Invalid state parameter. Please try again.
You can close this window.
"),G(),J(Error("OAuth state mismatch - possible CSRF attack"));return}if(w){F.writeHead(200,{"Content-Type":"text/html"});let O=aZA.default(String(w)),x=_?aZA.default(String(_)):"";F.end(`${O}: ${x}
You can close this window.
`),G();let u=`OAuth error: ${w}`;if(_)u+=` - ${_}`;if(z)u+=` (See: ${z})`;J(Error(u));return}if(C)F.writeHead(200,{"Content-Type":"text/html"}),F.end("You can close this window. Return to Claude Code.
"),G(),X(C)}}),E.listen(I,async()=>{try{NA(H,"Starting SDK auth"),NA(H,`Server URL: ${$.url}`);let W=await Iz(B,{serverUrl:$.url});if(NA(H,`Initial auth result: ${W}`),W!=="REDIRECT")NA(H,`Unexpected auth result, expected REDIRECT: ${W}`)}catch(W){NA(H,`SDK auth error: ${W}`),G(),J(W)}}),M=setTimeout(()=>{G(),J(Error("Authentication timeout"))},300000)});try{NA(H,"Completing auth flow with authorization code");let X=await Iz(B,{serverUrl:$.url,authorizationCode:U});if(NA(H,`Auth result: ${X}`),X==="AUTHORIZED"){let J=await B.tokens();if(NA(H,`Tokens after auth: ${J?"Present":"Missing"}`),J)NA(H,`Token access_token length: ${J.access_token?.length}`),NA(H,`Token expires_in: ${J.expires_in}`);l("tengu_mcp_oauth_flow_success",{transportType:$.type,...Y4($)?{mcpServerBaseUrl:Y4($)}:{}})}else throw Error("Unexpected auth result: "+X)}catch(X){if(NA(H,`Error during auth completion: ${X}`),HL.isAxiosError(X))try{let J=yW$.parse(X.response?.data);if(J.error==="invalid_client"&&J.error_description?.includes("Client not found")){let W=Y6(),F=W.read()||{},V=qBH(H,$);if(F.mcpOAuth?.[V])delete F.mcpOAuth[V].clientId,delete F.mcpOAuth[V].clientSecret,W.update(F)}}catch{}throw l("tengu_mcp_oauth_flow_error",{transportType:$.type,...Y4($)?{mcpServerBaseUrl:Y4($)}:{}}),X}}class OBH{serverName;serverConfig;redirectUri;handleRedirection;_codeVerifier;_authorizationUrl;_state;_scopes;_metadata;_refreshInProgress;onAuthorizationUrlCallback;constructor(H,$,A=_eI(),L=!1,I){this.serverName=H,this.serverConfig=$,this.redirectUri=A,this.handleRedirection=L,this.onAuthorizationUrlCallback=I}get redirectUrl(){return this.redirectUri}get authorizationUrl(){return this._authorizationUrl}get clientMetadata(){let H={client_name:`Claude Code (${this.serverName})`,redirect_uris:[this.redirectUri],grant_types:["authorization_code","refresh_token"],response_types:["code"],token_endpoint_auth_method:"none"},$=sZA(this._metadata);if($)H.scope=$,NA(this.serverName,`Using scope from metadata: ${H.scope}`);return H}setMetadata(H){this._metadata=H}async state(){if(!this._state)this._state=bF$.randomBytes(32).toString("base64url"),NA(this.serverName,"Generated new OAuth state");return this._state}async clientInformation(){let $=Y6().read(),A=qBH(this.serverName,this.serverConfig),L=$?.mcpOAuth?.[A];if(L?.clientId)return NA(this.serverName,"Found client info"),{client_id:L.clientId,client_secret:L.clientSecret};NA(this.serverName,"No client info found");return}async saveClientInformation(H){let $=Y6(),A=$.read()||{},L=qBH(this.serverName,this.serverConfig),I={...A,mcpOAuth:{...A.mcpOAuth,[L]:{...A.mcpOAuth?.[L],serverName:this.serverName,serverUrl:this.serverConfig.url,clientId:H.client_id,clientSecret:H.client_secret,accessToken:A.mcpOAuth?.