fix(mcp): drop in-memory tokens only on real auth-file deletion

Author: TheGreatAxios

src/mcp/auth-store.ts

@@ -67,7 +67,7 @@ export function authFilePath(
   );
 }
 
-function isEnoent(err: unknown): boolean {
+export function isEnoent(err: unknown): boolean {
   return (
     typeof err === "object" &&
     err !== null &&

src/mcp/oauth-provider.test.ts

@@ -253,6 +253,34 @@ describe("createOAuthProvider", () => {
     expect(await syncValue(provider.tokens())).toBeUndefined();
   });
 
+  test("keeps live tokens when the auth file is unreadable but drops them on delete", async () => {
+    const home = await tempHome();
+    const provider = await createOAuthProvider({
+      serverName: "linear",
+      serverURL: linear.serverURL,
+      redirectUrl: "http://127.0.0.1:1/callback",
+      onAuthURL: () => undefined,
+      home,
+    });
+    await saveClient(provider, clientInfo(1));
+    await provider.saveTokens({ access_token: "tok", token_type: "bearer" });
+    expect((await syncValue(provider.tokens()))?.access_token).toBe("tok");
+
+    // A transient stat failure (EACCES here, file still present) must not
+    // discard live credentials — only a real deletion (ENOENT) does.
+    const dir = dirname(authFilePath(linear, home));
+    await chmod(dir, 0o000);
+    try {
+      expect((await syncValue(provider.tokens()))?.access_token).toBe("tok");
+    } finally {
+      await chmod(dir, 0o700);
+    }
+
+    await deleteAuthState(linear, home);
+
+    expect(await syncValue(provider.tokens())).toBeUndefined();
+  });
+
   test("two overlapping logins on different ports both complete without clobbering verifiers", async () => {
     const home = await tempHome();
     const a = await createOAuthProvider({

src/mcp/oauth-provider.ts

@@ -20,6 +20,7 @@ import type {
 import type { FetchLike } from "@modelcontextprotocol/sdk/shared/transport.js";
 import {
   authFilePath,
+  isEnoent,
   tryLoadAuthStateSync,
   updateAuthState,
   type MCPAuthIdentity,
@@ -161,24 +162,32 @@ export async function createOAuthProvider(
   // failed/unreadable file is retried on the next getter call.
   const authPath = authFilePath(identity, home);
   let seenStamp: string | undefined;
+  // True once this provider has committed a disk observation. A transient stat
+  // failure resets the stamp so the next getter retries, but must not erase
+  // the fact that durable state was seen — otherwise a later real deletion
+  // (ENOENT) would look like "never saw the file" and orphan live tokens.
+  let observedDurable = false;
   const refreshDurableFromDisk = (): void => {
     let stamp: string | undefined;
     try {
       const stat = statSync(authPath);
       stamp = `${String(stat.mtimeMs)}:${String(stat.size)}`;
-    } catch {
-      if (seenStamp === undefined) return;
+    } catch (err) {
+      if (!observedDurable) return;
+      seenStamp = undefined;
+      if (!isEnoent(err)) return;
       // The auth file is gone (server removed, logged out elsewhere). Hold no
       // orphaned credentials: drop the in-memory tokens too. A later sibling
       // save is adopted on the next read via the stamp check above.
-      seenStamp = undefined;
+      observedDurable = false;
       delete stored.tokens;
       return;
     }
     if (stamp === seenStamp) return;
     const next = tryLoadAuthStateSync(identity, home);
     if (next === undefined) return;
     seenStamp = stamp;
+    observedDurable = true;
     const adoptClient = shouldAdoptClient(stored, next, opts.redirectUrl);
     assignTokens(stored, next);
     if (adoptClient) assignClient(stored, next);