mixdog 1.2.6 → 1.3.0

package/src/runtime/agent/orchestrator/mcp/client.mjs

@@ -33,11 +33,17 @@ import {
 import { createLazyOutputValidator } from './lazy-output-validator.mjs';
 import { appendMcpStderrTail, createMcpTransport, hasConfiguredMcpAuth } from './client-transport.mjs';
 import { listAllMcpTools, MCP_CONNECT_CANCELLED, runBoundedHandshake } from './client-handshake.mjs';
+import { rememberServerConnector } from './server-connectors.mjs';
+import { mcpOAuthClientFor } from './oauth-client.mjs';
+import { googleMcpService, withGoogleMcp } from '../../../connectors/google-mcp.mjs';
 import {
   clearMcpOAuth,
+  commitMcpOAuthSwitch,
   hasStoredMcpOAuthTokens,
   isMcpOAuthReauthenticationRequired,
   MCP_OAUTH_CALLBACK_NOT_PENDING,
+  startMcpOAuthSwitch,
+  storedMcpOAuthIdentity,
 } from './oauth.mjs';
 export { probeMcpServerAuth } from './oauth-probe.mjs';
 
@@ -67,6 +73,14 @@ const _connectAbortGenerations = new Map();
 const _pendingConnects = new Set();
 // scopeId -> root path advertised by that scope's scope-following servers.
 const _scopeRoots = new Map();
+// One stdio process per server config, shared by every scope that connects
+// the same server with the same resolved config: share key -> connection
+// { key, client, transport, liveness, stderrTail, warnings, tools,
+// capabilities, instructions, users: Set<registryKey> }. Every session
+// runtime has its own scope, so per-scope processes multiplied with the
+// number of retained sessions. A scope's close releases only its own use; the
+// process tree is shut down when its last user releases it.
+const _sharedStdio = new Map();
 let mcpSdkPromise = null;
 // Memo for mcpToolHasField(name, field) — keyed by `${scopeId}|${toolName}|${field}`.
 // The lookup (regex parse + servers Map get + tools.find + schema property
@@ -99,6 +113,24 @@ function scopedServerEntries(scopeId) {
   const normalized = normalizeMcpScopeId(scopeId);
   return [...servers.entries()].filter(([, server]) => server?.scopeId === normalized);
 }
+// Share key of a stdio server, or null when its connection must stay private
+// to one scope: remote transports, and servers whose advertised roots follow
+// their scope's cwd.
+function sharedStdioKey(name, cfg) {
+  if (cfg?._mixdogRootsFollowScope === true) return null;
+  try {
+    if (resolveMcpTransportKind(cfg) !== 'stdio') return null;
+  } catch {
+    return null;
+  }
+  return `${String(name || '')}\u0000${JSON.stringify(cfg)}`;
+}
+// A connection that failed a call is never handed to a later connect; scopes
+// still holding it keep it until they release it themselves.
+function retireSharedConnection(server) {
+  const shared = server?.shared;
+  if (shared && _sharedStdio.get(shared.key) === shared) _sharedStdio.delete(shared.key);
+}
 function currentConnectAbortGeneration(scopeId) {
   return _connectAbortGenerations.get(normalizeMcpScopeId(scopeId)) || 0;
 }
@@ -411,6 +443,7 @@ async function reconnectMcpServer(scopeId, serverName, failedServer) {
     if (!current || genAtStart !== currentConnectAbortGeneration(scopeId) || current.liveness?.closing) {
       throw new Error(`MCP server "${serverName}" was disconnected`);
     }
+    retireSharedConnection(current);
     await replaceServerConnection(scopeId, serverName, current, failedServer.cfg, genAtStart);
   });
   const replacement = servers.get(registryKey);
@@ -1223,22 +1256,52 @@ export function getMcpServerOAuthState(cfg) {
     return null;