[L]?.accessToken||"",expiresAt:A.mcpOAuth?.[L]?.expiresAt||0}}};$.update(I)}async tokens(){let $=Y6().read(),A=qBH(this.serverName,this.serverConfig),L=$?.mcpOAuth?.[A];if(!L){NA(this.serverName,"No token data found");return}let I=(L.expiresAt-Date.now())/1000;if(I<=0&&!L.refreshToken){NA(this.serverName,"Token expired without refresh token");return}if(I<=300&&L.refreshToken){if(!this._refreshInProgress)NA(this.serverName,`Token expires in ${Math.floor(I)}s, attempting proactive refresh`),this._refreshInProgress=this.refreshAuthorization(L.refreshToken).finally(()=>{this._refreshInProgress=void 0});else NA(this.serverName,"Token refresh already in progress, reusing existing promise");try{let B=await this._refreshInProgress;if(B)return NA(this.serverName,"Token refreshed successfully"),B;NA(this.serverName,"Token refresh failed, returning current tokens")}catch(B){NA(this.serverName,`Token refresh error: ${B instanceof Error?B.message:String(B)}`)}}let D={access_token:L.accessToken,refresh_token:L.refreshToken,expires_in:I,scope:L.scope,token_type:"Bearer"};return NA(this.serverName,"Returning tokens"),NA(this.serverName,`Token length: ${D.access_token?.length}`),NA(this.serverName,`Has refresh token: ${!!D.refresh_token}`),NA(this.serverName,`Expires in: ${Math.floor(I)}s`),D}async saveTokens(H){let $=Y6(),A=$.read()||{},L=qBH(this.serverName,this.serverConfig);NA(this.serverName,"Saving tokens"),NA(this.serverName,`Token expires in: ${H.expires_in}`),NA(this.serverName,`Has refresh token: ${!!H.refresh_token}`);let I={...A,mcpOAuth:{...A.mcpOAuth,[L]:{...A.mcpOAuth?.[L],serverName:this.serverName,serverUrl:this.serverConfig.url,accessToken:H.access_token,refreshToken:H.refresh_token,expiresAt:Date.now()+(H.expires_in||3600)*1000,scope:H.scope}}};$.update(I)}async redirectToAuthorization(H){this._authorizationUrl=H.toString();let $=H.searchParams.get("scope");if(NA(this.serverName,`Authorization URL: ${YeI(H.toString())}`),NA(this.serverName,`Scopes in URL: ${$||"NOT FOUND"}`),$)this._scopes=$,NA(this.serverName,`Captured scopes from authorization URL: ${$}`);else{let D=sZA(this._metadata);if(D)this._scopes=D,NA(this.serverName,`Using scopes from metadata: ${D}`);else NA(this.serverName,"No scopes available from URL or metadata")}if(!this.handleRedirection){NA(this.serverName,"Redirection handling is disabled, skipping redirect");return}let A=H.toString();if(!A.startsWith("http://")&&!A.startsWith("https://"))throw Error("Invalid authorization URL: must use http:// or https:// scheme");NA(this.serverName,"Redirecting to authorization URL");let L=YeI(A);if(NA(this.serverName,`Authorization URL: ${L}`),this.onAuthorizationUrlCallback)this.onAuthorizationUrlCallback(A);if(NA(this.serverName,`Opening authorization URL: ${L}`),!await tf(A))NA(this.serverName,"Browser didn't open automatically. URL is shown in UI.")