Re-read OAuth state from disk in the provider's sync getters

The MCP OAuth provider snapshotted auth state once at construction, so
a session that re-authenticated never published its fresh tokens to
sibling sessions: they kept serving a stale in-memory mirror and
needlessly triggered the browser flow after a 401.

The SDK requires tokens(), clientInformation(), and codeVerifier() to
be synchronous, so the getters now guard with statSync and only
readFileSync the auth file (via a new loadAuthStateSync that mirrors
loadAuthState's parsing) when its mtime or size changed. A vanished or
unreadable file keeps the in-memory mirror instead of throwing from a
sync getter.

Author: TheGreatAxios

src/mcp/auth-store.ts

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import type {
@@ -41,14 +42,37 @@ export function normalizeMCPServerURL(serverURL: string): string {
   return url.toString();
 }
 
-function authFilePath(identity: MCPAuthIdentity, home: string): string {
+export function authFilePath(identity: MCPAuthIdentity, home: string = homedir()): string {
   const normalizedURL = normalizeMCPServerURL(identity.serverURL);
   const digest = createHash("sha256")
     .update(JSON.stringify([identity.serverName, normalizedURL]))
     .digest("hex");
   return join(mcpAuthDir(home), `${serverDisplaySlug(identity.serverName)}-${digest}.json`);
 }
 
+// Synchronous mirror of loadAuthState for the SDK's sync getters (tokens(),
+// clientInformation(), codeVerifier()), which cannot await disk I/O. A missing or
+// corrupt file yields empty state, matching loadAuthState's tolerance.
+export function loadAuthStateSync(
+  identity: MCPAuthIdentity,
+  home: string = homedir(),
+): MCPAuthState {
+  let raw: string;
+  try {
+    raw = readFileSync(authFilePath(identity, home), "utf8");
+  } catch {
+    return {};
+  }
+  try {
+    const parsed: unknown = JSON.parse(raw);
+    if (typeof parsed === "object" && parsed !== null) return parsed as MCPAuthState;
+  } catch {
+    // A corrupt auth file should not wedge the session; treat it as no state and
+    // let a fresh authorization overwrite it.
+  }
+  return {};
+}
+
 export async function loadAuthState(
   identity: MCPAuthIdentity,
   home: string = homedir(),

src/mcp/oauth-provider.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, test } from "bun:test";
 import { mkdir, mkdtemp, readFile, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { loadAuthState, saveAuthState } from "./auth-store.js";
+import { loadAuthState, saveAuthState, deleteAuthState } from "./auth-store.js";
 import { createOAuthProvider } from "./oauth-provider.js";
 
 async function tempHome(): Promise<string> {
@@ -208,6 +208,52 @@ describe("createOAuthProvider", () => {
     expect(await readFile(join(dir, ".json"), "utf8")).toBe(legacy);
   });
 
+  test("propagates tokens saved by one provider to an existing sibling provider", async () => {
+    const home = await tempHome();
+    const a = await createOAuthProvider({
+      serverName: "linear",
+      serverURL: linear.serverURL,
+      redirectUrl: "http://127.0.0.1:1/callback",
+      onAuthURL: () => undefined,
+      home,
+    });
+    const b = await createOAuthProvider({
+      serverName: "linear",
+      serverURL: linear.serverURL,
+      redirectUrl: "http://127.0.0.1:1/callback",
+      onAuthURL: () => undefined,
+      home,
+    });
+    expect(await syncValue(b.tokens())).toBeUndefined();
+
+    await a.saveTokens({
+      access_token: "fresh",
+      token_type: "bearer",
+      expires_in: 3600,
+      refresh_token: "fresh-refresh",
+    });
+
+    expect((await syncValue(b.tokens()))?.access_token).toBe("fresh");
+  });
+
+  test("sync getters fall back to the in-memory mirror when the auth file disappears", async () => {
+    const home = await tempHome();
+    const provider = await createOAuthProvider({
+      serverName: "linear",
+      serverURL: linear.serverURL,
+      redirectUrl: "http://127.0.0.1:1/callback",
+      onAuthURL: () => undefined,
+      home,
+    });
+    await provider.saveTokens({ access_token: "tok", token_type: "bearer" });
+    expect((await syncValue(provider.tokens()))?.access_token).toBe("tok");
+
+    await deleteAuthState(linear, home);
+
+    expect((await syncValue(provider.tokens()))?.access_token).toBe("tok");
+    expect(await syncValue(provider.clientInformation())).toBeUndefined();
+  });
+
   test("does not delete scoped state whose filename stem is another provider name", async () => {
     const home = await tempHome();
     const dir = join(home, ".corbits", "mcp-auth");

