refactor(skills): focus parser differential guidance

* fix(mcp): refresh an expired bearer once on 401 instead of dropping the connection

* fix(mcp): clear recorded HTTP failures after successful responses

* fix(mcp): only clear a recorded auth failure on a later success

* fix(mcp): preserve eager refresh callbacks and share failed refresh attempts

.github/workflows/binary.yml

@@ -1,48 +1,39 @@
-name: Package
+name: Binary
 
 on:
-  workflow_call:
+  pull_request:
+    paths:
+      - pyproject.toml
+      - uv.lock
+      - strix.spec
+      - scripts/**
+      - strix/interface/tui/**
+      - .github/actions/**
+      - .github/workflows/binary.yml
+  push:
+    branches:
+      - main
+    paths:
+      - pyproject.toml
+      - uv.lock
+      - strix.spec
+      - scripts/**
+      - strix/interface/tui/**
+      - .github/actions/**
+      - .github/workflows/binary.yml
+  workflow_dispatch:
 
 permissions:
   contents: read
 
-jobs:
-  wheel:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
-        with:
-          persist-credentials: false
-      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00  # v6.0.0
-        with:
-          go-version-file: strix/interface/tui/go.mod
-          cache-dependency-path: strix/interface/tui/go.sum
-      - uses: ./.github/actions/setup-python-env
-      - run: uv build --wheel
-      - name: Wheel ships the TUI sidecar and the viewer bundle
-        run: |
-          uv run --frozen python - <<'PY'
-          import glob, zipfile
-          (wheel,) = glob.glob("dist/*.whl")
-          names = zipfile.ZipFile(wheel).namelist()
-          assert "strix/bin/strix-tui" in names, names
-          assert "strix/interface/viewer/static/index.html" in names, names
-          assert not any(name.startswith("strix/interface/viewer/frontend/") for name in names)
-          assert not any(name.startswith("strix/interface/tui/cmd/") for name in names)
-          PY
-      - name: Install into a clean environment and run the CLI
-        env:
-          UV_EXCLUDE_NEWER: 5 days
-        run: |
-          uv venv --python 3.12 /tmp/strix-smoke
-          uv pip install --python /tmp/strix-smoke/bin/python dist/*.whl
-          /tmp/strix-smoke/bin/strix --version
-          /tmp/strix-smoke/bin/strix --help >/dev/null
-      - name: Vertex AI and Bedrock dependencies install with the wheel
-        run: /tmp/strix-smoke/bin/python -c "import google.auth.transport.requests, boto3"
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
+jobs:
   binary:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
         with:

.github/workflows/build-release.yml

@@ -32,6 +32,7 @@ jobs:
             wheel-platform: win_amd64
 
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
 
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
@@ -110,6 +111,7 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/')
     needs: build
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: write
 

.github/workflows/ci-python.yml

@@ -1,61 +0,0 @@
-name: Python
-
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  lock:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
-        with:
-          persist-credentials: false
-      - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86  # v5.4.2
-      - run: uv lock --check
-
-  ruff:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
-        with:
-          persist-credentials: false
-      - uses: ./.github/actions/setup-python-env
-      - run: uv run --frozen ruff check .
-      - run: uv run --frozen ruff format --check .
-
-  mypy:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
-        with:
-          persist-credentials: false
-      - uses: ./.github/actions/setup-python-env
-      - run: uv run --frozen mypy strix/
-
-  bandit:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
-        with:
-          persist-credentials: false
-      - uses: ./.github/actions/setup-python-env
-      - run: uv run --frozen bandit -r strix/ -c pyproject.toml
-
-  pytest:
-    name: pytest (${{ matrix.python-version }})
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        python-version: ['3.12', '3.13', '3.14']
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
-        with:
-          persist-credentials: false
-      - uses: ./.github/actions/setup-python-env
-        with:
-          python-version: ${{ matrix.python-version }}
-      - run: uv run --frozen pytest -q

.github/workflows/ci-tui.yml

@@ -1,26 +0,0 @@
-name: TUI
-
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  go:
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: strix/interface/tui
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
-        with:
-          persist-credentials: false
-      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00  # v6.0.0
-        with:
-          go-version-file: strix/interface/tui/go.mod
-          cache-dependency-path: strix/interface/tui/go.sum
-      - run: test -z "$(gofmt -l .)"
-      - run: go vet ./...
-      - run: CGO_ENABLED=0 go build -trimpath -o /dev/null ./cmd/strix-tui
-      - run: go test -race ./...

.github/workflows/ci-viewer.yml

@@ -1,27 +0,0 @@
-name: Viewer
-
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: strix/interface/viewer/frontend
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
-        with:
-          node-version: '24'
-          cache: npm
-          cache-dependency-path: strix/interface/viewer/frontend/package-lock.json
-      - run: npm ci --no-audit --no-fund
-      - run: npm run build
-      - name: Committed viewer bundle matches the build
-        run: git -C "$GITHUB_WORKSPACE" diff --exit-code --stat -- strix/interface/viewer/static && test -z "$(git -C "$GITHUB_WORKSPACE" status --porcelain -- strix/interface/viewer/static)"

.github/workflows/ci.yml

@@ -15,38 +15,107 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  python:
-    uses: ./.github/workflows/ci-python.yml
+  lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup-python-env
+      - run: uv lock --check
+      - run: uv run --frozen ruff check .
+      - run: uv run --frozen ruff format --check .
+      - run: uv run --frozen mypy strix/
+      - run: uv run --frozen bandit -r strix/ -c pyproject.toml
+
+  pytest:
+    name: pytest (${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.12', '3.14']
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup-python-env
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: uv run --frozen pytest -q
 
   tui:
-    uses: ./.github/workflows/ci-tui.yml
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: strix/interface/tui
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00  # v6.0.0
+        with:
+          go-version-file: strix/interface/tui/go.mod
+          cache-dependency-path: strix/interface/tui/go.sum
+      - run: test -z "$(gofmt -l .)"
+      - run: go vet ./...
+      - run: CGO_ENABLED=0 go build -trimpath -o /dev/null ./cmd/strix-tui
+      - run: go test -race ./...
 