}async saveCodeVerifier(H){NA(this.serverName,"Saving code verifier"),this._codeVerifier=H}async codeVerifier(){if(!this._codeVerifier)throw NA(this.serverName,"No code verifier saved"),Error("No code verifier saved");return NA(this.serverName,"Returning code verifier"),this._codeVerifier}async refreshAuthorization(H){for(let A=1;A<=3;A++)try{NA(this.serverName,"Starting token refresh");let L=vb9(),I=await tyH(new URL(this.serverConfig.url),{fetchFn:L});if(!I){NA(this.serverName,"Failed to discover OAuth metadata");return}let D=await this.clientInformation();if(!D){NA(this.serverName,"No client information available");return}let B=await XQA(new URL(this.serverConfig.url),{metadata:I,clientInformation:D,refreshToken:H,resource:new URL(this.serverConfig.url),fetchFn:L});if(B)return NA(this.serverName,"Token refresh successful"),await this.saveTokens(B),B;NA(this.serverName,"Token refresh returned no tokens");return}catch(L){let I=L instanceof Error&&/timeout|timed out|etimedout|econnreset/i.test(L.message),D=L instanceof Mb||L instanceof uKH||L instanceof gKH;if(!(I||D)||A>=3){NA(this.serverName,`Token refresh failed: ${L instanceof Error?L.message:String(L)}`);return}let f=1000*Math.pow(2,A-1);NA(this.serverName,`Token refresh failed, retrying in ${f}ms (attempt ${A}/3)`),await new Promise((E)=>setTimeout(E,f))}return}}function sZA(H){if(!H)return;if("scope"in H&&typeof H.scope==="string")return H.scope;if("default_scope"in H&&typeof H.default_scope==="string")return H.default_scope;if(H.scopes_supported&&Array.isArray(H.scopes_supported))return H.scopes_supported.join(" ");return}var jF$,weI,aZA,bF$,jb9=30000,bb9,OFH,hb9,tZA=3118;var ejH=K(()=>{wF$();x$();jW$();syH();BQA();aC();a1();W$();wK();T9();C$();jF$=require("http"),weI=require("url"),aZA=y(ZeI(),1),bF$=require("crypto"),bb9=["state","nonce","code_challenge","code_verifier","code"];OFH=class OFH extends Error{constructor(){super("Authentication was cancelled");this.name="AuthenticationCancelledError"}};hb9=lA()==="windows"?{min:39152,max:49151}:{min:49152,max:65535}});function gb9(H){return H.scope==="project"||H.scope==="local"}async function mb9(H,$){if(!$.headersHelper)return null;if("scope"in $&&gb9($)&&!qD()){if(!YG(!0)){let L=Error(`Security: headersHelper for MCP server '${H}' executed before workspace trust is confirmed. If you see this message, post in ${{ISSUES_EXPLAINER:"report the issue at https://github.com/anthropics/claude-code/issues",PACKAGE_URL:"@anthropic-ai/claude-code",README_URL:"https://code.claude.com/docs/en/overview",VERSION:"2.1.20",FEEDBACK_CHANNEL:"https://github.com/anthropics/claude-code/issues",BUILD_TIME:"2026-01-27T00:39:12Z"}.FEEDBACK_CHANNEL}.`);return Y_("MCP headersHelper invoked before trust check",L),l("tengu_mcp_headersHelper_missing_trust",{}),null}}try{NA(H,"Executing headersHelper to get dynamic headers");let A=await WD($.headersHelper,[],{shell:!0,timeout:1e4});if(A.code!==0||!A.stdout)throw Error(`headersHelper for MCP server '${H}' did not return a valid value`);let L=A.stdout.trim(),I=HA(L);if(typeof I!=="object"||I===null||Array.isArray(I))throw Error(`headersHelper for MCP server '${H}' must return a JSON object with string key-value pairs`);for(let[D,B]of Object.entries(I))if(typeof B!