Retry OAuth disk refresh after a failed read

The refresh guard recorded the file stamp before reading it, so a
persistently unreadable auth file (e.g. chmod 000) wiped the in-memory
mirror with empty state and never retried. The stamp is now committed
only after a successful read, leaving it stale so the next getter call
retries. loadAuthStateSync also now matches loadAuthState's error
contract: missing (ENOENT) or corrupt files yield empty state, while
other read errors propagate to the caller instead of being swallowed.

Author: TheGreatAxios

src/mcp/auth-store.ts

@@ -51,17 +51,26 @@ export function authFilePath(identity: MCPAuthIdentity, home: string = homedir()
 }
 
 // Synchronous mirror of loadAuthState for the SDK's sync getters (tokens(),
-// clientInformation(), codeVerifier()), which cannot await disk I/O. A missing or
-// corrupt file yields empty state, matching loadAuthState's tolerance.
+// clientInformation(), codeVerifier()), which cannot await disk I/O. Tolerates
+// a missing (ENOENT) or corrupt file with empty state, matching loadAuthState;
+// other read errors propagate to the caller.
 export function loadAuthStateSync(
   identity: MCPAuthIdentity,
   home: string = homedir(),
 ): MCPAuthState {
   let raw: string;
   try {
     raw = readFileSync(authFilePath(identity, home), "utf8");
-  } catch {
-    return {};
+  } catch (err) {
+    if (
+      typeof err === "object" &&
+      err !== null &&
+      "code" in err &&
+      (err as { code?: unknown }).code === "ENOENT"
+    ) {
+      return {};
+    }
+    throw err;
   }
   try {
     const parsed: unknown = JSON.parse(raw);

src/mcp/oauth-provider.test.ts

@@ -1,8 +1,8 @@
 import { describe, expect, test } from "bun:test";
-import { mkdir, mkdtemp, readFile, writeFile } from "node:fs/promises";
+import { chmod, appendFile, mkdir, mkdtemp, readFile, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { loadAuthState, saveAuthState, deleteAuthState } from "./auth-store.js";
+import { authFilePath, loadAuthState, saveAuthState, deleteAuthState } from "./auth-store.js";
 import { createOAuthProvider } from "./oauth-provider.js";
 
 async function tempHome(): Promise<string> {
@@ -254,6 +254,29 @@ describe("createOAuthProvider", () => {
     expect(await syncValue(provider.clientInformation())).toBeUndefined();
   });
 
+  test("keeps the mirror through an unreadable auth file and recovers once readable", async () => {
+    const home = await tempHome();
+    const provider = await createOAuthProvider({
+      serverName: "linear",
+      serverURL: linear.serverURL,
+      redirectUrl: "http://127.0.0.1:1/callback",
+      onAuthURL: () => undefined,
+      home,
+    });
+    await provider.saveTokens({ access_token: "tok", token_type: "bearer" });
+
+    // Force a stat change so the mtime guard actually attempts the read.
+    const path = authFilePath(linear, home);
+    await appendFile(path, " ");
+    await chmod(path, 0o000);
+    expect((await syncValue(provider.tokens()))?.access_token).toBe("tok");
+    expect((await syncValue(provider.tokens()))?.access_token).toBe("tok");
+
+    await chmod(path, 0o600);
+    await saveAuthState(linear, { tokens: { access_token: "fresh", token_type: "bearer" } }, home);
+    expect((await syncValue(provider.tokens()))?.access_token).toBe("fresh");
+  });
+
   test("does not delete scoped state whose filename stem is another provider name", async () => {
     const home = await tempHome();
     const dir = join(home, ".corbits", "mcp-auth");

src/mcp/oauth-provider.ts

@@ -97,8 +97,16 @@ export async function createOAuthProvider(
       return;
     }
     if (stamp === seenStamp) return;
+    let next: MCPAuthState;
+    try {
+      next = loadAuthStateSync(identity, home);
+    } catch {
+      // Unreadable rather than missing: leave the stamp stale so the next
+      // getter call retries instead of pinning an empty state over the mirror.
+      return;
+    }
     seenStamp = stamp;
-    replaceStored(stored, loadAuthStateSync(identity, home));
+    replaceStored(stored, next);
   };
 
   let oauthState: string | undefined;