   viewer:
-    uses: ./.github/workflows/ci-viewer.yml
-
-  package:
-    uses: ./.github/workflows/ci-package.yml
-
-  workflows:
-    uses: ./.github/workflows/ci-workflows.yml
-
-  ci-passed:
-    name: ci-passed
-    if: always()
-    needs:
-      - python
-      - tui
-      - viewer
-      - package
-      - workflows
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: strix/interface/viewer/frontend
     steps:
-      - name: Every job succeeded
-        env:
-          NEEDS: ${{ toJSON(needs) }}
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        with:
+          node-version: '24'
+          cache: npm
+          cache-dependency-path: strix/interface/viewer/frontend/package-lock.json
+      - run: npm ci --no-audit --no-fund
+      - run: npm run build
+      - name: Committed viewer bundle matches the build
+        run: git -C "$GITHUB_WORKSPACE" diff --exit-code --stat -- strix/interface/viewer/static && test -z "$(git -C "$GITHUB_WORKSPACE" status --porcelain -- strix/interface/viewer/static)"
+
+  wheel:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00  # v6.0.0
+        with:
+          go-version-file: strix/interface/tui/go.mod
+          cache-dependency-path: strix/interface/tui/go.sum
+      - uses: ./.github/actions/setup-python-env
+      - run: uv build --wheel
+      - name: Wheel ships the TUI sidecar and the viewer bundle
         run: |
-          failing=$(jq -r 'to_entries[] | select(.value.result != "success") | "\(.key): \(.value.result)"' <<< "$NEEDS")
-          if [ -n "$failing" ]; then
-            echo "$failing"
-            exit 1
-          fi
+          uv run --frozen python - <<'PY'
+          import glob, zipfile
+          (wheel,) = glob.glob("dist/*.whl")
+          names = zipfile.ZipFile(wheel).namelist()
+          assert "strix/bin/strix-tui" in names, names
+          assert "strix/interface/viewer/static/index.html" in names, names
+          assert not any(name.startswith("strix/interface/viewer/frontend/") for name in names)
+          assert not any(name.startswith("strix/interface/tui/cmd/") for name in names)
+          PY
+      - name: Install into a clean environment and run the CLI
+        env:
+          UV_EXCLUDE_NEWER: 5 days
+        run: |
+          uv venv --python 3.12 /tmp/strix-smoke
+          uv pip install --python /tmp/strix-smoke/bin/python dist/*.whl
+          /tmp/strix-smoke/bin/strix --version
+          /tmp/strix-smoke/bin/strix --help >/dev/null
+      - name: Vertex AI and Bedrock dependencies install with the wheel
+        run: /tmp/strix-smoke/bin/python -c "import google.auth.transport.requests, boto3"

.github/workflows/workflows.yml

@@ -1,14 +1,27 @@
 name: Workflows
 
 on:
-  workflow_call:
+  pull_request:
+    paths:
+      - .github/**
+  push:
+    branches:
+      - main
+    paths:
+      - .github/**
+  workflow_dispatch:
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   actionlint:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     env:
       ACTIONLINT_VERSION: 1.7.12
       ACTIONLINT_SCRIPT_REF: 914e7df21a07ef503a81201c76d2b11c789d3fca  # v1.7.12
@@ -27,6 +40,7 @@ jobs:
 
   zizmor:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
         with:

.pre-commit-config.yaml

@@ -45,23 +45,3 @@ repos:
     hooks:
       - id: bandit
         args: [-c, pyproject.toml]
-
-  # Additional Python code quality checks
-  - repo: https://github.com/asottile/pyupgrade
-    rev: v3.21.2
-    hooks:
-      - id: pyupgrade
-        args: [--py312-plus]
-
-ci:
-  autofix_commit_msg: |
-    [pre-commit.ci] auto fixes from pre-commit.com hooks
-
-    for more information, see https://pre-commit.ci
-  autofix_prs: true
-  autoupdate_branch: ""
-  autoupdate_commit_msg: "[pre-commit.ci] pre-commit autoupdate"
-  autoupdate_schedule: weekly
-  # pre-commit.ci cannot run `language: system` hooks; mypy runs via `make check-all`.
-  skip: [mypy]
-  submodules: false

strix/skills/custom/dependency_cve_scanning.md

@@ -136,12 +136,8 @@ fi
 - A finding with a call stack ⇒ `reachability=reachable_call_path`, put the
   call-path excerpt (entrypoint → vulnerable function) in
   `reachability_evidence`.
-- Listed as affecting a required module but with no reachable symbol ⇒ the
-  call graph found no path to the vulnerable function: `not_reached` when
-  application code imports the module (cite the govulncheck result and the
-  import), `not_imported` when nothing imports it. When govulncheck could not
-  analyze the module (build errors, missing deps), fall back to the
-  import/symbol checks below instead of claiming a level.
+- Listed as affecting a required module but with no reachable symbol ⇒ fall
+  back to the import/symbol checks below (`imported` / `not_imported`).
 
 **All other ecosystems — import check, then symbol match:**
 
@@ -152,25 +148,15 @@ fi
    `PyYAML` → `yaml`). No hits ⇒ `not_imported`, with the search scope stated
    in `reachability_evidence`. For a **transitive** dependency, the check is
    whether application code imports it directly; if not, it is reachable only
-   through the packages that depend on it — walk every introducing chain
-   from the lockfile (e.g. `express > body-parser > qs`) and inspect the code
-   of the package one hop above the vulnerable one on each chain
-   (`body-parser`, not just `express`; its installed sources, or the class
-   references of its jar) for the affected API. No chain references it ⇒
-   `not_reached` (below), citing every artifact you inspected; referenced ⇒
-   that package's call is the usage site, continue the trace upward from
-   there. If you could not inspect every chain, or one of them is unclear,
-   the package is still loaded, so the level is `imported`, never
-   `not_reached`.
+   through the direct dependency — check whether the direct dep's usage can
+   hit it (if unclear, use `imported` when the direct dep is used at all).
 2. **Symbol match — per CVE, not per package.** Read each CVE's own advisory
    (GHSA/NVD/OSV `affected[].ecosystem_specific.imports` or the advisory
    text) for the affected functions/classes/APIs. Search application code for
    those symbols (`ast-grep` pattern or `rg -n`). Hits ⇒
    `vulnerable_symbol_used`, with repo-relative `file:line` of each hit (up
-   to a handful) in `reachability_evidence`. Imported, search completed, and
-   you can say why the vulnerable code does not run here ⇒ `not_reached`
-   (below). Imported but the search was partial, the result is unclear, or
-   the advisory names no symbols ⇒ `imported`.
+   to a handful) in `reachability_evidence`. Imported but no affected-symbol
+   usage found (or the advisory names no symbols) ⇒ `imported`.
    Different CVEs on the same package usually affect **different** symbols
    (one hits a parser, another a header check) — never copy one CVE's
    verdict/evidence onto its siblings; run the symbol search against each
@@ -196,23 +182,6 @@ fi
    dynamic loading, unparsable sources) ⇒ `unknown` and say why in
    `assumptions`.
 
