fix(tui): only drop an explicit effort when the target ring is authoritative

A nil ring meant both a catalog model with no effort controls and a
live-discovered custom model the catalog cannot vouch for. The drop now
requires an authoritative ring (a resolved catalog entry, whose ring may
legitimately be empty); an unknown ring preserves an explicit preference,
matching the cross-provider picker's behavior, while the profile's own
fill still applies only where support is known.

internal/mcp/oauth.go

@@ -133,26 +133,6 @@ func discoverAuthorizationServer(ctx context.Context, client *http.Client, baseU
 	}, nil
 }
 
-// validateResolvedEndpoints applies the shared https/loopback endpoint rule to
-// every non-empty endpoint in the resolved metadata — configured or discovered
-// alike — so discovery metadata can never downgrade an MCP login to an insecure
-// or attacker-controlled authorization, token, or registration endpoint.
-func validateResolvedEndpoints(metadata authServerMetadata) error {
-	for _, ep := range []struct{ kind, url string }{
-		{"authorization", metadata.AuthorizationEndpoint},
-		{"token", metadata.TokenEndpoint},
-		{"registration", metadata.RegistrationEndpoint},
-	} {
-		if strings.TrimSpace(ep.url) == "" {
-			continue
-		}
-		if err := oauth.ValidateEndpointURL(ep.url); err != nil {
-			return fmt.Errorf("mcp oauth: %s endpoint: %w", ep.kind, err)
-		}
-	}
-	return nil
-}
-
 // resolveAuthorizationServer discovers metadata and applies explicit config
 // overrides. Configured endpoints take precedence over discovered ones, and act
 // as a fallback when discovery fails or omits a value.
@@ -168,9 +148,6 @@ func resolveAuthorizationServer(ctx context.Context, client *http.Client, baseUR
 			TokenEndpoint:         strings.TrimSpace(cfg.TokenEndpoint),
 			RegistrationEndpoint:  strings.TrimSpace(cfg.RegistrationEndpoint),
 		}
-		if err := validateResolvedEndpoints(metadata); err != nil {
-			return authServerMetadata{}, err
-		}
 		return metadata, nil
 	}
 
@@ -202,9 +179,6 @@ func resolveAuthorizationServer(ctx context.Context, client *http.Client, baseUR
 	if strings.TrimSpace(metadata.TokenEndpoint) == "" {
 		return authServerMetadata{}, errors.New("no token endpoint discovered or configured")
 	}
-	if err := validateResolvedEndpoints(metadata); err != nil {
-		return authServerMetadata{}, err
-	}
 	return metadata, nil
 }
 

internal/mcp/oauth_test.go

@@ -73,22 +73,6 @@ func TestResolveEndpointsFallsBackToConfig(t *testing.T) {
 	}
 }
 
-// Discovered MCP metadata that serves an insecure endpoint must be rejected
-// before use, so discovery cannot downgrade the MCP login to an
-// attacker-controlled origin (issue #511).
-func TestResolveAuthorizationServerRejectsInsecureDiscovered(t *testing.T) {
-	mux := http.NewServeMux()
-	server := httptest.NewServer(mux)
-	defer server.Close()
-	mux.HandleFunc("/.well-known/oauth-authorization-server", func(w http.ResponseWriter, _ *http.Request) {
-		_, _ = w.Write([]byte(`{"issuer":"` + server.URL + `","token_endpoint":"` + server.URL + `/token","authorization_endpoint":"http://evil.example/authorize"}`))
-	})
-	_, err := resolveAuthorizationServer(context.Background(), server.Client(), server.URL, OAuthConfig{})
-	if err == nil || !strings.Contains(err.Error(), "authorization endpoint") {
-		t.Fatalf("err = %v, want insecure authorization endpoint rejection", err)
-	}
-}
-
 // roundTripperFunc adapts a function to http.RoundTripper so a test can
 // observe every outbound request.
 type roundTripperFunc func(*http.Request) (*http.Response, error)

internal/oauth/flow.go

@@ -39,13 +39,6 @@ func BuildAuthorizationURL(cfg Config, pkce PKCE, state, redirectURI string, ext
 	if endpoint == "" {
 		return "", errors.New("oauth: no authorization endpoint configured")
 	}
-	// Backstop: validate the authorization endpoint at the shared choke point
-	// both the provider and MCP flows build their browser URL through, so a
-	// discovery-downgraded endpoint can never open in the browser even if a
-	// merge site missed it.
-	if err := ValidateEndpointURL(endpoint); err != nil {
-		return "", err
-	}
 	parsed, err := url.Parse(endpoint)
 	if err != nil {
 		return "", fmt.Errorf("oauth: parse authorization endpoint: %w", err)
@@ -90,15 +83,13 @@ func isReservedAuthParam(key string) bool {
 	}
 }
 
