[setoelkahfi]

The official MCP server read the stored token once at startup. After signing in as another account or signing out, web_search and every mcp__sigit__* tool kept sending the old account's bearer until a restart. #259 fixed the same problem for inference by reading the token on each request. An MCP connection fixes its bearer when it connects, so here the fix is to reconnect when the stored token changes.

Fixes #260

What changed, all in crates/cli/src/mcp.rs unless noted:

• ServerDef has a follows_session flag, set only on the built-in official entry. Its bearer comes from credentials::load_token() on every connect. A user-defined sigit entry in mcp.toml keeps its static headers and does not follow the session.
• Each connection remembers the token it was opened with. call_server compares that with the stored token before sending and reconnects if they differ, so the old bearer is never sent. This also covers a sigit login run from another terminal.
• tools and error can be replaced, since signing in can change whether the handshake works and which tools are listed. reconnect() swaps the connection, tools and error together, and the retry path in call_server uses it too.
• If a reconnect fails for the official server, the old connection and its tools are dropped, so a stale bearer can't be reused.
• refresh_session_auth() does the same check with no call attached. It runs after sign-in, sign-out, /login, /logout and /reload (in main.rs and chat.rs), so the tool list and /mcp update right away. Correctness doesn't depend on these calls.

Tests: two unit tests cover the official and user-defined entries. tests/acp_mcp_reauth.rs runs the real binary against a fake cloud that serves /mcp and /chat/completions. It checks the bearer on each tools/call for token A, then B, then none after the credentials are removed. cargo test, cargo fmt --check and clippy with -D warnings pass.

Not done yet: the manual check (sign in as A, web_search, /login as B, web_search, and confirm B's token in the cloud logs).

[sigit-code-review]

This change ensures the official MCP server always uses the current signed-in account's bearer token by reconnecting whenever the stored token changes. The fix introduces a follows_session flag on ServerDef, set only for the built-in official server, and changes connection management so that the bearer is refreshed on each connect. The reconnection logic updates the connection, tools, and error fields atomically, and drops the old connection if a reconnect fails. The fix is covered by both unit and integration tests, including a new test that verifies the bearer changes as expected when the session changes. Calls to refresh_session_auth() are added after sign-in, sign-out, and reload events to keep the tool list and /mcp up to date. No findings from earlier reviews remain unresolved, and the changes are well-contained to mcp.rs and call sites.

---

Automated review by siGit Code Review · commit b92581e · see the review dashboard