   }
   if (!url || hasConfiguredMcpAuth(cfg)) return null;
-  return { signedIn: hasStoredMcpOAuthTokens(url) };
+  const signedIn = hasStoredMcpOAuthTokens(url);
+  if (!signedIn) return { signedIn };
+  // Who it is signed in as (never guessed: empty when the server named nobody)
+  // and whether 계정 바꾸기 can make the provider show its account choice.
+  const who = storedMcpOAuthIdentity(url);
+  return {
+    signedIn,
+    account: typeof who?.account === 'string' ? who.account : '',
+    workspace: typeof who?.workspace === 'string' ? who.workspace : '',
+    forcedAccountChoice: who?.forcedChoice === true,
+  };
+}
+/** 계정 바꾸기 of an HTTP/SSE server: a browser sign-in beside the stored one
+ *  (oauth.mjs startMcpOAuthSwitch); `launch` opens the authorization URL. */
+export function startMcpServerOAuthSwitch(cfg, launch, serverName) {
+  const url = resolveMcpOAuthUrl(cfg);
+  if (!url) throw new Error(`MCP server "${serverName}" does not use OAuth sign-in`);
+  return startMcpOAuthSwitch({
+    url,
+    launch,
+    serverName,
+    oauthClient: mcpOAuthClientFor(cfg, url),
+    ...(googleMcpService(url) ? { fetchImpl: withGoogleMcp() } : {}),
+  });
+}
+/** Store a switch's sign-in for the server's URL; resolves its rollback. */
+export function commitMcpServerOAuthSwitch(cfg, signIn) {
+  return commitMcpOAuthSwitch({ url: resolveMcpOAuthUrl(cfg), signIn });
 }
 /**
  * Log out of an HTTP/SSE server URL: delete the OAuth tokens and client
  * registration stored for it, shared by every server configured with that
- * exact URL, and drop them from live connections.
+ * exact URL, and drop them from live connections. `options.revoke` also
+ * revokes the grant where the authorization server documents how; resolves
+ * `{ revoked }`.
  */
-export async function clearMcpServerOAuth(cfg) {
+export async function clearMcpServerOAuth(cfg, options = {}) {
   let url;
   try {
     url = resolveMcpOAuthUrl(cfg);
   } catch {
     // A config without a valid remote URL never connected, so never logged in.
-    return;
+    return { revoked: false };
   }
-  if (url) await clearMcpOAuth({ url });
+  if (url) return clearMcpOAuth({ url, revoke: options.revoke === true });
+  return { revoked: false };
 }
 /**
  * Close a single server: for stdio transports first shut down the full child
@@ -1248,6 +1311,13 @@ export async function clearMcpServerOAuth(cfg) {
  * only kills the direct child and discards the pid we need to walk the tree.
  */
 async function _closeServer(server) {
+  // A shared stdio connection closes only when its last scope releases it.
+  const shared = server?.shared;
+  if (shared) {
+    shared.users.delete(server.registryKey);
+    if (shared.users.size > 0) return;
+    retireSharedConnection(server);
+  }
   // A deliberate close is not a crash: suppress the unexpected-close report.
   if (server?.liveness) server.liveness.closing = true;
   const transport = server?.transport;
@@ -1266,6 +1336,19 @@ async function _closeServer(server) {
     /* ignore */
   }
 }
+// Register `name` in `scopeId` on the live shared connection for `shareKey`,
+// when there is one. Returns whether it did.
+function adoptSharedConnection(shareKey, name, cfg, scopeId, genAtStart) {
+  const shared = shareKey ? _sharedStdio.get(shareKey) : null;
+  if (!shared || shared.liveness.alive === false || shared.liveness.closing) return false;
+  const registryKey = mcpServerRegistryKey(scopeId, name);
+  const { key: _key, users, ...connection } = shared;
+  users.add(registryKey);
+  rememberServerConnector(name, cfg);
+  servers.set(registryKey, { scopeId, registryKey, name, ...connection, cfg, shared, generation: genAtStart });
+  _invalidateMcpToolFieldMemo();
+  return true;
+}
 // Connects whose handshake has not finished yet: disconnectAll() must be able
 // to see (and tear down) their transports, because `servers` only lists fully
 // handshaken entries. Generation token aborts a connect that outlives a
@@ -1285,6 +1368,8 @@ async function connectServer(
     // abort before creating a transport/child at all.
     throw new Error(`MCP server "${name}" connect aborted by shutdown`);
   }
+  const shareKey = sharedStdioKey(name, cfg);
+  if (adoptSharedConnection(shareKey, name, cfg, scopeId, genAtStart)) return;
   const client = createMcpClient(sdk, name, cfg, scopeId);
   const { transport, autoDetectAdvert, stderrTail, warnings } = createMcpTransport({
     name,
@@ -1329,26 +1414,42 @@ async function connectServer(
       }
       throw new Error(`MCP server "${name}" connect aborted by shutdown`);
     }
+    // Another scope finished connecting the same server meanwhile: use its
+    // process and release this one.
+    if (adoptSharedConnection(shareKey, name, cfg, scopeId, genAtStart)) {
+      await _closeServer({ client, transport, liveness });
+      return;
+    }
     const tools = mcpServerTools(name, capabilities, toolsResult.tools, cfg);
     const registryKey = mcpServerRegistryKey(scopeId, name);
-    servers.set(registryKey, {
-      scopeId,
-      registryKey,
-      name,
+    const connection = {
       client,
       transport,
       tools,
-      cfg,
       instructions,
       capabilities,
       liveness,
       stderrTail,
       warnings: warnings || [],
+    };
+    const shared = shareKey ? { ...connection, key: shareKey, users: new Set([registryKey]) } : null;
+    if (shared) _sharedStdio.set(shareKey, shared);
+    rememberServerConnector(name, cfg);
+    servers.set(registryKey, {
+      scopeId,
+      registryKey,
+      name,
+      ...connection,
+      cfg,
+      shared,
       generation: genAtStart,
     });
     if (capabilities?.tools?.listChanged && sdk.ToolListChangedNotificationSchema) {
+      // A shared connection refreshes the tools of every scope using it.
       client.setNotificationHandler(sdk.ToolListChangedNotificationSchema, () =>
-        refreshServerTools(registryKey, client, name, cfg, capabilities)
+        Promise.all(
+          [...(shared?.users ?? [registryKey])].map((key) => refreshServerTools(key, client, name, cfg, capabilities))
+        )
       );
     }
     _invalidateMcpToolFieldMemo();
@@ -1517,6 +1618,8 @@ async function runToolRefresh(registryKey, live, name, cfg, capabilities) {
     }
     if (servers.get(registryKey) !== live) return;
     live.tools = mcpServerTools(name, capabilities, refreshed.tools, cfg);
+    // A scope adopting the connection later starts from the current listing.
+    if (live.shared) live.shared.tools = live.tools;
     _invalidateMcpToolFieldMemo();
   } catch (error) {
     mcpLog(
@@ -1570,6 +1673,7 @@ export function _registerMcpServerForTest(scopeId, name, rawTools = [], options
     generation: currentConnectAbortGeneration(normalizedScopeId),
   };
   _knownMcpScopes.add(normalizedScopeId);
+  rememberServerConnector(name, server.cfg);
   servers.set(registryKey, server);
   _invalidateMcpToolFieldMemo();
   return server;