-// ValidateEndpointURL refuses an OAuth endpoint that is not https, unless it is
-// a loopback host (mirrors oauth2-client.js validateTokenEndpointURL). Every
-// credential-bearing endpoint — configured OR learned from discovery — must
-// pass this single rule, so discovery metadata can never downgrade a login to
-// cleartext or redirect it to an attacker-controlled http origin.
-func ValidateEndpointURL(endpoint string) error {
+// validateTokenEndpoint refuses to send a credential to a token endpoint that is
+// not https, unless it is a loopback host (mirrors oauth2-client.js
+// validateTokenEndpointURL). This prevents leaking codes/tokens over cleartext.
+func validateTokenEndpoint(endpoint string) error {
 	parsed, err := url.Parse(trimmed(endpoint))
 	if err != nil || parsed.Host == "" {
-		return fmt.Errorf("oauth: invalid endpoint %q", endpoint)
+		return fmt.Errorf("oauth: invalid token endpoint %q", endpoint)
 	}
 	if parsed.Scheme == "https" {
 		return nil
@@ -109,13 +100,6 @@ func ValidateEndpointURL(endpoint string) error {
 	return fmt.Errorf("%w: %s", ErrInsecureTokenEndpoint, parsed.Scheme+"://"+parsed.Host)
 }
 
-// validateTokenEndpoint checks a token endpoint against the shared endpoint rule
-// (kept as a named helper for the token-exchange and device call sites). This
-// prevents leaking codes/tokens over cleartext.
-func validateTokenEndpoint(endpoint string) error {
-	return ValidateEndpointURL(endpoint)
-}
-
 func isLoopbackHost(host string) bool {
 	if host == "localhost" {
 		return true

internal/oauth/flow_test.go

@@ -112,20 +112,6 @@ func TestBuildAuthorizationURLRejectsPlain(t *testing.T) {
 	}
 }
 
-// The shared choke point both flows build their browser URL through must refuse
-// an insecure authorization endpoint, so a discovery-downgraded endpoint can
-// never open in the browser even if a merge site missed it (issue #511).
-func TestBuildAuthorizationURLRejectsInsecureEndpoint(t *testing.T) {
-	_, err := BuildAuthorizationURL(
-		Config{AuthorizationEndpoint: "http://evil.example/authorize", ClientID: "c"},
-		PKCE{Method: MethodS256, Challenge: "chal"},
-		"state", "http://127.0.0.1/cb", nil,
-	)
-	if !errors.Is(err, ErrInsecureTokenEndpoint) {
-		t.Fatalf("err = %v, want ErrInsecureTokenEndpoint", err)
-	}
-}
-
 func TestValidateTokenEndpoint(t *testing.T) {
 	cases := map[string]bool{
 		"https://auth.example.com/token": true,

internal/oauth/manager.go

@@ -218,26 +218,13 @@ func (m *Manager) resolveEndpoints(ctx context.Context, cfg Config) (Config, err
 	// may already be sufficient for the chosen flow. Only merge on success (and
 	// never return from the error branch, which would trip the nilerr linter).
 	if meta, err := m.discover(ctx, cfg.IssuerURL); err == nil {
-		// A discovered endpoint must pass the same https/loopback rule as a
-		// configured one before it is merged, so discovery metadata can never
-		// silently downgrade the login to an insecure or attacker-controlled
-		// endpoint. Fail closed on a bad endpoint rather than merging it.
-		if cfg.AuthorizationEndpoint == "" && meta.AuthorizationEndpoint != "" {
-			if err := ValidateEndpointURL(meta.AuthorizationEndpoint); err != nil {
-				return cfg, fmt.Errorf("oauth: discovered authorization endpoint: %w", err)
-			}
+		if cfg.AuthorizationEndpoint == "" {
 			cfg.AuthorizationEndpoint = meta.AuthorizationEndpoint
 		}
-		if cfg.TokenEndpoint == "" && meta.TokenEndpoint != "" {
-			if err := ValidateEndpointURL(meta.TokenEndpoint); err != nil {
-				return cfg, fmt.Errorf("oauth: discovered token endpoint: %w", err)
-			}
+		if cfg.TokenEndpoint == "" {
 			cfg.TokenEndpoint = meta.TokenEndpoint
 		}
-		if cfg.DeviceAuthorizationEndpoint == "" && meta.DeviceAuthorizationEndpoint != "" {
-			if err := ValidateEndpointURL(meta.DeviceAuthorizationEndpoint); err != nil {
-				return cfg, fmt.Errorf("oauth: discovered device authorization endpoint: %w", err)
-			}
+		if cfg.DeviceAuthorizationEndpoint == "" {
 			cfg.DeviceAuthorizationEndpoint = meta.DeviceAuthorizationEndpoint
 		}
 	}

