Merge branch 'main' into feat/add-client-connection-options

Author: its-mash

Cargo.lock

@@ -58,7 +58,7 @@ os_pipe = "1"
 
 # MCP Protocol
 # NOTE: Never use local path dependency - E:\one-mcp\rust-sdk is for source lookup only
-rmcp = { version = "0.15.0", features = [
+rmcp = { version = "0.17.0", features = [
     "client",
     "server",
     "transport-io",
@@ -69,7 +69,7 @@ rmcp = { version = "0.15.0", features = [
 ] }
 
 # HTTP
-reqwest = { version = "0.12", features = ["json", "rustls-tls"] }
+reqwest = { version = "0.13", features = ["json", "form", "rustls"] }
 axum = { version = "0.8", features = ["macros"] }
 http-body-util = "0.1"
 
@@ -84,9 +84,4 @@ lto = true
 codegen-units = 1
 strip = true
 
-# Temporary patch: fixes SSE channel replacement bug (notifications lost on reconnect)
-# Remove once upstream merges https://github.com/modelcontextprotocol/rust-sdk/pull/660
-[patch.crates-io]
-rmcp = { git = "https://github.com/mcpmux/rust-sdk.git", branch = "fix/sse-channel-replacement-conflict" }
-
 

Cargo.toml

@@ -668,28 +668,25 @@ pub async fn get_oauth_clients(
     // Map to response format
     let client_infos: Vec<OAuthClientInfo> = clients
         .into_iter()
-        .map(|client| {
-            OAuthClientInfo {
-                client_id: client.client_id,
-                registration_type: client.registration_type.as_str().to_string(),
-                client_name: client.client_name,
-                client_alias: client.client_alias,
-                redirect_uris: client.redirect_uris,
-                scope: client.scope,
-                approved: client.approved,
-                logo_uri: client.logo_uri,
-                client_uri: client.client_uri,
-                software_id: client.software_id,
-                software_version: client.software_version,
-                metadata_url: client.metadata_url,
-                metadata_cached_at: client.metadata_cached_at,
-                metadata_cache_ttl: client.metadata_cache_ttl,
-                connection_mode: client.connection_mode,
-                locked_space_id: client.locked_space_id,
-                last_seen: client.last_seen,
-                created_at: client.created_at,
-                has_active_tokens: false, // TODO: Check if client has active tokens
-            }
+        .map(|client| OAuthClientInfo {
+            client_id: client.client_id,
+            registration_type: client.registration_type.as_str().to_string(),
+            client_name: client.client_name,
+            client_alias: client.client_alias,
+            redirect_uris: client.redirect_uris,
+            scope: client.scope,
+            approved: client.approved,
+            logo_uri: client.logo_uri,
+            client_uri: client.client_uri,
+            software_id: client.software_id,
+            software_version: client.software_version,
+            metadata_url: client.metadata_url,
+            metadata_cached_at: client.metadata_cached_at,
+            metadata_cache_ttl: client.metadata_cache_ttl,
+            connection_mode: client.connection_mode,
+            locked_space_id: client.locked_space_id,
+            last_seen: client.last_seen,
+            created_at: client.created_at,
         })
         .collect();
 
@@ -763,7 +760,6 @@ pub struct OAuthClientInfo {
     pub locked_space_id: Option<String>,
     pub last_seen: Option<String>,
     pub created_at: String,
-    pub has_active_tokens: bool,
 }
 
 /// Request to update client settings
@@ -837,7 +833,6 @@ pub async fn update_oauth_client(
         locked_space_id: updated_client.locked_space_id,
         last_seen: updated_client.last_seen,
         created_at: updated_client.created_at,
-        has_active_tokens: false,
     })
 }
 

apps/desktop/src-tauri/src/commands/oauth.rs

@@ -13,8 +13,6 @@ import {
   Lock,
   Unlock,
   HelpCircle,
-  Wifi,
-  WifiOff,
   RefreshCw,
   Settings,
   Trash2,
@@ -653,21 +651,6 @@ export default function ClientsPage() {
                         </div>
                       </div>
 