package/src/runtime/agent/orchestrator/mcp/oauth-account.mjs

@@ -0,0 +1,97 @@
+// The account side of an MCP OAuth sign-in: which documented authorization
+// parameter makes a provider show its account choice, and who a sign-in
+// belongs to, read only from what the authorization server returned.
+//
+// Parameters are sent only where the provider documents them (keyed by the
+// authorization endpoint's host); everywhere else nothing is added:
+//   Google  prompt=select_account  developers.google.com/identity/protocols/oauth2/web-server#creatingclient
+//   GitHub  prompt=select_account  docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps
+//   Atlassian (Jira, Confluence, Trello) prompt=consent  developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/
+//   Linear  prompt=consent         linear.app/developers/oauth-2-0-authentication
+//   Dropbox force_reapprove=true   www.dropbox.com/developers/documentation/http/documentation#oauth2-authorize
+
+const SELECT_ACCOUNT = Object.freeze({ prompt: 'select_account' });
+// A normal connect shows the chooser only where it is the documented choice.
+const CONNECT_PARAMS = Object.freeze({
+  'accounts.google.com': SELECT_ACCOUNT,
+  'github.com': SELECT_ACCOUNT,
+});
+// 계정 바꾸기: the provider's documented way to force the choice (or the grant).
+const SWITCH_PARAMS = Object.freeze({
+  ...CONNECT_PARAMS,
+  'auth.atlassian.com': Object.freeze({ prompt: 'consent' }),
+  'linear.app': Object.freeze({ prompt: 'consent' }),
+  'mcp.linear.app': Object.freeze({ prompt: 'consent' }),
+  'www.dropbox.com': Object.freeze({ force_reapprove: 'true' }),
+});
+
+const hostOf = (url) => {
+  try {
+    return new URL(url).host.toLowerCase();
+  } catch {
+    return '';
+  }
+};
+
+/** `authorizationUrl` with the account parameters of `mode` (`connect`,
+ *  `reauth`, `switch`); a repair (`reauth`) adds nothing. A `prompt` the
+ *  request already carries (the SDK's `consent` for offline access) is kept. */
+export function withAccountParams(authorizationUrl, mode = 'connect') {
+  const target = new URL(authorizationUrl);
+  const table = mode === 'switch' ? SWITCH_PARAMS : mode === 'connect' ? CONNECT_PARAMS : {};
+  const params = table[target.host.toLowerCase()];
+  if (!params) return target;
+  for (const [key, value] of Object.entries(params)) {
+    if (key !== 'prompt') {
+      target.searchParams.set(key, value);
+      continue;
+    }
+    const values = new Set((target.searchParams.get('prompt') || '').split(' ').filter(Boolean));
+    values.add(value);
+    target.searchParams.set('prompt', [...values].join(' '));
+  }
+  return target;
+}
+
+/** Whether 계정 바꾸기 can make the provider of this authorization endpoint
+ *  show its choice (otherwise the user switches at the provider first). */
+export function canForceAccountChoice(authorizationEndpoint) {
+  return Object.hasOwn(SWITCH_PARAMS, hostOf(authorizationEndpoint));
+}
+
+const text = (value) => (typeof value === 'string' && value.trim() ? value.trim() : '');
+
+function idTokenClaims(idToken) {
+  const payload = typeof idToken === 'string' ? idToken.split('.')[1] : '';
+  if (!payload) return {};
+  try {
+    const claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+    return claims && typeof claims === 'object' ? claims : {};
+  } catch {
+    return {};
+  }
+}
+
+/** `{ account, workspace }` from a token endpoint response: the OIDC id_token
+ *  claims and the identity fields providers return beside the tokens (Notion's
+ *  workspace and owner, Slack's team, a `user` / `organization` object). Null
+ *  when the response names nobody: an identity is never guessed. */
+export function identityFromTokenResponse(body) {
+  if (!body || typeof body !== 'object') return null;
+  const claims = idTokenClaims(body.id_token);
+  const user = body.user && typeof body.user === 'object' ? body.user : {};
+  const person = body.owner?.user?.person;
+  const account =
+    text(claims.email) ||
+    text(claims.preferred_username) ||
+    text(body.email) ||
+    text(user.email) ||
+    text(user.login) ||
+    text(user.username) ||
+    text(person?.email) ||
+    text(body.owner?.user?.name);
+  const workspace =
+    text(body.workspace_name) || text(body.team?.name) || text(body.organization?.name) || text(body.org?.name);
+  if (!account && !workspace) return null;
+  return { account, workspace };
+}

package/src/runtime/agent/orchestrator/mcp/oauth-client.mjs

@@ -0,0 +1,49 @@
+// A pre-registered OAuth client for an MCP server, used as static client
+// information in place of dynamic client registration:
+//   - the user's own (custom connector → 고급 설정 → 앱 번호/비밀값): the id
+//     in the server config (`oauthClientId`, not a secret), the secret only in
+//     the keychain under mcpOAuthClientSecretAccount(url);
+//   - else the catalog connector's (connector-catalog.mjs `oauthClient`), with
+//     its scopes and the provider's offline-access parameter.
+import { createHash } from 'node:crypto';
+import keychain from '../../../../lib/keychain-cjs.cjs';
+import { connectorById, connectorOfServer } from '../../../shared/connector-catalog.mjs';
+import { GOOGLE_AUTH_PARAMS, googleOAuthClient } from '../../../shared/google-oauth-client.mjs';
+import { normalizeMcpTransportUrl } from './client-config.mjs';
+
+const BUILT_IN_CLIENTS = {
+  google: () => {
+    const client = googleOAuthClient();
+    return client && { ...client, authParams: GOOGLE_AUTH_PARAMS };
+  },
+};
+
+/** The keychain account of the user's client secret for one server URL. */
+export function mcpOAuthClientSecretAccount(url) {
+  const key = normalizeMcpTransportUrl(String(url));
+  return `mcp-oauth-client.${createHash('sha256').update(key).digest('hex')}`;
+}
+
+/** Store (or, with '', delete) the user's client secret for server `url`. */
+export async function saveMcpOAuthClientSecret(url, secret, credentialStore = keychain) {
+  const account = mcpOAuthClientSecretAccount(url);
+  if (secret) await credentialStore.setSecretAsync(account, secret);
+  else await credentialStore.deleteSecretAsync(account);
+}
+
+/**
+ * `{ clientId, clientSecret?, secretAccount?, scopes?, authParams? }` for
+ * server config `cfg` at `url`, or null to register a client dynamically.
+ */
+export function mcpOAuthClientFor(cfg, url) {
+  const backend = connectorById(connectorOfServer(cfg))?.backend;
+  const catalog = backend?.kind === 'oauth' ? backend : null;
+  const scopes = catalog?.scopes ? [...catalog.scopes] : undefined;
+  const own = typeof cfg?.oauthClientId === 'string' ? cfg.oauthClientId.trim() : '';
+  if (own) {
+    const authParams = catalog?.oauthClient === 'google' ? GOOGLE_AUTH_PARAMS : undefined;
+    return { clientId: own, secretAccount: mcpOAuthClientSecretAccount(url), scopes, authParams };
+  }
+  const builtIn = catalog?.oauthClient ? BUILT_IN_CLIENTS[catalog.oauthClient]?.() : null;
+  return builtIn ? { ...builtIn, scopes } : null;
+}

package/src/runtime/agent/orchestrator/mcp/oauth-credentials.mjs

@@ -1,8 +1,10 @@
 import { randomBytes } from 'node:crypto';
-import { readFile } from 'node:fs/promises';
+import { readFileSync } from 'node:fs';
+import { readFile, rm } from 'node:fs/promises';
 import { join } from 'node:path';
 import { withFileLock, writeFileAtomicAsync } from '../../../shared/atomic-file.mjs';
 import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
+import { canForceAccountChoice } from './oauth-account.mjs';
 import { reauthenticationRequired } from './oauth-shared.mjs';
 
 // Same lease as the provider OAuth refresh (openai-oauth-tokens.mjs): a
@@ -35,6 +37,31 @@ function readRevisionMarker(account) {
   return readFile(credentialFile(account, 'rev'), 'utf8').catch(() => null);
 }
 
+// Who the stored sign-in belongs to, beside the entry (never a credential), so
+// the status lists it without decrypting the keychain:
+// `{ account, workspace, forcedChoice }`; absent when unknown or signed out.
+export function writeIdentityFile(account, creds) {
+  const file = credentialFile(account, 'who');
+  if (!creds?.tokens) return rm(file, { force: true });
+  const identity = creds.identity || {};
+  return writeFileAtomicAsync(
+    file,
+    JSON.stringify({
+      account: identity.account || '',
+      workspace: identity.workspace || '',
+      forcedChoice: canForceAccountChoice(creds.discovery?.authorizationServerMetadata?.authorization_endpoint),
+    })
+  );
+}
+export function readIdentityFile(account) {
+  try {
+    const value = JSON.parse(readFileSync(credentialFile(account, 'who'), 'utf8'));
+    return value && typeof value === 'object' ? value : null;
+  } catch {
+    return null;
+  }
+}
+
 // The stored value as another process may have just written it, not this
 // process's cached copy.
 export function readStoredCredentials(credentialStore, account) {
@@ -57,6 +84,7 @@ export function createCredentialCache({ url, credentialStore, account }) {
     clientInformation: undefined,
     redirectUrl: undefined,
     discovery: undefined,
+    identity: undefined,
     observed: undefined,
     loaded: undefined,
   };
@@ -74,10 +102,25 @@ export function createCredentialCache({ url, credentialStore, account }) {
       clientInformation: creds.clientInformation,
       redirectUrl: creds.redirectUrl,
       discovery: creds.discovery,
+      identity: creds.identity,
     } = value);
     creds.observed = revisionOf(saved);
     hold();
   };
+  // Whether the stored entry is still the one this process last read or wrote:
+  // its revision marker says so without a keychain read (on Windows each read
+  // is a DPAPI PowerShell round trip of ~250 ms). Every writer changes the
+  // marker under the credential lock before the entry, so under that lock an
+  // unchanged marker is an unchanged entry.
+  const unchanged = async (expected = creds.observed) =>
+    expected !== undefined &&
+    expected === creds.observed &&
+    (await readRevisionMarker(account)) === markerOf(expected, Boolean(creds.tokens));
+  // The stored entry as of now, adopted (skipped when unchanged).
+  async function adoptStored() {
+    if (await unchanged()) return;
+    adopt(await readStoredCredentials(credentialStore, account));
+  }
   // A failed read (locked keychain) is retried by the next request.
   const ready = () =>
     (creds.loaded ??= credentialStore
@@ -93,25 +136,31 @@ export function createCredentialCache({ url, credentialStore, account }) {
   // the newer entry, or its deletion by a log-out, and changes nothing.
   function update(change, { expected = creds.observed, remove = false } = {}) {
     return withCredentialLock(account, async () => {
-      const saved = await readStoredCredentials(credentialStore, account);
-      if (revisionOf(saved) !== expected) {
-        adopt(saved);
-        return false;
+      let exists = creds.observed !== null;
+      if (!(await unchanged(expected))) {
+        const saved = await readStoredCredentials(credentialStore, account);
+        if (revisionOf(saved) !== expected) {
+          adopt(saved);
+          return false;
+        }
+        exists = Boolean(saved);
       }
       change();
       hold();
       if (remove) {
         await writeRevisionMarker(account, null);
-        if (saved) await credentialStore.deleteSecretAsync(account);
+        if (exists) await credentialStore.deleteSecretAsync(account);
+        await writeIdentityFile(account, null);
         creds.observed = null;
       } else {
         const revision = randomBytes(16).toString('hex');
         await writeRevisionMarker(account, revision, Boolean(creds.tokens));
-        const { tokens, clientInformation, redirectUrl, discovery } = creds;
+        const { tokens, clientInformation, redirectUrl, discovery, identity } = creds;
         await credentialStore.setSecretAsync(
           account,
-          JSON.stringify({ url, revision, tokens, clientInformation, redirectUrl, discovery })
+          JSON.stringify({ url, revision, tokens, clientInformation, redirectUrl, discovery, identity })
         );
+        await writeIdentityFile(account, creds);
         creds.observed = revision;
       }
       return true;
@@ -133,7 +182,7 @@ export function createCredentialCache({ url, credentialStore, account }) {
   }
   // Forget the in-memory credentials; the next request re-reads the keychain.
   function clear() {
-    creds.tokens = creds.clientInformation = creds.redirectUrl = creds.discovery = undefined;
+    creds.tokens = creds.clientInformation = creds.redirectUrl = creds.discovery = creds.identity = undefined;
     creds.loaded = creds.observed = undefined;
   }
   return {
@@ -141,6 +190,7 @@ export function createCredentialCache({ url, credentialStore, account }) {
     held,
     ready,
     adopt,
+    adoptStored,
     update,
     observeStoredRevision,
     clear,

package/src/runtime/agent/orchestrator/mcp/oauth-login.mjs

@@ -1,6 +1,7 @@
 import { createServer } from 'node:http';
 import { randomBytes } from 'node:crypto';
 import { normalizeMcpTransportUrl } from './client-config.mjs';
+import { identityFromTokenResponse } from './oauth-account.mjs';
 import { answerOAuthCallback } from './oauth-callback.mjs';
 import { anySignal, loginFailed, reauthenticationRequired } from './oauth-shared.mjs';
 
@@ -49,12 +50,34 @@ export function createLoginFlow({ url, cache, flow, provider, lifetimeSignal, op
     flow.browserOpened = false;
     flow.launchBrowser = browser || openBrowser;
     const signal = AbortSignal.any([lifetimeSignal, requestSignal, AbortSignal.timeout(timeoutMs)]);
-    const safeFetch = (input, init = {}) =>
-      fetchImpl(normalizeMcpTransportUrl(input), {
+    // Who this login's tokens belong to (oauth-account.mjs): the SDK keeps only
+    // the token fields, so the token endpoint's answer is read here.
+    flow.identity = undefined;
+    const safeFetch = async (input, init = {}) => {
+      const response = await fetchImpl(normalizeMcpTransportUrl(input), {
         ...init,
         redirect: 'error',
         signal: anySignal(signal, init.signal),
       });
+      if (response.ok && /(^|&)grant_type=/.test(String(init.body ?? ''))) {
+        flow.identity = identityFromTokenResponse(
+          await response
+            .clone()
+            .json()
+            .catch(() => null)
+        );
+      }
+      return response;
+    };
+    // The caller's progress hooks (mcp-oauth-login.mjs): the callback arrived,
+    // then the tokens are stored.
+    const progress = (hook) => {
+      try {
+        browser?.[hook]?.();
+      } catch {
+        /* progress reporting never fails the login */
+      }
+    };
     let abort;
     const callback = new Promise((resolve, reject) => {
       const finish = (code) => (code ? resolve(code) : reject(loginFailed()));
@@ -72,9 +95,10 @@ export function createLoginFlow({ url, cache, flow, provider, lifetimeSignal, op
       // refreshed (and rotated) the tokens this request was rejected with:
       // decide on the stored credentials, under the cross-process lock.
       const result = await cache.withLock(async () => {
-        cache.adopt(await cache.readStored());
+        await cache.adoptStored();
         if (creds.tokens && creds.tokens.access_token !== attemptedToken?.access_token) return 'AUTHORIZED';
-        if (!interactive && (!creds.tokens?.refresh_token || !creds.clientInformation || !creds.redirectUrl)) {
+        const registered = provider.preRegistered || creds.clientInformation;
+        if (!interactive && (!creds.tokens?.refresh_token || !registered || !creds.redirectUrl)) {
           throw reauthenticationRequired();
         }
         flow.state = randomBytes(32).toString('base64url');
@@ -85,16 +109,17 @@ export function createLoginFlow({ url, cache, flow, provider, lifetimeSignal, op
       if (result === 'REDIRECT') {
         const code = await callback;
         signal.throwIfAborted();
+        progress('onCallback');
         const exchanged = await cache.withLock(async () => {
           // The entry this login registered in is gone only after a log-out
           // since it began, which wins: never recreate it.
-          const saved = await cache.readStored();
-          if (!saved) throw loginFailed();
-          cache.adopt(saved);
+          await cache.adoptStored();
+          if (creds.observed === null) throw loginFailed();
           return auth(provider, { ...options, authorizationCode: code });
         });
         if (exchanged !== 'AUTHORIZED') throw loginFailed();
       }
+      progress('onAuthorized');
       signal.throwIfAborted();
     } catch (error) {
       // SDK errors may contain authorization server response bodies/secrets.