pi-soly 1.9.3 → 1.11.0

package/mcp/__tests__/mcp-callback-server-unref.upstream-test.ts

@@ -0,0 +1,264 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+type MockServer = {
+  once: ReturnType<typeof vi.fn>;
+  listen: ReturnType<typeof vi.fn>;
+  close: ReturnType<typeof vi.fn>;
+  unref: ReturnType<typeof vi.fn>;
+  address: ReturnType<typeof vi.fn>;
+  handlers: Map<string, (error?: NodeJS.ErrnoException) => void>;
+};
+
+const mocks = vi.hoisted(() => {
+  const state = {
+    configuredPort: 4337,
+    activePort: 4337,
+    callbackPath: "/callback",
+  };
+
+  const runtime = {
+    assignedPort: 4338,
+    listenImpl: (
+      _server: MockServer,
+      _port: number,
+      _host: string,
+      onListen: () => void,
+      _handlers: Map<string, (error?: NodeJS.ErrnoException) => void>
+    ) => {
+      onListen();
+    },
+    servers: [] as MockServer[],
+  };
+
+  const createServer = vi.fn((_handler: unknown) => {
+    const handlers = new Map<string, (error?: NodeJS.ErrnoException) => void>();
+    const server: MockServer = {
+      handlers,
+      once: vi.fn((event: string, handler: (error?: NodeJS.ErrnoException) => void) => {
+        handlers.set(event, handler);
+        return server;
+      }),
+      listen: vi.fn((port: number, host: string, onListen: () => void) => {
+        runtime.listenImpl(server, port, host, onListen, handlers);
+      }),
+      close: vi.fn((cb?: () => void) => cb?.()),
+      unref: vi.fn(),
+      address: vi.fn(() => ({ address: "127.0.0.1", family: "IPv4", port: runtime.assignedPort })),
+    };
+
+    runtime.servers.push(server);
+    return server;
+  });
+
+  return {
+    state,
+    runtime,
+    createServer,
+    getConfiguredOAuthCallbackPort: vi.fn(() => state.configuredPort),
+    getOAuthCallbackPort: vi.fn(() => state.activePort),
+    getOAuthCallbackPath: vi.fn(() => state.callbackPath),
+    setOAuthCallbackPath: vi.fn((path: string) => {
+      state.callbackPath = path.startsWith("/") ? path : `/${path}`;
+    }),
+    setOAuthCallbackPort: vi.fn((port: number) => {
+      state.activePort = port;
+    }),
+  };
+});
+
+vi.mock("http", () => ({
+  createServer: mocks.createServer,
+}));
+
+vi.mock("../mcp-oauth-provider.ts", () => ({
+  DEFAULT_OAUTH_CALLBACK_PATH: "/callback",
+  getConfiguredOAuthCallbackPort: mocks.getConfiguredOAuthCallbackPort,
+  getOAuthCallbackPath: mocks.getOAuthCallbackPath,
+  getOAuthCallbackPort: mocks.getOAuthCallbackPort,
+  setOAuthCallbackPath: mocks.setOAuthCallbackPath,
+  setOAuthCallbackPort: mocks.setOAuthCallbackPort,
+}));
+
+describe("mcp-callback-server", () => {
+  beforeEach(() => {
+    vi.resetModules();
+    mocks.state.configuredPort = 4337;
+    mocks.state.activePort = 4337;
+    mocks.state.callbackPath = "/callback";
+    mocks.runtime.assignedPort = 4338;
+    mocks.runtime.servers = [];
+    mocks.runtime.listenImpl = (_server, _port, _host, onListen) => {
+      onListen();
+    };
+    mocks.createServer.mockClear();
+    mocks.getConfiguredOAuthCallbackPort.mockClear();
+    mocks.getOAuthCallbackPath.mockClear();
+    mocks.getOAuthCallbackPort.mockClear();
+    mocks.setOAuthCallbackPath.mockClear();
+    mocks.setOAuthCallbackPort.mockClear();
+  });
+
+  it("binds localhost on an OS-assigned port and unrefs after a successful non-strict bind", async () => {
+    const { ensureCallbackServer } = await import("../mcp-callback-server.ts");
+
+    await ensureCallbackServer();
+
+    expect(mocks.runtime.servers[0]?.listen).toHaveBeenCalledWith(0, "localhost", expect.any(Function));
+    expect(mocks.runtime.servers[0]?.unref).toHaveBeenCalledTimes(1);
