Flaky: OAuth storage test clears the real ~/.mcp-inspector store, racing other worktrees #2668

The problem

clients/web/src/test/integration/auth/node/storage.test.ts › NodeOAuthStorage with custom storagePath › clearAllOAuthClientState clears every server in the default store constructs new NodeOAuthStorage() with no path and calls clearAllOAuthClientState(). With no MCP_INSPECTOR_OAUTH_STATE_PATH or MCP_STORAGE_DIR set (no test config sets either), both resolve to DEFAULT_STATE_PATH — ~/.mcp-inspector/storage/oauth.json, the real store (core/auth/node/storage-node.ts:14).

That has two consequences:

1. It is shared across every worktree on the machine. Two suites running this file at once (the normal multi-worktree setup) write and clear the same file, so one sees the other's tokens. It failed once in a full local:gate while I was working on Flaky: server-auto-open.test.ts races for its port and process.exit(1)s under load #2602:

   FAIL |integration| clients/web/src/test/integration/auth/node/storage.test.ts > NodeOAuthStorage with custom storagePath > clearAllOAuthClientState clears every server in the default store
   AssertionError: expected { access_token: 'a', …(1) } to be undefined
     595|     expect(await storage.getTokens("http://server-a.test")).toBeUndefined();
   

   Run alone, the file passed 5/5, and the next gate's coverage stage was green.
2. Running the suite wipes the developer's real Inspector OAuth state. clearAllOAuthClientState() on the default store clears every server's saved tokens and client registrations, not just the test's.

Reproduce

Needs concurrency: run the web integration project in two worktrees at the same time, or save a real OAuth login in the Inspector, then run this file and see that it's gone.

Expected

The test exercises the "default store" code path without touching the real one: point the default at a per-test temp directory (e.g. set MCP_STORAGE_DIR to a mkdtemp dir in beforeEach and restore it in afterEach, resetting the storage cache), so no test ever reads or writes ~/.mcp-inspector. Worth checking whether any other test in that file or elsewhere also hits DEFAULT_STATE_PATH.

Priority score

Severity 4 (the pre-push gate goes red on unrelated diffs, and running the suite deletes a developer's real saved OAuth state) + Urgency 3 (wanted this milestone; it reddens local:gate) + bug +1 = 8 → Medium.

Found while working on #2602.