-**`not_reached` — loaded, but this CVE's vulnerable code does not run here.**
-Use it when the package is imported (so `not_imported` is wrong) and you
-showed that the code path the advisory describes cannot execute in this
-codebase, and `reachability_evidence` says what you checked. The judgement is
-per CVE: it rests on what triggers *this* flaw (an affected function, a mode,
-an option, a kind of input) against what this code does. Situations that
-commonly support it, as inspiration rather than a checklist: the affected API
-has no caller in application code and the search was complete; the only call
-site is behind a condition that is false here (a polyfill for an older
-runtime, a flag that is off, a path only a dev tool runs); a transitive
-package's parent never references the affected API; the package is build or
-test tooling that the shipped artifact never executes; a library compiled into
-the runtime whose flaw sits in a mode the application never uses (a TLS server
-path in a client-only service). An inconclusive or skipped check stays
-`imported`. `not_reached` is still an evidence level, not proof of safety:
-dynamic dispatch, reflection and framework wiring can evade static search.
-
 Cheap-first budgeting: the import check is one search per package — always do
 it. Do the per-CVE symbol match for every CVE whose advisory names affected
 symbols (they can be batched into one multi-pattern search per package);
@@ -220,18 +189,13 @@ prioritize `critical`/`high`/KEV when the budget is tight; a CVE whose symbol
 search was skipped may still be reported as `imported` (the import check is
 real evidence), but its `reachability_evidence` must state that the
 affected-symbol check was not performed, so a skipped search is never
-mistaken for a completed one with no hits, and is never filed as
-`not_reached`. Never let this analysis stall
+mistaken for a completed one with no hits. Never let this analysis stall
 reporting — `unknown` with a reason beats an unverified claim.
 
 Anti-overclaim rules:
 
 - `not_imported` still does NOT mean safe (dynamic `import()`/reflection/
   framework wiring evade static search) — never phrase it as "not exploitable".
-- `not_reached` needs the check that shows the vulnerable code does not run,
-  named in `reachability_evidence`; "no call found" after a partial search is
-  `imported`, and one CVE's `not_reached` never carries over to a sibling CVE
-  on the same package.
 - `reachable_call_path` is reserved for call-graph tools (govulncheck); a
   symbol grep hit is `vulnerable_symbol_used`, no matter how convinced you are.
 - The tool rejects any level other than `unknown` without

strix/skills/tooling/agent_browser.md

@@ -207,7 +207,7 @@ agent-browser snapshot -i
 ```
 
 Credentials in shell history are a leak. For anything sensitive, use the
-auth vault (see [references/authentication.md](references/authentication.md)):
+auth vault (see `references/authentication.md`):
 
