fix: ensure DCR always registers both redirect URIs

The `redirect_uris` getter used `this.redirectUrl`, which is overridden
by `DebugInspectorOAuthClientProvider` to return `/oauth/callback/debug`.
This caused the `Set` deduplication to collapse both URIs into one,
so DCR only registered `/oauth/callback/debug`. The normal connection
flow then sent `/oauth/callback` in the authorize request, which was
never registered — causing spec-compliant OAuth servers to reject it.

Use the base callback URLs directly instead of the polymorphic getter
so both URIs are always registered regardless of which subclass
initiates DCR.

Fixes #930

Author: asoorm

client/src/lib/auth.ts

@@ -146,10 +146,15 @@ export class InspectorOAuthClientProvider implements OAuthClientProvider {
   }
 
   get redirect_uris() {
-    // Normally register both redirect URIs to support both normal and debug flows
-    // In debug subclass, redirectUrl may be the same as debugRedirectUrl, so remove duplicates
+    // Always register both redirect URIs to support both normal and debug flows.
+    // Use the base URLs directly (not this.redirectUrl) to avoid the debug subclass
+    // override collapsing both URIs into one, which causes the normal flow's
+    // /authorize request to use an unregistered redirect_uri.
     // See: https://github.com/modelcontextprotocol/inspector/issues/825
-    return [...new Set([this.redirectUrl, this.debugRedirectUrl])];
+    // See: https://github.com/modelcontextprotocol/inspector/issues/930
+    const callbackUrl = window.location.origin + "/oauth/callback";
+    const debugCallbackUrl = window.location.origin + "/oauth/callback/debug";
+    return [callbackUrl, debugCallbackUrl];
   }
 
   get clientMetadata(): OAuthClientMetadata {