+    expect(mocks.state.activePort).toBe(4338);
+  });
+
+  it("binds the configured localhost port exactly in strict mode", async () => {
+    const { ensureCallbackServer } = await import("../mcp-callback-server.ts");
+
+    await ensureCallbackServer({ strictPort: true });
+
+    expect(mocks.runtime.servers[0]?.listen).toHaveBeenCalledWith(4337, "localhost", expect.any(Function));
+    expect(mocks.runtime.servers[0]?.listen).not.toHaveBeenCalledWith(0, "localhost", expect.any(Function));
+    expect(mocks.state.activePort).toBe(4337);
+  });
+
+  it("binds an explicit loopback host and port exactly in strict mode", async () => {
+    const { ensureCallbackServer } = await import("../mcp-callback-server.ts");
+
+    await ensureCallbackServer({ strictPort: true, port: 3118, callbackHost: "127.0.0.1", callbackPath: "/custom/callback" });
+
+    expect(mocks.runtime.servers[0]?.listen).toHaveBeenCalledWith(3118, "127.0.0.1", expect.any(Function));
+    expect(mocks.runtime.servers[0]?.listen).not.toHaveBeenCalledWith(0, "127.0.0.1", expect.any(Function));
+    expect(mocks.state.activePort).toBe(3118);
+    expect(mocks.state.callbackPath).toBe("/custom/callback");
+  });
+
+  it("does not unref when bind fails", async () => {
+    mocks.runtime.listenImpl = (_server, _port, _host, _onListen, handlers) => {
+      Promise.resolve().then(() => {
+        handlers.get("error")?.(Object.assign(new Error("EADDRINUSE"), { code: "EADDRINUSE" }));
+      });
+    };
+
+    const { ensureCallbackServer } = await import("../mcp-callback-server.ts");
+
+    await expect(ensureCallbackServer({ strictPort: true })).rejects.toThrow(/already in use/);
+    expect(mocks.runtime.servers[0]?.unref).not.toHaveBeenCalled();
+  });
+
+  it("serializes concurrent callback server startup", async () => {
+    let resolveListen: (() => void) | undefined;
+    mocks.runtime.listenImpl = (_server, _port, _host, onListen) => {
+      resolveListen = onListen;
+    };
+
+    const { ensureCallbackServer } = await import("../mcp-callback-server.ts");
+
+    const first = ensureCallbackServer();
+    const second = ensureCallbackServer();
+    expect(mocks.runtime.servers).toHaveLength(1);
+
+    resolveListen?.();
+    await Promise.all([first, second]);
+
+    expect(mocks.runtime.servers).toHaveLength(1);
+    expect(mocks.runtime.servers[0]?.unref).toHaveBeenCalledTimes(1);
+    expect(mocks.state.activePort).toBe(4338);
+  });
+
+  it("rebinds to the configured port when strict mode is requested", async () => {
+    const { ensureCallbackServer } = await import("../mcp-callback-server.ts");
+
+    await ensureCallbackServer();
+    expect(mocks.state.activePort).toBe(4338);
+
+    await ensureCallbackServer({ strictPort: true });
+
+    expect(mocks.runtime.servers[0]?.close).toHaveBeenCalledTimes(1);
+    expect(mocks.runtime.servers[1]?.listen).toHaveBeenCalledWith(4337, "localhost", expect.any(Function));
+    expect(mocks.state.activePort).toBe(4337);
+  });
+
+  it("keeps the existing callback server when strict rebind fails", async () => {
+    const { ensureCallbackServer, isCallbackServerRunning } = await import("../mcp-callback-server.ts");
+
+    await ensureCallbackServer();
+    expect(mocks.state.activePort).toBe(4338);
+
+    mocks.runtime.listenImpl = (_server, port, _host, onListen, handlers) => {
+      if (port === mocks.state.configuredPort) {
+        Promise.resolve().then(() => {
+          handlers.get("error")?.(Object.assign(new Error("EADDRINUSE"), { code: "EADDRINUSE" }));
+        });
+        return;
+      }
+
+      onListen();
+    };
+