-                      {/* Status Badge */}
-                      <div className="mb-4">
-                        <span className={`inline-flex items-center gap-2 text-sm px-3 py-1.5 rounded-full font-medium ${
-                          client.has_active_tokens 
-                            ? 'bg-green-100 dark:bg-green-900/30 text-green-700 dark:text-green-400' 
-                            : 'bg-gray-100 dark:bg-gray-800 text-gray-600 dark:text-gray-400'
-                        }`}>
-                          {client.has_active_tokens ? (
-                            <><Wifi className="h-4 w-4" /> Active</>
-                          ) : (
-                            <><WifiOff className="h-4 w-4" /> Inactive</>
-                          )}
-                        </span>
-                      </div>
-
                       {/* Connection Mode */}
                       <div className="flex items-center gap-2.5 text-sm text-[rgb(var(--foreground))] mb-2">
                         <ModeIcon className={`h-4 w-4 ${modeInfo.color}`} />
@@ -726,25 +709,11 @@ export default function ClientsPage() {
               </button>
             </div>
 
-            {/* Quick Status */}
-            <div className="flex items-center gap-2 flex-wrap">
-              <span className={`inline-flex items-center gap-1.5 text-xs px-2.5 py-1 rounded-full font-medium ${
-                selectedClient.has_active_tokens 
-                  ? 'bg-green-100 dark:bg-green-900/30 text-green-700 dark:text-green-400' 
-                  : 'bg-gray-100 dark:bg-gray-800 text-gray-600 dark:text-gray-400'
-              }`}>
-                {selectedClient.has_active_tokens ? (
-                  <><Wifi className="h-3 w-3" /> Connected</>
-                ) : (
-                  <><WifiOff className="h-3 w-3" /> Inactive</>
-                )}
+            {selectedClient.software_version && (
+              <span className="text-xs text-[rgb(var(--muted))] px-2.5 py-1 bg-[rgb(var(--background))] rounded-full inline-block mt-1">
+                v{selectedClient.software_version}
               </span>
-              {selectedClient.software_version && (
-                <span className="text-xs text-[rgb(var(--muted))] px-2.5 py-1 bg-[rgb(var(--background))] rounded-full">
-                  v{selectedClient.software_version}
-                </span>
-              )}
-            </div>
+            )}
           </div>
 
           {/* Scrollable Content */}

apps/desktop/src/features/clients/ClientsPage.tsx

@@ -131,7 +131,6 @@ export interface OAuthClient {
   locked_space_id: string | null;
   last_seen: string | null;
   created_at: string;
-  has_active_tokens: boolean;
 }
 
 /**

apps/desktop/src/lib/api/gateway.ts

@@ -5,6 +5,7 @@
 //! CredentialStore interface.
 
 use std::sync::Arc;
+use std::time::{SystemTime, UNIX_EPOCH};
 
 use async_trait::async_trait;
 use chrono::{Duration, Utc};
@@ -159,6 +160,19 @@ impl DatabaseCredentialStore {
     }
 }
 
+/// Current time as seconds since UNIX epoch, matching rmcp's `AuthorizationManager::now_epoch_secs()`.
+///
+/// Used when loading credentials from the database: since `build_token_response` recalculates
+/// `expires_in` as remaining time from the stored `expires_at`, setting `token_received_at = now`
+/// makes rmcp's expiry arithmetic correct (`remaining = expires_in - (now - received_at)` = `expires_in`),
+/// enabling proactive token refresh before expiry instead of waiting for a 401.
+fn now_epoch_secs() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
+}
+
 #[async_trait]
 impl CredentialStore for DatabaseCredentialStore {
     async fn load(&self) -> Result<Option<StoredCredentials>, AuthError> {
@@ -208,6 +222,7 @@ impl CredentialStore for DatabaseCredentialStore {
                     client_id: reg.client_id,
                     token_response: Some(token_response),
                     granted_scopes: Vec::new(),
+                    token_received_at: Some(now_epoch_secs()),
                 })
             }
             (Some(reg), None) => {
@@ -219,6 +234,7 @@ impl CredentialStore for DatabaseCredentialStore {
                     client_id: reg.client_id,
                     token_response: None,
                     granted_scopes: Vec::new(),
+                    token_received_at: Some(now_epoch_secs()),
                 })
             }
             (None, Some(access)) => {
@@ -231,6 +247,7 @@ impl CredentialStore for DatabaseCredentialStore {
                     client_id: String::new(),
                     token_response: Some(token_response),
                     granted_scopes: Vec::new(),
+                    token_received_at: Some(now_epoch_secs()),
                 })
             }
             (None, None) => {
@@ -588,6 +605,7 @@ mod tests {
             client_id: "new-client-id".to_string(),
             token_response: Some(token_response),
             granted_scopes: Vec::new(),
+            token_received_at: None,
         };
 
         store.save(credentials).await.unwrap();
@@ -646,6 +664,7 @@ mod tests {
             client_id: "client-id".to_string(),
             token_response: Some(token_response),
             granted_scopes: Vec::new(),
+            token_received_at: None,
         };
 
         store.save(credentials).await.unwrap();

crates/mcpmux-gateway/src/pool/credential_store.rs

@@ -602,12 +602,9 @@ pub async fn oauth_token(
             let client_id_for_tracking = pending.client_id.clone();
             drop(gateway_state);
 