 ```bash
 agent-browser auth save my-app --url https://app.example.com/login \
@@ -367,7 +367,7 @@ agent-browser click @e3
 agent-browser record stop
 ```
 
-See [references/video-recording.md](references/video-recording.md) for
+See `references/video-recording.md` for
 codec options, GIF export, and more.
 
 ### Iframes
@@ -491,8 +491,8 @@ snapshot — fall back to `eval` in the iframe's origin or use the
 
 **Authentication expires mid-workflow**
 Use `--session-name <name>` or `state save`/`state load` so your session
-survives browser restarts. See [references/session-management.md](references/session-management.md)
-and [references/authentication.md](references/authentication.md).
+survives browser restarts. See `references/session-management.md`
+and `references/authentication.md`.
 
 ## Global flags worth knowing
 

strix/skills/vulnerabilities/idor.md

@@ -53,11 +53,13 @@ Object-level authorization failures (BOLA/IDOR) lead to cross-account data expos
 
 **Enumeration Techniques**
 - Alternate types: `{"id":123}` vs `{"id":"123"}`, arrays vs scalars, objects vs scalars
-- Edge values: null/empty/0/-1/MAX_INT, scientific notation, overflows
-- Duplicate keys/parameter pollution: `id=1&id=2`, JSON duplicate keys `{"id":1,"id":2}` (parser precedence)
+- Edge and numeric boundaries: null, empty, 0, -1, MAX_INT, and exact and adjacent values around each runtime's safe-integer and overflow limits, including decimal and exponent forms
+- Duplicate keys/parameter pollution: send raw query strings such as `id=1&id=2` and raw JSON such as `{"id":1,"id":2}` so serializers cannot collapse duplicates. Use conflicting values in both orders to determine parser precedence
 - Case/aliasing: userId vs userid vs USER_ID; alt names like resourceId, targetId, account
 - Path traversal-like in virtual file systems: `/files/user_123/../../user_456/report.csv`
 
+For gateways, workers, and multi-service APIs, treat authorization as an identity invariant: the object authorized must equal the object read, changed, or exported. Run the representation and duplicate-member matrix even after one variant succeeds. Compare response identity/content, not status alone.
+
 **UUID/Opaque ID Sources**
 - Logs, exports, JS bundles, analytics endpoints, emails, public activity
 - Time-based IDs (UUIDv1, ULID) may be guessable within a window

strix/skills/vulnerabilities/nosql_injection.md

@@ -14,6 +14,7 @@ NoSQL injection exploits the mismatch between how applications pass user input t
 - Form fields with bracket notation (`field[$ne]=`) coerced into operator objects by Express, PHP, and similar middleware
 - URL-encoded JSON in query strings, headers, and cookies
 - GraphQL variables passed directly into resolver-level NoSQL filters
+- Scalar search, filter, selector, and authorization strings may be compiled into another expression language instead of a NoSQL operator object. Before testing or closing any such field, load `query_language_injection` and run its Required First Pass on every scalar sink
 
 **Code patterns that enable injection**
 - Raw filter dicts/objects from user input handed to `find`/`findOne`/`aggregate`
@@ -241,7 +242,7 @@ DoS surface (use only with explicit authorization scope):
 
 1. **Identify query-receiving endpoints** — login, search, filter, lookup
 2. **Determine input format** — JSON body vs form fields vs URL params
-3. **Send error-probing payloads** — malformed operator objects; watch for MongoDB/driver errors
+3. **Send error-probing payloads** — test malformed operator objects and watch for MongoDB/driver errors. For scalar expression construction, load `query_language_injection` and complete its Required First Pass before closing the field
 4. **Attempt operator injection** — `$ne`, `$gt`, `$regex` against login endpoint
 5. **Confirm boolean oracle** — response, status, redirect differs between true/false predicates
 6. **Extract data blindly** — character-by-character `$regex` on sensitive fields (token, reset code)

strix/skills/vulnerabilities/query_language_injection.md

@@ -0,0 +1,145 @@
+---
+name: query-language-injection
+description: Query-language injection testing for scalar search, filter, selector, and authorization inputs compiled into JSONPath, JMESPath, OData, Lucene, LDAP, Cypher, XPath, or similar expressions. Requires a per-sink four-cell balanced true/false matrix before generic spraying or no-issue closure
+---
+
+# Query-Language Injection
+
+An HTTP scalar becomes an injection sink when an application inserts it into a query, selector, policy, or expression string. The input may look like an exact-match value at the API boundary while becoming executable syntax in a downstream parser. Treat each accepted search, filter, selector, and authorization field as an independent sink.
+
+## Non-Skippable First Pass
+
+Make this the first test after baselines. Do not begin generic SQL, NoSQL, wildcard, metacharacter, or product-specific spraying until every candidate scalar has a completed row in the execution ledger.
+
+For each scalar search, filter, selector, and authorization input:
+
+1. Record its transport path, a full known-match value `V`, a known-no-match value, and the corresponding record property.
+2. Map transport structure to record structure. For a nested request path such as `filters.status`, start with the leaf property `@.status`, not `@.filters.status`, unless responses or documentation show that the record itself is nested. For a free-text input, test each record property it searches.
+3. Keep authentication, sibling fields, method, pagination, and ordering fixed.
+4. Put each of these four values in the selected input itself:
+   - `V' || @.<property> == @.<property> || 'V`
+   - `V' && @.<property> != @.<property> && 'V`
+   - `V" || @.<property> == @.<property> || "V`
+   - `V" && @.<property> != @.<property> && "V`
+5. Compare returned object identities. A structural injection normally makes the `OR/true` cells broaden and the `AND/false` cells narrow.
+6. Record the transport path, record property, known value, all four exact transmitted values, status, result count, and returned identities.
+
+Substitute every placeholder before transmission. For the neutral example `filters.status=active`, the record property is `status`, so send exactly:
+
+- `active' || @.status == @.status || 'active`
+- `active' && @.status != @.status && 'active`
+- `active" || @.status == @.status || "active`
+- `active" && @.status != @.status && "active`
+
+Use the selected input's own accepted value at both ends. Do not send literal `V`, `@.<property>`, a bare closure fragment, or a payload in a free-text sibling. Repeat the matrix independently for every scalar, even when another field is literal or inert.
+
+A ledger row missing any cell is incomplete. Do not substitute standalone quotes, SQL tautologies, object operators, wildcards, or generic search tokens. Do not close the input as exact-match, safe, or `no issue` unless the row is complete or a specific control proves its value cannot reach expression construction. Otherwise retain an open proof gap.
+
+## Attack Surface
+
+Prioritize inputs that influence:
+
+- search, filtering, sorting, faceting, lookup, and autocomplete
+- tenant, owner, role, classification, visibility, or policy selectors
+- exports, reports, saved searches, dashboards, and background jobs
+- document, graph, directory, or inventory queries
+- path-like selectors, projections, field expressions, and rule conditions
+
+Test query parameters, JSON and form fields, headers, cookies, GraphQL arguments, WebSocket messages, and values copied into asynchronous work. A client-side dropdown or fixed option list is not a server-side control.
+
+Common sinks include JSONPath, JMESPath, XPath, LDAP filters, OData, Lucene-style search, Cypher, expression engines, and application-specific filter DSLs. Do not assume the grammar from the endpoint name alone. Infer it from errors, response behavior, client code, documentation, or source when available.
+
+## Core Model
+
+Map the complete path before selecting payloads:
+
+```text
+attacker-controlled scalar
+  -> decoding or normalization
+  -> string interpolation or expression construction
+  -> query-language parser
+  -> evaluator
+  -> authorization or result handling
+```
+
+The key question is whether the value stays data or changes the structure of the final expression. A protected query is vulnerable when attacker input can close its original value context, introduce an operator or expression, and rebalance the remaining suffix.
+
+## Reconnaissance
+
+For every candidate field:
+
+1. Record a known-match value and a known-no-match value.
+2. Keep method, authentication, sibling fields, pagination, and ordering fixed.