=="string")throw Error(`headersHelper for MCP server '${H}' returned non-string value for key "${D}": ${typeof B}`);return NA(H,`Successfully retrieved ${Object.keys(I).length} headers from headersHelper`),I}catch(A){return DE(H,`Error getting headers from headersHelper: ${A instanceof Error?A.message:String(A)}`),n(Error(`Error getting MCP headers from headersHelper for server '${H}': ${A instanceof Error?A.message:String(A)}`)),null}}async function hF$(H,$){let A=$.headers||{},L=await mb9(H,$)||{};return{...A,...L}}var zeI=K(()=>{mB();gA();W$();I$();x$();p$();C$()});class H3A{serverName;sendMcpMessage;isClosed=!1;onclose;onerror;onmessage;constructor(H,$){this.serverName=H;this.sendMcpMessage=$}async start(){}async send(H){if(this.isClosed)throw Error("Transport is closed");let $=await this.sendMcpMessage(this.serverName,H);if(this.onmessage)this.onmessage($)}async close(){if(this.isClosed)return;this.isClosed=!0,this.onclose?.()}}function pb9(H,$,A){let L=H.tabId;if(typeof L==="number")lcI(L);let I=[];switch($){case"navigate":if(typeof H.url==="string")try{let D=new URL(H.url);I.push(D.hostname)}catch{I.push(HbH(H.url,30))}break;case"find":if(typeof H.query==="string")I.push(`pattern: ${HbH(H.query,30)}`);break;case"computer":if(typeof H.action==="string"){let D=H.action;if(D==="left_click"||D==="right_click"||D==="double_click"||D==="middle_click")if(typeof H.ref==="string")I.push(`${D} on ${H.ref}`);else if(Array.isArray(H.coordinate))I.push(`${D} at (${H.coordinate.join(", ")})`);else I.push(D);else if(D==="type"&&typeof H.text==="string")I.push(`type "${HbH(H.text,15)}"`);else if(D==="key"&&typeof H.text==="string")I.push(`key ${H.text}`);else if(D==="scroll"&&typeof H.scroll_direction==="string")I.push(`scroll ${H.scroll_direction}`);else if(D==="wait"&&typeof H.duration==="number")I.push(`wait ${H.duration}s`);else if(D==="left_click_drag")I.push("drag");else I.push(D)}break;case"gif_creator":if(typeof H.action==="string")I.push(`${H.action}`);break;case"resize_window":if(typeof H.width==="number"&&typeof H.height==="number")I.push(`${H.width}x${H.height}`);break;case"read_console_messages":if(typeof H.pattern==="string")I.push(`pattern: ${HbH(H.pattern,20)}`);if(H.onlyErrors===!0)I.push("errors only");break;case"read_network_requests":if(typeof H.urlPattern==="string")I.push(`pattern: ${HbH(H.urlPattern,20)}`);break;case"shortcuts_execute":if(typeof H.shortcutId==="string")I.push(`shortcut_id: ${H.shortcutId}`);break;case"javascript_tool":if(A&&typeof H.text==="string")return H.text;return"";case"tabs_create_mcp":case"tabs_context_mcp":case"form_input":case"shortcuts_list":case"read_page":case"upload_image":case"get_page_text":case"update_plan":return""}return I.join(", ")||null}function cb9(H){if(!QN())return null;if(typeof H!=="object"||H===null||!("tabId"in H))return null;let $=typeof H.tabId==="number"?H.tabId:typeof H.tabId==="string"?parseInt(H.tabId,10):NaN;if(isNaN($))return null;let A=`${db9}${$}`;return ES.createElement(q,{flexWrap:"nowrap",marginLeft:1},ES.createElement(LD,{url:A},ES.createElement(Q,{color:"subtle"},"[View Tab]")))}function lb9(H,$,A){if(A)return ZF$(H,[],{verbose:A});let L=null;switch($){case"navigate":L="Navigation completed";break;case"tabs_create_mcp":L="Tab created";break;case"tabs_context_mcp":L="Tabs read";break;case"form_input":L="Input