+    await expect(ensureCallbackServer({ strictPort: true })).rejects.toThrow(/already in use/);
+
+    expect(isCallbackServerRunning()).toBe(true);
+    expect(mocks.runtime.servers[0]?.close).not.toHaveBeenCalled();
+    expect(mocks.state.activePort).toBe(4338);
+  });
+
+  it("does not switch ports in strict mode while an authorization URL can reference the active port", async () => {
+    const {
+      ensureCallbackServer,
+      reserveCallbackServer,
+      releaseCallbackServer,
+    } = await import("../mcp-callback-server.ts");
+
+    await ensureCallbackServer();
+    reserveCallbackServer("reserved-state");
+
+    await expect(ensureCallbackServer({ strictPort: true })).rejects.toThrow(/cannot be switched while authorizations are pending/);
+    expect(mocks.runtime.servers).toHaveLength(1);
+
+    releaseCallbackServer("reserved-state");
+  });
+
+  it("reserves callback state inside ensureCallbackServer before releasing the startup lock", async () => {
+    const {
+      ensureCallbackServer,
+      releaseCallbackServer,
+    } = await import("../mcp-callback-server.ts");
+
+    await ensureCallbackServer({ oauthState: "atomic-reserved-state", reserveState: true });
+
+    await expect(ensureCallbackServer({ strictPort: true })).rejects.toThrow(/cannot be switched while authorizations are pending/);
+    expect(mocks.runtime.servers).toHaveLength(1);
+
+    releaseCallbackServer("atomic-reserved-state");
+  });
+
+  it("does not switch host or path while callback state reserved by ensureCallbackServer", async () => {
+    const {
+      ensureCallbackServer,
+      releaseCallbackServer,
+    } = await import("../mcp-callback-server.ts");
+
+    await ensureCallbackServer({ callbackPath: "/first/callback", oauthState: "reserved-endpoint-state", reserveState: true });
+
+    await expect(ensureCallbackServer({ callbackHost: "127.0.0.1" })).rejects.toThrow(/cannot be switched while authorizations are pending/);
+    await expect(ensureCallbackServer({ callbackPath: "/second/callback" })).rejects.toThrow(/cannot be switched while authorizations are pending/);
+    expect(mocks.runtime.servers).toHaveLength(1);
+    expect(mocks.state.callbackPath).toBe("/first/callback");
+
+    releaseCallbackServer("reserved-endpoint-state");
+  });
+
+  it("does not switch ports in strict mode while callbacks are pending", async () => {
+    const {
+      ensureCallbackServer,
+      waitForCallback,
+      cancelPendingCallback,
+    } = await import("../mcp-callback-server.ts");
+
+    await ensureCallbackServer();
+    const pending = waitForCallback("pending-state");
+
+    await expect(ensureCallbackServer({ strictPort: true })).rejects.toThrow(/cannot be switched while authorizations are pending/);
+    expect(mocks.runtime.servers).toHaveLength(1);
+
+    cancelPendingCallback("pending-state");
+    await expect(pending).rejects.toThrow(/Authorization cancelled/);
+  });
+});

package/mcp/__tests__/mcp-oauth-provider.upstream-test.ts

@@ -0,0 +1,216 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { mkdtempSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
+import { McpOAuthProvider } from "../mcp-oauth-provider.ts";
+import { saveAuthEntry, updateOAuthState } from "../mcp-auth.ts";
+
+describe("McpOAuthProvider clientMetadata scope", () => {
+  it("includes configured scope in authorization_code client metadata", () => {
+    const provider = new McpOAuthProvider(
+      "scope-test",
+      "https://api.example.com/mcp",
+      { scope: "api://resource/.default openid" },
+      { onRedirect: async () => {} },
+    );
+
+    expect(provider.clientMetadata.scope).toBe("api://resource/.default openid");