+3. Compare returned object identities and authorization boundaries, not only status or response length.
+4. Repeat requests when data, timing, or ordering can vary.
+5. Preserve the raw request. High-level serializers may quote, normalize, or collapse the representation being tested.
+
+Test the field itself. A payload in a sibling field does not clear the original sink. Standalone quotes or metacharacters are discovery signals, not sufficient negative tests.
+
+## Grammar Adaptation
+
+After completing the first pass, use observed behavior to translate the same broadening and narrowing pair rather than spraying unrelated payloads. Balance the expected suffix instead of relying only on comments. Constant-only expressions may be rejected while field comparisons remain valid.
+
+| Language family | Useful structural clues | Paired strategy |
+|---|---|---|
+| JSONPath | `$`, `@`, filters, brackets, quote-delimited comparisons | close the comparison, add true and false predicates, then rebalance |
+| JMESPath | filters, projections, backtick literals, pipe expressions | alter a filter or projection and compare broadened with empty results |
+| XPath | path steps, predicates, `and`, `or`, quote-delimited values | close the literal and compare true with false node-set predicates |
+| LDAP | parenthesized filters, `&`, `|`, `!`, wildcards | inject balanced filter groups and compare match-all with match-none controls |
+| OData | `$filter`, `eq`, `ne`, `and`, `or`, single-quoted strings | close the literal and compare true with false clauses using valid escaping |
+| Lucene-like DSLs | field clauses, quotes, grouping, boolean operators | escape the term context and compare broad with contradictory clauses |
+| Cypher-like expressions | quoted values, `WHERE`, boolean operators, comments | close the value and compare tautological with contradictory predicates |
+
+Also test plausible value contexts such as strings, numbers, lists, paths, function arguments, and nested predicates. Change one structural assumption at a time. Use encoded forms only after a raw structural probe establishes a likely grammar or intermediary filter.
+
+## Differential Oracles
+
+High-signal evidence includes:
+
+- the broadening probe returns objects absent from the known-match baseline
+- the narrowing control returns no objects or a strict subset
+- protected, cross-tenant, privileged, or hidden records appear
+- error shape changes reveal the downstream parser or expression context
+- the same predicate controls an existence, count, timing, or authorization oracle
+
+An empty result can mean either a false predicate or a swallowed parser exception. Distinguish them with a syntactically valid false control, repeated requests, and a second predicate pair. A parser error alone proves input reached a grammar, not that the query can be controlled.
+
+## Authorization Filters
+
+Treat query injection as an authorization issue when the vulnerable predicate enforces tenant, owner, role, classification, or visibility boundaries. Prove that the injected request returns an object the same principal cannot obtain through the normal selector. Record the object identity and protected property so intended broad search behavior is not mistaken for a bypass.
+
+Do not stop after showing that the result count changed. Determine whether the injected expression can read protected data, influence an export, modify a selected object, or reach a more privileged downstream operation.
+
+## Validation
+
+A confirmed finding should include:
+
+1. A normal known-match baseline.
+2. A normal known-no-match baseline.
+3. A broadening expression with a stable unauthorized result.
+4. A paired narrowing or contradictory expression.
+5. Repetition showing the differential is deterministic.
+6. Evidence of the affected objects, boundary, and business impact.
+
+Keep sibling fields and credentials constant across the evidence pair. Prefer object identifiers or normalized response digests over raw body length. If only an error or response-shape anomaly is available, retain it as a proof gap rather than reporting data access that was not demonstrated.
+
+## False Positives
+
+- intended wildcard, fuzzy search, or documented advanced-query syntax
+- changing datasets, pagination, ranking, caching, or unstable ordering
+- generic validation errors that occur before the expression parser
+- a quote accepted as literal data without control over query structure
+- a broad result caused by an omitted filter rather than injected syntax
+- an empty response caused by a swallowed exception without a valid predicate oracle
+
+## Remediation
+
+- Avoid building expressions through string concatenation.
+- Use typed parameters, variables, or a safe AST/query-builder API when supported.
+- Map user-facing options to server-owned predicates instead of accepting expression fragments.
+- Apply strict allowlists for field names, operators, functions, and value types when dynamic queries are required.
+- Enforce authorization outside attacker-controlled search expressions and re-check every resolved object before returning or acting on it.
+- Preserve one canonical parse and representation across gateways, workers, and backend services.
+- Add regression tests using paired true and false predicates for every previously vulnerable field.
+
+Do not conclude `exact match`, `safe`, or `ruled out` until the paired matrix ran on every candidate scalar sink, or a specific non-concatenating control was identified.

strix/skills/vulnerabilities/semantic_confusion.md

@@ -1,6 +1,6 @@
 ---
 name: semantic-confusion
-description: Cross-component semantic confusion testing for parser differentials, normalization mismatches, overloaded fields, lifecycle state drift, internal redirects, protocol translation, and validator-to-sink inconsistencies
+description: Cross-component semantic confusion testing for parser differentials, normalization mismatches, email and IDNA identity drift, overloaded fields, lifecycle state drift, internal redirects, protocol translation, and validator-to-sink inconsistencies
 ---
 
 # Semantic Confusion
@@ -59,6 +59,27 @@ The highest-signal condition is `security_check(value_A)` followed by `sink(tran
 - Test malformed Unicode and replacement behavior; a rejected code point may become an allowed delimiter or wildcard later.
 - Test path, query, and fragment separately. Browsers and routers commonly transform each source differently.
 
+### Email and Account Identity Drift
+
+Treat an email address as both a principal selector and a delivery destination. Trace the complete boundary before testing:
+
+```text
+submitted or identity-provider address
+  -> application normalization / IDNA
+  -> database comparison and collation
+  -> selected local principal
+  -> token, session, invitation, or link binding
+  -> recipient or linked identity consumed by the final service
+```
+
+- Cover recovery, magic links, invitations, registration uniqueness, email changes, and OAuth/OIDC account linking. Test case/accent-insensitive collations, Unicode normalization, IDNA U-label/A-label conversion, trailing dots, and provider canonicalization only when the observed stack supports them.
+- In black-box testing, report the observed equivalence and routing behavior. Do not name a specific collation, normalizer, or provider algorithm without source, configuration, or version evidence.
+- Determine whether two non-identical addresses can select the same protected principal while SMTP or an identity provider routes them to different owners. The address that receives authority must identify the same principal selected by the security check.
+- In recovery flows, compare the submitted address with the selected account's stored canonical address. A fuzzy lookup followed by delivery to the submitted value is high risk; an exact lookup plus delivery to the stored value is the primary negative control.
+- Use only an explicitly authorized attacker-controlled mailbox or test domain. Derive a bounded variant set from the deployed collation and canonicalizers rather than spraying external domains or the Unicode range.
+
+For a recovery, magic-link, or invitation finding, a generic success response is not proof. Demonstrate that the variant selects the protected principal, the issued authority reaches the controlled mailbox or identity, and redemption yields the protected principal's access. If delivery or redemption cannot be observed, keep the path `needs_follow_up`.
+
 ### Field and Type Overloading
 
 - Identify shared fields reused for different concepts: path vs URL, content type vs handler, display name vs executable name, route vs filesystem location.
