openclaw/mcporter v0.12.4 on GitHub

Stop reading embedded digits (ports, durations, hostnames, request ids) as HTTP 401 auth signals in connection-error classification, and let known status codes win over message text, so unreachable servers are no longer promoted to auth: "oauth". (PR #248, thanks @Yigtwxx)
Route chrome-devtools-mcp --autoConnect through a paired OpenClaw Chrome-extension relay when one is live on this host, eliminating Chrome's per-session "Allow remote debugging?" dialog; falls back to plain auto-connect otherwise (MCPORTER_DISABLE_CHROME_DEVTOOLS_RELAY=1 to opt out).
Correct the documented call timeout to 60 seconds and distinguish its MCPORTER_CALL_TIMEOUT and --timeout overrides from the 30-second list timeout. (PR #230, thanks @KrasimirKralev)
Isolate long-lived SSE receive streams from ordinary HTTP requests so byte-idle servers cannot stall tool listing and calls. (PR #234, thanks @umutkeltek)

Open the Windows OAuth browser via shell-free rundll32 url.dll,FileProtocolHandler instead of a cmd.exe command string, so quote- or ampersand-bearing authorization URLs cannot run shell side effects. (PR #242, thanks @SebTardif)
Serialize interactive OAuth authorization per provider/session: concurrent 401s (background SSE reconnect plus a bridged request) now join one pending PKCE transaction instead of opening duplicate prompts, and keep-alive daemons no longer restart and replay operations on auth failures. (Issue #247, thanks @mkaput)
Recover rotating refresh tokens after transient OAuth refresh failures without clearing a concurrently persisted winner, and clear only the exact rejected token on invalid_grant. (PR #227, thanks @feniix)
Treat a configured server URL change as a new OAuth trust boundary, clearing cached credentials permanently even if the URL is later reverted. (Issue #231, thanks @sourman)

Replace the broken v0.12.3 standalone artifact path with exact-tag arm64 and x86_64 macOS builds that require Foundation Developer ID signing, hardened runtime, timestamping, Bun JIT entitlements, notarization, strict native execution proof, basename-only checksums, and exact provenance/inventory verification before GitHub, npm, or Homebrew publication.

Isolate OAuth callback and session tests behind temporary HOME and XDG roots, with a regression sentinel proving ambient credentials stay untouched.

Refresh compatible Rolldown, Oxlint, Oxfmt, tsx, and TypeScript-linting dependencies while retaining the Vitest-compatible Vite 8.1.4 peer line.