[cliffhall]

Closes #2962

Problem

Without a TTY, mcpdo connect runs OAuth in the detached sign-in helper. Any failure the helper reported before producing the authorization URL was turned into auth_required / exit 3 by the parent, because the helper relayed only the message text. A fetch-guard refusal therefore exited 3 instead of fetch_refused / 12 (and lost its url), unlike the one-shot CLI and the TTY path.

Fix

• The helper now classifies its failure with classifyError — in the process where the original error object still exists — and relays exitCode plus the envelope fields on the error event (helperErrorEvent). The catch-all error classification is not relayed.
• The parent rebuilds the classified CliExitCodeError from the event (relayedHelperError): exit code must be a known non-zero EXIT_CODES value, every field is type-checked, every string sanitized. auth_required stays the fallback for an unclassified (or malformed) relay.
• The EMA login helper emits through the same event and shares the same fix.

Verification

Reproduced per the issue against a composable server with "mode":"protected-resource","authorizationServers":["http://169.254.169.254"], </dev/null:

{"error":{"code":"fetch_refused","message":"Sign-in helper failed: Refusing to fetch from a link-local or metadata address (169.254.169.254)","url":"http://169.254.169.254/.well-known/oauth-authorization-server"}}
exit=12

(Before: auth_required / 3.) Unit tests cover both sides of the relay and the malformed-input fallbacks; npm run local:gate is green.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Reconstructing wrapped fetch errors drops the relayed cause, leaving non-TTY output without the refusal reason; preserve the sanitized cause and add a final-envelope round-trip assertion.

1 open issue

• Preserve relayed error causes in reconstructed failures · New

What changed in this PR

This PR addresses #2962 by preserving classified OAuth failures across mcpdo’s detached sign-in helper, bringing non-TTY error reporting closer to the TTY and one-shot CLI paths.

Changes:

• Relay classified exit codes and error fields from both sign-in helpers.
• Validate and sanitize relayed fields, retaining auth_required as the fallback.
• Add tests for classification, sanitization, and malformed relay data.

File	Description
clients/​mcpdo/​src/​connection/​ema-login-helper.ts	Uses the shared classified error-event builder.
clients/​mcpdo/​src/​connection/​auth-helper.ts	Builds and reconstructs classified helper errors.
clients/​mcpdo/​__tests__/​ema-login-helper.test.ts	Checks that EMA configuration failures retain their classification.
clients/​mcpdo/​__tests__/​auth-helper.test.ts	Covers error relaying, validation, sanitization, and fallbacks.

_{Review effort: Balanced}

[cliffhall]

Copilot round 1: 1 finding (relayed cause dropped on reconstruction) — fixed in fb5e98d with a round-trip test; replied in thread. Requesting round 2.

[Copilot]

🟢 Approval recommended

No active review issues block the changes preserving classified OAuth failures in non-TTY connections.

No open issues 🎉

1 resolved since last review

• Preserve relayed error causes in reconstructed failures

_{Review effort: Balanced}

[cliffhall]

Copilot review closed: round 2 was clean (no inline comments, no open issues, no suppressed comments) — the loop stopped on the first clean round.