-            // Track that this client has active tokens and emit event
+            // Update last_seen and emit event
             {
-                let mut gateway_state = state.write().await;
-                gateway_state
-                    .clients_with_tokens
-                    .insert(client_id_for_tracking.clone());
+                let gateway_state = state.read().await;
 
                 // Update last_seen in database
                 if let Some(repo) = gateway_state.inbound_client_repository() {
@@ -949,7 +946,6 @@ pub struct OAuthClientInfoResponse {
     pub locked_space_id: Option<String>,
     pub last_seen: Option<String>,
     pub created_at: String,
-    pub has_active_tokens: bool,
 }
 
 /// List all registered OAuth clients
@@ -969,28 +965,24 @@ pub async fn oauth_list_clients(
         Ok(db_clients) => {
             let clients: Vec<OAuthClientInfoResponse> = db_clients
                 .into_iter()
-                .map(|c| {
-                    let has_active = gateway_state.clients_with_tokens.contains(&c.client_id);
-                    OAuthClientInfoResponse {
-                        client_id: c.client_id,
-                        registration_type: c.registration_type.as_str().to_string(),
-                        client_name: c.client_name,
-                        client_alias: c.client_alias,
-                        redirect_uris: c.redirect_uris,
-                        scope: c.scope,
-                        logo_uri: c.logo_uri,
-                        client_uri: c.client_uri,
-                        software_id: c.software_id,
-                        software_version: c.software_version,
-                        metadata_url: c.metadata_url,
-                        metadata_cached_at: c.metadata_cached_at,
-                        metadata_cache_ttl: c.metadata_cache_ttl,
-                        connection_mode: c.connection_mode,
-                        locked_space_id: c.locked_space_id,
-                        last_seen: c.last_seen,
-                        created_at: c.created_at,
-                        has_active_tokens: has_active,
-                    }
+                .map(|c| OAuthClientInfoResponse {
+                    client_id: c.client_id,
+                    registration_type: c.registration_type.as_str().to_string(),
+                    client_name: c.client_name,
+                    client_alias: c.client_alias,
+                    redirect_uris: c.redirect_uris,
+                    scope: c.scope,
+                    logo_uri: c.logo_uri,
+                    client_uri: c.client_uri,
+                    software_id: c.software_id,
+                    software_version: c.software_version,
+                    metadata_url: c.metadata_url,
+                    metadata_cached_at: c.metadata_cached_at,
+                    metadata_cache_ttl: c.metadata_cache_ttl,
+                    connection_mode: c.connection_mode,
+                    locked_space_id: c.locked_space_id,
+                    last_seen: c.last_seen,
+                    created_at: c.created_at,
                 })
                 .collect();
             info!("[OAuth] Listed {} clients from database", clients.len());
@@ -1213,9 +1205,6 @@ pub async fn oauth_update_client(
         .await
     {
         Ok(Some(client)) => {
-            let has_active = gateway_state
-                .clients_with_tokens
-                .contains(&client.client_id);
             let response = OAuthClientInfoResponse {
                 client_id: client.client_id,
                 registration_type: client.registration_type.as_str().to_string(),
@@ -1234,7 +1223,6 @@ pub async fn oauth_update_client(
                 locked_space_id: client.locked_space_id,
                 last_seen: client.last_seen,
                 created_at: client.created_at,
-                has_active_tokens: has_active,
             };
             info!("[OAuth] Client updated: {}", response.client_id);
             Json(response).into_response()
@@ -1264,7 +1252,7 @@ pub async fn oauth_delete_client(
 ) -> Response {
     info!("[OAuth] Deleting client: {}", client_id);
 
