fix: OAuth handoff recovery and add regression suite

.github/CHANGELOG.md

@@ -8,7 +8,9 @@ For full upstream issue/PR mapping and detailed rationale behind each fix, see [
 ## [Unreleased]
 
 ## [2.1.0] - 2026-09-07
+
 ### Fixed
+
 - Cross-process OAuth coordination when Claude Desktop spawns duplicate `mcp-remote` processes ([#17](https://github.com/abluva/mcp-remote/issues/17)) — exclusive callback-port primary election; secondaries wait for primary tokens instead of racing `code_verifier` / callback writes
 - Secondary OAuth token handoff for non-primary processes
 - Stale dynamic OAuth client registration after port or callback URL changes — re-register only when this process owns coordination
@@ -19,48 +21,63 @@ For full upstream issue/PR mapping and detailed rationale behind each fix, see [
 - Custom header values (e.g. agent keys) appearing in debug logs — values now redacted
 
 ### Added
+
 - No-auth fast path — skip eager OAuth coordination when remote is reachable without authentication
 - Regression tests for Issue #17 cross-process OAuth election
 
 ## [2.0.1]
+
 ### Fixed
+
 - Connect-time recovery when Obot/gateway rejects cached OAuth (`401 after successful authentication`) — invalidate tokens and open browser instead of fatal exit
 
 ## [2.0.0]
+
 ### Added
+
 - MCP `2026-07-28` stateless remote transport (`--protocol auto|legacy|2026-07-28`)
 - POST-only remote transport with stdio bridge shims (`initialize`, `_meta` strip, list-method shims)
 - Local dev OAuth skip for `http://127.0.0.1` / `localhost` MCP URLs
 - SDK bump to `@modelcontextprotocol/sdk` 1.30
 
 ## [0.1.42]
+
 ### Added
+
 - Stronger auto-port selection and stale registration invalidation
 - Always-on callback server (dedicated startup server, `force: true` in proxy mode)
 - `setCallbackPort()` to keep `redirect_uri` synced with the bound listener
 
 ## [0.1.41]
+
 ### Fixed
+
 - Server send errors swallowed, causing Claude to hang (upstream #293, via #297)
 - No `expires_at` tracking causing silent token expiry and broken re-auth (upstream #273, via #290)
 - Token exchange POSTed to the wrong endpoint in proxy mode (upstream #270, via #302)
 
 ### Added
+
 - Regression tests for proxy-mode `finishAuth`
 
 ## [0.1.40]
+
 ### Added
+
 - Auto OAuth callback port selection per MCP server URL
 - Bind retry on `EADDRINUSE`, reducing need for explicit ports in Claude config (upstream #253, #306)
 
 ## [0.1.39]
+
 ### Added
+
 - Initial Abluva release, published as `@abluva/mcp-remote`
 - Mid-session OAuth re-authentication (`onSendError` handling for `UnauthorizedError`, stale refresh, `InvalidRequestError`), based on jacopoc's branch for upstream PR #213
 - Eager callback server — starts before remote connect, stays up for process lifetime
 - Forced re-auth coordination — reuse live listener when possible, skip lockfile delegation
 
 ### Fixed
+
 - Re-issuing OAuth tokens failing on refresh + new grant (upstream #181)
 - Mid-session `tools/call` 401s failing silently — OAuth previously ran only on `initialize` (upstream #286)
 - Runtime re-auth opening the browser but callback server never starting (upstream #248)

.github/CODE_OF_CONDUCT.md

@@ -56,17 +56,18 @@ When an incident does occur, it is important to report it promptly.
 **To report a possible violation:**
 
 **Please do not open a public GitHub issue for security vulnerabilities.**  
-Security flaws in MCP filters or providers handling data-guard logic can have 
+Security flaws in MCP filters or providers handling data-guard logic can have
 serious downstream impact on applications and integrations that depend on them.
 
 ### GitHub Private Vulnerability Reporting (Preferred)
 
 Use GitHub's built-in private reporting:
+
 1. Go to the **Security** tab of this repository
 2. Click **"Report a vulnerability"**
 3. Fill in the details and submit
 
-This is the preferred method as it keeps the disclosure private and allows 
+This is the preferred method as it keeps the disclosure private and allows
 collaborative resolution directly on GitHub.
 
