@akanjs/devkit 3.1.1 → 3.1.2-rc.0

package/codeAgent/tools/McpSignIn.ts

@@ -16,7 +16,7 @@ export class McpSignIn {
 
   /** The token to connect with, or undefined when none is had without asking; a failed refresh is not a throw. */
   static async token(ref: CodeAgentMcpServerRef, onNotice?: (message: string) => void) {
-    const stored = McpTokenStore.read(ref.name);
+    const stored = McpTokenStore.read(ref);
     if (!stored) return undefined;
     if (!McpTokenStore.isExpired(stored)) return stored.accessToken;
     return await McpSignIn.#refreshOnce(ref, stored, onNotice);
@@ -24,14 +24,14 @@ export class McpSignIn {
 
   /** After a server answered `refused` with 401: a token another session stored since, else one refresh. */
   static async retryToken(ref: CodeAgentMcpServerRef, refused: string, onNotice?: (message: string) => void) {
-    const stored = McpTokenStore.read(ref.name);
+    const stored = McpTokenStore.read(ref);
     if (!stored) return undefined;
     if (stored.accessToken !== refused && !McpTokenStore.isExpired(stored)) return stored.accessToken;
     return await McpSignIn.#refreshOnce(ref, stored, onNotice);
   }
 
   static async #refreshOnce(ref: CodeAgentMcpServerRef, stored: McpStoredAuth, onNotice?: (message: string) => void) {
-    const key = `${ref.name}\n${stored.refreshToken}`;
+    const key = `${stored.issuer}\n${stored.refreshToken}`;
     let pending = McpSignIn.#refreshing.get(key);
     if (!pending) {
       pending = McpSignIn.#refreshed(ref, stored, onNotice).finally(() => McpSignIn.#refreshing.delete(key));
@@ -45,7 +45,7 @@ export class McpSignIn {
     try {
       return await ConfigLock.run(McpTokenStore.lockFile(), async () => {
         // Another `akan code` may have refreshed while this one waited: take its token, never its spent refresh token.
-        const current = McpTokenStore.read(ref.name);
+        const current = McpTokenStore.read(ref);
         if (!current) return undefined;
         if (current.accessToken !== stored.accessToken && !McpTokenStore.isExpired(current)) return current.accessToken;
         const server: McpOAuthServer = {
@@ -58,7 +58,7 @@ export class McpSignIn {
         // `expires_in` is optional (RFC 6749 §5.1): the spent token's expiry must not outlive it on the new one.
         const { expiresAt: _spent, ...grant } = current;
         // A server that rotates refresh tokens invalidates the old one, so keeping it would sign us out.
-        McpTokenStore.write(ref.name, { ...grant, ...tokens });
+        McpTokenStore.write(ref, { ...grant, ...tokens });
         return tokens.accessToken;
       });
     } catch (error) {
@@ -72,7 +72,7 @@ export class McpSignIn {
     if (!ref.url) throw new Error(`"${ref.name}" is a stdio server: give it its credential through "env".`);
     const challenge = await McpSignIn.challenge(ref);
     const server = await McpOAuth.discover(ref.url, challenge);
-    const stored = McpTokenStore.read(ref.name);
+    const stored = McpTokenStore.read(ref);
     const reusable = stored && stored.issuer === server.issuer && !ref.oauth?.clientId ? stored : undefined;
     const loopback = McpOAuthLoopback.bind(McpSignIn.#portOf(reusable?.redirectUri));
     try {
@@ -98,7 +98,7 @@ export class McpSignIn {
         redirectUri,
         ...tokens,
       };
-      McpTokenStore.write(ref.name, auth);
+      McpTokenStore.write(ref, auth);
       return auth;
     } finally {
       loopback.close();

package/codeAgent/tools/McpTokenStore.ts

@@ -20,7 +20,18 @@ export interface McpStoredAuth {
   scope?: string;
 }
 
+export interface McpTokenOwner {
+  name: string;
+  url?: string | undefined;
+}
+
+interface McpTokenEntry extends McpStoredAuth {
+  name: string;
+  origin: string;
+}
+
 // Home directory only, mode 0600: `.akan/code/mcp.json` is shared with the editors and routinely committed.
+// Keyed by the server's origin, not its name: a workspace `mcp.json` can give a known name any url.
 export class McpTokenStore {
   static file() {
     return akanCodePaths.mcpAuthFile();
@@ -30,24 +41,37 @@ export class McpTokenStore {
     return `${McpTokenStore.file()}.lock`;
   }
 
