fix(mcp): bump @modelcontextprotocol/sdk to 1.32.x

package.json

@@ -105,7 +105,7 @@
     "@intx/tools-posix": "workspace:*",
     "@intx/types": "workspace:*",
     "@intx/workflow-host": "0.3.0",
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.32.1",
     "@opentui/core": "0.6.4",
     "arktype": "catalog:",
     "isomorphic-git": "catalog:",

src/mcp/auth-store.test.ts

@@ -208,6 +208,52 @@ describe("mcp auth-store", () => {
     );
   });
 
+  test("persists the SDK's nested issuer stamps unchanged", async () => {
+    const home = await tempHome();
+    await saveAuthState(
+      linear,
+      {
+        clientInformation: {
+          client_id: "c1",
+          redirect_uris: ["http://127.0.0.1:1/callback"],
+          issuer: "https://as.example",
+        },
+        tokens: {
+          access_token: "tok",
+          token_type: "bearer",
+          issuer: "https://as.example",
+        },
+      },
+      home,
+    );
+    const final = await loadAuthState(linear, home);
+    expect(final.tokens?.access_token).toBe("tok");
+    expect(final.tokens?.issuer).toBe("https://as.example");
+    expect(final.clientInformation?.client_id).toBe("c1");
+    expect(final.clientInformation?.issuer).toBe("https://as.example");
+  });
+
+  test("loads legacy credentials saved before issuer stamps", async () => {
+    const home = await tempHome();
+    // Pre-1.31 shape: no binding yet; the SDK consumes these as-is and
+    // re-stamps on first successful use, so loading must not require the key
+    // or invent one.
+    await saveAuthState(
+      linear,
+      {
+        tokens: {
+          access_token: "tok",
+          token_type: "bearer",
+          refresh_token: "r",
+        },
+      },
+      home,
+    );
+    const final = await loadAuthState(linear, home);
+    expect(final.tokens?.access_token).toBe("tok");
+    expect(final.tokens?.issuer).toBeUndefined();
+  });
+
   test("ignores legacy name-only auth state without modifying it", async () => {
     const home = await tempHome();
     const dir = join(home, ".corbits", "mcp-auth");

src/mcp/auth-store.ts

@@ -25,6 +25,16 @@ const logger = getLogger([LOG_NAMESPACE_ROOT, "mcp", "auth-store"]);
 // Per-server OAuth state. The durable pair — registered client info and
 // tokens — reaches disk; the PKCE verifier stays instance-local in the
 // provider. Legacy codeVerifier keys are stripped on write.
+//
+// Issuer binding (SDK >= 1.31): tokens and client information carry a nested
+// `issuer`, the authorization server they belong to; both are persisted
+// unchanged in that nested shape, not as separate fields. Stores saved before
+// the stamp have no `issuer` key and still load — `issuer` is optional on
+// both — and the SDK consumes unstamped credentials as-is, re-stamping them
+// on the next successful auth or refresh. Stamping at read time is
+// deliberately not done: the persisted epoch predates binding, so the
+// authorization server cannot be reconstructed without discovery and a wrong
+// guess would make the SDK discard valid credentials.
 export interface MCPAuthState {
   clientInformation?: OAuthClientInformationFull;
   tokens?: OAuthTokens;

src/mcp/client-auth-policy.test.ts

@@ -184,7 +184,9 @@ describe("HTTP MCP auth policy", () => {
     });
     expect(callbackStarts).toBe(0);
     expect(providerCreates).toBe(0);
-    expect(transportOptions).toEqual([undefined]);
+    // No signal and no provider: leave redirectPolicy unset so the SDK
+    // default `same-origin` applies. Do not pin `follow`.
+    expect(transportOptions).toEqual([{}]);
   });
 
   test("closes a bound OAuth callback server when provider setup fails", async () => {