+  });
+
+  it("omits scope from client metadata when not configured", () => {
+    const provider = new McpOAuthProvider(
+      "no-scope-test",
+      "https://api.example.com/mcp",
+      {},
+      { onRedirect: async () => {} },
+    );
+
+    expect(provider.clientMetadata).not.toHaveProperty("scope");
+  });
+});
+
+describe("McpOAuthProvider addClientAuthentication", () => {
+  const originalOAuthDir = process.env.MCP_OAUTH_DIR;
+  const serverUrl = "https://api.example.com/mcp";
+  let authDir: string;
+
+  beforeEach(() => {
+    authDir = mkdtempSync(join(tmpdir(), "pi-mcp-oauth-auth-"));
+    process.env.MCP_OAUTH_DIR = authDir;
+  });
+
+  afterEach(() => {
+    rmSync(authDir, { recursive: true, force: true });
+    if (originalOAuthDir === undefined) {
+      delete process.env.MCP_OAUTH_DIR;
+    } else {
+      process.env.MCP_OAUTH_DIR = originalOAuthDir;
+    }
+  });
+
+  it("adds configured scope to authorization_code token params", async () => {
+    const provider = new McpOAuthProvider(
+      "auth-scope",
+      serverUrl,
+      { clientId: "my-client", scope: "api://res/.default" },
+      { onRedirect: async () => {} },
+    );
+    const params = new URLSearchParams({ grant_type: "authorization_code", code: "abc" });
+
+    await provider.addClientAuthentication(new Headers(), params, new URL("https://auth.example.com/token"));
+
+    expect(params.get("scope")).toBe("api://res/.default");
+    expect(params.get("client_id")).toBe("my-client");
+  });
+
+  it("uses client_secret_basic when the token endpoint only supports basic auth", async () => {
+    const provider = new McpOAuthProvider(
+      "auth-basic",
+      serverUrl,
+      { clientId: "my-client", clientSecret: "my-secret", scope: "api://res/.default" },
+      { onRedirect: async () => {} },
+    );
+    const headers = new Headers();
+    const params = new URLSearchParams({ grant_type: "authorization_code", code: "abc" });
+
+    await provider.addClientAuthentication(headers, params, new URL("https://auth.example.com/token"), {
+      issuer: "https://auth.example.com",
+      authorization_endpoint: "https://auth.example.com/authorize",
+      token_endpoint: "https://auth.example.com/token",
+      response_types_supported: ["code"],
+      grant_types_supported: ["authorization_code"],
+      token_endpoint_auth_methods_supported: ["client_secret_basic"],
+    });
+
+    expect(headers.get("Authorization")).toBe(`Basic ${Buffer.from("my-client:my-secret").toString("base64")}`);
+    expect(params.get("scope")).toBe("api://res/.default");
+    expect(params.has("client_id")).toBe(false);
+    expect(params.has("client_secret")).toBe(false);
+  });
+
+  it("uses client_secret_post when metadata is absent", async () => {
+    const provider = new McpOAuthProvider(
+      "auth-post",
+      serverUrl,
+      { clientId: "my-client", clientSecret: "my-secret" },
+      { onRedirect: async () => {} },
+    );
+    const headers = new Headers();
+    const params = new URLSearchParams({ grant_type: "authorization_code", code: "abc" });
+
+    await provider.addClientAuthentication(headers, params, new URL("https://auth.example.com/token"));
+
+    expect(headers.has("Authorization")).toBe(false);
+    expect(params.get("client_id")).toBe("my-client");
+    expect(params.get("client_secret")).toBe("my-secret");
+  });
+
+  it("does not overwrite token params that are already present", async () => {
+    const provider = new McpOAuthProvider(
+      "auth-no-overwrite",
+      serverUrl,
+      { clientId: "my-client", clientSecret: "my-secret", scope: "api://res/.default" },