-  static read(name: string): McpStoredAuth | undefined {
-    return McpTokenStore.#all()[name];
+  static read(owner: McpTokenOwner): McpStoredAuth | undefined {
+    const origin = McpTokenStore.#originOf(owner.url);
+    if (!origin) return undefined;
+    const here = McpTokenStore.#all().filter((entry) => entry.origin === origin);
+    const entry = here.find((candidate) => candidate.name === owner.name) ?? here[0];
+    if (!entry) return undefined;
+    const { name: _name, origin: _origin, ...auth } = entry;
+    return auth;
   }
 
   static names() {
-    return Object.keys(McpTokenStore.#all());
+    return [...new Set(McpTokenStore.#all().map((entry) => entry.name))];
   }
 
   /** Re-reads right before writing, or two concurrent sign-ins each drop the other's token. */
-  static write(name: string, auth: McpStoredAuth) {
-    McpTokenStore.#save({ ...McpTokenStore.#all(), [name]: auth });
+  static write(owner: McpTokenOwner, auth: McpStoredAuth) {
+    const origin = McpTokenStore.#originOf(owner.url);
+    if (!origin) throw new Error(`"${owner.name}" has no http(s) url to bind its token to.`);
+    const kept = McpTokenStore.#all().filter(
+      (entry) => entry.origin !== origin || (entry.issuer !== auth.issuer && entry.name !== owner.name),
+    );
+    McpTokenStore.#save([...kept, { ...auth, name: owner.name, origin }]);
   }
 
-  static clear(name: string) {
+  //? Everything `read` could hand this server goes: its origin's tokens under any name, and its name's at any origin.
+  static clear(owner: McpTokenOwner) {
+    const origin = McpTokenStore.#originOf(owner.url);
     const all = McpTokenStore.#all();
-    if (!(name in all)) return false;
-    delete all[name];
-    McpTokenStore.#save(all);
+    const kept = all.filter((entry) => entry.name !== owner.name && entry.origin !== origin);
+    if (kept.length === all.length) return false;
+    McpTokenStore.#save(kept);
     return true;
   }
 
@@ -58,22 +82,45 @@ export class McpTokenStore {
   /** A token is treated as spent this long before it actually is, so a call never races its own expiry. */
   static readonly skewMs = 60_000;
 
-  static #all(): Record<string, McpStoredAuth> {
+  static #originOf(url: string | undefined) {
+    if (!url) return undefined;
+    try {
+      const parsed = new URL(url);
+      return parsed.protocol === "http:" || parsed.protocol === "https:" ? parsed.origin : undefined;
+    } catch {
+      return undefined;
+    }
+  }
+
+  static #keyOf(entry: McpTokenEntry) {
+    return `${entry.origin} ${entry.issuer}`;
+  }
+
+  static #all(): McpTokenEntry[] {
     const file = McpTokenStore.file();
-    if (!existsSync(file)) return {};
+    if (!existsSync(file)) return [];
     try {
-      const parsed = JSON.parse(readFileSync(file, "utf8")) as { servers?: Record<string, McpStoredAuth> };
-      return parsed.servers ?? {};
+      const parsed = JSON.parse(readFileSync(file, "utf8")) as {
+        tokens?: Record<string, McpTokenEntry>;
+        servers?: Record<string, McpStoredAuth>;
+      };
+      if (parsed.tokens) return Object.values(parsed.tokens);
+      // An older build keyed by name alone; its resource is the url the token was minted for, so it keeps that origin.
+      return Object.entries(parsed.servers ?? {}).flatMap(([name, auth]) => {
+        const origin = McpTokenStore.#originOf(auth.resource);
+        return origin ? [{ ...auth, name, origin }] : [];
+      });
     } catch {
-      return {};
+      return [];
     }
   }
 
