: saved in ${mutation.scope} configuration. Connections, authentication, and tool discovery remain on demand.` + (mutation.scope === "global" && projectTrusted(ctx) ? " Trusted project definitions take precedence over global definitions." : "") : `\u2714\uFE0E ${server}: removed from ${mutation.scope} configuration. Credentials were retained.` + (remaining ? " A definition from the other scope remains effective; connections reopen on demand." : " Its connection is closed and its tools are no longer active.");
-          if (ctx.hasUI) ctx.ui.notify(message2, "info");
+          const message3 = mutation.action === "add" ? `\u2714\uFE0E ${server}: saved in ${mutation.scope} configuration. Connections, authentication, and tool discovery remain on demand.` + (mutation.scope === "global" && projectTrusted(ctx) ? " Trusted project definitions take precedence over global definitions." : "") : `\u2714\uFE0E ${server}: removed from ${mutation.scope} configuration. Credentials were retained.` + (remaining ? " A definition from the other scope remains effective; connections reopen on demand." : " Its connection is closed and its tools are no longer active.");
+          if (ctx.hasUI) ctx.ui.notify(message3, "info");
           return;
         }
         if (action === "reload" && !server) {
@@ -7177,7 +7913,7 @@ ${snapshot.body}`,
           if (Object.keys(config[server].headers ?? {}).some((name) => name.toLowerCase() === "authorization"))
             throw new CommandUsageError("This server uses an Authorization header. Remove it from the server definition before using /mcp login, or keep using header authentication.");
           const identity = oauthSettings(server, config[server], ctx.cwd);
-          const options2 = config[server];
+          let options2 = config[server];
           const loginRuntime = current();
           const open2 = async (target) => {
             if (!await launchBrowser(target))
@@ -7192,8 +7928,17 @@ ${snapshot.body}`,
             const store = await storeFactory(identity);
             if (generation !== sessionGeneration || current() !== loginRuntime)
               throw failure("cancelled", { server, operation: "auth" });
-            const summary = `Requested scopes: ${options2.oauthScopes?.join(", ") ?? "SDK/server defaults"}
-Callback: http://127.0.0.1:${options2.oauthCallbackPort ?? 19847}/callback`;
+            const challenge = loginRuntime.authorizationChallenge(server);
+            if (challenge) {
+              const plan = authorizationOptions(identity, store, options2, challenge.scopes);
+              options2 = { ...options2, ...plan.options };
+              const approved = await reviewAuthorization(ctx, server, challenge.scopes, options2.oauthScopes, plan.grantedScopesKnown, signal);
+              signal.throwIfAborted();
+              if (!approved) throw failure("cancelled", { server, operation: "auth" });
+              if (generation !== sessionGeneration || current() !== loginRuntime || loginRuntime.authorizationChallenge(server) !== challenge)
+                throw failure("cancelled", { server, operation: "auth" });
+            }
+            const summary = loginSummary(options2, !!challenge);
             if (extra[0] === "--no-browser") {
               await authenticate(identity, open2, signal, store, {
                 ...options2,
@@ -7236,6 +7981,7 @@ Opening browser. Esc to cancel.`
                 throw authError ?? failure("cancelled", { server, operation: "auth" });
             } else await authenticate(identity, open2, signal, store, options2);
             if (generation !== sessionGeneration || current() !== loginRuntime) throw failure("cancelled", { server, operation: "auth" });
+            if (challenge) loginRuntime.clearAuthorizationChallenge(server, challenge);
             await loginRuntime.reconnect(server);
           } finally {
             if (loginController === controller) loginController = void 0;
@@ -7256,7 +8002,7 @@ Opening browser. Esc to cancel.`
             "info"
           );
       } catch (error) {
-        const message2 = error instanceof CommandUsageError || error instanceof ConfigMutationError || error instanceof PromptCommandError ? error.message : formatDiagnostic(
+        const message3 = error instanceof CommandUsageError || error instanceof ConfigMutationError || error instanceof PromptCommandError ? error.message : formatDiagnostic(
           diagnose(error, {
             server,
             operation: ["reload", "get", "enable", "disable", "add", "remove", "import"].includes(action) ? "configuration" : action === "tools" ? "search" : action === "prompt" ? "prompt" : ["login", "logout"].includes(action) ? "auth" : ["subscribe", "unsubscribe"].includes(action) ? "subscribe" : action === "refresh" ? "refresh" : "reconnect",
@@ -7264,8 +8010,8 @@ Opening browser. Esc to cancel.`
             signal: ctx.signal
           })
         );
-        if (ctx.hasUI) ctx.ui.notify(message2, "error");
-        else throw new Error(message2);
+        if (ctx.hasUI) ctx.ui.notify(message3, "error");
+        else throw new Error(message3);
       }
     }
   });