+      { onRedirect: async () => {} },
+    );
+    const params = new URLSearchParams({
+      grant_type: "authorization_code",
+      scope: "already-set",
+      client_id: "already-set-id",
+      client_secret: "already-set-secret",
+    });
+
+    await provider.addClientAuthentication(new Headers(), params, new URL("https://auth.example.com/token"));
+
+    expect(params.get("scope")).toBe("already-set");
+    expect(params.get("client_id")).toBe("already-set-id");
+    expect(params.get("client_secret")).toBe("already-set-secret");
+  });
+
+  it("does not add scope to refresh token requests", async () => {
+    const provider = new McpOAuthProvider(
+      "auth-refresh",
+      serverUrl,
+      { clientId: "my-client", scope: "api://res/.default" },
+      { onRedirect: async () => {} },
+    );
+    const params = new URLSearchParams({ grant_type: "refresh_token", refresh_token: "refresh" });
+
+    await provider.addClientAuthentication(new Headers(), params, new URL("https://auth.example.com/token"));
+
+    expect(params.has("scope")).toBe(false);
+    expect(params.get("client_id")).toBe("my-client");
+  });
+});
+
+describe("McpOAuthProvider authorization fallback", () => {
+  const originalOAuthDir = process.env.MCP_OAUTH_DIR;
+  const serverUrl = "https://api.example.com/mcp";
+  let authDir: string;
+
+  beforeEach(() => {
+    authDir = mkdtempSync(join(tmpdir(), "pi-mcp-oauth-provider-"));
+    process.env.MCP_OAUTH_DIR = authDir;
+  });
+
+  afterEach(() => {
+    rmSync(authDir, { recursive: true, force: true });
+    if (originalOAuthDir === undefined) {
+      delete process.env.MCP_OAUTH_DIR;
+    } else {
+      process.env.MCP_OAUTH_DIR = originalOAuthDir;
+    }
+  });
+
+  it("throws UnauthorizedError when state is requested outside a user-initiated flow", async () => {
+    const provider = new McpOAuthProvider("state-missing", serverUrl, {}, { onRedirect: async () => {} });
+
+    await expect(provider.state()).rejects.toBeInstanceOf(UnauthorizedError);
+    await expect(provider.state()).rejects.toThrow(/Re-authentication required/);
+  });
+
+  it("throws UnauthorizedError before redirecting when no OAuth flow is in progress", async () => {
+    let redirected = false;
+    const provider = new McpOAuthProvider("redirect-missing", serverUrl, {}, {
+      onRedirect: async () => {
+        redirected = true;
+      },
+    });
+
+    await expect(provider.redirectToAuthorization(new URL("https://auth.example.com/authorize")))
+      .rejects.toBeInstanceOf(UnauthorizedError);
+    expect(redirected).toBe(false);
+  });
+
+  it("still redirects when startAuth has seeded OAuth state", async () => {
+    const authUrl = new URL("https://auth.example.com/authorize");
+    let redirected: URL | undefined;
+    updateOAuthState("redirect-active", "state-abc", serverUrl);
+    const provider = new McpOAuthProvider("redirect-active", serverUrl, {}, {
+      onRedirect: async (url) => {
+        redirected = url;
+      },
+    });
+
+    await provider.redirectToAuthorization(authUrl);
+
+    expect(redirected).toBe(authUrl);
+  });
+
+  it("throws before redirecting when only stale URL-bound state exists", async () => {
+    let redirected = false;
+    saveAuthEntry("redirect-stale-url", {
+      oauthState: "state-abc",
+      serverUrl: "https://old.example.com/mcp",
+    }, "https://old.example.com/mcp");
+    const provider = new McpOAuthProvider("redirect-stale-url", serverUrl, {}, {
+      onRedirect: async () => {
+        redirected = true;
+      },
+    });
+
+    await expect(provider.redirectToAuthorization(new URL("https://auth.example.com/authorize")))