-  static #save(servers: Record<string, McpStoredAuth>) {
+  static #save(entries: McpTokenEntry[]) {
     const file = McpTokenStore.file();
     mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    const tokens = Object.fromEntries(entries.map((entry) => [McpTokenStore.#keyOf(entry), entry]));
     const temp = `${file}.${process.pid}.tmp`;
-    writeFileSync(temp, `${JSON.stringify({ servers }, null, 2)}\n`, { mode: 0o600 });
+    writeFileSync(temp, `${JSON.stringify({ tokens }, null, 2)}\n`, { mode: 0o600 });
     renameSync(temp, file);
     // `rename` keeps the temp file's mode, but an existing target written by an older build may be looser.
     chmodSync(file, 0o600);

package/codeAgent/tools/McpToolPack.ts

@@ -7,6 +7,7 @@ import {
   codeAgentOutputChars,
 } from "akanjs/common";
 import { Type } from "typebox";
+import { WorkspaceTrust } from "../agent/WorkspaceTrust";
 import { McpClient, type McpToolInfo, McpUnauthorized } from "./McpClient";
 import { McpServerConfig } from "./McpServerConfig";
 import { McpSignIn } from "./McpSignIn";
@@ -194,6 +195,12 @@ export class McpToolPack {
   static #refs(options: McpToolPackOptions): CodeAgentMcpServerRef[] {
     if (options.profile.tools.mcp === "off") return [];
     const declared = Array.isArray(options.profile.tools.mcp) ? options.profile.tools.mcp : [];
-    return [...McpServerConfig.read(options.workspaceRoot), ...declared];
+    if (WorkspaceTrust.isTrusted(options.workspaceRoot, "mcp"))
+      return [...McpServerConfig.read(options.workspaceRoot), ...declared];
+    const skipped = McpServerConfig.read(options.workspaceRoot, ["workspace"]).map((ref) => ref.name);
+    options.onNotice?.(
+      `Not started, because this repo's MCP servers are not approved: ${skipped.join(", ")}. Start akan code in a terminal to approve them, or pass --trust-workspace.`,
+    );
+    return [...McpServerConfig.read(options.workspaceRoot, ["global"]), ...declared];
   }
 }

package/codeAgent/tools/WebToolPack.ts

@@ -3,6 +3,7 @@ import { isIP } from "node:net";
 import type { ExtensionAPI, InlineExtension } from "@earendil-works/pi-coding-agent";
 import { type CodeAgentProfile, codeAgentClip } from "akanjs/common";
 import { Type } from "typebox";
+import { codeAgentHostListed, codeAgentHostOf, codeAgentIsLoopback } from "../agent/codeAgentHosts";
 import { DeepSeekWeb } from "./DeepSeekWeb";
 
 export interface WebToolPackOptions {
@@ -34,6 +35,7 @@ interface WebPage {
 export class WebToolPack {
   static readonly pageChars = 10_000;
   static readonly maxResults = 10;
+  static readonly maxRedirects = 5;
   static readonly #rememberedPages = 16;
   readonly #options: WebToolPackOptions;
   // A continuation reads the snapshot its first page came from; a fresh read always refetches, since a local dev
@@ -164,8 +166,10 @@ export class WebToolPack {
   }
 
