DottaandClaude Opus 5 0c2b2652ea test(server): cover generic remote MCP connections with an OAuth fixture ...

One in-process fetch fixture stands in for an MCP server plus its authorization
server, so the whole generic path — discovery, registration, authorization,
catalog, review, install, revoke — is deterministic and needs no network or
vendor credentials. Every case deliberately connects by URL and never names a
gallery app, and asserts the connection carries no `sourceTemplateKey`, so a
regression that reintroduced a dependency on curated metadata would fail here.

Covers public/bearer/custom-header endpoints, the four registration tiers and
their preference order, RFC 8707 `resource` on authorize and token, RFC 8414 and
OIDC-suffix discovery for a pathful issuer, `iss` acceptance and mismatch,
re-registration on a moved callback, refusal to auto-re-register over an
operator-supplied client, SSRF rejection, company isolation, secret redaction in
config/refs/API readback, and a client metadata document with no tenant data.

The manual-client binding test caught a real bug: a pasted client's callback was
never stamped on first use, so its binding check would have accepted any
callback forever. Fixed alongside.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-20 21:20:01 +00:00

..

scripts

fix(server): stamp built commit into service.version (#11748)

2026-08-19 21:20:40 -07:00

src

test(server): cover generic remote MCP connections with an OAuth fixture

2026-08-20 21:20:01 +00:00

CHANGELOG.md

fix: bound workspace Git scans (#11572)

2026-08-17 22:11:30 -05:00

package.json

feat: add kimi-local adapter for Kimi Code CLI (CLI + ACP engines) (#9967)

2026-08-20 12:06:33 -07:00

tsconfig.json

Fix root TypeScript solution config

2026-03-09 14:09:30 -05:00

vitest.config.ts

feat(workspaces): sign the workspace login handoff and gate readiness (#11671)

2026-08-19 02:37:02 -05:00