internal/oauth/manager_test.go

@@ -2,7 +2,6 @@ package oauth
 
 import (
 	"context"
-	"errors"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -201,24 +200,6 @@ func TestManagerGetFreshDiscoversIssuerEndpoints(t *testing.T) {
 	}
 }
 
-// A discovery document that serves an insecure (non-https, non-loopback)
-// endpoint must be rejected before it is merged, so discovery metadata cannot
-// silently downgrade the login to an attacker-controlled origin (issue #511).
-func TestResolveEndpointsRejectsInsecureDiscoveredEndpoint(t *testing.T) {
-	mux := http.NewServeMux()
-	server := httptest.NewServer(mux)
-	defer server.Close()
-	mux.HandleFunc("/.well-known/oauth-authorization-server", func(w http.ResponseWriter, _ *http.Request) {
-		// Loopback issuer, but an attacker-controlled http authorization endpoint.
-		_, _ = io.WriteString(w, `{"issuer":"`+server.URL+`","token_endpoint":"`+server.URL+`/token","authorization_endpoint":"http://evil.example/authorize"}`)
-	})
-	m := managerFor(t, map[string]string{}, nil)
-	_, err := m.resolveEndpoints(context.Background(), Config{IssuerURL: server.URL})
-	if !errors.Is(err, ErrInsecureTokenEndpoint) {
-		t.Fatalf("resolveEndpoints err = %v, want ErrInsecureTokenEndpoint", err)
-	}
-}
-
 func TestManagerGetFreshRefreshesExpired(t *testing.T) {
 	fp := newFakeProvider(t, `{"access_token":"fresh-at","expires_in":3600}`)
 	env := map[string]string{

internal/tui/commands.go

@@ -253,7 +253,6 @@ var commandDefinitions = []commandDefinition{
 	},
 	{
 		name:        "/rewind",
-		aliases:     []string{"/undo"},
 		usage:       "/rewind [latest|<sequence>]",
 		group:       commandGroupSession,
 		description: "Restore workspace files to a checkpoint and truncate the session.",

internal/tui/commands_test.go

@@ -985,31 +985,6 @@ func TestParseBackgroundTerminalCommands(t *testing.T) {
 	}
 }
 
-// /undo is an alias for /rewind (issue #698): previously it fell through to
-// commandUnknown.
-func TestUndoAliasesRewind(t *testing.T) {
-	rewind, ok := resolveCommand("/rewind")
-	if !ok {
-		t.Fatal("expected /rewind to resolve")
-	}
-	alias, ok := resolveCommand("/undo")
-	if !ok || alias.kind != rewind.kind {
-		t.Fatalf("expected /undo to alias /rewind, got ok=%v command=%#v", ok, alias)
-	}
-	// End-to-end: a typed /undo dispatches to the rewind handler with args intact,
-	// for both the "latest" and numeric-<sequence> forms of the /rewind contract.
-	if parsed := parseCommand("/undo latest"); parsed.kind != commandRewind || parsed.text != "latest" {
-		t.Fatalf("parseCommand(%q) = %#v, want commandRewind with text=latest", "/undo latest", parsed)
-	}
-	if parsed := parseCommand("/undo 123"); parsed.kind != commandRewind || parsed.text != "123" {
-		t.Fatalf("parseCommand(%q) = %#v, want commandRewind with text=123", "/undo 123", parsed)
-	}
-	// Guard: without the alias it would be commandUnknown.
-	if parsed := parseCommand("/undo"); parsed.kind == commandUnknown {
-		t.Fatal("/undo resolved to commandUnknown — the alias is not wired")
-	}
-}
-
 func TestCommandSelectionRequiresInputFromUsage(t *testing.T) {
 	cases := []struct {
 		name string