   async #read(url: string, signal?: AbortSignal): Promise<WebPage> {
+    const within = this.#boundOf(new URL(url).hostname);
     const deepseek = this.#options.deepseek;
-    if (deepseek && !(await this.#isLocal(new URL(url).hostname))) {
+    // DeepSeek follows a redirect on its own servers, where no host list reaches it.
+    if (deepseek && !within && !(await this.#isLocal(new URL(url).hostname))) {
       try {
         const page = await deepseek.fetch(url, signal);
         return { status: 200, ok: true, title: page.title, text: page.content };
@@ -173,11 +177,51 @@ export class WebToolPack {
         if (signal?.aborted) throw error;
       }
     }
-    const response = await fetch(url, {
-      signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(20_000)]) : AbortSignal.timeout(20_000),
-      redirect: "follow",
-    });
-    return { status: response.status, ok: response.ok, title: "", text: WebToolPack.#readable(await response.text()) };
+    const timeout = signal ? AbortSignal.any([signal, AbortSignal.timeout(20_000)]) : AbortSignal.timeout(20_000);
+    if (!within) {
+      const response = await fetch(url, { signal: timeout, redirect: "follow" });
+      return {
+        status: response.status,
+        ok: response.ok,
+        title: "",
+        text: WebToolPack.#readable(await response.text()),
+      };
+    }
+    return await WebToolPack.#readWithin(url, within, timeout);
+  }
+
+  #boundOf(hostname: string): ((host: string) => boolean) | undefined {
+    const { allowHosts, askOutside } = this.#options.profile.network;
+    if (allowHosts?.length) return (host) => allowHosts.includes(host);
+    const quiet = (host: string) => codeAgentIsLoopback(host) || codeAgentHostListed(host, askOutside ?? []);
+    return askOutside && quiet(hostname) ? quiet : undefined;
+  }
+
+  static async #readWithin(url: string, within: (host: string) => boolean, signal: AbortSignal): Promise<WebPage> {
+    let current = url;
+    for (let hop = 0; hop <= WebToolPack.maxRedirects; hop += 1) {
+      const response = await fetch(current, { signal, redirect: "manual" });
+      const location = response.headers.get("location");
+      if (response.status < 300 || response.status >= 400 || !location)
+        return {
+          status: response.status,
+          ok: response.ok,
+          title: "",
+          text: WebToolPack.#readable(await response.text()),
+        };
+      await response.body?.cancel();
+      const next = new URL(location, current).href;
+      const host = codeAgentHostOf(next);
+      if (!host || !within(host))
+        return {
+          status: response.status,
+          ok: false,
+          title: "",
+          text: `Redirected to ${next}, which this profile does not reach without asking. web_fetch that URL to follow it.`,
+        };
+      current = next;
+    }
+    return { status: 310, ok: false, title: "", text: `More than ${WebToolPack.maxRedirects} redirects.` };
   }
 
   #remember(url: string, page: WebPage) {

package/codeAgent/tools/akanCodePlugins.test.ts

@@ -1,9 +1,12 @@
-import { describe, expect, spyOn, test } from "bun:test";
+import { afterAll, beforeAll, describe, expect, spyOn, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
 import path from "node:path";
 import { codeAgentPresets } from "akanjs/common";
 import { makeCliTempWorkspace, tempRoots, writeText } from "../../testHelpers";
 import { CodeAgent, type CodeAgentOptions } from "../agent/CodeAgent";
 import { SubagentPool } from "../agent/SubagentPool";
+import { WorkspaceTrust } from "../agent/WorkspaceTrust";
 import { DevLogFeedback } from "../feedback/DevLogFeedback";
 import { TurnFeedback, type TurnFeedbackSource } from "../feedback/TurnFeedback";
 import { AkanCodePlugins } from "./AkanCodePlugins";
@@ -19,6 +22,26 @@ import { WebToolPack } from "./WebToolPack";
 const track = tempRoots();
 const tempRoot = async () => track(await makeCliTempWorkspace()).root;
 
