fix: ensure DCR always registers both redirect URIs

[asoorm]

Disclaimer: Claude Code was used to assist with investigating this issue, writing the root cause analysis, and drafting this PR.

Summary

Fixes a redirect_uri mismatch between Dynamic Client Registration and the authorize request, caused by the redirect_uris getter using a polymorphic this.redirectUrl that the debug subclass overrides.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Documentation update
• Refactoring (no functional changes)
• Test updates
• Build/CI improvements

Changes Made

The redirect_uris getter in InspectorOAuthClientProvider used this.redirectUrl, which DebugInspectorOAuthClientProvider overrides to return /oauth/callback/debug. This caused Set deduplication to collapse both URIs into one during DCR, so only /oauth/callback/debug was registered. The normal connection flow then sent redirect_uri=/oauth/callback in the authorize request — which was never registered — causing spec-compliant OAuth servers to reject it.

The fix references the base callback URLs directly instead of going through the polymorphic getter, ensuring both /oauth/callback and /oauth/callback/debug are always registered.

Related Issues

Fixes #930

Testing

• Tested in UI mode
• Tested in CLI mode
• Tested with STDIO transport
• Tested with SSE transport
• Tested with Streamable HTTP transport
• Added/updated automated tests
• Manual testing performed

Test Results and/or Instructions

1. Run npm run dev
2. Point inspector at an OAuth-enabled MCP server with a strict OAuth authorization server (one that enforces redirect URI validation)
3. Open the Auth Debugger tab and initiate the guided OAuth flow
4. Verify the DCR payload contains both redirect URIs: /oauth/callback and /oauth/callback/debug
5. Verify the authorize request's redirect_uri matches one of the registered URIs
6. Verify no duplicate URIs in the DCR payload (regression check for Duplicate redirect URIs generated by DebugInspectorOAuthClientProvider cause DCR failure #825)

Checklist

• Code follows the style guidelines (ran npm run prettier-fix)
• Self-review completed
• Code is commented where necessary
• Documentation updated (README, comments, etc.)

Breaking Changes

None.

Additional Context

This was introduced by the fix for #825 (duplicate redirect URIs). That fix correctly deduplicated, but didn't account for the polymorphic override collapsing both URIs into one. See root cause analysis comment.

[cliffhall]

LGTM! 👍

I don't really like it, but we're moving away from DCR anyway. IMO, the real fix would be to manage local storage differently for debug vs non-debug runs.

@BobDickinson something to watch out for on V2.

[asoorm]

we're moving away from DCR anyway.

Is that in favour of CIMD?

https://www.ietf.org/archive/id/draft-parecki-oauth-client-id-metadata-document-00.html