 Community Moderators take reports seriously and will respond in a timely manner. They will investigate all reports by reviewing messages, logs, recordings, or interviewing witnesses and participants.
@@ -85,9 +86,9 @@ If a violation is confirmed, the following enforcement ladder may be used. Sever
 2. **Consequence**: Private written warning
 3. **Repair**:
 
-  * Private apology
-  * Acknowledgment of responsibility
-  * Clarifying expectations
+- Private apology
+- Acknowledgment of responsibility
+- Clarifying expectations
 
 ---
 
@@ -97,9 +98,9 @@ If a violation is confirmed, the following enforcement ladder may be used. Sever
 2. **Consequence**: Warning + temporary cooldown period
 3. **Repair**:
 
-  * Apology
-  * Reflection during cooldown
-  * Careful re-entry into community
+- Apology
+- Reflection during cooldown
+- Careful re-entry into community
 
 ---
 
@@ -109,9 +110,9 @@ If a violation is confirmed, the following enforcement ladder may be used. Sever
 2. **Consequence**: Suspension with return conditions
 3. **Repair**:
 
-  * Respect suspension terms
-  * Meet return conditions
-  * Thoughtful reintegration
+- Respect suspension terms
+- Meet return conditions
+- Thoughtful reintegration
 
 ---
 
@@ -131,14 +132,14 @@ This ladder is a guideline and does not limit moderator discretion.
 
 This Code of Conduct applies:
 
-* Within all community spaces
-* When representing the community publicly
+- Within all community spaces
+- When representing the community publicly
 
 Examples include:
 
-* Using official email addresses
-* Posting via official social media
-* Acting as a representative at events
+- Using official email addresses
+- Posting via official social media
+- Acting as a representative at events
 
 ---
 
@@ -152,5 +153,4 @@ https://creativecommons.org/licenses/by-sa/4.0/
 
 For answers to common questions about Contributor Covenant, see the FAQ at https://www.contributor-covenant.org/faq. Translations are provided at https://www.contributor-covenant.org/translations. Additional enforcement and community guideline resources can be found at https://www.contributor-covenant.org/resources. The enforcement ladder was inspired by the work of Mozilla’s code of conduct team.
 
-
 The enforcement ladder was inspired by Mozilla’s Code of Conduct team.

.github/CONTRIBUTING.md

@@ -51,6 +51,7 @@ npx changeset
 ```
 
 This will prompt you for:
+
 - **Bump type** — `patch` (bug fix), `minor` (new feature, backwards compatible), or `major` (breaking change)
 - **Summary** — a one-line description of the change, written as it should appear in `CHANGELOG.md`
 
@@ -75,6 +76,7 @@ Skip this step only for changes with no user-facing impact (e.g. internal docs,
 ## Reporting bugs
 
 Please include:
+
 - `@abluva/mcp-remote` version
 - Node version
 - MCP client (Claude Desktop, Cursor, Windsurf, etc.) and version

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,7 +1,7 @@
 name: Bug Report
 description: Report something that is not working as expected
-title: "[Bug]: "
-labels: ["bug"]
+title: '[Bug]: '
+labels: ['bug']
 body:
   - type: textarea
     id: description

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,7 +1,7 @@
 name: Feature Request
 description: Suggest a new feature or improvement
-title: "[Feature]: "
-labels: ["enhancement"]
+title: '[Feature]: '
+labels: ['enhancement']
 body:
   - type: textarea
     id: problem

.github/dependabot.yml

@@ -1,25 +1,25 @@
 version: 2
 updates:
-  - package-ecosystem: "npm"
-    directory: "/"
+  - package-ecosystem: 'npm'
+    directory: '/'
     schedule:
-      interval: "weekly"
+      interval: 'weekly'
     open-pull-requests-limit: 10
     labels:
-      - "dependencies"
+      - 'dependencies'
 
-  - package-ecosystem: "npm"
-    directory: "/test"
+  - package-ecosystem: 'npm'
+    directory: '/test'
     schedule:
-      interval: "weekly"
+      interval: 'weekly'
     open-pull-requests-limit: 10
     labels:
-      - "dependencies"
+      - 'dependencies'
 
-  - package-ecosystem: "github-actions"
-    directory: "/"
+  - package-ecosystem: 'github-actions'
+    directory: '/'
     schedule:
-      interval: "weekly"
+      interval: 'weekly'
     labels:
-      - "dependencies"
-      - "github-actions"
+      - 'dependencies'
+      - 'github-actions'

.github/workflows/codeql.yml

@@ -26,4 +26,4 @@ jobs:
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858
         with:
-          category: "/language:javascript-typescript"
+          category: '/language:javascript-typescript'

.github/workflows/scorecard.yml

@@ -2,7 +2,7 @@ name: OpenSSF Scorecard
 
 on:
   push:
-    branches: ["main"]
+    branches: ['main']
   schedule:
     - cron: '0 10 1 * *'
   workflow_dispatch:
@@ -20,18 +20,18 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           persist-credentials: false
 
       - name: Run OpenSSF Scorecard
-        uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 
+        uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186
         with:
           results_file: scorecard-results.sarif
           results_format: sarif
           publish_results: true
 
       - name: Upload to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 
+        uses: github/codeql-action/upload-sarif@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858
         with:
           sarif_file: scorecard-results.sarif