- Step-up scopes are now persisted across auth revocations, preventing users from having to re-authorize expanded permissions
- OAuth discovery state (authorization server URL, resource metadata) is cached to avoid repeated discovery requests
- New
skipBrowserOpenoption for headless environments — logs the authorization URL instead of opening a browser preserveStepUpStateflag during MCP authentication prevents loss of elevated permissions
Evidence
"Persisted step-up scope:" log message, "Saving discovery state" log message (search for "Persisted step-up scope")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.