src/mcp/oauth-provider.ts

@@ -5,7 +5,15 @@ import type {
   OAuthClientMetadata,
   OAuthTokens,
 } from "@modelcontextprotocol/sdk/shared/auth.js";
-import { updateAuthState, type MCPAuthIdentity, type MCPAuthState } from "./auth-store.js";
+import {
+  authFilePath,
+  loadAuthStateSync,
+  updateAuthState,
+  type MCPAuthIdentity,
+  type MCPAuthState,
+} from "./auth-store.js";
+import { statSync } from "node:fs";
+import { homedir } from "node:os";
 import { MCP_CLIENT_NAME } from "../branding.js";
 
 export interface OAuthProviderOptions {
@@ -54,22 +62,45 @@ export async function createOAuthProvider(
     serverName: opts.serverName,
     serverURL: opts.serverURL,
   };
+  const home = opts.home ?? homedir();
   // Load + scrub stale DCR under the per-file chain so concurrent providers see
-  // the same cleaned state. Mutations always re-read disk; this in-memory mirror
-  // only serves the SDK's sync getters (tokens / clientInformation / codeVerifier).
+  // the same cleaned state. Mutations always re-read disk; the in-memory mirror
+  // serves the SDK's sync getters, refreshed from disk when the auth file
+  // changes so tokens saved by another session are picked up immediately.
   const stored: MCPAuthState = await updateAuthState(
     identity,
     (state) => {
       dropStaleClientRegistration(state, opts.redirectUrl);
     },
-    opts.home,
+    home,
   );
 
   const apply = async (mutator: (state: MCPAuthState) => void): Promise<void> => {
-    const next = await updateAuthState(identity, mutator, opts.home);
+    const next = await updateAuthState(identity, mutator, home);
     replaceStored(stored, next);
   };
 
+  // Cheap staleness guard: statSync per getter, sync read only when the file's
+  // mtime or size changed. A vanished file keeps the mirror rather than throwing.
+  const authPath = authFilePath(identity, home);
+  let seenStamp: string | undefined;
+  const refreshFromDisk = (): void => {
+    let stamp: string | undefined;
+    try {
+      const stat = statSync(authPath);
+      stamp = `${String(stat.mtimeMs)}:${String(stat.size)}`;
+    } catch {
+      // File gone (or unreadable): keep serving the in-memory mirror rather
+      // than throwing from a sync getter.
+      if (seenStamp === undefined) return;
+      seenStamp = undefined;
+      return;
+    }
+    if (stamp === seenStamp) return;
+    seenStamp = stamp;
+    replaceStored(stored, loadAuthStateSync(identity, home));
+  };
+
   let oauthState: string | undefined;
   return {
     get redirectUrl(): string {
@@ -89,6 +120,7 @@ export async function createOAuthProvider(
       };
     },
     clientInformation(): OAuthClientInformationMixed | undefined {
+      refreshFromDisk();
       return stored.clientInformation;
     },
     saveClientInformation(info: OAuthClientInformationMixed): Promise<void> {
@@ -97,6 +129,7 @@ export async function createOAuthProvider(
       });
     },
     tokens(): OAuthTokens | undefined {
+      refreshFromDisk();
       return stored.tokens;
     },
     saveTokens(tokens: OAuthTokens): Promise<void> {
@@ -115,6 +148,7 @@ export async function createOAuthProvider(
       });
     },
     codeVerifier(): string {
+      refreshFromDisk();
       if (stored.codeVerifier === undefined)
         throw new Error("No PKCE code verifier saved for this authorization.");
       return stored.codeVerifier;