@@ -170,6 +191,8 @@ A valid confusion finding should include:
 - Different error messages with identical final authorization and sink behavior
 - A parser accepts odd syntax but downstream consumers preserve the same safe meaning
 - A normalization difference visible only in logs, with no security decision between representations
+- A Unicode or Punycode lookalike that neither selects another principal nor receives authority intended for that principal
+- A permissive database comparison where recovery delivery still uses the selected account's stored canonical address
 - WAF bypass where the application itself rejects the request identically
 - Version-specific behavior claimed as universal without testing the relevant deployment
 - A search-path candidate that is attacker-named but cannot be created, claimed, loaded, or executed

strix/tools/mcp/auth.py

@@ -0,0 +1,56 @@
+"""In-memory bearer refresh for HTTP MCP connections."""
+
+from __future__ import annotations
+
+import asyncio
+import logging
+from typing import TYPE_CHECKING
+
+import httpx
+
+
+if TYPE_CHECKING:
+    from collections.abc import AsyncGenerator, Awaitable, Callable
+
+
+logger = logging.getLogger(__name__)
+
+
+class RefreshingBearerAuth(httpx.Auth):
+    def __init__(
+        self, token: str | None, refresh_token: Callable[[], Awaitable[str | None]]
+    ) -> None:
+        self._token = token
+        self._refresh_token = refresh_token
+        self._lock = asyncio.Lock()
+        self._refresh_generation = 0
+
+    def _authorize(self, request: httpx.Request, token: str | None) -> None:
+        if token:
+            request.headers["Authorization"] = f"Bearer {token}"
+        else:
+            request.headers.pop("Authorization", None)
+
+    async def async_auth_flow(
+        self, request: httpx.Request
+    ) -> AsyncGenerator[httpx.Request, httpx.Response]:
+        sent_token = self._token
+        sent_generation = self._refresh_generation
+        self._authorize(request, sent_token)
+        response = yield request
+        if response.status_code != 401:
+            return
+        async with self._lock:
+            if self._token == sent_token and self._refresh_generation == sent_generation:
+                try:
+                    token = await self._refresh_token()
+                except Exception as exc:  # noqa: BLE001
+                    logger.warning("MCP bearer refresh failed (%s)", type(exc).__name__)
+                    token = None
+                self._refresh_generation += 1
+                if token and token != sent_token:
+                    self._token = token
+            retry_token = self._token
+        if retry_token and retry_token != sent_token:
+            self._authorize(request, retry_token)
+            yield request

strix/tools/mcp/client.py

@@ -39,10 +39,11 @@ from strix.tools.mcp.session import McpConnectionUnavailableError, SupervisedMcp
 
 
 if TYPE_CHECKING:
-    from collections.abc import Callable
+    from collections.abc import Awaitable, Callable, Mapping
 
     import httpx
 
+    from strix.tools.mcp.auth import RefreshingBearerAuth
     from strix.tools.mcp.config import McpConnectionConfig
     from strix.tools.mcp.registry import McpConnectionRequest, McpRegistry
 
@@ -121,7 +122,9 @@ class _QuietMCPServerStdio(MCPServerStdio):
         return _quiet_stdio_streams(self.params)
 
 
-def _build_server(config: McpConnectionConfig) -> BuiltMcpServer:
+def _build_server(
+    config: McpConnectionConfig, bearer_auth: RefreshingBearerAuth | None = None
+) -> BuiltMcpServer:
     """Construct (but do not connect) the SDK server for one connection.
 
     The returned tuple carries the server and, for HTTP connections, a recorder
@@ -161,13 +164,13 @@ def _build_server(config: McpConnectionConfig) -> BuiltMcpServer:
         timeout: httpx.Timeout | None = None,
         auth: httpx.Auth | None = None,
     ) -> httpx.AsyncClient:
-        client = create_mcp_http_client(headers=headers, timeout=timeout, auth=auth)
+        client = create_mcp_http_client(headers=headers, timeout=timeout, auth=bearer_auth or auth)
         client.event_hooks.setdefault("response", []).append(recorder)
         return client
 
     http_params: MCPServerStreamableHttpParams = {
         "url": cast("str", config.url),
-        "headers": _auth_headers(config),
+        "headers": {} if bearer_auth is not None else _auth_headers(config),
         "timeout": config.http_timeout_seconds,
         "sse_read_timeout": config.sse_read_timeout_seconds,
         "httpx_client_factory": httpx_client_factory,
@@ -300,9 +303,12 @@ async def connect_mcp_servers(
     configs: list[McpConnectionConfig],
     *,
     max_concurrency: int = 6,
+    token_refreshers: Mapping[str, Callable[[], Awaitable[str | None]]] | None = None,
 ) -> list[ConnectedMcpServer]:
     """Connect MCP configs concurrently under a fixed bound.
 
+    ``token_refreshers`` optionally supplies a bearer refresher by connection name.
+
     Each connection becomes a :class:`~strix.tools.mcp.session.SupervisedMcpSession`
     that owns ``connect()``, the held-open session, and ``cleanup()`` on one
     dedicated task, so a later background failure in one session is contained to
@@ -325,7 +331,10 @@ async def connect_mcp_servers(
 
     async def connect_one(config: McpConnectionConfig) -> ConnectedMcpServer | None:
         async with semaphore:
-            session = SupervisedMcpSession(config)
+            session = SupervisedMcpSession(
+                config,
+                refresh_token=token_refreshers.get(config.name) if token_refreshers else None,
+            )
             sessions.append(session)
             try:
                 if not await session.start():
@@ -381,7 +390,14 @@ async def attach_mcp_requests(
     ends).
     """
     request_by_name = {request.config.name: request for request in requests}
-    connections = await connect_mcp_servers([request.config for request in requests])
+    connections = await connect_mcp_servers(
+        [request.config for request in requests],
+        token_refreshers={
+            request.config.name: request.refresh_token
+            for request in requests
+            if request.refresh_token is not None
+        },
+    )
     for connection in connections:
         request = request_by_name[connection.name]
         registry.add(
@@ -391,5 +407,6 @@ async def attach_mcp_requests(
             purpose=request.purpose or connection.notes,
             provider=request.provider,
             result_transform=request.result_transform,
+            refresh_token=request.refresh_token,
         )
     return connections

strix/tools/mcp/failures.py

@@ -129,12 +129,20 @@ def classify(exc: BaseException) -> FailureInfo:
 
 
 class HttpStatusRecorder:
-    """Capture the last non-success response from one HTTP connection."""
+    """Capture the last non-success response from one HTTP connection.
+
+    A later success clears a recorded 401, so a bearer refreshed and retried
+    in the auth flow does not leave a stale auth failure behind.
+    """
 
     def __init__(self) -> None:
         self._failure: FailureInfo | None = None
 
     async def __call__(self, response: httpx.Response) -> None:
+        if 200 <= response.status_code < 300:
+            if self._failure is not None and self._failure.kind == "auth":
+                self._failure = None
+            return
         if not 200 <= response.status_code < 300:
             request = response.request
             self._failure = _from_status(

strix/tools/mcp/registry.py

@@ -32,7 +32,7 @@ from strix.tools.mcp.session import McpConnectionUnavailableError, SupervisedMcp
 
 
 if TYPE_CHECKING:
-    from collections.abc import Callable
+    from collections.abc import Awaitable, Callable
 
     from agents.mcp import MCPServer
 
@@ -96,6 +96,9 @@ class McpConnectionEntry:
     tool_count: int = 0
     result_transform: ResultTransform | None = None
     provider: str | None = None
+    refresh_token: Callable[[], Awaitable[str | None]] | None = dataclasses.field(
+        default=None, repr=False
+    )
     state: McpConnectionState = "configured"
     _catalog: list[Any] | None = dataclasses.field(default=None, repr=False)
     _connect_task: asyncio.Task[SupervisedMcpSession] | None = dataclasses.field(
@@ -180,7 +183,7 @@ class McpConnectionEntry:
                 f"MCP connection {self.name!r} has no connection configuration."
             )
         self._set_state("connecting")
-        session = SupervisedMcpSession(config)
+        session = SupervisedMcpSession(config, refresh_token=self.refresh_token)
         try:
             started = await session.start()