+let codeHome: string;
+let realCodeHome: string | undefined;
+
+beforeAll(() => {
+  realCodeHome = process.env.AKAN_CODE_HOME;
+  codeHome = mkdtempSync(path.join(tmpdir(), "akan-code-home-"));
+  process.env.AKAN_CODE_HOME = codeHome;
+});
+
+afterAll(() => {
+  if (realCodeHome === undefined) delete process.env.AKAN_CODE_HOME;
+  else process.env.AKAN_CODE_HOME = realCodeHome;
+  rmSync(codeHome, { recursive: true, force: true });
+});
+
+const approved = (root: string) => {
+  WorkspaceTrust.approve(root, WorkspaceTrust.pending(root), false);
+  return root;
+};
+
 type ToolExecute = (
   id: string,
   params: never,
@@ -554,8 +577,20 @@ for await (const line of console) {
     return root;
   };
 
-  test("connects a declared stdio server, lists its tools and calls one", async () => {
+  test("a server the repo declares is not started until it is approved", async () => {
     const root = await withServer();
+    const notices: string[] = [];
+    const pack = await McpToolPack.connect({
+      workspaceRoot: root,
+      profile: codeAgentPresets.local(root),
+      onNotice: (message) => notices.push(message),
+    });
+    expect(pack).toBeUndefined();
+    expect(notices.join(" ")).toContain("not approved: echo");
+  });
+
+  test("connects a declared stdio server, lists its tools and calls one", async () => {
+    const root = approved(await withServer());
     const pack = await McpToolPack.connect({ workspaceRoot: root, profile: codeAgentPresets.local(root) });
     expect(pack).toBeDefined();
     try {
@@ -582,6 +617,7 @@ for await (const line of console) {
       path.join(root, ".akan", "code", "mcp.json"),
       JSON.stringify({ mcpServers: { broken: { command: "/nonexistent/binary" } } }),
     );
+    approved(root);
     const notices: string[] = [];
     const pack = await McpToolPack.connect({
       workspaceRoot: root,
@@ -656,6 +692,38 @@ describe("WebToolPack", () => {
     }
   });
 
+  test("follows a redirect only to a host the profile reaches without asking", async () => {
+    const server: ReturnType<typeof Bun.serve> = Bun.serve({
+      port: 0,
+      fetch: (request): Response => {
+        const { pathname } = new URL(request.url);
+        if (pathname === "/out") return Response.redirect("https://outside.example/page", 302);
+        if (pathname === "/in") return Response.redirect(`http://localhost:${server.port}/final`, 302);
+        if (pathname === "/loopback") return Response.redirect(`http://127.0.0.1:${server.port}/final`, 302);
+        return new Response("<p>final page</p>");
+      },
+    });
+    try {
+      const profile = codeAgentPresets.local(root);
+      const read = async (pack: WebToolPack, path: string) =>
+        await toolsOf(pack.extension()).get("web_fetch")?.("1", {
+          url: `http://localhost:${server.port}${path}`,
+        } as never);
+
+      const local = new WebToolPack({ profile });
+      expect((await read(local, "/in"))?.content[0]?.text).toContain("final page");
+      const out = await read(local, "/out");
+      expect(out?.isError).toBe(true);
+      expect(out?.content[0]?.text).toContain("Redirected to https://outside.example/page");
+
+      const narrowed = new WebToolPack({ profile: { ...profile, network: { allowHosts: ["localhost"] } } });
+      expect((await read(narrowed, "/in"))?.content[0]?.text).toContain("final page");
+      expect((await read(narrowed, "/loopback"))?.content[0]?.text).toContain(`Redirected to http://127.0.0.1:`);
+    } finally {
+      server.stop(true);
+    }
+  });
+
   test("reads a long page a window at a time, continuing from the snapshot it first read", async () => {
     let hits = 0;
     const server = Bun.serve({

package/codeAgent/tools/mcpOAuth.test.ts

@@ -239,7 +239,7 @@ describe("MCP sign-in", () => {
     expect(auth.resource).toBe(provider.mcpUrl);
     expect(provider.registrations).toHaveLength(1);
     expect(provider.registrations[0]?.redirect_uris?.[0]).toBe(auth.redirectUri);
-    expect(McpTokenStore.read("fake")?.accessToken).toBe("access-1");
+    expect(McpTokenStore.read(refOf())?.accessToken).toBe("access-1");
   });
 