-    let mut gateway_state = state.write().await;
+    let gateway_state = state.read().await;
 
     let Some(repo) = gateway_state.inbound_client_repository() else {
         warn!("[OAuth] Database not available for client deletion");
@@ -1273,8 +1261,6 @@ pub async fn oauth_delete_client(
 
     match repo.delete_client(&client_id).await {
         Ok(true) => {
-            // Remove from active tokens set
-            gateway_state.clients_with_tokens.remove(&client_id);
             info!("[OAuth] Client deleted: {}", client_id);
             StatusCode::NO_CONTENT.into_response()
         }

crates/mcpmux-gateway/src/server/handlers.rs

@@ -255,6 +255,7 @@ impl GatewayServer {
             LocalSessionManager::default().into(),
             StreamableHttpServerConfig {
                 stateful_mode: true,
+                json_response: false,
                 sse_keep_alive: Some(std::time::Duration::from_secs(30)),
                 sse_retry: Some(std::time::Duration::from_secs(3)),
                 cancellation_token: CancellationToken::new(),

crates/mcpmux-gateway/src/server/mod.rs

@@ -51,8 +51,6 @@ pub struct GatewayState {
     pub oauth_tokens: HashMap<String, super::super::oauth::OAuthToken>,
     /// Pending authorization codes (code -> PendingAuthorization)
     pub pending_authorizations: HashMap<String, PendingAuthorization>,
-    /// Set of client_ids that have been issued tokens (for "active" status)
-    pub clients_with_tokens: std::collections::HashSet<String>,
     /// JWT signing secret (for issuing access tokens)
     pub jwt_signing_secret: Option<Zeroizing<[u8; JWT_SECRET_SIZE]>>,
     /// Database connection (for persistent OAuth storage)
@@ -74,7 +72,6 @@ impl GatewayState {
             access_keys: HashMap::new(),
             oauth_tokens: HashMap::new(),
             pending_authorizations: HashMap::new(),
-            clients_with_tokens: std::collections::HashSet::new(),
             jwt_signing_secret: None,
             db: None,
             inbound_client_repository: None,

crates/mcpmux-gateway/src/server/state.rs

@@ -138,8 +138,8 @@ const FEATURE_SETS = [
 ];
 
 const OAUTH_CLIENTS = [
-  { client_id: 'cursor-001', registration_type: 'dcr', client_name: 'Cursor', client_alias: null, redirect_uris: ['http://localhost:9315/callback'], scope: null, approved: true, logo_uri: null, client_uri: null, software_id: 'cursor', software_version: '0.45.0', metadata_url: null, metadata_cached_at: null, metadata_cache_ttl: null, connection_mode: 'follow_active', locked_space_id: null, last_seen: '2026-02-07T09:30:00Z', created_at: '2026-01-20T10:00:00Z', has_active_tokens: true },
-  { client_id: 'vscode-001', registration_type: 'dcr', client_name: 'VS Code', client_alias: null, redirect_uris: ['http://localhost:9315/callback'], scope: null, approved: true, logo_uri: null, client_uri: null, software_id: 'vscode', software_version: '1.96.0', metadata_url: null, metadata_cached_at: null, metadata_cache_ttl: null, connection_mode: 'follow_active', locked_space_id: null, last_seen: '2026-02-07T08:45:00Z', created_at: '2026-01-22T10:00:00Z', has_active_tokens: true },
+  { client_id: 'cursor-001', registration_type: 'dcr', client_name: 'Cursor', client_alias: null, redirect_uris: ['http://localhost:9315/callback'], scope: null, approved: true, logo_uri: null, client_uri: null, software_id: 'cursor', software_version: '0.45.0', metadata_url: null, metadata_cached_at: null, metadata_cache_ttl: null, connection_mode: 'follow_active', locked_space_id: null, last_seen: '2026-02-07T09:30:00Z', created_at: '2026-01-20T10:00:00Z' },
+  { client_id: 'vscode-001', registration_type: 'dcr', client_name: 'VS Code', client_alias: null, redirect_uris: ['http://localhost:9315/callback'], scope: null, approved: true, logo_uri: null, client_uri: null, software_id: 'vscode', software_version: '1.96.0', metadata_url: null, metadata_cached_at: null, metadata_cache_ttl: null, connection_mode: 'follow_active', locked_space_id: null, last_seen: '2026-02-07T08:45:00Z', created_at: '2026-01-22T10:00:00Z' },
 ];
 
 function mkRegistry(id, name, desc, alias, icon, categories, auth, transportType, publisher, caps, hostingType, badges) {