         except BaseException:
@@ -298,12 +301,17 @@ class McpConnectionRequest:
     at the single dispatch point (strix-pro's sanitizer; empty for the
     command-line path). ``purpose`` is the human label ``list_mcps`` reports as the
     connection's description; when unset it falls back to ``config.notes``.
+    ``refresh_token`` optionally fetches a new bearer asynchronously after an HTTP
+    401; returning no token or the current token leaves the failure unchanged.
     """
 
     config: McpConnectionConfig
     provider: str | None = None
     result_transform: ResultTransform | None = None
     purpose: str | None = None
+    refresh_token: Callable[[], Awaitable[str | None]] | None = dataclasses.field(
+        default=None, repr=False
+    )
 
 
 class McpCallInfo(NamedTuple):
@@ -337,6 +345,7 @@ class McpRegistry:
             purpose=request.purpose or request.config.notes,
             result_transform=request.result_transform,
             provider=request.provider,
+            refresh_token=request.refresh_token,
         )
         entry.set_status_sink(self._status_sink)
         self._entries[entry.name] = entry
@@ -353,6 +362,7 @@ class McpRegistry:
         tool_count: int = 0,
         result_transform: ResultTransform | None = None,
         provider: str | None = None,
+        refresh_token: Callable[[], Awaitable[str | None]] | None = None,
     ) -> McpConnectionEntry:
         """Register one connection under ``name`` (last write wins).
 
@@ -374,6 +384,7 @@ class McpRegistry:
             tool_count=tool_count,
             result_transform=result_transform,
             provider=provider,
+            refresh_token=refresh_token,
             state="connected",
         )
         entry.set_status_sink(self._status_sink)

strix/tools/mcp/session.py

@@ -54,6 +54,7 @@ import time
 import weakref
 from typing import TYPE_CHECKING, Any, Literal, cast
 
+from strix.tools.mcp.auth import RefreshingBearerAuth
 from strix.tools.mcp.config import DEFAULT_MAX_CONCURRENT_CALLS
 from strix.tools.mcp.failures import FailureInfo, HttpStatusRecorder, classify
 
@@ -157,9 +158,19 @@ class SupervisedMcpSession:
     :attr:`name`, :attr:`server`, :attr:`config`, :attr:`is_dead`.
     """
 
-    def __init__(self, config: McpConnectionConfig) -> None:
+    def __init__(
+        self,
+        config: McpConnectionConfig,
+        *,
+        refresh_token: Callable[[], Awaitable[str | None]] | None = None,
+    ) -> None:
         self._name = config.name
         self._config: McpConnectionConfig | None = config
+        self._bearer_auth = (
+            RefreshingBearerAuth(config.auth.token if config.auth else None, refresh_token)
+            if refresh_token is not None and config.transport == "http"
+            else None
+        )
         self._server: MCPServer | None = None
         self._supervised = True
         self._task: asyncio.Task[None] | None = None
@@ -193,6 +204,7 @@ class SupervisedMcpSession:
         self = cls.__new__(cls)
         self._name = name
         self._config = config
+        self._bearer_auth = None
         self._server = server
         self._supervised = False
         self._task = None
@@ -701,7 +713,11 @@ class SupervisedMcpSession:
 
         if self._config is None:
             raise RuntimeError(f"MCP connection {self._name!r} has no config to connect")
-        built = _build_server(self._config)
+        built = (
+            _build_server(self._config, self._bearer_auth)
+            if self._bearer_auth is not None
+            else _build_server(self._config)
+        )
         server = built.server
         self._recorder = built.recorder
         try:

strix/tools/reporting/tool.py

@@ -1693,7 +1693,6 @@ _VALID_REACHABILITY = frozenset(
     {
         "not_imported",
         "imported",
-        "not_reached",
         "vulnerable_symbol_used",
         "reachable_call_path",
         "unknown",
@@ -1841,9 +1840,6 @@ def _build_dependency_metadata(
 _REACHABILITY_EVIDENCE_LABELS = {
     "not_imported": "not imported by application code",
     "imported": "imported by application code; affected API usage unconfirmed",
-    "not_reached": (
-        "imported by application code; the vulnerable code of this advisory is not reached"
-    ),
     "vulnerable_symbol_used": "the advisory's affected API is used in application code",
     "reachable_call_path": (
         "a call path from application code to the vulnerable function was proven"
@@ -2161,11 +2157,6 @@ async def create_dependency_report(
       can evade static search).
     - ``imported`` — application code imports the package, but usage of
       the advisory's affected API was not confirmed.
-    - ``not_reached`` — application code imports the package, and the
-      analysis showed that the vulnerable code of this advisory does not
-      run here (the affected API has no caller, the only call site is
-      behind a condition that is false in this codebase, the parent
-      package never reaches it, ...). Per advisory, never per package.
     - ``vulnerable_symbol_used`` — the advisory's affected
       function/class/API appears in application code.
     - ``reachable_call_path`` — a call-graph tool (e.g. ``govulncheck``)
@@ -2219,9 +2210,8 @@ async def create_dependency_report(
             repository root. This binds the finding to its exact file so
             remediation can target the right repository.
         reachability: Usage-evidence level from static analysis — one of
-            ``not_imported`` / ``imported`` / ``not_reached`` /
-            ``vulnerable_symbol_used`` / ``reachable_call_path`` /
-            ``unknown``. Claim only what the
+            ``not_imported`` / ``imported`` / ``vulnerable_symbol_used`` /
+            ``reachable_call_path`` / ``unknown``. Claim only what the
             evidence proves; when in doubt use ``unknown``.
         reachability_evidence: **Required.** The concrete proof for the
             claimed level, or, for ``unknown``, what you searched and why

tests/test_mcp_auth.py

@@ -0,0 +1,223 @@
+"""HTTP bearer refresh regressions without network access."""
+
+from __future__ import annotations
+
+import asyncio
+from typing import Any, cast
+from unittest.mock import AsyncMock
+
+import httpx
+import pytest
+from mcp.types import CallToolResult, TextContent, Tool
+
+from strix.tools.mcp import BearerAuth, McpConnectionConfig, McpConnectionRequest, McpRegistry
+from strix.tools.mcp import client as mcp_client
+from strix.tools.mcp import session as mcp_session
+from strix.tools.mcp.auth import RefreshingBearerAuth
+
+
+def _config() -> McpConnectionConfig:
+    return McpConnectionConfig(
+        name="refresh",
+        url="https://example.test/mcp",
+        auth=BearerAuth(token="old"),  # noqa: S106  # nosec B106
+    )
+
+
+def _client(auth: RefreshingBearerAuth | None, handler: Any) -> httpx.AsyncClient:
+    built = mcp_client._build_server(_config(), auth)
+    params = cast("Any", built.server).params
+    assert params["headers"] == ({} if auth else {"Authorization": "Bearer old"})
+    client = cast("httpx.AsyncClient", params["httpx_client_factory"](headers=params["headers"]))
+    client._transport = httpx.MockTransport(handler)
+    return client
+
+
+@pytest.mark.asyncio
+async def test_refresh_retries_once_and_persists_across_server_builds() -> None:
+    refresh = AsyncMock(return_value="new")
+    session = mcp_session.SupervisedMcpSession(_config(), refresh_token=refresh)
+    seen: list[str] = []
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        seen.append(request.headers["Authorization"])
+        return httpx.Response(200 if seen[-1] == "Bearer new" else 401)
+
+    for _ in range(2):
+        async with _client(session._bearer_auth, handler) as client:
+            response = await client.post("https://example.test/mcp", content=b"payload")
+            assert response.status_code == 200
+    assert seen == ["Bearer old", "Bearer new", "Bearer new"]
+    refresh.assert_awaited_once()
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("replacement", ["new", None, "old", "raises"])
+async def test_concurrent_unauthorized_requests_share_refresh(replacement: str | None) -> None:
+    refresh = AsyncMock(return_value=replacement)
+    if replacement == "raises":
+        refresh.side_effect = ValueError("refresh unavailable")
+    auth = RefreshingBearerAuth("old", refresh)
+    both_sent = asyncio.Event()
+    old_requests = 0
+
+    async def handler(request: httpx.Request) -> httpx.Response:
+        nonlocal old_requests
+        if request.headers["Authorization"] == "Bearer old":
+            old_requests += 1
+            if old_requests == 5:
+                both_sent.set()
+            await both_sent.wait()
+            return httpx.Response(401)
+        return httpx.Response(200)
+
+    async with _client(auth, handler) as client:
+        responses = await asyncio.wait_for(
+            asyncio.gather(*(client.get("https://example.test/mcp") for _ in range(5))),
+            timeout=2,
+        )
+    assert [response.status_code for response in responses] == [
+        200 if replacement == "new" else 401
+    ] * 5
+    assert old_requests == 5
+    refresh.assert_awaited_once()
+
+
+@pytest.mark.parametrize("replacement", [None, "", "old", "new", "raises", "disabled"])
+@pytest.mark.asyncio
+async def test_unrecovered_401_still_retires_connection(
+    replacement: str | None, caplog: pytest.LogCaptureFixture
+) -> None:
+    refresh = AsyncMock(return_value=replacement)
+    if replacement == "raises":
+        refresh.side_effect = ValueError("private-token-value")
+    auth = None if replacement == "disabled" else RefreshingBearerAuth("old", refresh)
+    seen: list[str] = []
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        seen.append(request.headers["Authorization"])
+        return httpx.Response(401)
+
+    async with _client(auth, handler) as client:
+        server = AsyncMock()
+
+        async def call_tool(*_args: Any, **_kwargs: Any) -> None:
+            response = await client.get("https://example.test/mcp")
+            response.raise_for_status()
+
+        server.call_tool = call_tool
+        session = mcp_session.SupervisedMcpSession.adopt(server, name="refresh")
+        result = await session.dispatch("read", {}, label="refresh_read")
+        assert result["success"] is False
+        assert session.is_dead
+        await session.aclose()
+    assert seen == (["Bearer old", "Bearer new"] if replacement == "new" else ["Bearer old"])
+    assert refresh.await_count == (0 if replacement == "disabled" else 1)
+    assert "private-token-value" not in caplog.text
+    if replacement == "raises":
+        assert "ValueError" in caplog.text
+
+
+@pytest.mark.asyncio
+async def test_non_401_does_not_refresh() -> None:
+    refresh = AsyncMock(return_value="new")
+    auth = RefreshingBearerAuth("old", refresh)
+    async with _client(auth, lambda _: httpx.Response(403)) as client:
+        assert (await client.get("https://example.test/mcp")).status_code == 403
+    refresh.assert_not_awaited()
+
+
+@pytest.mark.asyncio
+async def test_registry_passes_refresher_to_session(monkeypatch: pytest.MonkeyPatch) -> None:
+    refresh = AsyncMock(return_value="new")
+    registry = McpRegistry()
+    entry = registry.register(McpConnectionRequest(_config(), refresh_token=refresh))
+    server = AsyncMock()
+    captured: list[RefreshingBearerAuth] = []
+
+    def build(_config: McpConnectionConfig, auth: RefreshingBearerAuth) -> Any:
+        captured.append(auth)
+        return mcp_client.BuiltMcpServer(server, None)
+
+    monkeypatch.setattr(mcp_client, "_build_server", build)
+    session = await entry.ensure_connected()
+    assert entry.refresh_token is refresh
+    assert captured == [session._bearer_auth]
+    await session._open()
+    assert captured == [session._bearer_auth, session._bearer_auth]
+    await session.aclose()
+
+
+@pytest.mark.asyncio
+async def test_refreshed_token_can_refresh_again_after_expiry() -> None:
+    refresh = AsyncMock(side_effect=["new", "newer"])
+    auth = RefreshingBearerAuth("old", refresh)
+    valid = "new"
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(200 if request.headers["Authorization"] == f"Bearer {valid}" else 401)
+
+    async with _client(auth, handler) as client:
+        assert (await client.get("https://example.test/mcp")).status_code == 200
+        valid = "newer"
+        assert (await client.get("https://example.test/mcp")).status_code == 200
+    assert refresh.await_count == 2
+
+
+@pytest.mark.parametrize("with_refresher", [True, False])
+@pytest.mark.asyncio
+async def test_eager_attachment_preserves_bearer_refresh(
+    monkeypatch: pytest.MonkeyPatch, with_refresher: bool
+) -> None:
+    refresh = AsyncMock(return_value="new")
+    original_build = mcp_client._build_server
+    valid = "old"
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(200 if request.headers["Authorization"] == f"Bearer {valid}" else 401)
+
+    def build(config: McpConnectionConfig, auth: RefreshingBearerAuth | None = None) -> Any:
+        built = original_build(config, auth)
+        params = cast("Any", built.server).params
+        client = params["httpx_client_factory"](headers=params["headers"])
+        client._transport = httpx.MockTransport(handler)
+        server = AsyncMock()
+        server.use_structured_content = False
+        server.list_tools.return_value = [Tool(name="read", inputSchema={"type": "object"})]
+        server.cleanup.side_effect = client.aclose
+
+        async def call_tool(*_args: Any, **_kwargs: Any) -> CallToolResult:
+            response = await client.post("https://example.test/mcp")
+            response.raise_for_status()
+            return CallToolResult(content=[TextContent(type="text", text="ok")])
+
+        server.call_tool = call_tool
+        return mcp_client.BuiltMcpServer(server, built.recorder)
+
+    monkeypatch.setattr(mcp_client, "_build_server", build)
+    registry = McpRegistry()
+    try:
+        connections = await mcp_client.attach_mcp_requests(
+            [McpConnectionRequest(_config(), refresh_token=refresh if with_refresher else None)],
+            registry,
+        )
+        assert len(connections) == 1
+        entry = registry.get("refresh")
+        assert entry is not None
+        assert entry.refresh_token is (refresh if with_refresher else None)
+        session = await entry.ensure_connected()
+        assert await session.dispatch("read", {}, label="refresh_read") == {
+            "type": "text",
+            "text": "ok",
+        }
+        valid = "new"
+        result = await session.dispatch("read", {}, label="refresh_read")
+        if with_refresher:
+            assert result == {"type": "text", "text": "ok"}
+            assert not session.is_dead
+            refresh.assert_awaited_once()
+        else:
+            assert result["success"] is False
+            assert session.is_dead
+    finally:
+        await registry.close()

tests/test_mcp_resilience.py

@@ -111,6 +111,15 @@ async def test_retry_after_parses_seconds_and_http_date() -> None:
     assert 0 <= retry_after <= 20
 
 
+@pytest.mark.asyncio
+async def test_successful_response_clears_previous_auth_failure() -> None:
+    recorder = HttpStatusRecorder()
+    await recorder(_http_error(401).response)
+    request = httpx.Request("POST", "https://provider.example/tools")
+    await recorder(httpx.Response(200, request=request))
+    assert recorder.take() is None
+
+
 @pytest.mark.asyncio
 async def test_recorder_only_keeps_non_sensitive_request_metadata() -> None:
     recorder = HttpStatusRecorder()

tests/test_reporting_fields.py

@@ -668,39 +668,6 @@ async def test_dependency_report_records_reachability(report_state: ReportState)
     assert report["severity"] == "high"
 
 
-async def test_dependency_report_records_not_reached(report_state: ReportState) -> None:
-    result = await _do_create_dependency(
-        title="CVE-2021-23337 in lodash 4.17.20",
-        description="Command injection via template.",
-        target="repo/package.json",
-        cve="CVE-2021-23337",
-        package_name="lodash",
-        installed_version="4.17.20",
-        impact="Command injection where template is used.",
-        remediation_steps="Upgrade to 4.17.21.",
-        assumptions="Static search only; no dynamic dispatch into lodash was found.",
-        package_ecosystem="npm",
-        manifest_path="package-lock.json",
-        fixed_version="4.17.21",
-        cwe=None,
-        advisory_cvss=7.2,
-        technical_analysis=None,
-        fix_effort="low",
-        reachability="not_reached",
-        reachability_evidence=(
-            "src/util/strings.ts:3 imports lodash; a complete search of src/ finds no "
-            "call to _.template, the only API the advisory affects."
-        ),
-        contextual_cvss_breakdown=_DEP_CONTEXT,
-        contextual_cvss_reasoning=_DEP_REASONING,
-    )
-
-    assert result["success"] is True
-    report = report_state.vulnerability_reports[0]
-    assert report["dependency_metadata"]["reachability"] == "not_reached"
-    assert "the vulnerable code of this advisory is not reached" in report["evidence"]
-
-
 async def test_dependency_report_rejects_reachability_without_evidence(
     report_state: ReportState,
 ) -> None: