@@ -141,8 +141,10 @@ than hanging or dispatching against a dead transport.
 
 An HTTP SSE drop does not start that second dial. The Streamable HTTP
 transport resumes the stream itself (`reconnectionOptions`: 1s start, doubling,
-30s cap). The row stays connected and tools stay live; only a real stdio death
-uses the fail-fast stubs and attempt count above.
+30s cap). Those options have no random factor and no exhaustion callback, so
+the delay is not jittered and a stream that stops retrying stays on the
+connected row instead of flipping to failed. Tools stay live; only a real
+stdio death uses the fail-fast stubs and attempt count above.
 
 Pressing Enter on a failed or reconnecting row retries now with a single dial
 instead of waiting for backoff, reusing the saved settings row — it never
 
@@ -19,6 +19,27 @@ import {
 interface MockState {
   finishAuthCalls: number;
   finishAuthError: Error | undefined;
+  finishAuthInstanceId: number | undefined;
+  finishAuthResourceMetadataUrl: string | undefined;
+  finishAuthScope: string | undefined;
+  redirectingInstanceId: number | undefined;
+  preFailureResourceMetadataUrl: string | undefined;
+  preFailureScope: string | undefined;
+  challengeResourceMetadataUrl: string | undefined;
+  challengeScope: string | undefined;
+  boundTransport:
+    | {
+        instanceId: number;
+        resourceMetadataUrl?: string;
+        scope?: string;
+        sessionId?: string;
+      }
+    | undefined;
+  stampSessionId: string | undefined;
+  sessionStamped: boolean;
+  callSessionIds: (string | undefined)[];
+  callOAuthError: Error | undefined;
+  callbackCloseThrows: boolean;
   connectFailuresLeft: number;
   connectCalls: number;
   /** Thrown once, before any redirect, then cleared. */
@@ -61,6 +82,20 @@ function freshMockState(): MockState {
   return {
     finishAuthCalls: 0,
     finishAuthError: new Error("finishAuth exploded"),
+    finishAuthInstanceId: undefined,
+    finishAuthResourceMetadataUrl: undefined,
+    finishAuthScope: undefined,
+    redirectingInstanceId: undefined,
+    preFailureResourceMetadataUrl: undefined,
+    preFailureScope: undefined,
+    challengeResourceMetadataUrl: undefined,
+    challengeScope: undefined,
+    boundTransport: undefined,
+    stampSessionId: undefined,
+    sessionStamped: false,
+    callSessionIds: [],
+    callOAuthError: undefined,
+    callbackCloseThrows: false,
     connectFailuresLeft: 0,
     connectCalls: 0,
     connectOAuthError: undefined,
@@ -193,18 +228,44 @@ function waitForGate(signal: AbortSignal | undefined): Promise<void> {
 }
 
 await mockMcpClientModule(mock, {
-  connect: async (provider) => {
+  connect: async (provider, transport) => {
     mock.connectCalls += 1;
+    if (transport !== undefined) mock.boundTransport = transport;
     if (mock.connectOAuthError !== undefined) {
+      if (
+        transport !== undefined &&
+        mock.preFailureResourceMetadataUrl !== undefined
+      ) {
+        transport.resourceMetadataUrl = mock.preFailureResourceMetadataUrl;
+        if (mock.preFailureScope !== undefined)
+          transport.scope = mock.preFailureScope;
+      }
       const error = mock.connectOAuthError;
       mock.connectOAuthError = undefined;
       throw error;
     }
     if (mock.connectFailuresLeft > 0) {
       mock.connectFailuresLeft -= 1;
+      if (
+        transport !== undefined &&
+        mock.challengeResourceMetadataUrl !== undefined
+      ) {
+        transport.resourceMetadataUrl = mock.challengeResourceMetadataUrl;
+        if (mock.challengeScope !== undefined)
+          transport.scope = mock.challengeScope;
+        mock.redirectingInstanceId = transport.instanceId;
+      }
       await emitRedirects(provider);
       throw new UnauthorizedError("authorization required");
     }
+    if (
+      transport !== undefined &&
+      mock.stampSessionId !== undefined &&
+      !mock.sessionStamped
+    ) {
+      transport.sessionId = mock.stampSessionId;
+      mock.sessionStamped = true;
+    }
   },
   listTools: async () => {
     if (mock.listFailuresLeft > 0) {
@@ -218,8 +279,23 @@ await mockMcpClientModule(mock, {
     }
     return { tools: [] };
   },
-  callTool: async () => {
+  callTool: async (sessionId) => {
     mock.callToolCalls += 1;
+    mock.callSessionIds.push(sessionId);
+    if (mock.callOAuthError !== undefined) {
+      if (
+        mock.boundTransport !== undefined &&
+        mock.preFailureResourceMetadataUrl !== undefined
+      ) {
+        mock.boundTransport.resourceMetadataUrl =
+          mock.preFailureResourceMetadataUrl;
+        if (mock.preFailureScope !== undefined)
+          mock.boundTransport.scope = mock.preFailureScope;
+      }
+      const error = mock.callOAuthError;
+      mock.callOAuthError = undefined;
+      throw error;
+    }
     if (mock.callFailuresLeft > 0) {
       mock.callFailuresLeft -= 1;
       if (mock.callRedirectsLeft > 0) {
@@ -237,6 +313,9 @@ await mockMcpClientModule(mock, {
 await mockMcpTransportModule(mock, {
   finishAuth: async (self) => {
     mock.finishAuthCalls += 1;
+    mock.finishAuthInstanceId = self.instanceId;
+    mock.finishAuthResourceMetadataUrl = self.resourceMetadataUrl;
+    mock.finishAuthScope = self.scope;
     mock.exchangedCodeVerifier = self.provider?.codeVerifier?.();
     if (mock.finishAuthError !== undefined) throw mock.finishAuthError;
   },
@@ -248,7 +327,9 @@ await mockMcpCallbackServerModule({
     await waitForGate(signal);
     return "code";
   },
-  close: () => undefined,
+  close: () => {
+    if (mock.callbackCloseThrows) throw new Error("callback close threw");
+  },
 });
 
 await mockMcpOAuthProviderModule(
@@ -734,6 +815,71 @@ describe("HTTP MCP re-auth loop prevention", () => {
     expect(mock.finishAuthCalls).toBe(0);
   });
 
+  const defaultDiscovery =
+    "https://mcp.linear.app/.well-known/oauth-protected-resource";
+  const challengeMetadata =
+    "https://resource.linear.app/.well-known/oauth-protected-resource/mcp";
+
+  test("finishAuth uses the redirecting transport's 401 resource metadata", async () => {
+    mock.finishAuthError = undefined;
+    mock.preFailureResourceMetadataUrl = defaultDiscovery;
+    mock.preFailureScope = "legacy";
+    mock.challengeResourceMetadataUrl = challengeMetadata;
+    mock.challengeScope = "mcp:read";
+    mock.connectOAuthError = new InvalidScopeError("scope not allowed");
+    mock.connectFailuresLeft = 1;
+
+    const result = await connectWithAuthPrompt();
+
+    expect(result.ok).toBe(true);
+    expect(mock.finishAuthCalls).toBe(1);
+    expect(mock.redirectingInstanceId).toBeDefined();
+    expect(mock.finishAuthInstanceId).toBe(mock.redirectingInstanceId);
+    expect(mock.finishAuthResourceMetadataUrl).toBe(challengeMetadata);
+    expect(mock.finishAuthScope).toBe("mcp:read");
+    expect(mock.finishAuthResourceMetadataUrl).not.toBe(defaultDiscovery);
+  });
+
+  test("open-session code exchange does not retry the wiped mcp-session-id", async () => {
+    mock.finishAuthError = undefined;
+    mock.stampSessionId = "sess-wiped";
+    mock.preFailureResourceMetadataUrl = defaultDiscovery;
+    mock.preFailureScope = "legacy";
+    mock.challengeResourceMetadataUrl = challengeMetadata;
+    mock.challengeScope = "mcp:read";
+    const connected = await connectMCPServer(config, {
+      onAuthURL: () => {
+        mock.authURLCount += 1;
+      },
+    });
+    expect(connected.ok).toBe(true);
+    if (!connected.ok) return;
+
+    mock.callOAuthError = new InvalidScopeError("scope not allowed");
+    mock.connectFailuresLeft = 1;
+
+    await expect(
+      callText(connected.client, "ping", {}, new AbortController().signal),
+    ).resolves.toBe("");
+
+    expect(mock.finishAuthInstanceId).toBe(mock.redirectingInstanceId);
+    expect(mock.finishAuthResourceMetadataUrl).toBe(challengeMetadata);
+    expect(mock.finishAuthScope).toBe("mcp:read");
+    expect(mock.callSessionIds[0]).toBe("sess-wiped");
+    expect(mock.callSessionIds.at(-1)).toBeUndefined();
+  });
+
+  test("a sync callback close throw stays a failed connect result", async () => {
+    mock.callbackCloseThrows = true;
+    mock.connectOAuthError = new Error("dial failed");
+
+    const result = await connectMCPServer(config, {});
+
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.error).toBe("dial failed");
+  });
+
   test("reconnect during in-flight waitForCode does not emit a second prompt", async () => {
     mock.connectFailuresLeft = Number.POSITIVE_INFINITY;
     mock.callbackGate = new Promise(() => undefined);
 
@@ -137,6 +137,9 @@ interface HTTPAuthContext {
   coordinator: SdkAuthFinish;
   interactive: boolean;
   serverName: string;
+  client: Client;
+  /** Builds the next HTTP transport and records it as the live session. */
+  openTransport: () => Transport;
   onAuthorized?: (serverName: string) => void;
 }
 
@@ -156,7 +159,11 @@ interface SdkAuthFinish {
   notified?: boolean;
   recoveryGeneration?: number;
   waiters?: number;
-  /** Transport the SDK already dialed. finishAuth reuses it; no second client. */
+  /**
+   * Transport that finishAuth must use. A probe dial replaces the pre-failure
+   * transport with the instance that called redirectToAuthorization, so the
+   * code exchange sends that instance's resource metadata and scope.
+   */
   transport?: StreamableHTTPClientTransport;
 }
 
@@ -456,16 +463,21 @@ async function dialForFreshAuthorization(
       coordinator.lifecycle.signal,
     ),
   );
+  let redirected = false;
   try {
     await probeClient.connect(transport as unknown as Transport, {
       signal: coordinator.lifecycle.signal,
     });
   } catch (probeErr) {
     if (!isRecoverableAuthError(probeErr)) throw probeErr;
     if (coordinator.browserFlow === undefined) throw probeErr;
+    redirected = true;
   } finally {
     await closeQuietly(() => probeClient.close());
   }
+  // The probe, not the pre-failure transport, holds the resource metadata and
+  // scope the authorize URL was built from. finishAuth has to run on it.
+  if (redirected) coordinator.transport = transport;
 }
 
 async function driveRecovery(
@@ -510,6 +522,19 @@ async function driveRecovery(
   if (transport === undefined)
     throw new Error("no live HTTP transport to finish authorization");
   await transport.finishAuth(code);
+  // The probe is a second client. After its close, the live session still
+  // carries the mcp-session-id from before resetAuthorization wiped tokens.
+  const liveSession = context.client.transport;
+  if (
+    liveSession !== undefined &&
+    liveSession !== transport &&
+    liveSession.sessionId !== undefined
+  ) {
+    await context.client.close();
+    await context.client.connect(context.openTransport(), {
+      signal: coordinator.lifecycle.signal,
+    });
+  }
 }
 
 function completeVerifiedRecovery(
@@ -619,7 +644,7 @@ async function finishClient(
   authContext?: HTTPAuthContext,
   signal?: AbortSignal,
   closeLifecycle?: () => void,
-  liveTransport?: { onclose?: () => void },
+  live?: { current?: { onclose?: () => void } },
 ): Promise<MCPClient> {
   const result = await withHTTPAuthorizationRecovery(authContext, () =>
     signal === undefined
@@ -668,7 +693,7 @@ async function finishClient(
     },
     async close() {
       // Disarm first: the owner's hook reports unintentional death only.
-      if (liveTransport !== undefined) liveTransport.onclose = () => undefined;
+      if (live?.current !== undefined) live.current.onclose = () => undefined;
       closeLifecycle?.();
       authContext?.callback.close();
       await closeQuietly(() => client.close());
@@ -735,6 +760,7 @@ async function connectStdio(
         options.onDisconnect?.();
       };
     }
+    const live = { current: transport };
     return {
       ok: true,
       client: await finishClient(
@@ -743,7 +769,7 @@ async function connectStdio(
         undefined,
         options.signal,
         undefined,
-        transport,
+        live,
       ),
     };
   } catch (err) {
@@ -781,13 +807,22 @@ async function connectHttp(
     const normalizedURL = normalizeMCPServerURL(config.url);
     const url = new URL(normalizedURL);
     let authContext: HTTPAuthContext | undefined;
+    const live: { current?: { onclose?: () => void } } = {};
+    const connectedClient = new Client({
+      name: MCP_CLIENT_NAME,
+      version: "1.0.0",
+    });
+    client = connectedClient;
     let makeTransport: () => Transport;
     if (config.oauth === false) {
-      makeTransport = () =>
-        new StreamableHTTPClientTransport(
+      makeTransport = () => {
+        const transport = new StreamableHTTPClientTransport(
           url,
           streamableHTTPTransportOptions(undefined, options.signal),
-        ) as unknown as Transport;
+        );
+        live.current = transport;
+        return transport as unknown as Transport;
+      };
     } else {
       callback = await startCallbackServer(config.name);
       const authProvider = await createOAuthProvider({
@@ -807,6 +842,7 @@ async function connectHttp(
           streamableHTTPTransportOptions(authProvider, lifecycle.signal),
         );
         coordinator.transport = transport;
+        live.current = transport;
         return transport as unknown as Transport;
       };
       authContext = {
@@ -816,24 +852,19 @@ async function connectHttp(
         coordinator,
         interactive: options.onAuthURL !== undefined,
         serverName: config.name,
+        client: connectedClient,
+        openTransport: () => makeTransport(),
         ...(options.onAuthorized !== undefined
           ? { onAuthorized: options.onAuthorized }
           : {}),
       };
       gateRedirectToAuthorization(authContext);
     }
-    const connectedClient = new Client({
-      name: MCP_CLIENT_NAME,
-      version: "1.0.0",
-    });
-    client = connectedClient;
     // Recovery may dial again after finishAuth; the last transport wins.
-    let liveTransport: Transport | undefined;
     await withHTTPAuthorizationRecovery(
       authContext,
       () => {
         const transport = makeTransport();
-        liveTransport = transport;
         return connectedClient.connect(transport, {
           signal: lifecycle.signal,
         });
@@ -848,7 +879,7 @@ async function connectHttp(
         authContext,
         options.signal,
         closeLifecycle,
-        liveTransport,
+        live,
       ),
     };
   } catch (err) {