+      .rejects.toBeInstanceOf(UnauthorizedError);
+    expect(redirected).toBe(false);
+  });
+});

package/mcp/__tests__/mcp-panel-auth.upstream-test.ts

@@ -0,0 +1,206 @@
+import { describe, expect, it, vi } from "vitest";
+import { createMcpPanel } from "../mcp-panel.ts";
+import { computeServerHash, type MetadataCache } from "../metadata-cache.ts";
+import type { McpConfig, McpPanelCallbacks } from "../types.ts";
+
+function stripAnsi(input: string): string {
+  return input.replace(/\x1b\[[0-9;]*m/g, "");
+}
+
+function createCache(config: McpConfig): MetadataCache {
+  return {
+    version: 1,
+    servers: {
+      github: {
+        configHash: computeServerHash(config.mcpServers.github),
+        cachedAt: Date.now(),
+        tools: [{ name: "search", description: "Search" }],
+        resources: [],
+      },
+    },
+  };
+}
+
+function createCallbacks(status: "connected" | "idle" | "failed" | "needs-auth" = "needs-auth") {
+  let currentStatus = status;
+  const callbacks: McpPanelCallbacks = {
+    reconnect: async () => true,
+    canAuthenticate: (serverName) => serverName === "github",
+    authenticate: vi.fn(async () => {
+      currentStatus = "idle";
+      return { ok: true };
+    }),
+    getConnectionStatus: () => currentStatus,
+    refreshCacheAfterReconnect: () => null,
+  };
+  return callbacks;
+}
+
+function deferred<T>() {
+  let resolve!: (value: T) => void;
+  const promise = new Promise<T>((res) => {
+    resolve = res;
+  });
+  return { promise, resolve };
+}
+
+describe("mcp-panel auth actions", () => {
+  it("authenticates a needs-auth server when pressing enter", async () => {
+    const config: McpConfig = {
+      mcpServers: {
+        github: { url: "https://api.githubcopilot.com/mcp", auth: "oauth" },
+      },
+    };
+    const callbacks = createCallbacks("needs-auth");
+    const tui = { requestRender: vi.fn() };
+    const panel = createMcpPanel(config, createCache(config), new Map(), callbacks, tui, () => {});
+
+    panel.handleInput("\r");
+    await Promise.resolve();
+
+    expect(callbacks.authenticate).toHaveBeenCalledWith("github");
+    const output = stripAnsi(panel.render(100).join("\n"));
+    expect(output).toContain("OAuth finished for github");
+    panel.dispose();
+  });
+
+  it("authenticates OAuth-capable idle servers with ctrl+a", async () => {
+    const config: McpConfig = {
+      mcpServers: {
+        github: { url: "https://api.githubcopilot.com/mcp", auth: "oauth" },
+      },
+    };
+    const callbacks = createCallbacks("idle");
+    const panel = createMcpPanel(config, createCache(config), new Map(), callbacks, { requestRender: () => {} }, () => {});
+
+    panel.handleInput("\x01");
+    await Promise.resolve();
+
+    expect(callbacks.authenticate).toHaveBeenCalledWith("github");
+    panel.dispose();
+  });
+
+  it("shows concrete auth failure messages in the panel", async () => {
+    const config: McpConfig = {
+      mcpServers: {
+        github: { url: "https://api.githubcopilot.com/mcp", auth: "oauth" },
+      },
+    };
+    const callbacks = createCallbacks("needs-auth");
+    callbacks.authenticate = vi.fn(async () => ({ ok: false, message: "browser launch failed" }));
+    const panel = createMcpPanel(config, createCache(config), new Map(), callbacks, { requestRender: () => {} }, () => {});
+
+    panel.handleInput("\r");
+    await Promise.resolve();
+
+    const output = stripAnsi(panel.render(100).join("\n"));
+    expect(output).toContain("OAuth failed for github: browser launch failed");
+    panel.dispose();
+  });
+
+  it("does not start duplicate auth while auth is already in flight", async () => {
