Fix MCP OAuth resume order in Node.js SDK

resumeSession issued the session-scoped session.eventLog.registerInterest RPC for mcp.oauth_required BEFORE session.resume. The runtime only registers the session in its routing table while handling session.resume, so a fresh process resuming a persisted session rejected the pre-resume registerInterest with 'Session not found for sessionId: <id>'. VS Code always passes onMcpAuthRequest, so every resume threw.

Move the registerInterest block to after the session.resume response is processed, mirroring the already-correct createSession path. Add a unit test asserting resume is sent before registerInterest, and an e2e test that reproduces the runtime error end-to-end via a fresh-client resume.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: MackinnonBuck

nodejs/src/client.ts

@@ -1575,12 +1575,6 @@ export class CopilotClient {
         }
         this.sessions.set(sessionId, session);
         this.setupSessionFs(session, config);
-        if (config.onMcpAuthRequest) {
-            await this.connection!.sendRequest("session.eventLog.registerInterest", {
-                sessionId,
-                eventType: "mcp.oauth_required",
-            });
-        }
 
         const toolFilterOptions = this.resolveToolFilterOptions(config);
 
@@ -1671,6 +1665,12 @@ export class CopilotClient {
             session["_workspacePath"] = workspacePath;
             session.setCapabilities(capabilities);
             session.setOpenCanvases(openCanvases ?? []);
+            if (config.onMcpAuthRequest) {
+                await this.connection!.sendRequest("session.eventLog.registerInterest", {
+                    sessionId,
+                    eventType: "mcp.oauth_required",
+                });
+            }
 
             await this.updateSessionOptionsForMode(session, config);
         } catch (e) {

nodejs/test/client.test.ts

@@ -220,7 +220,7 @@ describe("CopilotClient", () => {
         ]);
     });
 
-    it("registers MCP OAuth interest before resuming only when an auth handler is configured", async () => {
+    it("registers MCP OAuth interest after resuming only when an auth handler is configured", async () => {
         const client = new CopilotClient();
         await client.start();
         onTestFinished(() => client.forceStop());
@@ -240,12 +240,23 @@ describe("CopilotClient", () => {
             onMcpAuthRequest: () => ({ kind: "cancelled" }),
         });
 
-        expect(spy.mock.calls[0]).toEqual([
-            "session.eventLog.registerInterest",
-            { sessionId: "session-with-auth", eventType: "mcp.oauth_required" },
-        ]);
-        expect(spy.mock.calls[1][0]).toBe("session.resume");
-        expect(spy.mock.calls[1][1]).toEqual(expect.objectContaining({ requestPermission: true }));
+        // `session.eventLog.registerInterest` is session-scoped: the runtime only
+        // registers the session id while handling `session.resume`, so resume must
+        // be sent BEFORE registering interest.
+        const resumeIndex = spy.mock.calls.findIndex(([method]) => method === "session.resume");
+        const interestIndex = spy.mock.calls.findIndex(
+            ([method]) => method === "session.eventLog.registerInterest"
+        );
+        expect(resumeIndex).toBeGreaterThanOrEqual(0);
+        expect(interestIndex).toBeGreaterThanOrEqual(0);
+        expect(resumeIndex).toBeLessThan(interestIndex);
+        expect(spy.mock.calls[resumeIndex][1]).toEqual(
+            expect.objectContaining({ sessionId: "session-with-auth", requestPermission: true })
+        );
+        expect(spy.mock.calls[interestIndex][1]).toEqual({
+            sessionId: "session-with-auth",
+            eventType: "mcp.oauth_required",
+        });
 
         spy.mockClear();
         await client.resumeSession("session-without-auth", {

nodejs/test/e2e/session.e2e.test.ts

@@ -2,7 +2,7 @@ import { rm } from "fs/promises";
 import { describe, expect, it, onTestFinished, vi } from "vitest";
 import { ParsedHttpExchange } from "../../../test/harness/replayingCapiProxy.js";
 import { CopilotClient, approveAll, defineTool, RuntimeConnection } from "../../src/index.js";
-import { createSdkTestContext, isCI } from "./harness/sdkTestContext.js";
+import { createSdkTestContext, DEFAULT_GITHUB_TOKEN, isCI } from "./harness/sdkTestContext.js";
 import { getFinalAssistantMessage, getNextEventOfType, retry } from "./harness/sdkTestHelper.js";
 
 describe("Sessions", async () => {
@@ -464,6 +464,38 @@ describe("Sessions", async () => {
         expect(session2.sessionId).toBe(sessionId);
     });
 
+    it("resumes a persisted session from a new client when an MCP OAuth handler is configured", async () => {
+        // Take a turn so the session is persisted to the store and can be
+        // loaded by a different CLI process.
+        const session1 = await client.createSession({
+            onPermissionRequest: approveAll,
+            onMcpAuthRequest: () => ({ kind: "cancelled" }),
+        });
+        const sessionId = session1.sessionId;
+        const answer = await session1.sendAndWait({ prompt: "What is 1+1?" });
+        expect(answer?.data.content).toContain("2");
+
+        // Resume from a fresh client (new CLI process). Its routing table does
+        // not know the session until it handles `session.resume`. Because an MCP
+        // OAuth handler is configured, the SDK issues a session-scoped
+        // `session.eventLog.registerInterest` for `mcp.oauth_required`; that must
+        // be sent AFTER `session.resume`, otherwise the runtime rejects it with
+        // "Session not found: <id>".
+        const newClient = new CopilotClient({
+            env,
+            gitHubToken: DEFAULT_GITHUB_TOKEN,
+        });
+        onTestFinished(() => newClient.forceStop());
+
+        const session2 = await newClient.resumeSession(sessionId, {
+            onPermissionRequest: approveAll,
+            onMcpAuthRequest: () => ({ kind: "cancelled" }),
+        });
+
+        expect(session2.sessionId).toBe(sessionId);
+        await session2.disconnect();
+    });
+
     it("should abort a session", async () => {
         const session = await client.createSession({ onPermissionRequest: approveAll });
 

test/snapshots/session/resumes_a_persisted_session_from_a_new_client_when_an_mcp_oauth_handler_is_configured.yaml

@@ -0,0 +1,10 @@
+models:
+  - claude-sonnet-4.5
+conversations:
+  - messages:
+      - role: system
+        content: ${system}
+      - role: user
+        content: What is 1+1?
+      - role: assistant
+        content: 1 + 1 = 2