fix(mcp): serialize token resets - #2845

Related issue

N/A - no matching issue was found.

Summary

Initial MCP token loading and reset responses did not share ownership, and reset was not single-flight. An older mount/reset response could overwrite the newest server token, duplicate resets could generate multiple tokens, and unmounted callbacks still updated state/feedback. This change serializes reset, invalidates mount ownership, exposes reset busy state, and suppresses late callbacks.

Affected surfaces

• Frontend / Web
• Backend / API / Storage
• Database plugin / Driver
• JCEF / Desktop packaging
• CI / Build / Release
• Documentation only

Verification

• Commands and results:
  • Red tests reproduced mount-over-reset overwrite, duplicate resets, and post-unmount callbacks.
  • MCP lifecycle/token tests and main-navigation prebuild entry: passed.
  • Targeted ESLint and full Community build/bundle verifier: passed.
  • Fork code and CodeQL checks: passed.
  • Merge-tree with Notification and SQL parser repairs: passed.
• Manual verification: N/A - deferred bridge promises reproduce token response ordering without real reset operations.
• UI evidence: N/A

Risk and compatibility

• Public API or stored data: No API or token format changes.
• Database or driver compatibility: N/A.
• Network, privacy, or security: Prevents display/copy of an already superseded MCP token.
• Community / Local / Pro boundary: Shared Community MCP settings.
• Backward compatibility: One reset retains existing bridge behavior; concurrent confirmations now join/ignore while busy.

Reviewer map

• Start here: McpTokenRequestCoordinator, mount token effect, and resetToken.
• Failure condition: two resets start concurrently, old mount data wins, or unmounted callbacks commit.
• Rollback or disable path: Revert commit 768fb79d33f80835752639fd363c8dea709a8646; no migration is required.

Contributor declaration

• I linked the Issue that defines this change.
• I tested the affected behavior and reported the actual results above.
• I did not include credentials, private data, or generated build output.
• I disclosed substantial AI assistance below, or this PR contains no substantial AI-generated code.

AI assistance: OpenAI Codex assisted with diagnosis, implementation, deterministic tests, verification, and adversarial review.

Latest-main revalidation (2026-09-04)

• Rebased onto upstream 144a04e; current head 768fb79.
• MCP request-owner, lifecycle, and main-navigation tests passed; targeted ESLint passed.
• Included in the green combined Community production build and bundle verification.