completed";break;case"computer":L="Action completed";break;case"resize_window":L="Window resized";break;case"find":L="Search completed";break;case"gif_creator":L="GIF action completed";break;case"read_console_messages":L="Console messages retrieved";break;case"read_network_requests":L="Network requests retrieved";break;case"shortcuts_list":L="Shortcuts retrieved";break;case"shortcuts_execute":L="Shortcut executed";break;case"javascript_tool":L="Script executed";break;case"read_page":L="Page read";break;case"upload_image":L="Image uploaded";break;case"get_page_text":L="Page text retrieved";break;case"update_plan":L="Plan updated";break}if(L)return ES.createElement(KA,{height:1},ES.createElement(Q,{dimColor:!0},L));return null}function TeI(H){return{userFacingName($){return`Claude in Chrome[${H.replace(/_mcp$/,"")}]`},renderToolUseMessage($,{verbose:A}){return pb9($,H,A)},renderToolUseTag($){return cb9($)},renderToolResultMessage($,A,{verbose:L}){if(!ib9($))return null;return lb9($,H,L)}}}function HbH(H,$){return H.length>$?H.slice(0,$)+"\u2026":H}function ib9(H){return typeof H==="object"&&H!==null}var ES,db9="https://clau.de/chrome/tab/";var qeI=K(()=>{NH();C0();YLH();dZA();oO();ES=y(a(),1)});function kF$(){return parseInt(process.env.MCP_TIMEOUT||"",10)||30000}function $3A(H){return async($,A)=>{if((A?.method??"GET").toUpperCase()==="GET")return H($,A);let I=AbortSignal.timeout(xeI);if(!A?.signal)return H($,{...A,signal:I});let D=new AbortController,B=()=>D.abort();A.signal.addEventListener("abort",B),I.addEventListener("abort",B);let f=()=>{A.signal?.removeEventListener("abort",B),I.removeEventListener("abort",B)};if(A.signal.aborted)D.abort();try{let E=await H($,{...A,signal:D.signal});return f(),E}catch(E){throw f(),E}}}function I3A(){return parseInt(process.env.MCP_SERVER_CONNECTION_BATCH_SIZE||"",10)||3}function rb9(){return parseInt(process.env.MCP_REMOTE_SERVER_CONNECTION_BATCH_SIZE||"",10)||20}function OeI(H){return!H.type||H.type==="stdio"||H.type==="sdk"}function ab9(H){return!H.name.startsWith("mcp__ide__")||ob9.includes(H.name)}function L3A(H,$){return`${H}-${RH($)}`}async function wb(H,$){let A=L3A(H,$);try{let L=await Qz(H,$);if(L.type==="connected")await L.cleanup()}catch{}Qz.cache.delete(A)}async function NFH(H){if(H.config.type==="sdk")return H;let $=await Qz(H.name,H.config);if($.type!=="connected")throw new Uk(`MCP server "${H.name}" is not connected`);return $}function ReI(H,$){if(H.type!==$.type)return!1;let{scope:A,...L}=H,{scope:I,...D}=$;return RH(L)===RH(D)}async function Ym(H,$,A){return(await jeI({client:A,tool:H,args:$,signal:mD().signal})).content}async function _b(H,$){try{await wb(H,$);let A=await Qz(H,$);if(A.type!=="connected")return{client:A,tools:[],commands:[]};let L=!!A.capabilities?.resources,[I,D,B]=await Promise.all([MS(A),AbH(A),L?$bH(A):Promise.resolve([])]),f=[];if(L){if(![Cm,Zm].some((M)=>I.some((G)=>G.name===M.name)))f.push(Cm,Zm)}return{client:A,tools:[...I,...f],commands:D,resources:B.length>0?B:void 0}}catch(A){return DE(H,`Error during reconnection: ${A instanceof Error?A.message:String(A)}`),{client:{name:H,type:"failed",config:$},tools:[],commands:[]}}}async function SeI(H,$,A){for(let L=0;L