   test("the token is what makes the server publish its tools", async () => {
@@ -270,23 +270,23 @@ describe("MCP sign-in", () => {
 
   test("an expired token is refreshed without anybody being asked", async () => {
     const auth = await McpSignIn.run(refOf(), { open: browser });
-    McpTokenStore.write("fake", { ...auth, expiresAt: Date.now() - 1 });
+    McpTokenStore.write(refOf(), { ...auth, expiresAt: Date.now() - 1 });
     expect(await McpSignIn.token(refOf())).toBe("access-refreshed-2");
-    expect(McpTokenStore.read("fake")?.refreshToken).toBe("refresh-2");
+    expect(McpTokenStore.read(refOf())?.refreshToken).toBe("refresh-2");
   });
 
   test("a refreshed token the server gave no lifetime is kept until refused, not refreshed on every connect", async () => {
     const auth = await McpSignIn.run(refOf(), { open: browser });
-    McpTokenStore.write("fake", { ...auth, expiresAt: Date.now() - 1 });
+    McpTokenStore.write(refOf(), { ...auth, expiresAt: Date.now() - 1 });
     provider.refreshExpiresIn = undefined;
     expect(await McpSignIn.token(refOf())).toBe("access-refreshed-2");
     expect(await McpSignIn.token(refOf())).toBe("access-refreshed-2");
-    expect(McpTokenStore.read("fake")?.expiresAt).toBeUndefined();
+    expect(McpTokenStore.read(refOf())?.expiresAt).toBeUndefined();
   });
 
   test("a refresh the server refuses reports no token rather than throwing", async () => {
     const auth = await McpSignIn.run(refOf(), { open: browser });
-    McpTokenStore.write("fake", { ...auth, expiresAt: Date.now() - 1 });
+    McpTokenStore.write(refOf(), { ...auth, expiresAt: Date.now() - 1 });
     provider.refreshable = false;
     const notices: string[] = [];
     expect(await McpSignIn.token(refOf(), (message) => notices.push(message))).toBeUndefined();
@@ -308,7 +308,7 @@ describe("MCP sign-in", () => {
     try {
       expect(pack?.status[0]).toMatchObject({ auth: "authorized" });
       expect(pack?.toolNames).toEqual(["mcp__fake__search"]);
-      expect(McpTokenStore.read("fake")).toMatchObject({
+      expect(McpTokenStore.read(refOf())).toMatchObject({
         accessToken: "access-refreshed-1",
         refreshToken: "refresh-2",
       });
@@ -365,7 +365,7 @@ describe("MCP sign-in", () => {
       expect((await search(pack)).content[0]?.text).toBe("found");
       expect(provider.refreshes).toBe(1);
       expect(provider.calls).toEqual([{ token: "access-refreshed-1", session: "session-2" }]);
-      expect(McpTokenStore.read("fake")).toMatchObject({
+      expect(McpTokenStore.read(refOf())).toMatchObject({
         accessToken: "access-refreshed-1",
         refreshToken: "refresh-2",
       });
@@ -405,7 +405,7 @@ describe("MCP sign-in", () => {
 
   test("a session connecting with an expired token while a call is refused shares one refresh with it", async () => {
     const auth = await McpSignIn.run(refOf(), { open: browser });
-    McpTokenStore.write("fake", { ...auth, expiresAt: Date.now() - 1 });
+    McpTokenStore.write(refOf(), { ...auth, expiresAt: Date.now() - 1 });
     provider.refreshDelayMs = 50;
     const tokens = await Promise.all([McpSignIn.token(refOf()), McpSignIn.retryToken(refOf(), auth.accessToken)]);
     expect(tokens).toEqual(["access-refreshed-2", "access-refreshed-2"]);
@@ -495,9 +495,23 @@ describe("MCP sign-in", () => {
 