src/mcp/client-redirect-policy.test.ts

@@ -0,0 +1,109 @@
+import { mkdtemp } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { describe, expect, test } from "bun:test";
+import { saveAuthState } from "./auth-store.js";
+import { streamableHTTPTransportOptions } from "./client.js";
+import { createOAuthProvider } from "./oauth-provider.js";
+
+const SERVER_URL = "https://mcp.example/mcp";
+const OFF_ORIGIN = "https://evil.example/collect";
+
+function json(body: unknown): Response {
+  return new Response(JSON.stringify(body), {
+    status: 200,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+describe("HTTP MCP redirect policy", () => {
+  test("discovery and token fetches do not follow a cross-origin redirect", async () => {
+    const home = await mkdtemp(join(tmpdir(), "mcp-redirect-"));
+    const identity = { serverName: "example", serverURL: SERVER_URL };
+    await saveAuthState(
+      identity,
+      {
+        clientInformation: {
+          client_id: "client",
+          redirect_uris: ["http://127.0.0.1:1/callback"],
+          client_id_issued_at: 1,
+          token_endpoint_auth_method: "none",
+          grant_types: ["authorization_code", "refresh_token"],
+          response_types: ["code"],
+          client_name: "interchange-code",
+        },
+      },
+      home,
+    );
+    const provider = await createOAuthProvider({
+      serverName: identity.serverName,
+      serverURL: identity.serverURL,
+      redirectUrl: "http://127.0.0.1:1/callback",
+      onAuthURL: () => undefined,
+      home,
+    });
+    await provider.saveCodeVerifier("verifier");
+
+    const abort = new AbortController();
+    const options = streamableHTTPTransportOptions(provider, abort.signal);
+    expect(options).not.toHaveProperty("redirectPolicy");
+
+    const requested: string[] = [];
+    const fetchFn = async (
+      url: string | URL,
+      init?: RequestInit,
+    ): Promise<Response> => {
+      const href = String(url);
+      requested.push(href);
+      const target = new URL(href);
+      if (target.hostname === "evil.example") {
+        return new Response("collected", { status: 200 });
+      }
+      const crossOrigin =
+        target.pathname === "/.well-known/oauth-protected-resource/mcp" ||
+        target.pathname === "/oauth/token";
+      if (!crossOrigin) {
+        if (target.pathname === "/.well-known/oauth-protected-resource") {
+          return json({
+            resource: SERVER_URL,
+            authorization_servers: ["https://mcp.example"],
+          });
+        }
+        if (target.pathname === "/.well-known/oauth-authorization-server") {
+          return json({
+            issuer: "https://mcp.example",
+            authorization_endpoint: "https://mcp.example/authorize",
+            token_endpoint: "https://mcp.example/oauth/token",
+            response_types_supported: ["code"],
+          });
+        }
+        return new Response(null, { status: 404 });
+      }
+      const redirect = new Response(null, {
+        status: 308,
+        headers: { location: OFF_ORIGIN },
+      });
+      const mode = init?.redirect ?? "follow";
+      if (mode === "error") throw new TypeError("redirect mode is error");
+      if (mode === "manual") return redirect;
+      return fetchFn(OFF_ORIGIN, init);
+    };
+
+    const transport = new StreamableHTTPClientTransport(new URL(SERVER_URL), {
+      ...options,
+      fetch: fetchFn,
+    });
+    await expect(transport.finishAuth("auth-code")).rejects.toThrow();
+
+    expect(requested.some((href) => href.includes("evil.example"))).toBe(false);
+    expect(
+      requested.some((href) =>
+        href.includes("/.well-known/oauth-protected-resource/mcp"),
+      ),
+    ).toBe(true);
+    expect(requested.some((href) => href.includes("/oauth/token"))).toBe(true);
+    const tokenPost = requested.find((href) => href.includes("/oauth/token"));
+    expect(tokenPost?.startsWith("https://mcp.example/")).toBe(true);
+  });
+});

src/mcp/client.ts

@@ -405,11 +405,13 @@ export function fetchWithConnectAbort(
   };
 }
 
-function streamableHTTPTransportOptions(
+export function streamableHTTPTransportOptions(
   authProvider: CorbitsOAuthProvider | undefined,
   signal: AbortSignal | undefined,
 ) {
-  if (authProvider === undefined && signal === undefined) return undefined;
+  // Leave redirectPolicy unset. SDK 1.32 defaults to `same-origin`; `follow`
+  // also wraps OAuth discovery and token requests, so a 307/308 can post
+  // refresh tokens or auth codes to another host.
   return {
     ...(authProvider === undefined ? {} : { authProvider }),
     ...(signal === undefined

src/mcp/oauth-provider.test.ts

@@ -767,7 +767,7 @@ describe("createOAuthProvider", () => {
     ).toBe("scoped-secret");
   });
 
-  test("refreshToken posts grant_type=refresh_token with a resource and persists tokens", async () => {
+  test("refreshToken posts grant_type=refresh_token with a resource and persists issuer-bound tokens", async () => {
     const home = await tempHome();
     await saveAuthState(
       linear,
@@ -807,6 +807,7 @@ describe("createOAuthProvider", () => {
 
     const tokens = await provider.refreshToken("refresh-me");
     expect(tokens.access_token).toBe("fresh-access");
+    expect(tokens.issuer).toBe("https://mcp.linear.app");
     expect(tokenBodies).toHaveLength(1);
     const body = tokenBodies[0] ?? "";
     expect(body).toContain("grant_type=refresh_token");
@@ -820,6 +821,9 @@ describe("createOAuthProvider", () => {
     expect((await loadAuthState(linear, home)).tokens?.access_token).toBe(
       "fresh-access",
     );
+    expect((await loadAuthState(linear, home)).tokens?.issuer).toBe(
+      "https://mcp.linear.app",
+    );
   });
 
   test("refreshToken wraps failures as UnauthorizedError", async () => {

src/mcp/oauth-provider.ts

@@ -312,10 +312,19 @@ export async function createOAuthProvider(
           resource: resourceURL,
           ...(fetchFn === undefined ? {} : { fetchFn }),
         });
+        // SDK >= 1.31 binds stored credentials to their authorization server
+        // via an `issuer` stamp; the transport's auth() stamps its own saves,
+        // so refresh here must too — unstamped tokens would re-trigger the
+        // SDK's stored-tokens-without-issuer deprecation warning on the next
+        // auth() and stay unbound.
+        const boundTokens: OAuthTokens = {
+          ...tokens,
+          issuer: authorizationServerUrl,
+        };
         await apply((state) => {
-          state.tokens = tokens;
+          state.tokens = boundTokens;
         });
-        return tokens;
+        return boundTokens;
       } catch (err) {
         if (isAbortError(err) || err instanceof UnauthorizedError) throw err;
         throw new UnauthorizedError(