fix(mcp): complete hosted OAuth across Dashboard and Desktop

[teknium1]

Summary

Hosted MCP OAuth now completes through both the Web Dashboard and Desktop without loopback callbacks, while keeping profile credentials isolated and reauthorization atomic.

This salvages #66090 from @benbarclay onto current main and hardens the shared OAuth lifecycle discovered during review.

Changes

• Preserve the MCP SDK as the authority for DCR, PKCE, state validation, token exchange, and persistence.
• Route hosted callbacks through a stable public endpoint compatible with pre-registered clients.
• Key cached OAuth providers by Hermes home plus server name so profiles cannot share tokens or provider state.
• Resolve selected-profile secrets through an isolated secret scope instead of process-global environment state.
• Serialize callback transitions and reauthorization, preserve tokens on failed reauth, and reconnect live MCP tasks after success.
• Bound pending hosted flows and isolate same-named servers across profiles.
• Update both Web Dashboard and Desktop clients to open the authorization URL and poll the authenticated flow status.

Validation

Check	Result
Targeted MCP/dashboard Python suites	216 passed
Web OAuth tests	4 passed
Web TypeScript typecheck	passed
Desktop OAuth tests	1 passed
Desktop changed-file ESLint	passed
Python ruff / compile / diff check	passed

Authorship

• Ben Barclay: original hosted Dashboard OAuth implementation and hardening commits from fix(mcp): complete OAuth through hosted dashboards #66090.
• Teknium: profile isolation, stable callback compatibility, atomic lifecycle, live reconnect, and Desktop parity follow-up.

Infographic

[alt-glitch]

This was generated by AI during triage.

Related: salvages and extends #66090 with Desktop parity and profile-isolated hosted OAuth lifecycle handling.

[tonydwb]

Code Review Summary

Verdict: Comment

Completes hosted OAuth flow across Dashboard and Desktop (83K diff, 10 files). Given the OAuth/security scope, recommend human reviewer give final approval. OAuth implementation patterns should be verified by someone with direct access.

---

Reviewed by Hermes Agent