Fix MCP OAuth resume order in Node.js SDK

[MackinnonBuck]

Why

Resuming a session with an onMcpAuthRequest handler failed against the current runtime (1.0.66) with Session not found for sessionId: <id>. VS Code always passes onMcpAuthRequest, so every resume threw, and VS Code then fell back to destructively recreating the session under the same id, which is why users saw old sessions return only a session.start event from getEvents().

Root cause

PR #1669 added, in both createSession and resumeSession, a block guarded by if (config.onMcpAuthRequest) that issues a session-scoped session.eventLog.registerInterest RPC for mcp.oauth_required. The placement was asymmetric:

• createSession correctly placed it AFTER session.create, so the session is already registered.
• resumeSession placed it BEFORE session.resume. The runtime only registers the session in its routing table while handling session.resume, so a fresh process resuming a persisted session hit an unregistered session and the runtime rejected the call.

Fix

Move the registerInterest block in resumeSession to AFTER the session.resume response is processed, mirroring the already-correct createSession path. The create path is unchanged. Local session registration (this.sessions.set / setupSessionFs) and the surrounding try/catch are untouched; only the runtime RPC moved.

registerInterest(mcp.oauth_required) is a gating switch the runtime reads when it builds the MCP OAuth handler as MCP servers connect later, not a buffered subscription, so issuing it after session.resume is still early enough (the create path proves this), and there is no lost-event race.

Tests

• Unit (nodejs/test/client.test.ts): rewrote the resume ordering test to assert session.resume is sent BEFORE session.eventLog.registerInterest, plus the no-handler case. Fails on the old ordering, passes after the fix.
• E2E (nodejs/test/e2e/session.e2e.test.ts + new snapshot): creates a session with onMcpAuthRequest, takes a turn to persist it, then resumes from a fresh CLI process. Against the unfixed SDK this reproduces the literal runtime error Session not found for sessionId: <id> on registerInterest; with the fix it passes.

Note on the E2E shape: the runtime gates session-scoped RPCs per process, not per connection, so the bug only surfaces when a different CLI process resumes a persisted session (the VS Code restart scenario). That required a real turn to persist the session, hence the accompanying replay snapshot.

typecheck, eslint, and prettier are clean.

[Copilot]

Pull request overview

Fixes a Node.js SDK session-resume regression where registering mcp.oauth_required interest could occur before the runtime had routed/registered the resumed session, causing Session not found for sessionId: <id> when onMcpAuthRequest is configured (a common VS Code path).

Changes:

• Move session.eventLog.registerInterest(mcp.oauth_required) in resumeSession to run after the session.resume RPC completes.
• Update unit coverage to assert resume ordering and handler/no-handler behavior.
• Add an E2E that reproduces the cross-process resume scenario (new CLI process) and a new replay snapshot.

Show a summary per file

File	Description
nodejs/src/client.ts	Moves MCP OAuth interest registration to after session.resume to avoid runtime “session not found”.
nodejs/test/client.test.ts	Updates unit test to assert session.resume occurs before registerInterest when auth handler is configured.
nodejs/test/e2e/session.e2e.test.ts	Adds E2E coverage for resuming a persisted session from a fresh client with onMcpAuthRequest.
test/snapshots/session/resumes_a_persisted_session_from_a_new_client_when_an_mcp_oauth_handler_is_configured.yaml	Adds replay snapshot used by the new E2E.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 2
• Review effort level: Low

[github-actions]

Cross-SDK Consistency Review ✅

This PR applies the registerInterest ordering fix consistently across all six SDK implementations:

SDK	Source change	Test added
Node.js	✅ Moved registerInterest after session.resume response	✅ Unit + E2E
Go	✅ Moved registerInterest after session.resume response	✅ E2E
Python	✅ Moved registerInterest after session.resume response	✅ Unit + E2E
.NET	✅ Moved registerInterest after session.resume response	✅ Unit + E2E
Rust	✅ Moved registerInterest after session.resume response	✅ Unit + E2E
Java	✅ Already correct — async .thenCompose(response -> {...}) chaining naturally guaranteed post-session.resume ordering	✅ E2E added

No consistency gaps found

• The fix is structurally identical across all five languages that needed it: move registerInterest inside the block that executes after session.resume returns.
• Java's correct pre-existing behavior (the registerInterest call was already inside the thenCompose(response -> ...) callback on line 784 of CopilotClient.java) confirms the fix in other SDKs is the right approach.
• Error-handling paths (cleanup on failure) are preserved in all SDKs.
• The shared replay snapshot (test/snapshots/session/resumes_a_persisted_session_from_a_new_client_when_an_mcp_oauth_handler_is_configured.yaml) is used by Java, while the Go test uses a separate snapshot under test/snapshots/resume_mcp_oauth/ — both are present in this PR.

Minor note: The PR title says "Fix MCP OAuth resume order in Node.js SDK" but the fix spans all five affected SDKs. Consider updating the title, though this is purely cosmetic.

Generated by SDK Consistency Review Agent for issue #1861 · sonnet46 1.2M · ◷