+    const config: McpConfig = {
+      mcpServers: {
+        github: { url: "https://api.githubcopilot.com/mcp", auth: "oauth" },
+      },
+    };
+    const callbacks = createCallbacks("needs-auth");
+    const auth = deferred<{ ok: boolean }>();
+    callbacks.authenticate = vi.fn(() => auth.promise);
+    const panel = createMcpPanel(config, createCache(config), new Map(), callbacks, { requestRender: () => {} }, () => {});
+
+    panel.handleInput("\r");
+    panel.handleInput("\r");
+    panel.handleInput("\x01");
+
+    expect(callbacks.authenticate).toHaveBeenCalledTimes(1);
+    auth.resolve({ ok: true });
+    await Promise.resolve();
+    panel.dispose();
+  });
+
+  it("filters the auth picker to OAuth-capable servers", () => {
+    const config: McpConfig = {
+      mcpServers: {
+        github: { url: "https://api.githubcopilot.com/mcp", auth: "oauth" },
+        local: { command: "node", args: ["server.js"] },
+      },
+    };
+    const callbacks = createCallbacks("needs-auth");
+    const panel = createMcpPanel(config, null, new Map(), callbacks, { requestRender: () => {} }, () => {}, {
+      authOnly: true,
+      noticeLines: ["Select an OAuth MCP server"],
+    });
+
+    const output = stripAnsi(panel.render(100).join("\n"));
+    expect(output).toContain("MCP OAuth");
+    expect(output).toContain("github");
+    expect(output).not.toContain("local");
+    panel.dispose();
+  });
+
+  it("treats Space as a no-op in auth-only mode", () => {
+    const config: McpConfig = {
+      mcpServers: {
+        github: { url: "https://api.githubcopilot.com/mcp", auth: "oauth" },
+      },
+    };
+    const callbacks = createCallbacks("needs-auth");
+    const panel = createMcpPanel(config, null, new Map(), callbacks, { requestRender: () => {} }, () => {}, {
+      authOnly: true,
+    });
+
+    panel.handleInput(" ");
+
+    expect(callbacks.authenticate).not.toHaveBeenCalled();
+    panel.dispose();
+  });
+
+  it("searches server rows directly in auth-only mode", () => {
+    const config: McpConfig = {
+      mcpServers: {
+        github: { url: "https://api.githubcopilot.com/mcp", auth: "oauth" },
+        gitlab: { url: "https://gitlab.example.com/mcp", auth: "oauth" },
+      },
+    };
+    const callbacks = createCallbacks("needs-auth");
+    callbacks.canAuthenticate = () => true;
+    const panel = createMcpPanel(config, null, new Map(), callbacks, { requestRender: () => {} }, () => {}, {
+      authOnly: true,
+    });
+
+    panel.handleInput("l");
+    panel.handleInput("a");
+    panel.handleInput("b");
+
+    const output = stripAnsi(panel.render(100).join("\n"));
+    expect(output).toContain("gitlab");
+    expect(output).not.toContain("github");
+    panel.dispose();
+  });
+
+  it("ignores description-search shortcut in auth-only mode", () => {
+    const config: McpConfig = {
+      mcpServers: {
+        github: { url: "https://api.githubcopilot.com/mcp", auth: "oauth" },
+        gitlab: { url: "https://gitlab.example.com/mcp", auth: "oauth" },
+      },
+    };
+    const callbacks = createCallbacks("needs-auth");
+    callbacks.canAuthenticate = () => true;
+    const panel = createMcpPanel(config, null, new Map(), callbacks, { requestRender: () => {} }, () => {}, {
+      authOnly: true,
+    });
+
+    panel.handleInput("?");
+    panel.handleInput("l");
+    panel.handleInput("a");
+    panel.handleInput("b");
+
+    const output = stripAnsi(panel.render(100).join("\n"));
+    expect(output).not.toContain("desc:");
+    expect(output).toContain("gitlab");
+    expect(output).not.toContain("github");
+    panel.dispose();
+  });
+});