fix(auth): avoid SSE OAuth refresh deadlock

[pragnyanramtha]

Summary

• preflight OAuth token refresh before opening the long-lived SSE GET
• add the refreshed bearer token directly to the SSE request and disable HTTPX auth for that stream request
• keep the OAuth-enabled client for normal POST requests so existing refresh/full-auth behavior remains intact

Fixes #1326.

Validation

• uv run pytest tests/client/test_auth.py tests/shared/test_sse.py -q
• uv run pyright src/mcp/client/auth/oauth2.py src/mcp/client/sse.py tests/client/test_auth.py tests/shared/test_sse.py
• uv run ruff check src/mcp/client/auth/oauth2.py src/mcp/client/sse.py tests/client/test_auth.py tests/shared/test_sse.py
• uv run ruff format --check src/mcp/client/auth/oauth2.py src/mcp/client/sse.py tests/client/test_auth.py tests/shared/test_sse.py
• git diff --check

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a preflight OAuth token refresh step before opening SSE streams to avoid OAuth generator/streaming deadlocks, with regression tests covering refreshed/valid/missing-refresh-token/failure scenarios.

Changes:

• Add _prepare_request_with_refresh() to OAuthClientProvider for refreshing tokens and injecting a Bearer header outside the normal auth flow.
• Update sse_client() to preflight-refresh OAuth before starting the SSE connection and disable per-request auth when a Bearer header is pre-injected.
• Add/extend tests for SSE OAuth preflight refresh and for the new OAuth preflight helper behavior.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
src/mcp/client/sse.py	Preflights OAuth refresh and injects Authorization header for SSE stream requests.
src/mcp/client/auth/oauth2.py	Introduces _prepare_request_with_refresh() helper to refresh and set Bearer header outside async_auth_flow.
tests/shared/test_sse.py	Adds regression tests ensuring SSE uses preflight Bearer header and avoids auth flow on the stream.
tests/client/test_auth.py	Adds unit tests for _prepare_request_with_refresh() across refresh/skip/init/no-refresh-token/failure cases.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[maxisbey]

Thanks for the PR, and sorry it sat here without a proper review.

We're closing most of the open PR backlog. v2 is out and changed a lot of the SDK, so many older PRs no longer apply as written, and we're a small team that realistically doesn't have the capacity to work through the rest.

If this still matters to you on v2, the most useful thing you can do is open an issue (or comment on the existing one) with your use case and a repro. Hearing why it matters to you is what we use to decide what to prioritise.

_{AI Disclaimer}