   test("signing out forgets the token and leaves nothing behind", async () => {
     await McpSignIn.run(refOf(), { open: browser });
-    expect(McpTokenStore.clear("fake")).toBe(true);
-    expect(McpTokenStore.read("fake")).toBeUndefined();
-    expect(McpTokenStore.clear("fake")).toBe(false);
+    expect(McpTokenStore.clear(refOf())).toBe(true);
+    expect(McpTokenStore.read(refOf())).toBeUndefined();
+    expect(McpTokenStore.clear(refOf())).toBe(false);
+  });
+
+  test("signing out of a renamed server forgets the token its origin still hands it", async () => {
+    await McpSignIn.run(refOf(), { open: browser });
+    expect(McpTokenStore.read(refOf({ name: "renamed" }))?.accessToken).toBe("access-1");
+    expect(McpTokenStore.clear(refOf({ name: "renamed" }))).toBe(true);
+    expect(McpTokenStore.read(refOf({ name: "renamed" }))).toBeUndefined();
+    expect(McpTokenStore.names()).toEqual([]);
+  });
+
+  test("signing out by the name alone forgets a token whose server is no longer declared", async () => {
+    await McpSignIn.run(refOf(), { open: browser });
+    expect(McpTokenStore.clear({ name: "fake" })).toBe(true);
+    expect(McpTokenStore.read(refOf())).toBeUndefined();
   });
 });
 
@@ -514,10 +528,32 @@ describe("the token file", () => {
     expect(statSync(McpTokenStore.file()).mode & 0o777).toBe(0o600);
   });
 
+  test("a token is found by the server's origin, so the same name at another url gets none", async () => {
+    await McpSignIn.run(refOf(), { open: browser });
+    expect(await McpSignIn.token(refOf({ url: "http://127.0.0.1:9/mcp" }))).toBeUndefined();
+    expect(await McpSignIn.token(refOf({ name: "renamed" }))).toBe("access-1");
+    expect(McpTokenStore.names()).toEqual(["fake"]);
+  });
+
+  test("a file an older build keyed by name keeps its tokens at the origin they were minted for", async () => {
+    const auth = await McpSignIn.run(refOf(), { open: browser });
+    await Bun.write(
+      McpTokenStore.file(),
+      JSON.stringify({ servers: { fake: auth, broken: { ...auth, resource: "" } } }),
+    );
+    expect(McpTokenStore.read(refOf())?.accessToken).toBe("access-1");
+    expect(McpTokenStore.read(refOf({ url: "https://elsewhere.example/mcp" }))).toBeUndefined();
+    expect(McpTokenStore.names()).toEqual(["fake"]);
+    McpTokenStore.write(refOf(), { ...auth, accessToken: "access-rewritten" });
+    const saved = (await Bun.file(McpTokenStore.file()).json()) as { servers?: unknown; tokens: object };
+    expect(saved.servers).toBeUndefined();
+    expect(Object.keys(saved.tokens)).toEqual([`${provider.origin} ${provider.origin}`]);
+  });
+
   test("a corrupt file costs the sign-ins and not the session", async () => {
     await McpSignIn.run(refOf(), { open: browser });
     await Bun.write(McpTokenStore.file(), "{ not json");
-    expect(McpTokenStore.read("fake")).toBeUndefined();
+    expect(McpTokenStore.read(refOf())).toBeUndefined();
     expect(McpTokenStore.names()).toEqual([]);
   });
 });
@@ -582,7 +618,7 @@ process.exit(0);
     });
     await taken.promise;
     const retried = McpSignIn.retryToken(refOf(), auth.accessToken);
-    McpTokenStore.write("fake", { ...auth, accessToken: "access-elsewhere", refreshToken: "refresh-elsewhere" });
+    McpTokenStore.write(refOf(), { ...auth, accessToken: "access-elsewhere", refreshToken: "refresh-elsewhere" });
     released.resolve();
     await elsewhere;
     expect(await retried).toBe("access-elsewhere");