fix(mcp): invalidate cached sessions when DynamicHeaders change

The ClientManager cached MCP sessions by server name but never checked
if the authentication headers had changed. When Safari restarts with
different credentials (e.g. SAFARI_FLASHDUTY_MCP_APP_KEY override), the
runner kept reusing the stale session with old headers, causing 401
Unauthorized errors on tool calls.

Now we hash both static and dynamic headers at session creation time and
compare on reuse. If headers differ, the stale session is closed and a
new one is created with the current credentials.

Also adds masked auth_key (first 6 chars) to session lifecycle logs for
easier debugging without leaking secrets.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: ysyneu

mcp/client.go

@@ -3,8 +3,10 @@ package mcp
 
 import (
 	"context"
+	"crypto/sha256"
 	"fmt"
 	"log/slog"
+	"sort"
 	"strings"
 	"sync"
 	"time"
@@ -31,17 +33,23 @@ type ClientManager struct {
 	mu       sync.Mutex
 	clients  map[string]*sdk_mcp.Client
 	sessions map[string]*sdk_mcp.ClientSession
+	// headerHashes tracks the hash of headers used when creating each session,
+	// so we can detect when DynamicHeaders change and invalidate stale sessions.
+	headerHashes map[string]string
 }
 
 // NewClientManager creates a new ClientManager.
 func NewClientManager() *ClientManager {
 	return &ClientManager{
-		clients:  make(map[string]*sdk_mcp.Client),
-		sessions: make(map[string]*sdk_mcp.ClientSession),
+		clients:      make(map[string]*sdk_mcp.Client),
+		sessions:     make(map[string]*sdk_mcp.ClientSession),
+		headerHashes: make(map[string]string),
 	}
 }
 
 // GetSession returns or creates an MCP session for the given server.
+// Sessions are cached by server name. If DynamicHeaders change (e.g. a different
+// user or rotated credentials), the stale session is invalidated and recreated.
 func (m *ClientManager) GetSession(ctx context.Context, server *protocol.MCPServerConfig, logger *slog.Logger) (*sdk_mcp.ClientSession, error) {
 	if logger == nil {
 		logger = slog.With("server", server.Name)
@@ -51,34 +59,43 @@ func (m *ClientManager) GetSession(ctx context.Context, server *protocol.MCPServ
 	defer m.mu.Unlock()
 
 	serverName := server.Name
+	currentHash := hashHeaders(server.Headers, server.DynamicHeaders)
 
 	logger.Debug("mcp resolving session",
 		"transport", server.Transport,
 		"url", server.URL,
 		"command", server.Command,
+		"auth_key", maskKey(server.DynamicHeaders["Authorization"]),
 	)
 
-	// Check if session exists and is still valid
+	// Check if session exists and headers haven't changed
 	if session, ok := m.sessions[serverName]; ok {
-		logger.Debug("mcp reusing session")
-		return session, nil
+		if m.headerHashes[serverName] == currentHash {
+			logger.Debug("mcp reusing session")
+			return session, nil
+		}
+		logger.Info("mcp headers changed, invalidating cached session",
+			"server", serverName,
+		)
+		_ = session.Close()
+		delete(m.sessions, serverName)
+		delete(m.clients, serverName)
+		delete(m.headerHashes, serverName)
 	}
 
-	// Create client if not exists
-	client, ok := m.clients[serverName]
-	if !ok {
-		client = sdk_mcp.NewClient(&sdk_mcp.Implementation{
-			Name:    "flashduty-runner",
-			Version: "1.0.0",
-		}, nil)
-		m.clients[serverName] = client
-	}
+	// Create client
+	client := sdk_mcp.NewClient(&sdk_mcp.Implementation{
+		Name:    "flashduty-runner",
+		Version: "1.0.0",
+	}, nil)
+	m.clients[serverName] = client
 
 	// Create transport
 	logger.Info("mcp creating transport",
 		"transport", server.Transport,
 		"url", server.URL,
 		"command", server.Command,
+		"auth_key", maskKey(server.DynamicHeaders["Authorization"]),
 	)
 
 	transport, err := createTransport(server)
@@ -103,8 +120,11 @@ func (m *ClientManager) GetSession(ctx context.Context, server *protocol.MCPServ
 		return nil, fmt.Errorf("failed to connect to MCP server '%s': %w", serverName, err)
 	}
 
-	logger.Info("mcp connected")
+	logger.Info("mcp connected",
+		"auth_key", maskKey(server.DynamicHeaders["Authorization"]),
+	)
 	m.sessions[serverName] = session
+	m.headerHashes[serverName] = currentHash
 	return session, nil
 }
 
@@ -174,9 +194,46 @@ func (m *ClientManager) ListTools(ctx context.Context, server *protocol.MCPServe
 func (m *ClientManager) invalidateSession(serverName string) {
 	m.mu.Lock()
 	delete(m.sessions, serverName)
+	delete(m.headerHashes, serverName)
 	m.mu.Unlock()
 }
 
+// hashHeaders computes a stable hash of both static and dynamic headers.
+// Used to detect when credentials change so stale sessions are invalidated.
+func hashHeaders(headers, dynamicHeaders map[string]string) string {
+	h := sha256.New()
+	// Sort keys for deterministic hashing
+	writeMap := func(m map[string]string) {
+		keys := make([]string, 0, len(m))
+		for k := range m {
+			keys = append(keys, k)
+		}
+		sort.Strings(keys)
+		for _, k := range keys {
+			h.Write([]byte(k))
+			h.Write([]byte(m[k]))
+		}
+	}
+	h.Write([]byte("static:"))
+	writeMap(headers)
+	h.Write([]byte("dynamic:"))
+	writeMap(dynamicHeaders)
+	return fmt.Sprintf("%x", h.Sum(nil))
+}
+
+// maskKey returns the first 6 characters of a key for safe logging.
+// Returns empty string for empty/short keys.
+func maskKey(key string) string {
+	// Strip "Bearer " prefix if present
+	if strings.HasPrefix(key, "Bearer ") {
+		key = key[7:]
+	}
+	if len(key) <= 6 {
+		return key
+	}
+	return key[:6] + "***"
+}
+
 // Close closes all active sessions and clients.
 func (m *ClientManager) Close() {
 	m.mu.Lock()

mcp/transport.go

@@ -41,6 +41,7 @@ func NewSSETransport(endpoint string, headers map[string]string, dynamicHeaders
 		"endpoint", endpoint,
 		"headers_count", len(headers),
 		"dynamic_headers_count", len(dynamicHeaders),
+		"auth_key", maskKey(dynamicHeaders["Authorization"]),
 	)
 
 	return &sdk_mcp.StreamableClientTransport{